/*      $NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $  */

/*
 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
 * Nottingham University 1987.
 *
 * This source may be freely distributed, however I would be interested
 * in any changes that are made.
 *
 * This driver takes packets off the IP i/f and hands them up to a
 * user process to have its wicked way with. This driver has it's
 * roots in a similar driver written by Phil Cockcroft (formerly) at
 * UCL. This driver is based much more on read/write/poll mode of
 * operation though.
 *
 * $FreeBSD: src/sys/net/if_tun.c,v 1.74.2.8 2002/02/13 00:43:11 dillon Exp $
 */

#include "opt_inet.h"
#include "opt_inet6.h"

#include <sys/param.h>
#include <sys/proc.h>
#include <sys/caps.h>
#include <sys/systm.h>
#include <sys/mbuf.h>
#include <sys/socket.h>
#include <sys/conf.h>
#include <sys/device.h>
#include <sys/filio.h>
#include <sys/sockio.h>
#include <sys/ttycom.h>
#include <sys/signalvar.h>
#include <sys/filedesc.h>
#include <sys/kernel.h>
#include <sys/sysctl.h>
#include <sys/uio.h>
#include <sys/vnode.h>
#include <sys/malloc.h>
#include <sys/mplock2.h>
#include <sys/devfs.h>
#include <sys/queue.h>

#include <net/bpf.h>
#include <net/if.h>
#include <net/if_types.h>
#include <net/if_clone.h>
#include <net/ifq_var.h>
#include <net/netisr.h>
#include <net/route.h>

#ifdef INET
#include <netinet/in.h>
#endif

#include "if_tunvar.h"
#include "if_tun.h"

#define TUN             "tun"
#define TUNDEBUG        if (tundebug) if_printf

/* module */
static int              tunmodevent(module_t, int, void *);

/* device */
static struct tun_softc *tuncreate(cdev_t, int);
static void             tundestroy(struct tun_softc *sc);

/* clone */
static int              tun_clone_create(struct if_clone *, int,
                                         caddr_t, caddr_t);
static int              tun_clone_destroy(struct ifnet *);

/* network interface */
static int              tunifinit(struct ifnet *);
static void             tunifstart(struct ifnet *, struct ifaltq_subque *);
static int              tunifoutput(struct ifnet *, struct mbuf *,
                                    struct sockaddr *, struct rtentry *rt);
static int              tunifioctl(struct ifnet *, u_long,
                                   caddr_t, struct ucred *);

/* character device */
static d_open_t         tunopen;
static d_close_t        tunclose;
static d_read_t         tunread;
static d_write_t        tunwrite;
static d_ioctl_t        tunioctl;
static d_kqfilter_t     tunkqfilter;
static d_clone_t        tunclone;

static struct dev_ops   tun_ops = {
        { TUN, 0, 0 },
        .d_open =       tunopen,
        .d_close =      tunclose,
        .d_read =       tunread,
        .d_write =      tunwrite,
        .d_ioctl =      tunioctl,
        .d_kqfilter =   tunkqfilter
};

/* kqueue support */
static void             tun_filter_detach(struct knote *);
static int              tun_filter_read(struct knote *, long);
static int              tun_filter_write(struct knote *, long);

static struct filterops tun_read_filtops = {
        FILTEROP_ISFD,
        NULL,
        tun_filter_detach,
        tun_filter_read
};
static struct filterops tun_write_filtops = {
        FILTEROP_ISFD,
        NULL,
        tun_filter_detach,
        tun_filter_write
};

static int              tundebug = 0;   /* debug flag */
static int              tunrefcnt = 0;  /* module reference counter */

static MALLOC_DEFINE(M_TUN, TUN, "Tunnel Interface");

static DEVFS_DEFINE_CLONE_BITMAP(tun);

struct if_clone tun_cloner = IF_CLONE_INITIALIZER(
        TUN, tun_clone_create, tun_clone_destroy, 0, IF_MAXUNIT);

static SLIST_HEAD(,tun_softc) tun_listhead =
        SLIST_HEAD_INITIALIZER(&tun_listhead);

SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0,
           "Enable debug output");
SYSCTL_DECL(_net_link);
SYSCTL_NODE(_net_link, OID_AUTO, tun, CTLFLAG_RW, 0,
            "IP tunnel software network interface");
SYSCTL_INT(_net_link_tun, OID_AUTO, debug, CTLFLAG_RW, &tundebug, 0,
           "Enable debug output");
SYSCTL_INT(_net_link_tun, OID_AUTO, refcnt, CTLFLAG_RD, &tunrefcnt, 0,
           "Number of opened devices");

DEV_MODULE(if_tun, tunmodevent, NULL);

/*
 * tunmodevent - module event handler
 */
static int
tunmodevent(module_t mod, int type, void *data)
{
        static cdev_t dev = NULL;
        struct tun_softc *sc, *sc_tmp;

        switch (type) {
        case MOD_LOAD:
                dev = make_autoclone_dev(&tun_ops, &DEVFS_CLONE_BITMAP(tun),
                                         tunclone, UID_UUCP, GID_DIALER,
                                         0600, TUN);

                SLIST_INIT(&tun_listhead);
                if_clone_attach(&tun_cloner);
                break;

        case MOD_UNLOAD:
                if (tunrefcnt > 0)
                        return (EBUSY);

                if_clone_detach(&tun_cloner);

                SLIST_FOREACH_MUTABLE(sc, &tun_listhead, tun_link, sc_tmp)
                        tundestroy(sc);

                dev_ops_remove_all(&tun_ops);
                destroy_autoclone_dev(dev, &DEVFS_CLONE_BITMAP(tun));
                break;

        default:
                return (EOPNOTSUPP);
        }

        return (0);
}

static int
tunclone(struct dev_clone_args *ap)
{
        char ifname[IFNAMSIZ];
        int unit;

        unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(tun), 0);
        ksnprintf(ifname, IFNAMSIZ, "%s%d", TUN, unit);
        ap->a_dev = make_only_dev(&tun_ops, unit, UID_UUCP, GID_DIALER,
                                  0600, "%s", ifname);

        /*
         * Use the if_clone framework to create cloned device/interface,
         * so the two clone methods (autoclone device /dev/tun; ifconfig
         * clone) are consistent and can be mix used.
         *
         * Need to pass the cdev_t because the device created by
         * 'make_only_dev()' doesn't appear in '/dev' yet so that it can't
         * be found by 'devfs_find_device_by_name()' in 'tun_clone_create()'.
         */
        return (if_clone_create(ifname, IFNAMSIZ, NULL, (caddr_t)ap->a_dev));
}

static struct tun_softc *
tuncreate(cdev_t dev, int flags)
{
        struct tun_softc *sc;
        struct ifnet *ifp;
        int unit = minor(dev);

        sc = kmalloc(sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
        dev->si_drv1 = sc;
        sc->tun_dev = dev;
        sc->tun_flags = TUN_INITED;
        sc->tun_flags |= flags;

        reference_dev(dev);  /* device association */

        ifp = sc->tun_ifp = if_alloc(IFT_PPP);
        if (ifp == NULL) {
                kprintf("%s: failed to if_alloc() interface for %s%d",
                        __func__, TUN, unit);
                return (NULL);
        }

        if_initname(ifp, TUN, unit);
        ifp->if_mtu = TUNMTU;
        ifp->if_ioctl = tunifioctl;
        ifp->if_output = tunifoutput;
        ifp->if_start = tunifstart;
        ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
        ifp->if_softc = sc;
        ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
        ifq_set_ready(&ifp->if_snd);

        if_attach(ifp, NULL);
        bpfattach(ifp, DLT_NULL, sizeof(uint32_t));

        SLIST_INSERT_HEAD(&tun_listhead, sc, tun_link);
        TUNDEBUG(ifp, "created, minor = %#x, flags = 0x%x\n",
                 unit, sc->tun_flags);
        return (sc);
}

static void
tundestroy(struct tun_softc *sc)
{
        cdev_t dev = sc->tun_dev;
        struct ifnet *ifp = sc->tun_ifp;
        int unit = minor(dev);

        TUNDEBUG(ifp, "destroyed, minor = %#x. Module refcnt = %d\n",
                 unit, tunrefcnt);

        bpfdetach(ifp);
        if_detach(ifp);
        if_free(ifp);

        sc->tun_dev = NULL;
        dev->si_drv1 = NULL;
        release_dev(dev);  /* device disassociation */

        /* Also destroy the cloned device */
        destroy_dev(dev);
        devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(tun), unit);

        SLIST_REMOVE(&tun_listhead, sc, tun_softc, tun_link);
        kfree(sc, M_TUN);
}

/*
 * tunnel open - must be superuser & the device must be configured in
 */
static int
tunopen(struct dev_open_args *ap)
{
        cdev_t dev = ap->a_head.a_dev;
        struct tun_softc *sc;
        int error;

        if ((error = caps_priv_check(ap->a_cred, SYSCAP_RESTRICTEDROOT)) != 0)
                return (error);

        sc = dev->si_drv1;
        if (sc == NULL && (sc = tuncreate(dev, 0)) == NULL)
                return (ENOMEM);
        if (sc->tun_flags & TUN_OPEN)
                return (EBUSY);

        sc->tun_pid = curproc->p_pid;
        sc->tun_flags |= TUN_OPEN;
        tunrefcnt++;

        TUNDEBUG(sc->tun_ifp, "opened, minor = %#x. Module refcnt = %d\n",
                 minor(dev), tunrefcnt);
        return (0);
}

/*
 * close the device - mark interface down & delete routing info
 */
static int
tunclose(struct dev_close_args *ap)
{
        cdev_t dev = ap->a_head.a_dev;
        struct tun_softc *sc = dev->si_drv1;
        struct ifnet *ifp;
        int unit = minor(dev);
        char ifname[IFNAMSIZ];

        KASSERT(sc != NULL,
                ("try closing the already destroyed %s%d", TUN, unit));
        ifp = sc->tun_ifp;

        sc->tun_flags &= ~TUN_OPEN;
        sc->tun_pid = 0;

        /* Junk all pending output. */
        ifq_purge_all(&ifp->if_snd);

        if (ifp->if_flags & IFF_UP)
                if_down(ifp);
        ifp->if_flags &= ~IFF_RUNNING;

        if ((sc->tun_flags & TUN_MANUALMAKE) == 0) {
                if_purgeaddrs_nolink(ifp);

                EVENTHANDLER_INVOKE(ifnet_detach_event, ifp);

                /* Announce the departure of the interface. */
                rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
        }

        funsetown(&sc->tun_sigio);
        KNOTE(&sc->tun_rkq.ki_note, 0);

        tunrefcnt--;
        if (tunrefcnt < 0) {
                tunrefcnt = 0;
                if_printf(ifp, ". Module refcnt = %d is out of sync! "
                          "Force refcnt to be 0.\n", tunrefcnt);
        }

        TUNDEBUG(ifp, "closed, minor = %#x. Module refcnt = %d\n",
                 unit, tunrefcnt);

        /* Only auto-destroy if the interface was not manually created. */
        if ((sc->tun_flags & TUN_MANUALMAKE) == 0) {
                ksnprintf(ifname, IFNAMSIZ, "%s%d", TUN, unit);
                if_clone_destroy(ifname);
        }

        return (0);
}


/*
 * Interface clone support
 *
 * Create and destroy tun device/interface via ifconfig(8).
 */

static struct tun_softc *
tunfind(int unit)
{
        struct tun_softc *sc;

        SLIST_FOREACH(sc, &tun_listhead, tun_link) {
                if (minor(sc->tun_dev) == unit)
                        return (sc);
        }
        return (NULL);
}

static int
tun_clone_create(struct if_clone *ifc __unused, int unit,
                 caddr_t params __unused, caddr_t data)
{
        struct tun_softc *sc;
        cdev_t dev = (cdev_t)data;
        int flags;

        if (tunfind(unit) != NULL)
                return (EEXIST);

        if (dev == NULL) {
                if (!devfs_clone_bitmap_chk(&DEVFS_CLONE_BITMAP(tun), unit)) {
                        devfs_clone_bitmap_set(&DEVFS_CLONE_BITMAP(tun), unit);
                        dev = make_dev(&tun_ops, unit, UID_UUCP, GID_DIALER,
                                       0600, "%s%d", TUN, unit);
                } else {
                        dev = devfs_find_device_by_name("%s%d", TUN, unit);
                        if (dev == NULL)
                                return (ENOENT);
                }
                flags = TUN_MANUALMAKE;
        } else {
                flags = 0;
        }

        if ((sc = tuncreate(dev, flags)) == NULL)
                return (ENOMEM);

        sc->tun_flags |= TUN_CLONE;

        TUNDEBUG(sc->tun_ifp, "clone created, minor = %#x, flags = 0x%x\n",
                 minor(sc->tun_dev), sc->tun_flags);

        return (0);
}

static int
tun_clone_destroy(struct ifnet *ifp)
{
        struct tun_softc *sc = ifp->if_softc;

        if (sc->tun_flags & TUN_OPEN)
                return (EBUSY);
        if ((sc->tun_flags & TUN_CLONE) == 0)
                return (EINVAL);

        TUNDEBUG(ifp, "clone destroyed, minor = %#x, flags = 0x%x\n",
                 minor(sc->tun_dev), sc->tun_flags);
        tundestroy(sc);

        return (0);
}


/*
 * Network interface functions
 */

static int
tunifinit(struct ifnet *ifp)
{
#ifdef INET
        struct tun_softc *sc = ifp->if_softc;
#endif
        struct ifaddr_container *ifac;
        int error = 0;

        TUNDEBUG(ifp, "initialize\n");

        ifp->if_flags |= IFF_UP | IFF_RUNNING;
        getmicrotime(&ifp->if_lastchange);

        TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) {
                struct ifaddr *ifa = ifac->ifa;

                if (ifa->ifa_addr == NULL) {
                        error = EFAULT;
                        /* XXX: Should maybe return straight off? */
                } else {
#ifdef INET
                        if (ifa->ifa_addr->sa_family == AF_INET) {
                                struct sockaddr_in *si;

                                si = (struct sockaddr_in *)ifa->ifa_addr;
                                if (si->sin_addr.s_addr)
                                        sc->tun_flags |= TUN_IASET;
                        }
#endif
                }
        }
        return (error);
}

/*
 * Process an ioctl request.
 *
 * MPSAFE
 */
static int
tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
{
        struct ifreq *ifr = (struct ifreq *)data;
        struct tun_softc *sc = ifp->if_softc;
        struct ifstat *ifs;
        int error = 0;

        switch (cmd) {
        case SIOCGIFSTATUS:
                ifs = (struct ifstat *)data;
                if (sc->tun_pid)
                        ksprintf(ifs->ascii + strlen(ifs->ascii),
                            "\tOpened by PID %d\n", sc->tun_pid);
                break;
        case SIOCSIFADDR:
                error = tunifinit(ifp);
                TUNDEBUG(ifp, "address set, error=%d\n", error);
                break;
        case SIOCSIFDSTADDR:
                error = tunifinit(ifp);
                TUNDEBUG(ifp, "destination address set, error=%d\n", error);
                break;
        case SIOCSIFMTU:
                ifp->if_mtu = ifr->ifr_mtu;
                TUNDEBUG(ifp, "mtu set\n");
                break;
        case SIOCSIFFLAGS:
        case SIOCADDMULTI:
        case SIOCDELMULTI:
                break;
        default:
                error = EINVAL;
        }
        return (error);
}

/*
 * Start packet transmission on the interface.
 * when the interface queue is rate-limited by ALTQ,
 * if_start is needed to drain packets from the queue in order
 * to notify readers when outgoing packets become ready.
 */
static void
tunifstart(struct ifnet *ifp, struct ifaltq_subque *ifsq)
{
        struct tun_softc *sc = ifp->if_softc;
        struct mbuf *m;

        ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);

        if (!ifq_is_enabled(&ifp->if_snd))
                return;

        m = ifsq_poll(ifsq);
        if (m != NULL) {
                if (sc->tun_flags & TUN_RWAIT) {
                        sc->tun_flags &= ~TUN_RWAIT;
                        wakeup((caddr_t)sc);
                }
                if (sc->tun_flags & TUN_ASYNC && sc->tun_sigio)
                        pgsigio(sc->tun_sigio, SIGIO, 0);
                ifsq_deserialize_hw(ifsq);
                KNOTE(&sc->tun_rkq.ki_note, 0);
                ifsq_serialize_hw(ifsq);
        }
}

/*
 * tunifoutput - queue packets from higher level ready to put out.
 *
 * MPSAFE
 */
static int
tunifoutput_serialized(struct ifnet *ifp, struct mbuf *m0,
                       struct sockaddr *dst, struct rtentry *rt)
{
        struct tun_softc *sc = ifp->if_softc;
        int error;
        struct altq_pktattr pktattr;

        TUNDEBUG(ifp, "output\n");

        if ((sc->tun_flags & TUN_READY) != TUN_READY) {
                TUNDEBUG(ifp, "not ready, flags = 0x%x\n", sc->tun_flags);
                m_freem(m0);
                return (EHOSTDOWN);
        }

        /*
         * if the queueing discipline needs packet classification,
         * do it before prepending link headers.
         */
        ifq_classify(&ifp->if_snd, m0, dst->sa_family, &pktattr);

        /* BPF write needs to be handled specially */
        if (dst->sa_family == AF_UNSPEC) {
                dst->sa_family = *(mtod(m0, int *));
                m0->m_len -= sizeof(int);
                m0->m_pkthdr.len -= sizeof(int);
                m0->m_data += sizeof(int);
        }

        if (ifp->if_bpf) {
                bpf_gettoken();
                if (ifp->if_bpf) {
                        /*
                         * We need to prepend the address family as
                         * a four byte field.
                         */
                        uint32_t af = dst->sa_family;

                        bpf_ptap(ifp->if_bpf, m0, &af, sizeof(af));
                }
                bpf_reltoken();
        }

        /* prepend sockaddr? this may abort if the mbuf allocation fails */
        if (sc->tun_flags & TUN_LMODE) {
                /* allocate space for sockaddr */
                M_PREPEND(m0, dst->sa_len, M_NOWAIT);

                /* if allocation failed drop packet */
                if (m0 == NULL){
                        IFNET_STAT_INC(ifp, oerrors, 1);
                        return (ENOBUFS);
                } else {
                        bcopy(dst, m0->m_data, dst->sa_len);
                }
        }

        if (sc->tun_flags & TUN_IFHEAD) {
                /* Prepend the address family */
                M_PREPEND(m0, 4, M_NOWAIT);

                /* if allocation failed drop packet */
                if (m0 == NULL){
                        IFNET_STAT_INC(ifp, oerrors, 1);
                        return (ENOBUFS);
                } else {
                        *(u_int32_t *)m0->m_data = htonl(dst->sa_family);
                }
        } else {
#ifdef INET
                if (dst->sa_family != AF_INET)
#endif
                {
                        m_freem(m0);
                        return (EAFNOSUPPORT);
                }
        }

        error = ifq_handoff(ifp, m0, &pktattr);
        if (error) {
                IFNET_STAT_INC(ifp, collisions, 1);
        } else {
                IFNET_STAT_INC(ifp, opackets, 1);
                if (sc->tun_flags & TUN_RWAIT) {
                        sc->tun_flags &= ~TUN_RWAIT;
                        wakeup((caddr_t)sc);
                }
                get_mplock();
                if (sc->tun_flags & TUN_ASYNC && sc->tun_sigio)
                        pgsigio(sc->tun_sigio, SIGIO, 0);
                rel_mplock();
                ifnet_deserialize_all(ifp);
                KNOTE(&sc->tun_rkq.ki_note, 0);
                ifnet_serialize_all(ifp);
        }
        return (error);
}

static int
tunifoutput(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
            struct rtentry *rt)
{
        int error;

        ifnet_serialize_all(ifp);
        error = tunifoutput_serialized(ifp, m0, dst, rt);
        ifnet_deserialize_all(ifp);

        return (error);
}


/*
 * the ops interface is now pretty minimal.
 */
static int
tunioctl(struct dev_ioctl_args *ap)
{
        cdev_t dev = ap->a_head.a_dev;
        caddr_t data = ap->a_data;
        struct tun_softc *sc = dev->si_drv1;
        struct ifnet *ifp = sc->tun_ifp;
        struct ifreq *ifr;
        struct tuninfo *tunp;
        int error = 0;

        switch (ap->a_cmd) {
        case TUNSIFINFO:
                tunp = (struct tuninfo *)data;
                if (ifp->if_type != tunp->type)
                        return (EPROTOTYPE);
                if (tunp->mtu < IF_MINMTU)
                        return (EINVAL);
                ifp->if_mtu = tunp->mtu;
                ifp->if_baudrate = tunp->baudrate;
                break;

        case TUNGIFINFO:
                tunp = (struct tuninfo *)data;
                tunp->mtu = ifp->if_mtu;
                tunp->type = ifp->if_type;
                tunp->baudrate = ifp->if_baudrate;
                break;

        case TUNGIFNAME:
                ifr = (struct ifreq *)data;
                strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
                break;

        case TUNSDEBUG:
                tundebug = *(int *)data;
                break;

        case TUNGDEBUG:
                *(int *)data = tundebug;
                break;

        case TUNSLMODE:
                if (*(int *)data) {
                        sc->tun_flags |= TUN_LMODE;
                        sc->tun_flags &= ~TUN_IFHEAD;
                } else {
                        sc->tun_flags &= ~TUN_LMODE;
                }
                break;

        case TUNSIFHEAD:
                if (*(int *)data) {
                        sc->tun_flags |= TUN_IFHEAD;
                        sc->tun_flags &= ~TUN_LMODE;
                } else {
                        sc->tun_flags &= ~TUN_IFHEAD;
                }
                break;

        case TUNGIFHEAD:
                *(int *)data = (sc->tun_flags & TUN_IFHEAD) ? 1 : 0;
                break;

        case TUNSIFMODE:
                /* deny this if UP */
                if (ifp->if_flags & IFF_UP)
                        return (EBUSY);

                switch (*(int *)data & ~IFF_MULTICAST) {
                case IFF_POINTOPOINT:
                case IFF_BROADCAST:
                        ifp->if_flags &= ~(IFF_BROADCAST | IFF_POINTOPOINT);
                        ifp->if_flags |= *(int *)data;
                        break;
                default:
                        return (EINVAL);
                }
                break;

        case TUNSIFPID:
                sc->tun_pid = curproc->p_pid;
                break;

        case FIOASYNC:
                if (*(int *)data)
                        sc->tun_flags |= TUN_ASYNC;
                else
                        sc->tun_flags &= ~TUN_ASYNC;
                break;

        case FIONREAD:
                *(int *)data = ifsq_poll_pktlen(
                    ifq_get_subq_default(&ifp->if_snd));
                break;

        case FIOSETOWN:
                error = fsetown(*(int *)data, &sc->tun_sigio);
                break;

        case FIOGETOWN:
                *(int *)data = fgetown(&sc->tun_sigio);
                break;

        /* This is deprecated, FIOSETOWN should be used instead. */
        case TIOCSPGRP:
                error = fsetown(-(*(int *)data), &sc->tun_sigio);
                break;

        /* This is deprecated, FIOGETOWN should be used instead. */
        case TIOCGPGRP:
                *(int *)data = -fgetown(&sc->tun_sigio);
                break;

        default:
                error = ENOTTY;
                break;
        }

        return (error);
}

/*
 * The ops read interface - reads a packet at a time, or at
 * least as much of a packet as can be read.
 */
static  int
tunread(struct dev_read_args *ap)
{
        cdev_t dev = ap->a_head.a_dev;
        struct uio *uio = ap->a_uio;
        struct tun_softc *sc = dev->si_drv1;
        struct ifnet *ifp = sc->tun_ifp;
        struct ifaltq_subque *ifsq = ifq_get_subq_default(&ifp->if_snd);
        struct mbuf *m0;
        int error=0, len;

        TUNDEBUG(ifp, "read\n");
        if ((sc->tun_flags & TUN_READY) != TUN_READY) {
                TUNDEBUG(ifp, "not ready, flags = 0x%x\n", sc->tun_flags);
                return (EHOSTDOWN);
        }

        sc->tun_flags &= ~TUN_RWAIT;

        ifnet_serialize_all(ifp);

        while ((m0 = ifsq_dequeue(ifsq)) == NULL) {
                if (ap->a_ioflag & IO_NDELAY) {
                        ifnet_deserialize_all(ifp);
                        return (EWOULDBLOCK);
                }
                sc->tun_flags |= TUN_RWAIT;
                ifnet_deserialize_all(ifp);
                if ((error = tsleep(sc, PCATCH, "tunread", 0)) != 0)
                        return (error);
                ifnet_serialize_all(ifp);
        }

        ifnet_deserialize_all(ifp);

        while (m0 && uio->uio_resid > 0 && error == 0) {
                len = (int)szmin(uio->uio_resid, m0->m_len);
                if (len != 0)
                        error = uiomove(mtod(m0, caddr_t), (size_t)len, uio);
                m0 = m_free(m0);
        }

        if (m0) {
                TUNDEBUG(ifp, "dropping mbuf\n");
                m_freem(m0);
        }
        return (error);
}

/*
 * the ops write interface - an atomic write is a packet - or else!
 */
static  int
tunwrite(struct dev_write_args *ap)
{
        cdev_t dev = ap->a_head.a_dev;
        struct uio *uio = ap->a_uio;
        struct tun_softc *sc = dev->si_drv1;
        struct ifnet *ifp = sc->tun_ifp;
        struct mbuf *top, **mp, *m;
        size_t tlen;
        uint32_t family, mru;
        int error = 0;
        int isr;

        TUNDEBUG(ifp, "tunwrite\n");

        if (uio->uio_resid == 0)
                return (0);

        mru = TUNMRU;
        if (sc->tun_flags & TUN_IFHEAD)
                mru += sizeof(family);
        if (uio->uio_resid > mru) {
                TUNDEBUG(ifp, "len = %zd!\n", uio->uio_resid);
                return (EIO);
        }

        /* get a header mbuf */
        MGETHDR(m, M_WAITOK, MT_DATA);

        tlen = uio->uio_resid;
        top = NULL;
        mp = &top;
        while (error == 0 && uio->uio_resid > 0) {
                m->m_len = (int)szmin(MHLEN, uio->uio_resid);
                error = uiomove(mtod(m, caddr_t), (size_t)m->m_len, uio);
                *mp = m;
                mp = &m->m_next;
                if (uio->uio_resid > 0)
                        MGET(m, M_WAITOK, MT_DATA);
        }
        if (error) {
                if (top)
                        m_freem(top);
                IFNET_STAT_INC(ifp, ierrors, 1);
                return (error);
        }

        top->m_pkthdr.len = (int)tlen;
        top->m_pkthdr.rcvif = ifp;

        if (ifp->if_bpf) {
                bpf_gettoken();

                if (ifp->if_bpf) {
                        if (sc->tun_flags & TUN_IFHEAD) {
                                /*
                                 * Conveniently, we already have a 4-byte
                                 * address family prepended to our packet !
                                 * Inconveniently, it's in the wrong byte
                                 * order !
                                 */
                                if ((top = m_pullup(top, sizeof(family)))
                                    == NULL) {
                                        bpf_reltoken();
                                        return (ENOBUFS);
                                }
                                *mtod(top, u_int32_t *) =
                                    ntohl(*mtod(top, u_int32_t *));
                                bpf_mtap(ifp->if_bpf, top);
                                *mtod(top, u_int32_t *) =
                                    htonl(*mtod(top, u_int32_t *));
                        } else {
                                /*
                                 * We need to prepend the address family as
                                 * a four byte field.
                                 */
                                static const uint32_t af = AF_INET;

                                bpf_ptap(ifp->if_bpf, top, &af, sizeof(af));
                        }
                }

                bpf_reltoken();
        }

        if (sc->tun_flags & TUN_IFHEAD) {
                if (top->m_len < sizeof(family) &&
                    (top = m_pullup(top, sizeof(family))) == NULL)
                        return (ENOBUFS);
                family = ntohl(*mtod(top, u_int32_t *));
                m_adj(top, sizeof(family));
        } else {
                family = AF_INET;
        }

        IFNET_STAT_INC(ifp, ibytes, top->m_pkthdr.len);
        IFNET_STAT_INC(ifp, ipackets, 1);

        switch (family) {
#ifdef INET
        case AF_INET:
                isr = NETISR_IP;
                break;
#endif
#ifdef INET6
        case AF_INET6:
                isr = NETISR_IPV6;
                break;
#endif
        default:
                m_freem(top);
                return (EAFNOSUPPORT);
        }

        netisr_queue(isr, top);
        return (0);
}


/*
 * tunkqfilter - support for the kevent() system call.
 */
static int
tunkqfilter(struct dev_kqfilter_args *ap)
{
        cdev_t dev = ap->a_head.a_dev;
        struct tun_softc *sc = dev->si_drv1;
        struct ifnet *ifp = sc->tun_ifp;
        struct knote *kn = ap->a_kn;
        struct klist *klist;

        ap->a_result = 0;
        ifnet_serialize_all(ifp);

        switch (kn->kn_filter) {
        case EVFILT_READ:
                kn->kn_fop = &tun_read_filtops;
                kn->kn_hook = (caddr_t)sc;
                break;
        case EVFILT_WRITE:
                kn->kn_fop = &tun_write_filtops;
                kn->kn_hook = (caddr_t)sc;
                break;
        default:
                ifnet_deserialize_all(ifp);
                ap->a_result = EOPNOTSUPP;
                return (0);
        }

        klist = &sc->tun_rkq.ki_note;
        knote_insert(klist, kn);
        ifnet_deserialize_all(ifp);

        return (0);
}

static void
tun_filter_detach(struct knote *kn)
{
        struct tun_softc *sc = (struct tun_softc *)kn->kn_hook;
        struct klist *klist = &sc->tun_rkq.ki_note;

        knote_remove(klist, kn);
}

static int
tun_filter_write(struct knote *kn, long hint)
{
        /* Always ready for a write */
        return (1);
}

static int
tun_filter_read(struct knote *kn, long hint)
{
        struct tun_softc *sc = (struct tun_softc *)kn->kn_hook;
        struct ifnet *ifp = sc->tun_ifp;
        int ready = 0;

        ifnet_serialize_all(ifp);
        if (!ifsq_is_empty(ifq_get_subq_default(&ifp->if_snd))) {
                if ((kn->kn_sfflags & NOTE_HUPONLY) == 0)
                        ready = 1;
        }
        ifnet_deserialize_all(ifp);

        return (ready);
}