xref: /freebsd/sys/net/bpf.c (revision 5129159789cc9d7bc514e4546b88e3427695002d)
1 /*
2  * Copyright (c) 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *      @(#)bpf.c	8.2 (Berkeley) 3/28/94
39  *
40  * $FreeBSD$
41  */
42 
43 #include "bpf.h"
44 
45 #ifndef __GNUC__
46 #define inline
47 #else
48 #define inline __inline
49 #endif
50 
51 #include <sys/param.h>
52 #include <sys/systm.h>
53 #include <sys/conf.h>
54 #include <sys/malloc.h>
55 #include <sys/mbuf.h>
56 #include <sys/time.h>
57 #include <sys/proc.h>
58 #include <sys/signalvar.h>
59 #include <sys/filio.h>
60 #include <sys/sockio.h>
61 #include <sys/ttycom.h>
62 #include <sys/filedesc.h>
63 
64 #if defined(sparc) && BSD < 199103
65 #include <sys/stream.h>
66 #endif
67 #include <sys/poll.h>
68 
69 #include <sys/socket.h>
70 #include <sys/vnode.h>
71 
72 #include <net/if.h>
73 #include <net/bpf.h>
74 #include <net/bpfdesc.h>
75 
76 #include <netinet/in.h>
77 #include <netinet/if_ether.h>
78 #include <sys/kernel.h>
79 #include <sys/sysctl.h>
80 
81 MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
82 
83 #if NBPF > 0
84 
85 /*
86  * Older BSDs don't have kernel malloc.
87  */
88 #if BSD < 199103
89 extern bcopy();
90 static caddr_t bpf_alloc();
91 #include <net/bpf_compat.h>
92 #define BPF_BUFSIZE (MCLBYTES-8)
93 #define UIOMOVE(cp, len, code, uio) uiomove(cp, len, code, uio)
94 #else
95 #define BPF_BUFSIZE 4096
96 #define UIOMOVE(cp, len, code, uio) uiomove(cp, len, uio)
97 #endif
98 
99 #define PRINET  26			/* interruptible */
100 
101 /*
102  * The default read buffer size is patchable.
103  */
104 static int bpf_bufsize = BPF_BUFSIZE;
105 SYSCTL_INT(_debug, OID_AUTO, bpf_bufsize, CTLFLAG_RW,
106 	&bpf_bufsize, 0, "");
107 
108 /*
109  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
110  */
111 static struct bpf_if	*bpf_iflist;
112 
113 static int	bpf_allocbufs __P((struct bpf_d *));
114 static void	bpf_attachd __P((struct bpf_d *d, struct bpf_if *bp));
115 static void	bpf_detachd __P((struct bpf_d *d));
116 static void	bpf_freed __P((struct bpf_d *));
117 static void	bpf_mcopy __P((const void *, void *, size_t));
118 static int	bpf_movein __P((struct uio *, int,
119 		    struct mbuf **, struct sockaddr *, int *));
120 static int	bpf_setif __P((struct bpf_d *, struct ifreq *));
121 static inline void
122 		bpf_wakeup __P((struct bpf_d *));
123 static void	catchpacket __P((struct bpf_d *, u_char *, u_int,
124 		    u_int, void (*)(const void *, void *, size_t)));
125 static void	reset_d __P((struct bpf_d *));
126 static int	 bpf_setf __P((struct bpf_d *, struct bpf_program *));
127 
128 static	d_open_t	bpfopen;
129 static	d_close_t	bpfclose;
130 static	d_read_t	bpfread;
131 static	d_write_t	bpfwrite;
132 static	d_ioctl_t	bpfioctl;
133 static	d_poll_t	bpfpoll;
134 
135 #define CDEV_MAJOR 23
136 static struct cdevsw bpf_cdevsw = {
137 	/* open */	bpfopen,
138 	/* close */	bpfclose,
139 	/* read */	bpfread,
140 	/* write */	bpfwrite,
141 	/* ioctl */	bpfioctl,
142 	/* poll */	bpfpoll,
143 	/* mmap */	nommap,
144 	/* strategy */	nostrategy,
145 	/* name */	"bpf",
146 	/* maj */	CDEV_MAJOR,
147 	/* dump */	nodump,
148 	/* psize */	nopsize,
149 	/* flags */	0,
150 	/* bmaj */	-1
151 };
152 
153 
154 static int
155 bpf_movein(uio, linktype, mp, sockp, datlen)
156 	register struct uio *uio;
157 	int linktype, *datlen;
158 	register struct mbuf **mp;
159 	register struct sockaddr *sockp;
160 {
161 	struct mbuf *m;
162 	int error;
163 	int len;
164 	int hlen;
165 
166 	/*
167 	 * Build a sockaddr based on the data link layer type.
168 	 * We do this at this level because the ethernet header
169 	 * is copied directly into the data field of the sockaddr.
170 	 * In the case of SLIP, there is no header and the packet
171 	 * is forwarded as is.
172 	 * Also, we are careful to leave room at the front of the mbuf
173 	 * for the link level header.
174 	 */
175 	switch (linktype) {
176 
177 	case DLT_SLIP:
178 		sockp->sa_family = AF_INET;
179 		hlen = 0;
180 		break;
181 
182 	case DLT_EN10MB:
183 		sockp->sa_family = AF_UNSPEC;
184 		/* XXX Would MAXLINKHDR be better? */
185 		hlen = sizeof(struct ether_header);
186 		break;
187 
188 	case DLT_FDDI:
189 #if defined(__FreeBSD__) || defined(__bsdi__)
190 		sockp->sa_family = AF_IMPLINK;
191 		hlen = 0;
192 #else
193 		sockp->sa_family = AF_UNSPEC;
194 		/* XXX 4(FORMAC)+6(dst)+6(src)+3(LLC)+5(SNAP) */
195 		hlen = 24;
196 #endif
197 		break;
198 
199 	case DLT_RAW:
200 	case DLT_NULL:
201 		sockp->sa_family = AF_UNSPEC;
202 		hlen = 0;
203 		break;
204 
205 #ifdef __FreeBSD__
206 	case DLT_ATM_RFC1483:
207 		/*
208 		 * en atm driver requires 4-byte atm pseudo header.
209 		 * though it isn't standard, vpi:vci needs to be
210 		 * specified anyway.
211 		 */
212 		sockp->sa_family = AF_UNSPEC;
213 		hlen = 12; 	/* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
214 		break;
215 #endif
216 
217 	default:
218 		return (EIO);
219 	}
220 
221 	len = uio->uio_resid;
222 	*datlen = len - hlen;
223 	if ((unsigned)len > MCLBYTES)
224 		return (EIO);
225 
226 	MGETHDR(m, M_WAIT, MT_DATA);
227 	if (m == 0)
228 		return (ENOBUFS);
229 	if (len > MHLEN) {
230 #if BSD >= 199103
231 		MCLGET(m, M_WAIT);
232 		if ((m->m_flags & M_EXT) == 0) {
233 #else
234 		MCLGET(m);
235 		if (m->m_len != MCLBYTES) {
236 #endif
237 			error = ENOBUFS;
238 			goto bad;
239 		}
240 	}
241 	m->m_pkthdr.len = m->m_len = len;
242 	m->m_pkthdr.rcvif = NULL;
243 	*mp = m;
244 	/*
245 	 * Make room for link header.
246 	 */
247 	if (hlen != 0) {
248 		m->m_pkthdr.len -= hlen;
249 		m->m_len -= hlen;
250 #if BSD >= 199103
251 		m->m_data += hlen; /* XXX */
252 #else
253 		m->m_off += hlen;
254 #endif
255 		error = UIOMOVE((caddr_t)sockp->sa_data, hlen, UIO_WRITE, uio);
256 		if (error)
257 			goto bad;
258 	}
259 	error = UIOMOVE(mtod(m, caddr_t), len - hlen, UIO_WRITE, uio);
260 	if (!error)
261 		return (0);
262  bad:
263 	m_freem(m);
264 	return (error);
265 }
266 
267 /*
268  * Attach file to the bpf interface, i.e. make d listen on bp.
269  * Must be called at splimp.
270  */
271 static void
272 bpf_attachd(d, bp)
273 	struct bpf_d *d;
274 	struct bpf_if *bp;
275 {
276 	/*
277 	 * Point d at bp, and add d to the interface's list of listeners.
278 	 * Finally, point the driver's bpf cookie at the interface so
279 	 * it will divert packets to bpf.
280 	 */
281 	d->bd_bif = bp;
282 	d->bd_next = bp->bif_dlist;
283 	bp->bif_dlist = d;
284 
285 	bp->bif_ifp->if_bpf = bp;
286 }
287 
288 /*
289  * Detach a file from its interface.
290  */
291 static void
292 bpf_detachd(d)
293 	struct bpf_d *d;
294 {
295 	struct bpf_d **p;
296 	struct bpf_if *bp;
297 
298 	bp = d->bd_bif;
299 	/*
300 	 * Check if this descriptor had requested promiscuous mode.
301 	 * If so, turn it off.
302 	 */
303 	if (d->bd_promisc) {
304 		d->bd_promisc = 0;
305 		if (ifpromisc(bp->bif_ifp, 0))
306 			/*
307 			 * Something is really wrong if we were able to put
308 			 * the driver into promiscuous mode, but can't
309 			 * take it out.
310 			 */
311 			panic("bpf: ifpromisc failed");
312 	}
313 	/* Remove d from the interface's descriptor list. */
314 	p = &bp->bif_dlist;
315 	while (*p != d) {
316 		p = &(*p)->bd_next;
317 		if (*p == 0)
318 			panic("bpf_detachd: descriptor not in list");
319 	}
320 	*p = (*p)->bd_next;
321 	if (bp->bif_dlist == 0)
322 		/*
323 		 * Let the driver know that there are no more listeners.
324 		 */
325 		d->bd_bif->bif_ifp->if_bpf = 0;
326 	d->bd_bif = 0;
327 }
328 
329 /*
330  * Open ethernet device.  Returns ENXIO for illegal minor device number,
331  * EBUSY if file is open by another process.
332  */
333 /* ARGSUSED */
334 static	int
335 bpfopen(dev, flags, fmt, p)
336 	dev_t dev;
337 	int flags;
338 	int fmt;
339 	struct proc *p;
340 {
341 	register struct bpf_d *d;
342 
343 	if (p->p_prison)
344 		return (EPERM);
345 
346 	d = dev->si_drv1;
347 	/*
348 	 * Each minor can be opened by only one process.  If the requested
349 	 * minor is in use, return EBUSY.
350 	 */
351 	if (d)
352 		return (EBUSY);
353 	make_dev(&bpf_cdevsw, minor(dev), 0, 0, 0600, "bpf%d", lminor(dev));
354 	MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK);
355 	bzero(d, sizeof(*d));
356 	dev->si_drv1 = d;
357 	d->bd_bufsize = bpf_bufsize;
358 	d->bd_sig = SIGIO;
359 
360 	return (0);
361 }
362 
363 /*
364  * Close the descriptor by detaching it from its interface,
365  * deallocating its buffers, and marking it free.
366  */
367 /* ARGSUSED */
368 static	int
369 bpfclose(dev, flags, fmt, p)
370 	dev_t dev;
371 	int flags;
372 	int fmt;
373 	struct proc *p;
374 {
375 	register struct bpf_d *d = dev->si_drv1;
376 	register int s;
377 
378 	funsetown(d->bd_sigio);
379 	s = splimp();
380 	if (d->bd_bif)
381 		bpf_detachd(d);
382 	splx(s);
383 	bpf_freed(d);
384 	dev->si_drv1 = 0;
385 	FREE(d, M_BPF);
386 
387 	return (0);
388 }
389 
390 /*
391  * Support for SunOS, which does not have tsleep.
392  */
393 #if BSD < 199103
394 static
395 bpf_timeout(arg)
396 	caddr_t arg;
397 {
398 	struct bpf_d *d = (struct bpf_d *)arg;
399 	d->bd_timedout = 1;
400 	wakeup(arg);
401 }
402 
403 #define BPF_SLEEP(chan, pri, s, t) bpf_sleep((struct bpf_d *)chan)
404 
405 int
406 bpf_sleep(d)
407 	register struct bpf_d *d;
408 {
409 	register int rto = d->bd_rtout;
410 	register int st;
411 
412 	if (rto != 0) {
413 		d->bd_timedout = 0;
414 		timeout(bpf_timeout, (caddr_t)d, rto);
415 	}
416 	st = sleep((caddr_t)d, PRINET|PCATCH);
417 	if (rto != 0) {
418 		if (d->bd_timedout == 0)
419 			untimeout(bpf_timeout, (caddr_t)d);
420 		else if (st == 0)
421 			return EWOULDBLOCK;
422 	}
423 	return (st != 0) ? EINTR : 0;
424 }
425 #else
426 #define BPF_SLEEP tsleep
427 #endif
428 
429 /*
430  * Rotate the packet buffers in descriptor d.  Move the store buffer
431  * into the hold slot, and the free buffer into the store slot.
432  * Zero the length of the new store buffer.
433  */
434 #define ROTATE_BUFFERS(d) \
435 	(d)->bd_hbuf = (d)->bd_sbuf; \
436 	(d)->bd_hlen = (d)->bd_slen; \
437 	(d)->bd_sbuf = (d)->bd_fbuf; \
438 	(d)->bd_slen = 0; \
439 	(d)->bd_fbuf = 0;
440 /*
441  *  bpfread - read next chunk of packets from buffers
442  */
443 static	int
444 bpfread(dev, uio, ioflag)
445 	dev_t dev;
446 	register struct uio *uio;
447 	int ioflag;
448 {
449 	register struct bpf_d *d = dev->si_drv1;
450 	int error;
451 	int s;
452 
453 	/*
454 	 * Restrict application to use a buffer the same size as
455 	 * as kernel buffers.
456 	 */
457 	if (uio->uio_resid != d->bd_bufsize)
458 		return (EINVAL);
459 
460 	s = splimp();
461 	/*
462 	 * If the hold buffer is empty, then do a timed sleep, which
463 	 * ends when the timeout expires or when enough packets
464 	 * have arrived to fill the store buffer.
465 	 */
466 	while (d->bd_hbuf == 0) {
467 		if (d->bd_immediate && d->bd_slen != 0) {
468 			/*
469 			 * A packet(s) either arrived since the previous
470 			 * read or arrived while we were asleep.
471 			 * Rotate the buffers and return what's here.
472 			 */
473 			ROTATE_BUFFERS(d);
474 			break;
475 		}
476 		if (ioflag & IO_NDELAY)
477 			error = EWOULDBLOCK;
478 		else
479 			error = BPF_SLEEP((caddr_t)d, PRINET|PCATCH, "bpf",
480 					  d->bd_rtout);
481 		if (error == EINTR || error == ERESTART) {
482 			splx(s);
483 			return (error);
484 		}
485 		if (error == EWOULDBLOCK) {
486 			/*
487 			 * On a timeout, return what's in the buffer,
488 			 * which may be nothing.  If there is something
489 			 * in the store buffer, we can rotate the buffers.
490 			 */
491 			if (d->bd_hbuf)
492 				/*
493 				 * We filled up the buffer in between
494 				 * getting the timeout and arriving
495 				 * here, so we don't need to rotate.
496 				 */
497 				break;
498 
499 			if (d->bd_slen == 0) {
500 				splx(s);
501 				return (0);
502 			}
503 			ROTATE_BUFFERS(d);
504 			break;
505 		}
506 	}
507 	/*
508 	 * At this point, we know we have something in the hold slot.
509 	 */
510 	splx(s);
511 
512 	/*
513 	 * Move data from hold buffer into user space.
514 	 * We know the entire buffer is transferred since
515 	 * we checked above that the read buffer is bpf_bufsize bytes.
516 	 */
517 	error = UIOMOVE(d->bd_hbuf, d->bd_hlen, UIO_READ, uio);
518 
519 	s = splimp();
520 	d->bd_fbuf = d->bd_hbuf;
521 	d->bd_hbuf = 0;
522 	d->bd_hlen = 0;
523 	splx(s);
524 
525 	return (error);
526 }
527 
528 
529 /*
530  * If there are processes sleeping on this descriptor, wake them up.
531  */
532 static inline void
533 bpf_wakeup(d)
534 	register struct bpf_d *d;
535 {
536 	wakeup((caddr_t)d);
537 	if (d->bd_async && d->bd_sig && d->bd_sigio)
538 		pgsigio(d->bd_sigio, d->bd_sig, 0);
539 
540 #if BSD >= 199103
541 	selwakeup(&d->bd_sel);
542 	/* XXX */
543 	d->bd_sel.si_pid = 0;
544 #else
545 	if (d->bd_selproc) {
546 		selwakeup(d->bd_selproc, (int)d->bd_selcoll);
547 		d->bd_selcoll = 0;
548 		d->bd_selproc = 0;
549 	}
550 #endif
551 }
552 
553 static	int
554 bpfwrite(dev, uio, ioflag)
555 	dev_t dev;
556 	struct uio *uio;
557 	int ioflag;
558 {
559 	register struct bpf_d *d = dev->si_drv1;
560 	struct ifnet *ifp;
561 	struct mbuf *m;
562 	int error, s;
563 	static struct sockaddr dst;
564 	int datlen;
565 
566 	if (d->bd_bif == 0)
567 		return (ENXIO);
568 
569 	ifp = d->bd_bif->bif_ifp;
570 
571 	if (uio->uio_resid == 0)
572 		return (0);
573 
574 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, &m, &dst, &datlen);
575 	if (error)
576 		return (error);
577 
578 	if (datlen > ifp->if_mtu)
579 		return (EMSGSIZE);
580 
581 	if (d->bd_hdrcmplt)
582 		dst.sa_family = pseudo_AF_HDRCMPLT;
583 
584 	s = splnet();
585 #if BSD >= 199103
586 	error = (*ifp->if_output)(ifp, m, &dst, (struct rtentry *)0);
587 #else
588 	error = (*ifp->if_output)(ifp, m, &dst);
589 #endif
590 	splx(s);
591 	/*
592 	 * The driver frees the mbuf.
593 	 */
594 	return (error);
595 }
596 
597 /*
598  * Reset a descriptor by flushing its packet buffer and clearing the
599  * receive and drop counts.  Should be called at splimp.
600  */
601 static void
602 reset_d(d)
603 	struct bpf_d *d;
604 {
605 	if (d->bd_hbuf) {
606 		/* Free the hold buffer. */
607 		d->bd_fbuf = d->bd_hbuf;
608 		d->bd_hbuf = 0;
609 	}
610 	d->bd_slen = 0;
611 	d->bd_hlen = 0;
612 	d->bd_rcount = 0;
613 	d->bd_dcount = 0;
614 }
615 
616 /*
617  *  FIONREAD		Check for read packet available.
618  *  SIOCGIFADDR		Get interface address - convenient hook to driver.
619  *  BIOCGBLEN		Get buffer len [for read()].
620  *  BIOCSETF		Set ethernet read filter.
621  *  BIOCFLUSH		Flush read packet buffer.
622  *  BIOCPROMISC		Put interface into promiscuous mode.
623  *  BIOCGDLT		Get link layer type.
624  *  BIOCGETIF		Get interface name.
625  *  BIOCSETIF		Set interface.
626  *  BIOCSRTIMEOUT	Set read timeout.
627  *  BIOCGRTIMEOUT	Get read timeout.
628  *  BIOCGSTATS		Get packet stats.
629  *  BIOCIMMEDIATE	Set immediate mode.
630  *  BIOCVERSION		Get filter language version.
631  *  BIOCGHDRCMPLT	Get "header already complete" flag
632  *  BIOCSHDRCMPLT	Set "header already complete" flag
633  */
634 /* ARGSUSED */
635 static	int
636 bpfioctl(dev, cmd, addr, flags, p)
637 	dev_t dev;
638 	u_long cmd;
639 	caddr_t addr;
640 	int flags;
641 	struct proc *p;
642 {
643 	register struct bpf_d *d = dev->si_drv1;
644 	int s, error = 0;
645 
646 	switch (cmd) {
647 
648 	default:
649 		error = EINVAL;
650 		break;
651 
652 	/*
653 	 * Check for read packet available.
654 	 */
655 	case FIONREAD:
656 		{
657 			int n;
658 
659 			s = splimp();
660 			n = d->bd_slen;
661 			if (d->bd_hbuf)
662 				n += d->bd_hlen;
663 			splx(s);
664 
665 			*(int *)addr = n;
666 			break;
667 		}
668 
669 	case SIOCGIFADDR:
670 		{
671 			struct ifnet *ifp;
672 
673 			if (d->bd_bif == 0)
674 				error = EINVAL;
675 			else {
676 				ifp = d->bd_bif->bif_ifp;
677 				error = (*ifp->if_ioctl)(ifp, cmd, addr);
678 			}
679 			break;
680 		}
681 
682 	/*
683 	 * Get buffer len [for read()].
684 	 */
685 	case BIOCGBLEN:
686 		*(u_int *)addr = d->bd_bufsize;
687 		break;
688 
689 	/*
690 	 * Set buffer length.
691 	 */
692 	case BIOCSBLEN:
693 #if BSD < 199103
694 		error = EINVAL;
695 #else
696 		if (d->bd_bif != 0)
697 			error = EINVAL;
698 		else {
699 			register u_int size = *(u_int *)addr;
700 
701 			if (size > BPF_MAXBUFSIZE)
702 				*(u_int *)addr = size = BPF_MAXBUFSIZE;
703 			else if (size < BPF_MINBUFSIZE)
704 				*(u_int *)addr = size = BPF_MINBUFSIZE;
705 			d->bd_bufsize = size;
706 		}
707 #endif
708 		break;
709 
710 	/*
711 	 * Set link layer read filter.
712 	 */
713 	case BIOCSETF:
714 		error = bpf_setf(d, (struct bpf_program *)addr);
715 		break;
716 
717 	/*
718 	 * Flush read packet buffer.
719 	 */
720 	case BIOCFLUSH:
721 		s = splimp();
722 		reset_d(d);
723 		splx(s);
724 		break;
725 
726 	/*
727 	 * Put interface into promiscuous mode.
728 	 */
729 	case BIOCPROMISC:
730 		if (d->bd_bif == 0) {
731 			/*
732 			 * No interface attached yet.
733 			 */
734 			error = EINVAL;
735 			break;
736 		}
737 		s = splimp();
738 		if (d->bd_promisc == 0) {
739 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
740 			if (error == 0)
741 				d->bd_promisc = 1;
742 		}
743 		splx(s);
744 		break;
745 
746 	/*
747 	 * Get device parameters.
748 	 */
749 	case BIOCGDLT:
750 		if (d->bd_bif == 0)
751 			error = EINVAL;
752 		else
753 			*(u_int *)addr = d->bd_bif->bif_dlt;
754 		break;
755 
756 	/*
757 	 * Get interface name.
758 	 */
759 	case BIOCGETIF:
760 		if (d->bd_bif == 0)
761 			error = EINVAL;
762 		else {
763 			struct ifnet *const ifp = d->bd_bif->bif_ifp;
764 			struct ifreq *const ifr = (struct ifreq *)addr;
765 
766 			snprintf(ifr->ifr_name, sizeof(ifr->ifr_name),
767 			    "%s%d", ifp->if_name, ifp->if_unit);
768 		}
769 		break;
770 
771 	/*
772 	 * Set interface.
773 	 */
774 	case BIOCSETIF:
775 		error = bpf_setif(d, (struct ifreq *)addr);
776 		break;
777 
778 	/*
779 	 * Set read timeout.
780 	 */
781 	case BIOCSRTIMEOUT:
782 		{
783 			struct timeval *tv = (struct timeval *)addr;
784 
785 			/*
786 			 * Subtract 1 tick from tvtohz() since this isn't
787 			 * a one-shot timer.
788 			 */
789 			if ((error = itimerfix(tv)) == 0)
790 				d->bd_rtout = tvtohz(tv) - 1;
791 			break;
792 		}
793 
794 	/*
795 	 * Get read timeout.
796 	 */
797 	case BIOCGRTIMEOUT:
798 		{
799 			struct timeval *tv = (struct timeval *)addr;
800 
801 			tv->tv_sec = d->bd_rtout / hz;
802 			tv->tv_usec = (d->bd_rtout % hz) * tick;
803 			break;
804 		}
805 
806 	/*
807 	 * Get packet stats.
808 	 */
809 	case BIOCGSTATS:
810 		{
811 			struct bpf_stat *bs = (struct bpf_stat *)addr;
812 
813 			bs->bs_recv = d->bd_rcount;
814 			bs->bs_drop = d->bd_dcount;
815 			break;
816 		}
817 
818 	/*
819 	 * Set immediate mode.
820 	 */
821 	case BIOCIMMEDIATE:
822 		d->bd_immediate = *(u_int *)addr;
823 		break;
824 
825 	case BIOCVERSION:
826 		{
827 			struct bpf_version *bv = (struct bpf_version *)addr;
828 
829 			bv->bv_major = BPF_MAJOR_VERSION;
830 			bv->bv_minor = BPF_MINOR_VERSION;
831 			break;
832 		}
833 
834 	/*
835 	 * Get "header already complete" flag
836 	 */
837 	case BIOCGHDRCMPLT:
838 		*(u_int *)addr = d->bd_hdrcmplt;
839 		break;
840 
841 	/*
842 	 * Set "header already complete" flag
843 	 */
844 	case BIOCSHDRCMPLT:
845 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
846 		break;
847 
848 	case FIONBIO:		/* Non-blocking I/O */
849 		break;
850 
851 	case FIOASYNC:		/* Send signal on receive packets */
852 		d->bd_async = *(int *)addr;
853 		break;
854 
855 	case FIOSETOWN:
856 		error = fsetown(*(int *)addr, &d->bd_sigio);
857 		break;
858 
859 	case FIOGETOWN:
860 		*(int *)addr = fgetown(d->bd_sigio);
861 		break;
862 
863 	/* This is deprecated, FIOSETOWN should be used instead. */
864 	case TIOCSPGRP:
865 		error = fsetown(-(*(int *)addr), &d->bd_sigio);
866 		break;
867 
868 	/* This is deprecated, FIOGETOWN should be used instead. */
869 	case TIOCGPGRP:
870 		*(int *)addr = -fgetown(d->bd_sigio);
871 		break;
872 
873 	case BIOCSRSIG:		/* Set receive signal */
874 		{
875 		 	u_int sig;
876 
877 			sig = *(u_int *)addr;
878 
879 			if (sig >= NSIG)
880 				error = EINVAL;
881 			else
882 				d->bd_sig = sig;
883 			break;
884 		}
885 	case BIOCGRSIG:
886 		*(u_int *)addr = d->bd_sig;
887 		break;
888 	}
889 	return (error);
890 }
891 
892 /*
893  * Set d's packet filter program to fp.  If this file already has a filter,
894  * free it and replace it.  Returns EINVAL for bogus requests.
895  */
896 static int
897 bpf_setf(d, fp)
898 	struct bpf_d *d;
899 	struct bpf_program *fp;
900 {
901 	struct bpf_insn *fcode, *old;
902 	u_int flen, size;
903 	int s;
904 
905 	old = d->bd_filter;
906 	if (fp->bf_insns == 0) {
907 		if (fp->bf_len != 0)
908 			return (EINVAL);
909 		s = splimp();
910 		d->bd_filter = 0;
911 		reset_d(d);
912 		splx(s);
913 		if (old != 0)
914 			free((caddr_t)old, M_BPF);
915 		return (0);
916 	}
917 	flen = fp->bf_len;
918 	if (flen > BPF_MAXINSNS)
919 		return (EINVAL);
920 
921 	size = flen * sizeof(*fp->bf_insns);
922 	fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
923 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
924 	    bpf_validate(fcode, (int)flen)) {
925 		s = splimp();
926 		d->bd_filter = fcode;
927 		reset_d(d);
928 		splx(s);
929 		if (old != 0)
930 			free((caddr_t)old, M_BPF);
931 
932 		return (0);
933 	}
934 	free((caddr_t)fcode, M_BPF);
935 	return (EINVAL);
936 }
937 
938 /*
939  * Detach a file from its current interface (if attached at all) and attach
940  * to the interface indicated by the name stored in ifr.
941  * Return an errno or 0.
942  */
943 static int
944 bpf_setif(d, ifr)
945 	struct bpf_d *d;
946 	struct ifreq *ifr;
947 {
948 	struct bpf_if *bp;
949 	int s, error;
950 	struct ifnet *theywant;
951 
952 	theywant = ifunit(ifr->ifr_name);
953 	if (theywant == 0)
954 		return ENXIO;
955 
956 	/*
957 	 * Look through attached interfaces for the named one.
958 	 */
959 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
960 		struct ifnet *ifp = bp->bif_ifp;
961 
962 		if (ifp == 0 || ifp != theywant)
963 			continue;
964 		/*
965 		 * We found the requested interface.
966 		 * If it's not up, return an error.
967 		 * Allocate the packet buffers if we need to.
968 		 * If we're already attached to requested interface,
969 		 * just flush the buffer.
970 		 */
971 		if ((ifp->if_flags & IFF_UP) == 0)
972 			return (ENETDOWN);
973 
974 		if (d->bd_sbuf == 0) {
975 			error = bpf_allocbufs(d);
976 			if (error != 0)
977 				return (error);
978 		}
979 		s = splimp();
980 		if (bp != d->bd_bif) {
981 			if (d->bd_bif)
982 				/*
983 				 * Detach if attached to something else.
984 				 */
985 				bpf_detachd(d);
986 
987 			bpf_attachd(d, bp);
988 		}
989 		reset_d(d);
990 		splx(s);
991 		return (0);
992 	}
993 	/* Not found. */
994 	return (ENXIO);
995 }
996 
997 /*
998  * Support for select() and poll() system calls
999  *
1000  * Return true iff the specific operation will not block indefinitely.
1001  * Otherwise, return false but make a note that a selwakeup() must be done.
1002  */
1003 int
1004 bpfpoll(dev, events, p)
1005 	register dev_t dev;
1006 	int events;
1007 	struct proc *p;
1008 {
1009 	register struct bpf_d *d;
1010 	register int s;
1011 	int revents = 0;
1012 
1013 	/*
1014 	 * An imitation of the FIONREAD ioctl code.
1015 	 */
1016 	d = dev->si_drv1;
1017 
1018 	s = splimp();
1019 	if (events & (POLLIN | POLLRDNORM)) {
1020 		if (d->bd_hlen != 0 || (d->bd_immediate && d->bd_slen != 0))
1021 			revents |= events & (POLLIN | POLLRDNORM);
1022 		else
1023 			selrecord(p, &d->bd_sel);
1024 	}
1025 	splx(s);
1026 	return (revents);
1027 }
1028 
1029 /*
1030  * Incoming linkage from device drivers.  Process the packet pkt, of length
1031  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1032  * by each process' filter, and if accepted, stashed into the corresponding
1033  * buffer.
1034  */
1035 void
1036 bpf_tap(ifp, pkt, pktlen)
1037 	struct ifnet *ifp;
1038 	register u_char *pkt;
1039 	register u_int pktlen;
1040 {
1041 	struct bpf_if *bp;
1042 	register struct bpf_d *d;
1043 	register u_int slen;
1044 	/*
1045 	 * Note that the ipl does not have to be raised at this point.
1046 	 * The only problem that could arise here is that if two different
1047 	 * interfaces shared any data.  This is not the case.
1048 	 */
1049 	bp = ifp->if_bpf;
1050 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1051 		++d->bd_rcount;
1052 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1053 		if (slen != 0)
1054 			catchpacket(d, pkt, pktlen, slen, bcopy);
1055 	}
1056 }
1057 
1058 /*
1059  * Copy data from an mbuf chain into a buffer.  This code is derived
1060  * from m_copydata in sys/uipc_mbuf.c.
1061  */
1062 static void
1063 bpf_mcopy(src_arg, dst_arg, len)
1064 	const void *src_arg;
1065 	void *dst_arg;
1066 	register size_t len;
1067 {
1068 	register const struct mbuf *m;
1069 	register u_int count;
1070 	u_char *dst;
1071 
1072 	m = src_arg;
1073 	dst = dst_arg;
1074 	while (len > 0) {
1075 		if (m == 0)
1076 			panic("bpf_mcopy");
1077 		count = min(m->m_len, len);
1078 		bcopy(mtod(m, void *), dst, count);
1079 		m = m->m_next;
1080 		dst += count;
1081 		len -= count;
1082 	}
1083 }
1084 
1085 /*
1086  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1087  */
1088 void
1089 bpf_mtap(ifp, m)
1090 	struct ifnet *ifp;
1091 	struct mbuf *m;
1092 {
1093 	struct bpf_if *bp = ifp->if_bpf;
1094 	struct bpf_d *d;
1095 	u_int pktlen, slen;
1096 	struct mbuf *m0;
1097 
1098 	pktlen = 0;
1099 	for (m0 = m; m0 != 0; m0 = m0->m_next)
1100 		pktlen += m0->m_len;
1101 
1102 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1103 		++d->bd_rcount;
1104 		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1105 		if (slen != 0)
1106 			catchpacket(d, (u_char *)m, pktlen, slen, bpf_mcopy);
1107 	}
1108 }
1109 
1110 /*
1111  * Move the packet data from interface memory (pkt) into the
1112  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1113  * otherwise 0.  "copy" is the routine called to do the actual data
1114  * transfer.  bcopy is passed in to copy contiguous chunks, while
1115  * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1116  * pkt is really an mbuf.
1117  */
1118 static void
1119 catchpacket(d, pkt, pktlen, snaplen, cpfn)
1120 	register struct bpf_d *d;
1121 	register u_char *pkt;
1122 	register u_int pktlen, snaplen;
1123 	register void (*cpfn) __P((const void *, void *, size_t));
1124 {
1125 	register struct bpf_hdr *hp;
1126 	register int totlen, curlen;
1127 	register int hdrlen = d->bd_bif->bif_hdrlen;
1128 	/*
1129 	 * Figure out how many bytes to move.  If the packet is
1130 	 * greater or equal to the snapshot length, transfer that
1131 	 * much.  Otherwise, transfer the whole packet (unless
1132 	 * we hit the buffer size limit).
1133 	 */
1134 	totlen = hdrlen + min(snaplen, pktlen);
1135 	if (totlen > d->bd_bufsize)
1136 		totlen = d->bd_bufsize;
1137 
1138 	/*
1139 	 * Round up the end of the previous packet to the next longword.
1140 	 */
1141 	curlen = BPF_WORDALIGN(d->bd_slen);
1142 	if (curlen + totlen > d->bd_bufsize) {
1143 		/*
1144 		 * This packet will overflow the storage buffer.
1145 		 * Rotate the buffers if we can, then wakeup any
1146 		 * pending reads.
1147 		 */
1148 		if (d->bd_fbuf == 0) {
1149 			/*
1150 			 * We haven't completed the previous read yet,
1151 			 * so drop the packet.
1152 			 */
1153 			++d->bd_dcount;
1154 			return;
1155 		}
1156 		ROTATE_BUFFERS(d);
1157 		bpf_wakeup(d);
1158 		curlen = 0;
1159 	}
1160 	else if (d->bd_immediate)
1161 		/*
1162 		 * Immediate mode is set.  A packet arrived so any
1163 		 * reads should be woken up.
1164 		 */
1165 		bpf_wakeup(d);
1166 
1167 	/*
1168 	 * Append the bpf header.
1169 	 */
1170 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1171 #if BSD >= 199103
1172 	microtime(&hp->bh_tstamp);
1173 #elif defined(sun)
1174 	uniqtime(&hp->bh_tstamp);
1175 #else
1176 	hp->bh_tstamp = time;
1177 #endif
1178 	hp->bh_datalen = pktlen;
1179 	hp->bh_hdrlen = hdrlen;
1180 	/*
1181 	 * Copy the packet data into the store buffer and update its length.
1182 	 */
1183 	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1184 	d->bd_slen = curlen + totlen;
1185 }
1186 
1187 /*
1188  * Initialize all nonzero fields of a descriptor.
1189  */
1190 static int
1191 bpf_allocbufs(d)
1192 	register struct bpf_d *d;
1193 {
1194 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1195 	if (d->bd_fbuf == 0)
1196 		return (ENOBUFS);
1197 
1198 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1199 	if (d->bd_sbuf == 0) {
1200 		free(d->bd_fbuf, M_BPF);
1201 		return (ENOBUFS);
1202 	}
1203 	d->bd_slen = 0;
1204 	d->bd_hlen = 0;
1205 	return (0);
1206 }
1207 
1208 /*
1209  * Free buffers currently in use by a descriptor.
1210  * Called on close.
1211  */
1212 static void
1213 bpf_freed(d)
1214 	register struct bpf_d *d;
1215 {
1216 	/*
1217 	 * We don't need to lock out interrupts since this descriptor has
1218 	 * been detached from its interface and it yet hasn't been marked
1219 	 * free.
1220 	 */
1221 	if (d->bd_sbuf != 0) {
1222 		free(d->bd_sbuf, M_BPF);
1223 		if (d->bd_hbuf != 0)
1224 			free(d->bd_hbuf, M_BPF);
1225 		if (d->bd_fbuf != 0)
1226 			free(d->bd_fbuf, M_BPF);
1227 	}
1228 	if (d->bd_filter)
1229 		free((caddr_t)d->bd_filter, M_BPF);
1230 }
1231 
1232 /*
1233  * Attach an interface to bpf.  driverp is a pointer to a (struct bpf_if *)
1234  * in the driver's softc; dlt is the link layer type; hdrlen is the fixed
1235  * size of the link header (variable length headers not yet supported).
1236  */
1237 void
1238 bpfattach(ifp, dlt, hdrlen)
1239 	struct ifnet *ifp;
1240 	u_int dlt, hdrlen;
1241 {
1242 	struct bpf_if *bp;
1243 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_BPF, M_DONTWAIT);
1244 	if (bp == 0)
1245 		panic("bpfattach");
1246 
1247 	bp->bif_dlist = 0;
1248 	bp->bif_ifp = ifp;
1249 	bp->bif_dlt = dlt;
1250 
1251 	bp->bif_next = bpf_iflist;
1252 	bpf_iflist = bp;
1253 
1254 	bp->bif_ifp->if_bpf = 0;
1255 
1256 	/*
1257 	 * Compute the length of the bpf header.  This is not necessarily
1258 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1259 	 * that the network layer header begins on a longword boundary (for
1260 	 * performance reasons and to alleviate alignment restrictions).
1261 	 */
1262 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1263 
1264 	if (bootverbose)
1265 		printf("bpf: %s%d attached\n", ifp->if_name, ifp->if_unit);
1266 }
1267 
1268 static void bpf_drvinit __P((void *unused));
1269 
1270 static void
1271 bpf_drvinit(unused)
1272 	void *unused;
1273 {
1274 
1275 	cdevsw_add(&bpf_cdevsw);
1276 }
1277 
1278 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,bpf_drvinit,NULL)
1279 
1280 #else /* !BPF */
1281 /*
1282  * NOP stubs to allow bpf-using drivers to load and function.
1283  *
1284  * A 'better' implementation would allow the core bpf functionality
1285  * to be loaded at runtime.
1286  */
1287 
1288 void
1289 bpf_tap(ifp, pkt, pktlen)
1290 	struct ifnet *ifp;
1291 	register u_char *pkt;
1292 	register u_int pktlen;
1293 {
1294 }
1295 
1296 void
1297 bpf_mtap(ifp, m)
1298 	struct ifnet *ifp;
1299 	struct mbuf *m;
1300 {
1301 }
1302 
1303 void
1304 bpfattach(ifp, dlt, hdrlen)
1305 	struct ifnet *ifp;
1306 	u_int dlt, hdrlen;
1307 {
1308 }
1309 
1310 u_int
1311 bpf_filter(pc, p, wirelen, buflen)
1312 	register const struct bpf_insn *pc;
1313 	register u_char *p;
1314 	u_int wirelen;
1315 	register u_int buflen;
1316 {
1317 	return -1;	/* "no filter" behaviour */
1318 }
1319 
1320 #endif /* !BPF */
1321