xref: /netbsd-src/sys/net/if_tap.c (revision b7b7574d3bf8eeb51a1fa3977b59142ec6434a55)
1 /*	$NetBSD: if_tap.c,v 1.76 2014/05/07 22:53:34 cube Exp $	*/
2 
3 /*
4  *  Copyright (c) 2003, 2004, 2008, 2009 The NetBSD Foundation.
5  *  All rights reserved.
6  *
7  *  Redistribution and use in source and binary forms, with or without
8  *  modification, are permitted provided that the following conditions
9  *  are met:
10  *  1. Redistributions of source code must retain the above copyright
11  *     notice, this list of conditions and the following disclaimer.
12  *  2. Redistributions in binary form must reproduce the above copyright
13  *     notice, this list of conditions and the following disclaimer in the
14  *     documentation and/or other materials provided with the distribution.
15  *
16  *  THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  *  ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  *  TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  *  PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  *  BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  *  POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * tap(4) is a virtual Ethernet interface.  It appears as a real Ethernet
31  * device to the system, but can also be accessed by userland through a
32  * character device interface, which allows reading and injecting frames.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: if_tap.c,v 1.76 2014/05/07 22:53:34 cube Exp $");
37 
38 #if defined(_KERNEL_OPT)
39 
40 #include "opt_modular.h"
41 #include "opt_compat_netbsd.h"
42 #endif
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/kernel.h>
47 #include <sys/malloc.h>
48 #include <sys/conf.h>
49 #include <sys/cprng.h>
50 #include <sys/device.h>
51 #include <sys/file.h>
52 #include <sys/filedesc.h>
53 #include <sys/ksyms.h>
54 #include <sys/poll.h>
55 #include <sys/proc.h>
56 #include <sys/select.h>
57 #include <sys/sockio.h>
58 #if defined(COMPAT_40) || defined(MODULAR)
59 #include <sys/sysctl.h>
60 #endif
61 #include <sys/kauth.h>
62 #include <sys/mutex.h>
63 #include <sys/intr.h>
64 #include <sys/stat.h>
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_ether.h>
69 #include <net/if_media.h>
70 #include <net/if_tap.h>
71 #include <net/bpf.h>
72 
73 #include <compat/sys/sockio.h>
74 
75 #if defined(COMPAT_40) || defined(MODULAR)
76 /*
77  * sysctl node management
78  *
79  * It's not really possible to use a SYSCTL_SETUP block with
80  * current module implementation, so it is easier to just define
81  * our own function.
82  *
83  * The handler function is a "helper" in Andrew Brown's sysctl
84  * framework terminology.  It is used as a gateway for sysctl
85  * requests over the nodes.
86  *
87  * tap_log allows the module to log creations of nodes and
88  * destroy them all at once using sysctl_teardown.
89  */
90 static int tap_node;
91 static int	tap_sysctl_handler(SYSCTLFN_PROTO);
92 SYSCTL_SETUP_PROTO(sysctl_tap_setup);
93 #endif
94 
95 /*
96  * Since we're an Ethernet device, we need the 2 following
97  * components: a struct ethercom and a struct ifmedia
98  * since we don't attach a PHY to ourselves.
99  * We could emulate one, but there's no real point.
100  */
101 
102 struct tap_softc {
103 	device_t	sc_dev;
104 	struct ifmedia	sc_im;
105 	struct ethercom	sc_ec;
106 	int		sc_flags;
107 #define	TAP_INUSE	0x00000001	/* tap device can only be opened once */
108 #define TAP_ASYNCIO	0x00000002	/* user is using async I/O (SIGIO) on the device */
109 #define TAP_NBIO	0x00000004	/* user wants calls to avoid blocking */
110 #define TAP_GOING	0x00000008	/* interface is being destroyed */
111 	struct selinfo	sc_rsel;
112 	pid_t		sc_pgid; /* For async. IO */
113 	kmutex_t	sc_rdlock;
114 	kmutex_t	sc_kqlock;
115 	void		*sc_sih;
116 	struct timespec sc_atime;
117 	struct timespec sc_mtime;
118 	struct timespec sc_btime;
119 };
120 
121 /* autoconf(9) glue */
122 
123 void	tapattach(int);
124 
125 static int	tap_match(device_t, cfdata_t, void *);
126 static void	tap_attach(device_t, device_t, void *);
127 static int	tap_detach(device_t, int);
128 
129 CFATTACH_DECL_NEW(tap, sizeof(struct tap_softc),
130     tap_match, tap_attach, tap_detach, NULL);
131 extern struct cfdriver tap_cd;
132 
133 /* Real device access routines */
134 static int	tap_dev_close(struct tap_softc *);
135 static int	tap_dev_read(int, struct uio *, int);
136 static int	tap_dev_write(int, struct uio *, int);
137 static int	tap_dev_ioctl(int, u_long, void *, struct lwp *);
138 static int	tap_dev_poll(int, int, struct lwp *);
139 static int	tap_dev_kqfilter(int, struct knote *);
140 
141 /* Fileops access routines */
142 static int	tap_fops_close(file_t *);
143 static int	tap_fops_read(file_t *, off_t *, struct uio *,
144     kauth_cred_t, int);
145 static int	tap_fops_write(file_t *, off_t *, struct uio *,
146     kauth_cred_t, int);
147 static int	tap_fops_ioctl(file_t *, u_long, void *);
148 static int	tap_fops_poll(file_t *, int);
149 static int	tap_fops_stat(file_t *, struct stat *);
150 static int	tap_fops_kqfilter(file_t *, struct knote *);
151 
152 static const struct fileops tap_fileops = {
153 	.fo_read = tap_fops_read,
154 	.fo_write = tap_fops_write,
155 	.fo_ioctl = tap_fops_ioctl,
156 	.fo_fcntl = fnullop_fcntl,
157 	.fo_poll = tap_fops_poll,
158 	.fo_stat = tap_fops_stat,
159 	.fo_close = tap_fops_close,
160 	.fo_kqfilter = tap_fops_kqfilter,
161 	.fo_restart = fnullop_restart,
162 };
163 
164 /* Helper for cloning open() */
165 static int	tap_dev_cloner(struct lwp *);
166 
167 /* Character device routines */
168 static int	tap_cdev_open(dev_t, int, int, struct lwp *);
169 static int	tap_cdev_close(dev_t, int, int, struct lwp *);
170 static int	tap_cdev_read(dev_t, struct uio *, int);
171 static int	tap_cdev_write(dev_t, struct uio *, int);
172 static int	tap_cdev_ioctl(dev_t, u_long, void *, int, struct lwp *);
173 static int	tap_cdev_poll(dev_t, int, struct lwp *);
174 static int	tap_cdev_kqfilter(dev_t, struct knote *);
175 
176 const struct cdevsw tap_cdevsw = {
177 	.d_open = tap_cdev_open,
178 	.d_close = tap_cdev_close,
179 	.d_read = tap_cdev_read,
180 	.d_write = tap_cdev_write,
181 	.d_ioctl = tap_cdev_ioctl,
182 	.d_stop = nostop,
183 	.d_tty = notty,
184 	.d_poll = tap_cdev_poll,
185 	.d_mmap = nommap,
186 	.d_kqfilter = tap_cdev_kqfilter,
187 	.d_flag = D_OTHER
188 };
189 
190 #define TAP_CLONER	0xfffff		/* Maximal minor value */
191 
192 /* kqueue-related routines */
193 static void	tap_kqdetach(struct knote *);
194 static int	tap_kqread(struct knote *, long);
195 
196 /*
197  * Those are needed by the if_media interface.
198  */
199 
200 static int	tap_mediachange(struct ifnet *);
201 static void	tap_mediastatus(struct ifnet *, struct ifmediareq *);
202 
203 /*
204  * Those are needed by the ifnet interface, and would typically be
205  * there for any network interface driver.
206  * Some other routines are optional: watchdog and drain.
207  */
208 
209 static void	tap_start(struct ifnet *);
210 static void	tap_stop(struct ifnet *, int);
211 static int	tap_init(struct ifnet *);
212 static int	tap_ioctl(struct ifnet *, u_long, void *);
213 
214 /* Internal functions */
215 #if defined(COMPAT_40) || defined(MODULAR)
216 static int	tap_lifaddr(struct ifnet *, u_long, struct ifaliasreq *);
217 #endif
218 static void	tap_softintr(void *);
219 
220 /*
221  * tap is a clonable interface, although it is highly unrealistic for
222  * an Ethernet device.
223  *
224  * Here are the bits needed for a clonable interface.
225  */
226 static int	tap_clone_create(struct if_clone *, int);
227 static int	tap_clone_destroy(struct ifnet *);
228 
229 struct if_clone tap_cloners = IF_CLONE_INITIALIZER("tap",
230 					tap_clone_create,
231 					tap_clone_destroy);
232 
233 /* Helper functionis shared by the two cloning code paths */
234 static struct tap_softc *	tap_clone_creator(int);
235 int	tap_clone_destroyer(device_t);
236 
237 void
238 tapattach(int n)
239 {
240 	int error;
241 
242 	error = config_cfattach_attach(tap_cd.cd_name, &tap_ca);
243 	if (error) {
244 		aprint_error("%s: unable to register cfattach\n",
245 		    tap_cd.cd_name);
246 		(void)config_cfdriver_detach(&tap_cd);
247 		return;
248 	}
249 
250 	if_clone_attach(&tap_cloners);
251 }
252 
253 /* Pretty much useless for a pseudo-device */
254 static int
255 tap_match(device_t parent, cfdata_t cfdata, void *arg)
256 {
257 
258 	return (1);
259 }
260 
261 void
262 tap_attach(device_t parent, device_t self, void *aux)
263 {
264 	struct tap_softc *sc = device_private(self);
265 	struct ifnet *ifp;
266 #if defined(COMPAT_40) || defined(MODULAR)
267 	const struct sysctlnode *node;
268 	int error;
269 #endif
270 	uint8_t enaddr[ETHER_ADDR_LEN] =
271 	    { 0xf2, 0x0b, 0xa4, 0xff, 0xff, 0xff };
272 	char enaddrstr[3 * ETHER_ADDR_LEN];
273 
274 	sc->sc_dev = self;
275 	sc->sc_sih = NULL;
276 	getnanotime(&sc->sc_btime);
277 	sc->sc_atime = sc->sc_mtime = sc->sc_btime;
278 
279 	if (!pmf_device_register(self, NULL, NULL))
280 		aprint_error_dev(self, "couldn't establish power handler\n");
281 
282 	/*
283 	 * In order to obtain unique initial Ethernet address on a host,
284 	 * do some randomisation.  It's not meant for anything but avoiding
285 	 * hard-coding an address.
286 	 */
287 	cprng_fast(&enaddr[3], 3);
288 
289 	aprint_verbose_dev(self, "Ethernet address %s\n",
290 	    ether_snprintf(enaddrstr, sizeof(enaddrstr), enaddr));
291 
292 	/*
293 	 * Why 1000baseT? Why not? You can add more.
294 	 *
295 	 * Note that there are 3 steps: init, one or several additions to
296 	 * list of supported media, and in the end, the selection of one
297 	 * of them.
298 	 */
299 	ifmedia_init(&sc->sc_im, 0, tap_mediachange, tap_mediastatus);
300 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_1000_T, 0, NULL);
301 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_1000_T|IFM_FDX, 0, NULL);
302 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_100_TX, 0, NULL);
303 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
304 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_10_T, 0, NULL);
305 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
306 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_AUTO, 0, NULL);
307 	ifmedia_set(&sc->sc_im, IFM_ETHER|IFM_AUTO);
308 
309 	/*
310 	 * One should note that an interface must do multicast in order
311 	 * to support IPv6.
312 	 */
313 	ifp = &sc->sc_ec.ec_if;
314 	strcpy(ifp->if_xname, device_xname(self));
315 	ifp->if_softc	= sc;
316 	ifp->if_flags	= IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
317 	ifp->if_ioctl	= tap_ioctl;
318 	ifp->if_start	= tap_start;
319 	ifp->if_stop	= tap_stop;
320 	ifp->if_init	= tap_init;
321 	IFQ_SET_READY(&ifp->if_snd);
322 
323 	sc->sc_ec.ec_capabilities = ETHERCAP_VLAN_MTU | ETHERCAP_JUMBO_MTU;
324 
325 	/* Those steps are mandatory for an Ethernet driver, the fisrt call
326 	 * being common to all network interface drivers. */
327 	if_attach(ifp);
328 	ether_ifattach(ifp, enaddr);
329 
330 	sc->sc_flags = 0;
331 
332 #if defined(COMPAT_40) || defined(MODULAR)
333 	/*
334 	 * Add a sysctl node for that interface.
335 	 *
336 	 * The pointer transmitted is not a string, but instead a pointer to
337 	 * the softc structure, which we can use to build the string value on
338 	 * the fly in the helper function of the node.  See the comments for
339 	 * tap_sysctl_handler for details.
340 	 *
341 	 * Usually sysctl_createv is called with CTL_CREATE as the before-last
342 	 * component.  However, we can allocate a number ourselves, as we are
343 	 * the only consumer of the net.link.<iface> node.  In this case, the
344 	 * unit number is conveniently used to number the node.  CTL_CREATE
345 	 * would just work, too.
346 	 */
347 	if ((error = sysctl_createv(NULL, 0, NULL,
348 	    &node, CTLFLAG_READWRITE,
349 	    CTLTYPE_STRING, device_xname(self), NULL,
350 	    tap_sysctl_handler, 0, (void *)sc, 18,
351 	    CTL_NET, AF_LINK, tap_node, device_unit(sc->sc_dev),
352 	    CTL_EOL)) != 0)
353 		aprint_error_dev(self, "sysctl_createv returned %d, ignoring\n",
354 		    error);
355 #endif
356 
357 	/*
358 	 * Initialize the two locks for the device.
359 	 *
360 	 * We need a lock here because even though the tap device can be
361 	 * opened only once, the file descriptor might be passed to another
362 	 * process, say a fork(2)ed child.
363 	 *
364 	 * The Giant saves us from most of the hassle, but since the read
365 	 * operation can sleep, we don't want two processes to wake up at
366 	 * the same moment and both try and dequeue a single packet.
367 	 *
368 	 * The queue for event listeners (used by kqueue(9), see below) has
369 	 * to be protected too, so use a spin lock.
370 	 */
371 	mutex_init(&sc->sc_rdlock, MUTEX_DEFAULT, IPL_NONE);
372 	mutex_init(&sc->sc_kqlock, MUTEX_DEFAULT, IPL_VM);
373 
374 	selinit(&sc->sc_rsel);
375 }
376 
377 /*
378  * When detaching, we do the inverse of what is done in the attach
379  * routine, in reversed order.
380  */
381 static int
382 tap_detach(device_t self, int flags)
383 {
384 	struct tap_softc *sc = device_private(self);
385 	struct ifnet *ifp = &sc->sc_ec.ec_if;
386 #if defined(COMPAT_40) || defined(MODULAR)
387 	int error;
388 #endif
389 	int s;
390 
391 	sc->sc_flags |= TAP_GOING;
392 	s = splnet();
393 	tap_stop(ifp, 1);
394 	if_down(ifp);
395 	splx(s);
396 
397 	if (sc->sc_sih != NULL) {
398 		softint_disestablish(sc->sc_sih);
399 		sc->sc_sih = NULL;
400 	}
401 
402 #if defined(COMPAT_40) || defined(MODULAR)
403 	/*
404 	 * Destroying a single leaf is a very straightforward operation using
405 	 * sysctl_destroyv.  One should be sure to always end the path with
406 	 * CTL_EOL.
407 	 */
408 	if ((error = sysctl_destroyv(NULL, CTL_NET, AF_LINK, tap_node,
409 	    device_unit(sc->sc_dev), CTL_EOL)) != 0)
410 		aprint_error_dev(self,
411 		    "sysctl_destroyv returned %d, ignoring\n", error);
412 #endif
413 	ether_ifdetach(ifp);
414 	if_detach(ifp);
415 	ifmedia_delete_instance(&sc->sc_im, IFM_INST_ANY);
416 	seldestroy(&sc->sc_rsel);
417 	mutex_destroy(&sc->sc_rdlock);
418 	mutex_destroy(&sc->sc_kqlock);
419 
420 	pmf_device_deregister(self);
421 
422 	return (0);
423 }
424 
425 /*
426  * This function is called by the ifmedia layer to notify the driver
427  * that the user requested a media change.  A real driver would
428  * reconfigure the hardware.
429  */
430 static int
431 tap_mediachange(struct ifnet *ifp)
432 {
433 	return (0);
434 }
435 
436 /*
437  * Here the user asks for the currently used media.
438  */
439 static void
440 tap_mediastatus(struct ifnet *ifp, struct ifmediareq *imr)
441 {
442 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
443 	imr->ifm_active = sc->sc_im.ifm_cur->ifm_media;
444 }
445 
446 /*
447  * This is the function where we SEND packets.
448  *
449  * There is no 'receive' equivalent.  A typical driver will get
450  * interrupts from the hardware, and from there will inject new packets
451  * into the network stack.
452  *
453  * Once handled, a packet must be freed.  A real driver might not be able
454  * to fit all the pending packets into the hardware, and is allowed to
455  * return before having sent all the packets.  It should then use the
456  * if_flags flag IFF_OACTIVE to notify the upper layer.
457  *
458  * There are also other flags one should check, such as IFF_PAUSE.
459  *
460  * It is our duty to make packets available to BPF listeners.
461  *
462  * You should be aware that this function is called by the Ethernet layer
463  * at splnet().
464  *
465  * When the device is opened, we have to pass the packet(s) to the
466  * userland.  For that we stay in OACTIVE mode while the userland gets
467  * the packets, and we send a signal to the processes waiting to read.
468  *
469  * wakeup(sc) is the counterpart to the tsleep call in
470  * tap_dev_read, while selnotify() is used for kevent(2) and
471  * poll(2) (which includes select(2)) listeners.
472  */
473 static void
474 tap_start(struct ifnet *ifp)
475 {
476 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
477 	struct mbuf *m0;
478 
479 	if ((sc->sc_flags & TAP_INUSE) == 0) {
480 		/* Simply drop packets */
481 		for(;;) {
482 			IFQ_DEQUEUE(&ifp->if_snd, m0);
483 			if (m0 == NULL)
484 				return;
485 
486 			ifp->if_opackets++;
487 			bpf_mtap(ifp, m0);
488 
489 			m_freem(m0);
490 		}
491 	} else if (!IFQ_IS_EMPTY(&ifp->if_snd)) {
492 		ifp->if_flags |= IFF_OACTIVE;
493 		wakeup(sc);
494 		selnotify(&sc->sc_rsel, 0, 1);
495 		if (sc->sc_flags & TAP_ASYNCIO)
496 			softint_schedule(sc->sc_sih);
497 	}
498 }
499 
500 static void
501 tap_softintr(void *cookie)
502 {
503 	struct tap_softc *sc;
504 	struct ifnet *ifp;
505 	int a, b;
506 
507 	sc = cookie;
508 
509 	if (sc->sc_flags & TAP_ASYNCIO) {
510 		ifp = &sc->sc_ec.ec_if;
511 		if (ifp->if_flags & IFF_RUNNING) {
512 			a = POLL_IN;
513 			b = POLLIN|POLLRDNORM;
514 		} else {
515 			a = POLL_HUP;
516 			b = 0;
517 		}
518 		fownsignal(sc->sc_pgid, SIGIO, a, b, NULL);
519 	}
520 }
521 
522 /*
523  * A typical driver will only contain the following handlers for
524  * ioctl calls, except SIOCSIFPHYADDR.
525  * The latter is a hack I used to set the Ethernet address of the
526  * faked device.
527  *
528  * Note that both ifmedia_ioctl() and ether_ioctl() have to be
529  * called under splnet().
530  */
531 static int
532 tap_ioctl(struct ifnet *ifp, u_long cmd, void *data)
533 {
534 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
535 	struct ifreq *ifr = (struct ifreq *)data;
536 	int s, error;
537 
538 	s = splnet();
539 
540 	switch (cmd) {
541 #ifdef OSIOCSIFMEDIA
542 	case OSIOCSIFMEDIA:
543 #endif
544 	case SIOCSIFMEDIA:
545 	case SIOCGIFMEDIA:
546 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_im, cmd);
547 		break;
548 #if defined(COMPAT_40) || defined(MODULAR)
549 	case SIOCSIFPHYADDR:
550 		error = tap_lifaddr(ifp, cmd, (struct ifaliasreq *)data);
551 		break;
552 #endif
553 	default:
554 		error = ether_ioctl(ifp, cmd, data);
555 		if (error == ENETRESET)
556 			error = 0;
557 		break;
558 	}
559 
560 	splx(s);
561 
562 	return (error);
563 }
564 
565 #if defined(COMPAT_40) || defined(MODULAR)
566 /*
567  * Helper function to set Ethernet address.  This has been replaced by
568  * the generic SIOCALIFADDR ioctl on a PF_LINK socket.
569  */
570 static int
571 tap_lifaddr(struct ifnet *ifp, u_long cmd, struct ifaliasreq *ifra)
572 {
573 	const struct sockaddr *sa = &ifra->ifra_addr;
574 
575 	if (sa->sa_family != AF_LINK)
576 		return (EINVAL);
577 
578 	if_set_sadl(ifp, sa->sa_data, ETHER_ADDR_LEN, false);
579 
580 	return (0);
581 }
582 #endif
583 
584 /*
585  * _init() would typically be called when an interface goes up,
586  * meaning it should configure itself into the state in which it
587  * can send packets.
588  */
589 static int
590 tap_init(struct ifnet *ifp)
591 {
592 	ifp->if_flags |= IFF_RUNNING;
593 
594 	tap_start(ifp);
595 
596 	return (0);
597 }
598 
599 /*
600  * _stop() is called when an interface goes down.  It is our
601  * responsability to validate that state by clearing the
602  * IFF_RUNNING flag.
603  *
604  * We have to wake up all the sleeping processes to have the pending
605  * read requests cancelled.
606  */
607 static void
608 tap_stop(struct ifnet *ifp, int disable)
609 {
610 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
611 
612 	ifp->if_flags &= ~IFF_RUNNING;
613 	wakeup(sc);
614 	selnotify(&sc->sc_rsel, 0, 1);
615 	if (sc->sc_flags & TAP_ASYNCIO)
616 		softint_schedule(sc->sc_sih);
617 }
618 
619 /*
620  * The 'create' command of ifconfig can be used to create
621  * any numbered instance of a given device.  Thus we have to
622  * make sure we have enough room in cd_devs to create the
623  * user-specified instance.  config_attach_pseudo will do this
624  * for us.
625  */
626 static int
627 tap_clone_create(struct if_clone *ifc, int unit)
628 {
629 	if (tap_clone_creator(unit) == NULL) {
630 		aprint_error("%s%d: unable to attach an instance\n",
631                     tap_cd.cd_name, unit);
632 		return (ENXIO);
633 	}
634 
635 	return (0);
636 }
637 
638 /*
639  * tap(4) can be cloned by two ways:
640  *   using 'ifconfig tap0 create', which will use the network
641  *     interface cloning API, and call tap_clone_create above.
642  *   opening the cloning device node, whose minor number is TAP_CLONER.
643  *     See below for an explanation on how this part work.
644  */
645 static struct tap_softc *
646 tap_clone_creator(int unit)
647 {
648 	struct cfdata *cf;
649 
650 	cf = malloc(sizeof(*cf), M_DEVBUF, M_WAITOK);
651 	cf->cf_name = tap_cd.cd_name;
652 	cf->cf_atname = tap_ca.ca_name;
653 	if (unit == -1) {
654 		/* let autoconf find the first free one */
655 		cf->cf_unit = 0;
656 		cf->cf_fstate = FSTATE_STAR;
657 	} else {
658 		cf->cf_unit = unit;
659 		cf->cf_fstate = FSTATE_NOTFOUND;
660 	}
661 
662 	return device_private(config_attach_pseudo(cf));
663 }
664 
665 /*
666  * The clean design of if_clone and autoconf(9) makes that part
667  * really straightforward.  The second argument of config_detach
668  * means neither QUIET nor FORCED.
669  */
670 static int
671 tap_clone_destroy(struct ifnet *ifp)
672 {
673 	struct tap_softc *sc = ifp->if_softc;
674 
675 	return tap_clone_destroyer(sc->sc_dev);
676 }
677 
678 int
679 tap_clone_destroyer(device_t dev)
680 {
681 	cfdata_t cf = device_cfdata(dev);
682 	int error;
683 
684 	if ((error = config_detach(dev, 0)) != 0)
685 		aprint_error_dev(dev, "unable to detach instance\n");
686 	free(cf, M_DEVBUF);
687 
688 	return (error);
689 }
690 
691 /*
692  * tap(4) is a bit of an hybrid device.  It can be used in two different
693  * ways:
694  *  1. ifconfig tapN create, then use /dev/tapN to read/write off it.
695  *  2. open /dev/tap, get a new interface created and read/write off it.
696  *     That interface is destroyed when the process that had it created exits.
697  *
698  * The first way is managed by the cdevsw structure, and you access interfaces
699  * through a (major, minor) mapping:  tap4 is obtained by the minor number
700  * 4.  The entry points for the cdevsw interface are prefixed by tap_cdev_.
701  *
702  * The second way is the so-called "cloning" device.  It's a special minor
703  * number (chosen as the maximal number, to allow as much tap devices as
704  * possible).  The user first opens the cloner (e.g., /dev/tap), and that
705  * call ends in tap_cdev_open.  The actual place where it is handled is
706  * tap_dev_cloner.
707  *
708  * An tap device cannot be opened more than once at a time, so the cdevsw
709  * part of open() does nothing but noting that the interface is being used and
710  * hence ready to actually handle packets.
711  */
712 
713 static int
714 tap_cdev_open(dev_t dev, int flags, int fmt, struct lwp *l)
715 {
716 	struct tap_softc *sc;
717 
718 	if (minor(dev) == TAP_CLONER)
719 		return tap_dev_cloner(l);
720 
721 	sc = device_lookup_private(&tap_cd, minor(dev));
722 	if (sc == NULL)
723 		return (ENXIO);
724 
725 	/* The device can only be opened once */
726 	if (sc->sc_flags & TAP_INUSE)
727 		return (EBUSY);
728 	sc->sc_flags |= TAP_INUSE;
729 	return (0);
730 }
731 
732 /*
733  * There are several kinds of cloning devices, and the most simple is the one
734  * tap(4) uses.  What it does is change the file descriptor with a new one,
735  * with its own fileops structure (which maps to the various read, write,
736  * ioctl functions).  It starts allocating a new file descriptor with falloc,
737  * then actually creates the new tap devices.
738  *
739  * Once those two steps are successful, we can re-wire the existing file
740  * descriptor to its new self.  This is done with fdclone():  it fills the fp
741  * structure as needed (notably f_data gets filled with the fifth parameter
742  * passed, the unit of the tap device which will allows us identifying the
743  * device later), and returns EMOVEFD.
744  *
745  * That magic value is interpreted by sys_open() which then replaces the
746  * current file descriptor by the new one (through a magic member of struct
747  * lwp, l_dupfd).
748  *
749  * The tap device is flagged as being busy since it otherwise could be
750  * externally accessed through the corresponding device node with the cdevsw
751  * interface.
752  */
753 
754 static int
755 tap_dev_cloner(struct lwp *l)
756 {
757 	struct tap_softc *sc;
758 	file_t *fp;
759 	int error, fd;
760 
761 	if ((error = fd_allocfile(&fp, &fd)) != 0)
762 		return (error);
763 
764 	if ((sc = tap_clone_creator(-1)) == NULL) {
765 		fd_abort(curproc, fp, fd);
766 		return (ENXIO);
767 	}
768 
769 	sc->sc_flags |= TAP_INUSE;
770 
771 	return fd_clone(fp, fd, FREAD|FWRITE, &tap_fileops,
772 	    (void *)(intptr_t)device_unit(sc->sc_dev));
773 }
774 
775 /*
776  * While all other operations (read, write, ioctl, poll and kqfilter) are
777  * really the same whether we are in cdevsw or fileops mode, the close()
778  * function is slightly different in the two cases.
779  *
780  * As for the other, the core of it is shared in tap_dev_close.  What
781  * it does is sufficient for the cdevsw interface, but the cloning interface
782  * needs another thing:  the interface is destroyed when the processes that
783  * created it closes it.
784  */
785 static int
786 tap_cdev_close(dev_t dev, int flags, int fmt,
787     struct lwp *l)
788 {
789 	struct tap_softc *sc =
790 	    device_lookup_private(&tap_cd, minor(dev));
791 
792 	if (sc == NULL)
793 		return (ENXIO);
794 
795 	return tap_dev_close(sc);
796 }
797 
798 /*
799  * It might happen that the administrator used ifconfig to externally destroy
800  * the interface.  In that case, tap_fops_close will be called while
801  * tap_detach is already happening.  If we called it again from here, we
802  * would dead lock.  TAP_GOING ensures that this situation doesn't happen.
803  */
804 static int
805 tap_fops_close(file_t *fp)
806 {
807 	int unit = (intptr_t)fp->f_data;
808 	struct tap_softc *sc;
809 	int error;
810 
811 	sc = device_lookup_private(&tap_cd, unit);
812 	if (sc == NULL)
813 		return (ENXIO);
814 
815 	/* tap_dev_close currently always succeeds, but it might not
816 	 * always be the case. */
817 	KERNEL_LOCK(1, NULL);
818 	if ((error = tap_dev_close(sc)) != 0) {
819 		KERNEL_UNLOCK_ONE(NULL);
820 		return (error);
821 	}
822 
823 	/* Destroy the device now that it is no longer useful,
824 	 * unless it's already being destroyed. */
825 	if ((sc->sc_flags & TAP_GOING) != 0) {
826 		KERNEL_UNLOCK_ONE(NULL);
827 		return (0);
828 	}
829 
830 	error = tap_clone_destroyer(sc->sc_dev);
831 	KERNEL_UNLOCK_ONE(NULL);
832 	return error;
833 }
834 
835 static int
836 tap_dev_close(struct tap_softc *sc)
837 {
838 	struct ifnet *ifp;
839 	int s;
840 
841 	s = splnet();
842 	/* Let tap_start handle packets again */
843 	ifp = &sc->sc_ec.ec_if;
844 	ifp->if_flags &= ~IFF_OACTIVE;
845 
846 	/* Purge output queue */
847 	if (!(IFQ_IS_EMPTY(&ifp->if_snd))) {
848 		struct mbuf *m;
849 
850 		for (;;) {
851 			IFQ_DEQUEUE(&ifp->if_snd, m);
852 			if (m == NULL)
853 				break;
854 
855 			ifp->if_opackets++;
856 			bpf_mtap(ifp, m);
857 			m_freem(m);
858 		}
859 	}
860 	splx(s);
861 
862 	if (sc->sc_sih != NULL) {
863 		softint_disestablish(sc->sc_sih);
864 		sc->sc_sih = NULL;
865 	}
866 	sc->sc_flags &= ~(TAP_INUSE | TAP_ASYNCIO);
867 
868 	return (0);
869 }
870 
871 static int
872 tap_cdev_read(dev_t dev, struct uio *uio, int flags)
873 {
874 	return tap_dev_read(minor(dev), uio, flags);
875 }
876 
877 static int
878 tap_fops_read(file_t *fp, off_t *offp, struct uio *uio,
879     kauth_cred_t cred, int flags)
880 {
881 	int error;
882 
883 	KERNEL_LOCK(1, NULL);
884 	error = tap_dev_read((intptr_t)fp->f_data, uio, flags);
885 	KERNEL_UNLOCK_ONE(NULL);
886 	return error;
887 }
888 
889 static int
890 tap_dev_read(int unit, struct uio *uio, int flags)
891 {
892 	struct tap_softc *sc =
893 	    device_lookup_private(&tap_cd, unit);
894 	struct ifnet *ifp;
895 	struct mbuf *m, *n;
896 	int error = 0, s;
897 
898 	if (sc == NULL)
899 		return (ENXIO);
900 
901 	getnanotime(&sc->sc_atime);
902 
903 	ifp = &sc->sc_ec.ec_if;
904 	if ((ifp->if_flags & IFF_UP) == 0)
905 		return (EHOSTDOWN);
906 
907 	/*
908 	 * In the TAP_NBIO case, we have to make sure we won't be sleeping
909 	 */
910 	if ((sc->sc_flags & TAP_NBIO) != 0) {
911 		if (!mutex_tryenter(&sc->sc_rdlock))
912 			return (EWOULDBLOCK);
913 	} else {
914 		mutex_enter(&sc->sc_rdlock);
915 	}
916 
917 	s = splnet();
918 	if (IFQ_IS_EMPTY(&ifp->if_snd)) {
919 		ifp->if_flags &= ~IFF_OACTIVE;
920 		/*
921 		 * We must release the lock before sleeping, and re-acquire it
922 		 * after.
923 		 */
924 		mutex_exit(&sc->sc_rdlock);
925 		if (sc->sc_flags & TAP_NBIO)
926 			error = EWOULDBLOCK;
927 		else
928 			error = tsleep(sc, PSOCK|PCATCH, "tap", 0);
929 		splx(s);
930 
931 		if (error != 0)
932 			return (error);
933 		/* The device might have been downed */
934 		if ((ifp->if_flags & IFF_UP) == 0)
935 			return (EHOSTDOWN);
936 		if ((sc->sc_flags & TAP_NBIO)) {
937 			if (!mutex_tryenter(&sc->sc_rdlock))
938 				return (EWOULDBLOCK);
939 		} else {
940 			mutex_enter(&sc->sc_rdlock);
941 		}
942 		s = splnet();
943 	}
944 
945 	IFQ_DEQUEUE(&ifp->if_snd, m);
946 	ifp->if_flags &= ~IFF_OACTIVE;
947 	splx(s);
948 	if (m == NULL) {
949 		error = 0;
950 		goto out;
951 	}
952 
953 	ifp->if_opackets++;
954 	bpf_mtap(ifp, m);
955 
956 	/*
957 	 * One read is one packet.
958 	 */
959 	do {
960 		error = uiomove(mtod(m, void *),
961 		    min(m->m_len, uio->uio_resid), uio);
962 		MFREE(m, n);
963 		m = n;
964 	} while (m != NULL && uio->uio_resid > 0 && error == 0);
965 
966 	if (m != NULL)
967 		m_freem(m);
968 
969 out:
970 	mutex_exit(&sc->sc_rdlock);
971 	return (error);
972 }
973 
974 static int
975 tap_fops_stat(file_t *fp, struct stat *st)
976 {
977 	int error = 0;
978 	struct tap_softc *sc;
979 	int unit = (uintptr_t)fp->f_data;
980 
981 	(void)memset(st, 0, sizeof(*st));
982 
983 	KERNEL_LOCK(1, NULL);
984 	sc = device_lookup_private(&tap_cd, unit);
985 	if (sc == NULL) {
986 		error = ENXIO;
987 		goto out;
988 	}
989 
990 	st->st_dev = makedev(cdevsw_lookup_major(&tap_cdevsw), unit);
991 	st->st_atimespec = sc->sc_atime;
992 	st->st_mtimespec = sc->sc_mtime;
993 	st->st_ctimespec = st->st_birthtimespec = sc->sc_btime;
994 	st->st_uid = kauth_cred_geteuid(fp->f_cred);
995 	st->st_gid = kauth_cred_getegid(fp->f_cred);
996 out:
997 	KERNEL_UNLOCK_ONE(NULL);
998 	return error;
999 }
1000 
1001 static int
1002 tap_cdev_write(dev_t dev, struct uio *uio, int flags)
1003 {
1004 	return tap_dev_write(minor(dev), uio, flags);
1005 }
1006 
1007 static int
1008 tap_fops_write(file_t *fp, off_t *offp, struct uio *uio,
1009     kauth_cred_t cred, int flags)
1010 {
1011 	int error;
1012 
1013 	KERNEL_LOCK(1, NULL);
1014 	error = tap_dev_write((intptr_t)fp->f_data, uio, flags);
1015 	KERNEL_UNLOCK_ONE(NULL);
1016 	return error;
1017 }
1018 
1019 static int
1020 tap_dev_write(int unit, struct uio *uio, int flags)
1021 {
1022 	struct tap_softc *sc =
1023 	    device_lookup_private(&tap_cd, unit);
1024 	struct ifnet *ifp;
1025 	struct mbuf *m, **mp;
1026 	int error = 0;
1027 	int s;
1028 
1029 	if (sc == NULL)
1030 		return (ENXIO);
1031 
1032 	getnanotime(&sc->sc_mtime);
1033 	ifp = &sc->sc_ec.ec_if;
1034 
1035 	/* One write, one packet, that's the rule */
1036 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1037 	if (m == NULL) {
1038 		ifp->if_ierrors++;
1039 		return (ENOBUFS);
1040 	}
1041 	m->m_pkthdr.len = uio->uio_resid;
1042 
1043 	mp = &m;
1044 	while (error == 0 && uio->uio_resid > 0) {
1045 		if (*mp != m) {
1046 			MGET(*mp, M_DONTWAIT, MT_DATA);
1047 			if (*mp == NULL) {
1048 				error = ENOBUFS;
1049 				break;
1050 			}
1051 		}
1052 		(*mp)->m_len = min(MHLEN, uio->uio_resid);
1053 		error = uiomove(mtod(*mp, void *), (*mp)->m_len, uio);
1054 		mp = &(*mp)->m_next;
1055 	}
1056 	if (error) {
1057 		ifp->if_ierrors++;
1058 		m_freem(m);
1059 		return (error);
1060 	}
1061 
1062 	ifp->if_ipackets++;
1063 	m->m_pkthdr.rcvif = ifp;
1064 
1065 	bpf_mtap(ifp, m);
1066 	s = splnet();
1067 	(*ifp->if_input)(ifp, m);
1068 	splx(s);
1069 
1070 	return (0);
1071 }
1072 
1073 static int
1074 tap_cdev_ioctl(dev_t dev, u_long cmd, void *data, int flags,
1075     struct lwp *l)
1076 {
1077 	return tap_dev_ioctl(minor(dev), cmd, data, l);
1078 }
1079 
1080 static int
1081 tap_fops_ioctl(file_t *fp, u_long cmd, void *data)
1082 {
1083 	return tap_dev_ioctl((intptr_t)fp->f_data, cmd, data, curlwp);
1084 }
1085 
1086 static int
1087 tap_dev_ioctl(int unit, u_long cmd, void *data, struct lwp *l)
1088 {
1089 	struct tap_softc *sc = device_lookup_private(&tap_cd, unit);
1090 
1091 	if (sc == NULL)
1092 		return ENXIO;
1093 
1094 	switch (cmd) {
1095 	case FIONREAD:
1096 		{
1097 			struct ifnet *ifp = &sc->sc_ec.ec_if;
1098 			struct mbuf *m;
1099 			int s;
1100 
1101 			s = splnet();
1102 			IFQ_POLL(&ifp->if_snd, m);
1103 
1104 			if (m == NULL)
1105 				*(int *)data = 0;
1106 			else
1107 				*(int *)data = m->m_pkthdr.len;
1108 			splx(s);
1109 			return 0;
1110 		}
1111 	case TIOCSPGRP:
1112 	case FIOSETOWN:
1113 		return fsetown(&sc->sc_pgid, cmd, data);
1114 	case TIOCGPGRP:
1115 	case FIOGETOWN:
1116 		return fgetown(sc->sc_pgid, cmd, data);
1117 	case FIOASYNC:
1118 		if (*(int *)data) {
1119 			if (sc->sc_sih == NULL) {
1120 				sc->sc_sih = softint_establish(SOFTINT_CLOCK,
1121 				    tap_softintr, sc);
1122 				if (sc->sc_sih == NULL)
1123 					return EBUSY; /* XXX */
1124 			}
1125 			sc->sc_flags |= TAP_ASYNCIO;
1126 		} else {
1127 			sc->sc_flags &= ~TAP_ASYNCIO;
1128 			if (sc->sc_sih != NULL) {
1129 				softint_disestablish(sc->sc_sih);
1130 				sc->sc_sih = NULL;
1131 			}
1132 		}
1133 		return 0;
1134 	case FIONBIO:
1135 		if (*(int *)data)
1136 			sc->sc_flags |= TAP_NBIO;
1137 		else
1138 			sc->sc_flags &= ~TAP_NBIO;
1139 		return 0;
1140 #ifdef OTAPGIFNAME
1141 	case OTAPGIFNAME:
1142 #endif
1143 	case TAPGIFNAME:
1144 		{
1145 			struct ifreq *ifr = (struct ifreq *)data;
1146 			struct ifnet *ifp = &sc->sc_ec.ec_if;
1147 
1148 			strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
1149 			return 0;
1150 		}
1151 	default:
1152 		return ENOTTY;
1153 	}
1154 }
1155 
1156 static int
1157 tap_cdev_poll(dev_t dev, int events, struct lwp *l)
1158 {
1159 	return tap_dev_poll(minor(dev), events, l);
1160 }
1161 
1162 static int
1163 tap_fops_poll(file_t *fp, int events)
1164 {
1165 	return tap_dev_poll((intptr_t)fp->f_data, events, curlwp);
1166 }
1167 
1168 static int
1169 tap_dev_poll(int unit, int events, struct lwp *l)
1170 {
1171 	struct tap_softc *sc =
1172 	    device_lookup_private(&tap_cd, unit);
1173 	int revents = 0;
1174 
1175 	if (sc == NULL)
1176 		return POLLERR;
1177 
1178 	if (events & (POLLIN|POLLRDNORM)) {
1179 		struct ifnet *ifp = &sc->sc_ec.ec_if;
1180 		struct mbuf *m;
1181 		int s;
1182 
1183 		s = splnet();
1184 		IFQ_POLL(&ifp->if_snd, m);
1185 
1186 		if (m != NULL)
1187 			revents |= events & (POLLIN|POLLRDNORM);
1188 		else {
1189 			mutex_spin_enter(&sc->sc_kqlock);
1190 			selrecord(l, &sc->sc_rsel);
1191 			mutex_spin_exit(&sc->sc_kqlock);
1192 		}
1193 		splx(s);
1194 	}
1195 	revents |= events & (POLLOUT|POLLWRNORM);
1196 
1197 	return (revents);
1198 }
1199 
1200 static struct filterops tap_read_filterops = { 1, NULL, tap_kqdetach,
1201 	tap_kqread };
1202 static struct filterops tap_seltrue_filterops = { 1, NULL, tap_kqdetach,
1203 	filt_seltrue };
1204 
1205 static int
1206 tap_cdev_kqfilter(dev_t dev, struct knote *kn)
1207 {
1208 	return tap_dev_kqfilter(minor(dev), kn);
1209 }
1210 
1211 static int
1212 tap_fops_kqfilter(file_t *fp, struct knote *kn)
1213 {
1214 	return tap_dev_kqfilter((intptr_t)fp->f_data, kn);
1215 }
1216 
1217 static int
1218 tap_dev_kqfilter(int unit, struct knote *kn)
1219 {
1220 	struct tap_softc *sc =
1221 	    device_lookup_private(&tap_cd, unit);
1222 
1223 	if (sc == NULL)
1224 		return (ENXIO);
1225 
1226 	KERNEL_LOCK(1, NULL);
1227 	switch(kn->kn_filter) {
1228 	case EVFILT_READ:
1229 		kn->kn_fop = &tap_read_filterops;
1230 		break;
1231 	case EVFILT_WRITE:
1232 		kn->kn_fop = &tap_seltrue_filterops;
1233 		break;
1234 	default:
1235 		KERNEL_UNLOCK_ONE(NULL);
1236 		return (EINVAL);
1237 	}
1238 
1239 	kn->kn_hook = sc;
1240 	mutex_spin_enter(&sc->sc_kqlock);
1241 	SLIST_INSERT_HEAD(&sc->sc_rsel.sel_klist, kn, kn_selnext);
1242 	mutex_spin_exit(&sc->sc_kqlock);
1243 	KERNEL_UNLOCK_ONE(NULL);
1244 	return (0);
1245 }
1246 
1247 static void
1248 tap_kqdetach(struct knote *kn)
1249 {
1250 	struct tap_softc *sc = (struct tap_softc *)kn->kn_hook;
1251 
1252 	KERNEL_LOCK(1, NULL);
1253 	mutex_spin_enter(&sc->sc_kqlock);
1254 	SLIST_REMOVE(&sc->sc_rsel.sel_klist, kn, knote, kn_selnext);
1255 	mutex_spin_exit(&sc->sc_kqlock);
1256 	KERNEL_UNLOCK_ONE(NULL);
1257 }
1258 
1259 static int
1260 tap_kqread(struct knote *kn, long hint)
1261 {
1262 	struct tap_softc *sc = (struct tap_softc *)kn->kn_hook;
1263 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1264 	struct mbuf *m;
1265 	int s, rv;
1266 
1267 	KERNEL_LOCK(1, NULL);
1268 	s = splnet();
1269 	IFQ_POLL(&ifp->if_snd, m);
1270 
1271 	if (m == NULL)
1272 		kn->kn_data = 0;
1273 	else
1274 		kn->kn_data = m->m_pkthdr.len;
1275 	splx(s);
1276 	rv = (kn->kn_data != 0 ? 1 : 0);
1277 	KERNEL_UNLOCK_ONE(NULL);
1278 	return rv;
1279 }
1280 
1281 #if defined(COMPAT_40) || defined(MODULAR)
1282 /*
1283  * sysctl management routines
1284  * You can set the address of an interface through:
1285  * net.link.tap.tap<number>
1286  *
1287  * Note the consistent use of tap_log in order to use
1288  * sysctl_teardown at unload time.
1289  *
1290  * In the kernel you will find a lot of SYSCTL_SETUP blocks.  Those
1291  * blocks register a function in a special section of the kernel
1292  * (called a link set) which is used at init_sysctl() time to cycle
1293  * through all those functions to create the kernel's sysctl tree.
1294  *
1295  * It is not possible to use link sets in a module, so the
1296  * easiest is to simply call our own setup routine at load time.
1297  *
1298  * In the SYSCTL_SETUP blocks you find in the kernel, nodes have the
1299  * CTLFLAG_PERMANENT flag, meaning they cannot be removed.  Once the
1300  * whole kernel sysctl tree is built, it is not possible to add any
1301  * permanent node.
1302  *
1303  * It should be noted that we're not saving the sysctlnode pointer
1304  * we are returned when creating the "tap" node.  That structure
1305  * cannot be trusted once out of the calling function, as it might
1306  * get reused.  So we just save the MIB number, and always give the
1307  * full path starting from the root for later calls to sysctl_createv
1308  * and sysctl_destroyv.
1309  */
1310 SYSCTL_SETUP(sysctl_tap_setup, "sysctl net.link.tap subtree setup")
1311 {
1312 	const struct sysctlnode *node;
1313 	int error = 0;
1314 
1315 	if ((error = sysctl_createv(clog, 0, NULL, NULL,
1316 	    CTLFLAG_PERMANENT,
1317 	    CTLTYPE_NODE, "link", NULL,
1318 	    NULL, 0, NULL, 0,
1319 	    CTL_NET, AF_LINK, CTL_EOL)) != 0)
1320 		return;
1321 
1322 	/*
1323 	 * The first four parameters of sysctl_createv are for management.
1324 	 *
1325 	 * The four that follows, here starting with a '0' for the flags,
1326 	 * describe the node.
1327 	 *
1328 	 * The next series of four set its value, through various possible
1329 	 * means.
1330 	 *
1331 	 * Last but not least, the path to the node is described.  That path
1332 	 * is relative to the given root (third argument).  Here we're
1333 	 * starting from the root.
1334 	 */
1335 	if ((error = sysctl_createv(clog, 0, NULL, &node,
1336 	    CTLFLAG_PERMANENT,
1337 	    CTLTYPE_NODE, "tap", NULL,
1338 	    NULL, 0, NULL, 0,
1339 	    CTL_NET, AF_LINK, CTL_CREATE, CTL_EOL)) != 0)
1340 		return;
1341 	tap_node = node->sysctl_num;
1342 }
1343 
1344 /*
1345  * The helper functions make Andrew Brown's interface really
1346  * shine.  It makes possible to create value on the fly whether
1347  * the sysctl value is read or written.
1348  *
1349  * As shown as an example in the man page, the first step is to
1350  * create a copy of the node to have sysctl_lookup work on it.
1351  *
1352  * Here, we have more work to do than just a copy, since we have
1353  * to create the string.  The first step is to collect the actual
1354  * value of the node, which is a convenient pointer to the softc
1355  * of the interface.  From there we create the string and use it
1356  * as the value, but only for the *copy* of the node.
1357  *
1358  * Then we let sysctl_lookup do the magic, which consists in
1359  * setting oldp and newp as required by the operation.  When the
1360  * value is read, that means that the string will be copied to
1361  * the user, and when it is written, the new value will be copied
1362  * over in the addr array.
1363  *
1364  * If newp is NULL, the user was reading the value, so we don't
1365  * have anything else to do.  If a new value was written, we
1366  * have to check it.
1367  *
1368  * If it is incorrect, we can return an error and leave 'node' as
1369  * it is:  since it is a copy of the actual node, the change will
1370  * be forgotten.
1371  *
1372  * Upon a correct input, we commit the change to the ifnet
1373  * structure of our interface.
1374  */
1375 static int
1376 tap_sysctl_handler(SYSCTLFN_ARGS)
1377 {
1378 	struct sysctlnode node;
1379 	struct tap_softc *sc;
1380 	struct ifnet *ifp;
1381 	int error;
1382 	size_t len;
1383 	char addr[3 * ETHER_ADDR_LEN];
1384 	uint8_t enaddr[ETHER_ADDR_LEN];
1385 
1386 	node = *rnode;
1387 	sc = node.sysctl_data;
1388 	ifp = &sc->sc_ec.ec_if;
1389 	(void)ether_snprintf(addr, sizeof(addr), CLLADDR(ifp->if_sadl));
1390 	node.sysctl_data = addr;
1391 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1392 	if (error || newp == NULL)
1393 		return (error);
1394 
1395 	len = strlen(addr);
1396 	if (len < 11 || len > 17)
1397 		return (EINVAL);
1398 
1399 	/* Commit change */
1400 	if (ether_aton_r(enaddr, sizeof(enaddr), addr) != 0)
1401 		return (EINVAL);
1402 	if_set_sadl(ifp, enaddr, ETHER_ADDR_LEN, false);
1403 	return (error);
1404 }
1405 #endif
1406