xref: /freebsd/sys/net/bpf.c (revision 4b2eaea43fec8e8792be611dea204071a10b655a)
1 /*
2  * Copyright (c) 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *      @(#)bpf.c	8.4 (Berkeley) 1/9/95
39  *
40  * $FreeBSD$
41  */
42 
43 #include "opt_bpf.h"
44 #include "opt_mac.h"
45 #include "opt_netgraph.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/conf.h>
50 #include <sys/mac.h>
51 #include <sys/malloc.h>
52 #include <sys/mbuf.h>
53 #include <sys/time.h>
54 #include <sys/proc.h>
55 #include <sys/signalvar.h>
56 #include <sys/filio.h>
57 #include <sys/sockio.h>
58 #include <sys/ttycom.h>
59 #include <sys/filedesc.h>
60 
61 #include <sys/poll.h>
62 
63 #include <sys/socket.h>
64 #include <sys/vnode.h>
65 
66 #include <net/if.h>
67 #include <net/bpf.h>
68 #include <net/bpfdesc.h>
69 
70 #include <netinet/in.h>
71 #include <netinet/if_ether.h>
72 #include <sys/kernel.h>
73 #include <sys/sysctl.h>
74 
75 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
76 
77 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)
78 
79 #define PRINET  26			/* interruptible */
80 
81 /*
82  * The default read buffer size is patchable.
83  */
84 static int bpf_bufsize = 4096;
85 SYSCTL_INT(_debug, OID_AUTO, bpf_bufsize, CTLFLAG_RW,
86 	&bpf_bufsize, 0, "");
87 static int bpf_maxbufsize = BPF_MAXBUFSIZE;
88 SYSCTL_INT(_debug, OID_AUTO, bpf_maxbufsize, CTLFLAG_RW,
89 	&bpf_maxbufsize, 0, "");
90 
91 /*
92  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
93  */
94 static struct bpf_if	*bpf_iflist;
95 static struct mtx	bpf_mtx;		/* bpf global lock */
96 
97 static int	bpf_allocbufs(struct bpf_d *);
98 static void	bpf_attachd(struct bpf_d *d, struct bpf_if *bp);
99 static void	bpf_detachd(struct bpf_d *d);
100 static void	bpf_freed(struct bpf_d *);
101 static void	bpf_mcopy(const void *, void *, size_t);
102 static int	bpf_movein(struct uio *, int,
103 		    struct mbuf **, struct sockaddr *, int *);
104 static int	bpf_setif(struct bpf_d *, struct ifreq *);
105 static void	bpf_timed_out(void *);
106 static __inline void
107 		bpf_wakeup(struct bpf_d *);
108 static void	catchpacket(struct bpf_d *, u_char *, u_int,
109 		    u_int, void (*)(const void *, void *, size_t));
110 static void	reset_d(struct bpf_d *);
111 static int	 bpf_setf(struct bpf_d *, struct bpf_program *);
112 static int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
113 static int	bpf_setdlt(struct bpf_d *, u_int);
114 
115 static	d_open_t	bpfopen;
116 static	d_close_t	bpfclose;
117 static	d_read_t	bpfread;
118 static	d_write_t	bpfwrite;
119 static	d_ioctl_t	bpfioctl;
120 static	d_poll_t	bpfpoll;
121 
122 #define CDEV_MAJOR 23
123 static struct cdevsw bpf_cdevsw = {
124 	/* open */	bpfopen,
125 	/* close */	bpfclose,
126 	/* read */	bpfread,
127 	/* write */	bpfwrite,
128 	/* ioctl */	bpfioctl,
129 	/* poll */	bpfpoll,
130 	/* mmap */	nommap,
131 	/* strategy */	nostrategy,
132 	/* name */	"bpf",
133 	/* maj */	CDEV_MAJOR,
134 	/* dump */	nodump,
135 	/* psize */	nopsize,
136 	/* flags */	0,
137 };
138 
139 
140 static int
141 bpf_movein(uio, linktype, mp, sockp, datlen)
142 	register struct uio *uio;
143 	int linktype, *datlen;
144 	register struct mbuf **mp;
145 	register struct sockaddr *sockp;
146 {
147 	struct mbuf *m;
148 	int error;
149 	int len;
150 	int hlen;
151 
152 	/*
153 	 * Build a sockaddr based on the data link layer type.
154 	 * We do this at this level because the ethernet header
155 	 * is copied directly into the data field of the sockaddr.
156 	 * In the case of SLIP, there is no header and the packet
157 	 * is forwarded as is.
158 	 * Also, we are careful to leave room at the front of the mbuf
159 	 * for the link level header.
160 	 */
161 	switch (linktype) {
162 
163 	case DLT_SLIP:
164 		sockp->sa_family = AF_INET;
165 		hlen = 0;
166 		break;
167 
168 	case DLT_EN10MB:
169 		sockp->sa_family = AF_UNSPEC;
170 		/* XXX Would MAXLINKHDR be better? */
171 		hlen = sizeof(struct ether_header);
172 		break;
173 
174 	case DLT_FDDI:
175 		sockp->sa_family = AF_IMPLINK;
176 		hlen = 0;
177 		break;
178 
179 	case DLT_RAW:
180 	case DLT_NULL:
181 		sockp->sa_family = AF_UNSPEC;
182 		hlen = 0;
183 		break;
184 
185 	case DLT_ATM_RFC1483:
186 		/*
187 		 * en atm driver requires 4-byte atm pseudo header.
188 		 * though it isn't standard, vpi:vci needs to be
189 		 * specified anyway.
190 		 */
191 		sockp->sa_family = AF_UNSPEC;
192 		hlen = 12; 	/* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
193 		break;
194 
195 	case DLT_PPP:
196 		sockp->sa_family = AF_UNSPEC;
197 		hlen = 4;	/* This should match PPP_HDRLEN */
198 		break;
199 
200 	default:
201 		return (EIO);
202 	}
203 
204 	len = uio->uio_resid;
205 	*datlen = len - hlen;
206 	if ((unsigned)len > MCLBYTES)
207 		return (EIO);
208 
209 	if (len > MHLEN) {
210 		m = m_getcl(0, MT_DATA, M_PKTHDR);
211 	} else {
212 		MGETHDR(m, 0, MT_DATA);
213 	}
214 	if (m == NULL)
215 		return (ENOBUFS);
216 	m->m_pkthdr.len = m->m_len = len;
217 	m->m_pkthdr.rcvif = NULL;
218 	*mp = m;
219 
220 	/*
221 	 * Make room for link header.
222 	 */
223 	if (hlen != 0) {
224 		m->m_pkthdr.len -= hlen;
225 		m->m_len -= hlen;
226 #if BSD >= 199103
227 		m->m_data += hlen; /* XXX */
228 #else
229 		m->m_off += hlen;
230 #endif
231 		error = uiomove((caddr_t)sockp->sa_data, hlen, uio);
232 		if (error)
233 			goto bad;
234 	}
235 	error = uiomove(mtod(m, caddr_t), len - hlen, uio);
236 	if (!error)
237 		return (0);
238 bad:
239 	m_freem(m);
240 	return (error);
241 }
242 
243 /*
244  * Attach file to the bpf interface, i.e. make d listen on bp.
245  */
246 static void
247 bpf_attachd(d, bp)
248 	struct bpf_d *d;
249 	struct bpf_if *bp;
250 {
251 	/*
252 	 * Point d at bp, and add d to the interface's list of listeners.
253 	 * Finally, point the driver's bpf cookie at the interface so
254 	 * it will divert packets to bpf.
255 	 */
256 	BPFIF_LOCK(bp);
257 	d->bd_bif = bp;
258 	d->bd_next = bp->bif_dlist;
259 	bp->bif_dlist = d;
260 
261 	*bp->bif_driverp = bp;
262 	BPFIF_UNLOCK(bp);
263 }
264 
265 /*
266  * Detach a file from its interface.
267  */
268 static void
269 bpf_detachd(d)
270 	struct bpf_d *d;
271 {
272 	int error;
273 	struct bpf_d **p;
274 	struct bpf_if *bp;
275 
276 	bp = d->bd_bif;
277 	/*
278 	 * Check if this descriptor had requested promiscuous mode.
279 	 * If so, turn it off.
280 	 */
281 	if (d->bd_promisc) {
282 		d->bd_promisc = 0;
283 		error = ifpromisc(bp->bif_ifp, 0);
284 		if (error != 0 && error != ENXIO) {
285 			/*
286 			 * ENXIO can happen if a pccard is unplugged
287 			 * Something is really wrong if we were able to put
288 			 * the driver into promiscuous mode, but can't
289 			 * take it out.
290 			 */
291 			if_printf(bp->bif_ifp,
292 				"bpf_detach: ifpromisc failed (%d)\n", error);
293 		}
294 	}
295 	/* Remove d from the interface's descriptor list. */
296 	BPFIF_LOCK(bp);
297 	p = &bp->bif_dlist;
298 	while (*p != d) {
299 		p = &(*p)->bd_next;
300 		if (*p == 0)
301 			panic("bpf_detachd: descriptor not in list");
302 	}
303 	*p = (*p)->bd_next;
304 	if (bp->bif_dlist == 0)
305 		/*
306 		 * Let the driver know that there are no more listeners.
307 		 */
308 		*d->bd_bif->bif_driverp = 0;
309 	BPFIF_UNLOCK(bp);
310 	d->bd_bif = 0;
311 }
312 
313 /*
314  * Open ethernet device.  Returns ENXIO for illegal minor device number,
315  * EBUSY if file is open by another process.
316  */
317 /* ARGSUSED */
318 static	int
319 bpfopen(dev, flags, fmt, td)
320 	dev_t dev;
321 	int flags;
322 	int fmt;
323 	struct thread *td;
324 {
325 	struct bpf_d *d;
326 
327 	mtx_lock(&bpf_mtx);
328 	d = dev->si_drv1;
329 	/*
330 	 * Each minor can be opened by only one process.  If the requested
331 	 * minor is in use, return EBUSY.
332 	 */
333 	if (d) {
334 		mtx_unlock(&bpf_mtx);
335 		return (EBUSY);
336 	}
337 	dev->si_drv1 = (struct bpf_d *)~0;	/* mark device in use */
338 	mtx_unlock(&bpf_mtx);
339 
340 	if ((dev->si_flags & SI_NAMED) == 0)
341 		make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600,
342 		    "bpf%d", dev2unit(dev));
343 	MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_ZERO);
344 	dev->si_drv1 = d;
345 	d->bd_bufsize = bpf_bufsize;
346 	d->bd_sig = SIGIO;
347 	d->bd_seesent = 1;
348 #ifdef MAC
349 	mac_init_bpfdesc(d);
350 	mac_create_bpfdesc(td->td_ucred, d);
351 #endif
352 	mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
353 	callout_init(&d->bd_callout, 1);
354 
355 	return (0);
356 }
357 
358 /*
359  * Close the descriptor by detaching it from its interface,
360  * deallocating its buffers, and marking it free.
361  */
362 /* ARGSUSED */
363 static	int
364 bpfclose(dev, flags, fmt, td)
365 	dev_t dev;
366 	int flags;
367 	int fmt;
368 	struct thread *td;
369 {
370 	struct bpf_d *d = dev->si_drv1;
371 
372 	BPFD_LOCK(d);
373 	if (d->bd_state == BPF_WAITING)
374 		callout_stop(&d->bd_callout);
375 	d->bd_state = BPF_IDLE;
376 	BPFD_UNLOCK(d);
377 	funsetown(&d->bd_sigio);
378 	mtx_lock(&bpf_mtx);
379 	if (d->bd_bif)
380 		bpf_detachd(d);
381 	mtx_unlock(&bpf_mtx);
382 #ifdef MAC
383 	mac_destroy_bpfdesc(d);
384 #endif /* MAC */
385 	bpf_freed(d);
386 	dev->si_drv1 = 0;
387 	free(d, M_BPF);
388 
389 	return (0);
390 }
391 
392 
393 /*
394  * Rotate the packet buffers in descriptor d.  Move the store buffer
395  * into the hold slot, and the free buffer into the store slot.
396  * Zero the length of the new store buffer.
397  */
398 #define ROTATE_BUFFERS(d) \
399 	(d)->bd_hbuf = (d)->bd_sbuf; \
400 	(d)->bd_hlen = (d)->bd_slen; \
401 	(d)->bd_sbuf = (d)->bd_fbuf; \
402 	(d)->bd_slen = 0; \
403 	(d)->bd_fbuf = 0;
404 /*
405  *  bpfread - read next chunk of packets from buffers
406  */
407 static	int
408 bpfread(dev, uio, ioflag)
409 	dev_t dev;
410 	register struct uio *uio;
411 	int ioflag;
412 {
413 	struct bpf_d *d = dev->si_drv1;
414 	int timed_out;
415 	int error;
416 
417 	/*
418 	 * Restrict application to use a buffer the same size as
419 	 * as kernel buffers.
420 	 */
421 	if (uio->uio_resid != d->bd_bufsize)
422 		return (EINVAL);
423 
424 	BPFD_LOCK(d);
425 	if (d->bd_state == BPF_WAITING)
426 		callout_stop(&d->bd_callout);
427 	timed_out = (d->bd_state == BPF_TIMED_OUT);
428 	d->bd_state = BPF_IDLE;
429 	/*
430 	 * If the hold buffer is empty, then do a timed sleep, which
431 	 * ends when the timeout expires or when enough packets
432 	 * have arrived to fill the store buffer.
433 	 */
434 	while (d->bd_hbuf == 0) {
435 		if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
436 			/*
437 			 * A packet(s) either arrived since the previous
438 			 * read or arrived while we were asleep.
439 			 * Rotate the buffers and return what's here.
440 			 */
441 			ROTATE_BUFFERS(d);
442 			break;
443 		}
444 
445 		/*
446 		 * No data is available, check to see if the bpf device
447 		 * is still pointed at a real interface.  If not, return
448 		 * ENXIO so that the userland process knows to rebind
449 		 * it before using it again.
450 		 */
451 		if (d->bd_bif == NULL) {
452 			BPFD_UNLOCK(d);
453 			return (ENXIO);
454 		}
455 
456 		if (ioflag & IO_NDELAY) {
457 			BPFD_UNLOCK(d);
458 			return (EWOULDBLOCK);
459 		}
460 		error = msleep((caddr_t)d, &d->bd_mtx, PRINET|PCATCH,
461 		     "bpf", d->bd_rtout);
462 		if (error == EINTR || error == ERESTART) {
463 			BPFD_UNLOCK(d);
464 			return (error);
465 		}
466 		if (error == EWOULDBLOCK) {
467 			/*
468 			 * On a timeout, return what's in the buffer,
469 			 * which may be nothing.  If there is something
470 			 * in the store buffer, we can rotate the buffers.
471 			 */
472 			if (d->bd_hbuf)
473 				/*
474 				 * We filled up the buffer in between
475 				 * getting the timeout and arriving
476 				 * here, so we don't need to rotate.
477 				 */
478 				break;
479 
480 			if (d->bd_slen == 0) {
481 				BPFD_UNLOCK(d);
482 				return (0);
483 			}
484 			ROTATE_BUFFERS(d);
485 			break;
486 		}
487 	}
488 	/*
489 	 * At this point, we know we have something in the hold slot.
490 	 */
491 	BPFD_UNLOCK(d);
492 
493 	/*
494 	 * Move data from hold buffer into user space.
495 	 * We know the entire buffer is transferred since
496 	 * we checked above that the read buffer is bpf_bufsize bytes.
497 	 */
498 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
499 
500 	BPFD_LOCK(d);
501 	d->bd_fbuf = d->bd_hbuf;
502 	d->bd_hbuf = 0;
503 	d->bd_hlen = 0;
504 	BPFD_UNLOCK(d);
505 
506 	return (error);
507 }
508 
509 
510 /*
511  * If there are processes sleeping on this descriptor, wake them up.
512  */
513 static __inline void
514 bpf_wakeup(d)
515 	register struct bpf_d *d;
516 {
517 	if (d->bd_state == BPF_WAITING) {
518 		callout_stop(&d->bd_callout);
519 		d->bd_state = BPF_IDLE;
520 	}
521 	wakeup((caddr_t)d);
522 	if (d->bd_async && d->bd_sig && d->bd_sigio)
523 		pgsigio(&d->bd_sigio, d->bd_sig, 0);
524 
525 	selwakeup(&d->bd_sel);
526 }
527 
528 static void
529 bpf_timed_out(arg)
530 	void *arg;
531 {
532 	struct bpf_d *d = (struct bpf_d *)arg;
533 
534 	BPFD_LOCK(d);
535 	if (d->bd_state == BPF_WAITING) {
536 		d->bd_state = BPF_TIMED_OUT;
537 		if (d->bd_slen != 0)
538 			bpf_wakeup(d);
539 	}
540 	BPFD_UNLOCK(d);
541 }
542 
543 static	int
544 bpfwrite(dev, uio, ioflag)
545 	dev_t dev;
546 	struct uio *uio;
547 	int ioflag;
548 {
549 	struct bpf_d *d = dev->si_drv1;
550 	struct ifnet *ifp;
551 	struct mbuf *m;
552 	int error;
553 	static struct sockaddr dst;
554 	int datlen;
555 
556 	if (d->bd_bif == 0)
557 		return (ENXIO);
558 
559 	ifp = d->bd_bif->bif_ifp;
560 
561 	if (uio->uio_resid == 0)
562 		return (0);
563 
564 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, &m, &dst, &datlen);
565 	if (error)
566 		return (error);
567 
568 	if (datlen > ifp->if_mtu)
569 		return (EMSGSIZE);
570 
571 	if (d->bd_hdrcmplt)
572 		dst.sa_family = pseudo_AF_HDRCMPLT;
573 
574 	mtx_lock(&Giant);
575 #ifdef MAC
576 	mac_create_mbuf_from_bpfdesc(d, m);
577 #endif
578 	error = (*ifp->if_output)(ifp, m, &dst, (struct rtentry *)0);
579 	mtx_unlock(&Giant);
580 	/*
581 	 * The driver frees the mbuf.
582 	 */
583 	return (error);
584 }
585 
586 /*
587  * Reset a descriptor by flushing its packet buffer and clearing the
588  * receive and drop counts.
589  */
590 static void
591 reset_d(d)
592 	struct bpf_d *d;
593 {
594 
595 	mtx_assert(&d->bd_mtx, MA_OWNED);
596 	if (d->bd_hbuf) {
597 		/* Free the hold buffer. */
598 		d->bd_fbuf = d->bd_hbuf;
599 		d->bd_hbuf = 0;
600 	}
601 	d->bd_slen = 0;
602 	d->bd_hlen = 0;
603 	d->bd_rcount = 0;
604 	d->bd_dcount = 0;
605 }
606 
607 /*
608  *  FIONREAD		Check for read packet available.
609  *  SIOCGIFADDR		Get interface address - convenient hook to driver.
610  *  BIOCGBLEN		Get buffer len [for read()].
611  *  BIOCSETF		Set ethernet read filter.
612  *  BIOCFLUSH		Flush read packet buffer.
613  *  BIOCPROMISC		Put interface into promiscuous mode.
614  *  BIOCGDLT		Get link layer type.
615  *  BIOCGETIF		Get interface name.
616  *  BIOCSETIF		Set interface.
617  *  BIOCSRTIMEOUT	Set read timeout.
618  *  BIOCGRTIMEOUT	Get read timeout.
619  *  BIOCGSTATS		Get packet stats.
620  *  BIOCIMMEDIATE	Set immediate mode.
621  *  BIOCVERSION		Get filter language version.
622  *  BIOCGHDRCMPLT	Get "header already complete" flag
623  *  BIOCSHDRCMPLT	Set "header already complete" flag
624  *  BIOCGSEESENT	Get "see packets sent" flag
625  *  BIOCSSEESENT	Set "see packets sent" flag
626  */
627 /* ARGSUSED */
628 static	int
629 bpfioctl(dev, cmd, addr, flags, td)
630 	dev_t dev;
631 	u_long cmd;
632 	caddr_t addr;
633 	int flags;
634 	struct thread *td;
635 {
636 	struct bpf_d *d = dev->si_drv1;
637 	int error = 0;
638 
639 	BPFD_LOCK(d);
640 	if (d->bd_state == BPF_WAITING)
641 		callout_stop(&d->bd_callout);
642 	d->bd_state = BPF_IDLE;
643 	BPFD_UNLOCK(d);
644 
645 	switch (cmd) {
646 
647 	default:
648 		error = EINVAL;
649 		break;
650 
651 	/*
652 	 * Check for read packet available.
653 	 */
654 	case FIONREAD:
655 		{
656 			int n;
657 
658 			BPFD_LOCK(d);
659 			n = d->bd_slen;
660 			if (d->bd_hbuf)
661 				n += d->bd_hlen;
662 			BPFD_UNLOCK(d);
663 
664 			*(int *)addr = n;
665 			break;
666 		}
667 
668 	case SIOCGIFADDR:
669 		{
670 			struct ifnet *ifp;
671 
672 			if (d->bd_bif == 0)
673 				error = EINVAL;
674 			else {
675 				ifp = d->bd_bif->bif_ifp;
676 				error = (*ifp->if_ioctl)(ifp, cmd, addr);
677 			}
678 			break;
679 		}
680 
681 	/*
682 	 * Get buffer len [for read()].
683 	 */
684 	case BIOCGBLEN:
685 		*(u_int *)addr = d->bd_bufsize;
686 		break;
687 
688 	/*
689 	 * Set buffer length.
690 	 */
691 	case BIOCSBLEN:
692 		if (d->bd_bif != 0)
693 			error = EINVAL;
694 		else {
695 			register u_int size = *(u_int *)addr;
696 
697 			if (size > bpf_maxbufsize)
698 				*(u_int *)addr = size = bpf_maxbufsize;
699 			else if (size < BPF_MINBUFSIZE)
700 				*(u_int *)addr = size = BPF_MINBUFSIZE;
701 			d->bd_bufsize = size;
702 		}
703 		break;
704 
705 	/*
706 	 * Set link layer read filter.
707 	 */
708 	case BIOCSETF:
709 		error = bpf_setf(d, (struct bpf_program *)addr);
710 		break;
711 
712 	/*
713 	 * Flush read packet buffer.
714 	 */
715 	case BIOCFLUSH:
716 		BPFD_LOCK(d);
717 		reset_d(d);
718 		BPFD_UNLOCK(d);
719 		break;
720 
721 	/*
722 	 * Put interface into promiscuous mode.
723 	 */
724 	case BIOCPROMISC:
725 		if (d->bd_bif == 0) {
726 			/*
727 			 * No interface attached yet.
728 			 */
729 			error = EINVAL;
730 			break;
731 		}
732 		if (d->bd_promisc == 0) {
733 			mtx_lock(&Giant);
734 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
735 			mtx_unlock(&Giant);
736 			if (error == 0)
737 				d->bd_promisc = 1;
738 		}
739 		break;
740 
741 	/*
742 	 * Get current data link type.
743 	 */
744 	case BIOCGDLT:
745 		if (d->bd_bif == 0)
746 			error = EINVAL;
747 		else
748 			*(u_int *)addr = d->bd_bif->bif_dlt;
749 		break;
750 
751   	/*
752 	 * Get a list of supported data link types.
753 	 */
754 	case BIOCGDLTLIST:
755 		if (d->bd_bif == 0)
756 			error = EINVAL;
757 		else
758 			error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
759 		break;
760 
761 	/*
762 	 * Set data link type.
763 	 */
764 	case BIOCSDLT:
765 		if (d->bd_bif == 0)
766 			error = EINVAL;
767 		else
768 			error = bpf_setdlt(d, *(u_int *)addr);
769 		break;
770 
771 	/*
772 	 * Get interface name.
773 	 */
774 	case BIOCGETIF:
775 		if (d->bd_bif == 0)
776 			error = EINVAL;
777 		else {
778 			struct ifnet *const ifp = d->bd_bif->bif_ifp;
779 			struct ifreq *const ifr = (struct ifreq *)addr;
780 
781 			snprintf(ifr->ifr_name, sizeof(ifr->ifr_name),
782 			    "%s%d", ifp->if_name, ifp->if_unit);
783 		}
784 		break;
785 
786 	/*
787 	 * Set interface.
788 	 */
789 	case BIOCSETIF:
790 		error = bpf_setif(d, (struct ifreq *)addr);
791 		break;
792 
793 	/*
794 	 * Set read timeout.
795 	 */
796 	case BIOCSRTIMEOUT:
797 		{
798 			struct timeval *tv = (struct timeval *)addr;
799 
800 			/*
801 			 * Subtract 1 tick from tvtohz() since this isn't
802 			 * a one-shot timer.
803 			 */
804 			if ((error = itimerfix(tv)) == 0)
805 				d->bd_rtout = tvtohz(tv) - 1;
806 			break;
807 		}
808 
809 	/*
810 	 * Get read timeout.
811 	 */
812 	case BIOCGRTIMEOUT:
813 		{
814 			struct timeval *tv = (struct timeval *)addr;
815 
816 			tv->tv_sec = d->bd_rtout / hz;
817 			tv->tv_usec = (d->bd_rtout % hz) * tick;
818 			break;
819 		}
820 
821 	/*
822 	 * Get packet stats.
823 	 */
824 	case BIOCGSTATS:
825 		{
826 			struct bpf_stat *bs = (struct bpf_stat *)addr;
827 
828 			bs->bs_recv = d->bd_rcount;
829 			bs->bs_drop = d->bd_dcount;
830 			break;
831 		}
832 
833 	/*
834 	 * Set immediate mode.
835 	 */
836 	case BIOCIMMEDIATE:
837 		d->bd_immediate = *(u_int *)addr;
838 		break;
839 
840 	case BIOCVERSION:
841 		{
842 			struct bpf_version *bv = (struct bpf_version *)addr;
843 
844 			bv->bv_major = BPF_MAJOR_VERSION;
845 			bv->bv_minor = BPF_MINOR_VERSION;
846 			break;
847 		}
848 
849 	/*
850 	 * Get "header already complete" flag
851 	 */
852 	case BIOCGHDRCMPLT:
853 		*(u_int *)addr = d->bd_hdrcmplt;
854 		break;
855 
856 	/*
857 	 * Set "header already complete" flag
858 	 */
859 	case BIOCSHDRCMPLT:
860 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
861 		break;
862 
863 	/*
864 	 * Get "see sent packets" flag
865 	 */
866 	case BIOCGSEESENT:
867 		*(u_int *)addr = d->bd_seesent;
868 		break;
869 
870 	/*
871 	 * Set "see sent packets" flag
872 	 */
873 	case BIOCSSEESENT:
874 		d->bd_seesent = *(u_int *)addr;
875 		break;
876 
877 	case FIONBIO:		/* Non-blocking I/O */
878 		break;
879 
880 	case FIOASYNC:		/* Send signal on receive packets */
881 		d->bd_async = *(int *)addr;
882 		break;
883 
884 	case FIOSETOWN:
885 		error = fsetown(*(int *)addr, &d->bd_sigio);
886 		break;
887 
888 	case FIOGETOWN:
889 		*(int *)addr = fgetown(&d->bd_sigio);
890 		break;
891 
892 	/* This is deprecated, FIOSETOWN should be used instead. */
893 	case TIOCSPGRP:
894 		error = fsetown(-(*(int *)addr), &d->bd_sigio);
895 		break;
896 
897 	/* This is deprecated, FIOGETOWN should be used instead. */
898 	case TIOCGPGRP:
899 		*(int *)addr = -fgetown(&d->bd_sigio);
900 		break;
901 
902 	case BIOCSRSIG:		/* Set receive signal */
903 		{
904 		 	u_int sig;
905 
906 			sig = *(u_int *)addr;
907 
908 			if (sig >= NSIG)
909 				error = EINVAL;
910 			else
911 				d->bd_sig = sig;
912 			break;
913 		}
914 	case BIOCGRSIG:
915 		*(u_int *)addr = d->bd_sig;
916 		break;
917 	}
918 	return (error);
919 }
920 
921 /*
922  * Set d's packet filter program to fp.  If this file already has a filter,
923  * free it and replace it.  Returns EINVAL for bogus requests.
924  */
925 static int
926 bpf_setf(d, fp)
927 	struct bpf_d *d;
928 	struct bpf_program *fp;
929 {
930 	struct bpf_insn *fcode, *old;
931 	u_int flen, size;
932 
933 	old = d->bd_filter;
934 	if (fp->bf_insns == 0) {
935 		if (fp->bf_len != 0)
936 			return (EINVAL);
937 		BPFD_LOCK(d);
938 		d->bd_filter = 0;
939 		reset_d(d);
940 		BPFD_UNLOCK(d);
941 		if (old != 0)
942 			free((caddr_t)old, M_BPF);
943 		return (0);
944 	}
945 	flen = fp->bf_len;
946 	if (flen > BPF_MAXINSNS)
947 		return (EINVAL);
948 
949 	size = flen * sizeof(*fp->bf_insns);
950 	fcode = (struct bpf_insn *)malloc(size, M_BPF, 0);
951 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
952 	    bpf_validate(fcode, (int)flen)) {
953 		BPFD_LOCK(d);
954 		d->bd_filter = fcode;
955 		reset_d(d);
956 		BPFD_UNLOCK(d);
957 		if (old != 0)
958 			free((caddr_t)old, M_BPF);
959 
960 		return (0);
961 	}
962 	free((caddr_t)fcode, M_BPF);
963 	return (EINVAL);
964 }
965 
966 /*
967  * Detach a file from its current interface (if attached at all) and attach
968  * to the interface indicated by the name stored in ifr.
969  * Return an errno or 0.
970  */
971 static int
972 bpf_setif(d, ifr)
973 	struct bpf_d *d;
974 	struct ifreq *ifr;
975 {
976 	struct bpf_if *bp;
977 	int error;
978 	struct ifnet *theywant;
979 
980 	theywant = ifunit(ifr->ifr_name);
981 	if (theywant == 0)
982 		return ENXIO;
983 
984 	/*
985 	 * Look through attached interfaces for the named one.
986 	 */
987 	mtx_lock(&bpf_mtx);
988 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
989 		struct ifnet *ifp = bp->bif_ifp;
990 
991 		if (ifp == 0 || ifp != theywant)
992 			continue;
993 		/* skip additional entry */
994 		if (bp->bif_driverp != (struct bpf_if **)&ifp->if_bpf)
995 			continue;
996 
997 		mtx_unlock(&bpf_mtx);
998 		/*
999 		 * We found the requested interface.
1000 		 * If it's not up, return an error.
1001 		 * Allocate the packet buffers if we need to.
1002 		 * If we're already attached to requested interface,
1003 		 * just flush the buffer.
1004 		 */
1005 		if ((ifp->if_flags & IFF_UP) == 0)
1006 			return (ENETDOWN);
1007 
1008 		if (d->bd_sbuf == 0) {
1009 			error = bpf_allocbufs(d);
1010 			if (error != 0)
1011 				return (error);
1012 		}
1013 		if (bp != d->bd_bif) {
1014 			if (d->bd_bif)
1015 				/*
1016 				 * Detach if attached to something else.
1017 				 */
1018 				bpf_detachd(d);
1019 
1020 			bpf_attachd(d, bp);
1021 		}
1022 		BPFD_LOCK(d);
1023 		reset_d(d);
1024 		BPFD_UNLOCK(d);
1025 		return (0);
1026 	}
1027 	mtx_unlock(&bpf_mtx);
1028 	/* Not found. */
1029 	return (ENXIO);
1030 }
1031 
1032 /*
1033  * Support for select() and poll() system calls
1034  *
1035  * Return true iff the specific operation will not block indefinitely.
1036  * Otherwise, return false but make a note that a selwakeup() must be done.
1037  */
1038 static int
1039 bpfpoll(dev, events, td)
1040 	register dev_t dev;
1041 	int events;
1042 	struct thread *td;
1043 {
1044 	struct bpf_d *d;
1045 	int revents;
1046 
1047 	d = dev->si_drv1;
1048 	if (d->bd_bif == NULL)
1049 		return (ENXIO);
1050 
1051 	revents = events & (POLLOUT | POLLWRNORM);
1052 	BPFD_LOCK(d);
1053 	if (events & (POLLIN | POLLRDNORM)) {
1054 		/*
1055 		 * An imitation of the FIONREAD ioctl code.
1056 		 * XXX not quite.  An exact imitation:
1057 		 *	if (d->b_slen != 0 ||
1058 		 *	    (d->bd_hbuf != NULL && d->bd_hlen != 0)
1059 		 */
1060 		if (d->bd_hlen != 0 ||
1061 		    ((d->bd_immediate || d->bd_state == BPF_TIMED_OUT) &&
1062 		    d->bd_slen != 0))
1063 			revents |= events & (POLLIN | POLLRDNORM);
1064 		else {
1065 			selrecord(td, &d->bd_sel);
1066 			/* Start the read timeout if necessary. */
1067 			if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1068 				callout_reset(&d->bd_callout, d->bd_rtout,
1069 				    bpf_timed_out, d);
1070 				d->bd_state = BPF_WAITING;
1071 			}
1072 		}
1073 	}
1074 	BPFD_UNLOCK(d);
1075 	return (revents);
1076 }
1077 
1078 /*
1079  * Incoming linkage from device drivers.  Process the packet pkt, of length
1080  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1081  * by each process' filter, and if accepted, stashed into the corresponding
1082  * buffer.
1083  */
1084 void
1085 bpf_tap(bp, pkt, pktlen)
1086 	struct bpf_if *bp;
1087 	register u_char *pkt;
1088 	register u_int pktlen;
1089 {
1090 	register struct bpf_d *d;
1091 	register u_int slen;
1092 
1093 	BPFIF_LOCK(bp);
1094 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1095 		BPFD_LOCK(d);
1096 		++d->bd_rcount;
1097 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1098 		if (slen != 0) {
1099 #ifdef MAC
1100 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1101 #endif
1102 				catchpacket(d, pkt, pktlen, slen, bcopy);
1103 		}
1104 		BPFD_UNLOCK(d);
1105 	}
1106 	BPFIF_UNLOCK(bp);
1107 }
1108 
1109 /*
1110  * Copy data from an mbuf chain into a buffer.  This code is derived
1111  * from m_copydata in sys/uipc_mbuf.c.
1112  */
1113 static void
1114 bpf_mcopy(src_arg, dst_arg, len)
1115 	const void *src_arg;
1116 	void *dst_arg;
1117 	register size_t len;
1118 {
1119 	register const struct mbuf *m;
1120 	register u_int count;
1121 	u_char *dst;
1122 
1123 	m = src_arg;
1124 	dst = dst_arg;
1125 	while (len > 0) {
1126 		if (m == 0)
1127 			panic("bpf_mcopy");
1128 		count = min(m->m_len, len);
1129 		bcopy(mtod(m, void *), dst, count);
1130 		m = m->m_next;
1131 		dst += count;
1132 		len -= count;
1133 	}
1134 }
1135 
1136 /*
1137  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1138  */
1139 void
1140 bpf_mtap(bp, m)
1141 	struct bpf_if *bp;
1142 	struct mbuf *m;
1143 {
1144 	struct bpf_d *d;
1145 	u_int pktlen, slen;
1146 
1147 	pktlen = m_length(m, NULL);
1148 	if (pktlen == m->m_len) {
1149 		bpf_tap(bp, mtod(m, u_char *), pktlen);
1150 		return;
1151 	}
1152 
1153 	BPFIF_LOCK(bp);
1154 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1155 		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1156 			continue;
1157 		BPFD_LOCK(d);
1158 		++d->bd_rcount;
1159 		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1160 		if (slen != 0)
1161 #ifdef MAC
1162 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1163 #endif
1164 				catchpacket(d, (u_char *)m, pktlen, slen,
1165 				    bpf_mcopy);
1166 		BPFD_UNLOCK(d);
1167 	}
1168 	BPFIF_UNLOCK(bp);
1169 }
1170 
1171 /*
1172  * Move the packet data from interface memory (pkt) into the
1173  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1174  * otherwise 0.  "copy" is the routine called to do the actual data
1175  * transfer.  bcopy is passed in to copy contiguous chunks, while
1176  * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1177  * pkt is really an mbuf.
1178  */
1179 static void
1180 catchpacket(d, pkt, pktlen, snaplen, cpfn)
1181 	register struct bpf_d *d;
1182 	register u_char *pkt;
1183 	register u_int pktlen, snaplen;
1184 	register void (*cpfn)(const void *, void *, size_t);
1185 {
1186 	register struct bpf_hdr *hp;
1187 	register int totlen, curlen;
1188 	register int hdrlen = d->bd_bif->bif_hdrlen;
1189 	/*
1190 	 * Figure out how many bytes to move.  If the packet is
1191 	 * greater or equal to the snapshot length, transfer that
1192 	 * much.  Otherwise, transfer the whole packet (unless
1193 	 * we hit the buffer size limit).
1194 	 */
1195 	totlen = hdrlen + min(snaplen, pktlen);
1196 	if (totlen > d->bd_bufsize)
1197 		totlen = d->bd_bufsize;
1198 
1199 	/*
1200 	 * Round up the end of the previous packet to the next longword.
1201 	 */
1202 	curlen = BPF_WORDALIGN(d->bd_slen);
1203 	if (curlen + totlen > d->bd_bufsize) {
1204 		/*
1205 		 * This packet will overflow the storage buffer.
1206 		 * Rotate the buffers if we can, then wakeup any
1207 		 * pending reads.
1208 		 */
1209 		if (d->bd_fbuf == 0) {
1210 			/*
1211 			 * We haven't completed the previous read yet,
1212 			 * so drop the packet.
1213 			 */
1214 			++d->bd_dcount;
1215 			return;
1216 		}
1217 		ROTATE_BUFFERS(d);
1218 		bpf_wakeup(d);
1219 		curlen = 0;
1220 	}
1221 	else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1222 		/*
1223 		 * Immediate mode is set, or the read timeout has
1224 		 * already expired during a select call.  A packet
1225 		 * arrived, so the reader should be woken up.
1226 		 */
1227 		bpf_wakeup(d);
1228 
1229 	/*
1230 	 * Append the bpf header.
1231 	 */
1232 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1233 	microtime(&hp->bh_tstamp);
1234 	hp->bh_datalen = pktlen;
1235 	hp->bh_hdrlen = hdrlen;
1236 	/*
1237 	 * Copy the packet data into the store buffer and update its length.
1238 	 */
1239 	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1240 	d->bd_slen = curlen + totlen;
1241 }
1242 
1243 /*
1244  * Initialize all nonzero fields of a descriptor.
1245  */
1246 static int
1247 bpf_allocbufs(d)
1248 	register struct bpf_d *d;
1249 {
1250 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, 0);
1251 	if (d->bd_fbuf == 0)
1252 		return (ENOBUFS);
1253 
1254 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, 0);
1255 	if (d->bd_sbuf == 0) {
1256 		free(d->bd_fbuf, M_BPF);
1257 		return (ENOBUFS);
1258 	}
1259 	d->bd_slen = 0;
1260 	d->bd_hlen = 0;
1261 	return (0);
1262 }
1263 
1264 /*
1265  * Free buffers currently in use by a descriptor.
1266  * Called on close.
1267  */
1268 static void
1269 bpf_freed(d)
1270 	register struct bpf_d *d;
1271 {
1272 	/*
1273 	 * We don't need to lock out interrupts since this descriptor has
1274 	 * been detached from its interface and it yet hasn't been marked
1275 	 * free.
1276 	 */
1277 	if (d->bd_sbuf != 0) {
1278 		free(d->bd_sbuf, M_BPF);
1279 		if (d->bd_hbuf != 0)
1280 			free(d->bd_hbuf, M_BPF);
1281 		if (d->bd_fbuf != 0)
1282 			free(d->bd_fbuf, M_BPF);
1283 	}
1284 	if (d->bd_filter)
1285 		free((caddr_t)d->bd_filter, M_BPF);
1286 	mtx_destroy(&d->bd_mtx);
1287 }
1288 
1289 /*
1290  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
1291  * fixed size of the link header (variable length headers not yet supported).
1292  */
1293 void
1294 bpfattach(ifp, dlt, hdrlen)
1295 	struct ifnet *ifp;
1296 	u_int dlt, hdrlen;
1297 {
1298 
1299 	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1300 }
1301 
1302 /*
1303  * Attach an interface to bpf.  ifp is a pointer to the structure
1304  * defining the interface to be attached, dlt is the link layer type,
1305  * and hdrlen is the fixed size of the link header (variable length
1306  * headers are not yet supporrted).
1307  */
1308 void
1309 bpfattach2(ifp, dlt, hdrlen, driverp)
1310 	struct ifnet *ifp;
1311 	u_int dlt, hdrlen;
1312 	struct bpf_if **driverp;
1313 {
1314 	struct bpf_if *bp;
1315 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
1316 	if (bp == 0)
1317 		panic("bpfattach");
1318 
1319 	bp->bif_dlist = 0;
1320 	bp->bif_driverp = driverp;
1321 	bp->bif_ifp = ifp;
1322 	bp->bif_dlt = dlt;
1323 	mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
1324 
1325 	mtx_lock(&bpf_mtx);
1326 	bp->bif_next = bpf_iflist;
1327 	bpf_iflist = bp;
1328 	mtx_unlock(&bpf_mtx);
1329 
1330 	*bp->bif_driverp = 0;
1331 
1332 	/*
1333 	 * Compute the length of the bpf header.  This is not necessarily
1334 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1335 	 * that the network layer header begins on a longword boundary (for
1336 	 * performance reasons and to alleviate alignment restrictions).
1337 	 */
1338 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1339 
1340 	if (bootverbose)
1341 		if_printf(ifp, "bpf attached\n");
1342 }
1343 
1344 /*
1345  * Detach bpf from an interface.  This involves detaching each descriptor
1346  * associated with the interface, and leaving bd_bif NULL.  Notify each
1347  * descriptor as it's detached so that any sleepers wake up and get
1348  * ENXIO.
1349  */
1350 void
1351 bpfdetach(ifp)
1352 	struct ifnet *ifp;
1353 {
1354 	struct bpf_if	*bp, *bp_prev;
1355 	struct bpf_d	*d;
1356 
1357 	/* Locate BPF interface information */
1358 	bp_prev = NULL;
1359 
1360 	mtx_lock(&bpf_mtx);
1361 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1362 		if (ifp == bp->bif_ifp)
1363 			break;
1364 		bp_prev = bp;
1365 	}
1366 
1367 	/* Interface wasn't attached */
1368 	if (bp->bif_ifp == NULL) {
1369 		mtx_unlock(&bpf_mtx);
1370 		printf("bpfdetach: %s%d was not attached\n", ifp->if_name,
1371 		    ifp->if_unit);
1372 		return;
1373 	}
1374 
1375 	if (bp_prev) {
1376 		bp_prev->bif_next = bp->bif_next;
1377 	} else {
1378 		bpf_iflist = bp->bif_next;
1379 	}
1380 	mtx_unlock(&bpf_mtx);
1381 
1382 	while ((d = bp->bif_dlist) != NULL) {
1383 		bpf_detachd(d);
1384 		BPFD_LOCK(d);
1385 		bpf_wakeup(d);
1386 		BPFD_UNLOCK(d);
1387 	}
1388 
1389 	mtx_destroy(&bp->bif_mtx);
1390 	free(bp, M_BPF);
1391 }
1392 
1393 /*
1394  * Get a list of available data link type of the interface.
1395  */
1396 static int
1397 bpf_getdltlist(d, bfl)
1398 	struct bpf_d *d;
1399 	struct bpf_dltlist *bfl;
1400 {
1401 	int n, error;
1402 	struct ifnet *ifp;
1403 	struct bpf_if *bp;
1404 
1405 	ifp = d->bd_bif->bif_ifp;
1406 	n = 0;
1407 	error = 0;
1408 	mtx_lock(&bpf_mtx);
1409 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1410 		if (bp->bif_ifp != ifp)
1411 			continue;
1412 		if (bfl->bfl_list != NULL) {
1413 			if (n >= bfl->bfl_len) {
1414 				mtx_unlock(&bpf_mtx);
1415 				return (ENOMEM);
1416 			}
1417 			error = copyout(&bp->bif_dlt,
1418 			    bfl->bfl_list + n, sizeof(u_int));
1419 		}
1420 		n++;
1421 	}
1422 	mtx_unlock(&bpf_mtx);
1423 	bfl->bfl_len = n;
1424 	return (error);
1425 }
1426 
1427 /*
1428  * Set the data link type of a BPF instance.
1429  */
1430 static int
1431 bpf_setdlt(d, dlt)
1432 	struct bpf_d *d;
1433 	u_int dlt;
1434 {
1435 	int error, opromisc;
1436 	struct ifnet *ifp;
1437 	struct bpf_if *bp;
1438 
1439 	if (d->bd_bif->bif_dlt == dlt)
1440 		return (0);
1441 	ifp = d->bd_bif->bif_ifp;
1442 	mtx_lock(&bpf_mtx);
1443 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1444 		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1445 			break;
1446 	}
1447 	mtx_unlock(&bpf_mtx);
1448 	if (bp != NULL) {
1449 		BPFD_LOCK(d);
1450 		opromisc = d->bd_promisc;
1451 		bpf_detachd(d);
1452 		bpf_attachd(d, bp);
1453 		reset_d(d);
1454 		BPFD_UNLOCK(d);
1455 		if (opromisc) {
1456 			error = ifpromisc(bp->bif_ifp, 1);
1457 			if (error)
1458 				if_printf(bp->bif_ifp,
1459 					"bpf_setdlt: ifpromisc failed (%d)\n",
1460 					error);
1461 			else
1462 				d->bd_promisc = 1;
1463 		}
1464 	}
1465 	return (bp == NULL ? EINVAL : 0);
1466 }
1467 
1468 static void bpf_drvinit(void *unused);
1469 
1470 static void bpf_clone(void *arg, char *name, int namelen, dev_t *dev);
1471 
1472 static void
1473 bpf_clone(arg, name, namelen, dev)
1474 	void *arg;
1475 	char *name;
1476 	int namelen;
1477 	dev_t *dev;
1478 {
1479 	int u;
1480 
1481 	if (*dev != NODEV)
1482 		return;
1483 	if (dev_stdclone(name, NULL, "bpf", &u) != 1)
1484 		return;
1485 	*dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
1486 	    "bpf%d", u);
1487 	(*dev)->si_flags |= SI_CHEAPCLONE;
1488 	return;
1489 }
1490 
1491 static void
1492 bpf_drvinit(unused)
1493 	void *unused;
1494 {
1495 
1496 	mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
1497 	EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000);
1498 }
1499 
1500 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,bpf_drvinit,NULL)
1501 
1502 #else /* !DEV_BPF && !NETGRAPH_BPF */
1503 /*
1504  * NOP stubs to allow bpf-using drivers to load and function.
1505  *
1506  * A 'better' implementation would allow the core bpf functionality
1507  * to be loaded at runtime.
1508  */
1509 
1510 void
1511 bpf_tap(bp, pkt, pktlen)
1512 	struct bpf_if *bp;
1513 	register u_char *pkt;
1514 	register u_int pktlen;
1515 {
1516 }
1517 
1518 void
1519 bpf_mtap(bp, m)
1520 	struct bpf_if *bp;
1521 	struct mbuf *m;
1522 {
1523 }
1524 
1525 void
1526 bpfattach(ifp, dlt, hdrlen)
1527 	struct ifnet *ifp;
1528 	u_int dlt, hdrlen;
1529 {
1530 }
1531 
1532 void
1533 bpfdetach(ifp)
1534 	struct ifnet *ifp;
1535 {
1536 }
1537 
1538 u_int
1539 bpf_filter(pc, p, wirelen, buflen)
1540 	register const struct bpf_insn *pc;
1541 	register u_char *p;
1542 	u_int wirelen;
1543 	register u_int buflen;
1544 {
1545 	return -1;	/* "no filter" behaviour */
1546 }
1547 
1548 int
1549 bpf_validate(f, len)
1550 	const struct bpf_insn *f;
1551 	int len;
1552 {
1553 	return 0;		/* false */
1554 }
1555 
1556 #endif /* !DEV_BPF && !NETGRAPH_BPF */
1557