1 /* $NetBSD: bpf.c,v 1.143 2009/03/11 05:55:22 mrg Exp $ */ 2 3 /* 4 * Copyright (c) 1990, 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * This code is derived from the Stanford/CMU enet packet filter, 8 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 9 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 10 * Berkeley Laboratory. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)bpf.c 8.4 (Berkeley) 1/9/95 37 * static char rcsid[] = 38 * "Header: bpf.c,v 1.67 96/09/26 22:00:52 leres Exp "; 39 */ 40 /* 41 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 42 * Use is subject to license terms. 43 * Copyright 2017 Joyent, Inc. 44 */ 45 46 /* 47 * The BPF implements the following access controls for zones attempting 48 * to read and write data. Writing of data requires that the net_rawaccess 49 * privilege is held whilst reading data requires either net_rawaccess or 50 * net_observerability. 51 * 52 * | Shared | Exclusive | Global 53 * -----------------------------+--------+------------+------------+ 54 * DLT_IPNET in local zone | Read | Read | Read | 55 * -----------------------------+--------+------------+------------+ 56 * Raw access to local zone NIC | None | Read/Write | Read/Write | 57 * -----------------------------+--------+------------+------------+ 58 * Raw access to all NICs | None | None | Read/Write | 59 * -----------------------------+--------+------------+------------+ 60 * 61 * The BPF driver is written as a cloning driver: each call to bpfopen() 62 * allocates a new minor number. This provides BPF with a 1:1 relationship 63 * between open's and close's. There is some amount of "descriptor state" 64 * that is kept per open. Pointers to this data are stored in a hash table 65 * (bpf_hash) that is index'd by the minor device number for each open file. 66 */ 67 #include <sys/param.h> 68 #include <sys/systm.h> 69 #include <sys/time.h> 70 #include <sys/ioctl.h> 71 #include <sys/queue.h> 72 #include <sys/filio.h> 73 #include <sys/policy.h> 74 #include <sys/cmn_err.h> 75 #include <sys/uio.h> 76 #include <sys/file.h> 77 #include <sys/sysmacros.h> 78 #include <sys/zone.h> 79 80 #include <sys/socket.h> 81 #include <sys/errno.h> 82 #include <sys/poll.h> 83 #include <sys/dlpi.h> 84 #include <sys/neti.h> 85 86 #include <net/if.h> 87 88 #include <net/bpf.h> 89 #include <net/bpfdesc.h> 90 #include <net/dlt.h> 91 92 #include <netinet/in.h> 93 #include <sys/mac.h> 94 #include <sys/mac_client.h> 95 #include <sys/mac_impl.h> 96 #include <sys/time_std_impl.h> 97 #include <sys/hook.h> 98 #include <sys/hook_event.h> 99 100 101 #define mtod(_v, _t) (_t)((_v)->b_rptr) 102 #define M_LEN(_m) ((_m)->b_wptr - (_m)->b_rptr) 103 104 /* 105 * 4096 is too small for FDDI frames. 8192 is too small for gigabit Ethernet 106 * jumbos (circa 9k), ATM, or Intel gig/10gig ethernet jumbos (16k). 107 */ 108 #define BPF_BUFSIZE (32 * 1024) 109 110 typedef void *(*cp_fn_t)(void *, const void *, size_t); 111 112 /* 113 * The default read buffer size, and limit for BIOCSBLEN. 114 */ 115 int bpf_bufsize = BPF_BUFSIZE; 116 int bpf_maxbufsize = (16 * 1024 * 1024); 117 static mod_hash_t *bpf_hash = NULL; 118 119 /* 120 * Use a mutex to avoid a race condition between gathering the stats/peers 121 * and opening/closing the device. 122 */ 123 static kcondvar_t bpf_dlt_waiter; 124 static kmutex_t bpf_mtx; 125 static bpf_kstats_t ks_stats; 126 static bpf_kstats_t bpf_kstats = { 127 { "readWait", KSTAT_DATA_UINT64 }, 128 { "writeOk", KSTAT_DATA_UINT64 }, 129 { "writeError", KSTAT_DATA_UINT64 }, 130 { "receive", KSTAT_DATA_UINT64 }, 131 { "captured", KSTAT_DATA_UINT64 }, 132 { "dropped", KSTAT_DATA_UINT64 }, 133 }; 134 static kstat_t *bpf_ksp; 135 136 /* 137 * bpf_list is a list of the BPF descriptors currently open 138 */ 139 LIST_HEAD(, bpf_d) bpf_list; 140 141 static int bpf_allocbufs(struct bpf_d *); 142 static void bpf_clear_timeout(struct bpf_d *); 143 static void bpf_deliver(struct bpf_d *, cp_fn_t, 144 void *, uint_t, uint_t, boolean_t); 145 static void bpf_freed(struct bpf_d *); 146 static int bpf_ifname(struct bpf_d *d, char *, int); 147 static void *bpf_mcpy(void *, const void *, size_t); 148 static int bpf_attachd(struct bpf_d *, const char *, int); 149 static void bpf_detachd(struct bpf_d *); 150 static int bpf_setif(struct bpf_d *, char *, int); 151 static void bpf_timed_out(void *); 152 static inline void 153 bpf_wakeup(struct bpf_d *); 154 static void catchpacket(struct bpf_d *, uchar_t *, uint_t, uint_t, 155 cp_fn_t, struct timeval *); 156 static void reset_d(struct bpf_d *); 157 static int bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *); 158 static int bpf_setdlt(struct bpf_d *, void *); 159 static void bpf_dev_add(struct bpf_d *); 160 static struct bpf_d *bpf_dev_find(minor_t); 161 static struct bpf_d *bpf_dev_get(minor_t); 162 static void bpf_dev_remove(struct bpf_d *); 163 164 static int 165 bpf_movein(struct uio *uio, int linktype, int mtu, mblk_t **mp) 166 { 167 mblk_t *m; 168 int error; 169 int len; 170 int hlen; 171 int align; 172 173 /* 174 * Build a sockaddr based on the data link layer type. 175 * We do this at this level because the ethernet header 176 * is copied directly into the data field of the sockaddr. 177 * In the case of SLIP, there is no header and the packet 178 * is forwarded as is. 179 * Also, we are careful to leave room at the front of the mbuf 180 * for the link level header. 181 */ 182 switch (linktype) { 183 184 case DLT_EN10MB: 185 hlen = sizeof (struct ether_header); 186 break; 187 188 case DLT_FDDI: 189 hlen = 16; 190 break; 191 192 case DLT_NULL: 193 hlen = 0; 194 break; 195 196 case DLT_IPOIB: 197 hlen = 44; 198 break; 199 200 default: 201 return (EIO); 202 } 203 204 align = 4 - (hlen & 3); 205 206 len = uio->uio_resid; 207 /* 208 * If there aren't enough bytes for a link level header or the 209 * packet length exceeds the interface mtu, return an error. 210 */ 211 if (len < hlen || len - hlen > mtu) 212 return (EMSGSIZE); 213 214 m = allocb(len + align, BPRI_MED); 215 if (m == NULL) { 216 error = ENOBUFS; 217 goto bad; 218 } 219 220 /* Insure the data is properly aligned */ 221 if (align > 0) 222 m->b_rptr += align; 223 m->b_wptr = m->b_rptr + len; 224 225 error = uiomove(mtod(m, void *), len, UIO_WRITE, uio); 226 if (error) 227 goto bad; 228 *mp = m; 229 return (0); 230 231 bad: 232 if (m != NULL) 233 freemsg(m); 234 return (error); 235 } 236 237 238 /* 239 * Attach file to the bpf interface, i.e. make d listen on bp. 240 */ 241 static int 242 bpf_attachd(struct bpf_d *d, const char *ifname, int dlt) 243 { 244 bpf_provider_list_t *bp; 245 bpf_provider_t *bpr; 246 boolean_t zonematch; 247 zoneid_t niczone; 248 uintptr_t mcip; 249 zoneid_t zone; 250 uint_t nicdlt; 251 uintptr_t mh; 252 int hdrlen; 253 int error; 254 255 ASSERT(d->bd_bif == (uintptr_t)NULL); 256 ASSERT(d->bd_mcip == (uintptr_t)NULL); 257 zone = d->bd_zone; 258 zonematch = B_TRUE; 259 error = 0; 260 bpr = NULL; 261 again: 262 mh = 0; 263 mcip = 0; 264 LIST_FOREACH(bp, &bpf_providers, bpl_next) { 265 bpr = bp->bpl_what; 266 error = MBPF_OPEN(bpr, ifname, &mh, zone); 267 if (error != 0) 268 goto next; 269 error = MBPF_CLIENT_OPEN(bpr, mh, &mcip); 270 if (error != 0) 271 goto next; 272 error = MBPF_GET_DLT(bpr, mh, &nicdlt); 273 if (error != 0) 274 goto next; 275 276 nicdlt = bpf_dl_to_dlt(nicdlt); 277 if (dlt != -1 && dlt != nicdlt) { 278 error = ENOENT; 279 goto next; 280 } 281 282 error = MBPF_GET_ZONE(bpr, mh, &niczone); 283 if (error != 0) 284 goto next; 285 286 DTRACE_PROBE4(bpf__attach, struct bpf_provider_s *, bpr, 287 uintptr_t, mh, int, nicdlt, zoneid_t, niczone); 288 289 if (zonematch && niczone != zone) { 290 error = ENOENT; 291 goto next; 292 } 293 break; 294 next: 295 if (mcip != 0) { 296 MBPF_CLIENT_CLOSE(bpr, mcip); 297 mcip = 0; 298 } 299 if (mh != 0) { 300 MBPF_CLOSE(bpr, mh); 301 mh = 0; 302 } 303 } 304 if (error != 0) { 305 if (zonematch && (zone == GLOBAL_ZONEID)) { 306 /* 307 * If we failed to do an exact match for the global 308 * zone using the global zoneid, try again in case 309 * the network interface is owned by a local zone. 310 */ 311 zonematch = B_FALSE; 312 goto again; 313 } 314 return (error); 315 } 316 317 /* No providers? */ 318 if (bpr == NULL) 319 return (ENOENT); 320 321 d->bd_mac = *bpr; 322 d->bd_mcip = mcip; 323 d->bd_bif = mh; 324 d->bd_dlt = nicdlt; 325 hdrlen = bpf_dl_hdrsize(nicdlt); 326 d->bd_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen; 327 328 (void) strlcpy(d->bd_ifname, MBPF_CLIENT_NAME(&d->bd_mac, mcip), 329 sizeof (d->bd_ifname)); 330 331 (void) MBPF_GET_LINKID(&d->bd_mac, d->bd_ifname, &d->bd_linkid, 332 zone); 333 (void) MBPF_PROMISC_ADD(&d->bd_mac, d->bd_mcip, 0, d, 334 &d->bd_promisc_handle, d->bd_promisc_flags); 335 return (0); 336 } 337 338 /* 339 * Detach a file from its interface. 340 */ 341 static void 342 bpf_detachd(struct bpf_d *d) 343 { 344 uintptr_t mph; 345 uintptr_t mch; 346 uintptr_t mh; 347 348 ASSERT(d->bd_inuse == -1); 349 mch = d->bd_mcip; 350 d->bd_mcip = 0; 351 mh = d->bd_bif; 352 d->bd_bif = 0; 353 354 /* 355 * Check if this descriptor had requested promiscuous mode. 356 * If so, turn it off. There's no need to take any action 357 * here, that is done when MBPF_PROMISC_REMOVE is used; 358 * bd_promisc is just a local flag to stop promiscuous mode 359 * from being set more than once. 360 */ 361 if (d->bd_promisc) 362 d->bd_promisc = 0; 363 364 /* 365 * Take device out of "promiscuous" mode. Since we were able to 366 * enter "promiscuous" mode, we should be able to turn it off. 367 * Note, this field stores a pointer used to support both 368 * promiscuous and non-promiscuous callbacks for packets. 369 */ 370 mph = d->bd_promisc_handle; 371 d->bd_promisc_handle = 0; 372 373 /* 374 * The lock has to be dropped here because mac_promisc_remove may 375 * need to wait for mac_promisc_dispatch, which has called into 376 * bpf and catchpacket is waiting for bd_lock... 377 * i.e mac_promisc_remove() needs to be called with none of the 378 * locks held that are part of the bpf_mtap() call path. 379 */ 380 mutex_exit(&d->bd_lock); 381 if (mph != 0) 382 MBPF_PROMISC_REMOVE(&d->bd_mac, mph); 383 384 if (mch != 0) 385 MBPF_CLIENT_CLOSE(&d->bd_mac, mch); 386 387 if (mh != 0) 388 MBPF_CLOSE(&d->bd_mac, mh); 389 390 /* 391 * Because this function is called with bd_lock held, so it must 392 * exit with it held. 393 */ 394 mutex_enter(&d->bd_lock); 395 *d->bd_ifname = '\0'; 396 (void) memset(&d->bd_mac, 0, sizeof (d->bd_mac)); 397 } 398 399 400 /* 401 * bpfilterattach() is called at load time. 402 */ 403 int 404 bpfilterattach(void) 405 { 406 407 bpf_hash = mod_hash_create_idhash("bpf_dev_tab", 31, 408 mod_hash_null_keydtor); 409 if (bpf_hash == NULL) 410 return (ENOMEM); 411 412 (void) memcpy(&ks_stats, &bpf_kstats, sizeof (bpf_kstats)); 413 414 bpf_ksp = kstat_create("bpf", 0, "global", "misc", 415 KSTAT_TYPE_NAMED, sizeof (bpf_kstats) / sizeof (kstat_named_t), 416 KSTAT_FLAG_VIRTUAL); 417 if (bpf_ksp != NULL) { 418 bpf_ksp->ks_data = &ks_stats; 419 kstat_install(bpf_ksp); 420 } else { 421 mod_hash_destroy_idhash(bpf_hash); 422 bpf_hash = NULL; 423 return (EEXIST); 424 } 425 426 cv_init(&bpf_dlt_waiter, NULL, CV_DRIVER, NULL); 427 mutex_init(&bpf_mtx, NULL, MUTEX_DRIVER, NULL); 428 429 LIST_INIT(&bpf_list); 430 431 return (0); 432 } 433 434 435 /* 436 * bpfilterdetach() is called at unload time. 437 */ 438 int 439 bpfilterdetach(void) 440 { 441 442 if (bpf_ksp != NULL) { 443 kstat_delete(bpf_ksp); 444 bpf_ksp = NULL; 445 } 446 447 mod_hash_destroy_idhash(bpf_hash); 448 bpf_hash = NULL; 449 450 cv_destroy(&bpf_dlt_waiter); 451 mutex_destroy(&bpf_mtx); 452 453 return (0); 454 } 455 456 /* 457 * Open ethernet device. Clones. 458 */ 459 /* ARGSUSED */ 460 int 461 bpfopen(dev_t *devp, int flag, int mode, cred_t *cred) 462 { 463 struct bpf_d *d; 464 uint_t dmin; 465 466 /* 467 * The security policy described at the top of this file is 468 * enforced here. 469 */ 470 if ((flag & FWRITE) != 0) { 471 if (secpolicy_net_rawaccess(cred) != 0) 472 return (EACCES); 473 } 474 475 if ((flag & FREAD) != 0) { 476 if ((secpolicy_net_observability(cred) != 0) && 477 (secpolicy_net_rawaccess(cred) != 0)) 478 return (EACCES); 479 } 480 481 if ((flag & (FWRITE|FREAD)) == 0) 482 return (ENXIO); 483 484 /* 485 * A structure is allocated per open file in BPF to store settings 486 * such as buffer capture size, provide private buffers, etc. 487 */ 488 d = (struct bpf_d *)kmem_zalloc(sizeof (*d), KM_SLEEP); 489 d->bd_bufsize = bpf_bufsize; 490 d->bd_fmode = flag; 491 d->bd_zone = crgetzoneid(cred); 492 d->bd_seesent = 1; 493 d->bd_promisc_flags = MAC_PROMISC_FLAGS_NO_PHYS| 494 MAC_PROMISC_FLAGS_NO_COPY; 495 mutex_init(&d->bd_lock, NULL, MUTEX_DRIVER, NULL); 496 cv_init(&d->bd_wait, NULL, CV_DRIVER, NULL); 497 498 mutex_enter(&bpf_mtx); 499 /* 500 * Find an unused minor number. Obviously this is an O(n) algorithm 501 * and doesn't scale particularly well, so if there are large numbers 502 * of open file descriptors happening in real use, this design may 503 * need to be revisited. 504 */ 505 for (dmin = 0; dmin < L_MAXMIN; dmin++) 506 if (bpf_dev_find(dmin) == NULL) 507 break; 508 if (dmin == L_MAXMIN) { 509 mutex_exit(&bpf_mtx); 510 kmem_free(d, sizeof (*d)); 511 return (ENXIO); 512 } 513 d->bd_dev = dmin; 514 LIST_INSERT_HEAD(&bpf_list, d, bd_list); 515 bpf_dev_add(d); 516 mutex_exit(&bpf_mtx); 517 518 *devp = makedevice(getmajor(*devp), dmin); 519 520 return (0); 521 } 522 523 /* 524 * Close the descriptor by detaching it from its interface, 525 * deallocating its buffers, and marking it free. 526 * 527 * Because we only allow a device to be opened once, there is always a 528 * 1 to 1 relationship between opens and closes supporting this function. 529 */ 530 /* ARGSUSED */ 531 int 532 bpfclose(dev_t dev, int flag, int otyp, cred_t *cred_p) 533 { 534 struct bpf_d *d = bpf_dev_get(getminor(dev)); 535 536 mutex_enter(&d->bd_lock); 537 538 while (d->bd_inuse != 0) { 539 d->bd_waiting++; 540 if (cv_wait_sig(&d->bd_wait, &d->bd_lock) <= 0) { 541 d->bd_waiting--; 542 mutex_exit(&d->bd_lock); 543 return (EINTR); 544 } 545 d->bd_waiting--; 546 } 547 548 d->bd_inuse = -1; 549 if (d->bd_state == BPF_WAITING) 550 bpf_clear_timeout(d); 551 d->bd_state = BPF_IDLE; 552 if (d->bd_bif) 553 bpf_detachd(d); 554 mutex_exit(&d->bd_lock); 555 556 mutex_enter(&bpf_mtx); 557 LIST_REMOVE(d, bd_list); 558 bpf_dev_remove(d); 559 mutex_exit(&bpf_mtx); 560 561 mutex_enter(&d->bd_lock); 562 mutex_destroy(&d->bd_lock); 563 cv_destroy(&d->bd_wait); 564 565 bpf_freed(d); 566 kmem_free(d, sizeof (*d)); 567 568 return (0); 569 } 570 571 /* 572 * Rotate the packet buffers in descriptor d. Move the store buffer 573 * into the hold slot, and the free buffer into the store slot. 574 * Zero the length of the new store buffer. 575 */ 576 #define ROTATE_BUFFERS(d) \ 577 (d)->bd_hbuf = (d)->bd_sbuf; \ 578 (d)->bd_hlen = (d)->bd_slen; \ 579 (d)->bd_sbuf = (d)->bd_fbuf; \ 580 (d)->bd_slen = 0; \ 581 (d)->bd_fbuf = 0; 582 /* 583 * bpfread - read next chunk of packets from buffers 584 */ 585 /* ARGSUSED */ 586 int 587 bpfread(dev_t dev, struct uio *uio, cred_t *cred) 588 { 589 struct bpf_d *d = bpf_dev_get(getminor(dev)); 590 int timed_out; 591 ulong_t delay; 592 int error; 593 594 if ((d->bd_fmode & FREAD) == 0) 595 return (EBADF); 596 597 /* 598 * Restrict application to use a buffer the same size as 599 * the kernel buffers. 600 */ 601 if (uio->uio_resid != d->bd_bufsize) 602 return (EINVAL); 603 604 mutex_enter(&d->bd_lock); 605 if (d->bd_state == BPF_WAITING) 606 bpf_clear_timeout(d); 607 timed_out = (d->bd_state == BPF_TIMED_OUT); 608 d->bd_state = BPF_IDLE; 609 /* 610 * If the hold buffer is empty, then do a timed sleep, which 611 * ends when the timeout expires or when enough packets 612 * have arrived to fill the store buffer. 613 */ 614 while (d->bd_hbuf == 0) { 615 if (d->bd_nonblock) { 616 if (d->bd_slen == 0) { 617 mutex_exit(&d->bd_lock); 618 return (EWOULDBLOCK); 619 } 620 ROTATE_BUFFERS(d); 621 break; 622 } 623 624 if ((d->bd_immediate || timed_out) && d->bd_slen != 0) { 625 /* 626 * A packet(s) either arrived since the previous 627 * read or arrived while we were asleep. 628 * Rotate the buffers and return what's here. 629 */ 630 ROTATE_BUFFERS(d); 631 break; 632 } 633 ks_stats.kp_read_wait.value.ui64++; 634 delay = ddi_get_lbolt() + d->bd_rtout; 635 error = cv_timedwait_sig(&d->bd_wait, &d->bd_lock, delay); 636 if (error == 0) { 637 mutex_exit(&d->bd_lock); 638 return (EINTR); 639 } 640 if (error == -1) { 641 /* 642 * On a timeout, return what's in the buffer, 643 * which may be nothing. If there is something 644 * in the store buffer, we can rotate the buffers. 645 */ 646 if (d->bd_hbuf) 647 /* 648 * We filled up the buffer in between 649 * getting the timeout and arriving 650 * here, so we don't need to rotate. 651 */ 652 break; 653 654 if (d->bd_slen == 0) { 655 mutex_exit(&d->bd_lock); 656 return (0); 657 } 658 ROTATE_BUFFERS(d); 659 } 660 } 661 /* 662 * At this point, we know we have something in the hold slot. 663 */ 664 mutex_exit(&d->bd_lock); 665 666 /* 667 * Move data from hold buffer into user space. 668 * We know the entire buffer is transferred since 669 * we checked above that the read buffer is bpf_bufsize bytes. 670 */ 671 error = uiomove(d->bd_hbuf, d->bd_hlen, UIO_READ, uio); 672 673 mutex_enter(&d->bd_lock); 674 d->bd_fbuf = d->bd_hbuf; 675 d->bd_hbuf = 0; 676 d->bd_hlen = 0; 677 mutex_exit(&d->bd_lock); 678 return (error); 679 } 680 681 682 /* 683 * If there are processes sleeping on this descriptor, wake them up. 684 * NOTE: the lock for bd_wait is bd_lock and is held by bpf_deliver, 685 * so there is no code here grabbing it. 686 */ 687 static inline void 688 bpf_wakeup(struct bpf_d *d) 689 { 690 cv_signal(&d->bd_wait); 691 } 692 693 static void 694 bpf_timed_out(void *arg) 695 { 696 struct bpf_d *d = arg; 697 698 mutex_enter(&d->bd_lock); 699 if (d->bd_state == BPF_WAITING) { 700 d->bd_state = BPF_TIMED_OUT; 701 if (d->bd_slen != 0) 702 cv_signal(&d->bd_wait); 703 } 704 mutex_exit(&d->bd_lock); 705 } 706 707 708 /* ARGSUSED */ 709 int 710 bpfwrite(dev_t dev, struct uio *uio, cred_t *cred) 711 { 712 struct bpf_d *d = bpf_dev_get(getminor(dev)); 713 uintptr_t mch; 714 uint_t mtu; 715 mblk_t *m; 716 int error; 717 int dlt; 718 719 if ((d->bd_fmode & FWRITE) == 0) 720 return (EBADF); 721 722 mutex_enter(&d->bd_lock); 723 if (d->bd_bif == 0 || d->bd_mcip == 0 || d->bd_bif == 0) { 724 mutex_exit(&d->bd_lock); 725 return (EINTR); 726 } 727 728 if (uio->uio_resid == 0) { 729 mutex_exit(&d->bd_lock); 730 return (0); 731 } 732 733 while (d->bd_inuse < 0) { 734 d->bd_waiting++; 735 if (cv_wait_sig(&d->bd_wait, &d->bd_lock) <= 0) { 736 d->bd_waiting--; 737 mutex_exit(&d->bd_lock); 738 return (EINTR); 739 } 740 d->bd_waiting--; 741 } 742 743 mutex_exit(&d->bd_lock); 744 745 dlt = d->bd_dlt; 746 mch = d->bd_mcip; 747 MBPF_SDU_GET(&d->bd_mac, d->bd_bif, &mtu); 748 d->bd_inuse++; 749 750 m = NULL; 751 if (dlt == DLT_IPNET) { 752 error = EIO; 753 goto done; 754 } 755 756 error = bpf_movein(uio, dlt, mtu, &m); 757 if (error) 758 goto done; 759 760 DTRACE_PROBE4(bpf__tx, struct bpf_d *, d, int, dlt, 761 uint_t, mtu, mblk_t *, m); 762 763 if (M_LEN(m) > mtu) { 764 error = EMSGSIZE; 765 goto done; 766 } 767 768 error = MBPF_TX(&d->bd_mac, mch, m); 769 /* 770 * The "tx" action here is required to consume the mblk_t. 771 */ 772 m = NULL; 773 774 done: 775 if (error == 0) 776 ks_stats.kp_write_ok.value.ui64++; 777 else 778 ks_stats.kp_write_error.value.ui64++; 779 if (m != NULL) 780 freemsg(m); 781 782 mutex_enter(&d->bd_lock); 783 d->bd_inuse--; 784 if ((d->bd_inuse == 0) && (d->bd_waiting != 0)) 785 cv_signal(&d->bd_wait); 786 mutex_exit(&d->bd_lock); 787 788 /* 789 * The driver frees the mbuf. 790 */ 791 return (error); 792 } 793 794 795 /* 796 * Reset a descriptor by flushing its packet buffer and clearing the 797 * receive and drop counts. Should be called at splnet. 798 */ 799 static void 800 reset_d(struct bpf_d *d) 801 { 802 if (d->bd_hbuf) { 803 /* Free the hold buffer. */ 804 d->bd_fbuf = d->bd_hbuf; 805 d->bd_hbuf = 0; 806 } 807 d->bd_slen = 0; 808 d->bd_hlen = 0; 809 d->bd_rcount = 0; 810 d->bd_dcount = 0; 811 d->bd_ccount = 0; 812 } 813 814 /* 815 * FIONREAD Check for read packet available. 816 * BIOCGBLEN Get buffer len [for read()]. 817 * BIOCSETF Set ethernet read filter. 818 * BIOCFLUSH Flush read packet buffer. 819 * BIOCPROMISC Put interface into promiscuous mode. 820 * BIOCGDLT Get link layer type. 821 * BIOCGETIF Get interface name. 822 * BIOCSETIF Set interface. 823 * BIOCSRTIMEOUT Set read timeout. 824 * BIOCGRTIMEOUT Get read timeout. 825 * BIOCGSTATS Get packet stats. 826 * BIOCIMMEDIATE Set immediate mode. 827 * BIOCVERSION Get filter language version. 828 * BIOCGHDRCMPLT Get "header already complete" flag. 829 * BIOCSHDRCMPLT Set "header already complete" flag. 830 */ 831 /* ARGSUSED */ 832 int 833 bpfioctl(dev_t dev, int cmd, intptr_t addr, int mode, cred_t *cred, int *rval) 834 { 835 struct bpf_d *d = bpf_dev_get(getminor(dev)); 836 struct bpf_program prog; 837 struct lifreq lifreq; 838 struct ifreq ifreq; 839 int error = 0; 840 uint_t size; 841 842 /* 843 * Refresh the PID associated with this bpf file. 844 */ 845 mutex_enter(&d->bd_lock); 846 if (d->bd_state == BPF_WAITING) 847 bpf_clear_timeout(d); 848 d->bd_state = BPF_IDLE; 849 mutex_exit(&d->bd_lock); 850 851 switch (cmd) { 852 853 default: 854 error = EINVAL; 855 break; 856 857 /* 858 * Check for read packet available. 859 */ 860 case FIONREAD: 861 { 862 int n; 863 864 mutex_enter(&d->bd_lock); 865 n = d->bd_slen; 866 if (d->bd_hbuf) 867 n += d->bd_hlen; 868 mutex_exit(&d->bd_lock); 869 870 *(int *)addr = n; 871 break; 872 } 873 874 /* 875 * Get buffer len [for read()]. 876 */ 877 case BIOCGBLEN: 878 error = copyout(&d->bd_bufsize, (void *)addr, 879 sizeof (d->bd_bufsize)); 880 break; 881 882 /* 883 * Set buffer length. 884 */ 885 case BIOCSBLEN: 886 if (copyin((void *)addr, &size, sizeof (size)) != 0) { 887 error = EFAULT; 888 break; 889 } 890 891 mutex_enter(&d->bd_lock); 892 if (d->bd_bif != 0) { 893 error = EINVAL; 894 } else { 895 if (size > bpf_maxbufsize) 896 size = bpf_maxbufsize; 897 else if (size < BPF_MINBUFSIZE) 898 size = BPF_MINBUFSIZE; 899 900 d->bd_bufsize = size; 901 } 902 mutex_exit(&d->bd_lock); 903 904 if (error == 0) 905 error = copyout(&size, (void *)addr, sizeof (size)); 906 break; 907 908 /* 909 * Set link layer read filter. 910 */ 911 case BIOCSETF: 912 if (ddi_copyin((void *)addr, &prog, sizeof (prog), mode)) { 913 error = EFAULT; 914 break; 915 } 916 error = bpf_setf(d, &prog); 917 break; 918 919 /* 920 * Flush read packet buffer. 921 */ 922 case BIOCFLUSH: 923 mutex_enter(&d->bd_lock); 924 reset_d(d); 925 mutex_exit(&d->bd_lock); 926 break; 927 928 /* 929 * Put interface into promiscuous mode. 930 * This is a one-way ioctl, it is not used to turn promiscuous 931 * mode off. 932 */ 933 case BIOCPROMISC: 934 if (d->bd_bif == 0) { 935 /* 936 * No interface attached yet. 937 */ 938 error = EINVAL; 939 break; 940 } 941 mutex_enter(&d->bd_lock); 942 if (d->bd_promisc == 0) { 943 944 if (d->bd_promisc_handle) { 945 uintptr_t mph; 946 947 mph = d->bd_promisc_handle; 948 d->bd_promisc_handle = 0; 949 950 mutex_exit(&d->bd_lock); 951 MBPF_PROMISC_REMOVE(&d->bd_mac, mph); 952 mutex_enter(&d->bd_lock); 953 } 954 955 d->bd_promisc_flags = MAC_PROMISC_FLAGS_NO_COPY; 956 error = MBPF_PROMISC_ADD(&d->bd_mac, 957 d->bd_mcip, MAC_CLIENT_PROMISC_ALL, d, 958 &d->bd_promisc_handle, d->bd_promisc_flags); 959 if (error == 0) 960 d->bd_promisc = 1; 961 } 962 mutex_exit(&d->bd_lock); 963 break; 964 965 /* 966 * Get device parameters. 967 */ 968 case BIOCGDLT: 969 if (d->bd_bif == 0) 970 error = EINVAL; 971 else 972 error = copyout(&d->bd_dlt, (void *)addr, 973 sizeof (d->bd_dlt)); 974 break; 975 976 /* 977 * Get a list of supported device parameters. 978 */ 979 case BIOCGDLTLIST: 980 if (d->bd_bif == 0) { 981 error = EINVAL; 982 } else { 983 struct bpf_dltlist list; 984 985 if (copyin((void *)addr, &list, sizeof (list)) != 0) { 986 error = EFAULT; 987 break; 988 } 989 error = bpf_getdltlist(d, &list); 990 if ((error == 0) && 991 copyout(&list, (void *)addr, sizeof (list)) != 0) 992 error = EFAULT; 993 } 994 break; 995 996 /* 997 * Set device parameters. 998 */ 999 case BIOCSDLT: 1000 error = bpf_setdlt(d, (void *)addr); 1001 break; 1002 1003 /* 1004 * Get interface name. 1005 */ 1006 case BIOCGETIF: 1007 if (copyin((void *)addr, &ifreq, sizeof (ifreq)) != 0) { 1008 error = EFAULT; 1009 break; 1010 } 1011 error = bpf_ifname(d, ifreq.ifr_name, sizeof (ifreq.ifr_name)); 1012 if ((error == 0) && 1013 copyout(&ifreq, (void *)addr, sizeof (ifreq)) != 0) { 1014 error = EFAULT; 1015 break; 1016 } 1017 break; 1018 1019 /* 1020 * Set interface. 1021 */ 1022 case BIOCSETIF: 1023 if (copyin((void *)addr, &ifreq, sizeof (ifreq)) != 0) { 1024 error = EFAULT; 1025 break; 1026 } 1027 error = bpf_setif(d, ifreq.ifr_name, sizeof (ifreq.ifr_name)); 1028 break; 1029 1030 /* 1031 * Get interface name. 1032 */ 1033 case BIOCGETLIF: 1034 if (copyin((void *)addr, &lifreq, sizeof (lifreq)) != 0) { 1035 error = EFAULT; 1036 break; 1037 } 1038 error = bpf_ifname(d, lifreq.lifr_name, 1039 sizeof (lifreq.lifr_name)); 1040 if ((error == 0) && 1041 copyout(&lifreq, (void *)addr, sizeof (lifreq)) != 0) { 1042 error = EFAULT; 1043 break; 1044 } 1045 break; 1046 1047 /* 1048 * Set interface. 1049 */ 1050 case BIOCSETLIF: 1051 if (copyin((void *)addr, &lifreq, sizeof (lifreq)) != 0) { 1052 error = EFAULT; 1053 break; 1054 } 1055 error = bpf_setif(d, lifreq.lifr_name, 1056 sizeof (lifreq.lifr_name)); 1057 break; 1058 1059 #ifdef _SYSCALL32_IMPL 1060 /* 1061 * Set read timeout. 1062 */ 1063 case BIOCSRTIMEOUT32: 1064 { 1065 struct timeval32 tv; 1066 1067 if (copyin((void *)addr, &tv, sizeof (tv)) != 0) { 1068 error = EFAULT; 1069 break; 1070 } 1071 1072 /* Convert the timeout in microseconds to ticks */ 1073 d->bd_rtout = drv_usectohz(tv.tv_sec * 1000000 + 1074 tv.tv_usec); 1075 if ((d->bd_rtout == 0) && (tv.tv_usec != 0)) 1076 d->bd_rtout = 1; 1077 break; 1078 } 1079 1080 /* 1081 * Get read timeout. 1082 */ 1083 case BIOCGRTIMEOUT32: 1084 { 1085 struct timeval32 tv; 1086 clock_t ticks; 1087 1088 ticks = drv_hztousec(d->bd_rtout); 1089 tv.tv_sec = ticks / 1000000; 1090 tv.tv_usec = ticks - (tv.tv_sec * 1000000); 1091 error = copyout(&tv, (void *)addr, sizeof (tv)); 1092 break; 1093 } 1094 1095 /* 1096 * Get a list of supported device parameters. 1097 */ 1098 case BIOCGDLTLIST32: 1099 if (d->bd_bif == 0) { 1100 error = EINVAL; 1101 } else { 1102 struct bpf_dltlist32 lst32; 1103 struct bpf_dltlist list; 1104 1105 if (copyin((void *)addr, &lst32, sizeof (lst32)) != 0) { 1106 error = EFAULT; 1107 break; 1108 } 1109 1110 list.bfl_len = lst32.bfl_len; 1111 list.bfl_list = (void *)(uint64_t)lst32.bfl_list; 1112 error = bpf_getdltlist(d, &list); 1113 if (error == 0) { 1114 lst32.bfl_len = list.bfl_len; 1115 1116 if (copyout(&lst32, (void *)addr, 1117 sizeof (lst32)) != 0) 1118 error = EFAULT; 1119 } 1120 } 1121 break; 1122 1123 /* 1124 * Set link layer read filter. 1125 */ 1126 case BIOCSETF32: { 1127 struct bpf_program32 prog32; 1128 1129 if (ddi_copyin((void *)addr, &prog32, sizeof (prog), mode)) { 1130 error = EFAULT; 1131 break; 1132 } 1133 prog.bf_len = prog32.bf_len; 1134 prog.bf_insns = (void *)(uint64_t)prog32.bf_insns; 1135 error = bpf_setf(d, &prog); 1136 break; 1137 } 1138 #endif 1139 1140 /* 1141 * Set read timeout. 1142 */ 1143 case BIOCSRTIMEOUT: 1144 { 1145 struct timeval tv; 1146 1147 if (copyin((void *)addr, &tv, sizeof (tv)) != 0) { 1148 error = EFAULT; 1149 break; 1150 } 1151 1152 /* Convert the timeout in microseconds to ticks */ 1153 d->bd_rtout = drv_usectohz(tv.tv_sec * 1000000 + 1154 tv.tv_usec); 1155 if ((d->bd_rtout == 0) && (tv.tv_usec != 0)) 1156 d->bd_rtout = 1; 1157 break; 1158 } 1159 1160 /* 1161 * Get read timeout. 1162 */ 1163 case BIOCGRTIMEOUT: 1164 { 1165 struct timeval tv; 1166 clock_t ticks; 1167 1168 ticks = drv_hztousec(d->bd_rtout); 1169 tv.tv_sec = ticks / 1000000; 1170 tv.tv_usec = ticks - (tv.tv_sec * 1000000); 1171 if (copyout(&tv, (void *)addr, sizeof (tv)) != 0) 1172 error = EFAULT; 1173 break; 1174 } 1175 1176 /* 1177 * Get packet stats. 1178 */ 1179 case BIOCGSTATS: 1180 { 1181 struct bpf_stat bs; 1182 1183 bs.bs_recv = d->bd_rcount; 1184 bs.bs_drop = d->bd_dcount; 1185 bs.bs_capt = d->bd_ccount; 1186 if (copyout(&bs, (void *)addr, sizeof (bs)) != 0) 1187 error = EFAULT; 1188 break; 1189 } 1190 1191 /* 1192 * Set immediate mode. 1193 */ 1194 case BIOCIMMEDIATE: 1195 if (copyin((void *)addr, &d->bd_immediate, 1196 sizeof (d->bd_immediate)) != 0) 1197 error = EFAULT; 1198 break; 1199 1200 case BIOCVERSION: 1201 { 1202 struct bpf_version bv; 1203 1204 bv.bv_major = BPF_MAJOR_VERSION; 1205 bv.bv_minor = BPF_MINOR_VERSION; 1206 if (copyout(&bv, (void *)addr, sizeof (bv)) != 0) 1207 error = EFAULT; 1208 break; 1209 } 1210 1211 case BIOCGHDRCMPLT: /* get "header already complete" flag */ 1212 if (copyout(&d->bd_hdrcmplt, (void *)addr, 1213 sizeof (d->bd_hdrcmplt)) != 0) 1214 error = EFAULT; 1215 break; 1216 1217 case BIOCSHDRCMPLT: /* set "header already complete" flag */ 1218 if (copyin((void *)addr, &d->bd_hdrcmplt, 1219 sizeof (d->bd_hdrcmplt)) != 0) 1220 error = EFAULT; 1221 break; 1222 1223 /* 1224 * Get "see sent packets" flag 1225 */ 1226 case BIOCGSEESENT: 1227 if (copyout(&d->bd_seesent, (void *)addr, 1228 sizeof (d->bd_seesent)) != 0) 1229 error = EFAULT; 1230 break; 1231 1232 /* 1233 * Set "see sent" packets flag 1234 */ 1235 case BIOCSSEESENT: 1236 if (copyin((void *)addr, &d->bd_seesent, 1237 sizeof (d->bd_seesent)) != 0) 1238 error = EFAULT; 1239 break; 1240 1241 case FIONBIO: /* Non-blocking I/O */ 1242 if (copyin((void *)addr, &d->bd_nonblock, 1243 sizeof (d->bd_nonblock)) != 0) 1244 error = EFAULT; 1245 break; 1246 } 1247 return (error); 1248 } 1249 1250 /* 1251 * Set d's packet filter program to fp. If this file already has a filter, 1252 * free it and replace it. If the new filter is "empty" (has a 0 size), then 1253 * the result is to just remove and free the existing filter. 1254 * Returns EINVAL for bogus requests. 1255 */ 1256 int 1257 bpf_setf(struct bpf_d *d, struct bpf_program *fp) 1258 { 1259 struct bpf_insn *fcode, *old; 1260 uint_t flen, size; 1261 size_t oldsize; 1262 1263 if (fp->bf_insns == 0) { 1264 if (fp->bf_len != 0) 1265 return (EINVAL); 1266 mutex_enter(&d->bd_lock); 1267 old = d->bd_filter; 1268 oldsize = d->bd_filter_size; 1269 d->bd_filter = 0; 1270 d->bd_filter_size = 0; 1271 reset_d(d); 1272 mutex_exit(&d->bd_lock); 1273 if (old != 0) 1274 kmem_free(old, oldsize); 1275 return (0); 1276 } 1277 flen = fp->bf_len; 1278 if (flen > BPF_MAXINSNS) 1279 return (EINVAL); 1280 1281 size = flen * sizeof (*fp->bf_insns); 1282 fcode = kmem_alloc(size, KM_SLEEP); 1283 if (copyin(fp->bf_insns, fcode, size) != 0) 1284 return (EFAULT); 1285 1286 if (bpf_validate(fcode, (int)flen)) { 1287 mutex_enter(&d->bd_lock); 1288 old = d->bd_filter; 1289 oldsize = d->bd_filter_size; 1290 d->bd_filter = fcode; 1291 d->bd_filter_size = size; 1292 reset_d(d); 1293 mutex_exit(&d->bd_lock); 1294 if (old != 0) 1295 kmem_free(old, oldsize); 1296 1297 return (0); 1298 } 1299 kmem_free(fcode, size); 1300 return (EINVAL); 1301 } 1302 1303 /* 1304 * Detach a file from its current interface (if attached at all) and attach 1305 * to the interface indicated by the name stored in ifname. 1306 * Return an errno or 0. 1307 */ 1308 static int 1309 bpf_setif(struct bpf_d *d, char *ifname, int namesize) 1310 { 1311 int unit_seen; 1312 int error = 0; 1313 char *cp; 1314 int i; 1315 1316 /* 1317 * Make sure the provided name has a unit number, and default 1318 * it to '0' if not specified. 1319 * XXX This is ugly ... do this differently? 1320 */ 1321 unit_seen = 0; 1322 cp = ifname; 1323 cp[namesize - 1] = '\0'; /* sanity */ 1324 while (*cp++) 1325 if (*cp >= '0' && *cp <= '9') 1326 unit_seen = 1; 1327 if (!unit_seen) { 1328 /* Make sure to leave room for the '\0'. */ 1329 for (i = 0; i < (namesize - 1); ++i) { 1330 if ((ifname[i] >= 'a' && ifname[i] <= 'z') || 1331 (ifname[i] >= 'A' && ifname[i] <= 'Z')) 1332 continue; 1333 ifname[i] = '0'; 1334 } 1335 } 1336 1337 /* 1338 * Make sure that only one call to this function happens at a time 1339 * and that we're not interleaving a read/write 1340 */ 1341 mutex_enter(&d->bd_lock); 1342 while (d->bd_inuse != 0) { 1343 d->bd_waiting++; 1344 if (cv_wait_sig(&d->bd_wait, &d->bd_lock) <= 0) { 1345 d->bd_waiting--; 1346 mutex_exit(&d->bd_lock); 1347 return (EINTR); 1348 } 1349 d->bd_waiting--; 1350 } 1351 d->bd_inuse = -1; 1352 mutex_exit(&d->bd_lock); 1353 1354 if (d->bd_sbuf == 0) 1355 error = bpf_allocbufs(d); 1356 1357 if (error == 0) { 1358 mutex_enter(&d->bd_lock); 1359 if (d->bd_bif) 1360 /* 1361 * Detach if attached to something else. 1362 */ 1363 bpf_detachd(d); 1364 1365 error = bpf_attachd(d, ifname, -1); 1366 reset_d(d); 1367 d->bd_inuse = 0; 1368 if (d->bd_waiting != 0) 1369 cv_signal(&d->bd_wait); 1370 mutex_exit(&d->bd_lock); 1371 return (error); 1372 } 1373 1374 mutex_enter(&d->bd_lock); 1375 d->bd_inuse = 0; 1376 if (d->bd_waiting != 0) 1377 cv_signal(&d->bd_wait); 1378 mutex_exit(&d->bd_lock); 1379 1380 /* 1381 * Try tickle the mac layer into attaching the device... 1382 */ 1383 return (bpf_provider_tickle(ifname, d->bd_zone)); 1384 } 1385 1386 /* 1387 * Copy the interface name to the ifreq. 1388 */ 1389 static int 1390 bpf_ifname(struct bpf_d *d, char *buffer, int bufsize) 1391 { 1392 1393 mutex_enter(&d->bd_lock); 1394 if (d->bd_bif == 0) { 1395 mutex_exit(&d->bd_lock); 1396 return (EINVAL); 1397 } 1398 1399 (void) strlcpy(buffer, d->bd_ifname, bufsize); 1400 mutex_exit(&d->bd_lock); 1401 1402 return (0); 1403 } 1404 1405 /* ARGSUSED */ 1406 int 1407 bpfchpoll(dev_t dev, short events, int anyyet, short *reventsp, 1408 struct pollhead **phpp) 1409 { 1410 struct bpf_d *d = bpf_dev_get(getminor(dev)); 1411 1412 /* 1413 * Until this driver is modified to issue proper pollwakeup() calls on 1414 * its pollhead, edge-triggered polling is not allowed. 1415 */ 1416 if (events & POLLET) { 1417 return (EPERM); 1418 } 1419 1420 if (events & (POLLIN | POLLRDNORM)) { 1421 /* 1422 * An imitation of the FIONREAD ioctl code. 1423 */ 1424 mutex_enter(&d->bd_lock); 1425 if (d->bd_hlen != 0 || 1426 ((d->bd_immediate || d->bd_state == BPF_TIMED_OUT) && 1427 d->bd_slen != 0)) { 1428 *reventsp |= events & (POLLIN | POLLRDNORM); 1429 } else { 1430 /* 1431 * Until the bpf driver has been updated to include 1432 * adequate pollwakeup() logic, no pollhead will be 1433 * emitted here, preventing the resource from being 1434 * cached by poll()/devpoll/epoll. 1435 */ 1436 *reventsp = 0; 1437 /* Start the read timeout if necessary */ 1438 if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) { 1439 bpf_clear_timeout(d); 1440 /* 1441 * Only allow the timeout to be set once. 1442 */ 1443 if (d->bd_callout == 0) 1444 d->bd_callout = timeout(bpf_timed_out, 1445 d, d->bd_rtout); 1446 d->bd_state = BPF_WAITING; 1447 } 1448 } 1449 mutex_exit(&d->bd_lock); 1450 } 1451 1452 return (0); 1453 } 1454 1455 /* 1456 * Copy data from an mblk_t chain into a buffer. This works for ipnet 1457 * because the dl_ipnetinfo_t is placed in an mblk_t that leads the 1458 * packet itself. 1459 */ 1460 static void * 1461 bpf_mcpy(void *dst_arg, const void *src_arg, size_t len) 1462 { 1463 const mblk_t *m; 1464 uint_t count; 1465 uchar_t *dst; 1466 1467 m = src_arg; 1468 dst = dst_arg; 1469 while (len > 0) { 1470 if (m == NULL) 1471 panic("bpf_mcpy"); 1472 count = (uint_t)min(M_LEN(m), len); 1473 (void) memcpy(dst, mtod(m, const void *), count); 1474 m = m->b_cont; 1475 dst += count; 1476 len -= count; 1477 } 1478 return (dst_arg); 1479 } 1480 1481 /* 1482 * Dispatch a packet to all the listeners on interface bp. 1483 * 1484 * marg pointer to the packet, either a data buffer or an mbuf chain 1485 * buflen buffer length, if marg is a data buffer 1486 * cpfn a function that can copy marg into the listener's buffer 1487 * pktlen length of the packet 1488 * issent boolean indicating whether the packet was sent or receive 1489 */ 1490 static inline void 1491 bpf_deliver(struct bpf_d *d, cp_fn_t cpfn, void *marg, uint_t pktlen, 1492 uint_t buflen, boolean_t issent) 1493 { 1494 struct timeval tv; 1495 uint_t slen; 1496 1497 if (!d->bd_seesent && issent) 1498 return; 1499 1500 /* 1501 * Accuracy of the packet counters in BPF is vital so it 1502 * is important to protect even the outer ones. 1503 */ 1504 mutex_enter(&d->bd_lock); 1505 slen = bpf_filter(d->bd_filter, marg, pktlen, buflen); 1506 DTRACE_PROBE5(bpf__packet, struct bpf_if *, d->bd_bif, 1507 struct bpf_d *, d, void *, marg, uint_t, pktlen, uint_t, slen); 1508 d->bd_rcount++; 1509 ks_stats.kp_receive.value.ui64++; 1510 if (slen != 0) { 1511 uniqtime(&tv); 1512 catchpacket(d, marg, pktlen, slen, cpfn, &tv); 1513 } 1514 mutex_exit(&d->bd_lock); 1515 } 1516 1517 /* 1518 * Incoming linkage from device drivers. 1519 */ 1520 /* ARGSUSED */ 1521 void 1522 bpf_mtap(void *arg, mac_resource_handle_t mrh, mblk_t *m, boolean_t issent) 1523 { 1524 cp_fn_t cpfn; 1525 struct bpf_d *d = arg; 1526 uint_t pktlen, buflen; 1527 void *marg; 1528 1529 pktlen = msgdsize(m); 1530 1531 if (pktlen == M_LEN(m)) { 1532 cpfn = (cp_fn_t)memcpy; 1533 marg = mtod(m, void *); 1534 buflen = pktlen; 1535 } else { 1536 cpfn = bpf_mcpy; 1537 marg = m; 1538 buflen = 0; 1539 } 1540 1541 bpf_deliver(d, cpfn, marg, pktlen, buflen, issent); 1542 } 1543 1544 /* 1545 * Incoming linkage from ipnet. 1546 * In ipnet, there is only one event, NH_OBSERVE, that delivers packets 1547 * from all network interfaces. Thus the tap function needs to apply a 1548 * filter using the interface index/id to immitate snoop'ing on just the 1549 * specified interface. 1550 */ 1551 /* ARGSUSED */ 1552 void 1553 bpf_itap(void *arg, mblk_t *m, boolean_t issent, uint_t length) 1554 { 1555 hook_pkt_observe_t *hdr; 1556 struct bpf_d *d = arg; 1557 1558 hdr = (hook_pkt_observe_t *)m->b_rptr; 1559 if (ntohl(hdr->hpo_ifindex) != d->bd_linkid) 1560 return; 1561 bpf_deliver(d, bpf_mcpy, m, length, 0, issent); 1562 1563 } 1564 1565 /* 1566 * Move the packet data from interface memory (pkt) into the 1567 * store buffer. Return 1 if it's time to wakeup a listener (buffer full), 1568 * otherwise 0. "copy" is the routine called to do the actual data 1569 * transfer. memcpy is passed in to copy contiguous chunks, while 1570 * bpf_mcpy is passed in to copy mbuf chains. In the latter case, 1571 * pkt is really an mbuf. 1572 */ 1573 static void 1574 catchpacket(struct bpf_d *d, uchar_t *pkt, uint_t pktlen, uint_t snaplen, 1575 cp_fn_t cpfn, struct timeval *tv) 1576 { 1577 struct bpf_hdr *hp; 1578 int totlen, curlen; 1579 int hdrlen = d->bd_hdrlen; 1580 int do_wakeup = 0; 1581 1582 ++d->bd_ccount; 1583 ks_stats.kp_capture.value.ui64++; 1584 /* 1585 * Figure out how many bytes to move. If the packet is 1586 * greater or equal to the snapshot length, transfer that 1587 * much. Otherwise, transfer the whole packet (unless 1588 * we hit the buffer size limit). 1589 */ 1590 totlen = hdrlen + min(snaplen, pktlen); 1591 if (totlen > d->bd_bufsize) 1592 totlen = d->bd_bufsize; 1593 1594 /* 1595 * Round up the end of the previous packet to the next longword. 1596 */ 1597 curlen = BPF_WORDALIGN(d->bd_slen); 1598 if (curlen + totlen > d->bd_bufsize) { 1599 /* 1600 * This packet will overflow the storage buffer. 1601 * Rotate the buffers if we can, then wakeup any 1602 * pending reads. 1603 */ 1604 if (d->bd_fbuf == 0) { 1605 /* 1606 * We haven't completed the previous read yet, 1607 * so drop the packet. 1608 */ 1609 ++d->bd_dcount; 1610 ks_stats.kp_dropped.value.ui64++; 1611 return; 1612 } 1613 ROTATE_BUFFERS(d); 1614 do_wakeup = 1; 1615 curlen = 0; 1616 } else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT) { 1617 /* 1618 * Immediate mode is set, or the read timeout has 1619 * already expired during a select call. A packet 1620 * arrived, so the reader should be woken up. 1621 */ 1622 do_wakeup = 1; 1623 } 1624 1625 /* 1626 * Append the bpf header to the existing buffer before we add 1627 * on the actual packet data. 1628 */ 1629 hp = (struct bpf_hdr *)((char *)d->bd_sbuf + curlen); 1630 hp->bh_tstamp.tv_sec = tv->tv_sec; 1631 hp->bh_tstamp.tv_usec = tv->tv_usec; 1632 hp->bh_datalen = pktlen; 1633 hp->bh_hdrlen = (uint16_t)hdrlen; 1634 /* 1635 * Copy the packet data into the store buffer and update its length. 1636 */ 1637 (*cpfn)((uchar_t *)hp + hdrlen, pkt, 1638 (hp->bh_caplen = totlen - hdrlen)); 1639 d->bd_slen = curlen + totlen; 1640 1641 /* 1642 * Call bpf_wakeup after bd_slen has been updated. 1643 */ 1644 if (do_wakeup) 1645 bpf_wakeup(d); 1646 } 1647 1648 /* 1649 * Initialize all nonzero fields of a descriptor. 1650 */ 1651 static int 1652 bpf_allocbufs(struct bpf_d *d) 1653 { 1654 1655 d->bd_fbuf = kmem_zalloc(d->bd_bufsize, KM_NOSLEEP); 1656 if (!d->bd_fbuf) 1657 return (ENOBUFS); 1658 d->bd_sbuf = kmem_zalloc(d->bd_bufsize, KM_NOSLEEP); 1659 if (!d->bd_sbuf) { 1660 kmem_free(d->bd_fbuf, d->bd_bufsize); 1661 return (ENOBUFS); 1662 } 1663 d->bd_slen = 0; 1664 d->bd_hlen = 0; 1665 return (0); 1666 } 1667 1668 /* 1669 * Free buffers currently in use by a descriptor. 1670 * Called on close. 1671 */ 1672 static void 1673 bpf_freed(struct bpf_d *d) 1674 { 1675 /* 1676 * At this point the descriptor has been detached from its 1677 * interface and it yet hasn't been marked free. 1678 */ 1679 if (d->bd_sbuf != 0) { 1680 kmem_free(d->bd_sbuf, d->bd_bufsize); 1681 if (d->bd_hbuf != 0) 1682 kmem_free(d->bd_hbuf, d->bd_bufsize); 1683 if (d->bd_fbuf != 0) 1684 kmem_free(d->bd_fbuf, d->bd_bufsize); 1685 } 1686 if (d->bd_filter) 1687 kmem_free(d->bd_filter, d->bd_filter_size); 1688 } 1689 1690 /* 1691 * Get a list of available data link type of the interface. 1692 */ 1693 static int 1694 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *listp) 1695 { 1696 bpf_provider_list_t *bp; 1697 bpf_provider_t *bpr; 1698 zoneid_t zoneid; 1699 uintptr_t mcip; 1700 uint_t nicdlt; 1701 uintptr_t mh; 1702 int error; 1703 int n; 1704 1705 n = 0; 1706 mh = 0; 1707 mcip = 0; 1708 error = 0; 1709 mutex_enter(&d->bd_lock); 1710 LIST_FOREACH(bp, &bpf_providers, bpl_next) { 1711 bpr = bp->bpl_what; 1712 error = MBPF_OPEN(bpr, d->bd_ifname, &mh, d->bd_zone); 1713 if (error != 0) 1714 goto next; 1715 error = MBPF_CLIENT_OPEN(bpr, mh, &mcip); 1716 if (error != 0) 1717 goto next; 1718 error = MBPF_GET_ZONE(bpr, mh, &zoneid); 1719 if (error != 0) 1720 goto next; 1721 if (d->bd_zone != GLOBAL_ZONEID && 1722 d->bd_zone != zoneid) 1723 goto next; 1724 error = MBPF_GET_DLT(bpr, mh, &nicdlt); 1725 if (error != 0) 1726 goto next; 1727 nicdlt = bpf_dl_to_dlt(nicdlt); 1728 if (listp->bfl_list != NULL) { 1729 if (n >= listp->bfl_len) { 1730 MBPF_CLIENT_CLOSE(bpr, mcip); 1731 MBPF_CLOSE(bpr, mh); 1732 break; 1733 } 1734 /* 1735 * Bumping of bd_inuse ensures the structure does not 1736 * disappear while the copyout runs and allows the for 1737 * loop to be continued. 1738 */ 1739 d->bd_inuse++; 1740 mutex_exit(&d->bd_lock); 1741 if (copyout(&nicdlt, 1742 listp->bfl_list + n, sizeof (uint_t)) != 0) 1743 error = EFAULT; 1744 mutex_enter(&d->bd_lock); 1745 if (error != 0) 1746 break; 1747 d->bd_inuse--; 1748 } 1749 n++; 1750 next: 1751 if (mcip != 0) { 1752 MBPF_CLIENT_CLOSE(bpr, mcip); 1753 mcip = 0; 1754 } 1755 if (mh != 0) { 1756 MBPF_CLOSE(bpr, mh); 1757 mh = 0; 1758 } 1759 } 1760 mutex_exit(&d->bd_lock); 1761 1762 /* 1763 * It is quite possible that one or more provider to BPF may not 1764 * know about a link name whlist others do. In that case, so long 1765 * as we have one success, do not declare an error unless it was 1766 * an EFAULT as this indicates a problem that needs to be reported. 1767 */ 1768 if ((error != EFAULT) && (n > 0)) 1769 error = 0; 1770 1771 listp->bfl_len = n; 1772 return (error); 1773 } 1774 1775 /* 1776 * Set the data link type of a BPF instance. 1777 */ 1778 static int 1779 bpf_setdlt(struct bpf_d *d, void *addr) 1780 { 1781 char ifname[LIFNAMSIZ+1]; 1782 zoneid_t niczone; 1783 int error; 1784 int dlt; 1785 1786 if (copyin(addr, &dlt, sizeof (dlt)) != 0) 1787 return (EFAULT); 1788 1789 mutex_enter(&d->bd_lock); 1790 1791 if (d->bd_bif == 0) { /* Interface not set */ 1792 mutex_exit(&d->bd_lock); 1793 return (EINVAL); 1794 } 1795 if (d->bd_dlt == dlt) { /* NULL-op */ 1796 mutex_exit(&d->bd_lock); 1797 return (0); 1798 } 1799 1800 error = MBPF_GET_ZONE(&d->bd_mac, d->bd_bif, &niczone); 1801 if (error != 0) { 1802 mutex_exit(&d->bd_lock); 1803 return (error); 1804 } 1805 1806 /* 1807 * See the matrix at the top of the file for the permissions table 1808 * enforced by this driver. 1809 */ 1810 if ((d->bd_zone != GLOBAL_ZONEID) && (dlt != DLT_IPNET) && 1811 (niczone != d->bd_zone)) { 1812 mutex_exit(&d->bd_lock); 1813 return (EINVAL); 1814 } 1815 1816 (void) strlcpy(ifname, d->bd_ifname, sizeof (ifname)); 1817 d->bd_inuse = -1; 1818 bpf_detachd(d); 1819 error = bpf_attachd(d, ifname, dlt); 1820 reset_d(d); 1821 d->bd_inuse = 0; 1822 1823 mutex_exit(&d->bd_lock); 1824 return (error); 1825 } 1826 1827 /* 1828 * bpf_clear_timeout is called with the bd_lock mutex held, providing it 1829 * with the necessary protection to retrieve and modify bd_callout but it 1830 * does not hold the lock for its entire duration... see below... 1831 */ 1832 static void 1833 bpf_clear_timeout(struct bpf_d *d) 1834 { 1835 timeout_id_t tid = d->bd_callout; 1836 d->bd_callout = 0; 1837 d->bd_inuse++; 1838 1839 /* 1840 * If the timeout has fired and is waiting on bd_lock, we could 1841 * deadlock here because untimeout if bd_lock is held and would 1842 * wait for bpf_timed_out to finish and it never would. 1843 */ 1844 if (tid != 0) { 1845 mutex_exit(&d->bd_lock); 1846 (void) untimeout(tid); 1847 mutex_enter(&d->bd_lock); 1848 } 1849 1850 d->bd_inuse--; 1851 } 1852 1853 /* 1854 * As a cloning device driver, BPF needs to keep track of which device 1855 * numbers are in use and which ones are not. A hash table, indexed by 1856 * the minor device number, is used to store the pointers to the 1857 * individual descriptors that are allocated in bpfopen(). 1858 * The functions below present the interface for that hash table to 1859 * the rest of the driver. 1860 */ 1861 static struct bpf_d * 1862 bpf_dev_find(minor_t minor) 1863 { 1864 struct bpf_d *d = NULL; 1865 1866 (void) mod_hash_find(bpf_hash, (mod_hash_key_t)(uintptr_t)minor, 1867 (mod_hash_val_t *)&d); 1868 1869 return (d); 1870 } 1871 1872 static void 1873 bpf_dev_add(struct bpf_d *d) 1874 { 1875 (void) mod_hash_insert(bpf_hash, (mod_hash_key_t)(uintptr_t)d->bd_dev, 1876 (mod_hash_val_t)d); 1877 } 1878 1879 static void 1880 bpf_dev_remove(struct bpf_d *d) 1881 { 1882 struct bpf_d *stor; 1883 1884 (void) mod_hash_remove(bpf_hash, (mod_hash_key_t)(uintptr_t)d->bd_dev, 1885 (mod_hash_val_t *)&stor); 1886 ASSERT(stor == d); 1887 } 1888 1889 /* 1890 * bpf_def_get should only ever be called for a minor number that exists, 1891 * thus there should always be a pointer in the hash table that corresponds 1892 * to it. 1893 */ 1894 static struct bpf_d * 1895 bpf_dev_get(minor_t minor) 1896 { 1897 struct bpf_d *d = NULL; 1898 1899 (void) mod_hash_find(bpf_hash, (mod_hash_key_t)(uintptr_t)minor, 1900 (mod_hash_val_t *)&d); 1901 ASSERT(d != NULL); 1902 1903 return (d); 1904 } 1905