xref: /freebsd/sys/net/bpf.c (revision dba6dd177bdee890cf445fbe21a5dccefd5de18e)
1 /*
2  * Copyright (c) 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *      @(#)bpf.c	8.4 (Berkeley) 1/9/95
35  *
36  * $FreeBSD$
37  */
38 
39 #include "opt_bpf.h"
40 #include "opt_mac.h"
41 #include "opt_netgraph.h"
42 
43 #include <sys/types.h>
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/conf.h>
47 #include <sys/mac.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 #include <sys/time.h>
51 #include <sys/proc.h>
52 #include <sys/signalvar.h>
53 #include <sys/filio.h>
54 #include <sys/sockio.h>
55 #include <sys/ttycom.h>
56 #include <sys/filedesc.h>
57 
58 #include <sys/event.h>
59 #include <sys/file.h>
60 #include <sys/poll.h>
61 #include <sys/proc.h>
62 
63 #include <sys/socket.h>
64 #include <sys/vnode.h>
65 
66 #include <net/if.h>
67 #include <net/bpf.h>
68 #include <net/bpfdesc.h>
69 
70 #include <netinet/in.h>
71 #include <netinet/if_ether.h>
72 #include <sys/kernel.h>
73 #include <sys/sysctl.h>
74 
75 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
76 
77 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)
78 
79 #define PRINET  26			/* interruptible */
80 
81 /*
82  * The default read buffer size is patchable.
83  */
84 static int bpf_bufsize = 4096;
85 SYSCTL_INT(_debug, OID_AUTO, bpf_bufsize, CTLFLAG_RW,
86 	&bpf_bufsize, 0, "");
87 static int bpf_maxbufsize = BPF_MAXBUFSIZE;
88 SYSCTL_INT(_debug, OID_AUTO, bpf_maxbufsize, CTLFLAG_RW,
89 	&bpf_maxbufsize, 0, "");
90 
91 /*
92  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
93  */
94 static struct bpf_if	*bpf_iflist;
95 static struct mtx	bpf_mtx;		/* bpf global lock */
96 
97 static int	bpf_allocbufs(struct bpf_d *);
98 static void	bpf_attachd(struct bpf_d *d, struct bpf_if *bp);
99 static void	bpf_detachd(struct bpf_d *d);
100 static void	bpf_freed(struct bpf_d *);
101 static void	bpf_mcopy(const void *, void *, size_t);
102 static int	bpf_movein(struct uio *, int,
103 		    struct mbuf **, struct sockaddr *, int *);
104 static int	bpf_setif(struct bpf_d *, struct ifreq *);
105 static void	bpf_timed_out(void *);
106 static __inline void
107 		bpf_wakeup(struct bpf_d *);
108 static void	catchpacket(struct bpf_d *, u_char *, u_int,
109 		    u_int, void (*)(const void *, void *, size_t));
110 static void	reset_d(struct bpf_d *);
111 static int	 bpf_setf(struct bpf_d *, struct bpf_program *);
112 static int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
113 static int	bpf_setdlt(struct bpf_d *, u_int);
114 static void	filt_bpfdetach(struct knote *);
115 static int	filt_bpfread(struct knote *, long);
116 
117 static	d_open_t	bpfopen;
118 static	d_close_t	bpfclose;
119 static	d_read_t	bpfread;
120 static	d_write_t	bpfwrite;
121 static	d_ioctl_t	bpfioctl;
122 static	d_poll_t	bpfpoll;
123 static	d_kqfilter_t	bpfkqfilter;
124 
125 static struct cdevsw bpf_cdevsw = {
126 	.d_version =	D_VERSION,
127 	.d_flags =	D_NEEDGIANT,
128 	.d_open =	bpfopen,
129 	.d_close =	bpfclose,
130 	.d_read =	bpfread,
131 	.d_write =	bpfwrite,
132 	.d_ioctl =	bpfioctl,
133 	.d_poll =	bpfpoll,
134 	.d_name =	"bpf",
135 	.d_kqfilter =	bpfkqfilter,
136 };
137 
138 static struct filterops bpfread_filtops =
139 	{ 1, NULL, filt_bpfdetach, filt_bpfread };
140 
141 static int
142 bpf_movein(uio, linktype, mp, sockp, datlen)
143 	struct uio *uio;
144 	int linktype, *datlen;
145 	struct mbuf **mp;
146 	struct sockaddr *sockp;
147 {
148 	struct mbuf *m;
149 	int error;
150 	int len;
151 	int hlen;
152 
153 	/*
154 	 * Build a sockaddr based on the data link layer type.
155 	 * We do this at this level because the ethernet header
156 	 * is copied directly into the data field of the sockaddr.
157 	 * In the case of SLIP, there is no header and the packet
158 	 * is forwarded as is.
159 	 * Also, we are careful to leave room at the front of the mbuf
160 	 * for the link level header.
161 	 */
162 	switch (linktype) {
163 
164 	case DLT_SLIP:
165 		sockp->sa_family = AF_INET;
166 		hlen = 0;
167 		break;
168 
169 	case DLT_EN10MB:
170 		sockp->sa_family = AF_UNSPEC;
171 		/* XXX Would MAXLINKHDR be better? */
172 		hlen = ETHER_HDR_LEN;
173 		break;
174 
175 	case DLT_FDDI:
176 		sockp->sa_family = AF_IMPLINK;
177 		hlen = 0;
178 		break;
179 
180 	case DLT_RAW:
181 	case DLT_NULL:
182 		sockp->sa_family = AF_UNSPEC;
183 		hlen = 0;
184 		break;
185 
186 	case DLT_ATM_RFC1483:
187 		/*
188 		 * en atm driver requires 4-byte atm pseudo header.
189 		 * though it isn't standard, vpi:vci needs to be
190 		 * specified anyway.
191 		 */
192 		sockp->sa_family = AF_UNSPEC;
193 		hlen = 12;	/* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
194 		break;
195 
196 	case DLT_PPP:
197 		sockp->sa_family = AF_UNSPEC;
198 		hlen = 4;	/* This should match PPP_HDRLEN */
199 		break;
200 
201 	default:
202 		return (EIO);
203 	}
204 
205 	len = uio->uio_resid;
206 	*datlen = len - hlen;
207 	if ((unsigned)len > MCLBYTES)
208 		return (EIO);
209 
210 	if (len > MHLEN) {
211 		m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR);
212 	} else {
213 		MGETHDR(m, M_TRYWAIT, MT_DATA);
214 	}
215 	if (m == NULL)
216 		return (ENOBUFS);
217 	m->m_pkthdr.len = m->m_len = len;
218 	m->m_pkthdr.rcvif = NULL;
219 	*mp = m;
220 
221 	/*
222 	 * Make room for link header.
223 	 */
224 	if (hlen != 0) {
225 		m->m_pkthdr.len -= hlen;
226 		m->m_len -= hlen;
227 #if BSD >= 199103
228 		m->m_data += hlen; /* XXX */
229 #else
230 		m->m_off += hlen;
231 #endif
232 		error = uiomove(sockp->sa_data, hlen, uio);
233 		if (error)
234 			goto bad;
235 	}
236 	error = uiomove(mtod(m, void *), len - hlen, uio);
237 	if (!error)
238 		return (0);
239 bad:
240 	m_freem(m);
241 	return (error);
242 }
243 
244 /*
245  * Attach file to the bpf interface, i.e. make d listen on bp.
246  */
247 static void
248 bpf_attachd(d, bp)
249 	struct bpf_d *d;
250 	struct bpf_if *bp;
251 {
252 	/*
253 	 * Point d at bp, and add d to the interface's list of listeners.
254 	 * Finally, point the driver's bpf cookie at the interface so
255 	 * it will divert packets to bpf.
256 	 */
257 	BPFIF_LOCK(bp);
258 	d->bd_bif = bp;
259 	d->bd_next = bp->bif_dlist;
260 	bp->bif_dlist = d;
261 
262 	*bp->bif_driverp = bp;
263 	BPFIF_UNLOCK(bp);
264 }
265 
266 /*
267  * Detach a file from its interface.
268  */
269 static void
270 bpf_detachd(d)
271 	struct bpf_d *d;
272 {
273 	int error;
274 	struct bpf_d **p;
275 	struct bpf_if *bp;
276 
277 	/* XXX locking */
278 	bp = d->bd_bif;
279 	d->bd_bif = 0;
280 	/*
281 	 * Check if this descriptor had requested promiscuous mode.
282 	 * If so, turn it off.
283 	 */
284 	if (d->bd_promisc) {
285 		d->bd_promisc = 0;
286 		error = ifpromisc(bp->bif_ifp, 0);
287 		if (error != 0 && error != ENXIO) {
288 			/*
289 			 * ENXIO can happen if a pccard is unplugged
290 			 * Something is really wrong if we were able to put
291 			 * the driver into promiscuous mode, but can't
292 			 * take it out.
293 			 */
294 			if_printf(bp->bif_ifp,
295 				"bpf_detach: ifpromisc failed (%d)\n", error);
296 		}
297 	}
298 	/* Remove d from the interface's descriptor list. */
299 	BPFIF_LOCK(bp);
300 	p = &bp->bif_dlist;
301 	while (*p != d) {
302 		p = &(*p)->bd_next;
303 		if (*p == 0)
304 			panic("bpf_detachd: descriptor not in list");
305 	}
306 	*p = (*p)->bd_next;
307 	if (bp->bif_dlist == 0)
308 		/*
309 		 * Let the driver know that there are no more listeners.
310 		 */
311 		*bp->bif_driverp = 0;
312 	BPFIF_UNLOCK(bp);
313 }
314 
315 /*
316  * Open ethernet device.  Returns ENXIO for illegal minor device number,
317  * EBUSY if file is open by another process.
318  */
319 /* ARGSUSED */
320 static	int
321 bpfopen(dev, flags, fmt, td)
322 	dev_t dev;
323 	int flags;
324 	int fmt;
325 	struct thread *td;
326 {
327 	struct bpf_d *d;
328 
329 	mtx_lock(&bpf_mtx);
330 	d = dev->si_drv1;
331 	/*
332 	 * Each minor can be opened by only one process.  If the requested
333 	 * minor is in use, return EBUSY.
334 	 */
335 	if (d) {
336 		mtx_unlock(&bpf_mtx);
337 		return (EBUSY);
338 	}
339 	dev->si_drv1 = (struct bpf_d *)~0;	/* mark device in use */
340 	mtx_unlock(&bpf_mtx);
341 
342 	if ((dev->si_flags & SI_NAMED) == 0)
343 		make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600,
344 		    "bpf%d", dev2unit(dev));
345 	MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK | M_ZERO);
346 	dev->si_drv1 = d;
347 	d->bd_bufsize = bpf_bufsize;
348 	d->bd_sig = SIGIO;
349 	d->bd_seesent = 1;
350 #ifdef MAC
351 	mac_init_bpfdesc(d);
352 	mac_create_bpfdesc(td->td_ucred, d);
353 #endif
354 	mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
355 	callout_init(&d->bd_callout, CALLOUT_MPSAFE);
356 
357 	return (0);
358 }
359 
360 /*
361  * Close the descriptor by detaching it from its interface,
362  * deallocating its buffers, and marking it free.
363  */
364 /* ARGSUSED */
365 static	int
366 bpfclose(dev, flags, fmt, td)
367 	dev_t dev;
368 	int flags;
369 	int fmt;
370 	struct thread *td;
371 {
372 	struct bpf_d *d = dev->si_drv1;
373 
374 	BPFD_LOCK(d);
375 	if (d->bd_state == BPF_WAITING)
376 		callout_stop(&d->bd_callout);
377 	d->bd_state = BPF_IDLE;
378 	BPFD_UNLOCK(d);
379 	funsetown(&d->bd_sigio);
380 	mtx_lock(&bpf_mtx);
381 	if (d->bd_bif)
382 		bpf_detachd(d);
383 	mtx_unlock(&bpf_mtx);
384 #ifdef MAC
385 	mac_destroy_bpfdesc(d);
386 #endif /* MAC */
387 	bpf_freed(d);
388 	dev->si_drv1 = 0;
389 	free(d, M_BPF);
390 
391 	return (0);
392 }
393 
394 
395 /*
396  * Rotate the packet buffers in descriptor d.  Move the store buffer
397  * into the hold slot, and the free buffer into the store slot.
398  * Zero the length of the new store buffer.
399  */
400 #define ROTATE_BUFFERS(d) \
401 	(d)->bd_hbuf = (d)->bd_sbuf; \
402 	(d)->bd_hlen = (d)->bd_slen; \
403 	(d)->bd_sbuf = (d)->bd_fbuf; \
404 	(d)->bd_slen = 0; \
405 	(d)->bd_fbuf = 0;
406 /*
407  *  bpfread - read next chunk of packets from buffers
408  */
409 static	int
410 bpfread(dev, uio, ioflag)
411 	dev_t dev;
412 	struct uio *uio;
413 	int ioflag;
414 {
415 	struct bpf_d *d = dev->si_drv1;
416 	int timed_out;
417 	int error;
418 
419 	/*
420 	 * Restrict application to use a buffer the same size as
421 	 * as kernel buffers.
422 	 */
423 	if (uio->uio_resid != d->bd_bufsize)
424 		return (EINVAL);
425 
426 	BPFD_LOCK(d);
427 	if (d->bd_state == BPF_WAITING)
428 		callout_stop(&d->bd_callout);
429 	timed_out = (d->bd_state == BPF_TIMED_OUT);
430 	d->bd_state = BPF_IDLE;
431 	/*
432 	 * If the hold buffer is empty, then do a timed sleep, which
433 	 * ends when the timeout expires or when enough packets
434 	 * have arrived to fill the store buffer.
435 	 */
436 	while (d->bd_hbuf == 0) {
437 		if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
438 			/*
439 			 * A packet(s) either arrived since the previous
440 			 * read or arrived while we were asleep.
441 			 * Rotate the buffers and return what's here.
442 			 */
443 			ROTATE_BUFFERS(d);
444 			break;
445 		}
446 
447 		/*
448 		 * No data is available, check to see if the bpf device
449 		 * is still pointed at a real interface.  If not, return
450 		 * ENXIO so that the userland process knows to rebind
451 		 * it before using it again.
452 		 */
453 		if (d->bd_bif == NULL) {
454 			BPFD_UNLOCK(d);
455 			return (ENXIO);
456 		}
457 
458 		if (ioflag & IO_NDELAY) {
459 			BPFD_UNLOCK(d);
460 			return (EWOULDBLOCK);
461 		}
462 		error = msleep(d, &d->bd_mtx, PRINET|PCATCH,
463 		     "bpf", d->bd_rtout);
464 		if (error == EINTR || error == ERESTART) {
465 			BPFD_UNLOCK(d);
466 			return (error);
467 		}
468 		if (error == EWOULDBLOCK) {
469 			/*
470 			 * On a timeout, return what's in the buffer,
471 			 * which may be nothing.  If there is something
472 			 * in the store buffer, we can rotate the buffers.
473 			 */
474 			if (d->bd_hbuf)
475 				/*
476 				 * We filled up the buffer in between
477 				 * getting the timeout and arriving
478 				 * here, so we don't need to rotate.
479 				 */
480 				break;
481 
482 			if (d->bd_slen == 0) {
483 				BPFD_UNLOCK(d);
484 				return (0);
485 			}
486 			ROTATE_BUFFERS(d);
487 			break;
488 		}
489 	}
490 	/*
491 	 * At this point, we know we have something in the hold slot.
492 	 */
493 	BPFD_UNLOCK(d);
494 
495 	/*
496 	 * Move data from hold buffer into user space.
497 	 * We know the entire buffer is transferred since
498 	 * we checked above that the read buffer is bpf_bufsize bytes.
499 	 */
500 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
501 
502 	BPFD_LOCK(d);
503 	d->bd_fbuf = d->bd_hbuf;
504 	d->bd_hbuf = 0;
505 	d->bd_hlen = 0;
506 	BPFD_UNLOCK(d);
507 
508 	return (error);
509 }
510 
511 
512 /*
513  * If there are processes sleeping on this descriptor, wake them up.
514  */
515 static __inline void
516 bpf_wakeup(d)
517 	struct bpf_d *d;
518 {
519 	if (d->bd_state == BPF_WAITING) {
520 		callout_stop(&d->bd_callout);
521 		d->bd_state = BPF_IDLE;
522 	}
523 	wakeup(d);
524 	if (d->bd_async && d->bd_sig && d->bd_sigio)
525 		pgsigio(&d->bd_sigio, d->bd_sig, 0);
526 
527 	selwakeuppri(&d->bd_sel, PRINET);
528 	KNOTE(&d->bd_sel.si_note, 0);
529 }
530 
531 static void
532 bpf_timed_out(arg)
533 	void *arg;
534 {
535 	struct bpf_d *d = (struct bpf_d *)arg;
536 
537 	BPFD_LOCK(d);
538 	if (d->bd_state == BPF_WAITING) {
539 		d->bd_state = BPF_TIMED_OUT;
540 		if (d->bd_slen != 0)
541 			bpf_wakeup(d);
542 	}
543 	BPFD_UNLOCK(d);
544 }
545 
546 static	int
547 bpfwrite(dev, uio, ioflag)
548 	dev_t dev;
549 	struct uio *uio;
550 	int ioflag;
551 {
552 	struct bpf_d *d = dev->si_drv1;
553 	struct ifnet *ifp;
554 	struct mbuf *m;
555 	int error;
556 	static struct sockaddr dst;
557 	int datlen;
558 
559 	if (d->bd_bif == 0)
560 		return (ENXIO);
561 
562 	ifp = d->bd_bif->bif_ifp;
563 
564 	if (uio->uio_resid == 0)
565 		return (0);
566 
567 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, &m, &dst, &datlen);
568 	if (error)
569 		return (error);
570 
571 	if (datlen > ifp->if_mtu)
572 		return (EMSGSIZE);
573 
574 	if (d->bd_hdrcmplt)
575 		dst.sa_family = pseudo_AF_HDRCMPLT;
576 
577 #ifdef MAC
578 	BPFD_LOCK(d);
579 	mac_create_mbuf_from_bpfdesc(d, m);
580 	BPFD_UNLOCK(d);
581 #endif
582 	mtx_lock(&Giant);
583 	error = (*ifp->if_output)(ifp, m, &dst, (struct rtentry *)0);
584 	mtx_unlock(&Giant);
585 	/*
586 	 * The driver frees the mbuf.
587 	 */
588 	return (error);
589 }
590 
591 /*
592  * Reset a descriptor by flushing its packet buffer and clearing the
593  * receive and drop counts.
594  */
595 static void
596 reset_d(d)
597 	struct bpf_d *d;
598 {
599 
600 	mtx_assert(&d->bd_mtx, MA_OWNED);
601 	if (d->bd_hbuf) {
602 		/* Free the hold buffer. */
603 		d->bd_fbuf = d->bd_hbuf;
604 		d->bd_hbuf = 0;
605 	}
606 	d->bd_slen = 0;
607 	d->bd_hlen = 0;
608 	d->bd_rcount = 0;
609 	d->bd_dcount = 0;
610 }
611 
612 /*
613  *  FIONREAD		Check for read packet available.
614  *  SIOCGIFADDR		Get interface address - convenient hook to driver.
615  *  BIOCGBLEN		Get buffer len [for read()].
616  *  BIOCSETF		Set ethernet read filter.
617  *  BIOCFLUSH		Flush read packet buffer.
618  *  BIOCPROMISC		Put interface into promiscuous mode.
619  *  BIOCGDLT		Get link layer type.
620  *  BIOCGETIF		Get interface name.
621  *  BIOCSETIF		Set interface.
622  *  BIOCSRTIMEOUT	Set read timeout.
623  *  BIOCGRTIMEOUT	Get read timeout.
624  *  BIOCGSTATS		Get packet stats.
625  *  BIOCIMMEDIATE	Set immediate mode.
626  *  BIOCVERSION		Get filter language version.
627  *  BIOCGHDRCMPLT	Get "header already complete" flag
628  *  BIOCSHDRCMPLT	Set "header already complete" flag
629  *  BIOCGSEESENT	Get "see packets sent" flag
630  *  BIOCSSEESENT	Set "see packets sent" flag
631  */
632 /* ARGSUSED */
633 static	int
634 bpfioctl(dev, cmd, addr, flags, td)
635 	dev_t dev;
636 	u_long cmd;
637 	caddr_t addr;
638 	int flags;
639 	struct thread *td;
640 {
641 	struct bpf_d *d = dev->si_drv1;
642 	int error = 0;
643 
644 	BPFD_LOCK(d);
645 	if (d->bd_state == BPF_WAITING)
646 		callout_stop(&d->bd_callout);
647 	d->bd_state = BPF_IDLE;
648 	BPFD_UNLOCK(d);
649 
650 	switch (cmd) {
651 
652 	default:
653 		error = EINVAL;
654 		break;
655 
656 	/*
657 	 * Check for read packet available.
658 	 */
659 	case FIONREAD:
660 		{
661 			int n;
662 
663 			BPFD_LOCK(d);
664 			n = d->bd_slen;
665 			if (d->bd_hbuf)
666 				n += d->bd_hlen;
667 			BPFD_UNLOCK(d);
668 
669 			*(int *)addr = n;
670 			break;
671 		}
672 
673 	case SIOCGIFADDR:
674 		{
675 			struct ifnet *ifp;
676 
677 			if (d->bd_bif == 0)
678 				error = EINVAL;
679 			else {
680 				ifp = d->bd_bif->bif_ifp;
681 				error = (*ifp->if_ioctl)(ifp, cmd, addr);
682 			}
683 			break;
684 		}
685 
686 	/*
687 	 * Get buffer len [for read()].
688 	 */
689 	case BIOCGBLEN:
690 		*(u_int *)addr = d->bd_bufsize;
691 		break;
692 
693 	/*
694 	 * Set buffer length.
695 	 */
696 	case BIOCSBLEN:
697 		if (d->bd_bif != 0)
698 			error = EINVAL;
699 		else {
700 			u_int size = *(u_int *)addr;
701 
702 			if (size > bpf_maxbufsize)
703 				*(u_int *)addr = size = bpf_maxbufsize;
704 			else if (size < BPF_MINBUFSIZE)
705 				*(u_int *)addr = size = BPF_MINBUFSIZE;
706 			d->bd_bufsize = size;
707 		}
708 		break;
709 
710 	/*
711 	 * Set link layer read filter.
712 	 */
713 	case BIOCSETF:
714 		error = bpf_setf(d, (struct bpf_program *)addr);
715 		break;
716 
717 	/*
718 	 * Flush read packet buffer.
719 	 */
720 	case BIOCFLUSH:
721 		BPFD_LOCK(d);
722 		reset_d(d);
723 		BPFD_UNLOCK(d);
724 		break;
725 
726 	/*
727 	 * Put interface into promiscuous mode.
728 	 */
729 	case BIOCPROMISC:
730 		if (d->bd_bif == 0) {
731 			/*
732 			 * No interface attached yet.
733 			 */
734 			error = EINVAL;
735 			break;
736 		}
737 		if (d->bd_promisc == 0) {
738 			mtx_lock(&Giant);
739 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
740 			mtx_unlock(&Giant);
741 			if (error == 0)
742 				d->bd_promisc = 1;
743 		}
744 		break;
745 
746 	/*
747 	 * Get current data link type.
748 	 */
749 	case BIOCGDLT:
750 		if (d->bd_bif == 0)
751 			error = EINVAL;
752 		else
753 			*(u_int *)addr = d->bd_bif->bif_dlt;
754 		break;
755 
756 	/*
757 	 * Get a list of supported data link types.
758 	 */
759 	case BIOCGDLTLIST:
760 		if (d->bd_bif == 0)
761 			error = EINVAL;
762 		else
763 			error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
764 		break;
765 
766 	/*
767 	 * Set data link type.
768 	 */
769 	case BIOCSDLT:
770 		if (d->bd_bif == 0)
771 			error = EINVAL;
772 		else
773 			error = bpf_setdlt(d, *(u_int *)addr);
774 		break;
775 
776 	/*
777 	 * Get interface name.
778 	 */
779 	case BIOCGETIF:
780 		if (d->bd_bif == 0)
781 			error = EINVAL;
782 		else {
783 			struct ifnet *const ifp = d->bd_bif->bif_ifp;
784 			struct ifreq *const ifr = (struct ifreq *)addr;
785 
786 			strlcpy(ifr->ifr_name, ifp->if_xname,
787 			    sizeof(ifr->ifr_name));
788 		}
789 		break;
790 
791 	/*
792 	 * Set interface.
793 	 */
794 	case BIOCSETIF:
795 		error = bpf_setif(d, (struct ifreq *)addr);
796 		break;
797 
798 	/*
799 	 * Set read timeout.
800 	 */
801 	case BIOCSRTIMEOUT:
802 		{
803 			struct timeval *tv = (struct timeval *)addr;
804 
805 			/*
806 			 * Subtract 1 tick from tvtohz() since this isn't
807 			 * a one-shot timer.
808 			 */
809 			if ((error = itimerfix(tv)) == 0)
810 				d->bd_rtout = tvtohz(tv) - 1;
811 			break;
812 		}
813 
814 	/*
815 	 * Get read timeout.
816 	 */
817 	case BIOCGRTIMEOUT:
818 		{
819 			struct timeval *tv = (struct timeval *)addr;
820 
821 			tv->tv_sec = d->bd_rtout / hz;
822 			tv->tv_usec = (d->bd_rtout % hz) * tick;
823 			break;
824 		}
825 
826 	/*
827 	 * Get packet stats.
828 	 */
829 	case BIOCGSTATS:
830 		{
831 			struct bpf_stat *bs = (struct bpf_stat *)addr;
832 
833 			bs->bs_recv = d->bd_rcount;
834 			bs->bs_drop = d->bd_dcount;
835 			break;
836 		}
837 
838 	/*
839 	 * Set immediate mode.
840 	 */
841 	case BIOCIMMEDIATE:
842 		d->bd_immediate = *(u_int *)addr;
843 		break;
844 
845 	case BIOCVERSION:
846 		{
847 			struct bpf_version *bv = (struct bpf_version *)addr;
848 
849 			bv->bv_major = BPF_MAJOR_VERSION;
850 			bv->bv_minor = BPF_MINOR_VERSION;
851 			break;
852 		}
853 
854 	/*
855 	 * Get "header already complete" flag
856 	 */
857 	case BIOCGHDRCMPLT:
858 		*(u_int *)addr = d->bd_hdrcmplt;
859 		break;
860 
861 	/*
862 	 * Set "header already complete" flag
863 	 */
864 	case BIOCSHDRCMPLT:
865 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
866 		break;
867 
868 	/*
869 	 * Get "see sent packets" flag
870 	 */
871 	case BIOCGSEESENT:
872 		*(u_int *)addr = d->bd_seesent;
873 		break;
874 
875 	/*
876 	 * Set "see sent packets" flag
877 	 */
878 	case BIOCSSEESENT:
879 		d->bd_seesent = *(u_int *)addr;
880 		break;
881 
882 	case FIONBIO:		/* Non-blocking I/O */
883 		break;
884 
885 	case FIOASYNC:		/* Send signal on receive packets */
886 		d->bd_async = *(int *)addr;
887 		break;
888 
889 	case FIOSETOWN:
890 		error = fsetown(*(int *)addr, &d->bd_sigio);
891 		break;
892 
893 	case FIOGETOWN:
894 		*(int *)addr = fgetown(&d->bd_sigio);
895 		break;
896 
897 	/* This is deprecated, FIOSETOWN should be used instead. */
898 	case TIOCSPGRP:
899 		error = fsetown(-(*(int *)addr), &d->bd_sigio);
900 		break;
901 
902 	/* This is deprecated, FIOGETOWN should be used instead. */
903 	case TIOCGPGRP:
904 		*(int *)addr = -fgetown(&d->bd_sigio);
905 		break;
906 
907 	case BIOCSRSIG:		/* Set receive signal */
908 		{
909 			u_int sig;
910 
911 			sig = *(u_int *)addr;
912 
913 			if (sig >= NSIG)
914 				error = EINVAL;
915 			else
916 				d->bd_sig = sig;
917 			break;
918 		}
919 	case BIOCGRSIG:
920 		*(u_int *)addr = d->bd_sig;
921 		break;
922 	}
923 	return (error);
924 }
925 
926 /*
927  * Set d's packet filter program to fp.  If this file already has a filter,
928  * free it and replace it.  Returns EINVAL for bogus requests.
929  */
930 static int
931 bpf_setf(d, fp)
932 	struct bpf_d *d;
933 	struct bpf_program *fp;
934 {
935 	struct bpf_insn *fcode, *old;
936 	u_int flen, size;
937 
938 	old = d->bd_filter;
939 	if (fp->bf_insns == 0) {
940 		if (fp->bf_len != 0)
941 			return (EINVAL);
942 		BPFD_LOCK(d);
943 		d->bd_filter = 0;
944 		reset_d(d);
945 		BPFD_UNLOCK(d);
946 		if (old != 0)
947 			free((caddr_t)old, M_BPF);
948 		return (0);
949 	}
950 	flen = fp->bf_len;
951 	if (flen > BPF_MAXINSNS)
952 		return (EINVAL);
953 
954 	size = flen * sizeof(*fp->bf_insns);
955 	fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
956 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
957 	    bpf_validate(fcode, (int)flen)) {
958 		BPFD_LOCK(d);
959 		d->bd_filter = fcode;
960 		reset_d(d);
961 		BPFD_UNLOCK(d);
962 		if (old != 0)
963 			free((caddr_t)old, M_BPF);
964 
965 		return (0);
966 	}
967 	free((caddr_t)fcode, M_BPF);
968 	return (EINVAL);
969 }
970 
971 /*
972  * Detach a file from its current interface (if attached at all) and attach
973  * to the interface indicated by the name stored in ifr.
974  * Return an errno or 0.
975  */
976 static int
977 bpf_setif(d, ifr)
978 	struct bpf_d *d;
979 	struct ifreq *ifr;
980 {
981 	struct bpf_if *bp;
982 	int error;
983 	struct ifnet *theywant;
984 
985 	theywant = ifunit(ifr->ifr_name);
986 	if (theywant == 0)
987 		return ENXIO;
988 
989 	/*
990 	 * Look through attached interfaces for the named one.
991 	 */
992 	mtx_lock(&bpf_mtx);
993 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
994 		struct ifnet *ifp = bp->bif_ifp;
995 
996 		if (ifp == 0 || ifp != theywant)
997 			continue;
998 		/* skip additional entry */
999 		if (bp->bif_driverp != (struct bpf_if **)&ifp->if_bpf)
1000 			continue;
1001 
1002 		mtx_unlock(&bpf_mtx);
1003 		/*
1004 		 * We found the requested interface.
1005 		 * If it's not up, return an error.
1006 		 * Allocate the packet buffers if we need to.
1007 		 * If we're already attached to requested interface,
1008 		 * just flush the buffer.
1009 		 */
1010 		if ((ifp->if_flags & IFF_UP) == 0)
1011 			return (ENETDOWN);
1012 
1013 		if (d->bd_sbuf == 0) {
1014 			error = bpf_allocbufs(d);
1015 			if (error != 0)
1016 				return (error);
1017 		}
1018 		if (bp != d->bd_bif) {
1019 			if (d->bd_bif)
1020 				/*
1021 				 * Detach if attached to something else.
1022 				 */
1023 				bpf_detachd(d);
1024 
1025 			bpf_attachd(d, bp);
1026 		}
1027 		BPFD_LOCK(d);
1028 		reset_d(d);
1029 		BPFD_UNLOCK(d);
1030 		return (0);
1031 	}
1032 	mtx_unlock(&bpf_mtx);
1033 	/* Not found. */
1034 	return (ENXIO);
1035 }
1036 
1037 /*
1038  * Support for select() and poll() system calls
1039  *
1040  * Return true iff the specific operation will not block indefinitely.
1041  * Otherwise, return false but make a note that a selwakeup() must be done.
1042  */
1043 static int
1044 bpfpoll(dev, events, td)
1045 	dev_t dev;
1046 	int events;
1047 	struct thread *td;
1048 {
1049 	struct bpf_d *d;
1050 	int revents;
1051 
1052 	d = dev->si_drv1;
1053 	if (d->bd_bif == NULL)
1054 		return (ENXIO);
1055 
1056 	revents = events & (POLLOUT | POLLWRNORM);
1057 	BPFD_LOCK(d);
1058 	if (events & (POLLIN | POLLRDNORM)) {
1059 		if (bpf_ready(d))
1060 			revents |= events & (POLLIN | POLLRDNORM);
1061 		else {
1062 			selrecord(td, &d->bd_sel);
1063 			/* Start the read timeout if necessary. */
1064 			if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1065 				callout_reset(&d->bd_callout, d->bd_rtout,
1066 				    bpf_timed_out, d);
1067 				d->bd_state = BPF_WAITING;
1068 			}
1069 		}
1070 	}
1071 	BPFD_UNLOCK(d);
1072 	return (revents);
1073 }
1074 
1075 /*
1076  * Support for kevent() system call.  Register EVFILT_READ filters and
1077  * reject all others.
1078  */
1079 int
1080 bpfkqfilter(dev, kn)
1081 	dev_t dev;
1082 	struct knote *kn;
1083 {
1084 	struct bpf_d *d = (struct bpf_d *)dev->si_drv1;
1085 
1086 	if (kn->kn_filter != EVFILT_READ)
1087 		return (1);
1088 
1089 	kn->kn_fop = &bpfread_filtops;
1090 	kn->kn_hook = d;
1091 	BPFD_LOCK(d);
1092 	SLIST_INSERT_HEAD(&d->bd_sel.si_note, kn, kn_selnext);
1093 	BPFD_UNLOCK(d);
1094 
1095 	return (0);
1096 }
1097 
1098 static void
1099 filt_bpfdetach(kn)
1100 	struct knote *kn;
1101 {
1102 	struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1103 
1104 	BPFD_LOCK(d);
1105 	SLIST_REMOVE(&d->bd_sel.si_note, kn, knote, kn_selnext);
1106 	BPFD_UNLOCK(d);
1107 }
1108 
1109 static int
1110 filt_bpfread(kn, hint)
1111 	struct knote *kn;
1112 	long hint;
1113 {
1114 	struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1115 	int ready;
1116 
1117 	BPFD_LOCK(d);
1118 	ready = bpf_ready(d);
1119 	if (ready) {
1120 		kn->kn_data = d->bd_slen;
1121 		if (d->bd_hbuf)
1122 			kn->kn_data += d->bd_hlen;
1123 	}
1124 	else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1125 		callout_reset(&d->bd_callout, d->bd_rtout,
1126 		    bpf_timed_out, d);
1127 		d->bd_state = BPF_WAITING;
1128 	}
1129 	BPFD_UNLOCK(d);
1130 
1131 	return (ready);
1132 }
1133 
1134 /*
1135  * Incoming linkage from device drivers.  Process the packet pkt, of length
1136  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1137  * by each process' filter, and if accepted, stashed into the corresponding
1138  * buffer.
1139  */
1140 void
1141 bpf_tap(bp, pkt, pktlen)
1142 	struct bpf_if *bp;
1143 	u_char *pkt;
1144 	u_int pktlen;
1145 {
1146 	struct bpf_d *d;
1147 	u_int slen;
1148 
1149 	BPFIF_LOCK(bp);
1150 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1151 		BPFD_LOCK(d);
1152 		++d->bd_rcount;
1153 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1154 		if (slen != 0) {
1155 #ifdef MAC
1156 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1157 #endif
1158 				catchpacket(d, pkt, pktlen, slen, bcopy);
1159 		}
1160 		BPFD_UNLOCK(d);
1161 	}
1162 	BPFIF_UNLOCK(bp);
1163 }
1164 
1165 /*
1166  * Copy data from an mbuf chain into a buffer.  This code is derived
1167  * from m_copydata in sys/uipc_mbuf.c.
1168  */
1169 static void
1170 bpf_mcopy(src_arg, dst_arg, len)
1171 	const void *src_arg;
1172 	void *dst_arg;
1173 	size_t len;
1174 {
1175 	const struct mbuf *m;
1176 	u_int count;
1177 	u_char *dst;
1178 
1179 	m = src_arg;
1180 	dst = dst_arg;
1181 	while (len > 0) {
1182 		if (m == 0)
1183 			panic("bpf_mcopy");
1184 		count = min(m->m_len, len);
1185 		bcopy(mtod(m, void *), dst, count);
1186 		m = m->m_next;
1187 		dst += count;
1188 		len -= count;
1189 	}
1190 }
1191 
1192 /*
1193  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1194  */
1195 void
1196 bpf_mtap(bp, m)
1197 	struct bpf_if *bp;
1198 	struct mbuf *m;
1199 {
1200 	struct bpf_d *d;
1201 	u_int pktlen, slen;
1202 
1203 	pktlen = m_length(m, NULL);
1204 	if (pktlen == m->m_len) {
1205 		bpf_tap(bp, mtod(m, u_char *), pktlen);
1206 		return;
1207 	}
1208 
1209 	BPFIF_LOCK(bp);
1210 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1211 		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1212 			continue;
1213 		BPFD_LOCK(d);
1214 		++d->bd_rcount;
1215 		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1216 		if (slen != 0)
1217 #ifdef MAC
1218 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1219 #endif
1220 				catchpacket(d, (u_char *)m, pktlen, slen,
1221 				    bpf_mcopy);
1222 		BPFD_UNLOCK(d);
1223 	}
1224 	BPFIF_UNLOCK(bp);
1225 }
1226 
1227 /*
1228  * Incoming linkage from device drivers, when packet is in
1229  * an mbuf chain and to be prepended by a contiguous header.
1230  */
1231 void
1232 bpf_mtap2(bp, data, dlen, m)
1233 	struct bpf_if *bp;
1234 	void *data;
1235 	u_int dlen;
1236 	struct mbuf *m;
1237 {
1238 	struct mbuf mb;
1239 	struct bpf_d *d;
1240 	u_int pktlen, slen;
1241 
1242 	pktlen = m_length(m, NULL);
1243 	/*
1244 	 * Craft on-stack mbuf suitable for passing to bpf_filter.
1245 	 * Note that we cut corners here; we only setup what's
1246 	 * absolutely needed--this mbuf should never go anywhere else.
1247 	 */
1248 	mb.m_next = m;
1249 	mb.m_data = data;
1250 	mb.m_len = dlen;
1251 	pktlen += dlen;
1252 
1253 	BPFIF_LOCK(bp);
1254 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1255 		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1256 			continue;
1257 		BPFD_LOCK(d);
1258 		++d->bd_rcount;
1259 		slen = bpf_filter(d->bd_filter, (u_char *)&mb, pktlen, 0);
1260 		if (slen != 0)
1261 #ifdef MAC
1262 			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1263 #endif
1264 				catchpacket(d, (u_char *)&mb, pktlen, slen,
1265 				    bpf_mcopy);
1266 		BPFD_UNLOCK(d);
1267 	}
1268 	BPFIF_UNLOCK(bp);
1269 }
1270 
1271 /*
1272  * Move the packet data from interface memory (pkt) into the
1273  * store buffer.  "cpfn" is the routine called to do the actual data
1274  * transfer.  bcopy is passed in to copy contiguous chunks, while
1275  * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1276  * pkt is really an mbuf.
1277  */
1278 static void
1279 catchpacket(d, pkt, pktlen, snaplen, cpfn)
1280 	struct bpf_d *d;
1281 	u_char *pkt;
1282 	u_int pktlen, snaplen;
1283 	void (*cpfn)(const void *, void *, size_t);
1284 {
1285 	struct bpf_hdr *hp;
1286 	int totlen, curlen;
1287 	int hdrlen = d->bd_bif->bif_hdrlen;
1288 
1289 	/*
1290 	 * Figure out how many bytes to move.  If the packet is
1291 	 * greater or equal to the snapshot length, transfer that
1292 	 * much.  Otherwise, transfer the whole packet (unless
1293 	 * we hit the buffer size limit).
1294 	 */
1295 	totlen = hdrlen + min(snaplen, pktlen);
1296 	if (totlen > d->bd_bufsize)
1297 		totlen = d->bd_bufsize;
1298 
1299 	/*
1300 	 * Round up the end of the previous packet to the next longword.
1301 	 */
1302 	curlen = BPF_WORDALIGN(d->bd_slen);
1303 	if (curlen + totlen > d->bd_bufsize) {
1304 		/*
1305 		 * This packet will overflow the storage buffer.
1306 		 * Rotate the buffers if we can, then wakeup any
1307 		 * pending reads.
1308 		 */
1309 		if (d->bd_fbuf == 0) {
1310 			/*
1311 			 * We haven't completed the previous read yet,
1312 			 * so drop the packet.
1313 			 */
1314 			++d->bd_dcount;
1315 			return;
1316 		}
1317 		ROTATE_BUFFERS(d);
1318 		bpf_wakeup(d);
1319 		curlen = 0;
1320 	}
1321 	else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1322 		/*
1323 		 * Immediate mode is set, or the read timeout has
1324 		 * already expired during a select call.  A packet
1325 		 * arrived, so the reader should be woken up.
1326 		 */
1327 		bpf_wakeup(d);
1328 
1329 	/*
1330 	 * Append the bpf header.
1331 	 */
1332 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1333 	microtime(&hp->bh_tstamp);
1334 	hp->bh_datalen = pktlen;
1335 	hp->bh_hdrlen = hdrlen;
1336 	/*
1337 	 * Copy the packet data into the store buffer and update its length.
1338 	 */
1339 	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1340 	d->bd_slen = curlen + totlen;
1341 }
1342 
1343 /*
1344  * Initialize all nonzero fields of a descriptor.
1345  */
1346 static int
1347 bpf_allocbufs(d)
1348 	struct bpf_d *d;
1349 {
1350 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1351 	if (d->bd_fbuf == 0)
1352 		return (ENOBUFS);
1353 
1354 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1355 	if (d->bd_sbuf == 0) {
1356 		free(d->bd_fbuf, M_BPF);
1357 		return (ENOBUFS);
1358 	}
1359 	d->bd_slen = 0;
1360 	d->bd_hlen = 0;
1361 	return (0);
1362 }
1363 
1364 /*
1365  * Free buffers currently in use by a descriptor.
1366  * Called on close.
1367  */
1368 static void
1369 bpf_freed(d)
1370 	struct bpf_d *d;
1371 {
1372 	/*
1373 	 * We don't need to lock out interrupts since this descriptor has
1374 	 * been detached from its interface and it yet hasn't been marked
1375 	 * free.
1376 	 */
1377 	if (d->bd_sbuf != 0) {
1378 		free(d->bd_sbuf, M_BPF);
1379 		if (d->bd_hbuf != 0)
1380 			free(d->bd_hbuf, M_BPF);
1381 		if (d->bd_fbuf != 0)
1382 			free(d->bd_fbuf, M_BPF);
1383 	}
1384 	if (d->bd_filter)
1385 		free((caddr_t)d->bd_filter, M_BPF);
1386 	mtx_destroy(&d->bd_mtx);
1387 }
1388 
1389 /*
1390  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
1391  * fixed size of the link header (variable length headers not yet supported).
1392  */
1393 void
1394 bpfattach(ifp, dlt, hdrlen)
1395 	struct ifnet *ifp;
1396 	u_int dlt, hdrlen;
1397 {
1398 
1399 	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1400 }
1401 
1402 /*
1403  * Attach an interface to bpf.  ifp is a pointer to the structure
1404  * defining the interface to be attached, dlt is the link layer type,
1405  * and hdrlen is the fixed size of the link header (variable length
1406  * headers are not yet supporrted).
1407  */
1408 void
1409 bpfattach2(ifp, dlt, hdrlen, driverp)
1410 	struct ifnet *ifp;
1411 	u_int dlt, hdrlen;
1412 	struct bpf_if **driverp;
1413 {
1414 	struct bpf_if *bp;
1415 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
1416 	if (bp == 0)
1417 		panic("bpfattach");
1418 
1419 	bp->bif_dlist = 0;
1420 	bp->bif_driverp = driverp;
1421 	bp->bif_ifp = ifp;
1422 	bp->bif_dlt = dlt;
1423 	mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
1424 
1425 	mtx_lock(&bpf_mtx);
1426 	bp->bif_next = bpf_iflist;
1427 	bpf_iflist = bp;
1428 	mtx_unlock(&bpf_mtx);
1429 
1430 	*bp->bif_driverp = 0;
1431 
1432 	/*
1433 	 * Compute the length of the bpf header.  This is not necessarily
1434 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1435 	 * that the network layer header begins on a longword boundary (for
1436 	 * performance reasons and to alleviate alignment restrictions).
1437 	 */
1438 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1439 
1440 	if (bootverbose)
1441 		if_printf(ifp, "bpf attached\n");
1442 }
1443 
1444 /*
1445  * Detach bpf from an interface.  This involves detaching each descriptor
1446  * associated with the interface, and leaving bd_bif NULL.  Notify each
1447  * descriptor as it's detached so that any sleepers wake up and get
1448  * ENXIO.
1449  */
1450 void
1451 bpfdetach(ifp)
1452 	struct ifnet *ifp;
1453 {
1454 	struct bpf_if	*bp, *bp_prev;
1455 	struct bpf_d	*d;
1456 
1457 	/* Locate BPF interface information */
1458 	bp_prev = NULL;
1459 
1460 	mtx_lock(&bpf_mtx);
1461 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1462 		if (ifp == bp->bif_ifp)
1463 			break;
1464 		bp_prev = bp;
1465 	}
1466 
1467 	/* Interface wasn't attached */
1468 	if ((bp == NULL) || (bp->bif_ifp == NULL)) {
1469 		mtx_unlock(&bpf_mtx);
1470 		printf("bpfdetach: %s was not attached\n", ifp->if_xname);
1471 		return;
1472 	}
1473 
1474 	if (bp_prev) {
1475 		bp_prev->bif_next = bp->bif_next;
1476 	} else {
1477 		bpf_iflist = bp->bif_next;
1478 	}
1479 	mtx_unlock(&bpf_mtx);
1480 
1481 	while ((d = bp->bif_dlist) != NULL) {
1482 		bpf_detachd(d);
1483 		BPFD_LOCK(d);
1484 		bpf_wakeup(d);
1485 		BPFD_UNLOCK(d);
1486 	}
1487 
1488 	mtx_destroy(&bp->bif_mtx);
1489 	free(bp, M_BPF);
1490 }
1491 
1492 /*
1493  * Get a list of available data link type of the interface.
1494  */
1495 static int
1496 bpf_getdltlist(d, bfl)
1497 	struct bpf_d *d;
1498 	struct bpf_dltlist *bfl;
1499 {
1500 	int n, error;
1501 	struct ifnet *ifp;
1502 	struct bpf_if *bp;
1503 
1504 	ifp = d->bd_bif->bif_ifp;
1505 	n = 0;
1506 	error = 0;
1507 	mtx_lock(&bpf_mtx);
1508 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1509 		if (bp->bif_ifp != ifp)
1510 			continue;
1511 		if (bfl->bfl_list != NULL) {
1512 			if (n >= bfl->bfl_len) {
1513 				mtx_unlock(&bpf_mtx);
1514 				return (ENOMEM);
1515 			}
1516 			error = copyout(&bp->bif_dlt,
1517 			    bfl->bfl_list + n, sizeof(u_int));
1518 		}
1519 		n++;
1520 	}
1521 	mtx_unlock(&bpf_mtx);
1522 	bfl->bfl_len = n;
1523 	return (error);
1524 }
1525 
1526 /*
1527  * Set the data link type of a BPF instance.
1528  */
1529 static int
1530 bpf_setdlt(d, dlt)
1531 	struct bpf_d *d;
1532 	u_int dlt;
1533 {
1534 	int error, opromisc;
1535 	struct ifnet *ifp;
1536 	struct bpf_if *bp;
1537 
1538 	if (d->bd_bif->bif_dlt == dlt)
1539 		return (0);
1540 	ifp = d->bd_bif->bif_ifp;
1541 	mtx_lock(&bpf_mtx);
1542 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1543 		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1544 			break;
1545 	}
1546 	mtx_unlock(&bpf_mtx);
1547 	if (bp != NULL) {
1548 		BPFD_LOCK(d);
1549 		opromisc = d->bd_promisc;
1550 		bpf_detachd(d);
1551 		bpf_attachd(d, bp);
1552 		reset_d(d);
1553 		BPFD_UNLOCK(d);
1554 		if (opromisc) {
1555 			error = ifpromisc(bp->bif_ifp, 1);
1556 			if (error)
1557 				if_printf(bp->bif_ifp,
1558 					"bpf_setdlt: ifpromisc failed (%d)\n",
1559 					error);
1560 			else
1561 				d->bd_promisc = 1;
1562 		}
1563 	}
1564 	return (bp == NULL ? EINVAL : 0);
1565 }
1566 
1567 static void bpf_drvinit(void *unused);
1568 
1569 static void bpf_clone(void *arg, char *name, int namelen, dev_t *dev);
1570 
1571 static void
1572 bpf_clone(arg, name, namelen, dev)
1573 	void *arg;
1574 	char *name;
1575 	int namelen;
1576 	dev_t *dev;
1577 {
1578 	int u;
1579 
1580 	if (*dev != NODEV)
1581 		return;
1582 	if (dev_stdclone(name, NULL, "bpf", &u) != 1)
1583 		return;
1584 	*dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
1585 	    "bpf%d", u);
1586 	(*dev)->si_flags |= SI_CHEAPCLONE;
1587 	return;
1588 }
1589 
1590 static void
1591 bpf_drvinit(unused)
1592 	void *unused;
1593 {
1594 
1595 	mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
1596 	EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000);
1597 }
1598 
1599 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL)
1600 
1601 #else /* !DEV_BPF && !NETGRAPH_BPF */
1602 /*
1603  * NOP stubs to allow bpf-using drivers to load and function.
1604  *
1605  * A 'better' implementation would allow the core bpf functionality
1606  * to be loaded at runtime.
1607  */
1608 
1609 void
1610 bpf_tap(bp, pkt, pktlen)
1611 	struct bpf_if *bp;
1612 	u_char *pkt;
1613 	u_int pktlen;
1614 {
1615 }
1616 
1617 void
1618 bpf_mtap(bp, m)
1619 	struct bpf_if *bp;
1620 	struct mbuf *m;
1621 {
1622 }
1623 
1624 void
1625 bpf_mtap2(bp, d, l, m)
1626 	struct bpf_if *bp;
1627 	void *d;
1628 	u_int l;
1629 	struct mbuf *m;
1630 {
1631 }
1632 
1633 void
1634 bpfattach(ifp, dlt, hdrlen)
1635 	struct ifnet *ifp;
1636 	u_int dlt, hdrlen;
1637 {
1638 }
1639 
1640 void
1641 bpfattach2(ifp, dlt, hdrlen, driverp)
1642 	struct ifnet *ifp;
1643 	u_int dlt, hdrlen;
1644 	struct bpf_if **driverp;
1645 {
1646 }
1647 
1648 void
1649 bpfdetach(ifp)
1650 	struct ifnet *ifp;
1651 {
1652 }
1653 
1654 u_int
1655 bpf_filter(pc, p, wirelen, buflen)
1656 	const struct bpf_insn *pc;
1657 	u_char *p;
1658 	u_int wirelen;
1659 	u_int buflen;
1660 {
1661 	return -1;	/* "no filter" behaviour */
1662 }
1663 
1664 int
1665 bpf_validate(f, len)
1666 	const struct bpf_insn *f;
1667 	int len;
1668 {
1669 	return 0;		/* false */
1670 }
1671 
1672 #endif /* !DEV_BPF && !NETGRAPH_BPF */
1673