bsd/kern/kern_control.c

   1 /*
   2  * Copyright (c) 1999-2008 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 /*
  30  * Kernel Control domain - allows control connections to
  31  *  and to read/write data.
  32  *
  33  * Vincent Lubet, 040506
  34  * Christophe Allie, 010928
  35  * Justin C. Walker, 990319
  36  */
  37
  38 #include <sys/types.h>
  39 #include <sys/param.h>
  40 #include <sys/systm.h>
  41 #include <sys/syslog.h>
  42 #include <sys/socket.h>
  43 #include <sys/socketvar.h>
  44 #include <sys/protosw.h>
  45 #include <sys/domain.h>
  46 #include <sys/malloc.h>
  47 #include <sys/mbuf.h>
  48 #include <sys/sys_domain.h>
  49 #include <sys/kern_event.h>
  50 #include <sys/kern_control.h>
  51 #include <sys/kauth.h>
  52 #include <net/if_var.h>
  53
  54 #include <mach/vm_types.h>
  55
  56 #include <kern/thread.h>
  57
  58 /*
  59  * Definitions and vars for we support
  60  */
  61
  62 #define CTL_SENDSIZE    (2 * 1024)      /* default buffer size */
  63 #define CTL_RECVSIZE    (8 * 1024)      /* default buffer size */
  64
  65 /*
  66  * Definitions and vars for we support
  67  */
  68
  69 static u_int32_t                ctl_maxunit = 65536;
  70 static lck_grp_attr_t   *ctl_lck_grp_attr = 0;
  71 static lck_attr_t               *ctl_lck_attr = 0;
  72 static lck_grp_t                *ctl_lck_grp = 0;
  73 static lck_mtx_t                *ctl_mtx;
  74
  75
  76 /* all the controllers are chained */
  77 TAILQ_HEAD(kctl_list, kctl)     ctl_head;
  78
  79 static int ctl_attach(struct socket *, int, struct proc *);
  80 static int ctl_detach(struct socket *);
  81 static int ctl_sofreelastref(struct socket *so);
  82 static int ctl_connect(struct socket *, struct sockaddr *, struct proc *);
  83 static int ctl_disconnect(struct socket *);
  84 static int ctl_ioctl(struct socket *so, u_long cmd, caddr_t data,
  85                   struct ifnet *ifp, struct proc *p);
  86 static int ctl_send(struct socket *, int, struct mbuf *,
  87             struct sockaddr *, struct mbuf *, struct proc *);
  88 static int ctl_ctloutput(struct socket *, struct sockopt *);
  89 static int ctl_peeraddr(struct socket *so, struct sockaddr **nam);
  90
  91 static struct kctl *ctl_find_by_name(const char *);
  92 static struct kctl *ctl_find_by_id_unit(u_int32_t id, u_int32_t unit);
  93
  94 static struct socket *kcb_find_socket(struct kctl *, u_int32_t unit);
  95 static struct ctl_cb *kcb_find(struct kctl *, u_int32_t unit);
  96 static void ctl_post_msg(u_int32_t event_code, u_int32_t id);
  97
  98 static int ctl_lock(struct socket *, int, void *);
  99 static int ctl_unlock(struct socket *, int, void *);
 100 static lck_mtx_t * ctl_getlock(struct socket *, int);
 101
 102 static struct pr_usrreqs ctl_usrreqs =
 103 {
 104         pru_abort_notsupp, pru_accept_notsupp, ctl_attach, pru_bind_notsupp,
 105         ctl_connect, pru_connect2_notsupp, ctl_ioctl, ctl_detach,
 106         ctl_disconnect, pru_listen_notsupp, ctl_peeraddr,
 107         pru_rcvd_notsupp, pru_rcvoob_notsupp, ctl_send,
 108         pru_sense_null, pru_shutdown_notsupp, pru_sockaddr_notsupp,
 109         sosend, soreceive, pru_sopoll_notsupp
 110 };
 111
 112 static struct protosw kctlswk_dgram =
 113 {
 114         SOCK_DGRAM, &systemdomain, SYSPROTO_CONTROL,
 115         PR_ATOMIC|PR_CONNREQUIRED|PR_PCBLOCK,
 116         NULL, NULL, NULL, ctl_ctloutput,
 117         NULL, NULL,
 118         NULL, NULL, NULL, NULL, &ctl_usrreqs,
 119         ctl_lock, ctl_unlock, ctl_getlock, { 0, 0 } , 0, { 0 }
 120 };
 121
 122 static struct protosw kctlswk_stream =
 123 {
 124         SOCK_STREAM, &systemdomain, SYSPROTO_CONTROL,
 125         PR_CONNREQUIRED|PR_PCBLOCK,
 126         NULL, NULL, NULL, ctl_ctloutput,
 127         NULL, NULL,
 128         NULL, NULL, NULL, NULL, &ctl_usrreqs,
 129         ctl_lock, ctl_unlock, ctl_getlock, { 0, 0 } , 0, { 0 }
 130 };
 131
 132
 133 /*
 134  * Install the protosw's for the Kernel Control manager.
 135  */
 136 __private_extern__ int
 137 kern_control_init(void)
 138 {
 139         int error = 0;
 140
 141         ctl_lck_grp_attr = lck_grp_attr_alloc_init();
 142         if (ctl_lck_grp_attr == 0) {
 143                         printf(": lck_grp_attr_alloc_init failed\n");
 144                         error = ENOMEM;
 145                         goto done;
 146         }
 147
 148         ctl_lck_grp = lck_grp_alloc_init("Kernel Control Protocol", ctl_lck_grp_attr);
 149         if (ctl_lck_grp == 0) {
 150                         printf("kern_control_init: lck_grp_alloc_init failed\n");
 151                         error = ENOMEM;
 152                         goto done;
 153         }
 154
 155         ctl_lck_attr = lck_attr_alloc_init();
 156         if (ctl_lck_attr == 0) {
 157                         printf("kern_control_init: lck_attr_alloc_init failed\n");
 158                         error = ENOMEM;
 159                         goto done;
 160         }
 161
 162         ctl_mtx = lck_mtx_alloc_init(ctl_lck_grp, ctl_lck_attr);
 163         if (ctl_mtx == 0) {
 164                         printf("kern_control_init: lck_mtx_alloc_init failed\n");
 165                         error = ENOMEM;
 166                         goto done;
 167         }
 168         TAILQ_INIT(&ctl_head);
 169
 170         error = net_add_proto(&kctlswk_dgram, &systemdomain);
 171         if (error) {
 172                 log(LOG_WARNING, "kern_control_init: net_add_proto dgram failed (%d)\n", error);
 173         }
 174         error = net_add_proto(&kctlswk_stream, &systemdomain);
 175         if (error) {
 176                 log(LOG_WARNING, "kern_control_init: net_add_proto stream failed (%d)\n", error);
 177         }
 178
 179         done:
 180         if (error != 0) {
 181                 if (ctl_mtx) {
 182                                 lck_mtx_free(ctl_mtx, ctl_lck_grp);
 183                                 ctl_mtx = 0;
 184                 }
 185                 if (ctl_lck_grp) {
 186                                 lck_grp_free(ctl_lck_grp);
 187                                 ctl_lck_grp = 0;
 188                 }
 189                 if (ctl_lck_grp_attr) {
 190                                 lck_grp_attr_free(ctl_lck_grp_attr);
 191                                 ctl_lck_grp_attr = 0;
 192                 }
 193                 if (ctl_lck_attr) {
 194                                 lck_attr_free(ctl_lck_attr);
 195                                 ctl_lck_attr = 0;
 196                 }
 197         }
 198         return error;
 199 }
 200
 201 static void
 202 kcb_delete(struct ctl_cb *kcb)
 203 {
 204         if (kcb != 0) {
 205                 if (kcb->mtx != 0)
 206                         lck_mtx_free(kcb->mtx, ctl_lck_grp);
 207                 FREE(kcb, M_TEMP);
 208         }
 209 }
 210
 211
 212 /*
 213  * Kernel Controller user-request functions
 214  * attach function must exist and succeed
 215  * detach not necessary
 216  * we need a pcb for the per socket mutex
 217  */
 218 static int
 219 ctl_attach(__unused struct socket *so, __unused int proto, __unused struct proc *p)
 220 {
 221         int error = 0;
 222         struct ctl_cb                   *kcb = 0;
 223
 224         MALLOC(kcb, struct ctl_cb *, sizeof(struct ctl_cb), M_TEMP, M_WAITOK);
 225         if (kcb == NULL) {
 226                 error = ENOMEM;
 227                 goto quit;
 228         }
 229         bzero(kcb, sizeof(struct ctl_cb));
 230
 231         kcb->mtx = lck_mtx_alloc_init(ctl_lck_grp, ctl_lck_attr);
 232         if (kcb->mtx == NULL) {
 233                 error = ENOMEM;
 234                 goto quit;
 235         }
 236         kcb->so = so;
 237         so->so_pcb = (caddr_t)kcb;
 238
 239 quit:
 240         if (error != 0) {
 241                 kcb_delete(kcb);
 242                 kcb = 0;
 243         }
 244         return error;
 245 }
 246
 247 static int
 248 ctl_sofreelastref(struct socket *so)
 249 {
 250     struct ctl_cb       *kcb = (struct ctl_cb *)so->so_pcb;
 251
 252     so->so_pcb = 0;
 253
 254     if (kcb != 0) {
 255         struct kctl             *kctl;
 256         if ((kctl = kcb->kctl) != 0) {
 257             lck_mtx_lock(ctl_mtx);
 258             TAILQ_REMOVE(&kctl->kcb_head, kcb, next);
 259             lck_mtx_unlock(ctl_mtx);
 260         }
 261         kcb_delete(kcb);
 262     }
 263     sofreelastref(so, 1);
 264     return 0;
 265 }
 266
 267 static int
 268 ctl_detach(struct socket *so)
 269 {
 270     struct ctl_cb       *kcb = (struct ctl_cb *)so->so_pcb;
 271
 272     if (kcb == 0)
 273         return 0;
 274
 275     soisdisconnected(so);
 276     so->so_flags |= SOF_PCBCLEARING;
 277     return 0;
 278 }
 279
 280
 281 static int
 282 ctl_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
 283 {
 284     struct kctl                 *kctl;
 285     int                                 error = 0;
 286     struct sockaddr_ctl sa;
 287     struct ctl_cb               *kcb = (struct ctl_cb *)so->so_pcb;
 288     struct ctl_cb               *kcb_next = NULL;
 289
 290     if (kcb == 0)
 291         panic("ctl_connect so_pcb null\n");
 292
 293     if (nam->sa_len !=  sizeof(struct sockaddr_ctl))
 294         return(EINVAL);
 295
 296     bcopy(nam, &sa, sizeof(struct sockaddr_ctl));
 297
 298     lck_mtx_lock(ctl_mtx);
 299     kctl = ctl_find_by_id_unit(sa.sc_id, sa.sc_unit);
 300     if (kctl == NULL) {
 301         lck_mtx_unlock(ctl_mtx);
 302         return ENOENT;
 303     }
 304
 305         if (((kctl->flags & CTL_FLAG_REG_SOCK_STREAM) && (so->so_type != SOCK_STREAM)) ||
 306                 (!(kctl->flags & CTL_FLAG_REG_SOCK_STREAM) && (so->so_type != SOCK_DGRAM))) {
 307         lck_mtx_unlock(ctl_mtx);
 308         return EPROTOTYPE;
 309         }
 310
 311     if (kctl->flags & CTL_FLAG_PRIVILEGED) {
 312         if (p == 0) {
 313             lck_mtx_unlock(ctl_mtx);
 314             return(EINVAL);
 315         }
 316         if (kauth_cred_issuser(kauth_cred_get()) == 0) {
 317             lck_mtx_unlock(ctl_mtx);
 318             return EPERM;
 319         }
 320     }
 321
 322         if ((kctl->flags & CTL_FLAG_REG_ID_UNIT) || sa.sc_unit != 0) {
 323                 if (kcb_find(kctl, sa.sc_unit) != NULL) {
 324                         lck_mtx_unlock(ctl_mtx);
 325                         return EBUSY;
 326                 }
 327         } else {
 328                 /* Find an unused ID, assumes control IDs are listed in order */
 329         u_int32_t       unit = 1;
 330
 331         TAILQ_FOREACH(kcb_next, &kctl->kcb_head, next) {
 332                 if (kcb_next->unit > unit) {
 333                         /* Found a gap, lets fill it in */
 334                         break;
 335                 }
 336                 unit = kcb_next->unit + 1;
 337                 if (unit == ctl_maxunit)
 338                         break;
 339         }
 340
 341                 if (unit == ctl_maxunit) {
 342                         lck_mtx_unlock(ctl_mtx);
 343                         return EBUSY;
 344                 }
 345
 346                 sa.sc_unit = unit;
 347     }
 348
 349         kcb->unit = sa.sc_unit;
 350     kcb->kctl = kctl;
 351     if (kcb_next != NULL) {
 352         TAILQ_INSERT_BEFORE(kcb_next, kcb, next);
 353     }
 354     else {
 355                 TAILQ_INSERT_TAIL(&kctl->kcb_head, kcb, next);
 356         }
 357     lck_mtx_unlock(ctl_mtx);
 358
 359     error = soreserve(so, kctl->sendbufsize, kctl->recvbufsize);
 360     if (error)
 361                 goto done;
 362     soisconnecting(so);
 363
 364         socket_unlock(so, 0);
 365     error = (*kctl->connect)(kctl, &sa, &kcb->userdata);
 366         socket_lock(so, 0);
 367     if (error)
 368                 goto end;
 369
 370     soisconnected(so);
 371
 372 end:
 373         if (error && kctl->disconnect) {
 374                 socket_unlock(so, 0);
 375                 (*kctl->disconnect)(kctl, kcb->unit, kcb->userdata);
 376                 socket_lock(so, 0);
 377         }
 378 done:
 379     if (error) {
 380         soisdisconnected(so);
 381         lck_mtx_lock(ctl_mtx);
 382         kcb->kctl = 0;
 383         kcb->unit = 0;
 384         TAILQ_REMOVE(&kctl->kcb_head, kcb, next);
 385         lck_mtx_unlock(ctl_mtx);
 386     }
 387     return error;
 388 }
 389
 390 static int
 391 ctl_disconnect(struct socket *so)
 392 {
 393     struct ctl_cb       *kcb = (struct ctl_cb *)so->so_pcb;
 394
 395     if ((kcb = (struct ctl_cb *)so->so_pcb)) {
 396         struct kctl             *kctl = kcb->kctl;
 397
 398         if (kctl && kctl->disconnect) {
 399             socket_unlock(so, 0);
 400             (*kctl->disconnect)(kctl, kcb->unit, kcb->userdata);
 401             socket_lock(so, 0);
 402         }
 403
 404         soisdisconnected(so);
 405
 406                 socket_unlock(so, 0);
 407         lck_mtx_lock(ctl_mtx);
 408         kcb->kctl = 0;
 409         kcb->unit = 0;
 410         while (kcb->usecount != 0) {
 411                 msleep(&kcb->usecount, ctl_mtx, 0, "kcb->usecount", 0);
 412         }
 413         TAILQ_REMOVE(&kctl->kcb_head, kcb, next);
 414         lck_mtx_unlock(ctl_mtx);
 415                 socket_lock(so, 0);
 416     }
 417     return 0;
 418 }
 419
 420 static int
 421 ctl_peeraddr(struct socket *so, struct sockaddr **nam)
 422 {
 423         struct ctl_cb           *kcb = (struct ctl_cb *)so->so_pcb;
 424         struct kctl                     *kctl;
 425         struct sockaddr_ctl     sc;
 426
 427         if (kcb == NULL)        /* sanity check */
 428                 return(ENOTCONN);
 429
 430         if ((kctl = kcb->kctl) == NULL)
 431                 return(EINVAL);
 432
 433         bzero(&sc, sizeof(struct sockaddr_ctl));
 434         sc.sc_len = sizeof(struct sockaddr_ctl);
 435         sc.sc_family = AF_SYSTEM;
 436         sc.ss_sysaddr = AF_SYS_CONTROL;
 437         sc.sc_id =  kctl->id;
 438         sc.sc_unit = kcb->unit;
 439
 440         *nam = dup_sockaddr((struct sockaddr *)&sc, 1);
 441
 442         return 0;
 443 }
 444
 445 static int
 446 ctl_send(struct socket *so, int flags, struct mbuf *m,
 447             __unused struct sockaddr *addr, struct mbuf *control,
 448             __unused struct proc *p)
 449 {
 450         int             error = 0;
 451         struct ctl_cb   *kcb = (struct ctl_cb *)so->so_pcb;
 452         struct kctl             *kctl;
 453
 454         if (control) m_freem(control);
 455
 456         if (kcb == NULL)        /* sanity check */
 457                 error = ENOTCONN;
 458
 459         if (error == 0 && (kctl = kcb->kctl) == NULL)
 460                 error = EINVAL;
 461
 462         if (error == 0 && kctl->send) {
 463                 socket_unlock(so, 0);
 464                 error = (*kctl->send)(kctl, kcb->unit, kcb->userdata, m, flags);
 465                 socket_lock(so, 0);
 466         } else {
 467                 m_freem(m);
 468                 if (error == 0)
 469                         error = ENOTSUP;
 470         }
 471         return error;
 472 }
 473
 474 errno_t
 475 ctl_enqueuembuf(void *kctlref, u_int32_t unit, struct mbuf *m, u_int32_t flags)
 476 {
 477         struct socket   *so;
 478         errno_t                 error = 0;
 479         struct kctl             *kctl = (struct kctl *)kctlref;
 480
 481         if (kctl == NULL)
 482                 return EINVAL;
 483
 484         so = kcb_find_socket(kctl, unit);
 485
 486         if (so == NULL)
 487                 return EINVAL;
 488
 489         if (sbspace(&so->so_rcv) < m->m_pkthdr.len) {
 490                 error = ENOBUFS;
 491                 goto bye;
 492         }
 493         if ((flags & CTL_DATA_EOR))
 494                 m->m_flags |= M_EOR;
 495         if (sbappend(&so->so_rcv, m) && (flags & CTL_DATA_NOWAKEUP) == 0)
 496                 sorwakeup(so);
 497 bye:
 498         socket_unlock(so, 1);
 499         return error;
 500 }
 501
 502 errno_t
 503 ctl_enqueuedata(void *kctlref, u_int32_t unit, void *data, size_t len, u_int32_t flags)
 504 {
 505         struct socket   *so;
 506         struct mbuf     *m;
 507         errno_t                 error = 0;
 508         struct kctl             *kctl = (struct kctl *)kctlref;
 509         unsigned int    num_needed;
 510         struct mbuf     *n;
 511         size_t                  curlen = 0;
 512
 513         if (kctlref == NULL)
 514                 return EINVAL;
 515
 516         so = kcb_find_socket(kctl, unit);
 517         if (so == NULL)
 518                 return EINVAL;
 519
 520         if (sbspace(&so->so_rcv) < (int)len) {
 521                 error = ENOBUFS;
 522                 goto bye;
 523         }
 524
 525         num_needed = 1;
 526         m = m_allocpacket_internal(&num_needed, len, NULL, M_NOWAIT, 1, 0);
 527         if (m == NULL) {
 528                 printf("ctl_enqueuedata: m_allocpacket_internal(%lu) failed\n", len);
 529                 error = ENOBUFS;
 530                 goto bye;
 531         }
 532
 533         for (n = m; n != NULL; n = n->m_next) {
 534                 size_t mlen = mbuf_maxlen(n);
 535
 536                 if (mlen + curlen > len)
 537                         mlen = len - curlen;
 538                 n->m_len = mlen;
 539                 bcopy((char *)data + curlen, n->m_data, mlen);
 540                 curlen += mlen;
 541         }
 542         mbuf_pkthdr_setlen(m, curlen);
 543
 544         if ((flags & CTL_DATA_EOR))
 545                 m->m_flags |= M_EOR;
 546         if (sbappend(&so->so_rcv, m) && (flags & CTL_DATA_NOWAKEUP) == 0)
 547                 sorwakeup(so);
 548 bye:
 549         socket_unlock(so, 1);
 550         return error;
 551 }
 552
 553
 554 errno_t
 555 ctl_getenqueuespace(kern_ctl_ref kctlref, u_int32_t unit, size_t *space)
 556 {
 557         struct kctl             *kctl = (struct kctl *)kctlref;
 558         struct socket   *so;
 559         long avail;
 560
 561         if (kctlref == NULL || space == NULL)
 562                 return EINVAL;
 563
 564         so = kcb_find_socket(kctl, unit);
 565         if (so == NULL)
 566                 return EINVAL;
 567
 568         avail = sbspace(&so->so_rcv);
 569         *space = (avail < 0) ? 0 : avail;
 570         socket_unlock(so, 1);
 571
 572         return 0;
 573 }
 574
 575 static int
 576 ctl_ctloutput(struct socket *so, struct sockopt *sopt)
 577 {
 578         struct ctl_cb   *kcb = (struct ctl_cb *)so->so_pcb;
 579         struct kctl     *kctl;
 580         int     error = 0;
 581         void    *data;
 582         size_t  len;
 583
 584         if (sopt->sopt_level != SYSPROTO_CONTROL) {
 585                 return(EINVAL);
 586         }
 587
 588         if (kcb == NULL)        /* sanity check */
 589                 return(ENOTCONN);
 590
 591         if ((kctl = kcb->kctl) == NULL)
 592                 return(EINVAL);
 593
 594         switch (sopt->sopt_dir) {
 595                 case SOPT_SET:
 596                         if (kctl->setopt == NULL)
 597                                 return(ENOTSUP);
 598                         if (sopt->sopt_valsize == 0) {
 599                                 data = NULL;
 600                         } else {
 601                                 MALLOC(data, void *, sopt->sopt_valsize, M_TEMP, M_WAITOK);
 602                                 if (data == NULL)
 603                                         return(ENOMEM);
 604                                 error = sooptcopyin(sopt, data, sopt->sopt_valsize, sopt->sopt_valsize);
 605                         }
 606                         if (error == 0) {
 607                                 socket_unlock(so, 0);
 608                                 error = (*kctl->setopt)(kcb->kctl, kcb->unit, kcb->userdata, sopt->sopt_name,
 609                                                         data, sopt->sopt_valsize);
 610                                 socket_lock(so, 0);
 611                         }
 612                         FREE(data, M_TEMP);
 613                         break;
 614
 615                 case SOPT_GET:
 616                         if (kctl->getopt == NULL)
 617                                 return(ENOTSUP);
 618                         data = NULL;
 619                         if (sopt->sopt_valsize && sopt->sopt_val) {
 620                                 MALLOC(data, void *, sopt->sopt_valsize, M_TEMP, M_WAITOK);
 621                                 if (data == NULL)
 622                                         return(ENOMEM);
 623                                 /* 4108337 - copy in data for get socket option */
 624                                 error = sooptcopyin(sopt, data, sopt->sopt_valsize, sopt->sopt_valsize);
 625                         }
 626                         len = sopt->sopt_valsize;
 627                         socket_unlock(so, 0);
 628                         error = (*kctl->getopt)(kcb->kctl, kcb->unit, kcb->userdata, sopt->sopt_name,
 629                                                 data, &len);
 630                         if (data != NULL && len > sopt->sopt_valsize)
 631                                 panic_plain("ctl_ctloutput: ctl %s returned len (%lu) > sopt_valsize (%lu)\n",
 632                                         kcb->kctl->name, len, sopt->sopt_valsize);
 633                         socket_lock(so, 0);
 634                         if (error == 0) {
 635                                 if (data != NULL)
 636                                         error = sooptcopyout(sopt, data, len);
 637                                 else
 638                                         sopt->sopt_valsize = len;
 639                         }
 640                         if (data != NULL)
 641                                 FREE(data, M_TEMP);
 642                         break;
 643         }
 644         return error;
 645 }
 646
 647 static int
 648 ctl_ioctl(__unused struct socket *so, u_long cmd, caddr_t data,
 649                         __unused struct ifnet *ifp, __unused struct proc *p)
 650 {
 651         int     error = ENOTSUP;
 652
 653         switch (cmd) {
 654                 /* get the number of controllers */
 655                 case CTLIOCGCOUNT: {
 656                         struct kctl     *kctl;
 657                         int n = 0;
 658
 659                         lck_mtx_lock(ctl_mtx);
 660                         TAILQ_FOREACH(kctl, &ctl_head, next)
 661                                 n++;
 662                         lck_mtx_unlock(ctl_mtx);
 663
 664                         *(u_int32_t *)data = n;
 665                         error = 0;
 666                         break;
 667                 }
 668                 case CTLIOCGINFO: {
 669                         struct ctl_info *ctl_info = (struct ctl_info *)data;
 670                         struct kctl     *kctl = 0;
 671                         size_t name_len = strlen(ctl_info->ctl_name);
 672
 673                         if (name_len == 0 || name_len + 1 > MAX_KCTL_NAME) {
 674                                 error = EINVAL;
 675                                 break;
 676                         }
 677                         lck_mtx_lock(ctl_mtx);
 678                         kctl = ctl_find_by_name(ctl_info->ctl_name);
 679                         lck_mtx_unlock(ctl_mtx);
 680                         if (kctl == 0) {
 681                                 error = ENOENT;
 682                                 break;
 683                         }
 684                         ctl_info->ctl_id = kctl->id;
 685                         error = 0;
 686                         break;
 687                 }
 688
 689                 /* add controls to get list of NKEs */
 690
 691         }
 692
 693         return error;
 694 }
 695
 696 /*
 697  * Register/unregister a NKE
 698  */
 699 errno_t
 700 ctl_register(struct kern_ctl_reg *userkctl, kern_ctl_ref *kctlref)
 701 {
 702         struct kctl     *kctl = NULL;
 703         struct kctl     *kctl_next = NULL;
 704         u_int32_t               id = 1;
 705         size_t                  name_len;
 706
 707         if (userkctl == NULL)   /* sanity check */
 708                 return(EINVAL);
 709         if (userkctl->ctl_connect == NULL)
 710                 return(EINVAL);
 711         name_len = strlen(userkctl->ctl_name);
 712         if (name_len == 0 || name_len + 1 > MAX_KCTL_NAME)
 713                 return(EINVAL);
 714
 715         MALLOC(kctl, struct kctl *, sizeof(*kctl), M_TEMP, M_WAITOK);
 716         if (kctl == NULL)
 717                 return(ENOMEM);
 718         bzero((char *)kctl, sizeof(*kctl));
 719
 720         lck_mtx_lock(ctl_mtx);
 721
 722         /*
 723          * Kernel Control IDs
 724          *
 725          * CTL_FLAG_REG_ID_UNIT indicates the control ID and unit number are
 726          * static. If they do not exist, add them to the list in order. If the
 727          * flag is not set, we must find a new unique value. We assume the
 728          * list is in order. We find the last item in the list and add one. If
 729          * this leads to wrapping the id around, we start at the front of the
 730          * list and look for a gap.
 731          */
 732
 733         if ((userkctl->ctl_flags & CTL_FLAG_REG_ID_UNIT) == 0) {
 734                 /* Must dynamically assign an unused ID */
 735
 736                 /* Verify the same name isn't already registered */
 737                 if (ctl_find_by_name(userkctl->ctl_name) != NULL) {
 738                         lck_mtx_unlock(ctl_mtx);
 739                         FREE(kctl, M_TEMP);
 740                         return(EEXIST);
 741                 }
 742
 743                 /* Start with 1 in case the list is empty */
 744                 id = 1;
 745                 kctl_next = TAILQ_LAST(&ctl_head, kctl_list);
 746
 747                 if (kctl_next != NULL) {
 748                         /* List was not empty, add one to the last item in the list */
 749                         id = kctl_next->id + 1;
 750                         kctl_next = NULL;
 751
 752                         /*
 753                          * If this wrapped the id number, start looking at the front
 754                          * of the list for an unused id.
 755                          */
 756                         if (id == 0) {
 757                                 /* Find the next unused ID */
 758                                 id = 1;
 759
 760                                 TAILQ_FOREACH(kctl_next, &ctl_head, next) {
 761                                         if (kctl_next->id > id) {
 762                                                 /* We found a gap */
 763                                                 break;
 764                                         }
 765
 766                                         id = kctl_next->id + 1;
 767                                 }
 768                         }
 769                 }
 770
 771                 userkctl->ctl_id = id;
 772                 kctl->id = id;
 773                 kctl->reg_unit = -1;
 774         } else {
 775                 TAILQ_FOREACH(kctl_next, &ctl_head, next) {
 776                         if (kctl_next->id > userkctl->ctl_id)
 777                                 break;
 778                 }
 779
 780                 if (ctl_find_by_id_unit(userkctl->ctl_id, userkctl->ctl_unit) != NULL) {
 781                         lck_mtx_unlock(ctl_mtx);
 782                         FREE(kctl, M_TEMP);
 783                         return(EEXIST);
 784                 }
 785                 kctl->id = userkctl->ctl_id;
 786                 kctl->reg_unit = userkctl->ctl_unit;
 787         }
 788         strlcpy(kctl->name, userkctl->ctl_name, MAX_KCTL_NAME);
 789         kctl->flags = userkctl->ctl_flags;
 790
 791         /* Let the caller know the default send and receive sizes */
 792         if (userkctl->ctl_sendsize == 0)
 793                 userkctl->ctl_sendsize = CTL_SENDSIZE;
 794         kctl->sendbufsize = userkctl->ctl_sendsize;
 795
 796         if (userkctl->ctl_recvsize == 0)
 797                 userkctl->ctl_recvsize = CTL_RECVSIZE;
 798         kctl->recvbufsize = userkctl->ctl_recvsize;
 799
 800         kctl->connect = userkctl->ctl_connect;
 801         kctl->disconnect = userkctl->ctl_disconnect;
 802         kctl->send = userkctl->ctl_send;
 803         kctl->setopt = userkctl->ctl_setopt;
 804         kctl->getopt = userkctl->ctl_getopt;
 805
 806         TAILQ_INIT(&kctl->kcb_head);
 807
 808         if (kctl_next)
 809                 TAILQ_INSERT_BEFORE(kctl_next, kctl, next);
 810         else
 811                 TAILQ_INSERT_TAIL(&ctl_head, kctl, next);
 812
 813         lck_mtx_unlock(ctl_mtx);
 814
 815         *kctlref = kctl;
 816
 817         ctl_post_msg(KEV_CTL_REGISTERED, kctl->id);
 818         return(0);
 819 }
 820
 821 errno_t
 822 ctl_deregister(void *kctlref)
 823 {
 824     struct kctl         *kctl;
 825
 826     if (kctlref == NULL)        /* sanity check */
 827         return(EINVAL);
 828
 829     lck_mtx_lock(ctl_mtx);
 830     TAILQ_FOREACH(kctl, &ctl_head, next) {
 831         if (kctl == (struct kctl *)kctlref)
 832                 break;
 833     }
 834     if (kctl != (struct kctl *)kctlref) {
 835         lck_mtx_unlock(ctl_mtx);
 836         return EINVAL;
 837     }
 838         if (!TAILQ_EMPTY(&kctl->kcb_head)) {
 839         lck_mtx_unlock(ctl_mtx);
 840                 return EBUSY;
 841         }
 842
 843     TAILQ_REMOVE(&ctl_head, kctl, next);
 844
 845     lck_mtx_unlock(ctl_mtx);
 846
 847     ctl_post_msg(KEV_CTL_DEREGISTERED, kctl->id);
 848     FREE(kctl, M_TEMP);
 849     return(0);
 850 }
 851
 852 /*
 853  * Must be called with global ctl_mtx lock taked
 854  */
 855 static struct kctl *
 856 ctl_find_by_name(const char *name)
 857 {
 858     struct kctl         *kctl;
 859
 860     TAILQ_FOREACH(kctl, &ctl_head, next)
 861         if (strncmp(kctl->name, name, sizeof(kctl->name)) == 0)
 862             return kctl;
 863
 864     return NULL;
 865 }
 866
 867 u_int32_t
 868 ctl_id_by_name(const char *name)
 869 {
 870         u_int32_t       ctl_id = 0;
 871
 872         lck_mtx_lock(ctl_mtx);
 873         struct kctl *kctl = ctl_find_by_name(name);
 874         if (kctl) ctl_id = kctl->id;
 875         lck_mtx_unlock(ctl_mtx);
 876
 877         return ctl_id;
 878 }
 879
 880 errno_t
 881 ctl_name_by_id(
 882         u_int32_t id,
 883         char    *out_name,
 884         size_t  maxsize)
 885 {
 886         int             found = 0;
 887
 888         lck_mtx_lock(ctl_mtx);
 889         struct kctl *kctl;
 890     TAILQ_FOREACH(kctl, &ctl_head, next) {
 891         if (kctl->id == id)
 892             break;
 893     }
 894
 895     if (kctl && kctl->name)
 896     {
 897         if (maxsize > MAX_KCTL_NAME)
 898                 maxsize = MAX_KCTL_NAME;
 899         strlcpy(out_name, kctl->name, maxsize);
 900         found = 1;
 901     }
 902         lck_mtx_unlock(ctl_mtx);
 903
 904         return found ? 0 : ENOENT;
 905 }
 906
 907 /*
 908  * Must be called with global ctl_mtx lock taked
 909  *
 910  */
 911 static struct kctl *
 912 ctl_find_by_id_unit(u_int32_t id, u_int32_t unit)
 913 {
 914     struct kctl         *kctl;
 915
 916     TAILQ_FOREACH(kctl, &ctl_head, next) {
 917         if (kctl->id == id && (kctl->flags & CTL_FLAG_REG_ID_UNIT) == 0)
 918             return kctl;
 919         else if (kctl->id == id && kctl->reg_unit == unit)
 920             return kctl;
 921     }
 922     return NULL;
 923 }
 924
 925 /*
 926  * Must be called with kernel controller lock taken
 927  */
 928 static struct ctl_cb *
 929 kcb_find(struct kctl *kctl, u_int32_t unit)
 930 {
 931     struct ctl_cb       *kcb;
 932
 933     TAILQ_FOREACH(kcb, &kctl->kcb_head, next)
 934         if (kcb->unit == unit)
 935             return kcb;
 936
 937     return NULL;
 938 }
 939
 940 static struct socket *
 941 kcb_find_socket(struct kctl *kctl, u_int32_t unit)
 942 {
 943         struct socket *so = NULL;
 944
 945         lck_mtx_lock(ctl_mtx);
 946         struct ctl_cb   *kcb = kcb_find(kctl, unit);
 947         if (kcb && kcb->kctl == kctl) {
 948                 so = kcb->so;
 949                 if (so) {
 950                         kcb->usecount++;
 951                 }
 952         }
 953         lck_mtx_unlock(ctl_mtx);
 954
 955         if (so == NULL) {
 956                 return NULL;
 957         }
 958
 959         socket_lock(so, 1);
 960
 961         lck_mtx_lock(ctl_mtx);
 962         if (kcb->kctl == NULL)
 963         {
 964                 lck_mtx_unlock(ctl_mtx);
 965                 socket_unlock(so, 1);
 966                 so = NULL;
 967                 lck_mtx_lock(ctl_mtx);
 968         }
 969         kcb->usecount--;
 970         if (kcb->usecount == 0)
 971                 wakeup((event_t)&kcb->usecount);
 972         lck_mtx_unlock(ctl_mtx);
 973
 974         return so;
 975 }
 976
 977 static void
 978 ctl_post_msg(u_int32_t event_code, u_int32_t id)
 979 {
 980     struct ctl_event_data       ctl_ev_data;
 981     struct kev_msg              ev_msg;
 982
 983     lck_mtx_assert(ctl_mtx, LCK_MTX_ASSERT_NOTOWNED);
 984
 985     bzero(&ev_msg, sizeof(struct kev_msg));
 986     ev_msg.vendor_code    = KEV_VENDOR_APPLE;
 987
 988     ev_msg.kev_class      = KEV_SYSTEM_CLASS;
 989     ev_msg.kev_subclass   = KEV_CTL_SUBCLASS;
 990     ev_msg.event_code     = event_code;
 991
 992     /* common nke subclass data */
 993     bzero(&ctl_ev_data, sizeof(ctl_ev_data));
 994     ctl_ev_data.ctl_id = id;
 995     ev_msg.dv[0].data_ptr    = &ctl_ev_data;
 996     ev_msg.dv[0].data_length = sizeof(ctl_ev_data);
 997
 998     ev_msg.dv[1].data_length = 0;
 999
1000     kev_post_msg(&ev_msg);
1001 }
1002
1003 static int
1004 ctl_lock(struct socket *so, int refcount, void *lr)
1005 {
1006         void *lr_saved;
1007
1008         if (lr == NULL)
1009                 lr_saved = __builtin_return_address(0);
1010         else
1011                 lr_saved = lr;
1012
1013         if (so->so_pcb != NULL) {
1014                 lck_mtx_lock(((struct ctl_cb *)so->so_pcb)->mtx);
1015         } else  {
1016                 panic("ctl_lock: so=%p NO PCB! lr=%p lrh= %s\n",
1017                     so, lr_saved, solockhistory_nr(so));
1018                 /* NOTREACHED */
1019         }
1020
1021         if (so->so_usecount < 0) {
1022                 panic("ctl_lock: so=%p so_pcb=%p lr=%p ref=%x lrh= %s\n",
1023                     so, so->so_pcb, lr_saved, so->so_usecount, solockhistory_nr(so));
1024                 /* NOTREACHED */
1025         }
1026
1027         if (refcount)
1028                 so->so_usecount++;
1029
1030         so->lock_lr[so->next_lock_lr] = lr_saved;
1031         so->next_lock_lr = (so->next_lock_lr+1) % SO_LCKDBG_MAX;
1032         return (0);
1033 }
1034
1035 static int
1036 ctl_unlock(struct socket *so, int refcount, void *lr)
1037 {
1038         void *lr_saved;
1039         lck_mtx_t *mutex_held;
1040
1041         if (lr == NULL)
1042                 lr_saved = __builtin_return_address(0);
1043         else
1044                 lr_saved = lr;
1045
1046 #ifdef MORE_KCTLLOCK_DEBUG
1047         printf("ctl_unlock: so=%x sopcb=%x lock=%x ref=%x lr=%p\n",
1048             so, so->so_pcb, ((struct ctl_cb *)so->so_pcb)->mtx,
1049             so->so_usecount, lr_saved);
1050 #endif
1051         if (refcount)
1052                 so->so_usecount--;
1053
1054         if (so->so_usecount < 0) {
1055                 panic("ctl_unlock: so=%p usecount=%x lrh= %s\n",
1056                     so, so->so_usecount, solockhistory_nr(so));
1057                 /* NOTREACHED */
1058         }
1059         if (so->so_pcb == NULL) {
1060                 panic("ctl_unlock: so=%p NO PCB usecount=%x lr=%p lrh= %s\n",
1061                     so, so->so_usecount, (void *)lr_saved, solockhistory_nr(so));
1062                 /* NOTREACHED */
1063         }
1064         mutex_held = ((struct ctl_cb *)so->so_pcb)->mtx;
1065
1066         lck_mtx_assert(mutex_held, LCK_MTX_ASSERT_OWNED);
1067         so->unlock_lr[so->next_unlock_lr] = lr_saved;
1068         so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
1069         lck_mtx_unlock(mutex_held);
1070
1071         if (so->so_usecount == 0)
1072                 ctl_sofreelastref(so);
1073
1074         return (0);
1075 }
1076
1077 static lck_mtx_t *
1078 ctl_getlock(struct socket *so, __unused int locktype)
1079 {
1080         struct ctl_cb *kcb = (struct ctl_cb *)so->so_pcb;
1081
1082         if (so->so_pcb)  {
1083                 if (so->so_usecount < 0)
1084                         panic("ctl_getlock: so=%p usecount=%x lrh= %s\n",
1085                             so, so->so_usecount, solockhistory_nr(so));
1086                 return(kcb->mtx);
1087         } else {
1088                 panic("ctl_getlock: so=%p NULL NO so_pcb %s\n",
1089                     so, solockhistory_nr(so));
1090                 return (so->so_proto->pr_domain->dom_mtx);
1091         }
1092 }