The entire sysctl callback to read/write version. I havn't tested this as

much as I'd like to, but the malloc stunt I tried for an interim for
sure does worse.
Now we can read and write from any kind of address-space, not only
user and kernel, using callbacks.
This may be over-generalization for now, but it's actually simpler.

sys/amd64/amd64/machdep.c

@@ -35,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)machdep.c	7.4 (Berkeley) 6/3/91
- *	$Id: machdep.c,v 1.148 1995/11/04 16:00:22 markm Exp $
+ *	$Id: machdep.c,v 1.149 1995/11/10 09:53:50 phk Exp $
  */
 
 #include "npx.h"
@@ -207,7 +207,7 @@ cpu_startup(dummy)
 	register caddr_t v;
 	vm_offset_t maxaddr;
 	vm_size_t size = 0;
-	int firstaddr, indx;
+	int firstaddr;
 	vm_offset_t minaddr;
 
 	if (boothowto & RB_VERBOSE)
@@ -1037,8 +1037,8 @@ sysctl_machdep_adjkerntz SYSCTL_HANDLER_ARGS
 {
 	int error;
 	error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2,
-		oldp, oldlenp, newp, newlen);
+		req);
-	if (!error && newp)
+	if (!error && req->newptr)
 		resettodr();
 	return (error);
 }
@@ -1051,8 +1051,7 @@ sysctl_machdep_consdev SYSCTL_HANDLER_ARGS
 {
 	dev_t consdev;
 	consdev = (cn_tty == NULL ? NODEV : cn_tty->t_dev);
-	return (sysctl_handle_opaque(oidp, &consdev, sizeof consdev,
+	return (sysctl_handle_opaque(oidp, &consdev, sizeof consdev, req));
-		oldp, oldlenp, newp, newlen));
 }
 
 SYSCTL_PROC(_machdep, CPU_CONSDEV, consdev,

sys/i386/i386/machdep.c

@@ -35,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)machdep.c	7.4 (Berkeley) 6/3/91
- *	$Id: machdep.c,v 1.148 1995/11/04 16:00:22 markm Exp $
+ *	$Id: machdep.c,v 1.149 1995/11/10 09:53:50 phk Exp $
  */
 
 #include "npx.h"
@@ -207,7 +207,7 @@ cpu_startup(dummy)
 	register caddr_t v;
 	vm_offset_t maxaddr;
 	vm_size_t size = 0;
-	int firstaddr, indx;
+	int firstaddr;
 	vm_offset_t minaddr;
 
 	if (boothowto & RB_VERBOSE)
@@ -1037,8 +1037,8 @@ sysctl_machdep_adjkerntz SYSCTL_HANDLER_ARGS
 {
 	int error;
 	error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2,
-		oldp, oldlenp, newp, newlen);
+		req);
-	if (!error && newp)
+	if (!error && req->newptr)
 		resettodr();
 	return (error);
 }
@@ -1051,8 +1051,7 @@ sysctl_machdep_consdev SYSCTL_HANDLER_ARGS
 {
 	dev_t consdev;
 	consdev = (cn_tty == NULL ? NODEV : cn_tty->t_dev);
-	return (sysctl_handle_opaque(oidp, &consdev, sizeof consdev,
+	return (sysctl_handle_opaque(oidp, &consdev, sizeof consdev, req));
-		oldp, oldlenp, newp, newlen));
 }
 
 SYSCTL_PROC(_machdep, CPU_CONSDEV, consdev,

sys/kern/kern_clock.c

@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kern_clock.c	8.5 (Berkeley) 1/21/94
- * $Id: kern_clock.c,v 1.17 1995/10/12 20:35:01 wollman Exp $
+ * $Id: kern_clock.c,v 1.18 1995/11/08 08:45:58 phk Exp $
  */
 
 /* Portions of this software are covered by the following: */
@@ -986,8 +986,7 @@ sysctl_kern_clockrate SYSCTL_HANDLER_ARGS
 	clkinfo.tick = tick;
 	clkinfo.profhz = profhz;
 	clkinfo.stathz = stathz ? stathz : hz;
-	return (sysctl_handle_opaque(
+	return (sysctl_handle_opaque(oidp, &clkinfo, sizeof clkinfo, req));
-		oidp, &clkinfo, sizeof clkinfo, oldp, oldlenp, newp, newlen));
 }
 
 SYSCTL_OID(_kern, KERN_CLOCKRATE, clockrate,

sys/kern/kern_sysctl.c

@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kern_sysctl.c	8.4 (Berkeley) 4/14/94
- * $Id: kern_sysctl.c,v 1.36 1995/11/11 00:09:21 bde Exp $
+ * $Id: kern_sysctl.c,v 1.37 1995/11/12 06:43:01 bde Exp $
  */
 
 /*
@@ -143,8 +143,7 @@ static int
 sysctl_kern_updateinterval SYSCTL_HANDLER_ARGS
 {
 	int error = sysctl_handle_int(oidp,
-		oidp->oid_arg1, oidp->oid_arg2,
+		oidp->oid_arg1, oidp->oid_arg2, req);
-		oldp, oldlenp, newp, newlen);
 	if (!error)
 		wakeup(&vfs_update_wakeup);
 	return error;
@@ -160,10 +159,9 @@ static int
 sysctl_kern_hostname SYSCTL_HANDLER_ARGS
 {
 	int error = sysctl_handle_string(oidp,
-		oidp->oid_arg1, oidp->oid_arg2,
+		oidp->oid_arg1, oidp->oid_arg2, req);
-		oldp, oldlenp, newp, newlen);
+	if (req->newptr && (error == 0 || error == ENOMEM))
-	if (newp && (error == 0 || error == ENOMEM))
+		hostnamelen = req->newlen;
-		hostnamelen = newlen;
 	return error;
 }
 
@@ -208,12 +206,12 @@ sysctl_order(void *arg)
 		sysctl_order_cmp);
 }
 
-SYSINIT(sysctl,SI_SUB_KMEM,SI_ORDER_ANY,sysctl_order,&sysctl_);
+SYSINIT(sysctl, SI_SUB_KMEM, SI_ORDER_ANY, sysctl_order, &sysctl_);
 
 static void
-sysctl_sysctl_debug_dump_node(struct linker_set *l,int i)
+sysctl_sysctl_debug_dump_node(struct linker_set *l, int i)
 {
-	int j,k;
+	int j, k;
 	struct sysctl_oid **oidpp;
 
 	j = l->ls_length;
@@ -247,7 +245,7 @@ sysctl_sysctl_debug_dump_node(struct linker_set *l,int i)
 				} else {
 					printf(" Node\n");
 					sysctl_sysctl_debug_dump_node(
-						(*oidpp)->oid_arg1,i+2);
+						(*oidpp)->oid_arg1, i+2);
 				}
 				break;
 			case CTLTYPE_INT:    printf(" Int\n"); break;
@@ -264,7 +262,7 @@ sysctl_sysctl_debug_dump_node(struct linker_set *l,int i)
 static int
 sysctl_sysctl_debug SYSCTL_HANDLER_ARGS
 {
-	sysctl_sysctl_debug_dump_node(&sysctl_,0);
+	sysctl_sysctl_debug_dump_node(&sysctl_, 0);
 	return ENOENT;
 }
 
@@ -277,10 +275,9 @@ static int
 sysctl_kern_domainname SYSCTL_HANDLER_ARGS
 {
 	int error = sysctl_handle_string(oidp,
-		oidp->oid_arg1, oidp->oid_arg2,
+		oidp->oid_arg1, oidp->oid_arg2, req);
-		oldp, oldlenp, newp, newlen);
+	if (req->newptr && (error == 0 || error == ENOMEM))
-	if (newp && (error == 0 || error == ENOMEM))
+		domainnamelen = req->newlen;
-		domainnamelen = newlen;
 	return error;
 }
 
@@ -291,77 +288,135 @@ long hostid;
 /* Some trouble here, if sizeof (int) != sizeof (long) */
 SYSCTL_INT(_kern, KERN_HOSTID, hostid, CTLFLAG_RW, &hostid, 0, "");
 
+/*
+ * Handle an integer, signed or unsigned.
+ * Two cases:
+ *     a variable:  point arg1 at it.
+ *     a constant:  pass it in arg2.
+ */
+
 int
 sysctl_handle_int SYSCTL_HANDLER_ARGS
 {
-	/* If there isn't sufficient space to return */
+	int error = 0;
-	if (oldp && *oldlenp < sizeof(int))
-		return (ENOMEM);
 
-	/* If it is a constant, don't write */
+	if (arg1)
-	if (newp && !arg1)
+		error = SYSCTL_OUT(req, arg1, sizeof(int));
-		return (EPERM);
+	else if (arg2)
+		error = SYSCTL_OUT(req, &arg2, sizeof(int));
 
-	/* If we get more than an int */
+	if (error || !req->newptr)
-	if (newp && newlen != sizeof(int))
+		return (error);
-		return (EINVAL);
 
-	*oldlenp = sizeof(int);
+	if (!arg1)
-	if (oldp && arg1 )
+		error = EPERM;
-		bcopy(arg1, oldp, sizeof(int));
+	else
-	else if (oldp)
+		error = SYSCTL_IN(req, arg1, sizeof(int));
-		bcopy(&arg2, oldp, sizeof(int));
+	return (error);
-	if (newp)
-		bcopy(newp, arg1, sizeof(int));
-	return (0);
 }
 
+/*
+ * Handle our generic '\0' terminated 'C' string.
+ * Two cases:
+ * 	a variable string:  point arg1 at it, arg2 is max length.
+ * 	a constant string:  point arg1 at it, arg2 is zero.
+ */
+
 int
 sysctl_handle_string SYSCTL_HANDLER_ARGS
 {
-	int len, error=0;
+	int error=0;
-	char *str = (char *)arg1;
 
-	len = strlen(str) + 1;
+	if (arg2)
+		error = SYSCTL_OUT(req, arg1, arg2);
+	else
+		error = SYSCTL_OUT(req, arg1, strlen((char *)arg1)+1);
 
-	if (oldp && *oldlenp < len) {
+	if (error || !req->newptr)
-		len = *oldlenp;
+		return (error);
-		error=ENOMEM;
+
+	if ((req->newlen - req->newidx) > arg2) {
+		error = E2BIG;
+	} else {
+		arg2 = (req->newlen - req->newidx);
+		error = SYSCTL_IN(req, arg1, arg2);
+		((char *)arg1)[arg2] = '\0';
 	}
 
-	if (newp && newlen >= arg2)
-		return (EINVAL);
-
-	if (oldp) {
-		*oldlenp = len;
-		bcopy(str, oldp, len);
-	}
-
-	if (newp) {
-		bcopy(newp, str, newlen);
-		str[newlen] = 0;
-	}
 	return (error);
 }
 
+/*
+ * Handle any kind of opaque data.
+ * arg1 points to it, arg2 is the size.
+ */
+
 int
 sysctl_handle_opaque SYSCTL_HANDLER_ARGS
 {
-	if (oldp && *oldlenp < arg2) 
+	int error;
-		return (ENOMEM);
 
-	if (newp && newlen != arg2)
+	error = SYSCTL_OUT(req, arg1, arg2);
-		return (EINVAL);
 
-	if (oldp) {
+	if (error || !req->newptr)
-		*oldlenp = arg2;
+		return (error);
-		bcopy(arg1, oldp, arg2);
+
+	error = SYSCTL_IN(req, arg1, arg2);
+
+	return (error);
+}
+
+int
+sysctl_old_kernel(struct sysctl_req *req, void *p, int l)
+{
+	int i = min(req->oldlen - req->oldidx, l);
+	if (i) {
+		bcopy(p, req->oldptr + req->oldidx, i);
+		req->oldidx += i;
 	}
-	if (newp) 
+	if (i != l)
-		bcopy(newp, arg1, arg2);
+		return (ENOMEM);
+	else
+		return (0);
+
+}
+
+int
+sysctl_new_kernel(struct sysctl_req *req, void *p, int l)
+{
+	int i = req->newlen - req->newidx;
+	if (i < l)
+		return (EINVAL);
+	bcopy(req->newptr + req->newidx, p, l);
+	req->newidx += l;
 	return (0);
 }
 
+int
+sysctl_old_user(struct sysctl_req *req, void *p, int l)
+{
+	int error , i = min(req->oldlen - req->oldidx, l);
+
+	error  = copyout(p, req->oldptr + req->oldidx, i);
+	req->oldidx += i;
+	if (error)
+		return (error);
+	if (i < l)
+		return (ENOMEM);
+	return (error);
+}
+
+int
+sysctl_new_user(struct sysctl_req *req, void *p, int l)
+{
+	int error, i = req->newlen - req->newidx;
+	if (i < l)
+		return (EINVAL);
+	error = copyin(req->newptr + req->newidx, p, l);
+	req->newidx += l;
+	return (error);
+}
+
 #ifdef DEBUG
 static sysctlfn debug_sysctl;
 #endif
@@ -421,7 +476,7 @@ sysctl_root SYSCTL_HANDLER_ARGS
 found:
 
 	/* If writing isn't allowed */
-	if (newp && !((*oidpp)->oid_kind & CTLFLAG_WR))
+	if (req->newptr && !((*oidpp)->oid_kind & CTLFLAG_WR))
 		return (EPERM);
 
 	if (!(*oidpp)->oid_handler)
@@ -430,11 +485,11 @@ sysctl_root SYSCTL_HANDLER_ARGS
 	if (((*oidpp)->oid_kind & CTLTYPE) == CTLTYPE_NODE) {
 		i = ((*oidpp)->oid_handler) (*oidpp,
 					name + indx, namelen - indx,
-					oldp, oldlenp, newp, newlen);
+					req);
 	} else {
 		i = ((*oidpp)->oid_handler) (*oidpp,
 					(*oidpp)->oid_arg1, (*oidpp)->oid_arg2,
-					oldp, oldlenp, newp, newlen);
+					req);
 	}
 	return (i);
 }
@@ -479,70 +534,62 @@ static sysctlfn kern_sysctl;
 int
 userland_sysctl(struct proc *p, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen, int *retval)
 {
-	int error = 0, dolock = 1, i;
+	int error = 0, dolock = 1, i, oldlen = 0;
-	u_int savelen = 0, oldlen = 0;
+	u_int savelen = 0;
 	sysctlfn *fn;
-	void *oldp = 0;
+	struct sysctl_req req;
-	void *newp = 0;
+
+	bzero(&req, sizeof req);
 
 	if (new != NULL && (error = suser(p->p_ucred, &p->p_acflag)))
 		return (error);
 
 	if (oldlenp) {
 		if (inkernel) {
-			oldlen = *oldlenp;
+			req.oldlen = *oldlenp;
 		} else {
-			error = copyin(oldlenp, &oldlen, sizeof(oldlen));
+			error = copyin(oldlenp, &req.oldlen,
+				sizeof(req.oldlen));
 			if (error)
 				return (error);
 		}
+		oldlen = req.oldlen;
 	}
 
-	if (old) 
+	if (old) {
-		oldp = malloc(oldlen, M_TEMP, M_WAITOK);
+		if (!useracc(old, req.oldlen, B_WRITE))
+			return (EFAULT);
+		req.oldptr= old;
+	}
 
 	if (newlen) {
-		newp = malloc(newlen, M_TEMP, M_WAITOK);
+		if (!useracc(new, req.newlen, B_READ))
-		error = copyin(new, newp, newlen);
+			return (EFAULT);
-	}
+		req.newlen = newlen;
-	if (error) {
+		req.newptr = new;
-		if (oldp)
-			free(oldp, M_TEMP);
-		if (newp)
-			free(newp, M_TEMP);
-		return error;
 	}
 
-	error = sysctl_root(0, name, namelen, oldp, &oldlen, newp, newlen);
+	req.oldfunc = sysctl_old_user;
+	req.newfunc = sysctl_new_user;
+
+	error = sysctl_root(0, name, namelen, &req);
 
         if (!error || error == ENOMEM) {
 		if (retval)
-			*retval = oldlen;
+			*retval = req.oldlen;
 		if (oldlenp) {
 			if (inkernel) {
-				*oldlenp = oldlen;
+				*oldlenp = req.oldlen;
 			} else {
-				i = copyout(&oldlen, oldlenp, sizeof(oldlen));
+				i = copyout(&req.oldlen, oldlenp,
+					sizeof(req.oldlen));
 				if (i)
 					error = i;
 			}
 		}
-		if ((error == ENOMEM || !error ) && oldp) {
-			i = copyout(oldp, old, oldlen);
-			if (i)
-				error = i;
-			free(oldp, M_TEMP);
-		}
-		if (newp)
-			free(newp, M_TEMP);
 		return (error);
 	}
 
-	if (oldp)
-		free(oldp, M_TEMP);
-	if (newp)
-		free(newp, M_TEMP);
-
 	switch (name[0]) {
 	case CTL_KERN:
 		fn = kern_sysctl;

sys/kern/kern_tc.c

@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kern_clock.c	8.5 (Berkeley) 1/21/94
- * $Id: kern_clock.c,v 1.17 1995/10/12 20:35:01 wollman Exp $
+ * $Id: kern_clock.c,v 1.18 1995/11/08 08:45:58 phk Exp $
  */
 
 /* Portions of this software are covered by the following: */
@@ -986,8 +986,7 @@ sysctl_kern_clockrate SYSCTL_HANDLER_ARGS
 	clkinfo.tick = tick;
 	clkinfo.profhz = profhz;
 	clkinfo.stathz = stathz ? stathz : hz;
-	return (sysctl_handle_opaque(
+	return (sysctl_handle_opaque(oidp, &clkinfo, sizeof clkinfo, req));
-		oidp, &clkinfo, sizeof clkinfo, oldp, oldlenp, newp, newlen));
 }
 
 SYSCTL_OID(_kern, KERN_CLOCKRATE, clockrate,

sys/kern/kern_timeout.c

@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kern_clock.c	8.5 (Berkeley) 1/21/94
- * $Id: kern_clock.c,v 1.17 1995/10/12 20:35:01 wollman Exp $
+ * $Id: kern_clock.c,v 1.18 1995/11/08 08:45:58 phk Exp $
  */
 
 /* Portions of this software are covered by the following: */
@@ -986,8 +986,7 @@ sysctl_kern_clockrate SYSCTL_HANDLER_ARGS
 	clkinfo.tick = tick;
 	clkinfo.profhz = profhz;
 	clkinfo.stathz = stathz ? stathz : hz;
-	return (sysctl_handle_opaque(
+	return (sysctl_handle_opaque(oidp, &clkinfo, sizeof clkinfo, req));
-		oidp, &clkinfo, sizeof clkinfo, oldp, oldlenp, newp, newlen));
 }
 
 SYSCTL_OID(_kern, KERN_CLOCKRATE, clockrate,

sys/sys/sysctl.h

@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)sysctl.h	8.1 (Berkeley) 6/2/93
- * $Id: sysctl.h,v 1.30 1995/11/09 20:20:03 phk Exp $
+ * $Id: sysctl.h,v 1.31 1995/11/10 10:14:55 phk Exp $
  */
 
 #ifndef _SYS_SYSCTL_H_
@@ -78,8 +78,28 @@ struct ctlname {
 
 #ifdef KERNEL
 #define SYSCTL_HANDLER_ARGS (struct sysctl_oid *oidp, void *arg1, int arg2, \
-	void *oldp, size_t *oldlenp, void *newp, size_t newlen )
+	struct sysctl_req *req)
 
+/*
+ * This describes the access space for a sysctl request.  This is needed
+ * so that we can use the interface from the kernel or from user-space.
+ */
+struct sysctl_req {
+	struct proc	*p;
+	void		*oldptr;
+	int		oldlen;
+	int		oldidx;
+	int		(*oldfunc)(struct sysctl_req *, void *, int);
+	void		*newptr;
+	int		newlen;
+	int		newidx;
+	int		(*newfunc)(struct sysctl_req *, void *, int);
+};
+
+/*
+ * This describes one "oid" in the MIB tree.  Potentially more nodes can
+ * be hidden behind it, expanded by the handler.
+ */
 struct sysctl_oid {
 	int		oid_number;
 	int		oid_kind;
@@ -89,6 +109,9 @@ struct sysctl_oid {
 	int 		(*oid_handler) SYSCTL_HANDLER_ARGS;
 };
 
+#define SYSCTL_IN(r, p, l) (r->newfunc)(r, p, l)
+#define SYSCTL_OUT(r, p, l) (r->oldfunc)(r, p, l)
+
 int sysctl_handle_int SYSCTL_HANDLER_ARGS;
 int sysctl_handle_string SYSCTL_HANDLER_ARGS;
 int sysctl_handle_opaque SYSCTL_HANDLER_ARGS;