CVS log for src/sys/net/if.c

Up to [cvs.NetBSD.org] / src / sys / net

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

if: add counts of packet drops on if_percpuq to if_iqdrops

So packets dropped on if_percpuq appear in ifconfig -v.

if_stats(9): Add ifp argument to if_stat..._ref.

This will enable us to pass the ifp through to a dtrace probe inside.

No functional change intended in this change, but this is an API
change visible to modules so it shouldn't be pulled up.

PR kern/58377

- Rename if_transmit() -> if_transmit_default()
- In if_enqueue(), handle the ALTQ-is-enabled case by creating a sort of
  chimera from ifq_put_slow() and if_transmit_default(), mainly to avoid
  having to repeatedly take and release the ifq lock.

if_transmit_lock() and if_enqueue() are equivalent.  if_enqueue() is
a better name, so collapse everything down to that and garbage-collect
if_transmit_lock().

Protect the ALTQ state that's exposed to the ifqueue if the ifq->ifq_lock.
This requires exposing some implementation details to ALTQ, which is guarded
by an __IFQ_PRIVATE define.

Rename ifq_enqueue() -> if_enqueue(), ifq_enqueue2() -> if_enqueue2().

New network interface output queue API.

Mostly de-tangle ifnet::if_snd from ifaltq, in a way that's minimally-
invasive to the ALTQ code itself.

The point of this is to lay the groundwork for future changes to ifqueue,
which among other benefits, will also hide the ALTQ ABI from drivers.

sys/net/if.c: Eliminate __HAVE_ATOMIC_AS_MEMBAR conditionals.

Discussed on tech-kern:
https://mail-index.netbsd.org/tech-kern/2023/02/23/msg028729.html

KNF. No functional change.

Make ifq_drops in struct ifqueue and struct ifaltq 64 bit.

Remove routes on an address removal if the routes referencing to the address.  Implemented by ozaki-r@n.o.

A route that has a gateway is on a connected route can be invalid if the
connected route is deleted, i.e., an associated address is removed.
Traditionally NetBSD doesn't sweep such a route on the address removal.  Sending
packets over the route fails with "No route to host".  Also the route holds an
orphan ifaddr as rt_ifa that is destructed say by in_purgeaddr.

If the same address is assgined again in such a state, there can be two
different ifaddr objects with the same address.  Until recently it's not a
big problem because we can send packets anyway.  However after MP-ification
of the network stack, we can't send packets because we strictly check if rt_ifa
(i.e., the (old) ifaddr) is valid.

This change automatically removes such routes on a removal of an associated
address to avoid keeping inconsistent routes.

Garbage-collect everything related to struct domain::dom_ifqueues
(except dom_ifqueues itself, until the next kernel version bump).
It's no longer used now that nothing uses the legacy netisr mechanism.

Garbage-collect the remaining vestiges of netisr.

Re-factor how pktq_barrier() is issued by if_detach().

Rather than excplicitly referencing ip_pktq and ip6_pktq in if_detach(),
instead add all pktqueues to a global list.  This list is then used in
the new pktq_ifdetach() function to issue a barrier on all pktqueues.

Note that the performance of this list is not critical; it will seldom
be accessed (then pktqueues are created/destroyed and when network
interfaces are detached), and so a simple synchronization strategy using
a rwlock is sufficient.

f_detach(): Drain the protocol input queues before the pr_purgeif()
calls; pktq_barrier() doesn't remove packets from the queue, it waits
for the packets enqueued before the barrier to drain.  This, in turn,
may cause the protocols to gain additional references to the interface
that's detaching.  By draining the queues first, we ensure that no
additional references will be taken after calling pr_purgeif().

pktqueue: Re-factor sysctl handling.

Provide a new pktq_sysctl_setup() function that attaches standard
pktq sysctl nodes below a specified parent node, with either a
fixed node ID or CTL_CREATE to dynamically assign node IDs.  Make
all of the sysctl handlers private to pktqueue.c, and remove the
INET- and INET6-specific pktqueue sysctl code from net/if.c.

Sprinkle more const. NFC.

Sprinkle const. NFC.

Style / whitespace.

ifnet(9): Make sure to use if_timer and if_watchdog at IPL_NET.

ifnet(9): On if_deactivate, don't make null if_slowtimo nonnull.

Fixes crash on detach.

ifnet(9): Kernel lock for struct ifnet::if_timer.

ifnet(9): Add sysctl net.interaces.ifN.watchdog.trigger.

For interfaces that use if_watchdog, this forces it to be called at
the next tick.

ifnet(9): Defer if_watchdog (a.k.a. if_slowtimo) to workqueue.

This is necessary to make mii_down and the *_init/stop routines that
call it to sleep waiting for MII callouts on other CPUs.

Mark the workqueue and callout MP-safe; only take the kernel lock
around the callback.

No kernel bump despite change to struct ifnet because the change is
ABI-compatible and using the callout outside net/if.c has never been
kosher.

if.c: fix typo in comment

Fix a typo in a comment.

KNF a comment

KNF two comments.

Grammar in a comment.

alredy -> already

ifioctl(9): Don't touch ifconf or ifreq until command is validated.

sys_ioctl validates the data pointer according to the command's size
and direction.  But userland may ioctl commands other than
OSIOCGIFCONF or OOSIOCGIFCONF -- and if userland passes an IOC_VOID
command, the argument is passed through verbatim and may be null.

Reported-by: syzbot+19b1bf83e5481273eafc@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=f4c91a7dcd31901c80d91af6ed01456faf0a7286

Reported-by: syzbot+442c033feb784d055185@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=4a3a4b92dbe9695046ff17a5474cef52aed23e0b

Reported-by: syzbot+4c87d0cdf7025741ea7a@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=3e5f42c998e43ad42da40dec3c7873e6aae187e4

fix various small typos, mainly in comments.

fix various typos in comments.

sys: Use membar_release/acquire around reference drop.

This just goes through my recent reference count membar audit and
changes membar_exit to membar_release and membar_enter to
membar_acquire -- this should make everything cheaper on most CPUs
without hurting correctness, because membar_acquire is generally
cheaper than membar_enter.

sys: Membar audit around reference count releases.

If two threads are using an object that is freed when the reference
count goes to zero, we need to ensure that all memory operations
related to the object happen before freeing the object.

Using an atomic_dec_uint_nv(&refcnt) == 0 ensures that only one
thread takes responsibility for freeing, but it's not enough to
ensure that the other thread's memory operations happen before the
freeing.

Consider:

	  Thread A			  Thread B
	obj->foo = 42;			obj->baz = 73;
	mumble(&obj->bar);		grumble(&obj->quux);
	/* membar_exit(); */		/* membar_exit(); */
	atomic_dec -- not last		atomic_dec -- last
					/* membar_enter(); */
					KASSERT(invariant(obj->foo,
					    obj->bar));
					free_stuff(obj);

The memory barriers ensure that

	obj->foo = 42;
	mumble(&obj->bar);

in thread A happens before

	KASSERT(invariant(obj->foo, obj->bar));
	free_stuff(obj);

in thread B.  Without them, this ordering is not guaranteed.

So in general it is necessary to do

	membar_exit();
	if (atomic_dec_uint_nv(&obj->refcnt) != 0)
		return;
	membar_enter();

to release a reference, for the `last one out hit the lights' style
of reference counting.  (This is in contrast to the style where one
thread blocks new references and then waits under a lock for existing
ones to drain with a condvar -- no membar needed thanks to mutex(9).)

I searched for atomic_dec to find all these.  Obviously we ought to
have a better abstraction for this because there's so much copypasta.
This is a stop-gap measure to fix actual bugs until we have that.  It
would be nice if an abstraction could gracefully handle the different
styles of reference counting in use -- some years ago I drafted an
API for this, but making it cover everything got a little out of hand
(particularly with struct vnode::v_usecount) and I ended up setting
it aside to work on psref/localcount instead for better scalability.

I got bored of adding #ifdef __HAVE_ATOMIC_AS_MEMBAR everywhere, so I
only put it on things that look performance-critical on 5sec review.
We should really adopt membar_enter_preatomic/membar_exit_postatomic
or something (except they are applicable only to atomic r/m/w, not to
atomic_load/store_*, making the naming annoying) and get rid of all
the ifdefs.

sys/net: Document if_mcast_op with comment and refuse other commands.

Meant only for multicast addition/deletion operations, nothing else.

sys/net: Document if_flags_set with a comment.

sys/net: Assert IFNET_LOCKED in if_ioctl, if_init, and if_stop.

Exception: Not for SIOCADDMULTI/SIOCDELMULTI, for which it is the
driver's responsibility to take internal locks.  Typically this is
already done via struct ethercom::ec_lock.

sys: Use if_ioctl wrapper function.

sys/net: New functions if_ioctl, if_init, and if_stop.

These are wrappers, suitable for inserting appropriate kasserts
regarding the API's locking contract, for the corresponding functions
in struct ifnet.

Since these are intended to commit configuration changes to the
interface, which may involve resetting the device, the caller should
hold IFNET_LOCK.  However, I can't straightforwardly prove that all
callers do yet, so the assertion is disabled for now.

net: obsolete ifnet::if_link_state_chenged
that was used for updating link-state of vlan I/F

The obsoleted function is replaced with
ifnet::if_linkstate_hooks

carp: Register carp_carpdev_state to link-state change hook

lagg: Register lagg_linkstate_changed to link-state change hook

bridge: Register bridge_calc_link_state to link-state change hook

Provide a hook point called at change of link state

Replace ifnet::if_agriprivate with ifnet::if_lagg

agr(4) and lagg(4) can not be used on the same interface so that
if_agrprivate and if_lagg are not used at the same time.
For resolve this wasteful, if_lagg is used in not only lagg(4)
but also agr(4).

After this modification, if_lagg has 3 states:
1. if_lagg == NULL
   - Both agr(4) and lagg(4) are not running on the interface
2. if_lagg != NULL && ifp->if_type != IFT_IEEE8023ADLAG
   - agr(4) is running on the I/F
3. if_lagg != NULL && ifp->if_type == IFT_IEEE8023ADLAG
   - lagg(4) is running on the I/F

remove extra changes

don't opencode kauth_cred_get()

fix various typos, mainly in comments.

Sync with HEAD.

Back out fix for kern_pmf.c calling a null if_stop and apply a fix
suggested by Jared McNeill which sets if_stop to a stub function
which means that more than just the pmf is protected from the NULL call.

Make if_stats_init, if_attach, if_initialize return void.

percpu_alloc can't fail.


Author: Maya Rashish <maya@NetBSD.org>
Committer: Taylor R Campbell <riastradh@NetBSD.org>

Sync w/ HEAD.

sync with head

Add a new link-aggregation pseudo interface named lagg(4)

 - FreeBSD's lagg(4) based implementation
 - MP-safe and MP-scalable

net: remove IFEF_NO_LINK_STATE_CHANGE

This flag was only set for virtual interfaces.
All virtual interfaces have a means of knowing if they are going to work
or not and as such now support link state changes.

If we want this flag back, it should be used as an indicator that
the interfaces does not support link state changes that userland can use
so it can make a decision on what to do when the link state is UNKNOWN.

bridge: When an interface joins then mark addresses on it as tentative

The exact flow is detatch addresses, join bridge and then mark detached
addresses as tentative.
This ensures that Duplicate Address Detection for the joining interface
are performed across all members of the bridge.

bridge: Calculate link state as the best link state of any member

If any member is LINK_STATE_UP then it's LINK_STATE_UP.
Otherwise if any member is LINK_STATE_UNKNOWN then it's LINK_STATE_UNKNOWN.
Otherwise it's LINK_STATE_DOWN.

net: Add a callback to ifnet to notify of link state changes

net: Fix the setting of if_link_state

Link state changes are not dependant on the interface being up, but we also
need to guard against more link state changes being scheduled when the
interface is being detached.

We do this by clearing the link queue but keeping if_link_sheduled = true.
We can check for this in both if_link_state_change() and
if_link_state_change_work() to abort early as there is no point in doing
anything if the interface is being detached because if_down() is called
in if_detach() after the workqueue has been drained to the same overall
effect.

Pull up following revision(s) (requested by msaitoh in ticket #1576):

	sys/net/if.c: revision 1.479
	sys/compat/common/uipc_syscalls_40.c: revision 1.23
	sys/compat/linux/common/linux_socket.c: revision 1.150
	sys/compat/linux32/common/linux32_socket.c: revision 1.31

 Don't accept negative value.

Pull up following revision(s) (requested by msaitoh in ticket #1018):

	sys/net/if.c: revision 1.479
	sys/compat/common/uipc_syscalls_40.c: revision 1.23
	sys/compat/linux/common/linux_socket.c: revision 1.150
	sys/compat/linux32/common/linux32_socket.c: revision 1.31

 Don't accept negative value.

 Don't accept negative value.

Reported-by: syzbot+e71a77402d6668f1868d@syzkaller.appspotmail.com

Remove in-kernel handling of Router Advertisements

This is much better handled by a user-land tool.
Proposed on tech-net here:
https://mail-index.netbsd.org/tech-net/2020/04/22/msg007766.html

Note that the ioctl SIOCGIFINFO_IN6 no longer sets flags. That now
needs to be done using the pre-existing SIOCSIFINFO_FLAGS ioctl.

Compat is fully provided where it makes sense, but trying to turn on
RA handling will obviously throw an error as it no longer exists.

Note that if you use IPv6 temporary addresses, this now needs to be
turned on in dhcpcd.conf(5) rather than in sysctl.conf(5).

adjust comment - sosetopt() path doesn't take IFNET_LOCK()

add a NOMPSAFE comment for if_mcast_op(), it is called from context
which doesn't hold IFNET_LOCK() in some cases, and calls if_ioctl

this needs to be sorted out for NET_MPSAFE

remove struct ifnet if_mcastop, it's not used by anything

Sync with HEAD

Sync with HEAD

In _if_down(), release the link state change lock before calling
workqueue_wait().  Add a comment explaining how the locking here
works.

PR kern/55018.

Mostly merge changes from HEAD upto 20200411

Sync with head.

Explicitly cast pointers to uintptr_t before casting to enums. They are
not necessarily the same size. Don't cast pointers to bool, check for
NULL instead.

IPL_SOFTNET -> IPL_NET in previous.

Perform link state change processing on a work queue, rather than in a
softint.

Switch sys/net to percpu_create.

Add support for MP-safe network interface statistics by maintaining them
in per-cpu storage, and collecting them for export in an if_data structure
when user-space wants them.

The new if_stat API is structured to make a gradual transition to the
new way in network drivers possible, and per-cpu stats are currently
disabled (thus there is no kernel ABI change).  Once all drivers have
been converted, the old ABI will be removed, and per-cpu stats will be
enabled universally.

Sync with head.

Remove FDDI support.

Remove Token Ring support.

Pull up following revision(s) (requested by christos in ticket #569):

	sys/dev/usb/if_umb.c: revision 1.10
	sys/net/if.c: revision 1.466
	sys/dev/ic/ath.c: revision 1.129

Protect network ioctls from non-authorized users. (Ilja Van Sprundel)

Protect network ioctls from non-authorized users. (Ilja Van Sprundel)

Add support for Kernel Memory Sanitizer (kMSan). It detects uninitialized
memory used by the kernel at run time, and just like kASan and kCSan, it
is an excellent feature. It has already detected 38 uninitialized variables
in the kernel during my testing, which I have since discreetly fixed.

We use two shadows:
 - "shad", to track uninitialized memory with a bit granularity (1:1).
   Each bit set to 1 in the shad corresponds to one uninitialized bit of
   real kernel memory.
 - "orig", to track the origin of the memory with a 4-byte granularity
   (1:1). Each uint32_t cell in the orig indicates the origin of the
   associated uint32_t of real kernel memory.

The memory consumption of these shadows is consequent, so at least 4GB of
RAM is recommended to run kMSan.

The compiler inserts calls to specific __msan_* functions on each memory
access, to manage both the shad and the orig and detect uninitialized
memory accesses that change the execution flow (like an "if" on an
uninitialized variable).

We mark as uninit several types of memory buffers (stack, pools, kmem,
malloc, uvm_km), and check each buffer passed to copyout, copyoutstr,
bwrite, if_transmit_lock and DMA operations, to detect uninitialized memory
that leaves the system. This allows us to detect kernel info leaks in a way
that is more efficient and also more user-friendly than KLEAK.

Contrary to kASan, kMSan requires comprehensive coverage, ie we cannot
tolerate having one non-instrumented function, because this could cause
false positives. kMSan cannot instrument ASM functions, so I converted
most of them to __asm__ inlines, which kMSan is able to instrument. Those
that remain receive special treatment.

Contrary to kASan again, kMSan uses a TLS, so we must context-switch this
TLS during interrupts. We use different contexts depending on the interrupt
level.

The orig tracks precisely the origin of a buffer. We use a special encoding
for the orig values, and pack together in each uint32_t cell of the orig:
 - a code designating the type of memory (Stack, Pool, etc), and
 - a compressed pointer, which points either (1) to a string containing
   the name of the variable associated with the cell, or (2) to an area
   in the kernel .text section which we resolve to a symbol name + offset.

This encoding allows us not to consume extra memory for associating
information with each cell, and produces a precise output, that can tell
for example the name of an uninitialized variable on the stack, the
function in which it was pushed on the stack, and the function where we
accessed this uninitialized variable.

kMSan is available with LLVM, but not with GCC.

The code is organized in a way that is similar to kASan and kCSan, so it
means that other architectures than amd64 can be supported.

Get rid of unnecessary NULL checks for rt_ifa and ifa_ifp

They are always non-NULL nowadays.

xc_barrier - convenience function to xc_broadcast() a nop.

Make the intent more clear and also avoid a bunch of (xcfunc_t)nullop
casts that gcc 8 -Wcast-function-type is not happy about.

Make panic messages more informative

Pull up following revision(s) (requested by knakahara in ticket #1385):

	sys/net/if.c				1.461
	sys/net/if.h				1.277
	sys/net/if_gif.c			1.149
	sys/net/if_gif.h			1.33
	sys/net/if_ipsec.c			1.19,1.20,1.24
	sys/net/if_ipsec.h			1.5
	sys/net/if_l2tp.c			1.33,1.36-1.39
	sys/net/if_l2tp.h			1.7,1.8
	sys/net/route.c				1.220,1.221
	sys/net/route.h				1.125
	sys/netinet/in_gif.c			1.95
	sys/netinet/in_l2tp.c			1.17
	sys/netinet/ip_input.c			1.391,1.392
	sys/netinet/wqinput.c			1.6
	sys/netinet6/in6_gif.c			1.94
	sys/netinet6/in6_l2tp.c			1.18
	sys/netinet6/ip6_forward.c		1.97
	sys/netinet6/ip6_input.c		1.210,1.211
	sys/netipsec/ipsec_output.c		1.82,1.83 (patched)
	sys/netipsec/ipsecif.c			1.12,1.13,1.15,1.17 (patched)
	sys/netipsec/key.c			1.259,1.260

ipsecif(4) support input drop packet counter.

ipsecif(4) should not increment drop counter by errors not related to if_snd. Pointed out by ozaki-r@n.o, thanks.
Remove unnecessary addresses in PF_KEY message.

MOBIKE Extensions for PF_KEY draft-schilcher-mobike-pfkey-extension-01.txt says
====================
5.  SPD Update
// snip
   SADB_X_SPDADD:
// snip
      sadb_x_ipsecrequest_reqid:
         An ID for that SA can be passed to the kernel in the
         sadb_x_ipsecrequest_reqid field.
      If tunnel mode is specified, the sadb_x_ipsecrequest structure is
      followed by two sockaddr structures that define the tunnel
      endpoint addresses.  In the case that transport mode is used, no
      additional addresses are specified.
====================
see: <a  rel="nofollow" href="https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01">https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01</a>

ipsecif(4) uses transport mode, so it should not add addresses.

ipsecif(4) supports multiple peers in the same NAPT.

E.g. ipsec0 connects between NetBSD_A and NetBSD_B, ipsec1 connects
NetBSD_A and NetBSD_C at the following figure.
                                        +----------+
                                   +----| NetBSD_B |
 +----------+           +------+   |    +----------+
 | NetBSD_A |--- ... ---| NAPT |---+
 +----------+           +------+   |    +----------+
                                   +----| NetBSD_C |
                                        +----------+

Add ATF later.

l2tp(4): fix output bytes counter. Pointed by k-goda@IIJ, thanks.
remove a variable which is no longer used.

l2tp: initialize mowner variables for MBUFTRACE

Avoid having a rtcache directly in a percpu storage
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.
A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by knakahara@ and yamaguchi@


wqinput: avoid having struct wqinput_worklist directly in a percpu storage
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Input handlers of wqinput normally involves sleepable operations so we must
avoid dereferencing a percpu data (struct wqinput_worklist) after executing
an input handler.  Address this situation by having just a pointer to the data
in a percpu storage instead.

Reviewed by knakahara@ and yamaguchi@

Add missing #include <sys/kmem.h>

Divide Tx context of l2tp(4) to improve performance.
It seems l2tp(4) call path is too long for instruction cache. So, dividing
l2tp(4) Tx context improves CPU use efficiency.

After this commit, l2tp(4) throughput gains 10% on my machine(Atom C3000).

Apply some missing changes lost on the previous commit

Avoid having a rtcache directly in a percpu storage for tunnel protocols.
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.
A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

l2tp(4): avoid having struct ifqueue directly in a percpu storage.

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Tx processing of l2tp(4) uses normally involves sleepable operations so we
must avoid dereferencing a percpu data (struct ifqueue) after executing Tx
processing.  Address this situation by having just a pointer to the data in
a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

Pull up following revision(s) (requested by ozaki-r in ticket #238):

	sys/netipsec/ipsec_output.c: revision 1.83
	sys/net/route.h: revision 1.125
	sys/netinet6/ip6_input.c: revision 1.210
	sys/netinet6/ip6_input.c: revision 1.211
	sys/net/if.c: revision 1.461
	sys/net/if_gif.h: revision 1.33
	sys/net/route.c: revision 1.220
	sys/net/route.c: revision 1.221
	sys/net/if.h: revision 1.277
	sys/netinet6/ip6_forward.c: revision 1.97
	sys/netinet/wqinput.c: revision 1.6
	sys/net/if_ipsec.h: revision 1.5
	sys/netinet6/in6_l2tp.c: revision 1.18
	sys/netinet6/in6_gif.c: revision 1.94
	sys/net/if_l2tp.h: revision 1.7
	sys/net/if_gif.c: revision 1.149
	sys/net/if_l2tp.h: revision 1.8
	sys/netinet/in_gif.c: revision 1.95
	sys/netinet/in_l2tp.c: revision 1.17
	sys/netipsec/ipsecif.c: revision 1.17
	sys/net/if_ipsec.c: revision 1.24
	sys/net/if_l2tp.c: revision 1.37
	sys/netinet/ip_input.c: revision 1.391
	sys/net/if_l2tp.c: revision 1.38
	sys/netinet/ip_input.c: revision 1.392
	sys/net/if_l2tp.c: revision 1.39

Avoid having a rtcache directly in a percpu storage

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.
Reviewed by knakahara@ and yamaguchi@

 -

wqinput: avoid having struct wqinput_worklist directly in a percpu storage

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Input handlers of wqinput normally involves sleepable operations so we must
avoid dereferencing a percpu data (struct wqinput_worklist) after executing
an input handler.  Address this situation by having just a pointer to the data
in a percpu storage instead.
Reviewed by knakahara@ and yamaguchi@

 -

Add missing #include <sys/kmem.h>

 -

Divide Tx context of l2tp(4) to improve performance.

It seems l2tp(4) call path is too long for instruction cache. So, dividing
l2tp(4) Tx context improves CPU use efficiency.

After this commit, l2tp(4) throughput gains 10% on my machine(Atom C3000).

 -

Apply some missing changes lost on the previous commit

 -

Avoid having a rtcache directly in a percpu storage for tunnel protocols.
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

 -

l2tp(4): avoid having struct ifqueue directly in a percpu storage.
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Tx processing of l2tp(4) uses normally involves sleepable operations so we
must avoid dereferencing a percpu data (struct ifqueue) after executing Tx
processing.  Address this situation by having just a pointer to the data in
a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

Avoid having a rtcache directly in a percpu storage for tunnel protocols.

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.
A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

 if_flags is neither int nor short. It's unsigned short.

if: announce flag changes other than up or down

For example toggling promiscuous mode or disabling ARP.

XXX Pullup -9

Pull up following revision(s) (requested by ozaki-r in ticket #98):

	sys/net/if.c: revision 1.458
	tests/net/if/t_ifconfig.sh: revision 1.21

Restore if_ioctl on error of ifc_destroy

Otherwise subsequence ioctls won't work.

Patch from Harold Gutch on PR kern/54434 (tweaked a bit by me)
tests: check if ifconfig (ioctl) works after a failure of ifconfig destroy

This is a test for PR kern/54434.

Pull up following revision(s) (requested by ozaki-r in ticket #1339):

	sys/net/if.c: revision 1.458
	tests/net/if/t_ifconfig.sh: revision 1.21

Restore if_ioctl on error of ifc_destroy

Otherwise subsequence ioctls won't work.

Patch from Harold Gutch on PR kern/54434 (tweaked a bit by me)
tests: check if ifconfig (ioctl) works after a failure of ifconfig destroy

This is a test for PR kern/54434.

Restore if_ioctl on error of ifc_destroy

Otherwise subsequence ioctls won't work.

Patch from Harold Gutch on PR kern/54434 (tweaked a bit by me)

micro-optimization for if_snd_is_used()

Add support for a network interface description.

ioctl(2):
- Add SIOCGIFDESCR/SIOCSIFDESCR commands to get/set the description.

This enables to make a memo for interface, like "Home network" or "Remote VPN".

From t-kusaba@IIJ

Sync with HEAD

 KNF. No functional change.

 The max subtype of the ifmedia word is 31. It's too small for Ethernet now.
We currently use use it up to 30. We should extend the limit to be able to use
more than 10Gbps speeds. Our ifmedia(4) is inconvenience and have some problem
so we should redesign the interface, but it's too late for netbsd-9 to do it.
So, we keep the data structure size and modify the structure a bit. The
strategy is almost the same as FreeBSD. Many bits of IFM_OMASK for Ethernet
have not used, so use some of them for Ethernet's subtype.

The differences against FreeBSD are:
 - We use NetBSD style compat code (i.e. no SIOCGIFXMEDIA).
 - FreeBSD's IFM_ETH_XTYPE's bit location is from 11 to "14" even though
   IFM_OMASK is from 8 to "15". We use _IFM_ETH_XTMASK from bit 13 to "15".
 - FreeBSD changed the meaning of IFM_TYPE_MATCH(). I think we should
   not do it. We keep it not changing and added new IFM_TYPE_SUBTYPE_MATCH()
   macro for matching both TYPE and SUBTYPE.
 - Added up to 400GBASE-SR16.

New layout of the media word is as follows (from ifmedia_h):

 * if_media Options word:
 *	Bits	Use
 *	----	-------
 *	0-4	Media subtype	MAX SUBTYPE == 255 for ETH and 31 for others
 *	5-7	Media type
 *	8-15	Type specific options
 *	16-18	Mode (for multi-mode devices)
 *	19	(Reserved for Future Use)
 *	20-27	Shared (global) options
 *	28-31	Instance
 *
 *   3                     2                   1
 *   1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
 *  +-------+---------------+-+-----+---------------+-----+---------+
 *  |       |               |R|     |               |     |         |
 *  | IMASK |     GMASK     |F|MMASK+-----+ OMASK   |NMASK|  TMASK  |
 *  |       |               |U|     |XTMSK|         |     |         |
 *  +-------+---------------+-+-----+-----+---------+-----+---------+
 *   <----->                   <--->                 <--->
 *  IFM_INST()               IFM_MODE()            IFM_TYPE()
 *
 *                              IFM_SUBTYPE(other than ETH)<------->
 *
 *                                   <---> IFM_SUBTYPE(ETH)<------->
 *
 *
 *           <------------->         <------------->
 *                        IFM_OPTIONS()

Implement an aggressive psref leak detector

It is yet another psref leak detector that enables to tell where a leak occurs
while a simpler version that is already committed just tells an occurrence of a
leak.

Investigating of psref leaks is hard because once a leak occurs a percpu list of
psref that tracks references can be corrupted.  A reference to a tracking object
is memorized in the list via an intermediate object (struct psref) that is
normally allocated on a stack of a thread.  Thus, the intermediate object can be
overwritten on a leak resulting in corruption of the list.

The tracker makes a shadow entry to an intermediate object and stores some hints
into it (currently it's a caller address of psref_acquire).  We can detect a
leak by checking the entries on certain points where any references should be
released such as the return point of syscalls and the end of each softint
handler.

The feature is expensive and enabled only if the kernel is built with
PSREF_DEBUG.

Proposed on tech-kern

Store IFF_ALLMULTI in ec_flags instead of if_flags to avoid data races

IFF_ALLMULTI is set/unset to if_flags via if_mcast_op.  To avoid data races on
if_flags, IFNET_LOCK was added for if_mcast_op.  Unfortunately it produces
a deadlock so we want to remove added IFNET_LOCK by avoiding the data races by
another approach.

This fix introduces ec_flags to struct ethercom and stores IFF_ALLMULTI to it.
ec_flags is protected by ETHER_LOCK and thus IFNET_LOCK is no longer necessary
for if_mcast_op.  Note that the fix is applied only to MP-safe drivers that
the data races matter.

In the kernel, IFF_ALLMULTI is set by a driver and used by the driver itself.
So changing the storing place doesn't break anything.  One exception is
ioctl(SIOCGIFFLAGS); we have to include IFF_ALLMULTI in a result if needed to
export the flag as well as before.

A upcoming commit will remove IFNET_LOCK.

PR kern/54189

Typos in comments.  NFCI.

Pull up following revision(s) via patch (requested by christos in ticket #1689):

	sys/compat/linux/common/linux_socket.c: revision 1.145
	sys/net/if.c: revision 1.449
	sys/compat/linux32/common/linux32_socket.c: revision 1.30
	sys/compat/common/uipc_syscalls_40.c: revision 1.19

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks!

 -

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Pull up following revision(s) via patch (requested by christos in ticket #1689):

	sys/compat/linux/common/linux_socket.c: revision 1.145
	sys/net/if.c: revision 1.449
	sys/compat/linux32/common/linux32_socket.c: revision 1.30
	sys/compat/common/uipc_syscalls_40.c: revision 1.19

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks!

 -

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Pull up following revision(s) via patch (requested by christos in ticket #1689):

	sys/compat/linux/common/linux_socket.c: revision 1.145
	sys/net/if.c: revision 1.449
	sys/compat/linux32/common/linux32_socket.c: revision 1.30
	sys/compat/common/uipc_syscalls_40.c: revision 1.19

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks!

 -

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Pull up following revision(s) (requested by christos in ticket #1233):

	sys/compat/linux/common/linux_socket.c: revision 1.145
	sys/net/if.c: revision 1.449
	sys/compat/linux32/common/linux32_socket.c: revision 1.30
	sys/compat/common/uipc_syscalls_40.c: revision 1.19

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks!

 -

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks! This is the compat code part
pointed out by ozaki-r@

Rename ifreqo2n() and ifreqo2n() to IFREQO2N_43() and IFREQN2O_43():
 - ifreqo2n() and ifreqn2o() are for COMPAT_43, so add _43 to the name.
 - Uppercase to make it clear those are macros.

Zero out the ifreq struct for SIOCGIFCONF to avoid up to 127 bytes of stack
disclosure. From Andy Nguyen, many thanks!

 Remove inclusion of compat/sys/socket.h. It's not required anymore.

Replace compile-time checking for vlan code with a module hook.

Should resolve the errors reported on irc when booting a kernel which
has agr without vlan:


 [   1.0000000] WARNING: module error: built-in module if_agr can't find builtin dependency `if_vlan'
 [   1.0000000] WARNING: module error: built-in module if_agr prerequisite if_vlan failed, error 2

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Normalize all the compat hooks' names to the form

	<subsystem>_<function>_<version>_hook

NFCI

XXX Note that although this introduces a change in the kernel-to-
XXX module interface, we are NOT bumping the kernel version number.
XXX We will bump the version number once the interface stabilizes.

Merge the [pgoyette-compat] branch

Convert the MODULE_{,VOID_}HOOK_CALL macros to do everything in-line
rather than defining an intermediate hook##call function.  Almost
all of the hooks are called only once, and although we lose the
ability of doing things like

	if (MODULE_HOOK_CALL(...) == 0) ...

we simplify things quite a bit.  With this change, we no longer need
to have both declaration and definition macros, and the definition
no longer needs to have both prototype argument list and a "real"
argument list.

FWIW, the above if now needs to written as

	int ret;

	MODULE_HOOK_CALL(..., ret);
	if (ret == 0) ...

with appropriate use of braces {}.

Don't restrict hooks to having only int or void types.  Pass the hook's
type to the various macros, as needed.

Allows us to reduce diffs to original in at least one or two places (we
no longer have to provide an additional parameter to the hook routine
for returning a non-int return value).

Create a variant of the HOOK macros that handles hook routines of
type void, and use them where appropriate.

Remove the HOOK2 versions of the MODULE_HOOK macros.  There were
only a few uses, and using them led to some lack of clarity in the
code.  Instead, we now use two separate hooks, with names that
make it clear(er) what we're doing.

This also positions us to start unraveling some of the rtsock_50
mess, which will need (at least) five hooks.

Sync with HEAD, resolve a few conflicts

 Add SIOCSETHERCAP. It's used to change ec_capenable.

PR kern/53562

Handle TX offload in software when a packet is sent via
bridge_output(). We can send it as is in the following
exceptional cases:

For unicast:

(1) When the destination interface is the same as source.

(2) When the destination supports all TX offload options
    specified in a packet.

For multicast/broadcast:

(3) When all the members of the bridge support the specified
    TX offload options.

For (3), add sc_csum_flags_tx flag to bridge softc, which is
logical AND b/w capabilities of TX offload options in member
interface (ifp->if_csum_flags_tx). The flag is updated when a
member is (i) added to or (ii) removed from a bridge, or (iii)
if_csum_flags_tx flag of a member interface is manipulated via
ifconfig(8).

Turn on M_CSUM_TSOv[46] bit in ifp->if_csum_flags_tx flag when
TSO[46] is enabled for that interface.

OK msaitoh thorpej

Sync with HEAD, resolve a couple of conflicts

Remove the 't' argument from m_tag_find().

Pull up following revision(s) (requested by ozaki-r in ticket #1080):

	sys/netinet6/nd6.c: revision 1.251
	sys/netinet/if_arp.c: revision 1.276
	sys/net/if.c: revision 1.438
	sys/net/if.c: revision 1.439
	sys/net/route.c: revision 1.214
	sys/net/route.c: revision 1.215
	sys/net/route.c: revision 1.216
	sys/netinet6/in6.c: revision 1.270
	sys/net/route.h: revision 1.120
	sys/net/if.c: revision 1.440

Remove a wrong assertion in ifaref

 -

Doing ifref on an ifa with IFA_DESTROYING is not a problem; the reference should
be dropped during the destruction of the ifa.

 -

Use atomic operations for ifa_refcnt

 -

Avoid a dangling pointer during rt_replace_ifa

 -

Avoid double rt_replace_ifa on rtrequest1(RTM_ADD)

Some callers of rtrequest1(RTM_ADD) adjust rt_ifa of an rtentry created by
rtrequest1 that may change rt_ifa (in ifa_rtrequest) with another ifa that is
different from requested one.  It's wasteful and even worse introduces a race
condition.  rtrequest1 should just use a passed ifa as is if a caller hopes so.

 -

Use rt_update framework on updating a rtentry

Avoid double rt_replace_ifa on rtrequest1(RTM_ADD)

Some callers of rtrequest1(RTM_ADD) adjust rt_ifa of an rtentry created by
rtrequest1 that may change rt_ifa (in ifa_rtrequest) with another ifa that is
different from requested one.  It's wasteful and even worse introduces a race
condition.  rtrequest1 should just use a passed ifa as is if a caller hopes so.

Use atomic operations for ifa_refcnt

Remove a wrong assertion in ifaref

Doing ifref on an ifa with IFA_DESTROYING is not a problem; the reference should
be dropped during the destruction of the ifa.

Sync with head

fix panic when do ifconfig -vlanif and ifconfig vlanif again. advised by ozaki-r@.

e.g. do the following commands.
    ====================
    # ifconfig vlan0 create
    # ifconfig vlan0 vlan 100 vlanif wm0
    # ifconfig vlan0 -vlanif wm0
    # ifconfig vlan0 vlan 100 vlanif wm0
    ====================

ATF net/if_vlan do this type of test, however it cannot detect this bug.
Because the shmif(4)'s ifp->if_hwdl is always NULL as shmif(4)'s ethernet
address is set U/L bit.
See: https://nxr.netbsd.org/xref/src/sys/net/if_ethersubr.c#997

Ssync with HEAD

In MODULE_HOOK_CALL_DECL we don't need to provide the actual argument
list for calling the hook function, nor do we need to provide the
default value (for when the hook has not been set).

Clean-up some pre-existing function-pointer code (related to if_43)
to use the new MP-safe mechanism.

The uipc_syscalls_40 compat routine doesn't have a ``struct lwp *l''
argument - adjust hook parameter lists accordingly.

Use the MP-safe hooks mechanism for the uipc_syscalls_40 and _50
routines.

Flip the order of free'ing things to avoid crash (from ozaki-r). Tested
with a month's uptime. Used to crash once a week.

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Remove the network ATM code.

Pull up following revision(s) (requested by ozaki-r in ticket #991):

	sys/net/if.c: revision 1.434

Restore splx removed accidentally at v1.406
Pointed out by k-goda@IIJ

Restore splx removed accidentally at v1.406

Pointed out by k-goda@IIJ

fix if_snd_is_used(), ifp->if_snd is also used by if.c::if_transmit().

- Fix a bug that drop counter shows incorrect vaule like
  "net.inet.ip.ifq.drops = 72059810241052672"
- Change pktq's length sysctl to uint64_t.

 Change pktq's drops count sysctl from CTLTYPE_INT to CTLTYPE_QUAD.

Sync with HEAD

Pull up following revision(s) (requested by msaitoh in ticket #915):

	sys/net/if.c: revision 1.424

Print "NET_MPSAFE enabled" if it's enabled.

Pull up following revision(s) (requested by ozaki-r in ticket #911):

	sys/kern/init_main.c: revision 1.498
	sys/rump/net/lib/libnet/net_component.c: revision 1.10
	sys/net/if.h: revision 1.264
	sys/net/if.c: revision 1.429

Fix net.inet6.ip6.ifq node doesn't exist

The node (and child nodes) is initialized in sysctl_net_pktq_setup, but the call
of sysctl_net_pktq_setup is skipped unexpectedly.
sysctl_net_pktq_setup is skipped if in6_present is false that indicates the
netinet6 component isn't loaded on rump kernels.  However the flag is
accidentally always false because the flag is turned on in in6_dom_init that is
called after if_sysctl_setup on both normal and rump kernels.

Fix the issue by moving if_sysctl_setup after in6_dom_init (domaininit on normal
kernels).  This fix is ad-hoc but good enough for netbsd-8.  We should refine
the initialization order of network components in the future.

Pointed out by hikaru@

Calling rtinit(sa_family = AF_LINK, RTM_DELETE, 0) is guaranteed not to
work. Remove bogus call leaving a KASSERT behind.

Fix net.inet6.ip6.ifq node doesn't exist

The node (and child nodes) is initialized in sysctl_net_pktq_setup, but the call
of sysctl_net_pktq_setup is skipped unexpectedly.

sysctl_net_pktq_setup is skipped if in6_present is false that indicates the
netinet6 component isn't loaded on rump kernels.  However the flag is
accidentally always false because the flag is turned on in in6_dom_init that is
called after if_sysctl_setup on both normal and rump kernels.

Fix the issue by moving if_sysctl_setup after in6_dom_init (domaininit on normal
kernels).  This fix is ad-hoc but good enough for netbsd-8.  We should refine
the initialization order of network components in the future.

Pointed out by hikaru@

 Implement the BPF direction filter (BIOC[GS]DIRECTION). It provides backward
compatibility with BIOC[GS]SEESENT ioctl. The userland interface is the same
as FreeBSD.

 This change also fixes a bug that the direction is misunderstand on some
environment by passing the direction to bpf_mtap*() instead of checking
m->m_pkthdr.rcvif.

Sync with HEAD

Pull up following revision(s) (requested by ozaki-r in ticket #844):

	sys/net/if.c: revision 1.425

Relax a lock check in if_mcast_op unless NET_MPSAFE

It seems that there remain some paths that don't satisfy the constraint that is
required only if NET_MPSAFE.  So don't check it by default.

One known path is nd6_rtrequest => in6_addmulti => if_mcast_op, which is not
easy to address.

Make sure to remove all AF_LINK addresses in if_detach

Make sure to not change if_hwdl once set

Relax a lock check in if_mcast_op unless NET_MPSAFE

It seems that there remain some paths that don't satisfy the constraint that is
required only if NET_MPSAFE.  So don't check it by default.

One known path is nd6_rtrequest => in6_addmulti => if_mcast_op, which is not
easy to address.

 Print "NET_MPSAFE enabled" if it's enabled.

Sync with HEAD

Pull up following revision(s) (requested by ozaki-r in ticket #826):

	sys/net/if_bridge.c: revision 1.155
	sys/net/if.c: revision 1.421
	sys/net/bpf.c: revision 1.224
	sys/net/if.c: revision 1.422
	sys/net/if.c: revision 1.423

Use if_is_mpsafe (NFC)

Protect packet input routines with KERNEL_LOCK and splsoftnet
if_input, i.e, ether_input and friends, now runs in softint without any
protections.  It's ok for ether_input itself because it's already MP-safe,
however, subsequent routines called from it such as carp_input and agr_input
aren't safe because they're not MP-safe.  Protect if_input with KERNEL_LOCK.
if_input can be called from a normal LWP context.  In that case we need to
prevent interrupts (softint) from running by splsoftnet to protect
non-MP-safe
codes (e.g., carp_input and agr_input).

Pointed out by mlelstv@

Protect if_deferred_start_softint with KERNEL_LOCK if the interface isn't
MP-safe

Protect if_deferred_start_softint with KERNEL_LOCK if the interface isn't MP-safe

Protect packet input routines with KERNEL_LOCK and splsoftnet

if_input, i.e, ether_input and friends, now runs in softint without any
protections.  It's ok for ether_input itself because it's already MP-safe,
however, subsequent routines called from it such as carp_input and agr_input
aren't safe because they're not MP-safe.  Protect if_input with KERNEL_LOCK.

if_input can be called from a normal LWP context.  In that case we need to
prevent interrupts (softint) from running by splsoftnet to protect non-MP-safe
codes (e.g., carp_input and agr_input).

Pointed out by mlelstv@

Use if_is_mpsafe (NFC)

Sync with HEAD, resolve some conflicts

Merge christos's recent changes on HEAD

disentangle a bit more the compat ioctl code.

Handle ifconf() compat vectors

Remove redundant assignment

Allocate and initialize the vector for compat_ifconf()

Untangle some networking compat code so we can build a kernel with
networking and MODULAR, but without any actual COMPAT_* code (ie,
assuming that all the compat stuff can be added later via modules).

Pull up following revision(s) (requested by mrg in ticket #595):
	sys/net/if.c: revision 1.398
	sys/net/rtsock.c: revision 1.231
remove useless cast, initialize family.
Avoid using a zero family mask.

Pull up following revision(s) (requested by ozaki-r in ticket #536):
	distrib/sets/lists/base/shl.mi: 1.825
	distrib/sets/lists/comp/mi: 1.2168-1.2169
	distrib/sets/lists/comp/shl.mi: 1.310
	distrib/sets/lists/debug/mi: 1.234
	distrib/sets/lists/debug/shl.mi: 1.188
	distrib/sets/lists/man/mi: 1.1570
	distrib/sets/lists/tests/mi: 1.772
	etc/mtree/NetBSD.dist.tests: 1.150
	share/man/man4/Makefile: 1.650
	share/man/man4/ipsec.4: 1.42-1.43
	share/man/man4/ipsecif.4: 1.1-1.5
	sys/arch/amd64/conf/ALL: 1.77
	sys/arch/amd64/conf/GENERIC: 1.480
	sys/conf/files: 1.1191
	sys/net/Makefile: 1.34
	sys/net/files.net: 1.14
	sys/net/if.c: 1.404
	sys/net/if.h: 1.248
	sys/net/if_gif.c: 1.135
	sys/net/if_ipsec.c: 1.1-1.3
	sys/net/if_ipsec.h: 1.1
	sys/net/if_l2tp.c: 1.16
	sys/net/if_types.h: 1.28
	sys/netinet/in.c: 1.214
	sys/netinet/in.h: 1.103
	sys/netinet/in_gif.c: 1.92
	sys/netinet/ip_var.h: 1.122
	sys/netinet6/in6.c: 1.257
	sys/netinet6/in6.h: 1.88
	sys/netinet6/in6_gif.c: 1.90
	sys/netinet6/ip6_var.h: 1.75
	sys/netipsec/Makefile: 1.6
	sys/netipsec/files.netipsec: 1.13
	sys/netipsec/ipsec.h: 1.62
	sys/netipsec/ipsecif.c: 1.1
	sys/netipsec/ipsecif.h: 1.1
	sys/netipsec/key.c: 1.246-1.247
	sys/netipsec/key.h: 1.34
	sys/rump/net/Makefile.rumpnetcomp: 1.20
	sys/rump/net/lib/libipsec/IPSEC.ioconf: 1.1
	sys/rump/net/lib/libipsec/Makefile: 1.1
	sys/rump/net/lib/libipsec/ipsec_component.c: 1.1
	tests/net/Makefile: 1.34
	tests/net/if_ipsec/Makefile: 1.1
	tests/net/if_ipsec/t_ipsec.sh: 1.1-1.2
Don't touch an SP without a reference to it
unify processing to check nesting count for some tunnel protocols.
add ipsec(4) interface, which is used for route-based VPN.
man and ATF are added later, please see man for details.
reviewed by christos@n.o, joerg@n.o and ozaki-r@n.o, thanks.
https://mail-index.netbsd.org/tech-net/2017/12/18/msg006557.html
ipsec(4) interface supports rump now.
add ipsec(4) interface ATF.
add ipsec(4) interface man as ipsecif.4.
add ipsec(4) interface to amd64/GENERIC and amd64/ALL configs.
apply in{,6}_tunnel_validate() to gif(4).
Spell IPsec that way. Simplify macro usage. Sort SEE ALSO. Bump
date for previous.
Improve wording and macro use.
Some parts are not clear to me, so someone with knowledge of ipsecif(4)
should improve this some more.
Improve ipsecif.4. Default port ipsec(4) NAT-T is tested now.
pointed out by wiz@n.o and suggested by ozaki-r@n.o, thanks.
Change the prefix of test names to ipsecif_ to distinguish from tests for ipsec(4)
New sentence, new line. Remove empty macro.
Fix PR kern/52920. Pointed out by David Binderman, thanks.
Improve wording, and put a new drawing, from me and Kengo Nakahara.
apply a little more #ifdef INET/INET6.  fixes !INET6 builds.

Pull up following revision(s) (requested by ozaki-r in ticket #528):
	sys/net/agr/if_agr.c: revision 1.42
	sys/netinet6/nd6_rtr.c: revision 1.137
	sys/netinet6/nd6_rtr.c: revision 1.138
	sys/net/agr/if_agr.c: revision 1.46
	sys/net/route.c: revision 1.206
	sys/net/if.c: revision 1.419
	sys/net/agr/if_agrether.c: revision 1.10
	sys/netinet6/nd6.c: revision 1.241
	sys/netinet6/nd6.c: revision 1.242
	sys/netinet6/nd6.c: revision 1.243
	sys/netinet6/nd6.c: revision 1.244
	sys/netinet6/nd6.c: revision 1.245
	sys/netipsec/ipsec_input.c: revision 1.52
	sys/netipsec/ipsec_input.c: revision 1.53
	sys/net/agr/if_agrsubr.h: revision 1.5
	sys/kern/subr_workqueue.c: revision 1.35
	sys/netipsec/ipsec.c: revision 1.124
	sys/net/agr/if_agrsubr.c: revision 1.11
	sys/net/agr/if_agrsubr.c: revision 1.12
Simplify; share agr_vlan_add and agr_vlan_del (NFCI)
Fix late NULL-checking (CID 1427782: Null pointer dereferences (REVERSE_INULL))
KNF: replace soft tabs with hard tabs
Add missing NULL-checking for m_pullup (CID 1427770: Null pointer dereferences (NULL_RETURNS))
Add locking.
Revert "Get rid of unnecessary splsoftnet" (v1.133)
It's not always true that softnet_lock is held these places.
See PR kern/52947.
Get rid of unnecessary splsoftnet (redo)
Unless NET_MPSAFE, splsoftnet is still needed for rt_* functions.
Use existing fill_[pd]rlist() functions to calculate size of buffer to
allocate, rather than relying on an arbitrary length passed in from
userland.
Allow copyout() of partial results if the user buffer is too small, to
be consistent with the way sysctl(3) is documented.
Garbage-collect now-unused third parrameter in the fill_[pd]rlist()
functions.
As discussed on IRC.
OK kamil@ and christos@
XXX Needs pull-up to netbsd-8 branch.
Simplify, from christos@
More simplification, this time from ozaki-r@
No need to break after return.
One more from christos@
No need to initialize fill_func
more cleanup (don't allow oldlenp == NULL)
Destroy ifq_lock at the end of if_detach
It still can be used in if_detach.
Prevent rt_free_global.wk from being enqueued to workqueue doubly
Check if a queued work is tried to be enqueued again, which is not allowed

Destroy ifq_lock at the end of if_detach

It still can be used in if_detach.

Pull up following revision(s) (requested by ozaki-r in ticket #487):
	sys/net/if.c: revision 1.417
Suppress the assertion of IFNET_LOCK in if_mcast_op if MROUTING
MROUTING doesn't deal with IFNET_LOCK yet.
Reported by kardel@

Pull up following revision(s) (requested by ozaki-r in ticket #486):
	sys/net/if.c: revision 1.418
Check MP-safety in ifa_insert and ifa_remove only for IFEF_MPSAFE drivers
Eventually the assertions should pass for all drivers, however, at this point
it's too eager.
Fix PR kern/52895

Check MP-safety in ifa_insert and ifa_remove only for IFEF_MPSAFE drivers

Eventually the assertions should pass for all drivers, however, at this point
it's too eager.

Fix PR kern/52895

Pull up following revision(s) (requested by ozaki-r in ticket #456):
	sys/arch/arm/sunxi/sunxi_emac.c: 1.9
	sys/dev/ic/dwc_gmac.c: 1.43-1.44
	sys/dev/pci/if_iwm.c: 1.75
	sys/dev/pci/if_wm.c: 1.543
	sys/dev/pci/ixgbe/ixgbe.c: 1.112
	sys/dev/pci/ixgbe/ixv.c: 1.74
	sys/kern/sys_socket.c: 1.75
	sys/net/agr/if_agr.c: 1.43
	sys/net/bpf.c: 1.219
	sys/net/if.c: 1.397, 1.399, 1.401-1.403, 1.406-1.410, 1.412-1.416
	sys/net/if.h: 1.242-1.247, 1.250, 1.252-1.257
	sys/net/if_bridge.c: 1.140 via patch, 1.142-1.146
	sys/net/if_etherip.c: 1.40
	sys/net/if_ethersubr.c: 1.243, 1.246
	sys/net/if_faith.c: 1.57
	sys/net/if_gif.c: 1.132
	sys/net/if_l2tp.c: 1.15, 1.17
	sys/net/if_loop.c: 1.98-1.101
	sys/net/if_media.c: 1.35
	sys/net/if_pppoe.c: 1.131-1.132
	sys/net/if_spppsubr.c: 1.176-1.177
	sys/net/if_tun.c: 1.142
	sys/net/if_vlan.c: 1.107, 1.109, 1.114-1.121
	sys/net/npf/npf_ifaddr.c: 1.3
	sys/net/npf/npf_os.c: 1.8-1.9
	sys/net/rtsock.c: 1.230
	sys/netcan/if_canloop.c: 1.3-1.5
	sys/netinet/if_arp.c: 1.255
	sys/netinet/igmp.c: 1.65
	sys/netinet/in.c: 1.210-1.211
	sys/netinet/in_pcb.c: 1.180
	sys/netinet/ip_carp.c: 1.92, 1.94
	sys/netinet/ip_flow.c: 1.81
	sys/netinet/ip_input.c: 1.362
	sys/netinet/ip_mroute.c: 1.147
	sys/netinet/ip_output.c: 1.283, 1.285, 1.287
	sys/netinet6/frag6.c: 1.61
	sys/netinet6/in6.c: 1.251, 1.255
	sys/netinet6/in6_pcb.c: 1.162
	sys/netinet6/ip6_flow.c: 1.35
	sys/netinet6/ip6_input.c: 1.183
	sys/netinet6/ip6_output.c: 1.196
	sys/netinet6/mld6.c: 1.90
	sys/netinet6/nd6.c: 1.239-1.240
	sys/netinet6/nd6_nbr.c: 1.139
	sys/netinet6/nd6_rtr.c: 1.136
	sys/netipsec/ipsec_output.c: 1.65
	sys/rump/net/lib/libnetinet/netinet_component.c: 1.9-1.10
kmem_intr_free kmem_intr_[z]alloced memory
the underlying pools are the same but api-wise those should match
Unify IFEF_*_MPSAFE into IFEF_MPSAFE
There are already two flags for if_output and if_start, however, it seems such
MPSAFE flags are eventually needed for all if_XXX operations. Having discrete
flags for each operation is wasteful of if_extflags bits. So let's unify
the flags into one: IFEF_MPSAFE.
Fortunately IFEF_*_MPSAFE flags have never been included in any releases, so
we can change them without breaking backward compatibility of the releases
(though the kernel version of -current should be bumped).
Note that if an interface have both MP-safe and non-MP-safe operations at a
time, we have to set the IFEF_MPSAFE flag and let callees of non-MP-safe
opeartions take the kernel lock.
Proposed on tech-kern@ and tech-net@
Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch
It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.
No functional change
Hold KERNEL_LOCK on if_ioctl selectively based on IFEF_MPSAFE
If IFEF_MPSAFE is set, hold the lock and otherwise don't hold.
This change requires additions of KERNEL_LOCK to subsequence functions from
if_ioctl such as ifmedia_ioctl and ifioctl_common to protect non-MP-safe
components.
Proposed on tech-kern@ and tech-net@
Ensure to hold if_ioctl_lock when calling if_flags_set
Fix locking against myself on ifpromisc
vlan_unconfig_locked could be called with holding if_ioctl_lock.
Ensure to not turn on IFF_RUNNING of an interface until its initialization completes
And ensure to turn off it before destruction as per IFF_RUNNING's description
"resource allocated". (The description is a bit doubtful though, I believe the
change is still proper.)
Ensure to hold if_ioctl_lock on if_up and if_down
One exception for if_down is if_detach; in the case the lock isn't needed
because it's guaranteed that no other one can access ifp at that point.
Make if_link_queue MP-safe if IFEF_MPSAFE
if_link_queue is a queue to store events of link state changes, which is
used to pass events from (typically) an interrupt handler to
if_link_state_change softint. The queue was protected by KERNEL_LOCK so far,
but if IFEF_MPSAFE is enabled, it becomes unsafe because (perhaps) an interrupt
handler of an interface with IFEF_MPSAFE doesn't take KERNEL_LOCK. Protect it
by a spin mutex.
Additionally with this change KERNEL_LOCK of if_link_state_change softint is
omitted if NET_MPSAFE is enabled.
Note that the spin mutex is now ifp->if_snd.ifq_lock as well as the case of
if_timer (see the comment).
Use IFADDR_WRITER_FOREACH instead of IFADDR_READER_FOREACH
At that point no other one modifies the list so IFADDR_READER_FOREACH
is unnecessary. Use of IFADDR_READER_FOREACH is harmless in general though,
if we try to detect contract violations of pserialize, using it violates
the contract. So avoid using it makes life easy.
Ensure to call if_addr_init with holding if_ioctl_lock
Get rid of outdated comments
Fix build of kernels without ether
By throwing out if_enable_vlan_mtu and if_disable_vlan_mtu that
created a unnecessary dependency from if.c to if_ethersubr.c.
PR kern/52790
Rename IFNET_LOCK to IFNET_GLOBAL_LOCK
IFNET_LOCK will be used in another lock, if_ioctl_lock (might be renamed then).
Wrap if_ioctl_lock with IFNET_* macros (NFC)
Also if_ioctl_lock perhaps needs to be renamed to something because it's now
not just for ioctl...
Reorder some destruction routines in if_detach
- Destroy if_ioctl_lock at the end of the if_detach because it's used in various
  destruction routines
- Move psref_target_destroy after pr_purgeif because we want to use psref in
  pr_purgeif (otherwise destruction procedures can be tricky)
Ensure to call if_mcast_op with holding IFNET_LOCK
Note that CARP doesn't deal with IFNET_LOCK yet.
Remove IFNET_GLOBAL_LOCK where it's unnecessary because IFNET_LOCK is held
Describe which lock is used to protect each member variable of struct ifnet
Requested by skrll@
Write a guideline for converting an interface to IFEF_MPSAFE
Requested by skrll@
Note that IFNET_LOCK must not be held in softint
Don't set IFEF_MPSAFE unless NET_MPSAFE at this point
Because recent investigations show that interfaces with IFEF_MPSAFE need to
follow additional restrictions to work with the flag safely. We should enable it
on an interface by default only if the interface surely satisfies the
restrictions, which are described in if.h.
Note that enabling IFEF_MPSAFE solely gains a few benefit on performance because
the network stack is still serialized by the big kernel locks by default.

Suppress the assertion of IFNET_LOCK in if_mcast_op if MROUTING

MROUTING doesn't deal with IFNET_LOCK yet.

Reported by kardel@

Remove IFNET_GLOBAL_LOCK where it's unnecessary because IFNET_LOCK is held

Ensure to call if_mcast_op with holding IFNET_LOCK

Note that CARP doesn't deal with IFNET_LOCK yet.

Reorder some destruction routines in if_detach

- Destroy if_ioctl_lock at the end of the if_detach because it's used in various
  destruction routines
- Move psref_target_destroy after pr_purgeif because we want to use psref in
  pr_purgeif (otherwise destruction procedures can be tricky)

Wrap if_ioctl_lock with IFNET_* macros (NFC)

Also if_ioctl_lock perhaps needs to be renamed to something because it's now
not just for ioctl...

Rename IFNET_LOCK to IFNET_GLOBAL_LOCK

IFNET_LOCK will be used in another lock, if_ioctl_lock (might be renamed then).

Pull up following revision(s) (requested by msaitoh in ticket #427):
	sys/arch/amiga/dev/if_bah_zbus.c: 1.17
	sys/arch/arm/broadcom/bcm53xx_eth.c: 1.30
	sys/arch/powerpc/booke/dev/pq3etsec.c: 1.32
	sys/arch/usermode/dev/if_veth.c: 1.9
	sys/dev/ic/an.c: 1.66
	sys/dev/ic/athn.c: 1.17
	sys/dev/ic/atw.c: 1.162
	sys/dev/ic/bwi.c: 1.33
	sys/dev/ic/dwc_gmac.c: 1.41-1.42
	sys/dev/ic/malo.c: 1.10
	sys/dev/ic/rt2560.c: 1.31
	sys/dev/ic/rt2661.c: 1.36
	sys/dev/ic/rt2860.c: 1.29
	sys/dev/ic/rtw.c: 1.127
	sys/dev/ic/rtwvar.h: 1.46
	sys/dev/ic/smc90cx6.c: 1.71
	sys/dev/ic/smc90cx6var.h: 1.12
	sys/dev/ic/wi.c: 1.244
	sys/dev/pci/if_ipw.c: 1.66
	sys/dev/pci/if_iwi.c: 1.104
	sys/dev/pci/if_iwm.c: 1.76
	sys/dev/pci/if_iwn.c: 1.86
	sys/dev/pci/if_rtwn.c: 1.13
	sys/dev/pci/if_wm.c: 1.541
	sys/dev/pci/if_wpi.c: 1.79
	sys/dev/pci/ixgbe/ixgbe.c: 1.106
	sys/dev/pci/ixgbe/ixv.c: 1.73 via patch
	sys/dev/pcmcia/if_malo_pcmcia.c: 1.15
	sys/dev/scsipi/if_se.c: 1.95
	sys/dev/usb/if_upl.c: 1.60
	sys/net/if.c: 1.396
	sys/net/if.h: 1.241
	sys/net/if_arc.h: 1.23
	sys/net/if_arcsubr.c: 1.78
	sys/net/if_bridge.c: 1.136-1.137
	sys/net/if_etherip.c: 1.39
	sys/net/if_faith.c: 1.56
	sys/net/if_gif.c: 1.131
	sys/net/if_loop.c: 1.96
	sys/net/if_mpls.c: 1.30
	sys/net/if_pppoe.c: 1.129
	sys/net/if_srt.c: 1.27
	sys/net/if_stf.c: 1.102
	sys/net/if_tap.c: 1.100
	sys/net/if_vlan.c: 1.105
	sys/netinet/ip_carp.c: 1.91
	sys/rump/net/lib/libshmif/if_shmem.c: 1.73-1.74
	sys/rump/net/lib/libvirtif/if_virt.c: 1.55-1.56
 if_initalize() and if_attach() failed when resource allocation failed
(e.g. allocating softint). Without this change, it panics. It's bad because
resource shortage really occured when a lot of pseudo interface is created.
To avoid this problem, don't panic and change return value of if_initialize()
and if_attach() to int. Caller fanction will be recover from error cleanly by
checking the return value.
 Return if bah_attach_subr() failed.
 If if_attach() failed in the attach function, return.
- If if_initialize() failed in the attach function, free resources and return.
- Add some missing frees in bridge_clone_destroy().
- KNF
 If error occured in bcmeth_ccb_attach(), free resources and return.
 If error occured in pq3etsec_attach(), free resources and return.
 If error occured in the attach function, free resources and return.
- If if_initialize() failed in athn_attach(), free resources and return.
- Add missing pmf_event_deregister() in athn_detach().
- Free resources correctly on some errors in atw_attach().
- Use apint*() insread of printf() in the attach function.
 If if_initialize() failed in the attach function, return.
- If if_initialize() failed in the attach function, free resources and return.
- Add missing dwc_gmac_free_dma_rings() and mutex_destroy() when attach
   failed.
- If if_initialize() failed in the attach function, free resources and return.
- ifp is always not NULL in iwi_detach(). Check correctly with ifp->if_softc.
- If if_initialize() failed in the attach function, free resources and return.
- Fix error path in the attach function correctly.
 If if_initialize() failed in the attach function, free resources and return.
 If if_attach() failed in the attach function, free resources and return.
 - If if_initialize() failed in the attach function, free resources and return.
 - KNF
 - If if_attach() failed in the attach function, free resources and return.
 - KNF
 Fix compile error.
 Fix compile error.
We don't need '&mii', but just 'mii' for mii_detach().
Don't free sc_rthash twice

Revert "Make if_timer MP-safe if IFEF_MPSAFE"

Because it has decreased the performance of wm. And also I found that
wm_watchdog doesn't work well with if_watchdog framework at all. Sharing one
counter (if_timer) with multiple instances (hardware multi-queues) can't detect
a single (or some) stall of them because other instances reset the counter even
if the stalled one want the watchdog to fire.

Interfaces without IFEF_MPSAFE works safely with the original if_watchdog thanks
to KENREL_LOCK. OTOH, interfaces with IFEF_MPSAFE shouldn't use if_watchdog and
should implement their own watchdog timer that works with multiple instances.

Fix build of kernels without ether

By throwing out if_enable_vlan_mtu and if_disable_vlan_mtu that
created a unnecessary dependency from if.c to if_ethersubr.c.

PR kern/52790

Get rid of outdated comments

Ensure to call if_addr_init with holding if_ioctl_lock

Use IFADDR_WRITER_FOREACH instead of IFADDR_READER_FOREACH

At that point no other one modifies the list so IFADDR_READER_FOREACH
is unnecessary. Use of IFADDR_READER_FOREACH is harmless in general though,
if we try to detect contract violations of pserialize, using it violates
the contract. So avoid using it makes life easy.

Make if_link_queue MP-safe if IFEF_MPSAFE

if_link_queue is a queue to store events of link state changes, which is
used to pass events from (typically) an interrupt handler to
if_link_state_change softint. The queue was protected by KERNEL_LOCK so far,
but if IFEF_MPSAFE is enabled, it becomes unsafe because (perhaps) an interrupt
handler of an interface with IFEF_MPSAFE doesn't take KERNEL_LOCK. Protect it
by a spin mutex.

Additionally with this change KERNEL_LOCK of if_link_state_change softint is
omitted if NET_MPSAFE is enabled.

Note that the spin mutex is now ifp->if_snd.ifq_lock as well as the case of
if_timer (see the comment).

Make if_timer MP-safe if IFEF_MPSAFE

if_timer, a counter used by if_watchdog (if_slowtimo), can be modified in
if_watchdog and if_start and/or interrupt handlers of some device drivers. All
such accesses were serialized by KERNEL_LOCK. If IFEF_MPSAFE is enabled,
KERNEL_LOCK of if_start (and perhaps interrupt handlers) is omitted and if_timer
becomes racy.

Fix the race condition by protecting if_timer by a spin mutex. if_watchdog_reset
and if_watchdog_stop are introduced to ensure to take the mutex on accessing
if_timer. Interface with IFEF_MPSAFE enabled must use the functions.

In addition, if_watchdog callout is now set CALLOUT_MPSAFE if IFEF_MPSAFE. It
means that if_watchdog implemented by a driver must be MP-safe if the driver is
set IFEF_MPSAFE.

Currenlty interfaces with IFEF_MPSAFE implementing if_watchdog and accessing
if_timer in if_start and interrupt handlers are only wm(4). wm is changed to
use the functions. (Its watchdog handler (wm_watchdog) is already MP-safe.

These contracts will be written somewhere in a further commit.

Note that the spin mutex is now ifp->if_snd.ifq_lock to avoid adding another
spin mutex to each interface. For now reusing it isn't problematic (see the
comment to know why) thought if that does matter in the future, feel free to
replace it with a new spin mutex. It's easy to do.

unify processing to check nesting count for some tunnel protocols.

Ensure to hold if_ioctl_lock on if_up and if_down

One exception for if_down is if_detach; in the case the lock isn't needed
because it's guaranteed that no other one can access ifp at that point.

Fix locking against myself on ifpromisc

vlan_unconfig_locked could be called with holding if_ioctl_lock.

Ensure to hold if_ioctl_lock when calling if_flags_set

update from HEAD

Pull up following revision(s) (requested by ozaki-r in ticket #407):
	sys/compat/linux32/common/linux32_socket.c: revision 1.28
	sys/net/if.c: revision 1.400
	sys/netipsec/key.c: revision 1.243
	sys/compat/linux/common/linux_socket.c: revision 1.139
	sys/netinet/ip_carp.c: revision 1.93
	sys/netinet6/in6.c: revision 1.252
	sys/netinet6/in6.c: revision 1.253
	sys/netinet6/in6.c: revision 1.254
	sys/net/if_spppsubr.c: revision 1.173
	sys/net/if_spppsubr.c: revision 1.174
	sys/compat/common/uipc_syscalls_40.c: revision 1.14
Protect IFADDR_READER_FOREACH and obtained ifa with psz/psref
Fix usage of FOREACH macro
key_sad.lock is held there so SAVLIST_WRITER_FOREACH is enough.
Protect IFADDR_READER_FOREACH and obtained ifa with psz/psref
Protect IFADDR_READER_FOREACH and obtained ifa with psz/psref (more)
Fix and make consistent of usages of psz/psref in ifconf variants
Remove unnecessary goto because there is no cleanup code to share (NFC)
Tweak a condition; we don't need to care ifacount to be negative
Fix a race condition of in6_ifinit
in6_ifinit checks the number of IPv6 addresses on a given interface and
if it's zero (i.e., an IPv6 address being assigned to the interface
is the first one), call if_addr_init. However, the actual assignment of
the address (ifa_insert) is out of in6_ifinit. The check and the
assignment must be done atomically.
Fix it by holding in6_ifaddr_lock during in6_ifinit and ifa_insert.
And also add missing pserialize to IFADDR_READER_FOREACH.

Fix and make consistent of usages of psz/psref in ifconf variants

Hold KERNEL_LOCK on if_ioctl selectively based on IFEF_MPSAFE

If IFEF_MPSAFE is set, hold the lock and otherwise don't hold.

This change requires additions of KERNEL_LOCK to subsequence functions from
if_ioctl such as ifmedia_ioctl and ifioctl_common to protect non-MP-safe
components.

Proposed on tech-kern@ and tech-net@

remove useless cast, initialize family.

Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch

It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.

No functional change

 if_initalize() and if_attach() failed when resource allocation failed
(e.g. allocating softint). Without this change, it panics. It's bad because
resource shortage really occured when a lot of pseudo interface is created.
To avoid this problem, don't panic and change return value of if_initialize()
and if_attach() to int. Caller fanction will be recover from error cleanly by
checking the return value.

Sync with HEAD

Pull up following revision(s) (requested by roy in ticket #77):
	sys/net/if.h: revision 1.240
	sys/netinet/if_arp.c: revision 1.253
	sys/net/if.c: revision 1.395
Introduce if_get_bylla to find an interface with the active
local link address.
--
Use if_get_bylla() instead of just looking at the lla of the interface
the address belongs to.
This allows any ARP message we receieved from another interface to
be correctly dropped.
While here, move the protocol length check higher up the food chain.

Introduce if_get_bylla to find an interface with the active
local link address.

remove checks for failure after memory allocation calls that cannot fail:

  kmem_alloc() with KM_SLEEP
  kmem_zalloc() with KM_SLEEP
  percpu_alloc()
  pserialize_create()
  psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Allow CARP to call the link_state_change handler immediately

If the handler is delayed because of the indirection call via softint,
some operations are executed in reverse and may cause unexpected
behaviors. For example, due to the issue a GARP packet wasn't sent on
a transition from the BACKUP state to the MASTER state; this happened
because IN_IFF_DETACHED flag wasn't cleared on arpannounce, which
had been cleared in the link_state_change handler.

This fixes an issue reported by sborrill@ on tech-net:
  http://mail-index.netbsd.org/tech-net/2017/03/14/msg006283.html

Sync with HEAD

Sync with HEAD

Prepare netipsec for rump-ification

- Include "opt_*.h" only if _KERNEL_OPT is defined
- Allow encapinit to be called twice (by ifinit and ipe4_attach)
  - ifinit didn't call encapinit if IPSEC is enabled (ipe4_attach called
    it instead), however, on a rump kernel ipe4_attach may not be called
    even if IPSEC is enabled. So we need to allow ifinit to call it anyway
- Setup sysctls in ipsec_attach explicitly instead of using SYSCTL_SETUP
- Call ip6flow_invalidate_all in key_spdadd only if in6_present
  - It's possible that a rump kernel loads the ipsec library but not
    the inet6 library

Revert "Make sure to hold if_ioctl_lock when calling ifp->if_ioctl"

As per pgoyette@ and riastradh@ requests; we shouldn't decide to
hold a lock based on if the lock is held or not.

Make sure to hold if_ioctl_lock when calling ifp->if_ioctl

Unfortunately callers of ifp->if_ioctl (if_addr_init, if_flags_set
and if_mcast_op) may or may not hold if_ioctl_lock, so we have to
hold the lock only if it's not held.

Avoid touching a mbuf after enqueuing it

Remove extra semicolon

Sync with HEAD

Simplify ifunit, if_get and if_get_byindex by reusing other functions

Inspired by kre@'s comment

Fix panic on ifconfig <number>

Pointed out by s-yamaguchi@IIJ

Use if_acquire and if_release instead of using psref API directly

- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static

Replace DIAGNOSTIC + panic with KASSERT

ifp->if_transmit() must free mbuf even if error occurred.

Add missing m_freem(m) to if_nulltransmit().
Below ifp->if_transmit() implementations are already added m_freem(m) properly.
    - wm(4)
    - ixg(4)
    - ixv(4)
    - pppoe(4)
    - gif(4)
    - l2tp(4)

pointed out by ozaki-r@n.o, thanks.

Add missing splnet to if_deferred_start_common

if_start should run in splnet to avoid running interrupt handlers.

Remove mkludge stuffs

For unknown reasons, IPv6 multicast addresses are linked to a first
IPv6 address assigned to an interface. Due to the design, when removing
a first address having multicast addresses, we need to save them to
somewhere and later restore them once a new IPv6 address is activated.
mkludge stuffs support the operations.

This change links multicast addresses to an interface directly and
throws the kludge away.

Note that as usual some obsolete member variables remain for kvm(3)
users. And also sysctl net.inet6.multicast_kludge remains to avoid
breaking old ifmcstat.

TODO: currently ifnet has a list of in6_multi but obviously the list
should be protocol independent. Provide a common structure (if_multi
or something) to handle in6_multi and in_multi together as well as
ifaddr does for in_ifaddr and in6_ifaddr.

Rename if_acquire_NOMPSAFE to if_acquire

It can be used in MP-safe ways. So let's remove the confusing postfix.
If it's used in a unsafe way, warn NOMPSAFE in a comment.

support interface name which includes digit.

Avoid if_dl and if_sadl to be NULL

Calling if_deactivate_sadl and then if_sadl_setrefs exposes NULL-ed if_dl
and if_sadl to users for a moment. It's harmful because users expect that
they're always non-NULL. Fix it.

Note that a race condition still remains; if_dl and if_sald aren't updated
atomically so a user can see different data from if_dl and if_sadl.
Fortunately none uses both if_dl and if_sadl at the same time, so the race
condition doesn't hurt nobody for now. (In the first place exposing one
data with two ways is problematic?)

make attach and detach locking symmetric (detaching cloners failed)

Make bpf MP-safe

By the change, bpf_mtap can run without any locks as long as its bpf filter
doesn't match a target packet. Pushing data to a bpf buffer still needs
a lock. Removing the lock requires big changes and it's a future work.

Another known issue is that we need to remain some obsolete variables to
avoid breaking kvm(3) users such as netstat and fstat. One problem for
MP-ification is that in order to keep statistic counters of bpf_d we need
to use atomic operations for them. Once we retire the kvm(3) users, we
should make the counters per-CPU and remove the atomic operations.

Sync with HEAD

fix locking against myself in module autoload; module autoload calls
if_clone_attach which takes the lock again.

Restore splnet for if_slowtimo

if_slowtimo (== if_watchdog) still requires splnet for most drivers.

Pointed out by nonaka@

Replace some splnet with splsoftnet

Protect if_clone data with if_clone_mtx

To this end, carpattach needs to be delayed from RUMP_COMPONENT_NET to
RUMP_COMPONENT_NET_IF on rump_server. Otherwise mutex_enter via carpattach
for if_clone_mtx is called before mutex_init for it in ifinit1.

Add softnet_lock to if_link_state_change_si

Fix
  panic: lock error: Mutex: mutex_vector_exit: assertion failed:
  MUTEX_OWNER(mtx->mtx_owner) == curthread
at callout_halt <= arp_dad_stop <= in_if_link_down.

Enable some sysctl knobs on rump kernels for ifmcstat

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

pfil(9) improvements to handle address changes:

Add:
  PFIL_IFADDR     call on interface reconfig (mbuf is ioctl #)
  PFIL_IFNET      call on interface attach/detach (mbuf is PFIL_IFNET_*)

from rmind@

Move bpf_mtap and if_ipackets++ on Rx of each driver to percpuq if_input

The benefits of the change are:
- We can reduce codes
- We can provide the same behavior between drivers
  - Where/When if_ipackets is counted up
  - Note that some drivers still update packet statistics in their own
    way (periodical update)
- Moved bpf_mtap run in softint
  - This makes it easy to MP-ify bpf

Proposed on tech-kern and tech-net

Constify ifp of if_is_deactivated

Make the routing table and rtcaches MP-safe

See the following descriptions for details.

Proposed on tech-kern and tech-net


Overview
--------

We protect the routing table with a rwock and protect
rtcaches with another rwlock. Each rtentry is protected
from being freed or updated via reference counting and psref.

Global rwlocks
--------------

There are two rwlocks; one for the routing table (rt_lock) and
the other for rtcaches (rtcache_lock). rtcache_lock covers
all existing rtcaches; there may have room for optimizations
(future work).

The locking order is rtcache_lock first and rt_lock is next.

rtentry references
------------------

References to an rtentry is managed with reference counting
and psref. Either of the two mechanisms is used depending on
where a rtentry is obtained. Reference counting is used when
we obtain a rtentry from the routing table directly via
rtalloc1 and rtrequest{,1} while psref is used when we obtain
a rtentry from a rtcache via rtcache_* APIs. In both cases,
a caller can sleep/block with holding an obtained rtentry.

The reasons why we use two different mechanisms are (i) only
using reference counting hurts the performance due to atomic
instructions (rtcache case) (ii) ease of implementation;
applying psref to APIs such rtaloc1 and rtrequest{,1} requires
additional works (adding a local variable and an argument).

We will finally migrate to use only psref but we can do it
when we have a lockless routing table alternative.

Reference counting for rtentry
------------------------------

rt_refcnt now doesn't count permanent references such as for
rt_timers and rtcaches, instead it is used only for temporal
references when obtaining a rtentry via rtalloc1 and rtrequest{,1}.
We can do so because destroying a rtentry always involves
removing references of rt_timers and rtcaches to the rtentry
and we don't need to track such references. This also makes
it easy to wait for readers to release references on deleting
or updating a rtentry, i.e., we can simply wait until the
reference counter is 0 or 1. (If there are permanent references
the counter can be arbitrary.)

rt_ref increments a reference counter of a rtentry and rt_unref
decrements it. rt_ref is called inside APIs (rtalloc1 and
rtrequest{,1} so users don't need to care about it while
users must call rt_unref to an obtained rtentry after using it.

rtfree is removed and we use rt_unref and rt_free instead.
rt_unref now just decrements the counter of a given rtentry
and rt_free just tries to destroy a given rtentry.

See the next section for destructions of rtentries by rt_free.

Destructions of rtentries
-------------------------

We destroy a rtentry only when we call rtrequst{,1}(RTM_DELETE);
the original implementation can destroy in any rtfree where it's
the last reference. If we use reference counting or psref, it's
easy to understand if the place that a rtentry is destroyed is
fixed.

rt_free waits for references to a given rtentry to be released
before actually destroying the rtentry. rt_free uses a condition
variable (cv_wait) (and psref_target_destroy for psref) to wait.

Unfortunately rtrequst{,1}(RTM_DELETE) can be called in softint
that we cannot use cv_wait. In that case, we have to defer the
destruction to a workqueue.

rtentry#rt_cv, rtentry#rt_psref and global variables
(see rt_free_global) are added to conduct the procedure.

Updates of rtentries
--------------------

One difficulty to use refcnt/psref instead of rwlock for rtentry
is updates of rtentries. We need an additional mechanism to
prevent readers from seeing inconsistency of a rtentry being
updated.

We introduce RTF_UPDATING flag to rtentries that are updating.
While the flag is set to a rtentry, users cannot acquire the
rtentry. By doing so, we avoid users to see inconsistent
rtentries.

There are two options when a user tries to acquire a rtentry
with the RTF_UPDATING flag; if a user runs in softint context
the user fails to acquire a rtentry (NULL is returned).
Otherwise a user waits until the update completes by waiting
on cv.

The procedure of a updater is simpler to destruction of
a rtentry. Wait on cv (and psref) and after all readers left,
proceed with the update.

Global variables (see rt_update_global) are added to conduct
the procedure.

Currently we apply the mechanism to only RTM_CHANGE in
rtsock.c. We would have to apply other codes. See
"Known issues" section.

psref for rtentry
-----------------

When we obtain a rtentry from a rtcache via rtcache_* APIs,
psref is used to reference to the rtentry.

rtcache_ref acquires a reference to a rtentry with psref
and rtcache_unref releases the reference after using it.
rtcache_ref is called inside rtcache_* APIs and users don't
need to take care of it while users must call rtcache_unref
to release the reference.

struct psref and int bound that is needed for psref is
embedded into struct route. By doing so we don't need to
add local variables and additional argument to APIs.

However this adds another constraint to psref other than
reference counting one's; holding a reference of an rtentry
via a rtcache is allowed by just one caller at the same time.
So we must not acquire a rtentry via a rtcache twice and
avoid a recursive use of a rtcache. And also a rtcache must
be arranged to be used by a LWP/softint at the same time
somehow. For IP forwarding case, we have per-CPU rtcaches
used in softint so the constraint is guaranteed. For a h
rtcache of a PCB case, the constraint is guaranteed by the
solock of each PCB. Any other cases (pf, ipf, stf and ipsec)
are currently guaranteed by only the existence of the global
locks (softnet_lock and/or KERNEL_LOCK). If we've found the
cases that we cannot guarantee the constraint, we would need
to introduce other rtcache APIs that use simple reference
counting.

psref of rtcache is created with IPL_SOFTNET and so rtcache
shouldn't used at an IPL higher than IPL_SOFTNET.

Note that rtcache_free is used to invalidate a given rtcache.
We don't need another care by my change; just keep them as
they are.

Performance impact
------------------

When NET_MPSAFE is disabled the performance drop is 3% while
when it's enabled the drop is increased to 11%. The difference
comes from that currently we don't take any global locks and
don't use psref if NET_MPSAFE is disabled.

We can optimize the performance of the case of NET_MPSAFE
on by reducing lookups of rtcache that uses psref;
currently we do two lookups but we should be able to trim
one of two. This is a future work.

Known issues
------------

There are two known issues to be solved; one is that
a caller of rtrequest(RTM_ADD) may change rtentry (see rtinit).
We need to prevent new references during the update. Or
we may be able to remove the code (perhaps, need more
investigations).

The other is rtredirect that updates a rtentry. We need
to apply our update mechanism, however it's not easy because
rtredirect is called in softint and we cannot apply our
mechanism simply. One solution is to defer rtredirect to
a workqueue but it requires some code restructuring.

This spams 100's of times during boot!

Introduce deferred if_start framework

The framework provides a means to schedule if_start that will be executed
in softint later. It intends to be used to avoid calling if_start,
especially bpf_mtap, in hardware interrupt.

It adds a dedicated softint to a driver if the driver requests to use the
framework via if_deferred_start_init. The driver can schedule deferred
if_start by if_schedule_deferred_start.

Proposed and discussed on tech-kern and tech-net

Fix memory leak of struct if_percpuq on interface destruction

Sync with HEAD

Don't use rt_walktree to delete routes

Some functions use rt_walktree to scan the routing table and delete
matched routes. However, we shouldn't use rt_walktree to delete
routes because rt_walktree is recursive to the routing table (radix
tree) and isn't friendly to MP-ification. rt_walktree allows a caller
to pass a callback function to delete an matched entry. The callback
function is called from an API of the radix tree (rn_walktree) but
also calls an API of the radix tree to delete an entry.

This change adds a new API of the radix tree, rn_search_matched,
which returns a matched entry that is selected by a callback
function passed by a caller and the caller itself deletes the
entry. By using the API, we can avoid the recursive form.

Move if_43.c back into the shared Makefile.sysio where it really
belongs.

Update the code to invoke the two routines compat_cvtcmd() and
compat_ifioctl() through indirect pointers.  Initialize those
pointers in sys/net/if.c and update them in the compat module's
initialization code.

Addresses the issue pointed out in PR kern/51598

Sync with HEAD

Fix the position of IFADDR_ENTRY_DESTROY

It must be called after all readers left, i.e, after pserialize_perform.

Don't hold global locks if NET_MPSAFE is enabled

If NET_MPSAFE is enabled, don't hold KERNEL_LOCK and softnet_lock in
part of the network stack such as IP forwarding paths. The aim of the
change is to make it easy to test the network stack without the locks
and reduce our local diffs.

By default (i.e., if NET_MPSAFE isn't enabled), the locks are held
as they used to be.

Reviewed by knakahara@

Sync with HEAD

Fix race condition on ifqueue used by traditional netisr

If a underlying network device driver supports MSI/MSI-X, RX interrupts
can be delivered to arbitrary CPUs. This means that Layer 2 subroutines
such as ether_input (softint) and subsequent Layer 3 subroutines (softint)
which are called via traditional netisr can be dispatched on an arbitrary
CPU. Layer 2 subroutines now run without any locks (expected) and so a
Layer 2 subroutine and a Layer 3 subroutine can run in parallel.

There is a shared data between a Layer 2 routine and a Layer 3 routine,
that is ifqueue and IF_ENQUEUE (from L2) and IF_DEQUEUE (from L3) on it
are racy now.

To fix the race condition, use ifqueue#ifq_lock to protect ifqueue
instead of splnet that is meaningless now.

The same race condition exists in route_intr. Fix it as well.

Reviewed by knakahara@

Sync with HEAD

Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

Sync with HEAD

Reduce KERNEL_LOCK thereby ifq_lock is used by default.

if_snd is always excluded by ifq_lock now. So, the KERNEL_LOCK in if_transmit()
which serializes packet output processing is not needed now.

Toward NET_MPSAFE-on in future, if_snd uses if_snd->ifq_lock by default.

That can reduce confusing difference between NET_MPSAFE on and off.

Sync with HEAD

Switch the address list of intefaces to pslist(9)

As usual, we leave the old list to avoid breaking kvm(3) users.

fix evbsh3 build

make encap_lock_{enter,exit} interruptable.

Tweak p2p_rtrequest as well for ifaddr initialization change

We need to set lo0ifp to rt->rt_ifp if the interface is RTF_LOCAL.

Fix PR kern/51301.

Make sure to free all interface addresses in if_detach

Addresses of an interface (struct ifaddr) have a (reverse) pointer of an
interface object (ifa->ifa_ifp). If the addresses are surely freed when
their interface is destroyed, the pointer is always valid and we don't
need a tweak of replacing the pointer to if_index like mbuf.

In order to make sure the assumption, the following changes are required:
- Deactivate the interface at the firstish of if_detach. This prevents
  in6_unlink_ifa from saving multicast addresses (wrongly)
- Invalidate rtcache(s) and clear a rtentry referencing an address on
  RTM_DELETE. rtcache(s) may delay freeing an address
- Replace callout_stop with callout_halt of DAD timers to ensure stopping
  such timers in if_detach

Add debug helper function for interface addresses

It checks whether all addresses of an interface being destroyed
are freed (no reference remains) at the end of if_detach.

Introduce if_is_deactivated

Checking ifp->if_output == if_nulloutput is too implicit.

No functional change.

fix spelling mistake pointed out by roy@n.o

reduce link state changing softint if it is not required

ok by ozaki-r@n.o

fix: locking about IFQ_ENQUEUE and ALTQ

- If NET_MPSAFE is not defined, IFQ_LOCK is nop. Currently, that means
  IFQ_ENQUEUE() of some paths such as bridge_enqueue() is called parallel
  wrongly.
- If ALTQ is enabled, Tx processing should call if_transmit() (= IFQ_ENQUEUE
  + ifp->if_start()) instead of ifp->if_transmit() to call ALTQ_ENQUEUE()
  and ALTQ_DEQUEUE().
  Furthermore, ALTQ processing is always required KERNEL_LOCK currently.

Make sure returning ifp from in6_select* functions psref-ed

To this end, callers need to pass struct psref to the functions
and the fuctions acquire a reference of ifp with it. In some cases,
we can simply use if_get_byindex, however, in other cases
(say rt->rt_ifp and ia->ifa_ifp), we have no MP-safe way for now.
In order to take a reference anyway we use non MP-safe function
if_acquire_NOMPSAFE for the latter cases. They should be fixed in
the future somehow.

apply if_start_lock() to L2 callers which call ifp->if_start() of device derivers

Do psref_target_destroy after purging packets

Because purging packets may try to send packets, which requires psref yet.

Fix error branches of if_sdl_sysctl.

Can't release the psref if we didn't even find the interface!

Use if_get_byindex instead of if_byindex for MP-safe

Use curlwp_bind and curlwp_bindx instead of open-coding LP_BOUND

Avoid storing a pointer of an interface in a mbuf

Having a pointer of an interface in a mbuf isn't safe if we remove big
kernel locks; an interface object (ifnet) can be destroyed anytime in any
packet processing and accessing such object via a pointer is racy. Instead
we have to get an object from the interface collection (ifindex2ifnet) via
an interface index (if_index) that is stored to a mbuf instead of an
pointer.

The change provides two APIs: m_{get,put}_rcvif_psref that use psref(9)
for sleep-able critical sections and m_{get,put}_rcvif that use
pserialize(9) for other critical sections. The change also adds another
API called m_get_rcvif_NOMPSAFE, that is NOT MP-safe and for transition
moratorium, i.e., it is intended to be used for places where are not
planned to be MP-ified soon.

The change adds some overhead due to psref to performance sensitive paths,
however the overhead is not serious, 2% down at worst.

Proposed on tech-kern and tech-net.

Optimize if_get_byindex by adding __predict_true

Sync with HEAD

Replace ifnet_lock with if_get and if_put

ifnet_lock is a dedicated method to safely destroy an interface over running
ioctl operations. Replace it with a more generic mechanism using psref(9).

Introduce if_get, if_get_byindex and if_put

The new API enables to obtain an ifnet object with protected by psref(9).
It is intended to be used where an obtained ifnet object is used over
sleepable operations.

Protect ifnet list with psz and psref

The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).

Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.

Typo in comment

introduce new ifnet MP-scalable sending interface "if_transmit".

Constify rtentry of if_output

We no longer need to change rtentry below if_output.

The change makes it clear where rtentries are changed (or not)
and helps forthcoming locking (os psrefing) rtentries.

Sync with HEAD

IFQ_ENQUEUE refactor (3/3) : eliminate pktattr argument from IFQ_ENQUEUE caller

Don't use radix tree API directly

Separate nexthop caches from the routing table

By this change, nexthop caches (IP-MAC address pair) are not stored
in the routing table anymore. Instead nexthop caches are stored in
each network interface; we already have lltable/llentry data structure
for this purpose. This change also obsoletes the concept of cloning/cloned
routes. Cloned routes no longer exist while cloning routes still exist
with renamed to connected routes.

Noticeable changes are:
- Nexthop caches aren't listed in route show/netstat -r
  - sysctl(NET_RT_DUMP) doesn't return them
  - If RTF_LLDATA is specified, it returns nexthop caches
- Several definitions of routing flags and messages are removed
  - RTF_CLONING, RTF_XRESOLVE, RTF_LLINFO, RTF_CLONED and RTM_RESOLVE
- RTF_CONNECTED is added
  - It has the same value of RTF_CLONING for backward compatibility
- route's -xresolve, -[no]cloned and -llinfo options are removed
  - -[no]cloning remains because it seems there are users
  - -[no]connected is introduced and recommended
    to be used instead of -[no]cloning
- route show/netstat -r drops some flags
  - 'L' and 'c' are not seen anymore
  - 'C' now indicates a connected route
- Gateway value of a route of an interface address is now not
  a L2 address but "link#N" like a connected (cloning) route
- Proxy ARP: "arp -s ... pub" doesn't create a route

You can know details of behavior changes by seeing diffs under tests/.

Proposed on tech-net and tech-kern:
  http://mail-index.netbsd.org/tech-net/2016/03/11/msg005701.html

add drop count which means the sum of struct if_percpuq's per-CPU queues.

ok by ozaki-r@n.o

Sync with HEAD

Add missing percpu_putref to error path

Implement a queue for if_link_state_change() calls to fix a race condition
introduced in the prior patch.

The queue has capacity to store 8 link state changes, if it overflows then
the oldest state change is lost, but the oldest DOWN state change is
preserved to ensure any subsequent UP state changes reflect properly.

Because there are only 3 states to queue, the queue itself is implemented
by storing 2-bit numbers in a bigger one.
To increase the size of the queue, just increase the size of the backing
store to a bigger number.

Run if_link_state_change in softint

if_link_state_change can execute the network stack that is expected to
not run in hardware interrupt (at least now), however network drivers
may call it in hardware interrupt. Avoid that by introducing a new
softint for if_link_state_change.

The original patch is provided by mlelstv@ and tweaked a bit by me.

Should fix PR kern/50602.

Introduce softint-based if_input

This change intends to run the whole network stack in softint context
(or normal LWP), not hardware interrupt context. Note that the work is
still incomplete by this change; to that end, we also have to softint-ify
if_link_state_change (and bpf) which can still run in hardware interrupt.

This change softint-ifies at ifp->if_input that is called from
each device driver (and ieee80211_input) to ensure Layer 2 runs
in softint (e.g., ether_input and bridge_input). To this end,
we provide a framework (called percpuq) that utlizes softint(9)
and percpu ifqueues. With this patch, rxintr of most drivers just
queues received packets and schedules a softint, and the softint
dequeues packets and does rest packet processing.

To minimize changes to each driver, percpuq is allocated in struct
ifnet for now and that is initialized by default (in if_attach).
We probably have to move percpuq to softc of each driver, but it's
future work. At this point, only wm(4) has percpuq in its softc
as a reference implementation.

Additional information including performance numbers can be found
in the thread at tech-kern@ and tech-net@:
http://mail-index.netbsd.org/tech-kern/2016/01/14/msg019997.html

Acknowledgment: riastradh@ greatly helped this work.
Thank you very much!

Revert previous: ran cvs commit when I meant cvs diff.  Sorry!

Hit up-arrow one too few times.

Give proper prototype to ip_output.

Fix the destruction of the afdata lock

Pointed out by mlelstv@

Sync with HEAD (as of 26th Dec)

Remove an ifnet object from the global list before destructing it

Sync with HEAD

Hook up lltable/llentry with the kernel (and rumpkernel)

It is built and initialized on bootup, but there is no user for now.

Most codes in in.c are imported from FreeBSD as well as lltable/llentry.

Reform use of rt_refcnt

rt_refcnt of rtentry was used in bad manners, for example, direct rt_refcnt++
and rt_refcnt-- outside route.c, "rt->rt_refcnt++; rtfree(rt);" idiom, and
touching rt after rt->rt_refcnt--.

These abuses seem to be needed because rt_refcnt manages only references
between rtentry and doesn't take care of references during packet processing
(IOW references from local variables). In order to reduce the above abuses,
the latter cases should be counted by rt_refcnt as well as the former cases.

This change improves consistency of use of rt_refcnt:
- rtentry is always accessed with rt_refcnt incremented
- rtentry's rt_refcnt is decremented after use (rtfree is always used instead
  of rt_refcnt--)
- functions returning rtentry increment its rt_refcnt (and caller rtfree it)

Note that rt_refcnt prevents rtentry from being freed but doesn't prevent
rtentry from being updated. Toward MP-safe, we need to provide another
protection for rtentry, e.g., locks. (Or introduce a better data structure
allowing concurrent readers during updates.)

Remove ifnet_addrs

We can assume that ifnet_addrs[ifp->if_index] is always the same as
ifp->if_dl, so we can replace ifnet_addrs[ifp->if_index] with ifp->if_dl
and remove ifnet_addrs entirely.

ok martin@

Sync with HEAD

Implement SIOCIFGCLONERS for netbsd32, so ifconfig -C works.

This comment is no longer IPv6 specific.

Fix a copy n pasta error with prior.

Move INET6 specific in6_if_{up,down}() and in6_if_link_{up,down}()
into agnostic domain functions.

Attach PF_INET6 pktq sysctls only when inet6 is present.

More modular initialization would be nicer, but at least this patch
prevents "sysctl -a" from crashing when INET6 is defined by inet6 has
not been attached.

Introduce p2p_rtrequest() so that IFF_POINTOPOINT interfaces can work
with RTF_LOCAL.
Fixes PR kern/49829.

Move in6if_do_dad() to if_do_dad() as the routine is not INET6 specific
and could equally be used by INET.

Sync with HEAD

Introduce defflag for NET_MPSAFE

Introduce if_initialize and if_register as an alternative to if_attach

if_attach initializes an ifnet object and registers it to the system
(e.g., ifnet_list), however, if_attach doesn't complete the
initialization and the rest of it will be done by if_alloc_sadl
that is normally directly called by device drivers or called via
functions like ether_ifattach. So there is a race between
if_attach and if_alloc_sadl (A half-baked ifnet object may be
accessed, for example, via ioctl between them).

The aim of this fix is to register an initializing ifnet object
after completing its initializations. To this end, this fix
separates if_attach into an initialization part (if_initialize)
and a registration part (if_register) and call the latter after
if_alloc_sadl (ether_ifattach). So a typical usage of the two
new APIs is like this:

  if_initialize(ifp);  // was if_attach
  ether_ifattach(ifp, enaddr);
  if_register(ifp);

Nonetheless, changing every drivers to do so at once isn't
feasible. So we keep if_attach working as it used to be and
will change only some drivers that we need at this point.
Once we know the fix really works well, we'll change all
the others.

Some more information of the fix can be found here:
http://mail-index.netbsd.org/tech-kern/2014/12/10/msg018242.html

No objection on tech-kern and tech-net.

Avoid a race when the ifp->if_slowtimo pointer is changed while we are
running in if_slowtimo already. Suggested by Masao Uebayashi
in PR kern/49462.

Avoid scheduling more slow timeouts while we are in the process of detaching
the interface: set if_slowtimo to NULL before doing the callout_halt()
and test for that in the callout. Fixes PR kern/49462.

Tweak ifconf (retry)

The tweak makes the code intention clear and further changes easy.

No functional change.

The first trial broke SIOCGIFCONF (PR 49437). So as not to repeat the mistake,
t_ifconf was added. It should warn if something goes wrong on ifconf.

Revert "Pull if_drain routine out of m_reclaim"

The commit broke dlopen()'d rumpnet on platforms where ld.so does not
override weak aliases (e.g. musl, Solaris, potentially OS X, ...).

Requested by pooka@.

Make more functions static

No functional change.

PR/49437: jmcneill: revert broken changes that broke SIOCGIFCONF (mdnsd uses it)

Remove dead codes and make if_free_sadl static

No functional change.

Pull if_drain routine out of m_reclaim

It's if-specific and should be in if.c.

No functional change.

Tweak ifconf variants

The tweaks make the code intention clear and make further changes easy.

No functional change.

Change if_slowtimo_ch to a pointer

One benefit to do so is to reduce memory used for struct callout;
we can avoid to allocate struct callout for interfaces that don't
use callout.

Requested by uebayasi@.

Create if_slowtimo (if_watchdog) callout for each interface

This change is to obviate the need to run if_slowtimo callbacks that
may sleep inside IFNET_FOREACH. And also by this change we can turn
on MPSAFE of callouts individually.

Discussed with uebayasi@ and riastradh@.

Rename if_watchdog to if_slowtimo

if_watchdog callbacks do a little more than what "watchdog" suggests.

Discussed with uebayasi@ (the idea originally from openbsd-tech).

Make if_slowtimo static

Make ifconfig destroy work if INET6 is present but not attached

Pull up following revision(s) (requested by ozaki-r in ticket #205):
	sys/net/if.c: revision 1.292
PR/49373: Ryota Ozaki: Running if_clone_create and if_clone_destroy in
parallel causes panic
XXX: Pullup 7.

PR/49373: Ryota Ozaki: Running if_clone_create and if_clone_destroy in
parallel causes panic
XXX: Pullup 7.

Eliminate IFAREF() and IFAFREE() macros in favour of functions.

Rebase to HEAD as of a few days ago.

Rebase.

split PRU_CONNECT2 & PRU_PURGEIF function out of pr_generic() usrreq
switches and put into separate functions

  - always KASSERT(solocked(so)) even if not implemented
    (for PRU_CONNECT2 only)

  - replace calls to pr_generic() with req = PRU_CONNECT2 with calls to
    pr_connect2()

  - replace calls to pr_generic() with req = PRU_PURGEIF with calls to
    pr_purgeif()

put common code from unp_connect2() (used by unp_connect() into
unp_connect1() and call out to it when needed

patch only briefly reviewed by rmind@

Define IFADDR_FOREACH_SAFE for on-the-fly element removal in a loop

We have to use it when we purge an address element in an ifaddr loop.

This change restores the original behavior that was accidentally degraded.

Call etherinit from ifinit1 only when it is required

This unbreaks the builds of kernels that don't build if_ethersubr.c.

Use IFADDR_FOREACH

Add a mutex for global variables of if_ethersubr.c

To initialize the mutex, we introduce etherinit that is called from ifinit1.

Lock IFQ operations when NET_MPSAFE

- Introduce NET_MPSAFE
  - not defined by default
- Add ifq_lock to protect ifnet#if_snd
- Initialize ifq_lock and lock IFQ operations
  when NET_MPSAFE

When NET_MPSAFE isn't defined, this modification
doesn't change its behavior and adds trivial
performance overheads.

Discussed with matt@ on tech-net

fix parameter types in pr_ioctl, called xx_control() functions and remove
abuse of pointer to struct mbuf type.

param2 changed to u_long type and uses parameter name 'cmd' (ioctl command)
param3 changed to void * type and uses parameter name 'data'
param4 changed to struct ifnet * and uses parameter name 'ifp'
param5 has been removed (formerly struct lwp *) and uses of 'l' have been
       replaced with curlwp from curproc(9).

callers have had (now unnecessary) casts to struct mbuf * removed, called
code has had (now unnecessary) casts to u_long, void * and struct ifnet *
respectively removed.

reviewed by rmind@

* split PRU_CONTROL functionality out of xxx_userreq() switches and place
  into separate xxx_ioctl() functions.
* place KASSERT(req != PRU_CONTROL) inside xxx_userreq() as it is now
  inappropriate for req = PRU_CONTROL in xxx_userreq().
* replace calls to pr_generic() with req = PRU_CONTROL with pr_ioctl().
* remove & fixup references to PRU_CONTROL xxx_userreq() function comments.
* fix various comments references for xxx_userreq() that mentioned
  PRU_CONTROL as xxx_userreq() no longer handles the request.

a further change will follow to fix parameter and naming inconsistencies
retained from original code.

Reviewed by rmind@

Move sysctl_pktq_{maxlen,count} to pktqueue.c and make them global

They will be used by bridge.

ok rmind@

if_detach: drain ip6_pktq as well.

Introduce new sysctls for obtaining interface-specific addresses:
- net.sdl for the active link-layer adddress (the MAC)
- net.ether.multicast for the Ethernet multicast addresses
- net.inet6.multicast for the IPv6 multicast groups
- net.inet6.multicast_kludge for temporarily removed multicast groups

Use this sysctls for replacing the kmem grovelling in ifmcstat(8).

Implement pktq_set_maxlen() and let sysctl net.inet.{ip,ip6}.ifq.maxlen be
changed on the fly again.

Include <netinet/in.h> before <netinet/in_var.h> to avoid build failure
for the COMPUTEX7750 kernel of evbsh3-eb.
Also, don't reference ip_pktq if INET isn't defined (found by the same
kernel).

- Eliminate RTFREE() macro in favour of rtfree() function.
- Make rtcache() function static.

- Implement pktqueue interface for lockless IP input queue.
- Replace ipintrq and ip6intrq with the pktqueue mechanism.
- Eliminate kernel-lock from ipintr() and ip6intr().
- Some preparation work to push softnet_lock out of ipintr().

Discussed on tech-net.

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

Add struct pr_usrreqs with a pr_generic function and prepare for the
dismantling of pr_usrreq in the protocols; no functional change intended.
PRU_ATTACH/PRU_DETACH changes will follow soon.

Bump for struct protosw.  Welcome to 6.99.62!

- Move ifnet_list (and lo0ifp while here) under #ifdef _KERNEL.
- Make ifindex2ifnet, if_indexlim and some other variables static.
- Move if_index generation into its own function.
- if_alloc/if_free: replace malloc with kmem.

Decouple sockets linkage from interface code by making ifioctl() a pointer.

Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

missed one inet6 check

Allow kernels compiled with INET+INET6 to be booted as IPv4-only or IPv6-only.

adjust previous; old_link_state is also used in INET6.

Ifdef a variable like its use

remove unrelated diff.

Add SIOCGIFINDEX from Ty Sarna and Matthew Sporleder.

sync with head

Checkpoint work in progress:
- Initial split of the protocol user-request method into the following
  methods: pr_attach, pr_detach and pr_generic for old the pr_usrreq.
- Adjust socreate(9) and sonewconn(9) to call pr_attach without the
  socket lock held (as a preparation for the locking scheme adjustment).
- Adjust all pr_attach routines to assert that PCB is not set.
- Sprinkle various comments, document some routines and their locking.
- Remove M_PCB, replace with kmem(9).
- Fix few bugs spotted on the way.

Checkpoint work in progress:
- Move PCB structures under __INPCB_PRIVATE, adjust most of the callers
  and thus make IPv4 PCB structures mostly opaque.  Any volunteers for
  merging in6pcb with inpcb (see rpaulo-netinet-merge-pcb branch)?
- Move various global vars to the modules where they belong, make them static.
- Some preliminary work for IPv4 PCB locking scheme.
- Make raw IP code mostly MP-safe.  Simplify some of it.
- Rework "fast" IP forwarding (ipflow) code to be mostly MP-safe.  It should
  run from a software interrupt, rather than hard.
- Rework tun(4) pseudo interface to be MP-safe.
- Work towards making some other interfaces more strict.

- Rewrite parts of pfil(9): use array to store hooks and thus be more cache
  friendly (there are only few hooks in the system).  Make the structures
  opaque and the interface more strict.
- Remove PFIL_HOOKS option by making pfil(9) mandatory.

resync from head

Move the detaching and making tentative addresses out if in6_if_up
and into in6_if_link_up.

This fixes a possible panic where link is up but not the interface.
Note that a better solution would be to listen to the routing socket
in the kernel, but I don't know how to do that.

Reachable Router tests for IFF_UP as well.

When an interface link state changes to down, mark all attached IPv6
addresses as detached.
Likewise, when the link state changes to up, mark all detached IPv6
as tentative and start DAD on them.

Advertised router reachability now checks that link state is not down.
This means that when an interface link state changes, the default IPv6
router may change as well.

allow cloners as modules.

sync with (a bit old) head

Resync to 2012-11-19 00:00:00 UTC

Pull up following revision(s) (requested by msaitoh in ticket #669):
	sys/net/if.c: revision 1.261
Fix a bug that SIOCZIFDATA clears if_lastchage by zero.
Update if_lastchange with getnanotime().

Fix a bug that SIOCZIFDATA clears if_lastchage by zero.
Update if_lastchange with getnanotime().

sync with head

merge to -current.

PR/45764, PR/45914
Part 2:
Arrange so that the pointers that we free (ifp->if_afdata, dom->dom_ifqueues[i])
are set to NULL.
While I am here, add a continue.

Pull up the following revisions(s) (requested by obache in ticket #1708):
	sys/net/if.c:	revision 1.246

PR/44030: ifreqn2o gets called with the parameters the wrong way around.
Reverts fix for PR 42585 (ticket #1416) as the root cause of the crash is
addressed by PR 44054 (pullup #1541).

Fix ifpromisc() regression: if ifpromisc(ifp, 1) is called, do set
IFF_PROMISC whether ifp is IFF_UP or not, but do not call ifp->if_ioctl
unless ifp is IFF_UP.

We need a cv_destroy() here too.  Fixes LOCKDEBUG panic on interface detachment.