xref: /freebsd/sys/net/bpf.c (revision 7562eaabc01a48e6b11d5b558c41e3b92dae5c2d)
1 /*
2  * Copyright (c) 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *      @(#)bpf.c	8.4 (Berkeley) 1/9/95
35  *
36  * $FreeBSD$
37  */
38 
39 #include "opt_bpf.h"
40 #include "opt_mac.h"
41 #include "opt_netgraph.h"
42 
43 #include <sys/types.h>
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/conf.h>
47 #include <sys/mac.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 #include <sys/time.h>
51 #include <sys/proc.h>
52 #include <sys/signalvar.h>
53 #include <sys/filio.h>
54 #include <sys/sockio.h>
55 #include <sys/ttycom.h>
56 #include <sys/filedesc.h>
57 
58 #include <sys/event.h>
59 #include <sys/file.h>
60 #include <sys/poll.h>
61 #include <sys/proc.h>
62 
63 #include <sys/socket.h>
64 #include <sys/vnode.h>
65 
66 #include <net/if.h>
67 #include <net/bpf.h>
68 #include <net/bpfdesc.h>
69 
70 #include <netinet/in.h>
71 #include <netinet/if_ether.h>
72 #include <sys/kernel.h>
73 #include <sys/sysctl.h>
74 
75 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
76 
77 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)
78 
79 #define PRINET  26			/* interruptible */
80 
81 /*
82  * The default read buffer size is patchable.
83  */
84 static int bpf_bufsize = 4096;
85 SYSCTL_INT(_debug, OID_AUTO, bpf_bufsize, CTLFLAG_RW,
86 	&bpf_bufsize, 0, "");
87 static int bpf_maxbufsize = BPF_MAXBUFSIZE;
88 SYSCTL_INT(_debug, OID_AUTO, bpf_maxbufsize, CTLFLAG_RW,
89 	&bpf_maxbufsize, 0, "");
90 
91 /*
92  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
93  */
94 static LIST_HEAD(, bpf_if)	bpf_iflist;
95 static struct mtx	bpf_mtx;		/* bpf global lock */
96 
97 static int	bpf_allocbufs(struct bpf_d *);
98 static void	bpf_attachd(struct bpf_d *d, struct bpf_if *bp);
99 static void	bpf_detachd(struct bpf_d *d);
100 static void	bpf_freed(struct bpf_d *);
101 static void	bpf_mcopy(const void *, void *, size_t);
102 static int	bpf_movein(struct uio *, int,
103 		    struct mbuf **, struct sockaddr *, int *);
104 static int	bpf_setif(struct bpf_d *, struct ifreq *);
105 static void	bpf_timed_out(void *);
106 static __inline void
107 		bpf_wakeup(struct bpf_d *);
108 static void	catchpacket(struct bpf_d *, u_char *, u_int,
109 		    u_int, void (*)(const void *, void *, size_t));
110 static void	reset_d(struct bpf_d *);
111 static int	 bpf_setf(struct bpf_d *, struct bpf_program *);
112 static int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
113 static int	bpf_setdlt(struct bpf_d *, u_int);
114 static void	filt_bpfdetach(struct knote *);
115 static int	filt_bpfread(struct knote *, long);
116 
117 static	d_open_t	bpfopen;
118 static	d_close_t	bpfclose;
119 static	d_read_t	bpfread;
120 static	d_write_t	bpfwrite;
121 static	d_ioctl_t	bpfioctl;
122 static	d_poll_t	bpfpoll;
123 static	d_kqfilter_t	bpfkqfilter;
124 
125 static struct cdevsw bpf_cdevsw = {
126 	.d_version =	D_VERSION,
127 	.d_flags =	D_NEEDGIANT,
128 	.d_open =	bpfopen,
129 	.d_close =	bpfclose,
130 	.d_read =	bpfread,
131 	.d_write =	bpfwrite,
132 	.d_ioctl =	bpfioctl,
133 	.d_poll =	bpfpoll,
134 	.d_name =	"bpf",
135 	.d_kqfilter =	bpfkqfilter,
136 };
137 
138 static struct filterops bpfread_filtops =
139 	{ 1, NULL, filt_bpfdetach, filt_bpfread };
140 
141 static int
142 bpf_movein(uio, linktype, mp, sockp, datlen)
143 	struct uio *uio;
144 	int linktype, *datlen;
145 	struct mbuf **mp;
146 	struct sockaddr *sockp;
147 {
148 	struct mbuf *m;
149 	int error;
150 	int len;
151 	int hlen;
152 
153 	/*
154 	 * Build a sockaddr based on the data link layer type.
155 	 * We do this at this level because the ethernet header
156 	 * is copied directly into the data field of the sockaddr.
157 	 * In the case of SLIP, there is no header and the packet
158 	 * is forwarded as is.
159 	 * Also, we are careful to leave room at the front of the mbuf
160 	 * for the link level header.
161 	 */
162 	switch (linktype) {
163 
164 	case DLT_SLIP:
165 		sockp->sa_family = AF_INET;
166 		hlen = 0;
167 		break;
168 
169 	case DLT_EN10MB:
170 		sockp->sa_family = AF_UNSPEC;
171 		/* XXX Would MAXLINKHDR be better? */
172 		hlen = ETHER_HDR_LEN;
173 		break;
174 
175 	case DLT_FDDI:
176 		sockp->sa_family = AF_IMPLINK;
177 		hlen = 0;
178 		break;
179 
180 	case DLT_RAW:
181 	case DLT_NULL:
182 		sockp->sa_family = AF_UNSPEC;
183 		hlen = 0;
184 		break;
185 
186 	case DLT_ATM_RFC1483:
187 		/*
188 		 * en atm driver requires 4-byte atm pseudo header.
189 		 * though it isn't standard, vpi:vci needs to be
190 		 * specified anyway.
191 		 */
192 		sockp->sa_family = AF_UNSPEC;
193 		hlen = 12;	/* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
194 		break;
195 
196 	case DLT_PPP:
197 		sockp->sa_family = AF_UNSPEC;
198 		hlen = 4;	/* This should match PPP_HDRLEN */
199 		break;
200 
201 	default:
202 		return (EIO);
203 	}
204 
205 	len = uio->uio_resid;
206 	*datlen = len - hlen;
207 	if ((unsigned)len > MCLBYTES)
208 		return (EIO);
209 
210 	if (len > MHLEN) {
211 		m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR);
212 	} else {
213 		MGETHDR(m, M_TRYWAIT, MT_DATA);
214 	}
215 	if (m == NULL)
216 		return (ENOBUFS);
217 	m->m_pkthdr.len = m->m_len = len;
218 	m->m_pkthdr.rcvif = NULL;
219 	*mp = m;
220 
221 	/*
222 	 * Make room for link header.
223 	 */
224 	if (hlen != 0) {
225 		m->m_pkthdr.len -= hlen;
226 		m->m_len -= hlen;
227 #if BSD >= 199103
228 		m->m_data += hlen; /* XXX */
229 #else
230 		m->m_off += hlen;
231 #endif
232 		error = uiomove(sockp->sa_data, hlen, uio);
233 		if (error)
234 			goto bad;
235 	}
236 	error = uiomove(mtod(m, void *), len - hlen, uio);
237 	if (!error)
238 		return (0);
239 bad:
240 	m_freem(m);
241 	return (error);
242 }
243 
244 /*
245  * Attach file to the bpf interface, i.e. make d listen on bp.
246  */
247 static void
248 bpf_attachd(d, bp)
249 	struct bpf_d *d;
250 	struct bpf_if *bp;
251 {
252 	/*
253 	 * Point d at bp, and add d to the interface's list of listeners.
254 	 * Finally, point the driver's bpf cookie at the interface so
255 	 * it will divert packets to bpf.
256 	 */
257 	BPFIF_LOCK(bp);
258 	d->bd_bif = bp;
259 	LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
260 
261 	*bp->bif_driverp = bp;
262 	BPFIF_UNLOCK(bp);
263 }
264 
265 /*
266  * Detach a file from its interface.
267  */
268 static void
269 bpf_detachd(d)
270 	struct bpf_d *d;
271 {
272 	int error;
273 	struct bpf_if *bp;
274 	struct ifnet *ifp;
275 
276 	bp = d->bd_bif;
277 	BPFIF_LOCK(bp);
278 	BPFD_LOCK(d);
279 	ifp = d->bd_bif->bif_ifp;
280 
281 	/*
282 	 * Remove d from the interface's descriptor list.
283 	 */
284 	LIST_REMOVE(d, bd_next);
285 
286 	/*
287 	 * Let the driver know that there are no more listeners.
288 	 */
289 	if (LIST_EMPTY(&bp->bif_dlist))
290 		*bp->bif_driverp = NULL;
291 
292 	d->bd_bif = NULL;
293 	BPFD_UNLOCK(d);
294 	BPFIF_UNLOCK(bp);
295 
296 	/*
297 	 * Check if this descriptor had requested promiscuous mode.
298 	 * If so, turn it off.
299 	 */
300 	if (d->bd_promisc) {
301 		d->bd_promisc = 0;
302 		error = ifpromisc(ifp, 0);
303 		if (error != 0 && error != ENXIO) {
304 			/*
305 			 * ENXIO can happen if a pccard is unplugged
306 			 * Something is really wrong if we were able to put
307 			 * the driver into promiscuous mode, but can't
308 			 * take it out.
309 			 */
310 			if_printf(bp->bif_ifp,
311 				"bpf_detach: ifpromisc failed (%d)\n", error);
312 		}
313 	}
314 }
315 
316 /*
317  * Open ethernet device.  Returns ENXIO for illegal minor device number,
318  * EBUSY if file is open by another process.
319  */
320 /* ARGSUSED */
321 static	int
322 bpfopen(dev, flags, fmt, td)
323 	struct cdev *dev;
324 	int flags;
325 	int fmt;
326 	struct thread *td;
327 {
328 	struct bpf_d *d;
329 
330 	mtx_lock(&bpf_mtx);
331 	d = dev->si_drv1;
332 	/*
333 	 * Each minor can be opened by only one process.  If the requested
334 	 * minor is in use, return EBUSY.
335 	 */
336 	if (d != NULL) {
337 		mtx_unlock(&bpf_mtx);
338 		return (EBUSY);
339 	}
340 	dev->si_drv1 = (struct bpf_d *)~0;	/* mark device in use */
341 	mtx_unlock(&bpf_mtx);
342 
343 	if ((dev->si_flags & SI_NAMED) == 0)
344 		make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600,
345 		    "bpf%d", dev2unit(dev));
346 	MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK | M_ZERO);
347 	dev->si_drv1 = d;
348 	d->bd_bufsize = bpf_bufsize;
349 	d->bd_sig = SIGIO;
350 	d->bd_seesent = 1;
351 #ifdef MAC
352 	mac_init_bpfdesc(d);
353 	mac_create_bpfdesc(td->td_ucred, d);
354 #endif
355 	mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
356 	callout_init(&d->bd_callout, debug_mpsafenet ? CALLOUT_MPSAFE : 0);
357 	knlist_init(&d->bd_sel.si_note, &d->bd_mtx);
358 
359 	return (0);
360 }
361 
362 /*
363  * Close the descriptor by detaching it from its interface,
364  * deallocating its buffers, and marking it free.
365  */
366 /* ARGSUSED */
367 static	int
368 bpfclose(dev, flags, fmt, td)
369 	struct cdev *dev;
370 	int flags;
371 	int fmt;
372 	struct thread *td;
373 {
374 	struct bpf_d *d = dev->si_drv1;
375 
376 	BPFD_LOCK(d);
377 	if (d->bd_state == BPF_WAITING)
378 		callout_stop(&d->bd_callout);
379 	d->bd_state = BPF_IDLE;
380 	BPFD_UNLOCK(d);
381 	funsetown(&d->bd_sigio);
382 	mtx_lock(&bpf_mtx);
383 	if (d->bd_bif)
384 		bpf_detachd(d);
385 	mtx_unlock(&bpf_mtx);
386 #ifdef MAC
387 	mac_destroy_bpfdesc(d);
388 #endif /* MAC */
389 	knlist_destroy(&d->bd_sel.si_note);
390 	bpf_freed(d);
391 	dev->si_drv1 = NULL;
392 	free(d, M_BPF);
393 
394 	return (0);
395 }
396 
397 
398 /*
399  * Rotate the packet buffers in descriptor d.  Move the store buffer
400  * into the hold slot, and the free buffer into the store slot.
401  * Zero the length of the new store buffer.
402  */
403 #define ROTATE_BUFFERS(d) \
404 	(d)->bd_hbuf = (d)->bd_sbuf; \
405 	(d)->bd_hlen = (d)->bd_slen; \
406 	(d)->bd_sbuf = (d)->bd_fbuf; \
407 	(d)->bd_slen = 0; \
408 	(d)->bd_fbuf = NULL;
409 /*
410  *  bpfread - read next chunk of packets from buffers
411  */
412 static	int
413 bpfread(dev, uio, ioflag)
414 	struct cdev *dev;
415 	struct uio *uio;
416 	int ioflag;
417 {
418 	struct bpf_d *d = dev->si_drv1;
419 	int timed_out;
420 	int error;
421 
422 	/*
423 	 * Restrict application to use a buffer the same size as
424 	 * as kernel buffers.
425 	 */
426 	if (uio->uio_resid != d->bd_bufsize)
427 		return (EINVAL);
428 
429 	BPFD_LOCK(d);
430 	if (d->bd_state == BPF_WAITING)
431 		callout_stop(&d->bd_callout);
432 	timed_out = (d->bd_state == BPF_TIMED_OUT);
433 	d->bd_state = BPF_IDLE;
434 	/*
435 	 * If the hold buffer is empty, then do a timed sleep, which
436 	 * ends when the timeout expires or when enough packets
437 	 * have arrived to fill the store buffer.
438 	 */
439 	while (d->bd_hbuf == NULL) {
440 		if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
441 			/*
442 			 * A packet(s) either arrived since the previous
443 			 * read or arrived while we were asleep.
444 			 * Rotate the buffers and return what's here.
445 			 */
446 			ROTATE_BUFFERS(d);
447 			break;
448 		}
449 
450 		/*
451 		 * No data is available, check to see if the bpf device
452 		 * is still pointed at a real interface.  If not, return
453 		 * ENXIO so that the userland process knows to rebind
454 		 * it before using it again.
455 		 */
456 		if (d->bd_bif == NULL) {
457 			BPFD_UNLOCK(d);
458 			return (ENXIO);
459 		}
460 
461 		if (ioflag & IO_NDELAY) {
462 			BPFD_UNLOCK(d);
463 			return (EWOULDBLOCK);
464 		}
465 		error = msleep(d, &d->bd_mtx, PRINET|PCATCH,
466 		     "bpf", d->bd_rtout);
467 		if (error == EINTR || error == ERESTART) {
468 			BPFD_UNLOCK(d);
469 			return (error);
470 		}
471 		if (error == EWOULDBLOCK) {
472 			/*
473 			 * On a timeout, return what's in the buffer,
474 			 * which may be nothing.  If there is something
475 			 * in the store buffer, we can rotate the buffers.
476 			 */
477 			if (d->bd_hbuf)
478 				/*
479 				 * We filled up the buffer in between
480 				 * getting the timeout and arriving
481 				 * here, so we don't need to rotate.
482 				 */
483 				break;
484 
485 			if (d->bd_slen == 0) {
486 				BPFD_UNLOCK(d);
487 				return (0);
488 			}
489 			ROTATE_BUFFERS(d);
490 			break;
491 		}
492 	}
493 	/*
494 	 * At this point, we know we have something in the hold slot.
495 	 */
496 	BPFD_UNLOCK(d);
497 
498 	/*
499 	 * Move data from hold buffer into user space.
500 	 * We know the entire buffer is transferred since
501 	 * we checked above that the read buffer is bpf_bufsize bytes.
502 	 */
503 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
504 
505 	BPFD_LOCK(d);
506 	d->bd_fbuf = d->bd_hbuf;
507 	d->bd_hbuf = NULL;
508 	d->bd_hlen = 0;
509 	BPFD_UNLOCK(d);
510 
511 	return (error);
512 }
513 
514 
515 /*
516  * If there are processes sleeping on this descriptor, wake them up.
517  */
518 static __inline void
519 bpf_wakeup(d)
520 	struct bpf_d *d;
521 {
522 	if (d->bd_state == BPF_WAITING) {
523 		callout_stop(&d->bd_callout);
524 		d->bd_state = BPF_IDLE;
525 	}
526 	wakeup(d);
527 	if (d->bd_async && d->bd_sig && d->bd_sigio)
528 		pgsigio(&d->bd_sigio, d->bd_sig, 0);
529 
530 	selwakeuppri(&d->bd_sel, PRINET);
531 	KNOTE_LOCKED(&d->bd_sel.si_note, 0);
532 }
533 
534 static void
535 bpf_timed_out(arg)
536 	void *arg;
537 {
538 	struct bpf_d *d = (struct bpf_d *)arg;
539 
540 	BPFD_LOCK(d);
541 	if (d->bd_state == BPF_WAITING) {
542 		d->bd_state = BPF_TIMED_OUT;
543 		if (d->bd_slen != 0)
544 			bpf_wakeup(d);
545 	}
546 	BPFD_UNLOCK(d);
547 }
548 
549 static	int
550 bpfwrite(dev, uio, ioflag)
551 	struct cdev *dev;
552 	struct uio *uio;
553 	int ioflag;
554 {
555 	struct bpf_d *d = dev->si_drv1;
556 	struct ifnet *ifp;
557 	struct mbuf *m;
558 	int error;
559 	struct sockaddr dst;
560 	int datlen;
561 
562 	if (d->bd_bif == NULL)
563 		return (ENXIO);
564 
565 	ifp = d->bd_bif->bif_ifp;
566 
567 	if (uio->uio_resid == 0)
568 		return (0);
569 
570 	bzero(&dst, sizeof(dst));
571 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, &m, &dst, &datlen);
572 	if (error)
573 		return (error);
574 
575 	if (datlen > ifp->if_mtu)
576 		return (EMSGSIZE);
577 
578 	if (d->bd_hdrcmplt)
579 		dst.sa_family = pseudo_AF_HDRCMPLT;
580 
581 #ifdef MAC
582 	BPFD_LOCK(d);
583 	mac_create_mbuf_from_bpfdesc(d, m);
584 	BPFD_UNLOCK(d);
585 #endif
586 	NET_LOCK_GIANT();
587 	error = (*ifp->if_output)(ifp, m, &dst, NULL);
588 	NET_UNLOCK_GIANT();
589 	/*
590 	 * The driver frees the mbuf.
591 	 */
592 	return (error);
593 }
594 
595 /*
596  * Reset a descriptor by flushing its packet buffer and clearing the
597  * receive and drop counts.
598  */
599 static void
600 reset_d(d)
601 	struct bpf_d *d;
602 {
603 
604 	mtx_assert(&d->bd_mtx, MA_OWNED);
605 	if (d->bd_hbuf) {
606 		/* Free the hold buffer. */
607 		d->bd_fbuf = d->bd_hbuf;
608 		d->bd_hbuf = NULL;
609 	}
610 	d->bd_slen = 0;
611 	d->bd_hlen = 0;
612 	d->bd_rcount = 0;
613 	d->bd_dcount = 0;
614 }
615 
616 /*
617  *  FIONREAD		Check for read packet available.
618  *  SIOCGIFADDR		Get interface address - convenient hook to driver.
619  *  BIOCGBLEN		Get buffer len [for read()].
620  *  BIOCSETF		Set ethernet read filter.
621  *  BIOCFLUSH		Flush read packet buffer.
622  *  BIOCPROMISC		Put interface into promiscuous mode.
623  *  BIOCGDLT		Get link layer type.
624  *  BIOCGETIF		Get interface name.
625  *  BIOCSETIF		Set interface.
626  *  BIOCSRTIMEOUT	Set read timeout.
627  *  BIOCGRTIMEOUT	Get read timeout.
628  *  BIOCGSTATS		Get packet stats.
629  *  BIOCIMMEDIATE	Set immediate mode.
630  *  BIOCVERSION		Get filter language version.
631  *  BIOCGHDRCMPLT	Get "header already complete" flag
632  *  BIOCSHDRCMPLT	Set "header already complete" flag
633  *  BIOCGSEESENT	Get "see packets sent" flag
634  *  BIOCSSEESENT	Set "see packets sent" flag
635  */
636 /* ARGSUSED */
637 static	int
638 bpfioctl(dev, cmd, addr, flags, td)
639 	struct cdev *dev;
640 	u_long cmd;
641 	caddr_t addr;
642 	int flags;
643 	struct thread *td;
644 {
645 	struct bpf_d *d = dev->si_drv1;
646 	int error = 0;
647 
648 	BPFD_LOCK(d);
649 	if (d->bd_state == BPF_WAITING)
650 		callout_stop(&d->bd_callout);
651 	d->bd_state = BPF_IDLE;
652 	BPFD_UNLOCK(d);
653 
654 	switch (cmd) {
655 
656 	default:
657 		error = EINVAL;
658 		break;
659 
660 	/*
661 	 * Check for read packet available.
662 	 */
663 	case FIONREAD:
664 		{
665 			int n;
666 
667 			BPFD_LOCK(d);
668 			n = d->bd_slen;
669 			if (d->bd_hbuf)
670 				n += d->bd_hlen;
671 			BPFD_UNLOCK(d);
672 
673 			*(int *)addr = n;
674 			break;
675 		}
676 
677 	case SIOCGIFADDR:
678 		{
679 			struct ifnet *ifp;
680 
681 			if (d->bd_bif == NULL)
682 				error = EINVAL;
683 			else {
684 				ifp = d->bd_bif->bif_ifp;
685 				error = (*ifp->if_ioctl)(ifp, cmd, addr);
686 			}
687 			break;
688 		}
689 
690 	/*
691 	 * Get buffer len [for read()].
692 	 */
693 	case BIOCGBLEN:
694 		*(u_int *)addr = d->bd_bufsize;
695 		break;
696 
697 	/*
698 	 * Set buffer length.
699 	 */
700 	case BIOCSBLEN:
701 		if (d->bd_bif != NULL)
702 			error = EINVAL;
703 		else {
704 			u_int size = *(u_int *)addr;
705 
706 			if (size > bpf_maxbufsize)
707 				*(u_int *)addr = size = bpf_maxbufsize;
708 			else if (size < BPF_MINBUFSIZE)
709 				*(u_int *)addr = size = BPF_MINBUFSIZE;
710 			d->bd_bufsize = size;
711 		}
712 		break;
713 
714 	/*
715 	 * Set link layer read filter.
716 	 */
717 	case BIOCSETF:
718 		error = bpf_setf(d, (struct bpf_program *)addr);
719 		break;
720 
721 	/*
722 	 * Flush read packet buffer.
723 	 */
724 	case BIOCFLUSH:
725 		BPFD_LOCK(d);
726 		reset_d(d);
727 		BPFD_UNLOCK(d);
728 		break;
729 
730 	/*
731 	 * Put interface into promiscuous mode.
732 	 */
733 	case BIOCPROMISC:
734 		if (d->bd_bif == NULL) {
735 			/*
736 			 * No interface attached yet.
737 			 */
738 			error = EINVAL;
739 			break;
740 		}
741 		if (d->bd_promisc == 0) {
742 			mtx_lock(&Giant);
743 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
744 			mtx_unlock(&Giant);
745 			if (error == 0)
746 				d->bd_promisc = 1;
747 		}
748 		break;
749 
750 	/*
751 	 * Get current data link type.
752 	 */
753 	case BIOCGDLT:
754 		if (d->bd_bif == NULL)
755 			error = EINVAL;
756 		else
757 			*(u_int *)addr = d->bd_bif->bif_dlt;
758 		break;
759 
760 	/*
761 	 * Get a list of supported data link types.
762 	 */
763 	case BIOCGDLTLIST:
764 		if (d->bd_bif == NULL)
765 			error = EINVAL;
766 		else
767 			error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
768 		break;
769 
770 	/*
771 	 * Set data link type.
772 	 */
773 	case BIOCSDLT:
774 		if (d->bd_bif == NULL)
775 			error = EINVAL;
776 		else
777 			error = bpf_setdlt(d, *(u_int *)addr);
778 		break;
779 
780 	/*
781 	 * Get interface name.
782 	 */
783 	case BIOCGETIF:
784 		if (d->bd_bif == NULL)
785 			error = EINVAL;
786 		else {
787 			struct ifnet *const ifp = d->bd_bif->bif_ifp;
788 			struct ifreq *const ifr = (struct ifreq *)addr;
789 
790 			strlcpy(ifr->ifr_name, ifp->if_xname,
791 			    sizeof(ifr->ifr_name));
792 		}
793 		break;
794 
795 	/*
796 	 * Set interface.
797 	 */
798 	case BIOCSETIF:
799 		error = bpf_setif(d, (struct ifreq *)addr);
800 		break;
801 
802 	/*
803 	 * Set read timeout.
804 	 */
805 	case BIOCSRTIMEOUT:
806 		{
807 			struct timeval *tv = (struct timeval *)addr;
808 
809 			/*
810 			 * Subtract 1 tick from tvtohz() since this isn't
811 			 * a one-shot timer.
812 			 */
813 			if ((error = itimerfix(tv)) == 0)
814 				d->bd_rtout = tvtohz(tv) - 1;
815 			break;
816 		}
817 
818 	/*
819 	 * Get read timeout.
820 	 */
821 	case BIOCGRTIMEOUT:
822 		{
823 			struct timeval *tv = (struct timeval *)addr;
824 
825 			tv->tv_sec = d->bd_rtout / hz;
826 			tv->tv_usec = (d->bd_rtout % hz) * tick;
827 			break;
828 		}
829 
830 	/*
831 	 * Get packet stats.
832 	 */
833 	case BIOCGSTATS:
834 		{
835 			struct bpf_stat *bs = (struct bpf_stat *)addr;
836 
837 			bs->bs_recv = d->bd_rcount;
838 			bs->bs_drop = d->bd_dcount;
839 			break;
840 		}
841 
842 	/*
843 	 * Set immediate mode.
844 	 */
845 	case BIOCIMMEDIATE:
846 		d->bd_immediate = *(u_int *)addr;
847 		break;
848 
849 	case BIOCVERSION:
850 		{
851 			struct bpf_version *bv = (struct bpf_version *)addr;
852 
853 			bv->bv_major = BPF_MAJOR_VERSION;
854 			bv->bv_minor = BPF_MINOR_VERSION;
855 			break;
856 		}
857 
858 	/*
859 	 * Get "header already complete" flag
860 	 */
861 	case BIOCGHDRCMPLT:
862 		*(u_int *)addr = d->bd_hdrcmplt;
863 		break;
864 
865 	/*
866 	 * Set "header already complete" flag
867 	 */
868 	case BIOCSHDRCMPLT:
869 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
870 		break;
871 
872 	/*
873 	 * Get "see sent packets" flag
874 	 */
875 	case BIOCGSEESENT:
876 		*(u_int *)addr = d->bd_seesent;
877 		break;
878 
879 	/*
880 	 * Set "see sent packets" flag
881 	 */
882 	case BIOCSSEESENT:
883 		d->bd_seesent = *(u_int *)addr;
884 		break;
885 
886 	case FIONBIO:		/* Non-blocking I/O */
887 		break;
888 
889 	case FIOASYNC:		/* Send signal on receive packets */
890 		d->bd_async = *(int *)addr;
891 		break;
892 
893 	case FIOSETOWN:
894 		error = fsetown(*(int *)addr, &d->bd_sigio);
895 		break;
896 
897 	case FIOGETOWN:
898 		*(int *)addr = fgetown(&d->bd_sigio);
899 		break;
900 
901 	/* This is deprecated, FIOSETOWN should be used instead. */
902 	case TIOCSPGRP:
903 		error = fsetown(-(*(int *)addr), &d->bd_sigio);
904 		break;
905 
906 	/* This is deprecated, FIOGETOWN should be used instead. */
907 	case TIOCGPGRP:
908 		*(int *)addr = -fgetown(&d->bd_sigio);
909 		break;
910 
911 	case BIOCSRSIG:		/* Set receive signal */
912 		{
913 			u_int sig;
914 
915 			sig = *(u_int *)addr;
916 
917 			if (sig >= NSIG)
918 				error = EINVAL;
919 			else
920 				d->bd_sig = sig;
921 			break;
922 		}
923 	case BIOCGRSIG:
924 		*(u_int *)addr = d->bd_sig;
925 		break;
926 	}
927 	return (error);
928 }
929 
930 /*
931  * Set d's packet filter program to fp.  If this file already has a filter,
932  * free it and replace it.  Returns EINVAL for bogus requests.
933  */
934 static int
935 bpf_setf(d, fp)
936 	struct bpf_d *d;
937 	struct bpf_program *fp;
938 {
939 	struct bpf_insn *fcode, *old;
940 	u_int flen, size;
941 
942 	old = d->bd_filter;
943 	if (fp->bf_insns == NULL) {
944 		if (fp->bf_len != 0)
945 			return (EINVAL);
946 		BPFD_LOCK(d);
947 		d->bd_filter = NULL;
948 		reset_d(d);
949 		BPFD_UNLOCK(d);
950 		if (old != NULL)
951 			free((caddr_t)old, M_BPF);
952 		return (0);
953 	}
954 	flen = fp->bf_len;
955 	if (flen > BPF_MAXINSNS)
956 		return (EINVAL);
957 
958 	size = flen * sizeof(*fp->bf_insns);
959 	fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
960 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
961 	    bpf_validate(fcode, (int)flen)) {
962 		BPFD_LOCK(d);
963 		d->bd_filter = fcode;
964 		reset_d(d);
965 		BPFD_UNLOCK(d);
966 		if (old != NULL)
967 			free((caddr_t)old, M_BPF);
968 
969 		return (0);
970 	}
971 	free((caddr_t)fcode, M_BPF);
972 	return (EINVAL);
973 }
974 
975 /*
976  * Detach a file from its current interface (if attached at all) and attach
977  * to the interface indicated by the name stored in ifr.
978  * Return an errno or 0.
979  */
980 static int
981 bpf_setif(d, ifr)
982 	struct bpf_d *d;
983 	struct ifreq *ifr;
984 {
985 	struct bpf_if *bp;
986 	int error;
987 	struct ifnet *theywant;
988 
989 	theywant = ifunit(ifr->ifr_name);
990 	if (theywant == NULL)
991 		return ENXIO;
992 
993 	/*
994 	 * Look through attached interfaces for the named one.
995 	 */
996 	mtx_lock(&bpf_mtx);
997 	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
998 		struct ifnet *ifp = bp->bif_ifp;
999 
1000 		if (ifp == NULL || ifp != theywant)
1001 			continue;
1002 		/* skip additional entry */
1003 		if (bp->bif_driverp != (struct bpf_if **)&ifp->if_bpf)
1004 			continue;
1005 
1006 		mtx_unlock(&bpf_mtx);
1007 		/*
1008 		 * We found the requested interface.
1009 		 * If it's not up, return an error.
1010 		 * Allocate the packet buffers if we need to.
1011 		 * If we're already attached to requested interface,
1012 		 * just flush the buffer.
1013 		 */
1014 		if ((ifp->if_flags & IFF_UP) == 0)
1015 			return (ENETDOWN);
1016 
1017 		if (d->bd_sbuf == NULL) {
1018 			error = bpf_allocbufs(d);
1019 			if (error != 0)
1020 				return (error);
1021 		}
1022 		if (bp != d->bd_bif) {
1023 			if (d->bd_bif)
1024 				/*
1025 				 * Detach if attached to something else.
1026 				 */
1027 				bpf_detachd(d);
1028 
1029 			bpf_attachd(d, bp);
1030 		}
1031 		BPFD_LOCK(d);
1032 		reset_d(d);
1033 		BPFD_UNLOCK(d);
1034 		return (0);
1035 	}
1036 	mtx_unlock(&bpf_mtx);
1037 	/* Not found. */
1038 	return (ENXIO);
1039 }
1040 
1041 /*
1042  * Support for select() and poll() system calls
1043  *
1044  * Return true iff the specific operation will not block indefinitely.
1045  * Otherwise, return false but make a note that a selwakeup() must be done.
1046  */
1047 static int
1048 bpfpoll(dev, events, td)
1049 	struct cdev *dev;
1050 	int events;
1051 	struct thread *td;
1052 {
1053 	struct bpf_d *d;
1054 	int revents;
1055 
1056 	d = dev->si_drv1;
1057 	if (d->bd_bif == NULL)
1058 		return (ENXIO);
1059 
1060 	revents = events & (POLLOUT | POLLWRNORM);
1061 	BPFD_LOCK(d);
1062 	if (events & (POLLIN | POLLRDNORM)) {
1063 		if (bpf_ready(d))
1064 			revents |= events & (POLLIN | POLLRDNORM);
1065 		else {
1066 			selrecord(td, &d->bd_sel);
1067 			/* Start the read timeout if necessary. */
1068 			if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1069 				callout_reset(&d->bd_callout, d->bd_rtout,
1070 				    bpf_timed_out, d);
1071 				d->bd_state = BPF_WAITING;
1072 			}
1073 		}
1074 	}
1075 	BPFD_UNLOCK(d);
1076 	return (revents);
1077 }
1078 
1079 /*
1080  * Support for kevent() system call.  Register EVFILT_READ filters and
1081  * reject all others.
1082  */
1083 int
1084 bpfkqfilter(dev, kn)
1085 	struct cdev *dev;
1086 	struct knote *kn;
1087 {
1088 	struct bpf_d *d = (struct bpf_d *)dev->si_drv1;
1089 
1090 	if (kn->kn_filter != EVFILT_READ)
1091 		return (1);
1092 
1093 	kn->kn_fop = &bpfread_filtops;
1094 	kn->kn_hook = d;
1095 	knlist_add(&d->bd_sel.si_note, kn, 0);
1096 
1097 	return (0);
1098 }
1099 
1100 static void
1101 filt_bpfdetach(kn)
1102 	struct knote *kn;
1103 {
1104 	struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1105 
1106 	knlist_remove(&d->bd_sel.si_note, kn, 0);
1107 }
1108 
1109 static int
1110 filt_bpfread(kn, hint)
1111 	struct knote *kn;
1112 	long hint;
1113 {
1114 	struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1115 	int ready;
1116 
1117 	BPFD_LOCK(d);
1118 	ready = bpf_ready(d);
1119 	if (ready) {
1120 		kn->kn_data = d->bd_slen;
1121 		if (d->bd_hbuf)
1122 			kn->kn_data += d->bd_hlen;
1123 	}
1124 	else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1125 		callout_reset(&d->bd_callout, d->bd_rtout,
1126 		    bpf_timed_out, d);
1127 		d->bd_state = BPF_WAITING;
1128 	}
1129 	BPFD_UNLOCK(d);
1130 
1131 	return (ready);
1132 }
1133 
1134 /*
1135  * Incoming linkage from device drivers.  Process the packet pkt, of length
1136  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1137  * by each process' filter, and if accepted, stashed into the corresponding
1138  * buffer.
1139  */
1140 void
1141 bpf_tap(bp, pkt, pktlen)
1142 	struct bpf_if *bp;
1143 	u_char *pkt;
1144 	u_int pktlen;
1145 {
1146 	struct bpf_d *d;
1147 	u_int slen;
1148 
1149 	/*
1150 	 * Lockless read to avoid cost of locking the interface if there are
1151 	 * no descriptors attached.
1152 	 */
1153 	if (LIST_EMPTY(&bp->bif_dlist))
1154 		return;
1155 
1156 	BPFIF_LOCK(bp);
1157 	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1158 		BPFD_LOCK(d);
1159 		++d->bd_rcount;
1160 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1161 		if (slen != 0) {
1162 #ifdef MAC
1163 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1164 #endif
1165 				catchpacket(d, pkt, pktlen, slen, bcopy);
1166 		}
1167 		BPFD_UNLOCK(d);
1168 	}
1169 	BPFIF_UNLOCK(bp);
1170 }
1171 
1172 /*
1173  * Copy data from an mbuf chain into a buffer.  This code is derived
1174  * from m_copydata in sys/uipc_mbuf.c.
1175  */
1176 static void
1177 bpf_mcopy(src_arg, dst_arg, len)
1178 	const void *src_arg;
1179 	void *dst_arg;
1180 	size_t len;
1181 {
1182 	const struct mbuf *m;
1183 	u_int count;
1184 	u_char *dst;
1185 
1186 	m = src_arg;
1187 	dst = dst_arg;
1188 	while (len > 0) {
1189 		if (m == NULL)
1190 			panic("bpf_mcopy");
1191 		count = min(m->m_len, len);
1192 		bcopy(mtod(m, void *), dst, count);
1193 		m = m->m_next;
1194 		dst += count;
1195 		len -= count;
1196 	}
1197 }
1198 
1199 /*
1200  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1201  */
1202 void
1203 bpf_mtap(bp, m)
1204 	struct bpf_if *bp;
1205 	struct mbuf *m;
1206 {
1207 	struct bpf_d *d;
1208 	u_int pktlen, slen;
1209 
1210 	/*
1211 	 * Lockless read to avoid cost of locking the interface if there are
1212 	 * no descriptors attached.
1213 	 */
1214 	if (LIST_EMPTY(&bp->bif_dlist))
1215 		return;
1216 
1217 	pktlen = m_length(m, NULL);
1218 	if (pktlen == m->m_len) {
1219 		bpf_tap(bp, mtod(m, u_char *), pktlen);
1220 		return;
1221 	}
1222 
1223 	BPFIF_LOCK(bp);
1224 	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1225 		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1226 			continue;
1227 		BPFD_LOCK(d);
1228 		++d->bd_rcount;
1229 		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1230 		if (slen != 0)
1231 #ifdef MAC
1232 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1233 #endif
1234 				catchpacket(d, (u_char *)m, pktlen, slen,
1235 				    bpf_mcopy);
1236 		BPFD_UNLOCK(d);
1237 	}
1238 	BPFIF_UNLOCK(bp);
1239 }
1240 
1241 /*
1242  * Incoming linkage from device drivers, when packet is in
1243  * an mbuf chain and to be prepended by a contiguous header.
1244  */
1245 void
1246 bpf_mtap2(bp, data, dlen, m)
1247 	struct bpf_if *bp;
1248 	void *data;
1249 	u_int dlen;
1250 	struct mbuf *m;
1251 {
1252 	struct mbuf mb;
1253 	struct bpf_d *d;
1254 	u_int pktlen, slen;
1255 
1256 	/*
1257 	 * Lockless read to avoid cost of locking the interface if there are
1258 	 * no descriptors attached.
1259 	 */
1260 	if (LIST_EMPTY(&bp->bif_dlist))
1261 		return;
1262 
1263 	pktlen = m_length(m, NULL);
1264 	/*
1265 	 * Craft on-stack mbuf suitable for passing to bpf_filter.
1266 	 * Note that we cut corners here; we only setup what's
1267 	 * absolutely needed--this mbuf should never go anywhere else.
1268 	 */
1269 	mb.m_next = m;
1270 	mb.m_data = data;
1271 	mb.m_len = dlen;
1272 	pktlen += dlen;
1273 
1274 	BPFIF_LOCK(bp);
1275 	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1276 		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1277 			continue;
1278 		BPFD_LOCK(d);
1279 		++d->bd_rcount;
1280 		slen = bpf_filter(d->bd_filter, (u_char *)&mb, pktlen, 0);
1281 		if (slen != 0)
1282 #ifdef MAC
1283 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1284 #endif
1285 				catchpacket(d, (u_char *)&mb, pktlen, slen,
1286 				    bpf_mcopy);
1287 		BPFD_UNLOCK(d);
1288 	}
1289 	BPFIF_UNLOCK(bp);
1290 }
1291 
1292 /*
1293  * Move the packet data from interface memory (pkt) into the
1294  * store buffer.  "cpfn" is the routine called to do the actual data
1295  * transfer.  bcopy is passed in to copy contiguous chunks, while
1296  * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1297  * pkt is really an mbuf.
1298  */
1299 static void
1300 catchpacket(d, pkt, pktlen, snaplen, cpfn)
1301 	struct bpf_d *d;
1302 	u_char *pkt;
1303 	u_int pktlen, snaplen;
1304 	void (*cpfn)(const void *, void *, size_t);
1305 {
1306 	struct bpf_hdr *hp;
1307 	int totlen, curlen;
1308 	int hdrlen = d->bd_bif->bif_hdrlen;
1309 
1310 	/*
1311 	 * Figure out how many bytes to move.  If the packet is
1312 	 * greater or equal to the snapshot length, transfer that
1313 	 * much.  Otherwise, transfer the whole packet (unless
1314 	 * we hit the buffer size limit).
1315 	 */
1316 	totlen = hdrlen + min(snaplen, pktlen);
1317 	if (totlen > d->bd_bufsize)
1318 		totlen = d->bd_bufsize;
1319 
1320 	/*
1321 	 * Round up the end of the previous packet to the next longword.
1322 	 */
1323 	curlen = BPF_WORDALIGN(d->bd_slen);
1324 	if (curlen + totlen > d->bd_bufsize) {
1325 		/*
1326 		 * This packet will overflow the storage buffer.
1327 		 * Rotate the buffers if we can, then wakeup any
1328 		 * pending reads.
1329 		 */
1330 		if (d->bd_fbuf == NULL) {
1331 			/*
1332 			 * We haven't completed the previous read yet,
1333 			 * so drop the packet.
1334 			 */
1335 			++d->bd_dcount;
1336 			return;
1337 		}
1338 		ROTATE_BUFFERS(d);
1339 		bpf_wakeup(d);
1340 		curlen = 0;
1341 	}
1342 	else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1343 		/*
1344 		 * Immediate mode is set, or the read timeout has
1345 		 * already expired during a select call.  A packet
1346 		 * arrived, so the reader should be woken up.
1347 		 */
1348 		bpf_wakeup(d);
1349 
1350 	/*
1351 	 * Append the bpf header.
1352 	 */
1353 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1354 	microtime(&hp->bh_tstamp);
1355 	hp->bh_datalen = pktlen;
1356 	hp->bh_hdrlen = hdrlen;
1357 	/*
1358 	 * Copy the packet data into the store buffer and update its length.
1359 	 */
1360 	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1361 	d->bd_slen = curlen + totlen;
1362 }
1363 
1364 /*
1365  * Initialize all nonzero fields of a descriptor.
1366  */
1367 static int
1368 bpf_allocbufs(d)
1369 	struct bpf_d *d;
1370 {
1371 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1372 	if (d->bd_fbuf == NULL)
1373 		return (ENOBUFS);
1374 
1375 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1376 	if (d->bd_sbuf == NULL) {
1377 		free(d->bd_fbuf, M_BPF);
1378 		return (ENOBUFS);
1379 	}
1380 	d->bd_slen = 0;
1381 	d->bd_hlen = 0;
1382 	return (0);
1383 }
1384 
1385 /*
1386  * Free buffers currently in use by a descriptor.
1387  * Called on close.
1388  */
1389 static void
1390 bpf_freed(d)
1391 	struct bpf_d *d;
1392 {
1393 	/*
1394 	 * We don't need to lock out interrupts since this descriptor has
1395 	 * been detached from its interface and it yet hasn't been marked
1396 	 * free.
1397 	 */
1398 	if (d->bd_sbuf != NULL) {
1399 		free(d->bd_sbuf, M_BPF);
1400 		if (d->bd_hbuf != NULL)
1401 			free(d->bd_hbuf, M_BPF);
1402 		if (d->bd_fbuf != NULL)
1403 			free(d->bd_fbuf, M_BPF);
1404 	}
1405 	if (d->bd_filter)
1406 		free((caddr_t)d->bd_filter, M_BPF);
1407 	mtx_destroy(&d->bd_mtx);
1408 }
1409 
1410 /*
1411  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
1412  * fixed size of the link header (variable length headers not yet supported).
1413  */
1414 void
1415 bpfattach(ifp, dlt, hdrlen)
1416 	struct ifnet *ifp;
1417 	u_int dlt, hdrlen;
1418 {
1419 
1420 	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1421 }
1422 
1423 /*
1424  * Attach an interface to bpf.  ifp is a pointer to the structure
1425  * defining the interface to be attached, dlt is the link layer type,
1426  * and hdrlen is the fixed size of the link header (variable length
1427  * headers are not yet supporrted).
1428  */
1429 void
1430 bpfattach2(ifp, dlt, hdrlen, driverp)
1431 	struct ifnet *ifp;
1432 	u_int dlt, hdrlen;
1433 	struct bpf_if **driverp;
1434 {
1435 	struct bpf_if *bp;
1436 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
1437 	if (bp == NULL)
1438 		panic("bpfattach");
1439 
1440 	LIST_INIT(&bp->bif_dlist);
1441 	bp->bif_driverp = driverp;
1442 	bp->bif_ifp = ifp;
1443 	bp->bif_dlt = dlt;
1444 	mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
1445 
1446 	mtx_lock(&bpf_mtx);
1447 	LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next);
1448 	mtx_unlock(&bpf_mtx);
1449 
1450 	*bp->bif_driverp = NULL;
1451 
1452 	/*
1453 	 * Compute the length of the bpf header.  This is not necessarily
1454 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1455 	 * that the network layer header begins on a longword boundary (for
1456 	 * performance reasons and to alleviate alignment restrictions).
1457 	 */
1458 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1459 
1460 	if (bootverbose)
1461 		if_printf(ifp, "bpf attached\n");
1462 }
1463 
1464 /*
1465  * Detach bpf from an interface.  This involves detaching each descriptor
1466  * associated with the interface, and leaving bd_bif NULL.  Notify each
1467  * descriptor as it's detached so that any sleepers wake up and get
1468  * ENXIO.
1469  */
1470 void
1471 bpfdetach(ifp)
1472 	struct ifnet *ifp;
1473 {
1474 	struct bpf_if	*bp;
1475 	struct bpf_d	*d;
1476 
1477 	/* Locate BPF interface information */
1478 	mtx_lock(&bpf_mtx);
1479 	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1480 		if (ifp == bp->bif_ifp)
1481 			break;
1482 	}
1483 
1484 	/* Interface wasn't attached */
1485 	if ((bp == NULL) || (bp->bif_ifp == NULL)) {
1486 		mtx_unlock(&bpf_mtx);
1487 		printf("bpfdetach: %s was not attached\n", ifp->if_xname);
1488 		return;
1489 	}
1490 
1491 	LIST_REMOVE(bp, bif_next);
1492 	mtx_unlock(&bpf_mtx);
1493 
1494 	while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) {
1495 		bpf_detachd(d);
1496 		BPFD_LOCK(d);
1497 		bpf_wakeup(d);
1498 		BPFD_UNLOCK(d);
1499 	}
1500 
1501 	mtx_destroy(&bp->bif_mtx);
1502 	free(bp, M_BPF);
1503 }
1504 
1505 /*
1506  * Get a list of available data link type of the interface.
1507  */
1508 static int
1509 bpf_getdltlist(d, bfl)
1510 	struct bpf_d *d;
1511 	struct bpf_dltlist *bfl;
1512 {
1513 	int n, error;
1514 	struct ifnet *ifp;
1515 	struct bpf_if *bp;
1516 
1517 	ifp = d->bd_bif->bif_ifp;
1518 	n = 0;
1519 	error = 0;
1520 	mtx_lock(&bpf_mtx);
1521 	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1522 		if (bp->bif_ifp != ifp)
1523 			continue;
1524 		if (bfl->bfl_list != NULL) {
1525 			if (n >= bfl->bfl_len) {
1526 				mtx_unlock(&bpf_mtx);
1527 				return (ENOMEM);
1528 			}
1529 			error = copyout(&bp->bif_dlt,
1530 			    bfl->bfl_list + n, sizeof(u_int));
1531 		}
1532 		n++;
1533 	}
1534 	mtx_unlock(&bpf_mtx);
1535 	bfl->bfl_len = n;
1536 	return (error);
1537 }
1538 
1539 /*
1540  * Set the data link type of a BPF instance.
1541  */
1542 static int
1543 bpf_setdlt(d, dlt)
1544 	struct bpf_d *d;
1545 	u_int dlt;
1546 {
1547 	int error, opromisc;
1548 	struct ifnet *ifp;
1549 	struct bpf_if *bp;
1550 
1551 	if (d->bd_bif->bif_dlt == dlt)
1552 		return (0);
1553 	ifp = d->bd_bif->bif_ifp;
1554 	mtx_lock(&bpf_mtx);
1555 	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1556 		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1557 			break;
1558 	}
1559 	mtx_unlock(&bpf_mtx);
1560 	if (bp != NULL) {
1561 		opromisc = d->bd_promisc;
1562 		bpf_detachd(d);
1563 		bpf_attachd(d, bp);
1564 		BPFD_LOCK(d);
1565 		reset_d(d);
1566 		BPFD_UNLOCK(d);
1567 		if (opromisc) {
1568 			error = ifpromisc(bp->bif_ifp, 1);
1569 			if (error)
1570 				if_printf(bp->bif_ifp,
1571 					"bpf_setdlt: ifpromisc failed (%d)\n",
1572 					error);
1573 			else
1574 				d->bd_promisc = 1;
1575 		}
1576 	}
1577 	return (bp == NULL ? EINVAL : 0);
1578 }
1579 
1580 static void bpf_drvinit(void *unused);
1581 
1582 static void bpf_clone(void *arg, char *name, int namelen, struct cdev **dev);
1583 
1584 static void
1585 bpf_clone(arg, name, namelen, dev)
1586 	void *arg;
1587 	char *name;
1588 	int namelen;
1589 	struct cdev **dev;
1590 {
1591 	int u;
1592 
1593 	if (*dev != NULL)
1594 		return;
1595 	if (dev_stdclone(name, NULL, "bpf", &u) != 1)
1596 		return;
1597 	*dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
1598 	    "bpf%d", u);
1599 	(*dev)->si_flags |= SI_CHEAPCLONE;
1600 	return;
1601 }
1602 
1603 static void
1604 bpf_drvinit(unused)
1605 	void *unused;
1606 {
1607 
1608 	mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
1609 	LIST_INIT(&bpf_iflist);
1610 	EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000);
1611 }
1612 
1613 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL)
1614 
1615 #else /* !DEV_BPF && !NETGRAPH_BPF */
1616 /*
1617  * NOP stubs to allow bpf-using drivers to load and function.
1618  *
1619  * A 'better' implementation would allow the core bpf functionality
1620  * to be loaded at runtime.
1621  */
1622 
1623 void
1624 bpf_tap(bp, pkt, pktlen)
1625 	struct bpf_if *bp;
1626 	u_char *pkt;
1627 	u_int pktlen;
1628 {
1629 }
1630 
1631 void
1632 bpf_mtap(bp, m)
1633 	struct bpf_if *bp;
1634 	struct mbuf *m;
1635 {
1636 }
1637 
1638 void
1639 bpf_mtap2(bp, d, l, m)
1640 	struct bpf_if *bp;
1641 	void *d;
1642 	u_int l;
1643 	struct mbuf *m;
1644 {
1645 }
1646 
1647 void
1648 bpfattach(ifp, dlt, hdrlen)
1649 	struct ifnet *ifp;
1650 	u_int dlt, hdrlen;
1651 {
1652 }
1653 
1654 void
1655 bpfattach2(ifp, dlt, hdrlen, driverp)
1656 	struct ifnet *ifp;
1657 	u_int dlt, hdrlen;
1658 	struct bpf_if **driverp;
1659 {
1660 }
1661 
1662 void
1663 bpfdetach(ifp)
1664 	struct ifnet *ifp;
1665 {
1666 }
1667 
1668 u_int
1669 bpf_filter(pc, p, wirelen, buflen)
1670 	const struct bpf_insn *pc;
1671 	u_char *p;
1672 	u_int wirelen;
1673 	u_int buflen;
1674 {
1675 	return -1;	/* "no filter" behaviour */
1676 }
1677 
1678 int
1679 bpf_validate(f, len)
1680 	const struct bpf_insn *f;
1681 	int len;
1682 {
1683 	return 0;		/* false */
1684 }
1685 
1686 #endif /* !DEV_BPF && !NETGRAPH_BPF */
1687