kern_sysctl.c revision 217915
1/*-
2 * Copyright (c) 1982, 1986, 1989, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * This code is derived from software contributed to Berkeley by
6 * Mike Karels at Berkeley Software Design, Inc.
7 *
8 * Quite extensively rewritten by Poul-Henning Kamp of the FreeBSD
9 * project, to make these variables more userfriendly.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 * 4. Neither the name of the University nor the names of its contributors
20 *    may be used to endorse or promote products derived from this software
21 *    without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 *
35 *	@(#)kern_sysctl.c	8.4 (Berkeley) 4/14/94
36 */
37
38#include <sys/cdefs.h>
39__FBSDID("$FreeBSD: head/sys/kern/kern_sysctl.c 217915 2011-01-26 22:48:09Z mdf $");
40
41#include "opt_compat.h"
42#include "opt_ktrace.h"
43
44#include <sys/param.h>
45#include <sys/fail.h>
46#include <sys/systm.h>
47#include <sys/kernel.h>
48#include <sys/sysctl.h>
49#include <sys/malloc.h>
50#include <sys/priv.h>
51#include <sys/proc.h>
52#include <sys/jail.h>
53#include <sys/lock.h>
54#include <sys/mutex.h>
55#include <sys/sbuf.h>
56#include <sys/sx.h>
57#include <sys/sysproto.h>
58#include <sys/uio.h>
59#ifdef KTRACE
60#include <sys/ktrace.h>
61#endif
62
63#include <net/vnet.h>
64
65#include <security/mac/mac_framework.h>
66
67#include <vm/vm.h>
68#include <vm/vm_extern.h>
69
70static MALLOC_DEFINE(M_SYSCTL, "sysctl", "sysctl internal magic");
71static MALLOC_DEFINE(M_SYSCTLOID, "sysctloid", "sysctl dynamic oids");
72static MALLOC_DEFINE(M_SYSCTLTMP, "sysctltmp", "sysctl temp output buffer");
73
74/*
75 * The sysctllock protects the MIB tree.  It also protects sysctl
76 * contexts used with dynamic sysctls.  The sysctl_register_oid() and
77 * sysctl_unregister_oid() routines require the sysctllock to already
78 * be held, so the sysctl_lock() and sysctl_unlock() routines are
79 * provided for the few places in the kernel which need to use that
80 * API rather than using the dynamic API.  Use of the dynamic API is
81 * strongly encouraged for most code.
82 *
83 * The sysctlmemlock is used to limit the amount of user memory wired for
84 * sysctl requests.  This is implemented by serializing any userland
85 * sysctl requests larger than a single page via an exclusive lock.
86 */
87static struct sx sysctllock;
88static struct sx sysctlmemlock;
89
90#define	SYSCTL_XLOCK()		sx_xlock(&sysctllock)
91#define	SYSCTL_XUNLOCK()	sx_xunlock(&sysctllock)
92#define	SYSCTL_ASSERT_XLOCKED()	sx_assert(&sysctllock, SA_XLOCKED)
93#define	SYSCTL_INIT()		sx_init(&sysctllock, "sysctl lock")
94#define	SYSCTL_SLEEP(ch, wmesg, timo)					\
95				sx_sleep(ch, &sysctllock, 0, wmesg, timo)
96
97static int sysctl_root(SYSCTL_HANDLER_ARGS);
98
99struct sysctl_oid_list sysctl__children; /* root list */
100
101static int	sysctl_remove_oid_locked(struct sysctl_oid *oidp, int del,
102		    int recurse);
103
104static struct sysctl_oid *
105sysctl_find_oidname(const char *name, struct sysctl_oid_list *list)
106{
107	struct sysctl_oid *oidp;
108
109	SYSCTL_ASSERT_XLOCKED();
110	SLIST_FOREACH(oidp, list, oid_link) {
111		if (strcmp(oidp->oid_name, name) == 0) {
112			return (oidp);
113		}
114	}
115	return (NULL);
116}
117
118/*
119 * Initialization of the MIB tree.
120 *
121 * Order by number in each list.
122 */
123void
124sysctl_lock(void)
125{
126
127	SYSCTL_XLOCK();
128}
129
130void
131sysctl_unlock(void)
132{
133
134	SYSCTL_XUNLOCK();
135}
136
137void
138sysctl_register_oid(struct sysctl_oid *oidp)
139{
140	struct sysctl_oid_list *parent = oidp->oid_parent;
141	struct sysctl_oid *p;
142	struct sysctl_oid *q;
143
144	/*
145	 * First check if another oid with the same name already
146	 * exists in the parent's list.
147	 */
148	SYSCTL_ASSERT_XLOCKED();
149	p = sysctl_find_oidname(oidp->oid_name, parent);
150	if (p != NULL) {
151		if ((p->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
152			p->oid_refcnt++;
153			return;
154		} else {
155			printf("can't re-use a leaf (%s)!\n", p->oid_name);
156			return;
157		}
158	}
159	/*
160	 * If this oid has a number OID_AUTO, give it a number which
161	 * is greater than any current oid.
162	 * NOTE: DO NOT change the starting value here, change it in
163	 * <sys/sysctl.h>, and make sure it is at least 256 to
164	 * accomodate e.g. net.inet.raw as a static sysctl node.
165	 */
166	if (oidp->oid_number == OID_AUTO) {
167		static int newoid = CTL_AUTO_START;
168
169		oidp->oid_number = newoid++;
170		if (newoid == 0x7fffffff)
171			panic("out of oids");
172	}
173#if 0
174	else if (oidp->oid_number >= CTL_AUTO_START) {
175		/* do not panic; this happens when unregistering sysctl sets */
176		printf("static sysctl oid too high: %d", oidp->oid_number);
177	}
178#endif
179
180	/*
181	 * Insert the oid into the parent's list in order.
182	 */
183	q = NULL;
184	SLIST_FOREACH(p, parent, oid_link) {
185		if (oidp->oid_number < p->oid_number)
186			break;
187		q = p;
188	}
189	if (q)
190		SLIST_INSERT_AFTER(q, oidp, oid_link);
191	else
192		SLIST_INSERT_HEAD(parent, oidp, oid_link);
193}
194
195void
196sysctl_unregister_oid(struct sysctl_oid *oidp)
197{
198	struct sysctl_oid *p;
199	int error;
200
201	SYSCTL_ASSERT_XLOCKED();
202	error = ENOENT;
203	if (oidp->oid_number == OID_AUTO) {
204		error = EINVAL;
205	} else {
206		SLIST_FOREACH(p, oidp->oid_parent, oid_link) {
207			if (p == oidp) {
208				SLIST_REMOVE(oidp->oid_parent, oidp,
209				    sysctl_oid, oid_link);
210				error = 0;
211				break;
212			}
213		}
214	}
215
216	/*
217	 * This can happen when a module fails to register and is
218	 * being unloaded afterwards.  It should not be a panic()
219	 * for normal use.
220	 */
221	if (error)
222		printf("%s: failed to unregister sysctl\n", __func__);
223}
224
225/* Initialize a new context to keep track of dynamically added sysctls. */
226int
227sysctl_ctx_init(struct sysctl_ctx_list *c)
228{
229
230	if (c == NULL) {
231		return (EINVAL);
232	}
233
234	/*
235	 * No locking here, the caller is responsible for not adding
236	 * new nodes to a context until after this function has
237	 * returned.
238	 */
239	TAILQ_INIT(c);
240	return (0);
241}
242
243/* Free the context, and destroy all dynamic oids registered in this context */
244int
245sysctl_ctx_free(struct sysctl_ctx_list *clist)
246{
247	struct sysctl_ctx_entry *e, *e1;
248	int error;
249
250	error = 0;
251	/*
252	 * First perform a "dry run" to check if it's ok to remove oids.
253	 * XXX FIXME
254	 * XXX This algorithm is a hack. But I don't know any
255	 * XXX better solution for now...
256	 */
257	SYSCTL_XLOCK();
258	TAILQ_FOREACH(e, clist, link) {
259		error = sysctl_remove_oid_locked(e->entry, 0, 0);
260		if (error)
261			break;
262	}
263	/*
264	 * Restore deregistered entries, either from the end,
265	 * or from the place where error occured.
266	 * e contains the entry that was not unregistered
267	 */
268	if (error)
269		e1 = TAILQ_PREV(e, sysctl_ctx_list, link);
270	else
271		e1 = TAILQ_LAST(clist, sysctl_ctx_list);
272	while (e1 != NULL) {
273		sysctl_register_oid(e1->entry);
274		e1 = TAILQ_PREV(e1, sysctl_ctx_list, link);
275	}
276	if (error) {
277		SYSCTL_XUNLOCK();
278		return(EBUSY);
279	}
280	/* Now really delete the entries */
281	e = TAILQ_FIRST(clist);
282	while (e != NULL) {
283		e1 = TAILQ_NEXT(e, link);
284		error = sysctl_remove_oid_locked(e->entry, 1, 0);
285		if (error)
286			panic("sysctl_remove_oid: corrupt tree, entry: %s",
287			    e->entry->oid_name);
288		free(e, M_SYSCTLOID);
289		e = e1;
290	}
291	SYSCTL_XUNLOCK();
292	return (error);
293}
294
295/* Add an entry to the context */
296struct sysctl_ctx_entry *
297sysctl_ctx_entry_add(struct sysctl_ctx_list *clist, struct sysctl_oid *oidp)
298{
299	struct sysctl_ctx_entry *e;
300
301	SYSCTL_ASSERT_XLOCKED();
302	if (clist == NULL || oidp == NULL)
303		return(NULL);
304	e = malloc(sizeof(struct sysctl_ctx_entry), M_SYSCTLOID, M_WAITOK);
305	e->entry = oidp;
306	TAILQ_INSERT_HEAD(clist, e, link);
307	return (e);
308}
309
310/* Find an entry in the context */
311struct sysctl_ctx_entry *
312sysctl_ctx_entry_find(struct sysctl_ctx_list *clist, struct sysctl_oid *oidp)
313{
314	struct sysctl_ctx_entry *e;
315
316	SYSCTL_ASSERT_XLOCKED();
317	if (clist == NULL || oidp == NULL)
318		return(NULL);
319	TAILQ_FOREACH(e, clist, link) {
320		if(e->entry == oidp)
321			return(e);
322	}
323	return (e);
324}
325
326/*
327 * Delete an entry from the context.
328 * NOTE: this function doesn't free oidp! You have to remove it
329 * with sysctl_remove_oid().
330 */
331int
332sysctl_ctx_entry_del(struct sysctl_ctx_list *clist, struct sysctl_oid *oidp)
333{
334	struct sysctl_ctx_entry *e;
335
336	if (clist == NULL || oidp == NULL)
337		return (EINVAL);
338	SYSCTL_XLOCK();
339	e = sysctl_ctx_entry_find(clist, oidp);
340	if (e != NULL) {
341		TAILQ_REMOVE(clist, e, link);
342		SYSCTL_XUNLOCK();
343		free(e, M_SYSCTLOID);
344		return (0);
345	} else {
346		SYSCTL_XUNLOCK();
347		return (ENOENT);
348	}
349}
350
351/*
352 * Remove dynamically created sysctl trees.
353 * oidp - top of the tree to be removed
354 * del - if 0 - just deregister, otherwise free up entries as well
355 * recurse - if != 0 traverse the subtree to be deleted
356 */
357int
358sysctl_remove_oid(struct sysctl_oid *oidp, int del, int recurse)
359{
360	int error;
361
362	SYSCTL_XLOCK();
363	error = sysctl_remove_oid_locked(oidp, del, recurse);
364	SYSCTL_XUNLOCK();
365	return (error);
366}
367
368static int
369sysctl_remove_oid_locked(struct sysctl_oid *oidp, int del, int recurse)
370{
371	struct sysctl_oid *p;
372	int error;
373
374	SYSCTL_ASSERT_XLOCKED();
375	if (oidp == NULL)
376		return(EINVAL);
377	if ((oidp->oid_kind & CTLFLAG_DYN) == 0) {
378		printf("can't remove non-dynamic nodes!\n");
379		return (EINVAL);
380	}
381	/*
382	 * WARNING: normal method to do this should be through
383	 * sysctl_ctx_free(). Use recursing as the last resort
384	 * method to purge your sysctl tree of leftovers...
385	 * However, if some other code still references these nodes,
386	 * it will panic.
387	 */
388	if ((oidp->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
389		if (oidp->oid_refcnt == 1) {
390			SLIST_FOREACH(p, SYSCTL_CHILDREN(oidp), oid_link) {
391				if (!recurse)
392					return (ENOTEMPTY);
393				error = sysctl_remove_oid_locked(p, del,
394				    recurse);
395				if (error)
396					return (error);
397			}
398			if (del)
399				free(SYSCTL_CHILDREN(oidp), M_SYSCTLOID);
400		}
401	}
402	if (oidp->oid_refcnt > 1 ) {
403		oidp->oid_refcnt--;
404	} else {
405		if (oidp->oid_refcnt == 0) {
406			printf("Warning: bad oid_refcnt=%u (%s)!\n",
407				oidp->oid_refcnt, oidp->oid_name);
408			return (EINVAL);
409		}
410		sysctl_unregister_oid(oidp);
411		if (del) {
412			/*
413			 * Wait for all threads running the handler to drain.
414			 * This preserves the previous behavior when the
415			 * sysctl lock was held across a handler invocation,
416			 * and is necessary for module unload correctness.
417			 */
418			while (oidp->oid_running > 0) {
419				oidp->oid_kind |= CTLFLAG_DYING;
420				SYSCTL_SLEEP(&oidp->oid_running, "oidrm", 0);
421			}
422			if (oidp->oid_descr)
423				free((void *)(uintptr_t)(const void *)oidp->oid_descr, M_SYSCTLOID);
424			free((void *)(uintptr_t)(const void *)oidp->oid_name,
425			     M_SYSCTLOID);
426			free(oidp, M_SYSCTLOID);
427		}
428	}
429	return (0);
430}
431
432/*
433 * Create new sysctls at run time.
434 * clist may point to a valid context initialized with sysctl_ctx_init().
435 */
436struct sysctl_oid *
437sysctl_add_oid(struct sysctl_ctx_list *clist, struct sysctl_oid_list *parent,
438	int number, const char *name, int kind, void *arg1, int arg2,
439	int (*handler)(SYSCTL_HANDLER_ARGS), const char *fmt, const char *descr)
440{
441	struct sysctl_oid *oidp;
442	ssize_t len;
443	char *newname;
444
445	/* You have to hook up somewhere.. */
446	if (parent == NULL)
447		return(NULL);
448	/* Check if the node already exists, otherwise create it */
449	SYSCTL_XLOCK();
450	oidp = sysctl_find_oidname(name, parent);
451	if (oidp != NULL) {
452		if ((oidp->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
453			oidp->oid_refcnt++;
454			/* Update the context */
455			if (clist != NULL)
456				sysctl_ctx_entry_add(clist, oidp);
457			SYSCTL_XUNLOCK();
458			return (oidp);
459		} else {
460			SYSCTL_XUNLOCK();
461			printf("can't re-use a leaf (%s)!\n", name);
462			return (NULL);
463		}
464	}
465	oidp = malloc(sizeof(struct sysctl_oid), M_SYSCTLOID, M_WAITOK|M_ZERO);
466	oidp->oid_parent = parent;
467	SLIST_NEXT(oidp, oid_link) = NULL;
468	oidp->oid_number = number;
469	oidp->oid_refcnt = 1;
470	len = strlen(name);
471	newname = malloc(len + 1, M_SYSCTLOID, M_WAITOK);
472	bcopy(name, newname, len + 1);
473	newname[len] = '\0';
474	oidp->oid_name = newname;
475	oidp->oid_handler = handler;
476	oidp->oid_kind = CTLFLAG_DYN | kind;
477	if ((kind & CTLTYPE) == CTLTYPE_NODE) {
478		/* Allocate space for children */
479		SYSCTL_CHILDREN_SET(oidp, malloc(sizeof(struct sysctl_oid_list),
480		    M_SYSCTLOID, M_WAITOK));
481		SLIST_INIT(SYSCTL_CHILDREN(oidp));
482	} else {
483		oidp->oid_arg1 = arg1;
484		oidp->oid_arg2 = arg2;
485	}
486	oidp->oid_fmt = fmt;
487	if (descr) {
488		int len = strlen(descr) + 1;
489		oidp->oid_descr = malloc(len, M_SYSCTLOID, M_WAITOK);
490		if (oidp->oid_descr)
491			strcpy((char *)(uintptr_t)(const void *)oidp->oid_descr, descr);
492	}
493	/* Update the context, if used */
494	if (clist != NULL)
495		sysctl_ctx_entry_add(clist, oidp);
496	/* Register this oid */
497	sysctl_register_oid(oidp);
498	SYSCTL_XUNLOCK();
499	return (oidp);
500}
501
502/*
503 * Rename an existing oid.
504 */
505void
506sysctl_rename_oid(struct sysctl_oid *oidp, const char *name)
507{
508	ssize_t len;
509	char *newname;
510	void *oldname;
511
512	len = strlen(name);
513	newname = malloc(len + 1, M_SYSCTLOID, M_WAITOK);
514	bcopy(name, newname, len + 1);
515	newname[len] = '\0';
516	SYSCTL_XLOCK();
517	oldname = (void *)(uintptr_t)(const void *)oidp->oid_name;
518	oidp->oid_name = newname;
519	SYSCTL_XUNLOCK();
520	free(oldname, M_SYSCTLOID);
521}
522
523/*
524 * Reparent an existing oid.
525 */
526int
527sysctl_move_oid(struct sysctl_oid *oid, struct sysctl_oid_list *parent)
528{
529	struct sysctl_oid *oidp;
530
531	SYSCTL_XLOCK();
532	if (oid->oid_parent == parent) {
533		SYSCTL_XUNLOCK();
534		return (0);
535	}
536	oidp = sysctl_find_oidname(oid->oid_name, parent);
537	if (oidp != NULL) {
538		SYSCTL_XUNLOCK();
539		return (EEXIST);
540	}
541	sysctl_unregister_oid(oid);
542	oid->oid_parent = parent;
543	oid->oid_number = OID_AUTO;
544	sysctl_register_oid(oid);
545	SYSCTL_XUNLOCK();
546	return (0);
547}
548
549/*
550 * Register the kernel's oids on startup.
551 */
552SET_DECLARE(sysctl_set, struct sysctl_oid);
553
554static void
555sysctl_register_all(void *arg)
556{
557	struct sysctl_oid **oidp;
558
559	sx_init(&sysctlmemlock, "sysctl mem");
560	SYSCTL_INIT();
561	SYSCTL_XLOCK();
562	SET_FOREACH(oidp, sysctl_set)
563		sysctl_register_oid(*oidp);
564	SYSCTL_XUNLOCK();
565}
566SYSINIT(sysctl, SI_SUB_KMEM, SI_ORDER_ANY, sysctl_register_all, 0);
567
568/*
569 * "Staff-functions"
570 *
571 * These functions implement a presently undocumented interface
572 * used by the sysctl program to walk the tree, and get the type
573 * so it can print the value.
574 * This interface is under work and consideration, and should probably
575 * be killed with a big axe by the first person who can find the time.
576 * (be aware though, that the proper interface isn't as obvious as it
577 * may seem, there are various conflicting requirements.
578 *
579 * {0,0}	printf the entire MIB-tree.
580 * {0,1,...}	return the name of the "..." OID.
581 * {0,2,...}	return the next OID.
582 * {0,3}	return the OID of the name in "new"
583 * {0,4,...}	return the kind & format info for the "..." OID.
584 * {0,5,...}	return the description the "..." OID.
585 */
586
587#ifdef SYSCTL_DEBUG
588static void
589sysctl_sysctl_debug_dump_node(struct sysctl_oid_list *l, int i)
590{
591	int k;
592	struct sysctl_oid *oidp;
593
594	SYSCTL_ASSERT_XLOCKED();
595	SLIST_FOREACH(oidp, l, oid_link) {
596
597		for (k=0; k<i; k++)
598			printf(" ");
599
600		printf("%d %s ", oidp->oid_number, oidp->oid_name);
601
602		printf("%c%c",
603			oidp->oid_kind & CTLFLAG_RD ? 'R':' ',
604			oidp->oid_kind & CTLFLAG_WR ? 'W':' ');
605
606		if (oidp->oid_handler)
607			printf(" *Handler");
608
609		switch (oidp->oid_kind & CTLTYPE) {
610			case CTLTYPE_NODE:
611				printf(" Node\n");
612				if (!oidp->oid_handler) {
613					sysctl_sysctl_debug_dump_node(
614						oidp->oid_arg1, i+2);
615				}
616				break;
617			case CTLTYPE_INT:    printf(" Int\n"); break;
618			case CTLTYPE_UINT:   printf(" u_int\n"); break;
619			case CTLTYPE_LONG:   printf(" Long\n"); break;
620			case CTLTYPE_ULONG:  printf(" u_long\n"); break;
621			case CTLTYPE_STRING: printf(" String\n"); break;
622			case CTLTYPE_U64:    printf(" uint64_t\n"); break;
623			case CTLTYPE_S64:    printf(" int64_t\n"); break;
624			case CTLTYPE_OPAQUE: printf(" Opaque/struct\n"); break;
625			default:	     printf("\n");
626		}
627
628	}
629}
630
631static int
632sysctl_sysctl_debug(SYSCTL_HANDLER_ARGS)
633{
634	int error;
635
636	error = priv_check(req->td, PRIV_SYSCTL_DEBUG);
637	if (error)
638		return (error);
639	SYSCTL_XLOCK();
640	sysctl_sysctl_debug_dump_node(&sysctl__children, 0);
641	SYSCTL_XUNLOCK();
642	return (ENOENT);
643}
644
645SYSCTL_PROC(_sysctl, 0, debug, CTLTYPE_STRING|CTLFLAG_RD,
646	0, 0, sysctl_sysctl_debug, "-", "");
647#endif
648
649static int
650sysctl_sysctl_name(SYSCTL_HANDLER_ARGS)
651{
652	int *name = (int *) arg1;
653	u_int namelen = arg2;
654	int error = 0;
655	struct sysctl_oid *oid;
656	struct sysctl_oid_list *lsp = &sysctl__children, *lsp2;
657	char buf[10];
658
659	SYSCTL_XLOCK();
660	while (namelen) {
661		if (!lsp) {
662			snprintf(buf,sizeof(buf),"%d",*name);
663			if (req->oldidx)
664				error = SYSCTL_OUT(req, ".", 1);
665			if (!error)
666				error = SYSCTL_OUT(req, buf, strlen(buf));
667			if (error)
668				goto out;
669			namelen--;
670			name++;
671			continue;
672		}
673		lsp2 = 0;
674		SLIST_FOREACH(oid, lsp, oid_link) {
675			if (oid->oid_number != *name)
676				continue;
677
678			if (req->oldidx)
679				error = SYSCTL_OUT(req, ".", 1);
680			if (!error)
681				error = SYSCTL_OUT(req, oid->oid_name,
682					strlen(oid->oid_name));
683			if (error)
684				goto out;
685
686			namelen--;
687			name++;
688
689			if ((oid->oid_kind & CTLTYPE) != CTLTYPE_NODE)
690				break;
691
692			if (oid->oid_handler)
693				break;
694
695			lsp2 = SYSCTL_CHILDREN(oid);
696			break;
697		}
698		lsp = lsp2;
699	}
700	error = SYSCTL_OUT(req, "", 1);
701 out:
702	SYSCTL_XUNLOCK();
703	return (error);
704}
705
706static SYSCTL_NODE(_sysctl, 1, name, CTLFLAG_RD, sysctl_sysctl_name, "");
707
708static int
709sysctl_sysctl_next_ls(struct sysctl_oid_list *lsp, int *name, u_int namelen,
710	int *next, int *len, int level, struct sysctl_oid **oidpp)
711{
712	struct sysctl_oid *oidp;
713
714	SYSCTL_ASSERT_XLOCKED();
715	*len = level;
716	SLIST_FOREACH(oidp, lsp, oid_link) {
717		*next = oidp->oid_number;
718		*oidpp = oidp;
719
720		if (oidp->oid_kind & CTLFLAG_SKIP)
721			continue;
722
723		if (!namelen) {
724			if ((oidp->oid_kind & CTLTYPE) != CTLTYPE_NODE)
725				return (0);
726			if (oidp->oid_handler)
727				/* We really should call the handler here...*/
728				return (0);
729			lsp = SYSCTL_CHILDREN(oidp);
730			if (!sysctl_sysctl_next_ls(lsp, 0, 0, next+1,
731				len, level+1, oidpp))
732				return (0);
733			goto emptynode;
734		}
735
736		if (oidp->oid_number < *name)
737			continue;
738
739		if (oidp->oid_number > *name) {
740			if ((oidp->oid_kind & CTLTYPE) != CTLTYPE_NODE)
741				return (0);
742			if (oidp->oid_handler)
743				return (0);
744			lsp = SYSCTL_CHILDREN(oidp);
745			if (!sysctl_sysctl_next_ls(lsp, name+1, namelen-1,
746				next+1, len, level+1, oidpp))
747				return (0);
748			goto next;
749		}
750		if ((oidp->oid_kind & CTLTYPE) != CTLTYPE_NODE)
751			continue;
752
753		if (oidp->oid_handler)
754			continue;
755
756		lsp = SYSCTL_CHILDREN(oidp);
757		if (!sysctl_sysctl_next_ls(lsp, name+1, namelen-1, next+1,
758			len, level+1, oidpp))
759			return (0);
760	next:
761		namelen = 1;
762	emptynode:
763		*len = level;
764	}
765	return (1);
766}
767
768static int
769sysctl_sysctl_next(SYSCTL_HANDLER_ARGS)
770{
771	int *name = (int *) arg1;
772	u_int namelen = arg2;
773	int i, j, error;
774	struct sysctl_oid *oid;
775	struct sysctl_oid_list *lsp = &sysctl__children;
776	int newoid[CTL_MAXNAME];
777
778	SYSCTL_XLOCK();
779	i = sysctl_sysctl_next_ls(lsp, name, namelen, newoid, &j, 1, &oid);
780	SYSCTL_XUNLOCK();
781	if (i)
782		return (ENOENT);
783	error = SYSCTL_OUT(req, newoid, j * sizeof (int));
784	return (error);
785}
786
787static SYSCTL_NODE(_sysctl, 2, next, CTLFLAG_RD, sysctl_sysctl_next, "");
788
789static int
790name2oid(char *name, int *oid, int *len, struct sysctl_oid **oidpp)
791{
792	int i;
793	struct sysctl_oid *oidp;
794	struct sysctl_oid_list *lsp = &sysctl__children;
795	char *p;
796
797	SYSCTL_ASSERT_XLOCKED();
798
799	if (!*name)
800		return (ENOENT);
801
802	p = name + strlen(name) - 1 ;
803	if (*p == '.')
804		*p = '\0';
805
806	*len = 0;
807
808	for (p = name; *p && *p != '.'; p++)
809		;
810	i = *p;
811	if (i == '.')
812		*p = '\0';
813
814	oidp = SLIST_FIRST(lsp);
815
816	while (oidp && *len < CTL_MAXNAME) {
817		if (strcmp(name, oidp->oid_name)) {
818			oidp = SLIST_NEXT(oidp, oid_link);
819			continue;
820		}
821		*oid++ = oidp->oid_number;
822		(*len)++;
823
824		if (!i) {
825			if (oidpp)
826				*oidpp = oidp;
827			return (0);
828		}
829
830		if ((oidp->oid_kind & CTLTYPE) != CTLTYPE_NODE)
831			break;
832
833		if (oidp->oid_handler)
834			break;
835
836		lsp = SYSCTL_CHILDREN(oidp);
837		oidp = SLIST_FIRST(lsp);
838		name = p+1;
839		for (p = name; *p && *p != '.'; p++)
840				;
841		i = *p;
842		if (i == '.')
843			*p = '\0';
844	}
845	return (ENOENT);
846}
847
848static int
849sysctl_sysctl_name2oid(SYSCTL_HANDLER_ARGS)
850{
851	char *p;
852	int error, oid[CTL_MAXNAME], len = 0;
853	struct sysctl_oid *op = 0;
854
855	if (!req->newlen)
856		return (ENOENT);
857	if (req->newlen >= MAXPATHLEN)	/* XXX arbitrary, undocumented */
858		return (ENAMETOOLONG);
859
860	p = malloc(req->newlen+1, M_SYSCTL, M_WAITOK);
861
862	error = SYSCTL_IN(req, p, req->newlen);
863	if (error) {
864		free(p, M_SYSCTL);
865		return (error);
866	}
867
868	p [req->newlen] = '\0';
869
870	SYSCTL_XLOCK();
871	error = name2oid(p, oid, &len, &op);
872	SYSCTL_XUNLOCK();
873
874	free(p, M_SYSCTL);
875
876	if (error)
877		return (error);
878
879	error = SYSCTL_OUT(req, oid, len * sizeof *oid);
880	return (error);
881}
882
883SYSCTL_PROC(_sysctl, 3, name2oid,
884    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_MPSAFE,
885    0, 0, sysctl_sysctl_name2oid, "I", "");
886
887static int
888sysctl_sysctl_oidfmt(SYSCTL_HANDLER_ARGS)
889{
890	struct sysctl_oid *oid;
891	int error;
892
893	SYSCTL_XLOCK();
894	error = sysctl_find_oid(arg1, arg2, &oid, NULL, req);
895	if (error)
896		goto out;
897
898	if (oid->oid_fmt == NULL) {
899		error = ENOENT;
900		goto out;
901	}
902	error = SYSCTL_OUT(req, &oid->oid_kind, sizeof(oid->oid_kind));
903	if (error)
904		goto out;
905	error = SYSCTL_OUT(req, oid->oid_fmt, strlen(oid->oid_fmt) + 1);
906 out:
907	SYSCTL_XUNLOCK();
908	return (error);
909}
910
911
912static SYSCTL_NODE(_sysctl, 4, oidfmt, CTLFLAG_RD|CTLFLAG_MPSAFE,
913    sysctl_sysctl_oidfmt, "");
914
915static int
916sysctl_sysctl_oiddescr(SYSCTL_HANDLER_ARGS)
917{
918	struct sysctl_oid *oid;
919	int error;
920
921	SYSCTL_XLOCK();
922	error = sysctl_find_oid(arg1, arg2, &oid, NULL, req);
923	if (error)
924		goto out;
925
926	if (oid->oid_descr == NULL) {
927		error = ENOENT;
928		goto out;
929	}
930	error = SYSCTL_OUT(req, oid->oid_descr, strlen(oid->oid_descr) + 1);
931 out:
932	SYSCTL_XUNLOCK();
933	return (error);
934}
935
936static SYSCTL_NODE(_sysctl, 5, oiddescr, CTLFLAG_RD, sysctl_sysctl_oiddescr, "");
937
938/*
939 * Default "handler" functions.
940 */
941
942/*
943 * Handle an int, signed or unsigned.
944 * Two cases:
945 *     a variable:  point arg1 at it.
946 *     a constant:  pass it in arg2.
947 */
948
949int
950sysctl_handle_int(SYSCTL_HANDLER_ARGS)
951{
952	int tmpout, error = 0;
953
954	/*
955	 * Attempt to get a coherent snapshot by making a copy of the data.
956	 */
957	if (arg1)
958		tmpout = *(int *)arg1;
959	else
960		tmpout = arg2;
961	error = SYSCTL_OUT(req, &tmpout, sizeof(int));
962
963	if (error || !req->newptr)
964		return (error);
965
966	if (!arg1)
967		error = EPERM;
968	else
969		error = SYSCTL_IN(req, arg1, sizeof(int));
970	return (error);
971}
972
973/*
974 * Based on on sysctl_handle_int() convert milliseconds into ticks.
975 * Note: this is used by TCP.
976 */
977
978int
979sysctl_msec_to_ticks(SYSCTL_HANDLER_ARGS)
980{
981	int error, s, tt;
982
983	tt = *(int *)arg1;
984	s = (int)((int64_t)tt * 1000 / hz);
985
986	error = sysctl_handle_int(oidp, &s, 0, req);
987	if (error || !req->newptr)
988		return (error);
989
990	tt = (int)((int64_t)s * hz / 1000);
991	if (tt < 1)
992		return (EINVAL);
993
994	*(int *)arg1 = tt;
995	return (0);
996}
997
998
999/*
1000 * Handle a long, signed or unsigned.  arg1 points to it.
1001 */
1002
1003int
1004sysctl_handle_long(SYSCTL_HANDLER_ARGS)
1005{
1006	int error = 0;
1007	long tmplong;
1008#ifdef SCTL_MASK32
1009	int tmpint;
1010#endif
1011
1012	/*
1013	 * Attempt to get a coherent snapshot by making a copy of the data.
1014	 */
1015	if (!arg1)
1016		return (EINVAL);
1017	tmplong = *(long *)arg1;
1018#ifdef SCTL_MASK32
1019	if (req->flags & SCTL_MASK32) {
1020		tmpint = tmplong;
1021		error = SYSCTL_OUT(req, &tmpint, sizeof(int));
1022	} else
1023#endif
1024		error = SYSCTL_OUT(req, &tmplong, sizeof(long));
1025
1026	if (error || !req->newptr)
1027		return (error);
1028
1029#ifdef SCTL_MASK32
1030	if (req->flags & SCTL_MASK32) {
1031		error = SYSCTL_IN(req, &tmpint, sizeof(int));
1032		*(long *)arg1 = (long)tmpint;
1033	} else
1034#endif
1035		error = SYSCTL_IN(req, arg1, sizeof(long));
1036	return (error);
1037}
1038
1039/*
1040 * Handle a 64 bit int, signed or unsigned.  arg1 points to it.
1041 */
1042int
1043sysctl_handle_64(SYSCTL_HANDLER_ARGS)
1044{
1045	int error = 0;
1046	uint64_t tmpout;
1047
1048	/*
1049	 * Attempt to get a coherent snapshot by making a copy of the data.
1050	 */
1051	if (!arg1)
1052		return (EINVAL);
1053	tmpout = *(uint64_t *)arg1;
1054	error = SYSCTL_OUT(req, &tmpout, sizeof(uint64_t));
1055
1056	if (error || !req->newptr)
1057		return (error);
1058
1059	error = SYSCTL_IN(req, arg1, sizeof(uint64_t));
1060	return (error);
1061}
1062
1063/*
1064 * Handle our generic '\0' terminated 'C' string.
1065 * Two cases:
1066 * 	a variable string:  point arg1 at it, arg2 is max length.
1067 * 	a constant string:  point arg1 at it, arg2 is zero.
1068 */
1069
1070int
1071sysctl_handle_string(SYSCTL_HANDLER_ARGS)
1072{
1073	int error=0;
1074	char *tmparg;
1075	size_t outlen;
1076
1077	/*
1078	 * Attempt to get a coherent snapshot by copying to a
1079	 * temporary kernel buffer.
1080	 */
1081retry:
1082	outlen = strlen((char *)arg1)+1;
1083	tmparg = malloc(outlen, M_SYSCTLTMP, M_WAITOK);
1084
1085	if (strlcpy(tmparg, (char *)arg1, outlen) >= outlen) {
1086		free(tmparg, M_SYSCTLTMP);
1087		goto retry;
1088	}
1089
1090	error = SYSCTL_OUT(req, tmparg, outlen);
1091	free(tmparg, M_SYSCTLTMP);
1092
1093	if (error || !req->newptr)
1094		return (error);
1095
1096	if ((req->newlen - req->newidx) >= arg2) {
1097		error = EINVAL;
1098	} else {
1099		arg2 = (req->newlen - req->newidx);
1100		error = SYSCTL_IN(req, arg1, arg2);
1101		((char *)arg1)[arg2] = '\0';
1102	}
1103
1104	return (error);
1105}
1106
1107/*
1108 * Handle any kind of opaque data.
1109 * arg1 points to it, arg2 is the size.
1110 */
1111
1112int
1113sysctl_handle_opaque(SYSCTL_HANDLER_ARGS)
1114{
1115	int error, tries;
1116	u_int generation;
1117	struct sysctl_req req2;
1118
1119	/*
1120	 * Attempt to get a coherent snapshot, by using the thread
1121	 * pre-emption counter updated from within mi_switch() to
1122	 * determine if we were pre-empted during a bcopy() or
1123	 * copyout(). Make 3 attempts at doing this before giving up.
1124	 * If we encounter an error, stop immediately.
1125	 */
1126	tries = 0;
1127	req2 = *req;
1128retry:
1129	generation = curthread->td_generation;
1130	error = SYSCTL_OUT(req, arg1, arg2);
1131	if (error)
1132		return (error);
1133	tries++;
1134	if (generation != curthread->td_generation && tries < 3) {
1135		*req = req2;
1136		goto retry;
1137	}
1138
1139	error = SYSCTL_IN(req, arg1, arg2);
1140
1141	return (error);
1142}
1143
1144/*
1145 * Transfer functions to/from kernel space.
1146 * XXX: rather untested at this point
1147 */
1148static int
1149sysctl_old_kernel(struct sysctl_req *req, const void *p, size_t l)
1150{
1151	size_t i = 0;
1152
1153	if (req->oldptr) {
1154		i = l;
1155		if (req->oldlen <= req->oldidx)
1156			i = 0;
1157		else
1158			if (i > req->oldlen - req->oldidx)
1159				i = req->oldlen - req->oldidx;
1160		if (i > 0)
1161			bcopy(p, (char *)req->oldptr + req->oldidx, i);
1162	}
1163	req->oldidx += l;
1164	if (req->oldptr && i != l)
1165		return (ENOMEM);
1166	return (0);
1167}
1168
1169static int
1170sysctl_new_kernel(struct sysctl_req *req, void *p, size_t l)
1171{
1172	if (!req->newptr)
1173		return (0);
1174	if (req->newlen - req->newidx < l)
1175		return (EINVAL);
1176	bcopy((char *)req->newptr + req->newidx, p, l);
1177	req->newidx += l;
1178	return (0);
1179}
1180
1181int
1182kernel_sysctl(struct thread *td, int *name, u_int namelen, void *old,
1183    size_t *oldlenp, void *new, size_t newlen, size_t *retval, int flags)
1184{
1185	int error = 0;
1186	struct sysctl_req req;
1187
1188	bzero(&req, sizeof req);
1189
1190	req.td = td;
1191	req.flags = flags;
1192
1193	if (oldlenp) {
1194		req.oldlen = *oldlenp;
1195	}
1196	req.validlen = req.oldlen;
1197
1198	if (old) {
1199		req.oldptr= old;
1200	}
1201
1202	if (new != NULL) {
1203		req.newlen = newlen;
1204		req.newptr = new;
1205	}
1206
1207	req.oldfunc = sysctl_old_kernel;
1208	req.newfunc = sysctl_new_kernel;
1209	req.lock = REQ_UNWIRED;
1210
1211	SYSCTL_XLOCK();
1212	error = sysctl_root(0, name, namelen, &req);
1213	SYSCTL_XUNLOCK();
1214
1215	if (req.lock == REQ_WIRED && req.validlen > 0)
1216		vsunlock(req.oldptr, req.validlen);
1217
1218	if (error && error != ENOMEM)
1219		return (error);
1220
1221	if (retval) {
1222		if (req.oldptr && req.oldidx > req.validlen)
1223			*retval = req.validlen;
1224		else
1225			*retval = req.oldidx;
1226	}
1227	return (error);
1228}
1229
1230int
1231kernel_sysctlbyname(struct thread *td, char *name, void *old, size_t *oldlenp,
1232    void *new, size_t newlen, size_t *retval, int flags)
1233{
1234        int oid[CTL_MAXNAME];
1235        size_t oidlen, plen;
1236	int error;
1237
1238	oid[0] = 0;		/* sysctl internal magic */
1239	oid[1] = 3;		/* name2oid */
1240	oidlen = sizeof(oid);
1241
1242	error = kernel_sysctl(td, oid, 2, oid, &oidlen,
1243	    (void *)name, strlen(name), &plen, flags);
1244	if (error)
1245		return (error);
1246
1247	error = kernel_sysctl(td, oid, plen / sizeof(int), old, oldlenp,
1248	    new, newlen, retval, flags);
1249	return (error);
1250}
1251
1252/*
1253 * Transfer function to/from user space.
1254 */
1255static int
1256sysctl_old_user(struct sysctl_req *req, const void *p, size_t l)
1257{
1258	int error = 0;
1259	size_t i, len, origidx;
1260
1261	origidx = req->oldidx;
1262	req->oldidx += l;
1263	if (req->oldptr == NULL)
1264		return (0);
1265	/*
1266	 * If we have not wired the user supplied buffer and we are currently
1267	 * holding locks, drop a witness warning, as it's possible that
1268	 * write operations to the user page can sleep.
1269	 */
1270	if (req->lock != REQ_WIRED)
1271		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1272		    "sysctl_old_user()");
1273	i = l;
1274	len = req->validlen;
1275	if (len <= origidx)
1276		i = 0;
1277	else {
1278		if (i > len - origidx)
1279			i = len - origidx;
1280		error = copyout(p, (char *)req->oldptr + origidx, i);
1281	}
1282	if (error)
1283		return (error);
1284	if (i < l)
1285		return (ENOMEM);
1286	return (0);
1287}
1288
1289static int
1290sysctl_new_user(struct sysctl_req *req, void *p, size_t l)
1291{
1292	int error;
1293
1294	if (!req->newptr)
1295		return (0);
1296	if (req->newlen - req->newidx < l)
1297		return (EINVAL);
1298	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1299	    "sysctl_new_user()");
1300	error = copyin((char *)req->newptr + req->newidx, p, l);
1301	req->newidx += l;
1302	return (error);
1303}
1304
1305/*
1306 * Wire the user space destination buffer.  If set to a value greater than
1307 * zero, the len parameter limits the maximum amount of wired memory.
1308 */
1309int
1310sysctl_wire_old_buffer(struct sysctl_req *req, size_t len)
1311{
1312	int ret;
1313	size_t wiredlen;
1314
1315	wiredlen = (len > 0 && len < req->oldlen) ? len : req->oldlen;
1316	ret = 0;
1317	if (req->lock != REQ_WIRED && req->oldptr &&
1318	    req->oldfunc == sysctl_old_user) {
1319		if (wiredlen != 0) {
1320			ret = vslock(req->oldptr, wiredlen);
1321			if (ret != 0) {
1322				if (ret != ENOMEM)
1323					return (ret);
1324				wiredlen = 0;
1325			}
1326		}
1327		req->lock = REQ_WIRED;
1328		req->validlen = wiredlen;
1329	}
1330	return (0);
1331}
1332
1333int
1334sysctl_find_oid(int *name, u_int namelen, struct sysctl_oid **noid,
1335    int *nindx, struct sysctl_req *req)
1336{
1337	struct sysctl_oid_list *lsp;
1338	struct sysctl_oid *oid;
1339	int indx;
1340
1341	SYSCTL_ASSERT_XLOCKED();
1342	lsp = &sysctl__children;
1343	indx = 0;
1344	while (indx < CTL_MAXNAME) {
1345		SLIST_FOREACH(oid, lsp, oid_link) {
1346			if (oid->oid_number == name[indx])
1347				break;
1348		}
1349		if (oid == NULL)
1350			return (ENOENT);
1351
1352		indx++;
1353		if ((oid->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
1354			if (oid->oid_handler != NULL || indx == namelen) {
1355				*noid = oid;
1356				if (nindx != NULL)
1357					*nindx = indx;
1358				KASSERT((oid->oid_kind & CTLFLAG_DYING) == 0,
1359				    ("%s found DYING node %p", __func__, oid));
1360				return (0);
1361			}
1362			lsp = SYSCTL_CHILDREN(oid);
1363		} else if (indx == namelen) {
1364			*noid = oid;
1365			if (nindx != NULL)
1366				*nindx = indx;
1367			KASSERT((oid->oid_kind & CTLFLAG_DYING) == 0,
1368			    ("%s found DYING node %p", __func__, oid));
1369			return (0);
1370		} else {
1371			return (ENOTDIR);
1372		}
1373	}
1374	return (ENOENT);
1375}
1376
1377/*
1378 * Traverse our tree, and find the right node, execute whatever it points
1379 * to, and return the resulting error code.
1380 */
1381
1382static int
1383sysctl_root(SYSCTL_HANDLER_ARGS)
1384{
1385	struct sysctl_oid *oid;
1386	int error, indx, lvl;
1387
1388	SYSCTL_ASSERT_XLOCKED();
1389
1390	error = sysctl_find_oid(arg1, arg2, &oid, &indx, req);
1391	if (error)
1392		return (error);
1393
1394	if ((oid->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
1395		/*
1396		 * You can't call a sysctl when it's a node, but has
1397		 * no handler.  Inform the user that it's a node.
1398		 * The indx may or may not be the same as namelen.
1399		 */
1400		if (oid->oid_handler == NULL)
1401			return (EISDIR);
1402	}
1403
1404	/* Is this sysctl writable? */
1405	if (req->newptr && !(oid->oid_kind & CTLFLAG_WR))
1406		return (EPERM);
1407
1408	KASSERT(req->td != NULL, ("sysctl_root(): req->td == NULL"));
1409
1410	/* Is this sysctl sensitive to securelevels? */
1411	if (req->newptr && (oid->oid_kind & CTLFLAG_SECURE)) {
1412		lvl = (oid->oid_kind & CTLMASK_SECURE) >> CTLSHIFT_SECURE;
1413		error = securelevel_gt(req->td->td_ucred, lvl);
1414		if (error)
1415			return (error);
1416	}
1417
1418	/* Is this sysctl writable by only privileged users? */
1419	if (req->newptr && !(oid->oid_kind & CTLFLAG_ANYBODY)) {
1420		int priv;
1421
1422		if (oid->oid_kind & CTLFLAG_PRISON)
1423			priv = PRIV_SYSCTL_WRITEJAIL;
1424#ifdef VIMAGE
1425		else if ((oid->oid_kind & CTLFLAG_VNET) &&
1426		     prison_owns_vnet(req->td->td_ucred))
1427			priv = PRIV_SYSCTL_WRITEJAIL;
1428#endif
1429		else
1430			priv = PRIV_SYSCTL_WRITE;
1431		error = priv_check(req->td, priv);
1432		if (error)
1433			return (error);
1434	}
1435
1436	if (!oid->oid_handler)
1437		return (EINVAL);
1438
1439	if ((oid->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
1440		arg1 = (int *)arg1 + indx;
1441		arg2 -= indx;
1442	} else {
1443		arg1 = oid->oid_arg1;
1444		arg2 = oid->oid_arg2;
1445	}
1446#ifdef MAC
1447	error = mac_system_check_sysctl(req->td->td_ucred, oid, arg1, arg2,
1448	    req);
1449	if (error != 0)
1450		return (error);
1451#endif
1452	oid->oid_running++;
1453	SYSCTL_XUNLOCK();
1454
1455	if (!(oid->oid_kind & CTLFLAG_MPSAFE))
1456		mtx_lock(&Giant);
1457	error = oid->oid_handler(oid, arg1, arg2, req);
1458	if (!(oid->oid_kind & CTLFLAG_MPSAFE))
1459		mtx_unlock(&Giant);
1460
1461	KFAIL_POINT_ERROR(_debug_fail_point, sysctl_running, error);
1462
1463	SYSCTL_XLOCK();
1464	oid->oid_running--;
1465	if (oid->oid_running == 0 && (oid->oid_kind & CTLFLAG_DYING) != 0)
1466		wakeup(&oid->oid_running);
1467	return (error);
1468}
1469
1470#ifndef _SYS_SYSPROTO_H_
1471struct sysctl_args {
1472	int	*name;
1473	u_int	namelen;
1474	void	*old;
1475	size_t	*oldlenp;
1476	void	*new;
1477	size_t	newlen;
1478};
1479#endif
1480int
1481__sysctl(struct thread *td, struct sysctl_args *uap)
1482{
1483	int error, i, name[CTL_MAXNAME];
1484	size_t j;
1485
1486	if (uap->namelen > CTL_MAXNAME || uap->namelen < 2)
1487		return (EINVAL);
1488
1489 	error = copyin(uap->name, &name, uap->namelen * sizeof(int));
1490 	if (error)
1491		return (error);
1492
1493	error = userland_sysctl(td, name, uap->namelen,
1494		uap->old, uap->oldlenp, 0,
1495		uap->new, uap->newlen, &j, 0);
1496	if (error && error != ENOMEM)
1497		return (error);
1498	if (uap->oldlenp) {
1499		i = copyout(&j, uap->oldlenp, sizeof(j));
1500		if (i)
1501			return (i);
1502	}
1503	return (error);
1504}
1505
1506/*
1507 * This is used from various compatibility syscalls too.  That's why name
1508 * must be in kernel space.
1509 */
1510int
1511userland_sysctl(struct thread *td, int *name, u_int namelen, void *old,
1512    size_t *oldlenp, int inkernel, void *new, size_t newlen, size_t *retval,
1513    int flags)
1514{
1515	int error = 0, memlocked;
1516	struct sysctl_req req;
1517
1518	bzero(&req, sizeof req);
1519
1520	req.td = td;
1521	req.flags = flags;
1522
1523	if (oldlenp) {
1524		if (inkernel) {
1525			req.oldlen = *oldlenp;
1526		} else {
1527			error = copyin(oldlenp, &req.oldlen, sizeof(*oldlenp));
1528			if (error)
1529				return (error);
1530		}
1531	}
1532	req.validlen = req.oldlen;
1533
1534	if (old) {
1535		if (!useracc(old, req.oldlen, VM_PROT_WRITE))
1536			return (EFAULT);
1537		req.oldptr= old;
1538	}
1539
1540	if (new != NULL) {
1541		if (!useracc(new, newlen, VM_PROT_READ))
1542			return (EFAULT);
1543		req.newlen = newlen;
1544		req.newptr = new;
1545	}
1546
1547	req.oldfunc = sysctl_old_user;
1548	req.newfunc = sysctl_new_user;
1549	req.lock = REQ_UNWIRED;
1550
1551#ifdef KTRACE
1552	if (KTRPOINT(curthread, KTR_SYSCTL))
1553		ktrsysctl(name, namelen);
1554#endif
1555
1556	if (req.oldlen > PAGE_SIZE) {
1557		memlocked = 1;
1558		sx_xlock(&sysctlmemlock);
1559	} else
1560		memlocked = 0;
1561	CURVNET_SET(TD_TO_VNET(td));
1562
1563	for (;;) {
1564		req.oldidx = 0;
1565		req.newidx = 0;
1566		SYSCTL_XLOCK();
1567		error = sysctl_root(0, name, namelen, &req);
1568		SYSCTL_XUNLOCK();
1569		if (error != EAGAIN)
1570			break;
1571		uio_yield();
1572	}
1573
1574	CURVNET_RESTORE();
1575
1576	if (req.lock == REQ_WIRED && req.validlen > 0)
1577		vsunlock(req.oldptr, req.validlen);
1578	if (memlocked)
1579		sx_xunlock(&sysctlmemlock);
1580
1581	if (error && error != ENOMEM)
1582		return (error);
1583
1584	if (retval) {
1585		if (req.oldptr && req.oldidx > req.validlen)
1586			*retval = req.validlen;
1587		else
1588			*retval = req.oldidx;
1589	}
1590	return (error);
1591}
1592
1593/*
1594 * Drain into a sysctl struct.  The user buffer must be wired.
1595 */
1596static int
1597sbuf_sysctl_drain(void *arg, const char *data, int len)
1598{
1599	struct sysctl_req *req = arg;
1600	int error;
1601
1602	error = SYSCTL_OUT(req, data, len);
1603	KASSERT(error >= 0, ("Got unexpected negative value %d", error));
1604	return (error == 0 ? len : -error);
1605}
1606
1607struct sbuf *
1608sbuf_new_for_sysctl(struct sbuf *s, char *buf, int length,
1609    struct sysctl_req *req)
1610{
1611
1612	/* Wire the user buffer, so we can write without blocking. */
1613	sysctl_wire_old_buffer(req, 0);
1614
1615	s = sbuf_new(s, buf, length, SBUF_FIXEDLEN);
1616	sbuf_set_drain(s, sbuf_sysctl_drain, req);
1617	return (s);
1618}
1619