Context Navigation

source: rtems-libbsd/freebsd/sys/net/bpf.c @ 66659ff

4.1155-freebsd-126-freebsd-12freebsd-9.3

Last change on this file since 66659ff was 66659ff, checked in by Sebastian Huber <sebastian.huber@…>, on 11/06/13 at 15:20:21
Update to FreeBSD 9.2
Property mode set to `100644`
File size: 63.7 KB

Line
1	#include <machine/rtems-bsd-kernel-space.h>
2
3	/*-
4	* Copyright (c) 1990, 1991, 1993
5	* The Regents of the University of California. All rights reserved.
6	*
7	* This code is derived from the Stanford/CMU enet packet filter,
8	* (net/enet.c) distributed as part of 4.3BSD, and code contributed
9	* to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
10	* Berkeley Laboratory.
11	*
12	* Redistribution and use in source and binary forms, with or without
13	* modification, are permitted provided that the following conditions
14	* are met:
15	* 1. Redistributions of source code must retain the above copyright
16	* notice, this list of conditions and the following disclaimer.
17	* 2. Redistributions in binary form must reproduce the above copyright
18	* notice, this list of conditions and the following disclaimer in the
19	* documentation and/or other materials provided with the distribution.
20	* 4. Neither the name of the University nor the names of its contributors
21	* may be used to endorse or promote products derived from this software
22	* without specific prior written permission.
23	*
24	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34	* SUCH DAMAGE.
35	*
36	* @(#)bpf.c 8.4 (Berkeley) 1/9/95
37	*/
38
39	#include <sys/cdefs.h>
40	__FBSDID("$FreeBSD$");
41
42	#include <rtems/bsd/local/opt_bpf.h>
43	#include <rtems/bsd/local/opt_compat.h>
44	#include <rtems/bsd/local/opt_netgraph.h>
45
46	#include <rtems/bsd/sys/types.h>
47	#include <rtems/bsd/sys/param.h>
48	#include <rtems/bsd/sys/lock.h>
49	#include <sys/rwlock.h>
50	#include <sys/systm.h>
51	#include <sys/conf.h>
52	#include <sys/fcntl.h>
53	#include <sys/jail.h>
54	#include <sys/malloc.h>
55	#include <sys/mbuf.h>
56	#include <rtems/bsd/sys/time.h>
57	#include <sys/priv.h>
58	#include <sys/proc.h>
59	#include <sys/signalvar.h>
60	#include <sys/filio.h>
61	#include <sys/sockio.h>
62	#include <sys/ttycom.h>
63	#include <sys/uio.h>
64
65	#include <sys/event.h>
66	#include <sys/file.h>
67	#include <sys/poll.h>
68	#include <sys/proc.h>
69
70	#include <sys/socket.h>
71
72	#include <net/if.h>
73	#define BPF_INTERNAL
74	#include <net/bpf.h>
75	#include <net/bpf_buffer.h>
76	#ifdef BPF_JITTER
77	#include <net/bpf_jitter.h>
78	#endif
79	#include <net/bpf_zerocopy.h>
80	#include <net/bpfdesc.h>
81	#include <net/vnet.h>
82
83	#include <netinet/in.h>
84	#include <netinet/if_ether.h>
85	#include <sys/kernel.h>
86	#include <sys/sysctl.h>
87
88	#include <net80211/ieee80211_freebsd.h>
89
90	#include <security/mac/mac_framework.h>
91
92	MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
93
94	#if defined(DEV_BPF) \|\| defined(NETGRAPH_BPF)
95
96	#define PRINET 26 /* interruptible */
97
98	#define SIZEOF_BPF_HDR(type) \
99	(offsetof(type, bh_hdrlen) + sizeof(((type *)0)->bh_hdrlen))
100
101	#ifdef COMPAT_FREEBSD32
102	#include <sys/mount.h>
103	#include <compat/freebsd32/freebsd32.h>
104	#define BPF_ALIGNMENT32 sizeof(int32_t)
105	#define BPF_WORDALIGN32(x) (((x)+(BPF_ALIGNMENT32-1))&~(BPF_ALIGNMENT32-1))
106
107	#ifndef BURN_BRIDGES
108	/*
109	* 32-bit version of structure prepended to each packet. We use this header
110	* instead of the standard one for 32-bit streams. We mark the a stream as
111	* 32-bit the first time we see a 32-bit compat ioctl request.
112	*/
113	struct bpf_hdr32 {
114	struct timeval32 bh_tstamp; /* time stamp */
115	uint32_t bh_caplen; /* length of captured portion */
116	uint32_t bh_datalen; /* original length of packet */
117	uint16_t bh_hdrlen; /* length of bpf header (this struct
118	plus alignment padding) */
119	};
120	#endif
121
122	struct bpf_program32 {
123	u_int bf_len;
124	uint32_t bf_insns;
125	};
126
127	struct bpf_dltlist32 {
128	u_int bfl_len;
129	u_int bfl_list;
130	};
131
132	#define BIOCSETF32 _IOW('B', 103, struct bpf_program32)
133	#define BIOCSRTIMEOUT32 _IOW('B', 109, struct timeval32)
134	#define BIOCGRTIMEOUT32 _IOR('B', 110, struct timeval32)
135	#define BIOCGDLTLIST32 _IOWR('B', 121, struct bpf_dltlist32)
136	#define BIOCSETWF32 _IOW('B', 123, struct bpf_program32)
137	#define BIOCSETFNR32 _IOW('B', 130, struct bpf_program32)
138	#endif
139
140	/*
141	* bpf_iflist is a list of BPF interface structures, each corresponding to a
142	* specific DLT. The same network interface might have several BPF interface
143	* structures registered by different layers in the stack (i.e., 802.11
144	* frames, ethernet frames, etc).
145	*/
146	static LIST_HEAD(, bpf_if) bpf_iflist;
147	static struct mtx bpf_mtx; /* bpf global lock */
148	static int bpf_bpfd_cnt;
149
150	static void bpf_attachd(struct bpf_d , struct bpf_if );
151	static void bpf_detachd(struct bpf_d *);
152	static void bpf_detachd_locked(struct bpf_d *);
153	static void bpf_freed(struct bpf_d *);
154	static int bpf_movein(struct uio , int, struct ifnet , struct mbuf **,
155	struct sockaddr , int , struct bpf_insn *);
156	static int bpf_setif(struct bpf_d , struct ifreq );
157	static void bpf_timed_out(void *);
158	static __inline void
159	bpf_wakeup(struct bpf_d *);
160	static void catchpacket(struct bpf_d , u_char , u_int, u_int,
161	void ()(struct bpf_d , caddr_t, u_int, void *, u_int),
162	struct bintime *);
163	static void reset_d(struct bpf_d *);
164	static int bpf_setf(struct bpf_d , struct bpf_program , u_long cmd);
165	static int bpf_getdltlist(struct bpf_d , struct bpf_dltlist );
166	static int bpf_setdlt(struct bpf_d *, u_int);
167	static void filt_bpfdetach(struct knote *);
168	static int filt_bpfread(struct knote *, long);
169	static void bpf_drvinit(void *);
170	static int bpf_stats_sysctl(SYSCTL_HANDLER_ARGS);
171
172	SYSCTL_NODE(_net, OID_AUTO, bpf, CTLFLAG_RW, 0, "bpf sysctl");
173	int bpf_maxinsns = BPF_MAXINSNS;
174	SYSCTL_INT(_net_bpf, OID_AUTO, maxinsns, CTLFLAG_RW,
175	&bpf_maxinsns, 0, "Maximum bpf program instructions");
176	static int bpf_zerocopy_enable = 0;
177	SYSCTL_INT(_net_bpf, OID_AUTO, zerocopy_enable, CTLFLAG_RW,
178	&bpf_zerocopy_enable, 0, "Enable new zero-copy BPF buffer sessions");
179	static SYSCTL_NODE(_net_bpf, OID_AUTO, stats, CTLFLAG_MPSAFE \| CTLFLAG_RW,
180	bpf_stats_sysctl, "bpf statistics portal");
181
182	static VNET_DEFINE(int, bpf_optimize_writers) = 0;
183	#define V_bpf_optimize_writers VNET(bpf_optimize_writers)
184	SYSCTL_VNET_INT(_net_bpf, OID_AUTO, optimize_writers,
185	CTLFLAG_RW, &VNET_NAME(bpf_optimize_writers), 0,
186	"Do not send packets until BPF program is set");
187
188	static d_open_t bpfopen;
189	static d_read_t bpfread;
190	static d_write_t bpfwrite;
191	static d_ioctl_t bpfioctl;
192	static d_poll_t bpfpoll;
193	static d_kqfilter_t bpfkqfilter;
194
195	static struct cdevsw bpf_cdevsw = {
196	.d_version = D_VERSION,
197	.d_open = bpfopen,
198	.d_read = bpfread,
199	.d_write = bpfwrite,
200	.d_ioctl = bpfioctl,
201	.d_poll = bpfpoll,
202	.d_name = "bpf",
203	.d_kqfilter = bpfkqfilter,
204	};
205
206	static struct filterops bpfread_filtops = {
207	.f_isfd = 1,
208	.f_detach = filt_bpfdetach,
209	.f_event = filt_bpfread,
210	};
211
212	eventhandler_tag bpf_ifdetach_cookie = NULL;
213
214	/*
215	* LOCKING MODEL USED BY BPF:
216	* Locks:
217	* 1) global lock (BPF_LOCK). Mutex, used to protect interface addition/removal,
218	* some global counters and every bpf_if reference.
219	* 2) Interface lock. Rwlock, used to protect list of BPF descriptors and their filters.
220	* 3) Descriptor lock. Mutex, used to protect BPF buffers and various structure fields
221	* used by bpf_mtap code.
222	*
223	* Lock order:
224	*
225	* Global lock, interface lock, descriptor lock
226	*
227	* We have to acquire interface lock before descriptor main lock due to BPF_MTAP[2]
228	* working model. In many places (like bpf_detachd) we start with BPF descriptor
229	* (and we need to at least rlock it to get reliable interface pointer). This
230	* gives us potential LOR. As a result, we use global lock to protect from bpf_if
231	* change in every such place.
232	*
233	* Changing d->bd_bif is protected by 1) global lock, 2) interface lock and
234	* 3) descriptor main wlock.
235	* Reading bd_bif can be protected by any of these locks, typically global lock.
236	*
237	* Changing read/write BPF filter is protected by the same three locks,
238	* the same applies for reading.
239	*
240	* Sleeping in global lock is not allowed due to bpfdetach() using it.
241	*/
242
243	/*
244	* Wrapper functions for various buffering methods. If the set of buffer
245	* modes expands, we will probably want to introduce a switch data structure
246	* similar to protosw, et.
247	*/
248	static void
249	bpf_append_bytes(struct bpf_d d, caddr_t buf, u_int offset, void src,
250	u_int len)
251	{
252
253	BPFD_LOCK_ASSERT(d);
254
255	switch (d->bd_bufmode) {
256	case BPF_BUFMODE_BUFFER:
257	return (bpf_buffer_append_bytes(d, buf, offset, src, len));
258
259	case BPF_BUFMODE_ZBUF:
260	d->bd_zcopy++;
261	return (bpf_zerocopy_append_bytes(d, buf, offset, src, len));
262
263	default:
264	panic("bpf_buf_append_bytes");
265	}
266	}
267
268	static void
269	bpf_append_mbuf(struct bpf_d d, caddr_t buf, u_int offset, void src,
270	u_int len)
271	{
272
273	BPFD_LOCK_ASSERT(d);
274
275	switch (d->bd_bufmode) {
276	case BPF_BUFMODE_BUFFER:
277	return (bpf_buffer_append_mbuf(d, buf, offset, src, len));
278
279	case BPF_BUFMODE_ZBUF:
280	d->bd_zcopy++;
281	return (bpf_zerocopy_append_mbuf(d, buf, offset, src, len));
282
283	default:
284	panic("bpf_buf_append_mbuf");
285	}
286	}
287
288	/*
289	* This function gets called when the free buffer is re-assigned.
290	*/
291	static void
292	bpf_buf_reclaimed(struct bpf_d *d)
293	{
294
295	BPFD_LOCK_ASSERT(d);
296
297	switch (d->bd_bufmode) {
298	case BPF_BUFMODE_BUFFER:
299	return;
300
301	case BPF_BUFMODE_ZBUF:
302	bpf_zerocopy_buf_reclaimed(d);
303	return;
304
305	default:
306	panic("bpf_buf_reclaimed");
307	}
308	}
309
310	/*
311	* If the buffer mechanism has a way to decide that a held buffer can be made
312	* free, then it is exposed via the bpf_canfreebuf() interface. (1) is
313	* returned if the buffer can be discarded, (0) is returned if it cannot.
314	*/
315	static int
316	bpf_canfreebuf(struct bpf_d *d)
317	{
318
319	BPFD_LOCK_ASSERT(d);
320
321	switch (d->bd_bufmode) {
322	case BPF_BUFMODE_ZBUF:
323	return (bpf_zerocopy_canfreebuf(d));
324	}
325	return (0);
326	}
327
328	/*
329	* Allow the buffer model to indicate that the current store buffer is
330	* immutable, regardless of the appearance of space. Return (1) if the
331	* buffer is writable, and (0) if not.
332	*/
333	static int
334	bpf_canwritebuf(struct bpf_d *d)
335	{
336	BPFD_LOCK_ASSERT(d);
337
338	switch (d->bd_bufmode) {
339	case BPF_BUFMODE_ZBUF:
340	return (bpf_zerocopy_canwritebuf(d));
341	}
342	return (1);
343	}
344
345	/*
346	* Notify buffer model that an attempt to write to the store buffer has
347	* resulted in a dropped packet, in which case the buffer may be considered
348	* full.
349	*/
350	static void
351	bpf_buffull(struct bpf_d *d)
352	{
353
354	BPFD_LOCK_ASSERT(d);
355
356	switch (d->bd_bufmode) {
357	case BPF_BUFMODE_ZBUF:
358	bpf_zerocopy_buffull(d);
359	break;
360	}
361	}
362
363	/*
364	* Notify the buffer model that a buffer has moved into the hold position.
365	*/
366	void
367	bpf_bufheld(struct bpf_d *d)
368	{
369
370	BPFD_LOCK_ASSERT(d);
371
372	switch (d->bd_bufmode) {
373	case BPF_BUFMODE_ZBUF:
374	bpf_zerocopy_bufheld(d);
375	break;
376	}
377	}
378
379	static void
380	bpf_free(struct bpf_d *d)
381	{
382
383	switch (d->bd_bufmode) {
384	case BPF_BUFMODE_BUFFER:
385	return (bpf_buffer_free(d));
386
387	case BPF_BUFMODE_ZBUF:
388	return (bpf_zerocopy_free(d));
389
390	default:
391	panic("bpf_buf_free");
392	}
393	}
394
395	static int
396	bpf_uiomove(struct bpf_d d, caddr_t buf, u_int len, struct uio uio)
397	{
398
399	if (d->bd_bufmode != BPF_BUFMODE_BUFFER)
400	return (EOPNOTSUPP);
401	return (bpf_buffer_uiomove(d, buf, len, uio));
402	}
403
404	static int
405	bpf_ioctl_sblen(struct bpf_d d, u_int i)
406	{
407
408	if (d->bd_bufmode != BPF_BUFMODE_BUFFER)
409	return (EOPNOTSUPP);
410	return (bpf_buffer_ioctl_sblen(d, i));
411	}
412
413	static int
414	bpf_ioctl_getzmax(struct thread td, struct bpf_d d, size_t *i)
415	{
416
417	if (d->bd_bufmode != BPF_BUFMODE_ZBUF)
418	return (EOPNOTSUPP);
419	return (bpf_zerocopy_ioctl_getzmax(td, d, i));
420	}
421
422	static int
423	bpf_ioctl_rotzbuf(struct thread td, struct bpf_d d, struct bpf_zbuf *bz)
424	{
425
426	if (d->bd_bufmode != BPF_BUFMODE_ZBUF)
427	return (EOPNOTSUPP);
428	return (bpf_zerocopy_ioctl_rotzbuf(td, d, bz));
429	}
430
431	static int
432	bpf_ioctl_setzbuf(struct thread td, struct bpf_d d, struct bpf_zbuf *bz)
433	{
434
435	if (d->bd_bufmode != BPF_BUFMODE_ZBUF)
436	return (EOPNOTSUPP);
437	return (bpf_zerocopy_ioctl_setzbuf(td, d, bz));
438	}
439
440	/*
441	* General BPF functions.
442	*/
443	static int
444	bpf_movein(struct uio uio, int linktype, struct ifnet ifp, struct mbuf **mp,
445	struct sockaddr sockp, int hdrlen, struct bpf_insn *wfilter)
446	{
447	const struct ieee80211_bpf_params *p;
448	struct ether_header *eh;
449	struct mbuf *m;
450	int error;
451	int len;
452	int hlen;
453	int slen;
454
455	/*
456	* Build a sockaddr based on the data link layer type.
457	* We do this at this level because the ethernet header
458	* is copied directly into the data field of the sockaddr.
459	* In the case of SLIP, there is no header and the packet
460	* is forwarded as is.
461	* Also, we are careful to leave room at the front of the mbuf
462	* for the link level header.
463	*/
464	switch (linktype) {
465
466	case DLT_SLIP:
467	sockp->sa_family = AF_INET;
468	hlen = 0;
469	break;
470
471	case DLT_EN10MB:
472	sockp->sa_family = AF_UNSPEC;
473	/* XXX Would MAXLINKHDR be better? */
474	hlen = ETHER_HDR_LEN;
475	break;
476
477	case DLT_FDDI:
478	sockp->sa_family = AF_IMPLINK;
479	hlen = 0;
480	break;
481
482	case DLT_RAW:
483	sockp->sa_family = AF_UNSPEC;
484	hlen = 0;
485	break;
486
487	case DLT_NULL:
488	/*
489	* null interface types require a 4 byte pseudo header which
490	* corresponds to the address family of the packet.
491	*/
492	sockp->sa_family = AF_UNSPEC;
493	hlen = 4;
494	break;
495
496	case DLT_ATM_RFC1483:
497	/*
498	* en atm driver requires 4-byte atm pseudo header.
499	* though it isn't standard, vpi:vci needs to be
500	* specified anyway.
501	*/
502	sockp->sa_family = AF_UNSPEC;
503	hlen = 12; /* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
504	break;
505
506	case DLT_PPP:
507	sockp->sa_family = AF_UNSPEC;
508	hlen = 4; /* This should match PPP_HDRLEN */
509	break;
510
511	case DLT_IEEE802_11: /* IEEE 802.11 wireless */
512	sockp->sa_family = AF_IEEE80211;
513	hlen = 0;
514	break;
515
516	case DLT_IEEE802_11_RADIO: /* IEEE 802.11 wireless w/ phy params */
517	sockp->sa_family = AF_IEEE80211;
518	sockp->sa_len = 12; /* XXX != 0 */
519	hlen = sizeof(struct ieee80211_bpf_params);
520	break;
521
522	default:
523	return (EIO);
524	}
525
526	len = uio->uio_resid;
527
528	if (len - hlen > ifp->if_mtu)
529	return (EMSGSIZE);
530
531	if ((unsigned)len > MJUM16BYTES)
532	return (EIO);
533
534	if (len <= MHLEN)
535	MGETHDR(m, M_WAIT, MT_DATA);
536	else if (len <= MCLBYTES)
537	m = m_getcl(M_WAIT, MT_DATA, M_PKTHDR);
538	else
539	m = m_getjcl(M_WAIT, MT_DATA, M_PKTHDR,
540	#if (MJUMPAGESIZE > MCLBYTES)
541	len <= MJUMPAGESIZE ? MJUMPAGESIZE :
542	#endif
543	(len <= MJUM9BYTES ? MJUM9BYTES : MJUM16BYTES));
544	m->m_pkthdr.len = m->m_len = len;
545	m->m_pkthdr.rcvif = NULL;
546	*mp = m;
547
548	if (m->m_len < hlen) {
549	error = EPERM;
550	goto bad;
551	}
552
553	error = uiomove(mtod(m, u_char *), len, uio);
554	if (error)
555	goto bad;
556
557	slen = bpf_filter(wfilter, mtod(m, u_char *), len, len);
558	if (slen == 0) {
559	error = EPERM;
560	goto bad;
561	}
562
563	/* Check for multicast destination */
564	switch (linktype) {
565	case DLT_EN10MB:
566	eh = mtod(m, struct ether_header *);
567	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
568	if (bcmp(ifp->if_broadcastaddr, eh->ether_dhost,
569	ETHER_ADDR_LEN) == 0)
570	m->m_flags \|= M_BCAST;
571	else
572	m->m_flags \|= M_MCAST;
573	}
574	break;
575	}
576
577	/*
578	* Make room for link header, and copy it to sockaddr
579	*/
580	if (hlen != 0) {
581	if (sockp->sa_family == AF_IEEE80211) {
582	/*
583	* Collect true length from the parameter header
584	* NB: sockp is known to be zero'd so if we do a
585	* short copy unspecified parameters will be
586	* zero.
587	* NB: packet may not be aligned after stripping
588	* bpf params
589	* XXX check ibp_vers
590	*/
591	p = mtod(m, const struct ieee80211_bpf_params *);
592	hlen = p->ibp_len;
593	if (hlen > sizeof(sockp->sa_data)) {
594	error = EINVAL;
595	goto bad;
596	}
597	}
598	bcopy(m->m_data, sockp->sa_data, hlen);
599	}
600	*hdrlen = hlen;
601
602	return (0);
603	bad:
604	m_freem(m);
605	return (error);
606	}
607
608	/*
609	* Attach file to the bpf interface, i.e. make d listen on bp.
610	*/
611	static void
612	bpf_attachd(struct bpf_d d, struct bpf_if bp)
613	{
614	int op_w;
615
616	BPF_LOCK_ASSERT();
617
618	/*
619	* Save sysctl value to protect from sysctl change
620	* between reads
621	*/
622	op_w = V_bpf_optimize_writers;
623
624	if (d->bd_bif != NULL)
625	bpf_detachd_locked(d);
626	/*
627	* Point d at bp, and add d to the interface's list.
628	* Since there are many applicaiotns using BPF for
629	* sending raw packets only (dhcpd, cdpd are good examples)
630	* we can delay adding d to the list of active listeners until
631	* some filter is configured.
632	*/
633
634	BPFIF_WLOCK(bp);
635	BPFD_LOCK(d);
636
637	d->bd_bif = bp;
638
639	if (op_w != 0) {
640	/* Add to writers-only list */
641	LIST_INSERT_HEAD(&bp->bif_wlist, d, bd_next);
642	/*
643	* We decrement bd_writer on every filter set operation.
644	* First BIOCSETF is done by pcap_open_live() to set up
645	* snap length. After that appliation usually sets its own filter
646	*/
647	d->bd_writer = 2;
648	} else
649	LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
650
651	BPFD_UNLOCK(d);
652	BPFIF_WUNLOCK(bp);
653
654	bpf_bpfd_cnt++;
655
656	CTR3(KTR_NET, "%s: bpf_attach called by pid %d, adding to %s list",
657	__func__, d->bd_pid, d->bd_writer ? "writer" : "active");
658
659	if (op_w == 0)
660	EVENTHANDLER_INVOKE(bpf_track, bp->bif_ifp, bp->bif_dlt, 1);
661	}
662
663	/*
664	* Add d to the list of active bp filters.
665	* Reuqires bpf_attachd() to be called before
666	*/
667	static void
668	bpf_upgraded(struct bpf_d *d)
669	{
670	struct bpf_if *bp;
671
672	BPF_LOCK_ASSERT();
673
674	bp = d->bd_bif;
675
676	/*
677	* Filter can be set several times without specifying interface.
678	* Mark d as reader and exit.
679	*/
680	if (bp == NULL) {
681	BPFD_LOCK(d);
682	d->bd_writer = 0;
683	BPFD_UNLOCK(d);
684	return;
685	}
686
687	BPFIF_WLOCK(bp);
688	BPFD_LOCK(d);
689
690	/* Remove from writers-only list */
691	LIST_REMOVE(d, bd_next);
692	LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
693	/* Mark d as reader */
694	d->bd_writer = 0;
695
696	BPFD_UNLOCK(d);
697	BPFIF_WUNLOCK(bp);
698
699	CTR2(KTR_NET, "%s: upgrade required by pid %d", __func__, d->bd_pid);
700
701	EVENTHANDLER_INVOKE(bpf_track, bp->bif_ifp, bp->bif_dlt, 1);
702	}
703
704	/*
705	* Detach a file from its interface.
706	*/
707	static void
708	bpf_detachd(struct bpf_d *d)
709	{
710	BPF_LOCK();
711	bpf_detachd_locked(d);
712	BPF_UNLOCK();
713	}
714
715	static void
716	bpf_detachd_locked(struct bpf_d *d)
717	{
718	int error;
719	struct bpf_if *bp;
720	struct ifnet *ifp;
721
722	CTR2(KTR_NET, "%s: detach required by pid %d", __func__, d->bd_pid);
723
724	BPF_LOCK_ASSERT();
725
726	/* Check if descriptor is attached */
727	if ((bp = d->bd_bif) == NULL)
728	return;
729
730	BPFIF_WLOCK(bp);
731	BPFD_LOCK(d);
732
733	/* Save bd_writer value */
734	error = d->bd_writer;
735
736	/*
737	* Remove d from the interface's descriptor list.
738	*/
739	LIST_REMOVE(d, bd_next);
740
741	ifp = bp->bif_ifp;
742	d->bd_bif = NULL;
743	BPFD_UNLOCK(d);
744	BPFIF_WUNLOCK(bp);
745
746	bpf_bpfd_cnt--;
747
748	/* Call event handler iff d is attached */
749	if (error == 0)
750	EVENTHANDLER_INVOKE(bpf_track, ifp, bp->bif_dlt, 0);
751
752	/*
753	* Check if this descriptor had requested promiscuous mode.
754	* If so, turn it off.
755	*/
756	if (d->bd_promisc) {
757	d->bd_promisc = 0;
758	CURVNET_SET(ifp->if_vnet);
759	error = ifpromisc(ifp, 0);
760	CURVNET_RESTORE();
761	if (error != 0 && error != ENXIO) {
762	/*
763	* ENXIO can happen if a pccard is unplugged
764	* Something is really wrong if we were able to put
765	* the driver into promiscuous mode, but can't
766	* take it out.
767	*/
768	if_printf(bp->bif_ifp,
769	"bpf_detach: ifpromisc failed (%d)\n", error);
770	}
771	}
772	}
773
774	/*
775	* Close the descriptor by detaching it from its interface,
776	* deallocating its buffers, and marking it free.
777	*/
778	static void
779	bpf_dtor(void *data)
780	{
781	struct bpf_d *d = data;
782
783	BPFD_LOCK(d);
784	if (d->bd_state == BPF_WAITING)
785	callout_stop(&d->bd_callout);
786	d->bd_state = BPF_IDLE;
787	BPFD_UNLOCK(d);
788	funsetown(&d->bd_sigio);
789	bpf_detachd(d);
790	#ifdef MAC
791	mac_bpfdesc_destroy(d);
792	#endif /* MAC */
793	seldrain(&d->bd_sel);
794	knlist_destroy(&d->bd_sel.si_note);
795	callout_drain(&d->bd_callout);
796	bpf_freed(d);
797	free(d, M_BPF);
798	}
799
800	/*
801	* Open ethernet device. Returns ENXIO for illegal minor device number,
802	* EBUSY if file is open by another process.
803	*/
804	/* ARGSUSED */
805	static int
806	bpfopen(struct cdev dev, int flags, int fmt, struct thread td)
807	{
808	struct bpf_d *d;
809	int error, size;
810
811	d = malloc(sizeof(*d), M_BPF, M_WAITOK \| M_ZERO);
812	error = devfs_set_cdevpriv(d, bpf_dtor);
813	if (error != 0) {
814	free(d, M_BPF);
815	return (error);
816	}
817
818	/*
819	* For historical reasons, perform a one-time initialization call to
820	* the buffer routines, even though we're not yet committed to a
821	* particular buffer method.
822	*/
823	bpf_buffer_init(d);
824	d->bd_hbuf_in_use = 0;
825	d->bd_bufmode = BPF_BUFMODE_BUFFER;
826	d->bd_sig = SIGIO;
827	d->bd_direction = BPF_D_INOUT;
828	BPF_PID_REFRESH(d, td);
829	#ifdef MAC
830	mac_bpfdesc_init(d);
831	mac_bpfdesc_create(td->td_ucred, d);
832	#endif
833	mtx_init(&d->bd_lock, devtoname(dev), "bpf cdev lock", MTX_DEF);
834	callout_init_mtx(&d->bd_callout, &d->bd_lock, 0);
835	knlist_init_mtx(&d->bd_sel.si_note, &d->bd_lock);
836
837	/* Allocate default buffers */
838	size = d->bd_bufsize;
839	bpf_buffer_ioctl_sblen(d, &size);
840
841	return (0);
842	}
843
844	/*
845	* bpfread - read next chunk of packets from buffers
846	*/
847	static int
848	bpfread(struct cdev dev, struct uio uio, int ioflag)
849	{
850	struct bpf_d *d;
851	int error;
852	int non_block;
853	int timed_out;
854
855	error = devfs_get_cdevpriv((void **)&d);
856	if (error != 0)
857	return (error);
858
859	/*
860	* Restrict application to use a buffer the same size as
861	* as kernel buffers.
862	*/
863	if (uio->uio_resid != d->bd_bufsize)
864	return (EINVAL);
865
866	non_block = ((ioflag & O_NONBLOCK) != 0);
867
868	BPFD_LOCK(d);
869	BPF_PID_REFRESH_CUR(d);
870	if (d->bd_bufmode != BPF_BUFMODE_BUFFER) {
871	BPFD_UNLOCK(d);
872	return (EOPNOTSUPP);
873	}
874	if (d->bd_state == BPF_WAITING)
875	callout_stop(&d->bd_callout);
876	timed_out = (d->bd_state == BPF_TIMED_OUT);
877	d->bd_state = BPF_IDLE;
878	while (d->bd_hbuf_in_use) {
879	error = mtx_sleep(&d->bd_hbuf_in_use, &d->bd_lock,
880	PRINET\|PCATCH, "bd_hbuf", 0);
881	if (error != 0) {
882	BPFD_UNLOCK(d);
883	return (error);
884	}
885	}
886	/*
887	* If the hold buffer is empty, then do a timed sleep, which
888	* ends when the timeout expires or when enough packets
889	* have arrived to fill the store buffer.
890	*/
891	while (d->bd_hbuf == NULL) {
892	if (d->bd_slen != 0) {
893	/*
894	* A packet(s) either arrived since the previous
895	* read or arrived while we were asleep.
896	*/
897	if (d->bd_immediate \|\| non_block \|\| timed_out) {
898	/*
899	* Rotate the buffers and return what's here
900	* if we are in immediate mode, non-blocking
901	* flag is set, or this descriptor timed out.
902	*/
903	ROTATE_BUFFERS(d);
904	break;
905	}
906	}
907
908	/*
909	* No data is available, check to see if the bpf device
910	* is still pointed at a real interface. If not, return
911	* ENXIO so that the userland process knows to rebind
912	* it before using it again.
913	*/
914	if (d->bd_bif == NULL) {
915	BPFD_UNLOCK(d);
916	return (ENXIO);
917	}
918
919	if (non_block) {
920	BPFD_UNLOCK(d);
921	return (EWOULDBLOCK);
922	}
923	error = msleep(d, &d->bd_lock, PRINET\|PCATCH,
924	"bpf", d->bd_rtout);
925	if (error == EINTR \|\| error == ERESTART) {
926	BPFD_UNLOCK(d);
927	return (error);
928	}
929	if (error == EWOULDBLOCK) {
930	/*
931	* On a timeout, return what's in the buffer,
932	* which may be nothing. If there is something
933	* in the store buffer, we can rotate the buffers.
934	*/
935	if (d->bd_hbuf)
936	/*
937	* We filled up the buffer in between
938	* getting the timeout and arriving
939	* here, so we don't need to rotate.
940	*/
941	break;
942
943	if (d->bd_slen == 0) {
944	BPFD_UNLOCK(d);
945	return (0);
946	}
947	ROTATE_BUFFERS(d);
948	break;
949	}
950	}
951	/*
952	* At this point, we know we have something in the hold slot.
953	*/
954	d->bd_hbuf_in_use = 1;
955	BPFD_UNLOCK(d);
956
957	/*
958	* Move data from hold buffer into user space.
959	* We know the entire buffer is transferred since
960	* we checked above that the read buffer is bpf_bufsize bytes.
961	*
962	* We do not have to worry about simultaneous reads because
963	* we waited for sole access to the hold buffer above.
964	*/
965	error = bpf_uiomove(d, d->bd_hbuf, d->bd_hlen, uio);
966
967	BPFD_LOCK(d);
968	KASSERT(d->bd_hbuf != NULL, ("bpfread: lost bd_hbuf"));
969	d->bd_fbuf = d->bd_hbuf;
970	d->bd_hbuf = NULL;
971	d->bd_hlen = 0;
972	bpf_buf_reclaimed(d);
973	d->bd_hbuf_in_use = 0;
974	wakeup(&d->bd_hbuf_in_use);
975	BPFD_UNLOCK(d);
976
977	return (error);
978	}
979
980	/*
981	* If there are processes sleeping on this descriptor, wake them up.
982	*/
983	static __inline void
984	bpf_wakeup(struct bpf_d *d)
985	{
986
987	BPFD_LOCK_ASSERT(d);
988	if (d->bd_state == BPF_WAITING) {
989	callout_stop(&d->bd_callout);
990	d->bd_state = BPF_IDLE;
991	}
992	wakeup(d);
993	if (d->bd_async && d->bd_sig && d->bd_sigio)
994	pgsigio(&d->bd_sigio, d->bd_sig, 0);
995
996	selwakeuppri(&d->bd_sel, PRINET);
997	KNOTE_LOCKED(&d->bd_sel.si_note, 0);
998	}
999
1000	static void
1001	bpf_timed_out(void *arg)
1002	{
1003	struct bpf_d d = (struct bpf_d )arg;
1004
1005	BPFD_LOCK_ASSERT(d);
1006
1007	if (callout_pending(&d->bd_callout) \|\| !callout_active(&d->bd_callout))
1008	return;
1009	if (d->bd_state == BPF_WAITING) {
1010	d->bd_state = BPF_TIMED_OUT;
1011	if (d->bd_slen != 0)
1012	bpf_wakeup(d);
1013	}
1014	}
1015
1016	static int
1017	bpf_ready(struct bpf_d *d)
1018	{
1019
1020	BPFD_LOCK_ASSERT(d);
1021
1022	if (!bpf_canfreebuf(d) && d->bd_hlen != 0)
1023	return (1);
1024	if ((d->bd_immediate \|\| d->bd_state == BPF_TIMED_OUT) &&
1025	d->bd_slen != 0)
1026	return (1);
1027	return (0);
1028	}
1029
1030	static int
1031	bpfwrite(struct cdev dev, struct uio uio, int ioflag)
1032	{
1033	struct bpf_d *d;
1034	struct ifnet *ifp;
1035	struct mbuf m, mc;
1036	struct sockaddr dst;
1037	int error, hlen;
1038
1039	error = devfs_get_cdevpriv((void **)&d);
1040	if (error != 0)
1041	return (error);
1042
1043	BPF_PID_REFRESH_CUR(d);
1044	d->bd_wcount++;
1045	/* XXX: locking required */
1046	if (d->bd_bif == NULL) {
1047	d->bd_wdcount++;
1048	return (ENXIO);
1049	}
1050
1051	ifp = d->bd_bif->bif_ifp;
1052
1053	if ((ifp->if_flags & IFF_UP) == 0) {
1054	d->bd_wdcount++;
1055	return (ENETDOWN);
1056	}
1057
1058	if (uio->uio_resid == 0) {
1059	d->bd_wdcount++;
1060	return (0);
1061	}
1062
1063	bzero(&dst, sizeof(dst));
1064	m = NULL;
1065	hlen = 0;
1066	/* XXX: bpf_movein() can sleep */
1067	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp,
1068	&m, &dst, &hlen, d->bd_wfilter);
1069	if (error) {
1070	d->bd_wdcount++;
1071	return (error);
1072	}
1073	d->bd_wfcount++;
1074	if (d->bd_hdrcmplt)
1075	dst.sa_family = pseudo_AF_HDRCMPLT;
1076
1077	if (d->bd_feedback) {
1078	mc = m_dup(m, M_DONTWAIT);
1079	if (mc != NULL)
1080	mc->m_pkthdr.rcvif = ifp;
1081	/* Set M_PROMISC for outgoing packets to be discarded. */
1082	if (d->bd_direction == BPF_D_INOUT)
1083	m->m_flags \|= M_PROMISC;
1084	} else
1085	mc = NULL;
1086
1087	m->m_pkthdr.len -= hlen;
1088	m->m_len -= hlen;
1089	m->m_data += hlen; /* XXX */
1090
1091	CURVNET_SET(ifp->if_vnet);
1092	#ifdef MAC
1093	BPFD_LOCK(d);
1094	mac_bpfdesc_create_mbuf(d, m);
1095	if (mc != NULL)
1096	mac_bpfdesc_create_mbuf(d, mc);
1097	BPFD_UNLOCK(d);
1098	#endif
1099
1100	error = (*ifp->if_output)(ifp, m, &dst, NULL);
1101	if (error)
1102	d->bd_wdcount++;
1103
1104	if (mc != NULL) {
1105	if (error == 0)
1106	(*ifp->if_input)(ifp, mc);
1107	else
1108	m_freem(mc);
1109	}
1110	CURVNET_RESTORE();
1111
1112	return (error);
1113	}
1114
1115	/*
1116	* Reset a descriptor by flushing its packet buffer and clearing the receive
1117	* and drop counts. This is doable for kernel-only buffers, but with
1118	* zero-copy buffers, we can't write to (or rotate) buffers that are
1119	* currently owned by userspace. It would be nice if we could encapsulate
1120	* this logic in the buffer code rather than here.
1121	*/
1122	static void
1123	reset_d(struct bpf_d *d)
1124	{
1125
1126	BPFD_LOCK_ASSERT(d);
1127
1128	while (d->bd_hbuf_in_use)
1129	mtx_sleep(&d->bd_hbuf_in_use, &d->bd_lock, PRINET,
1130	"bd_hbuf", 0);
1131	if ((d->bd_hbuf != NULL) &&
1132	(d->bd_bufmode != BPF_BUFMODE_ZBUF \|\| bpf_canfreebuf(d))) {
1133	/* Free the hold buffer. */
1134	d->bd_fbuf = d->bd_hbuf;
1135	d->bd_hbuf = NULL;
1136	d->bd_hlen = 0;
1137	bpf_buf_reclaimed(d);
1138	}
1139	if (bpf_canwritebuf(d))
1140	d->bd_slen = 0;
1141	d->bd_rcount = 0;
1142	d->bd_dcount = 0;
1143	d->bd_fcount = 0;
1144	d->bd_wcount = 0;
1145	d->bd_wfcount = 0;
1146	d->bd_wdcount = 0;
1147	d->bd_zcopy = 0;
1148	}
1149
1150	/*
1151	* FIONREAD Check for read packet available.
1152	* SIOCGIFADDR Get interface address - convenient hook to driver.
1153	* BIOCGBLEN Get buffer len [for read()].
1154	* BIOCSETF Set read filter.
1155	* BIOCSETFNR Set read filter without resetting descriptor.
1156	* BIOCSETWF Set write filter.
1157	* BIOCFLUSH Flush read packet buffer.
1158	* BIOCPROMISC Put interface into promiscuous mode.
1159	* BIOCGDLT Get link layer type.
1160	* BIOCGETIF Get interface name.
1161	* BIOCSETIF Set interface.
1162	* BIOCSRTIMEOUT Set read timeout.
1163	* BIOCGRTIMEOUT Get read timeout.
1164	* BIOCGSTATS Get packet stats.
1165	* BIOCIMMEDIATE Set immediate mode.
1166	* BIOCVERSION Get filter language version.
1167	* BIOCGHDRCMPLT Get "header already complete" flag
1168	* BIOCSHDRCMPLT Set "header already complete" flag
1169	* BIOCGDIRECTION Get packet direction flag
1170	* BIOCSDIRECTION Set packet direction flag
1171	* BIOCGTSTAMP Get time stamp format and resolution.
1172	* BIOCSTSTAMP Set time stamp format and resolution.
1173	* BIOCLOCK Set "locked" flag
1174	* BIOCFEEDBACK Set packet feedback mode.
1175	* BIOCSETZBUF Set current zero-copy buffer locations.
1176	* BIOCGETZMAX Get maximum zero-copy buffer size.
1177	* BIOCROTZBUF Force rotation of zero-copy buffer
1178	* BIOCSETBUFMODE Set buffer mode.
1179	* BIOCGETBUFMODE Get current buffer mode.
1180	*/
1181	/* ARGSUSED */
1182	static int
1183	bpfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags,
1184	struct thread *td)
1185	{
1186	struct bpf_d *d;
1187	int error;
1188
1189	error = devfs_get_cdevpriv((void **)&d);
1190	if (error != 0)
1191	return (error);
1192
1193	/*
1194	* Refresh PID associated with this descriptor.
1195	*/
1196	BPFD_LOCK(d);
1197	BPF_PID_REFRESH(d, td);
1198	if (d->bd_state == BPF_WAITING)
1199	callout_stop(&d->bd_callout);
1200	d->bd_state = BPF_IDLE;
1201	BPFD_UNLOCK(d);
1202
1203	if (d->bd_locked == 1) {
1204	switch (cmd) {
1205	case BIOCGBLEN:
1206	case BIOCFLUSH:
1207	case BIOCGDLT:
1208	case BIOCGDLTLIST:
1209	#ifdef COMPAT_FREEBSD32
1210	case BIOCGDLTLIST32:
1211	#endif
1212	case BIOCGETIF:
1213	case BIOCGRTIMEOUT:
1214	#ifdef COMPAT_FREEBSD32
1215	case BIOCGRTIMEOUT32:
1216	#endif
1217	case BIOCGSTATS:
1218	case BIOCVERSION:
1219	case BIOCGRSIG:
1220	case BIOCGHDRCMPLT:
1221	case BIOCSTSTAMP:
1222	case BIOCFEEDBACK:
1223	case FIONREAD:
1224	case BIOCLOCK:
1225	case BIOCSRTIMEOUT:
1226	#ifdef COMPAT_FREEBSD32
1227	case BIOCSRTIMEOUT32:
1228	#endif
1229	case BIOCIMMEDIATE:
1230	case TIOCGPGRP:
1231	case BIOCROTZBUF:
1232	break;
1233	default:
1234	return (EPERM);
1235	}
1236	}
1237	#ifdef COMPAT_FREEBSD32
1238	/*
1239	* If we see a 32-bit compat ioctl, mark the stream as 32-bit so
1240	* that it will get 32-bit packet headers.
1241	*/
1242	switch (cmd) {
1243	case BIOCSETF32:
1244	case BIOCSETFNR32:
1245	case BIOCSETWF32:
1246	case BIOCGDLTLIST32:
1247	case BIOCGRTIMEOUT32:
1248	case BIOCSRTIMEOUT32:
1249	BPFD_LOCK(d);
1250	d->bd_compat32 = 1;
1251	BPFD_UNLOCK(d);
1252	}
1253	#endif
1254
1255	CURVNET_SET(TD_TO_VNET(td));
1256	switch (cmd) {
1257
1258	default:
1259	error = EINVAL;
1260	break;
1261
1262	/*
1263	* Check for read packet available.
1264	*/
1265	case FIONREAD:
1266	{
1267	int n;
1268
1269	BPFD_LOCK(d);
1270	n = d->bd_slen;
1271	while (d->bd_hbuf_in_use)
1272	mtx_sleep(&d->bd_hbuf_in_use, &d->bd_lock,
1273	PRINET, "bd_hbuf", 0);
1274	if (d->bd_hbuf)
1275	n += d->bd_hlen;
1276	BPFD_UNLOCK(d);
1277
1278	(int )addr = n;
1279	break;
1280	}
1281
1282	case SIOCGIFADDR:
1283	{
1284	struct ifnet *ifp;
1285
1286	if (d->bd_bif == NULL)
1287	error = EINVAL;
1288	else {
1289	ifp = d->bd_bif->bif_ifp;
1290	error = (*ifp->if_ioctl)(ifp, cmd, addr);
1291	}
1292	break;
1293	}
1294
1295	/*
1296	* Get buffer len [for read()].
1297	*/
1298	case BIOCGBLEN:
1299	BPFD_LOCK(d);
1300	(u_int )addr = d->bd_bufsize;
1301	BPFD_UNLOCK(d);
1302	break;
1303
1304	/*
1305	* Set buffer length.
1306	*/
1307	case BIOCSBLEN:
1308	error = bpf_ioctl_sblen(d, (u_int *)addr);
1309	break;
1310
1311	/*
1312	* Set link layer read filter.
1313	*/
1314	case BIOCSETF:
1315	case BIOCSETFNR:
1316	case BIOCSETWF:
1317	#ifdef COMPAT_FREEBSD32
1318	case BIOCSETF32:
1319	case BIOCSETFNR32:
1320	case BIOCSETWF32:
1321	#endif
1322	error = bpf_setf(d, (struct bpf_program *)addr, cmd);
1323	break;
1324
1325	/*
1326	* Flush read packet buffer.
1327	*/
1328	case BIOCFLUSH:
1329	BPFD_LOCK(d);
1330	reset_d(d);
1331	BPFD_UNLOCK(d);
1332	break;
1333
1334	/*
1335	* Put interface into promiscuous mode.
1336	*/
1337	case BIOCPROMISC:
1338	if (d->bd_bif == NULL) {
1339	/*
1340	* No interface attached yet.
1341	*/
1342	error = EINVAL;
1343	break;
1344	}
1345	if (d->bd_promisc == 0) {
1346	error = ifpromisc(d->bd_bif->bif_ifp, 1);
1347	if (error == 0)
1348	d->bd_promisc = 1;
1349	}
1350	break;
1351
1352	/*
1353	* Get current data link type.
1354	*/
1355	case BIOCGDLT:
1356	BPF_LOCK();
1357	if (d->bd_bif == NULL)
1358	error = EINVAL;
1359	else
1360	(u_int )addr = d->bd_bif->bif_dlt;
1361	BPF_UNLOCK();
1362	break;
1363
1364	/*
1365	* Get a list of supported data link types.
1366	*/
1367	#ifdef COMPAT_FREEBSD32
1368	case BIOCGDLTLIST32:
1369	{
1370	struct bpf_dltlist32 *list32;
1371	struct bpf_dltlist dltlist;
1372
1373	list32 = (struct bpf_dltlist32 *)addr;
1374	dltlist.bfl_len = list32->bfl_len;
1375	dltlist.bfl_list = PTRIN(list32->bfl_list);
1376	BPF_LOCK();
1377	if (d->bd_bif == NULL)
1378	error = EINVAL;
1379	else {
1380	error = bpf_getdltlist(d, &dltlist);
1381	if (error == 0)
1382	list32->bfl_len = dltlist.bfl_len;
1383	}
1384	BPF_UNLOCK();
1385	break;
1386	}
1387	#endif
1388
1389	case BIOCGDLTLIST:
1390	BPF_LOCK();
1391	if (d->bd_bif == NULL)
1392	error = EINVAL;
1393	else
1394	error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
1395	BPF_UNLOCK();
1396	break;
1397
1398	/*
1399	* Set data link type.
1400	*/
1401	case BIOCSDLT:
1402	BPF_LOCK();
1403	if (d->bd_bif == NULL)
1404	error = EINVAL;
1405	else
1406	error = bpf_setdlt(d, (u_int )addr);
1407	BPF_UNLOCK();
1408	break;
1409
1410	/*
1411	* Get interface name.
1412	*/
1413	case BIOCGETIF:
1414	BPF_LOCK();
1415	if (d->bd_bif == NULL)
1416	error = EINVAL;
1417	else {
1418	struct ifnet *const ifp = d->bd_bif->bif_ifp;
1419	struct ifreq const ifr = (struct ifreq )addr;
1420
1421	strlcpy(ifr->ifr_name, ifp->if_xname,
1422	sizeof(ifr->ifr_name));
1423	}
1424	BPF_UNLOCK();
1425	break;
1426
1427	/*
1428	* Set interface.
1429	*/
1430	case BIOCSETIF:
1431	BPF_LOCK();
1432	error = bpf_setif(d, (struct ifreq *)addr);
1433	BPF_UNLOCK();
1434	break;
1435
1436	/*
1437	* Set read timeout.
1438	*/
1439	case BIOCSRTIMEOUT:
1440	#ifdef COMPAT_FREEBSD32
1441	case BIOCSRTIMEOUT32:
1442	#endif
1443	{
1444	struct timeval tv = (struct timeval )addr;
1445	#ifdef COMPAT_FREEBSD32
1446	struct timeval32 *tv32;
1447	struct timeval tv64;
1448
1449	if (cmd == BIOCSRTIMEOUT32) {
1450	tv32 = (struct timeval32 *)addr;
1451	tv = &tv64;
1452	tv->tv_sec = tv32->tv_sec;
1453	tv->tv_usec = tv32->tv_usec;
1454	} else
1455	#endif
1456	tv = (struct timeval *)addr;
1457
1458	/*
1459	* Subtract 1 tick from tvtohz() since this isn't
1460	* a one-shot timer.
1461	*/
1462	if ((error = itimerfix(tv)) == 0)
1463	d->bd_rtout = tvtohz(tv) - 1;
1464	break;
1465	}
1466
1467	/*
1468	* Get read timeout.
1469	*/
1470	case BIOCGRTIMEOUT:
1471	#ifdef COMPAT_FREEBSD32
1472	case BIOCGRTIMEOUT32:
1473	#endif
1474	{
1475	struct timeval *tv;
1476	#ifdef COMPAT_FREEBSD32
1477	struct timeval32 *tv32;
1478	struct timeval tv64;
1479
1480	if (cmd == BIOCGRTIMEOUT32)
1481	tv = &tv64;
1482	else
1483	#endif
1484	tv = (struct timeval *)addr;
1485
1486	tv->tv_sec = d->bd_rtout / hz;
1487	tv->tv_usec = (d->bd_rtout % hz) * tick;
1488	#ifdef COMPAT_FREEBSD32
1489	if (cmd == BIOCGRTIMEOUT32) {
1490	tv32 = (struct timeval32 *)addr;
1491	tv32->tv_sec = tv->tv_sec;
1492	tv32->tv_usec = tv->tv_usec;
1493	}
1494	#endif
1495
1496	break;
1497	}
1498
1499	/*
1500	* Get packet stats.
1501	*/
1502	case BIOCGSTATS:
1503	{
1504	struct bpf_stat bs = (struct bpf_stat )addr;
1505
1506	/* XXXCSJP overflow */
1507	bs->bs_recv = d->bd_rcount;
1508	bs->bs_drop = d->bd_dcount;
1509	break;
1510	}
1511
1512	/*
1513	* Set immediate mode.
1514	*/
1515	case BIOCIMMEDIATE:
1516	BPFD_LOCK(d);
1517	d->bd_immediate = (u_int )addr;
1518	BPFD_UNLOCK(d);
1519	break;
1520
1521	case BIOCVERSION:
1522	{
1523	struct bpf_version bv = (struct bpf_version )addr;
1524
1525	bv->bv_major = BPF_MAJOR_VERSION;
1526	bv->bv_minor = BPF_MINOR_VERSION;
1527	break;
1528	}
1529
1530	/*
1531	* Get "header already complete" flag
1532	*/
1533	case BIOCGHDRCMPLT:
1534	BPFD_LOCK(d);
1535	(u_int )addr = d->bd_hdrcmplt;
1536	BPFD_UNLOCK(d);
1537	break;
1538
1539	/*
1540	* Set "header already complete" flag
1541	*/
1542	case BIOCSHDRCMPLT:
1543	BPFD_LOCK(d);
1544	d->bd_hdrcmplt = (u_int )addr ? 1 : 0;
1545	BPFD_UNLOCK(d);
1546	break;
1547
1548	/*
1549	* Get packet direction flag
1550	*/
1551	case BIOCGDIRECTION:
1552	BPFD_LOCK(d);
1553	(u_int )addr = d->bd_direction;
1554	BPFD_UNLOCK(d);
1555	break;
1556
1557	/*
1558	* Set packet direction flag
1559	*/
1560	case BIOCSDIRECTION:
1561	{
1562	u_int direction;
1563
1564	direction = (u_int )addr;
1565	switch (direction) {
1566	case BPF_D_IN:
1567	case BPF_D_INOUT:
1568	case BPF_D_OUT:
1569	BPFD_LOCK(d);
1570	d->bd_direction = direction;
1571	BPFD_UNLOCK(d);
1572	break;
1573	default:
1574	error = EINVAL;
1575	}
1576	}
1577	break;
1578
1579	/*
1580	* Get packet timestamp format and resolution.
1581	*/
1582	case BIOCGTSTAMP:
1583	BPFD_LOCK(d);
1584	(u_int )addr = d->bd_tstamp;
1585	BPFD_UNLOCK(d);
1586	break;
1587
1588	/*
1589	* Set packet timestamp format and resolution.
1590	*/
1591	case BIOCSTSTAMP:
1592	{
1593	u_int func;
1594
1595	func = (u_int )addr;
1596	if (BPF_T_VALID(func))
1597	d->bd_tstamp = func;
1598	else
1599	error = EINVAL;
1600	}
1601	break;
1602
1603	case BIOCFEEDBACK:
1604	BPFD_LOCK(d);
1605	d->bd_feedback = (u_int )addr;
1606	BPFD_UNLOCK(d);
1607	break;
1608
1609	case BIOCLOCK:
1610	BPFD_LOCK(d);
1611	d->bd_locked = 1;
1612	BPFD_UNLOCK(d);
1613	break;
1614
1615	case FIONBIO: /* Non-blocking I/O */
1616	break;
1617
1618	case FIOASYNC: /* Send signal on receive packets */
1619	BPFD_LOCK(d);
1620	d->bd_async = (int )addr;
1621	BPFD_UNLOCK(d);
1622	break;
1623
1624	case FIOSETOWN:
1625	/*
1626	* XXX: Add some sort of locking here?
1627	* fsetown() can sleep.
1628	*/
1629	error = fsetown((int )addr, &d->bd_sigio);
1630	break;
1631
1632	case FIOGETOWN:
1633	BPFD_LOCK(d);
1634	(int )addr = fgetown(&d->bd_sigio);
1635	BPFD_UNLOCK(d);
1636	break;
1637
1638	/* This is deprecated, FIOSETOWN should be used instead. */
1639	case TIOCSPGRP:
1640	error = fsetown(-((int )addr), &d->bd_sigio);
1641	break;
1642
1643	/* This is deprecated, FIOGETOWN should be used instead. */
1644	case TIOCGPGRP:
1645	(int )addr = -fgetown(&d->bd_sigio);
1646	break;
1647
1648	case BIOCSRSIG: /* Set receive signal */
1649	{
1650	u_int sig;
1651
1652	sig = (u_int )addr;
1653
1654	if (sig >= NSIG)
1655	error = EINVAL;
1656	else {
1657	BPFD_LOCK(d);
1658	d->bd_sig = sig;
1659	BPFD_UNLOCK(d);
1660	}
1661	break;
1662	}
1663	case BIOCGRSIG:
1664	BPFD_LOCK(d);
1665	(u_int )addr = d->bd_sig;
1666	BPFD_UNLOCK(d);
1667	break;
1668
1669	case BIOCGETBUFMODE:
1670	BPFD_LOCK(d);
1671	(u_int )addr = d->bd_bufmode;
1672	BPFD_UNLOCK(d);
1673	break;
1674
1675	case BIOCSETBUFMODE:
1676	/*
1677	* Allow the buffering mode to be changed as long as we
1678	* haven't yet committed to a particular mode. Our
1679	* definition of commitment, for now, is whether or not a
1680	* buffer has been allocated or an interface attached, since
1681	* that's the point where things get tricky.
1682	*/
1683	switch ((u_int )addr) {
1684	case BPF_BUFMODE_BUFFER:
1685	break;
1686
1687	case BPF_BUFMODE_ZBUF:
1688	if (bpf_zerocopy_enable)
1689	break;
1690	/* FALLSTHROUGH */
1691
1692	default:
1693	CURVNET_RESTORE();
1694	return (EINVAL);
1695	}
1696
1697	BPFD_LOCK(d);
1698	if (d->bd_sbuf != NULL \|\| d->bd_hbuf != NULL \|\|
1699	d->bd_fbuf != NULL \|\| d->bd_bif != NULL) {
1700	BPFD_UNLOCK(d);
1701	CURVNET_RESTORE();
1702	return (EBUSY);
1703	}
1704	d->bd_bufmode = (u_int )addr;
1705	BPFD_UNLOCK(d);
1706	break;
1707
1708	case BIOCGETZMAX:
1709	error = bpf_ioctl_getzmax(td, d, (size_t *)addr);
1710	break;
1711
1712	case BIOCSETZBUF:
1713	error = bpf_ioctl_setzbuf(td, d, (struct bpf_zbuf *)addr);
1714	break;
1715
1716	case BIOCROTZBUF:
1717	error = bpf_ioctl_rotzbuf(td, d, (struct bpf_zbuf *)addr);
1718	break;
1719	}
1720	CURVNET_RESTORE();
1721	return (error);
1722	}
1723
1724	/*
1725	* Set d's packet filter program to fp. If this file already has a filter,
1726	* free it and replace it. Returns EINVAL for bogus requests.
1727	*
1728	* Note we need global lock here to serialize bpf_setf() and bpf_setif() calls
1729	* since reading d->bd_bif can't be protected by d or interface lock due to
1730	* lock order.
1731	*
1732	* Additionally, we have to acquire interface write lock due to bpf_mtap() uses
1733	* interface read lock to read all filers.
1734	*
1735	*/
1736	static int
1737	bpf_setf(struct bpf_d d, struct bpf_program fp, u_long cmd)
1738	{
1739	#ifdef COMPAT_FREEBSD32
1740	struct bpf_program fp_swab;
1741	struct bpf_program32 *fp32;
1742	#endif
1743	struct bpf_insn fcode, old;
1744	#ifdef BPF_JITTER
1745	bpf_jit_filter jfunc, ofunc;
1746	#endif
1747	size_t size;
1748	u_int flen;
1749	int need_upgrade;
1750
1751	#ifdef COMPAT_FREEBSD32
1752	switch (cmd) {
1753	case BIOCSETF32:
1754	case BIOCSETWF32:
1755	case BIOCSETFNR32:
1756	fp32 = (struct bpf_program32 *)fp;
1757	fp_swab.bf_len = fp32->bf_len;
1758	fp_swab.bf_insns = (struct bpf_insn *)(uintptr_t)fp32->bf_insns;
1759	fp = &fp_swab;
1760	switch (cmd) {
1761	case BIOCSETF32:
1762	cmd = BIOCSETF;
1763	break;
1764	case BIOCSETWF32:
1765	cmd = BIOCSETWF;
1766	break;
1767	}
1768	break;
1769	}
1770	#endif
1771
1772	fcode = NULL;
1773	#ifdef BPF_JITTER
1774	jfunc = ofunc = NULL;
1775	#endif
1776	need_upgrade = 0;
1777
1778	/*
1779	* Check new filter validness before acquiring any locks.
1780	* Allocate memory for new filter, if needed.
1781	*/
1782	flen = fp->bf_len;
1783	if (flen > bpf_maxinsns \|\| (fp->bf_insns == NULL && flen != 0))
1784	return (EINVAL);
1785	size = flen * sizeof(*fp->bf_insns);
1786	if (size > 0) {
1787	/* We're setting up new filter. Copy and check actual data. */
1788	fcode = malloc(size, M_BPF, M_WAITOK);
1789	if (copyin(fp->bf_insns, fcode, size) != 0 \|\|
1790	!bpf_validate(fcode, flen)) {
1791	free(fcode, M_BPF);
1792	return (EINVAL);
1793	}
1794	#ifdef BPF_JITTER
1795	/* Filter is copied inside fcode and is perfectly valid. */
1796	jfunc = bpf_jitter(fcode, flen);
1797	#endif
1798	}
1799
1800	BPF_LOCK();
1801
1802	/*
1803	* Set up new filter.
1804	* Protect filter change by interface lock.
1805	* Additionally, we are protected by global lock here.
1806	*/
1807	if (d->bd_bif != NULL)
1808	BPFIF_WLOCK(d->bd_bif);
1809	BPFD_LOCK(d);
1810	if (cmd == BIOCSETWF) {
1811	old = d->bd_wfilter;
1812	d->bd_wfilter = fcode;
1813	} else {
1814	old = d->bd_rfilter;
1815	d->bd_rfilter = fcode;
1816	#ifdef BPF_JITTER
1817	ofunc = d->bd_bfilter;
1818	d->bd_bfilter = jfunc;
1819	#endif
1820	if (cmd == BIOCSETF)
1821	reset_d(d);
1822
1823	if (fcode != NULL) {
1824	/*
1825	* Do not require upgrade by first BIOCSETF
1826	* (used to set snaplen) by pcap_open_live().
1827	*/
1828	if (d->bd_writer != 0 && --d->bd_writer == 0)
1829	need_upgrade = 1;
1830	CTR4(KTR_NET, "%s: filter function set by pid %d, "
1831	"bd_writer counter %d, need_upgrade %d",
1832	__func__, d->bd_pid, d->bd_writer, need_upgrade);
1833	}
1834	}
1835	BPFD_UNLOCK(d);
1836	if (d->bd_bif != NULL)
1837	BPFIF_WUNLOCK(d->bd_bif);
1838	if (old != NULL)
1839	free(old, M_BPF);
1840	#ifdef BPF_JITTER
1841	if (ofunc != NULL)
1842	bpf_destroy_jit_filter(ofunc);
1843	#endif
1844
1845	/* Move d to active readers list. */
1846	if (need_upgrade)
1847	bpf_upgraded(d);
1848
1849	BPF_UNLOCK();
1850	return (0);
1851	}
1852
1853	/*
1854	* Detach a file from its current interface (if attached at all) and attach
1855	* to the interface indicated by the name stored in ifr.
1856	* Return an errno or 0.
1857	*/
1858	static int
1859	bpf_setif(struct bpf_d d, struct ifreq ifr)
1860	{
1861	struct bpf_if *bp;
1862	struct ifnet *theywant;
1863
1864	BPF_LOCK_ASSERT();
1865
1866	theywant = ifunit(ifr->ifr_name);
1867	if (theywant == NULL \|\| theywant->if_bpf == NULL)
1868	return (ENXIO);
1869
1870	bp = theywant->if_bpf;
1871
1872	/* Check if interface is not being detached from BPF */
1873	BPFIF_RLOCK(bp);
1874	if (bp->flags & BPFIF_FLAG_DYING) {
1875	BPFIF_RUNLOCK(bp);
1876	return (ENXIO);
1877	}
1878	BPFIF_RUNLOCK(bp);
1879
1880	/*
1881	* Behavior here depends on the buffering model. If we're using
1882	* kernel memory buffers, then we can allocate them here. If we're
1883	* using zero-copy, then the user process must have registered
1884	* buffers by the time we get here. If not, return an error.
1885	*/
1886	switch (d->bd_bufmode) {
1887	case BPF_BUFMODE_BUFFER:
1888	case BPF_BUFMODE_ZBUF:
1889	if (d->bd_sbuf == NULL)
1890	return (EINVAL);
1891	break;
1892
1893	default:
1894	panic("bpf_setif: bufmode %d", d->bd_bufmode);
1895	}
1896	if (bp != d->bd_bif)
1897	bpf_attachd(d, bp);
1898	BPFD_LOCK(d);
1899	reset_d(d);
1900	BPFD_UNLOCK(d);
1901	return (0);
1902	}
1903
1904	/*
1905	* Support for select() and poll() system calls
1906	*
1907	* Return true iff the specific operation will not block indefinitely.
1908	* Otherwise, return false but make a note that a selwakeup() must be done.
1909	*/
1910	static int
1911	bpfpoll(struct cdev dev, int events, struct thread td)
1912	{
1913	struct bpf_d *d;
1914	int revents;
1915
1916	if (devfs_get_cdevpriv((void **)&d) != 0 \|\| d->bd_bif == NULL)
1917	return (events &
1918	(POLLHUP\|POLLIN\|POLLRDNORM\|POLLOUT\|POLLWRNORM));
1919
1920	/*
1921	* Refresh PID associated with this descriptor.
1922	*/
1923	revents = events & (POLLOUT \| POLLWRNORM);
1924	BPFD_LOCK(d);
1925	BPF_PID_REFRESH(d, td);
1926	if (events & (POLLIN \| POLLRDNORM)) {
1927	if (bpf_ready(d))
1928	revents \|= events & (POLLIN \| POLLRDNORM);
1929	else {
1930	selrecord(td, &d->bd_sel);
1931	/* Start the read timeout if necessary. */
1932	if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1933	callout_reset(&d->bd_callout, d->bd_rtout,
1934	bpf_timed_out, d);
1935	d->bd_state = BPF_WAITING;
1936	}
1937	}
1938	}
1939	BPFD_UNLOCK(d);
1940	return (revents);
1941	}
1942
1943	/*
1944	* Support for kevent() system call. Register EVFILT_READ filters and
1945	* reject all others.
1946	*/
1947	int
1948	bpfkqfilter(struct cdev dev, struct knote kn)
1949	{
1950	struct bpf_d *d;
1951
1952	if (devfs_get_cdevpriv((void **)&d) != 0 \|\|
1953	kn->kn_filter != EVFILT_READ)
1954	return (1);
1955
1956	/*
1957	* Refresh PID associated with this descriptor.
1958	*/
1959	BPFD_LOCK(d);
1960	BPF_PID_REFRESH_CUR(d);
1961	kn->kn_fop = &bpfread_filtops;
1962	kn->kn_hook = d;
1963	knlist_add(&d->bd_sel.si_note, kn, 1);
1964	BPFD_UNLOCK(d);
1965
1966	return (0);
1967	}
1968
1969	static void
1970	filt_bpfdetach(struct knote *kn)
1971	{
1972	struct bpf_d d = (struct bpf_d )kn->kn_hook;
1973
1974	knlist_remove(&d->bd_sel.si_note, kn, 0);
1975	}
1976
1977	static int
1978	filt_bpfread(struct knote *kn, long hint)
1979	{
1980	struct bpf_d d = (struct bpf_d )kn->kn_hook;
1981	int ready;
1982
1983	BPFD_LOCK_ASSERT(d);
1984	ready = bpf_ready(d);
1985	if (ready) {
1986	kn->kn_data = d->bd_slen;
1987	while (d->bd_hbuf_in_use)
1988	mtx_sleep(&d->bd_hbuf_in_use, &d->bd_lock,
1989	PRINET, "bd_hbuf", 0);
1990	if (d->bd_hbuf)
1991	kn->kn_data += d->bd_hlen;
1992	} else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1993	callout_reset(&d->bd_callout, d->bd_rtout,
1994	bpf_timed_out, d);
1995	d->bd_state = BPF_WAITING;
1996	}
1997
1998	return (ready);
1999	}
2000
2001	#define BPF_TSTAMP_NONE 0
2002	#define BPF_TSTAMP_FAST 1
2003	#define BPF_TSTAMP_NORMAL 2
2004	#define BPF_TSTAMP_EXTERN 3
2005
2006	static int
2007	bpf_ts_quality(int tstype)
2008	{
2009
2010	if (tstype == BPF_T_NONE)
2011	return (BPF_TSTAMP_NONE);
2012	if ((tstype & BPF_T_FAST) != 0)
2013	return (BPF_TSTAMP_FAST);
2014
2015	return (BPF_TSTAMP_NORMAL);
2016	}
2017
2018	static int
2019	bpf_gettime(struct bintime bt, int tstype, struct mbuf m)
2020	{
2021	struct m_tag *tag;
2022	int quality;
2023
2024	quality = bpf_ts_quality(tstype);
2025	if (quality == BPF_TSTAMP_NONE)
2026	return (quality);
2027
2028	if (m != NULL) {
2029	tag = m_tag_locate(m, MTAG_BPF, MTAG_BPF_TIMESTAMP, NULL);
2030	if (tag != NULL) {
2031	bt = (struct bintime *)(tag + 1);
2032	return (BPF_TSTAMP_EXTERN);
2033	}
2034	}
2035	if (quality == BPF_TSTAMP_NORMAL)
2036	binuptime(bt);
2037	else
2038	getbinuptime(bt);
2039
2040	return (quality);
2041	}
2042
2043	/*
2044	* Incoming linkage from device drivers. Process the packet pkt, of length
2045	* pktlen, which is stored in a contiguous buffer. The packet is parsed
2046	* by each process' filter, and if accepted, stashed into the corresponding
2047	* buffer.
2048	*/
2049	void
2050	bpf_tap(struct bpf_if bp, u_char pkt, u_int pktlen)
2051	{
2052	struct bintime bt;
2053	struct bpf_d *d;
2054	#ifdef BPF_JITTER
2055	bpf_jit_filter *bf;
2056	#endif
2057	u_int slen;
2058	int gottime;
2059
2060	gottime = BPF_TSTAMP_NONE;
2061
2062	BPFIF_RLOCK(bp);
2063
2064	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
2065	/*
2066	* We are not using any locks for d here because:
2067	* 1) any filter change is protected by interface
2068	* write lock
2069	* 2) destroying/detaching d is protected by interface
2070	* write lock, too
2071	*/
2072
2073	/* XXX: Do not protect counter for the sake of performance. */
2074	++d->bd_rcount;
2075	/*
2076	* NB: We dont call BPF_CHECK_DIRECTION() here since there is no
2077	* way for the caller to indiciate to us whether this packet
2078	* is inbound or outbound. In the bpf_mtap() routines, we use
2079	* the interface pointers on the mbuf to figure it out.
2080	*/
2081	#ifdef BPF_JITTER
2082	bf = bpf_jitter_enable != 0 ? d->bd_bfilter : NULL;
2083	if (bf != NULL)
2084	slen = (*(bf->func))(pkt, pktlen, pktlen);
2085	else
2086	#endif
2087	slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen);
2088	if (slen != 0) {
2089	/*
2090	* Filter matches. Let's to acquire write lock.
2091	*/
2092	BPFD_LOCK(d);
2093
2094	d->bd_fcount++;
2095	if (gottime < bpf_ts_quality(d->bd_tstamp))
2096	gottime = bpf_gettime(&bt, d->bd_tstamp, NULL);
2097	#ifdef MAC
2098	if (mac_bpfdesc_check_receive(d, bp->bif_ifp) == 0)
2099	#endif
2100	catchpacket(d, pkt, pktlen, slen,
2101	bpf_append_bytes, &bt);
2102	BPFD_UNLOCK(d);
2103	}
2104	}
2105	BPFIF_RUNLOCK(bp);
2106	}
2107
2108	#define BPF_CHECK_DIRECTION(d, r, i) \
2109	(((d)->bd_direction == BPF_D_IN && (r) != (i)) \|\| \
2110	((d)->bd_direction == BPF_D_OUT && (r) == (i)))
2111
2112	/*
2113	* Incoming linkage from device drivers, when packet is in an mbuf chain.
2114	* Locking model is explained in bpf_tap().
2115	*/
2116	void
2117	bpf_mtap(struct bpf_if bp, struct mbuf m)
2118	{
2119	struct bintime bt;
2120	struct bpf_d *d;
2121	#ifdef BPF_JITTER
2122	bpf_jit_filter *bf;
2123	#endif
2124	u_int pktlen, slen;
2125	int gottime;
2126
2127	/* Skip outgoing duplicate packets. */
2128	if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
2129	m->m_flags &= ~M_PROMISC;
2130	return;
2131	}
2132
2133	pktlen = m_length(m, NULL);
2134	gottime = BPF_TSTAMP_NONE;
2135
2136	BPFIF_RLOCK(bp);
2137
2138	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
2139	if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
2140	continue;
2141	++d->bd_rcount;
2142	#ifdef BPF_JITTER
2143	bf = bpf_jitter_enable != 0 ? d->bd_bfilter : NULL;
2144	/* XXX We cannot handle multiple mbufs. */
2145	if (bf != NULL && m->m_next == NULL)
2146	slen = ((bf->func))(mtod(m, u_char ), pktlen, pktlen);
2147	else
2148	#endif
2149	slen = bpf_filter(d->bd_rfilter, (u_char *)m, pktlen, 0);
2150	if (slen != 0) {
2151	BPFD_LOCK(d);
2152
2153	d->bd_fcount++;
2154	if (gottime < bpf_ts_quality(d->bd_tstamp))
2155	gottime = bpf_gettime(&bt, d->bd_tstamp, m);
2156	#ifdef MAC
2157	if (mac_bpfdesc_check_receive(d, bp->bif_ifp) == 0)
2158	#endif
2159	catchpacket(d, (u_char *)m, pktlen, slen,
2160	bpf_append_mbuf, &bt);
2161	BPFD_UNLOCK(d);
2162	}
2163	}
2164	BPFIF_RUNLOCK(bp);
2165	}
2166
2167	/*
2168	* Incoming linkage from device drivers, when packet is in
2169	* an mbuf chain and to be prepended by a contiguous header.
2170	*/
2171	void
2172	bpf_mtap2(struct bpf_if bp, void data, u_int dlen, struct mbuf *m)
2173	{
2174	struct bintime bt;
2175	struct mbuf mb;
2176	struct bpf_d *d;
2177	u_int pktlen, slen;
2178	int gottime;
2179
2180	/* Skip outgoing duplicate packets. */
2181	if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
2182	m->m_flags &= ~M_PROMISC;
2183	return;
2184	}
2185
2186	pktlen = m_length(m, NULL);
2187	/*
2188	* Craft on-stack mbuf suitable for passing to bpf_filter.
2189	* Note that we cut corners here; we only setup what's
2190	* absolutely needed--this mbuf should never go anywhere else.
2191	*/
2192	mb.m_next = m;
2193	mb.m_data = data;
2194	mb.m_len = dlen;
2195	pktlen += dlen;
2196
2197	gottime = BPF_TSTAMP_NONE;
2198
2199	BPFIF_RLOCK(bp);
2200
2201	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
2202	if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
2203	continue;
2204	++d->bd_rcount;
2205	slen = bpf_filter(d->bd_rfilter, (u_char *)&mb, pktlen, 0);
2206	if (slen != 0) {
2207	BPFD_LOCK(d);
2208
2209	d->bd_fcount++;
2210	if (gottime < bpf_ts_quality(d->bd_tstamp))
2211	gottime = bpf_gettime(&bt, d->bd_tstamp, m);
2212	#ifdef MAC
2213	if (mac_bpfdesc_check_receive(d, bp->bif_ifp) == 0)
2214	#endif
2215	catchpacket(d, (u_char *)&mb, pktlen, slen,
2216	bpf_append_mbuf, &bt);
2217	BPFD_UNLOCK(d);
2218	}
2219	}
2220	BPFIF_RUNLOCK(bp);
2221	}
2222
2223	#undef BPF_CHECK_DIRECTION
2224
2225	#undef BPF_TSTAMP_NONE
2226	#undef BPF_TSTAMP_FAST
2227	#undef BPF_TSTAMP_NORMAL
2228	#undef BPF_TSTAMP_EXTERN
2229
2230	static int
2231	bpf_hdrlen(struct bpf_d *d)
2232	{
2233	int hdrlen;
2234
2235	hdrlen = d->bd_bif->bif_hdrlen;
2236	#ifndef BURN_BRIDGES
2237	if (d->bd_tstamp == BPF_T_NONE \|\|
2238	BPF_T_FORMAT(d->bd_tstamp) == BPF_T_MICROTIME)
2239	#ifdef COMPAT_FREEBSD32
2240	if (d->bd_compat32)
2241	hdrlen += SIZEOF_BPF_HDR(struct bpf_hdr32);
2242	else
2243	#endif
2244	hdrlen += SIZEOF_BPF_HDR(struct bpf_hdr);
2245	else
2246	#endif
2247	hdrlen += SIZEOF_BPF_HDR(struct bpf_xhdr);
2248	#ifdef COMPAT_FREEBSD32
2249	if (d->bd_compat32)
2250	hdrlen = BPF_WORDALIGN32(hdrlen);
2251	else
2252	#endif
2253	hdrlen = BPF_WORDALIGN(hdrlen);
2254
2255	return (hdrlen - d->bd_bif->bif_hdrlen);
2256	}
2257
2258	static void
2259	bpf_bintime2ts(struct bintime bt, struct bpf_ts ts, int tstype)
2260	{
2261	struct bintime bt2;
2262	struct timeval tsm;
2263	struct timespec tsn;
2264
2265	if ((tstype & BPF_T_MONOTONIC) == 0) {
2266	bt2 = *bt;
2267	bintime_add(&bt2, &boottimebin);
2268	bt = &bt2;
2269	}
2270	switch (BPF_T_FORMAT(tstype)) {
2271	case BPF_T_MICROTIME:
2272	bintime2timeval(bt, &tsm);
2273	ts->bt_sec = tsm.tv_sec;
2274	ts->bt_frac = tsm.tv_usec;
2275	break;
2276	case BPF_T_NANOTIME:
2277	bintime2timespec(bt, &tsn);
2278	ts->bt_sec = tsn.tv_sec;
2279	ts->bt_frac = tsn.tv_nsec;
2280	break;
2281	case BPF_T_BINTIME:
2282	ts->bt_sec = bt->sec;
2283	ts->bt_frac = bt->frac;
2284	break;
2285	}
2286	}
2287
2288	/*
2289	* Move the packet data from interface memory (pkt) into the
2290	* store buffer. "cpfn" is the routine called to do the actual data
2291	* transfer. bcopy is passed in to copy contiguous chunks, while
2292	* bpf_append_mbuf is passed in to copy mbuf chains. In the latter case,
2293	* pkt is really an mbuf.
2294	*/
2295	static void
2296	catchpacket(struct bpf_d d, u_char pkt, u_int pktlen, u_int snaplen,
2297	void (cpfn)(struct bpf_d , caddr_t, u_int, void *, u_int),
2298	struct bintime *bt)
2299	{
2300	struct bpf_xhdr hdr;
2301	#ifndef BURN_BRIDGES
2302	struct bpf_hdr hdr_old;
2303	#ifdef COMPAT_FREEBSD32
2304	struct bpf_hdr32 hdr32_old;
2305	#endif
2306	#endif
2307	int caplen, curlen, hdrlen, totlen;
2308	int do_wakeup = 0;
2309	int do_timestamp;
2310	int tstype;
2311
2312	BPFD_LOCK_ASSERT(d);
2313
2314	/*
2315	* Detect whether user space has released a buffer back to us, and if
2316	* so, move it from being a hold buffer to a free buffer. This may
2317	* not be the best place to do it (for example, we might only want to
2318	* run this check if we need the space), but for now it's a reliable
2319	* spot to do it.
2320	*/
2321	if (d->bd_fbuf == NULL && bpf_canfreebuf(d)) {
2322	while (d->bd_hbuf_in_use)
2323	mtx_sleep(&d->bd_hbuf_in_use, &d->bd_lock,
2324	PRINET, "bd_hbuf", 0);
2325	d->bd_fbuf = d->bd_hbuf;
2326	d->bd_hbuf = NULL;
2327	d->bd_hlen = 0;
2328	bpf_buf_reclaimed(d);
2329	}
2330
2331	/*
2332	* Figure out how many bytes to move. If the packet is
2333	* greater or equal to the snapshot length, transfer that
2334	* much. Otherwise, transfer the whole packet (unless
2335	* we hit the buffer size limit).
2336	*/
2337	hdrlen = bpf_hdrlen(d);
2338	totlen = hdrlen + min(snaplen, pktlen);
2339	if (totlen > d->bd_bufsize)
2340	totlen = d->bd_bufsize;
2341
2342	/*
2343	* Round up the end of the previous packet to the next longword.
2344	*
2345	* Drop the packet if there's no room and no hope of room
2346	* If the packet would overflow the storage buffer or the storage
2347	* buffer is considered immutable by the buffer model, try to rotate
2348	* the buffer and wakeup pending processes.
2349	*/
2350	#ifdef COMPAT_FREEBSD32
2351	if (d->bd_compat32)
2352	curlen = BPF_WORDALIGN32(d->bd_slen);
2353	else
2354	#endif
2355	curlen = BPF_WORDALIGN(d->bd_slen);
2356	if (curlen + totlen > d->bd_bufsize \|\| !bpf_canwritebuf(d)) {
2357	if (d->bd_fbuf == NULL) {
2358	/*
2359	* There's no room in the store buffer, and no
2360	* prospect of room, so drop the packet. Notify the
2361	* buffer model.
2362	*/
2363	bpf_buffull(d);
2364	++d->bd_dcount;
2365	return;
2366	}
2367	while (d->bd_hbuf_in_use)
2368	mtx_sleep(&d->bd_hbuf_in_use, &d->bd_lock,
2369	PRINET, "bd_hbuf", 0);
2370	ROTATE_BUFFERS(d);
2371	do_wakeup = 1;
2372	curlen = 0;
2373	} else if (d->bd_immediate \|\| d->bd_state == BPF_TIMED_OUT)
2374	/*
2375	* Immediate mode is set, or the read timeout has already
2376	* expired during a select call. A packet arrived, so the
2377	* reader should be woken up.
2378	*/
2379	do_wakeup = 1;
2380	caplen = totlen - hdrlen;
2381	tstype = d->bd_tstamp;
2382	do_timestamp = tstype != BPF_T_NONE;
2383	#ifndef BURN_BRIDGES
2384	if (tstype == BPF_T_NONE \|\| BPF_T_FORMAT(tstype) == BPF_T_MICROTIME) {
2385	struct bpf_ts ts;
2386	if (do_timestamp)
2387	bpf_bintime2ts(bt, &ts, tstype);
2388	#ifdef COMPAT_FREEBSD32
2389	if (d->bd_compat32) {
2390	bzero(&hdr32_old, sizeof(hdr32_old));
2391	if (do_timestamp) {
2392	hdr32_old.bh_tstamp.tv_sec = ts.bt_sec;
2393	hdr32_old.bh_tstamp.tv_usec = ts.bt_frac;
2394	}
2395	hdr32_old.bh_datalen = pktlen;
2396	hdr32_old.bh_hdrlen = hdrlen;
2397	hdr32_old.bh_caplen = caplen;
2398	bpf_append_bytes(d, d->bd_sbuf, curlen, &hdr32_old,
2399	sizeof(hdr32_old));
2400	goto copy;
2401	}
2402	#endif
2403	bzero(&hdr_old, sizeof(hdr_old));
2404	if (do_timestamp) {
2405	hdr_old.bh_tstamp.tv_sec = ts.bt_sec;
2406	hdr_old.bh_tstamp.tv_usec = ts.bt_frac;
2407	}
2408	hdr_old.bh_datalen = pktlen;
2409	hdr_old.bh_hdrlen = hdrlen;
2410	hdr_old.bh_caplen = caplen;
2411	bpf_append_bytes(d, d->bd_sbuf, curlen, &hdr_old,
2412	sizeof(hdr_old));
2413	goto copy;
2414	}
2415	#endif
2416
2417	/*
2418	* Append the bpf header. Note we append the actual header size, but
2419	* move forward the length of the header plus padding.
2420	*/
2421	bzero(&hdr, sizeof(hdr));
2422	if (do_timestamp)
2423	bpf_bintime2ts(bt, &hdr.bh_tstamp, tstype);
2424	hdr.bh_datalen = pktlen;
2425	hdr.bh_hdrlen = hdrlen;
2426	hdr.bh_caplen = caplen;
2427	bpf_append_bytes(d, d->bd_sbuf, curlen, &hdr, sizeof(hdr));
2428
2429	/*
2430	* Copy the packet data into the store buffer and update its length.
2431	*/
2432	#ifndef BURN_BRIDGES
2433	copy:
2434	#endif
2435	(*cpfn)(d, d->bd_sbuf, curlen + hdrlen, pkt, caplen);
2436	d->bd_slen = curlen + totlen;
2437
2438	if (do_wakeup)
2439	bpf_wakeup(d);
2440	}
2441
2442	/*
2443	* Free buffers currently in use by a descriptor.
2444	* Called on close.
2445	*/
2446	static void
2447	bpf_freed(struct bpf_d *d)
2448	{
2449
2450	/*
2451	* We don't need to lock out interrupts since this descriptor has
2452	* been detached from its interface and it yet hasn't been marked
2453	* free.
2454	*/
2455	bpf_free(d);
2456	if (d->bd_rfilter != NULL) {
2457	free((caddr_t)d->bd_rfilter, M_BPF);
2458	#ifdef BPF_JITTER
2459	if (d->bd_bfilter != NULL)
2460	bpf_destroy_jit_filter(d->bd_bfilter);
2461	#endif
2462	}
2463	if (d->bd_wfilter != NULL)
2464	free((caddr_t)d->bd_wfilter, M_BPF);
2465	mtx_destroy(&d->bd_lock);
2466	}
2467
2468	/*
2469	* Attach an interface to bpf. dlt is the link layer type; hdrlen is the
2470	* fixed size of the link header (variable length headers not yet supported).
2471	*/
2472	void
2473	bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
2474	{
2475
2476	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
2477	}
2478
2479	/*
2480	* Attach an interface to bpf. ifp is a pointer to the structure
2481	* defining the interface to be attached, dlt is the link layer type,
2482	* and hdrlen is the fixed size of the link header (variable length
2483	* headers are not yet supporrted).
2484	*/
2485	void
2486	bpfattach2(struct ifnet ifp, u_int dlt, u_int hdrlen, struct bpf_if *driverp)
2487	{
2488	struct bpf_if *bp;
2489
2490	bp = malloc(sizeof(*bp), M_BPF, M_NOWAIT \| M_ZERO);
2491	if (bp == NULL)
2492	panic("bpfattach");
2493
2494	LIST_INIT(&bp->bif_dlist);
2495	LIST_INIT(&bp->bif_wlist);
2496	bp->bif_ifp = ifp;
2497	bp->bif_dlt = dlt;
2498	rw_init(&bp->bif_lock, "bpf interface lock");
2499	KASSERT(*driverp == NULL, ("bpfattach2: driverp already initialized"));
2500	*driverp = bp;
2501
2502	BPF_LOCK();
2503	LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next);
2504	BPF_UNLOCK();
2505
2506	bp->bif_hdrlen = hdrlen;
2507
2508	if (bootverbose)
2509	if_printf(ifp, "bpf attached\n");
2510	}
2511
2512	/*
2513	* Detach bpf from an interface. This involves detaching each descriptor
2514	* associated with the interface. Notify each descriptor as it's detached
2515	* so that any sleepers wake up and get ENXIO.
2516	*/
2517	void
2518	bpfdetach(struct ifnet *ifp)
2519	{
2520	struct bpf_if *bp;
2521	struct bpf_d *d;
2522	#ifdef INVARIANTS
2523	int ndetached;
2524
2525	ndetached = 0;
2526	#endif
2527
2528	BPF_LOCK();
2529	/* Find all bpf_if struct's which reference ifp and detach them. */
2530	do {
2531	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
2532	if (ifp == bp->bif_ifp)
2533	break;
2534	}
2535	if (bp != NULL)
2536	LIST_REMOVE(bp, bif_next);
2537
2538	if (bp != NULL) {
2539	#ifdef INVARIANTS
2540	ndetached++;
2541	#endif
2542	while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) {
2543	bpf_detachd_locked(d);
2544	BPFD_LOCK(d);
2545	bpf_wakeup(d);
2546	BPFD_UNLOCK(d);
2547	}
2548	/* Free writer-only descriptors */
2549	while ((d = LIST_FIRST(&bp->bif_wlist)) != NULL) {
2550	bpf_detachd_locked(d);
2551	BPFD_LOCK(d);
2552	bpf_wakeup(d);
2553	BPFD_UNLOCK(d);
2554	}
2555
2556	/*
2557	* Delay freing bp till interface is detached
2558	* and all routes through this interface are removed.
2559	* Mark bp as detached to restrict new consumers.
2560	*/
2561	BPFIF_WLOCK(bp);
2562	bp->flags \|= BPFIF_FLAG_DYING;
2563	BPFIF_WUNLOCK(bp);
2564	}
2565	} while (bp != NULL);
2566	BPF_UNLOCK();
2567
2568	#ifdef INVARIANTS
2569	if (ndetached == 0)
2570	printf("bpfdetach: %s was not attached\n", ifp->if_xname);
2571	#endif
2572	}
2573
2574	/*
2575	* Interface departure handler.
2576	* Note departure event does not guarantee interface is going down.
2577	*/
2578	static void
2579	bpf_ifdetach(void arg __unused, struct ifnet ifp)
2580	{
2581	struct bpf_if *bp;
2582
2583	BPF_LOCK();
2584	if ((bp = ifp->if_bpf) == NULL) {
2585	BPF_UNLOCK();
2586	return;
2587	}
2588
2589	/* Check if bpfdetach() was called previously */
2590	if ((bp->flags & BPFIF_FLAG_DYING) == 0) {
2591	BPF_UNLOCK();
2592	return;
2593	}
2594
2595	CTR3(KTR_NET, "%s: freing BPF instance %p for interface %p",
2596	__func__, bp, ifp);
2597
2598	ifp->if_bpf = NULL;
2599	BPF_UNLOCK();
2600
2601	rw_destroy(&bp->bif_lock);
2602	free(bp, M_BPF);
2603	}
2604
2605	/*
2606	* Get a list of available data link type of the interface.
2607	*/
2608	static int
2609	bpf_getdltlist(struct bpf_d d, struct bpf_dltlist bfl)
2610	{
2611	int n, error;
2612	struct ifnet *ifp;
2613	struct bpf_if *bp;
2614
2615	BPF_LOCK_ASSERT();
2616
2617	ifp = d->bd_bif->bif_ifp;
2618	n = 0;
2619	error = 0;
2620	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
2621	if (bp->bif_ifp != ifp)
2622	continue;
2623	if (bfl->bfl_list != NULL) {
2624	if (n >= bfl->bfl_len)
2625	return (ENOMEM);
2626	error = copyout(&bp->bif_dlt,
2627	bfl->bfl_list + n, sizeof(u_int));
2628	}
2629	n++;
2630	}
2631	bfl->bfl_len = n;
2632	return (error);
2633	}
2634
2635	/*
2636	* Set the data link type of a BPF instance.
2637	*/
2638	static int
2639	bpf_setdlt(struct bpf_d *d, u_int dlt)
2640	{
2641	int error, opromisc;
2642	struct ifnet *ifp;
2643	struct bpf_if *bp;
2644
2645	BPF_LOCK_ASSERT();
2646
2647	if (d->bd_bif->bif_dlt == dlt)
2648	return (0);
2649	ifp = d->bd_bif->bif_ifp;
2650
2651	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
2652	if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
2653	break;
2654	}
2655
2656	if (bp != NULL) {
2657	opromisc = d->bd_promisc;
2658	bpf_attachd(d, bp);
2659	BPFD_LOCK(d);
2660	reset_d(d);
2661	BPFD_UNLOCK(d);
2662	if (opromisc) {
2663	error = ifpromisc(bp->bif_ifp, 1);
2664	if (error)
2665	if_printf(bp->bif_ifp,
2666	"bpf_setdlt: ifpromisc failed (%d)\n",
2667	error);
2668	else
2669	d->bd_promisc = 1;
2670	}
2671	}
2672	return (bp == NULL ? EINVAL : 0);
2673	}
2674
2675	static void
2676	bpf_drvinit(void *unused)
2677	{
2678	struct cdev *dev;
2679
2680	mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
2681	LIST_INIT(&bpf_iflist);
2682
2683	dev = make_dev(&bpf_cdevsw, 0, UID_ROOT, GID_WHEEL, 0600, "bpf");
2684	/* For compatibility */
2685	make_dev_alias(dev, "bpf0");
2686
2687	/* Register interface departure handler */
2688	bpf_ifdetach_cookie = EVENTHANDLER_REGISTER(
2689	ifnet_departure_event, bpf_ifdetach, NULL,
2690	EVENTHANDLER_PRI_ANY);
2691	}
2692
2693	/*
2694	* Zero out the various packet counters associated with all of the bpf
2695	* descriptors. At some point, we will probably want to get a bit more
2696	* granular and allow the user to specify descriptors to be zeroed.
2697	*/
2698	static void
2699	bpf_zero_counters(void)
2700	{
2701	struct bpf_if *bp;
2702	struct bpf_d *bd;
2703
2704	BPF_LOCK();
2705	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
2706	BPFIF_RLOCK(bp);
2707	LIST_FOREACH(bd, &bp->bif_dlist, bd_next) {
2708	BPFD_LOCK(bd);
2709	bd->bd_rcount = 0;
2710	bd->bd_dcount = 0;
2711	bd->bd_fcount = 0;
2712	bd->bd_wcount = 0;
2713	bd->bd_wfcount = 0;
2714	bd->bd_zcopy = 0;
2715	BPFD_UNLOCK(bd);
2716	}
2717	BPFIF_RUNLOCK(bp);
2718	}
2719	BPF_UNLOCK();
2720	}
2721
2722	/*
2723	* Fill filter statistics
2724	*/
2725	static void
2726	bpfstats_fill_xbpf(struct xbpf_d d, struct bpf_d bd)
2727	{
2728
2729	bzero(d, sizeof(*d));
2730	BPFD_LOCK_ASSERT(bd);
2731	d->bd_structsize = sizeof(*d);
2732	/* XXX: reading should be protected by global lock */
2733	d->bd_immediate = bd->bd_immediate;
2734	d->bd_promisc = bd->bd_promisc;
2735	d->bd_hdrcmplt = bd->bd_hdrcmplt;
2736	d->bd_direction = bd->bd_direction;
2737	d->bd_feedback = bd->bd_feedback;
2738	d->bd_async = bd->bd_async;
2739	d->bd_rcount = bd->bd_rcount;
2740	d->bd_dcount = bd->bd_dcount;
2741	d->bd_fcount = bd->bd_fcount;
2742	d->bd_sig = bd->bd_sig;
2743	d->bd_slen = bd->bd_slen;
2744	d->bd_hlen = bd->bd_hlen;
2745	d->bd_bufsize = bd->bd_bufsize;
2746	d->bd_pid = bd->bd_pid;
2747	strlcpy(d->bd_ifname,
2748	bd->bd_bif->bif_ifp->if_xname, IFNAMSIZ);
2749	d->bd_locked = bd->bd_locked;
2750	d->bd_wcount = bd->bd_wcount;
2751	d->bd_wdcount = bd->bd_wdcount;
2752	d->bd_wfcount = bd->bd_wfcount;
2753	d->bd_zcopy = bd->bd_zcopy;
2754	d->bd_bufmode = bd->bd_bufmode;
2755	}
2756
2757	/*
2758	* Handle `netstat -B' stats request
2759	*/
2760	static int
2761	bpf_stats_sysctl(SYSCTL_HANDLER_ARGS)
2762	{
2763	struct xbpf_d xbdbuf, xbd, zerostats;
2764	int index, error;
2765	struct bpf_if *bp;
2766	struct bpf_d *bd;
2767
2768	/*
2769	* XXX This is not technically correct. It is possible for non
2770	* privileged users to open bpf devices. It would make sense
2771	* if the users who opened the devices were able to retrieve
2772	* the statistics for them, too.
2773	*/
2774	error = priv_check(req->td, PRIV_NET_BPF);
2775	if (error)
2776	return (error);
2777	/*
2778	* Check to see if the user is requesting that the counters be
2779	* zeroed out. Explicitly check that the supplied data is zeroed,
2780	* as we aren't allowing the user to set the counters currently.
2781	*/
2782	if (req->newptr != NULL) {
2783	if (req->newlen != sizeof(zerostats))
2784	return (EINVAL);
2785	bzero(&zerostats, sizeof(zerostats));
2786	xbd = req->newptr;
2787	if (bcmp(xbd, &zerostats, sizeof(*xbd)) != 0)
2788	return (EINVAL);
2789	bpf_zero_counters();
2790	return (0);
2791	}
2792	if (req->oldptr == NULL)
2793	return (SYSCTL_OUT(req, 0, bpf_bpfd_cnt * sizeof(*xbd)));
2794	if (bpf_bpfd_cnt == 0)
2795	return (SYSCTL_OUT(req, 0, 0));
2796	xbdbuf = malloc(req->oldlen, M_BPF, M_WAITOK);
2797	BPF_LOCK();
2798	if (req->oldlen < (bpf_bpfd_cnt * sizeof(*xbd))) {
2799	BPF_UNLOCK();
2800	free(xbdbuf, M_BPF);
2801	return (ENOMEM);
2802	}
2803	index = 0;
2804	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
2805	BPFIF_RLOCK(bp);
2806	/* Send writers-only first */
2807	LIST_FOREACH(bd, &bp->bif_wlist, bd_next) {
2808	xbd = &xbdbuf[index++];
2809	BPFD_LOCK(bd);
2810	bpfstats_fill_xbpf(xbd, bd);
2811	BPFD_UNLOCK(bd);
2812	}
2813	LIST_FOREACH(bd, &bp->bif_dlist, bd_next) {
2814	xbd = &xbdbuf[index++];
2815	BPFD_LOCK(bd);
2816	bpfstats_fill_xbpf(xbd, bd);
2817	BPFD_UNLOCK(bd);
2818	}
2819	BPFIF_RUNLOCK(bp);
2820	}
2821	BPF_UNLOCK();
2822	error = SYSCTL_OUT(req, xbdbuf, index * sizeof(*xbd));
2823	free(xbdbuf, M_BPF);
2824	return (error);
2825	}
2826
2827	SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL);
2828
2829	#else /* !DEV_BPF && !NETGRAPH_BPF */
2830	/*
2831	* NOP stubs to allow bpf-using drivers to load and function.
2832	*
2833	* A 'better' implementation would allow the core bpf functionality
2834	* to be loaded at runtime.
2835	*/
2836	static struct bpf_if bp_null;
2837
2838	void
2839	bpf_tap(struct bpf_if bp, u_char pkt, u_int pktlen)
2840	{
2841	}
2842
2843	void
2844	bpf_mtap(struct bpf_if bp, struct mbuf m)
2845	{
2846	}
2847
2848	void
2849	bpf_mtap2(struct bpf_if bp, void d, u_int l, struct mbuf *m)
2850	{
2851	}
2852
2853	void
2854	bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
2855	{
2856
2857	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
2858	}
2859
2860	void
2861	bpfattach2(struct ifnet ifp, u_int dlt, u_int hdrlen, struct bpf_if *driverp)
2862	{
2863
2864	*driverp = &bp_null;
2865	}
2866
2867	void
2868	bpfdetach(struct ifnet *ifp)
2869	{
2870	}
2871
2872	u_int
2873	bpf_filter(const struct bpf_insn pc, u_char p, u_int wirelen, u_int buflen)
2874	{
2875	return -1; /* "no filter" behaviour */
2876	}
2877
2878	int
2879	bpf_validate(const struct bpf_insn *f, int len)
2880	{
2881	return 0; /* false */
2882	}
2883
2884	#endif /* !DEV_BPF && !NETGRAPH_BPF */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: