The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/bpf.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1990, 1991, 1993
    3  *      The Regents of the University of California.  All rights reserved.
    4  *
    5  * This code is derived from the Stanford/CMU enet packet filter,
    6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
    7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
    8  * Berkeley Laboratory.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  * 4. Neither the name of the University nor the names of its contributors
   19  *    may be used to endorse or promote products derived from this software
   20  *    without specific prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  *
   34  *      @(#)bpf.c       8.4 (Berkeley) 1/9/95
   35  */
   36 
   37 #include <sys/cdefs.h>
   38 __FBSDID("$FreeBSD: releng/8.1/sys/net/bpf.c 207815 2010-05-09 12:36:51Z kib $");
   39 
   40 #include "opt_bpf.h"
   41 #include "opt_compat.h"
   42 #include "opt_netgraph.h"
   43 
   44 #include <sys/types.h>
   45 #include <sys/param.h>
   46 #include <sys/systm.h>
   47 #include <sys/conf.h>
   48 #include <sys/fcntl.h>
   49 #include <sys/jail.h>
   50 #include <sys/malloc.h>
   51 #include <sys/mbuf.h>
   52 #include <sys/time.h>
   53 #include <sys/priv.h>
   54 #include <sys/proc.h>
   55 #include <sys/signalvar.h>
   56 #include <sys/filio.h>
   57 #include <sys/sockio.h>
   58 #include <sys/ttycom.h>
   59 #include <sys/uio.h>
   60 
   61 #include <sys/event.h>
   62 #include <sys/file.h>
   63 #include <sys/poll.h>
   64 #include <sys/proc.h>
   65 
   66 #include <sys/socket.h>
   67 
   68 #include <net/if.h>
   69 #include <net/bpf.h>
   70 #include <net/bpf_buffer.h>
   71 #ifdef BPF_JITTER
   72 #include <net/bpf_jitter.h>
   73 #endif
   74 #include <net/bpf_zerocopy.h>
   75 #include <net/bpfdesc.h>
   76 #include <net/vnet.h>
   77 
   78 #include <netinet/in.h>
   79 #include <netinet/if_ether.h>
   80 #include <sys/kernel.h>
   81 #include <sys/sysctl.h>
   82 
   83 #include <net80211/ieee80211_freebsd.h>
   84 
   85 #include <security/mac/mac_framework.h>
   86 
   87 MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
   88 
   89 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)
   90 
   91 #define PRINET  26                      /* interruptible */
   92 
   93 #ifdef COMPAT_FREEBSD32
   94 #include <sys/mount.h>
   95 #include <compat/freebsd32/freebsd32.h>
   96 #define BPF_ALIGNMENT32 sizeof(int32_t)
   97 #define BPF_WORDALIGN32(x) (((x)+(BPF_ALIGNMENT32-1))&~(BPF_ALIGNMENT32-1))
   98 
   99 /*
  100  * 32-bit version of structure prepended to each packet.  We use this header
  101  * instead of the standard one for 32-bit streams.  We mark the a stream as
  102  * 32-bit the first time we see a 32-bit compat ioctl request.
  103  */
  104 struct bpf_hdr32 {
  105         struct timeval32 bh_tstamp;     /* time stamp */
  106         uint32_t        bh_caplen;      /* length of captured portion */
  107         uint32_t        bh_datalen;     /* original length of packet */
  108         uint16_t        bh_hdrlen;      /* length of bpf header (this struct
  109                                            plus alignment padding) */
  110 };
  111 
  112 struct bpf_program32 {
  113         u_int bf_len;
  114         uint32_t bf_insns;
  115 };
  116 
  117 struct bpf_dltlist32 {
  118         u_int   bfl_len;
  119         u_int   bfl_list;
  120 };
  121 
  122 #define BIOCSETF32      _IOW('B', 103, struct bpf_program32)
  123 #define BIOCSRTIMEOUT32 _IOW('B',109, struct timeval32)
  124 #define BIOCGRTIMEOUT32 _IOR('B',110, struct timeval32)
  125 #define BIOCGDLTLIST32  _IOWR('B',121, struct bpf_dltlist32)
  126 #define BIOCSETWF32     _IOW('B',123, struct bpf_program32)
  127 #define BIOCSETFNR32    _IOW('B',130, struct bpf_program32)
  128 #endif
  129 
  130 /*
  131  * bpf_iflist is a list of BPF interface structures, each corresponding to a
  132  * specific DLT.  The same network interface might have several BPF interface
  133  * structures registered by different layers in the stack (i.e., 802.11
  134  * frames, ethernet frames, etc).
  135  */
  136 static LIST_HEAD(, bpf_if)      bpf_iflist;
  137 static struct mtx       bpf_mtx;                /* bpf global lock */
  138 static int              bpf_bpfd_cnt;
  139 
  140 static void     bpf_attachd(struct bpf_d *, struct bpf_if *);
  141 static void     bpf_detachd(struct bpf_d *);
  142 static void     bpf_freed(struct bpf_d *);
  143 static int      bpf_movein(struct uio *, int, struct ifnet *, struct mbuf **,
  144                     struct sockaddr *, int *, struct bpf_insn *);
  145 static int      bpf_setif(struct bpf_d *, struct ifreq *);
  146 static void     bpf_timed_out(void *);
  147 static __inline void
  148                 bpf_wakeup(struct bpf_d *);
  149 static void     catchpacket(struct bpf_d *, u_char *, u_int, u_int,
  150                     void (*)(struct bpf_d *, caddr_t, u_int, void *, u_int),
  151                     struct timeval *);
  152 static void     reset_d(struct bpf_d *);
  153 static int       bpf_setf(struct bpf_d *, struct bpf_program *, u_long cmd);
  154 static int      bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
  155 static int      bpf_setdlt(struct bpf_d *, u_int);
  156 static void     filt_bpfdetach(struct knote *);
  157 static int      filt_bpfread(struct knote *, long);
  158 static void     bpf_drvinit(void *);
  159 static int      bpf_stats_sysctl(SYSCTL_HANDLER_ARGS);
  160 
  161 SYSCTL_NODE(_net, OID_AUTO, bpf, CTLFLAG_RW, 0, "bpf sysctl");
  162 int bpf_maxinsns = BPF_MAXINSNS;
  163 SYSCTL_INT(_net_bpf, OID_AUTO, maxinsns, CTLFLAG_RW,
  164     &bpf_maxinsns, 0, "Maximum bpf program instructions");
  165 static int bpf_zerocopy_enable = 0;
  166 SYSCTL_INT(_net_bpf, OID_AUTO, zerocopy_enable, CTLFLAG_RW,
  167     &bpf_zerocopy_enable, 0, "Enable new zero-copy BPF buffer sessions");
  168 SYSCTL_NODE(_net_bpf, OID_AUTO, stats, CTLFLAG_MPSAFE | CTLFLAG_RW,
  169     bpf_stats_sysctl, "bpf statistics portal");
  170 
  171 static  d_open_t        bpfopen;
  172 static  d_read_t        bpfread;
  173 static  d_write_t       bpfwrite;
  174 static  d_ioctl_t       bpfioctl;
  175 static  d_poll_t        bpfpoll;
  176 static  d_kqfilter_t    bpfkqfilter;
  177 
  178 static struct cdevsw bpf_cdevsw = {
  179         .d_version =    D_VERSION,
  180         .d_open =       bpfopen,
  181         .d_read =       bpfread,
  182         .d_write =      bpfwrite,
  183         .d_ioctl =      bpfioctl,
  184         .d_poll =       bpfpoll,
  185         .d_name =       "bpf",
  186         .d_kqfilter =   bpfkqfilter,
  187 };
  188 
  189 static struct filterops bpfread_filtops =
  190         { 1, NULL, filt_bpfdetach, filt_bpfread };
  191 
  192 /*
  193  * Wrapper functions for various buffering methods.  If the set of buffer
  194  * modes expands, we will probably want to introduce a switch data structure
  195  * similar to protosw, et.
  196  */
  197 static void
  198 bpf_append_bytes(struct bpf_d *d, caddr_t buf, u_int offset, void *src,
  199     u_int len)
  200 {
  201 
  202         BPFD_LOCK_ASSERT(d);
  203 
  204         switch (d->bd_bufmode) {
  205         case BPF_BUFMODE_BUFFER:
  206                 return (bpf_buffer_append_bytes(d, buf, offset, src, len));
  207 
  208         case BPF_BUFMODE_ZBUF:
  209                 d->bd_zcopy++;
  210                 return (bpf_zerocopy_append_bytes(d, buf, offset, src, len));
  211 
  212         default:
  213                 panic("bpf_buf_append_bytes");
  214         }
  215 }
  216 
  217 static void
  218 bpf_append_mbuf(struct bpf_d *d, caddr_t buf, u_int offset, void *src,
  219     u_int len)
  220 {
  221 
  222         BPFD_LOCK_ASSERT(d);
  223 
  224         switch (d->bd_bufmode) {
  225         case BPF_BUFMODE_BUFFER:
  226                 return (bpf_buffer_append_mbuf(d, buf, offset, src, len));
  227 
  228         case BPF_BUFMODE_ZBUF:
  229                 d->bd_zcopy++;
  230                 return (bpf_zerocopy_append_mbuf(d, buf, offset, src, len));
  231 
  232         default:
  233                 panic("bpf_buf_append_mbuf");
  234         }
  235 }
  236 
  237 /*
  238  * This function gets called when the free buffer is re-assigned.
  239  */
  240 static void
  241 bpf_buf_reclaimed(struct bpf_d *d)
  242 {
  243 
  244         BPFD_LOCK_ASSERT(d);
  245 
  246         switch (d->bd_bufmode) {
  247         case BPF_BUFMODE_BUFFER:
  248                 return;
  249 
  250         case BPF_BUFMODE_ZBUF:
  251                 bpf_zerocopy_buf_reclaimed(d);
  252                 return;
  253 
  254         default:
  255                 panic("bpf_buf_reclaimed");
  256         }
  257 }
  258 
  259 /*
  260  * If the buffer mechanism has a way to decide that a held buffer can be made
  261  * free, then it is exposed via the bpf_canfreebuf() interface.  (1) is
  262  * returned if the buffer can be discarded, (0) is returned if it cannot.
  263  */
  264 static int
  265 bpf_canfreebuf(struct bpf_d *d)
  266 {
  267 
  268         BPFD_LOCK_ASSERT(d);
  269 
  270         switch (d->bd_bufmode) {
  271         case BPF_BUFMODE_ZBUF:
  272                 return (bpf_zerocopy_canfreebuf(d));
  273         }
  274         return (0);
  275 }
  276 
  277 /*
  278  * Allow the buffer model to indicate that the current store buffer is
  279  * immutable, regardless of the appearance of space.  Return (1) if the
  280  * buffer is writable, and (0) if not.
  281  */
  282 static int
  283 bpf_canwritebuf(struct bpf_d *d)
  284 {
  285 
  286         BPFD_LOCK_ASSERT(d);
  287 
  288         switch (d->bd_bufmode) {
  289         case BPF_BUFMODE_ZBUF:
  290                 return (bpf_zerocopy_canwritebuf(d));
  291         }
  292         return (1);
  293 }
  294 
  295 /*
  296  * Notify buffer model that an attempt to write to the store buffer has
  297  * resulted in a dropped packet, in which case the buffer may be considered
  298  * full.
  299  */
  300 static void
  301 bpf_buffull(struct bpf_d *d)
  302 {
  303 
  304         BPFD_LOCK_ASSERT(d);
  305 
  306         switch (d->bd_bufmode) {
  307         case BPF_BUFMODE_ZBUF:
  308                 bpf_zerocopy_buffull(d);
  309                 break;
  310         }
  311 }
  312 
  313 /*
  314  * Notify the buffer model that a buffer has moved into the hold position.
  315  */
  316 void
  317 bpf_bufheld(struct bpf_d *d)
  318 {
  319 
  320         BPFD_LOCK_ASSERT(d);
  321 
  322         switch (d->bd_bufmode) {
  323         case BPF_BUFMODE_ZBUF:
  324                 bpf_zerocopy_bufheld(d);
  325                 break;
  326         }
  327 }
  328 
  329 static void
  330 bpf_free(struct bpf_d *d)
  331 {
  332 
  333         switch (d->bd_bufmode) {
  334         case BPF_BUFMODE_BUFFER:
  335                 return (bpf_buffer_free(d));
  336 
  337         case BPF_BUFMODE_ZBUF:
  338                 return (bpf_zerocopy_free(d));
  339 
  340         default:
  341                 panic("bpf_buf_free");
  342         }
  343 }
  344 
  345 static int
  346 bpf_uiomove(struct bpf_d *d, caddr_t buf, u_int len, struct uio *uio)
  347 {
  348 
  349         if (d->bd_bufmode != BPF_BUFMODE_BUFFER)
  350                 return (EOPNOTSUPP);
  351         return (bpf_buffer_uiomove(d, buf, len, uio));
  352 }
  353 
  354 static int
  355 bpf_ioctl_sblen(struct bpf_d *d, u_int *i)
  356 {
  357 
  358         if (d->bd_bufmode != BPF_BUFMODE_BUFFER)
  359                 return (EOPNOTSUPP);
  360         return (bpf_buffer_ioctl_sblen(d, i));
  361 }
  362 
  363 static int
  364 bpf_ioctl_getzmax(struct thread *td, struct bpf_d *d, size_t *i)
  365 {
  366 
  367         if (d->bd_bufmode != BPF_BUFMODE_ZBUF)
  368                 return (EOPNOTSUPP);
  369         return (bpf_zerocopy_ioctl_getzmax(td, d, i));
  370 }
  371 
  372 static int
  373 bpf_ioctl_rotzbuf(struct thread *td, struct bpf_d *d, struct bpf_zbuf *bz)
  374 {
  375 
  376         if (d->bd_bufmode != BPF_BUFMODE_ZBUF)
  377                 return (EOPNOTSUPP);
  378         return (bpf_zerocopy_ioctl_rotzbuf(td, d, bz));
  379 }
  380 
  381 static int
  382 bpf_ioctl_setzbuf(struct thread *td, struct bpf_d *d, struct bpf_zbuf *bz)
  383 {
  384 
  385         if (d->bd_bufmode != BPF_BUFMODE_ZBUF)
  386                 return (EOPNOTSUPP);
  387         return (bpf_zerocopy_ioctl_setzbuf(td, d, bz));
  388 }
  389 
  390 /*
  391  * General BPF functions.
  392  */
  393 static int
  394 bpf_movein(struct uio *uio, int linktype, struct ifnet *ifp, struct mbuf **mp,
  395     struct sockaddr *sockp, int *hdrlen, struct bpf_insn *wfilter)
  396 {
  397         const struct ieee80211_bpf_params *p;
  398         struct ether_header *eh;
  399         struct mbuf *m;
  400         int error;
  401         int len;
  402         int hlen;
  403         int slen;
  404 
  405         /*
  406          * Build a sockaddr based on the data link layer type.
  407          * We do this at this level because the ethernet header
  408          * is copied directly into the data field of the sockaddr.
  409          * In the case of SLIP, there is no header and the packet
  410          * is forwarded as is.
  411          * Also, we are careful to leave room at the front of the mbuf
  412          * for the link level header.
  413          */
  414         switch (linktype) {
  415 
  416         case DLT_SLIP:
  417                 sockp->sa_family = AF_INET;
  418                 hlen = 0;
  419                 break;
  420 
  421         case DLT_EN10MB:
  422                 sockp->sa_family = AF_UNSPEC;
  423                 /* XXX Would MAXLINKHDR be better? */
  424                 hlen = ETHER_HDR_LEN;
  425                 break;
  426 
  427         case DLT_FDDI:
  428                 sockp->sa_family = AF_IMPLINK;
  429                 hlen = 0;
  430                 break;
  431 
  432         case DLT_RAW:
  433                 sockp->sa_family = AF_UNSPEC;
  434                 hlen = 0;
  435                 break;
  436 
  437         case DLT_NULL:
  438                 /*
  439                  * null interface types require a 4 byte pseudo header which
  440                  * corresponds to the address family of the packet.
  441                  */
  442                 sockp->sa_family = AF_UNSPEC;
  443                 hlen = 4;
  444                 break;
  445 
  446         case DLT_ATM_RFC1483:
  447                 /*
  448                  * en atm driver requires 4-byte atm pseudo header.
  449                  * though it isn't standard, vpi:vci needs to be
  450                  * specified anyway.
  451                  */
  452                 sockp->sa_family = AF_UNSPEC;
  453                 hlen = 12;      /* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
  454                 break;
  455 
  456         case DLT_PPP:
  457                 sockp->sa_family = AF_UNSPEC;
  458                 hlen = 4;       /* This should match PPP_HDRLEN */
  459                 break;
  460 
  461         case DLT_IEEE802_11:            /* IEEE 802.11 wireless */
  462                 sockp->sa_family = AF_IEEE80211;
  463                 hlen = 0;
  464                 break;
  465 
  466         case DLT_IEEE802_11_RADIO:      /* IEEE 802.11 wireless w/ phy params */
  467                 sockp->sa_family = AF_IEEE80211;
  468                 sockp->sa_len = 12;     /* XXX != 0 */
  469                 hlen = sizeof(struct ieee80211_bpf_params);
  470                 break;
  471 
  472         default:
  473                 return (EIO);
  474         }
  475 
  476         len = uio->uio_resid;
  477 
  478         if (len - hlen > ifp->if_mtu)
  479                 return (EMSGSIZE);
  480 
  481         if ((unsigned)len > MJUM16BYTES)
  482                 return (EIO);
  483 
  484         if (len <= MHLEN)
  485                 MGETHDR(m, M_WAIT, MT_DATA);
  486         else if (len <= MCLBYTES)
  487                 m = m_getcl(M_WAIT, MT_DATA, M_PKTHDR);
  488         else
  489                 m = m_getjcl(M_WAIT, MT_DATA, M_PKTHDR,
  490 #if (MJUMPAGESIZE > MCLBYTES)
  491                     len <= MJUMPAGESIZE ? MJUMPAGESIZE :
  492 #endif
  493                     (len <= MJUM9BYTES ? MJUM9BYTES : MJUM16BYTES));
  494         m->m_pkthdr.len = m->m_len = len;
  495         m->m_pkthdr.rcvif = NULL;
  496         *mp = m;
  497 
  498         if (m->m_len < hlen) {
  499                 error = EPERM;
  500                 goto bad;
  501         }
  502 
  503         error = uiomove(mtod(m, u_char *), len, uio);
  504         if (error)
  505                 goto bad;
  506 
  507         slen = bpf_filter(wfilter, mtod(m, u_char *), len, len);
  508         if (slen == 0) {
  509                 error = EPERM;
  510                 goto bad;
  511         }
  512 
  513         /* Check for multicast destination */
  514         switch (linktype) {
  515         case DLT_EN10MB:
  516                 eh = mtod(m, struct ether_header *);
  517                 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
  518                         if (bcmp(ifp->if_broadcastaddr, eh->ether_dhost,
  519                             ETHER_ADDR_LEN) == 0)
  520                                 m->m_flags |= M_BCAST;
  521                         else
  522                                 m->m_flags |= M_MCAST;
  523                 }
  524                 break;
  525         }
  526 
  527         /*
  528          * Make room for link header, and copy it to sockaddr
  529          */
  530         if (hlen != 0) {
  531                 if (sockp->sa_family == AF_IEEE80211) {
  532                         /*
  533                          * Collect true length from the parameter header
  534                          * NB: sockp is known to be zero'd so if we do a
  535                          *     short copy unspecified parameters will be
  536                          *     zero.
  537                          * NB: packet may not be aligned after stripping
  538                          *     bpf params
  539                          * XXX check ibp_vers
  540                          */
  541                         p = mtod(m, const struct ieee80211_bpf_params *);
  542                         hlen = p->ibp_len;
  543                         if (hlen > sizeof(sockp->sa_data)) {
  544                                 error = EINVAL;
  545                                 goto bad;
  546                         }
  547                 }
  548                 bcopy(m->m_data, sockp->sa_data, hlen);
  549         }
  550         *hdrlen = hlen;
  551 
  552         return (0);
  553 bad:
  554         m_freem(m);
  555         return (error);
  556 }
  557 
  558 /*
  559  * Attach file to the bpf interface, i.e. make d listen on bp.
  560  */
  561 static void
  562 bpf_attachd(struct bpf_d *d, struct bpf_if *bp)
  563 {
  564         /*
  565          * Point d at bp, and add d to the interface's list of listeners.
  566          * Finally, point the driver's bpf cookie at the interface so
  567          * it will divert packets to bpf.
  568          */
  569         BPFIF_LOCK(bp);
  570         d->bd_bif = bp;
  571         LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
  572 
  573         bpf_bpfd_cnt++;
  574         BPFIF_UNLOCK(bp);
  575 
  576         EVENTHANDLER_INVOKE(bpf_track, bp->bif_ifp, bp->bif_dlt, 1);
  577 }
  578 
  579 /*
  580  * Detach a file from its interface.
  581  */
  582 static void
  583 bpf_detachd(struct bpf_d *d)
  584 {
  585         int error;
  586         struct bpf_if *bp;
  587         struct ifnet *ifp;
  588 
  589         bp = d->bd_bif;
  590         BPFIF_LOCK(bp);
  591         BPFD_LOCK(d);
  592         ifp = d->bd_bif->bif_ifp;
  593 
  594         /*
  595          * Remove d from the interface's descriptor list.
  596          */
  597         LIST_REMOVE(d, bd_next);
  598 
  599         bpf_bpfd_cnt--;
  600         d->bd_bif = NULL;
  601         BPFD_UNLOCK(d);
  602         BPFIF_UNLOCK(bp);
  603 
  604         EVENTHANDLER_INVOKE(bpf_track, ifp, bp->bif_dlt, 0);
  605 
  606         /*
  607          * Check if this descriptor had requested promiscuous mode.
  608          * If so, turn it off.
  609          */
  610         if (d->bd_promisc) {
  611                 d->bd_promisc = 0;
  612                 CURVNET_SET(ifp->if_vnet);
  613                 error = ifpromisc(ifp, 0);
  614                 CURVNET_RESTORE();
  615                 if (error != 0 && error != ENXIO) {
  616                         /*
  617                          * ENXIO can happen if a pccard is unplugged
  618                          * Something is really wrong if we were able to put
  619                          * the driver into promiscuous mode, but can't
  620                          * take it out.
  621                          */
  622                         if_printf(bp->bif_ifp,
  623                                 "bpf_detach: ifpromisc failed (%d)\n", error);
  624                 }
  625         }
  626 }
  627 
  628 /*
  629  * Close the descriptor by detaching it from its interface,
  630  * deallocating its buffers, and marking it free.
  631  */
  632 static void
  633 bpf_dtor(void *data)
  634 {
  635         struct bpf_d *d = data;
  636 
  637         BPFD_LOCK(d);
  638         if (d->bd_state == BPF_WAITING)
  639                 callout_stop(&d->bd_callout);
  640         d->bd_state = BPF_IDLE;
  641         BPFD_UNLOCK(d);
  642         funsetown(&d->bd_sigio);
  643         mtx_lock(&bpf_mtx);
  644         if (d->bd_bif)
  645                 bpf_detachd(d);
  646         mtx_unlock(&bpf_mtx);
  647         selwakeuppri(&d->bd_sel, PRINET);
  648 #ifdef MAC
  649         mac_bpfdesc_destroy(d);
  650 #endif /* MAC */
  651         knlist_destroy(&d->bd_sel.si_note);
  652         callout_drain(&d->bd_callout);
  653         bpf_freed(d);
  654         free(d, M_BPF);
  655 }
  656 
  657 /*
  658  * Open ethernet device.  Returns ENXIO for illegal minor device number,
  659  * EBUSY if file is open by another process.
  660  */
  661 /* ARGSUSED */
  662 static  int
  663 bpfopen(struct cdev *dev, int flags, int fmt, struct thread *td)
  664 {
  665         struct bpf_d *d;
  666         int error;
  667 
  668         d = malloc(sizeof(*d), M_BPF, M_WAITOK | M_ZERO);
  669         error = devfs_set_cdevpriv(d, bpf_dtor);
  670         if (error != 0) {
  671                 free(d, M_BPF);
  672                 return (error);
  673         }
  674 
  675         /*
  676          * For historical reasons, perform a one-time initialization call to
  677          * the buffer routines, even though we're not yet committed to a
  678          * particular buffer method.
  679          */
  680         bpf_buffer_init(d);
  681         d->bd_bufmode = BPF_BUFMODE_BUFFER;
  682         d->bd_sig = SIGIO;
  683         d->bd_direction = BPF_D_INOUT;
  684         d->bd_pid = td->td_proc->p_pid;
  685 #ifdef MAC
  686         mac_bpfdesc_init(d);
  687         mac_bpfdesc_create(td->td_ucred, d);
  688 #endif
  689         mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
  690         callout_init_mtx(&d->bd_callout, &d->bd_mtx, 0);
  691         knlist_init_mtx(&d->bd_sel.si_note, &d->bd_mtx);
  692 
  693         return (0);
  694 }
  695 
  696 /*
  697  *  bpfread - read next chunk of packets from buffers
  698  */
  699 static  int
  700 bpfread(struct cdev *dev, struct uio *uio, int ioflag)
  701 {
  702         struct bpf_d *d;
  703         int error;
  704         int non_block;
  705         int timed_out;
  706 
  707         error = devfs_get_cdevpriv((void **)&d);
  708         if (error != 0)
  709                 return (error);
  710 
  711         /*
  712          * Restrict application to use a buffer the same size as
  713          * as kernel buffers.
  714          */
  715         if (uio->uio_resid != d->bd_bufsize)
  716                 return (EINVAL);
  717 
  718         non_block = ((ioflag & O_NONBLOCK) != 0);
  719 
  720         BPFD_LOCK(d);
  721         d->bd_pid = curthread->td_proc->p_pid;
  722         if (d->bd_bufmode != BPF_BUFMODE_BUFFER) {
  723                 BPFD_UNLOCK(d);
  724                 return (EOPNOTSUPP);
  725         }
  726         if (d->bd_state == BPF_WAITING)
  727                 callout_stop(&d->bd_callout);
  728         timed_out = (d->bd_state == BPF_TIMED_OUT);
  729         d->bd_state = BPF_IDLE;
  730         /*
  731          * If the hold buffer is empty, then do a timed sleep, which
  732          * ends when the timeout expires or when enough packets
  733          * have arrived to fill the store buffer.
  734          */
  735         while (d->bd_hbuf == NULL) {
  736                 if (d->bd_slen != 0) {
  737                         /*
  738                          * A packet(s) either arrived since the previous
  739                          * read or arrived while we were asleep.
  740                          */
  741                         if (d->bd_immediate || non_block || timed_out) {
  742                                 /*
  743                                  * Rotate the buffers and return what's here
  744                                  * if we are in immediate mode, non-blocking
  745                                  * flag is set, or this descriptor timed out.
  746                                  */
  747                                 ROTATE_BUFFERS(d);
  748                                 break;
  749                         }
  750                 }
  751 
  752                 /*
  753                  * No data is available, check to see if the bpf device
  754                  * is still pointed at a real interface.  If not, return
  755                  * ENXIO so that the userland process knows to rebind
  756                  * it before using it again.
  757                  */
  758                 if (d->bd_bif == NULL) {
  759                         BPFD_UNLOCK(d);
  760                         return (ENXIO);
  761                 }
  762 
  763                 if (non_block) {
  764                         BPFD_UNLOCK(d);
  765                         return (EWOULDBLOCK);
  766                 }
  767                 error = msleep(d, &d->bd_mtx, PRINET|PCATCH,
  768                      "bpf", d->bd_rtout);
  769                 if (error == EINTR || error == ERESTART) {
  770                         BPFD_UNLOCK(d);
  771                         return (error);
  772                 }
  773                 if (error == EWOULDBLOCK) {
  774                         /*
  775                          * On a timeout, return what's in the buffer,
  776                          * which may be nothing.  If there is something
  777                          * in the store buffer, we can rotate the buffers.
  778                          */
  779                         if (d->bd_hbuf)
  780                                 /*
  781                                  * We filled up the buffer in between
  782                                  * getting the timeout and arriving
  783                                  * here, so we don't need to rotate.
  784                                  */
  785                                 break;
  786 
  787                         if (d->bd_slen == 0) {
  788                                 BPFD_UNLOCK(d);
  789                                 return (0);
  790                         }
  791                         ROTATE_BUFFERS(d);
  792                         break;
  793                 }
  794         }
  795         /*
  796          * At this point, we know we have something in the hold slot.
  797          */
  798         BPFD_UNLOCK(d);
  799 
  800         /*
  801          * Move data from hold buffer into user space.
  802          * We know the entire buffer is transferred since
  803          * we checked above that the read buffer is bpf_bufsize bytes.
  804          *
  805          * XXXRW: More synchronization needed here: what if a second thread
  806          * issues a read on the same fd at the same time?  Don't want this
  807          * getting invalidated.
  808          */
  809         error = bpf_uiomove(d, d->bd_hbuf, d->bd_hlen, uio);
  810 
  811         BPFD_LOCK(d);
  812         d->bd_fbuf = d->bd_hbuf;
  813         d->bd_hbuf = NULL;
  814         d->bd_hlen = 0;
  815         bpf_buf_reclaimed(d);
  816         BPFD_UNLOCK(d);
  817 
  818         return (error);
  819 }
  820 
  821 /*
  822  * If there are processes sleeping on this descriptor, wake them up.
  823  */
  824 static __inline void
  825 bpf_wakeup(struct bpf_d *d)
  826 {
  827 
  828         BPFD_LOCK_ASSERT(d);
  829         if (d->bd_state == BPF_WAITING) {
  830                 callout_stop(&d->bd_callout);
  831                 d->bd_state = BPF_IDLE;
  832         }
  833         wakeup(d);
  834         if (d->bd_async && d->bd_sig && d->bd_sigio)
  835                 pgsigio(&d->bd_sigio, d->bd_sig, 0);
  836 
  837         selwakeuppri(&d->bd_sel, PRINET);
  838         KNOTE_LOCKED(&d->bd_sel.si_note, 0);
  839 }
  840 
  841 static void
  842 bpf_timed_out(void *arg)
  843 {
  844         struct bpf_d *d = (struct bpf_d *)arg;
  845 
  846         BPFD_LOCK_ASSERT(d);
  847 
  848         if (callout_pending(&d->bd_callout) || !callout_active(&d->bd_callout))
  849                 return;
  850         if (d->bd_state == BPF_WAITING) {
  851                 d->bd_state = BPF_TIMED_OUT;
  852                 if (d->bd_slen != 0)
  853                         bpf_wakeup(d);
  854         }
  855 }
  856 
  857 static int
  858 bpf_ready(struct bpf_d *d)
  859 {
  860 
  861         BPFD_LOCK_ASSERT(d);
  862 
  863         if (!bpf_canfreebuf(d) && d->bd_hlen != 0)
  864                 return (1);
  865         if ((d->bd_immediate || d->bd_state == BPF_TIMED_OUT) &&
  866             d->bd_slen != 0)
  867                 return (1);
  868         return (0);
  869 }
  870 
  871 static int
  872 bpfwrite(struct cdev *dev, struct uio *uio, int ioflag)
  873 {
  874         struct bpf_d *d;
  875         struct ifnet *ifp;
  876         struct mbuf *m, *mc;
  877         struct sockaddr dst;
  878         int error, hlen;
  879 
  880         error = devfs_get_cdevpriv((void **)&d);
  881         if (error != 0)
  882                 return (error);
  883 
  884         d->bd_pid = curthread->td_proc->p_pid;
  885         d->bd_wcount++;
  886         if (d->bd_bif == NULL) {
  887                 d->bd_wdcount++;
  888                 return (ENXIO);
  889         }
  890 
  891         ifp = d->bd_bif->bif_ifp;
  892 
  893         if ((ifp->if_flags & IFF_UP) == 0) {
  894                 d->bd_wdcount++;
  895                 return (ENETDOWN);
  896         }
  897 
  898         if (uio->uio_resid == 0) {
  899                 d->bd_wdcount++;
  900                 return (0);
  901         }
  902 
  903         bzero(&dst, sizeof(dst));
  904         m = NULL;
  905         hlen = 0;
  906         error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp,
  907             &m, &dst, &hlen, d->bd_wfilter);
  908         if (error) {
  909                 d->bd_wdcount++;
  910                 return (error);
  911         }
  912         d->bd_wfcount++;
  913         if (d->bd_hdrcmplt)
  914                 dst.sa_family = pseudo_AF_HDRCMPLT;
  915 
  916         if (d->bd_feedback) {
  917                 mc = m_dup(m, M_DONTWAIT);
  918                 if (mc != NULL)
  919                         mc->m_pkthdr.rcvif = ifp;
  920                 /* Set M_PROMISC for outgoing packets to be discarded. */
  921                 if (d->bd_direction == BPF_D_INOUT)
  922                         m->m_flags |= M_PROMISC;
  923         } else
  924                 mc = NULL;
  925 
  926         m->m_pkthdr.len -= hlen;
  927         m->m_len -= hlen;
  928         m->m_data += hlen;      /* XXX */
  929 
  930         CURVNET_SET(ifp->if_vnet);
  931 #ifdef MAC
  932         BPFD_LOCK(d);
  933         mac_bpfdesc_create_mbuf(d, m);
  934         if (mc != NULL)
  935                 mac_bpfdesc_create_mbuf(d, mc);
  936         BPFD_UNLOCK(d);
  937 #endif
  938 
  939         error = (*ifp->if_output)(ifp, m, &dst, NULL);
  940         if (error)
  941                 d->bd_wdcount++;
  942 
  943         if (mc != NULL) {
  944                 if (error == 0)
  945                         (*ifp->if_input)(ifp, mc);
  946                 else
  947                         m_freem(mc);
  948         }
  949         CURVNET_RESTORE();
  950 
  951         return (error);
  952 }
  953 
  954 /*
  955  * Reset a descriptor by flushing its packet buffer and clearing the receive
  956  * and drop counts.  This is doable for kernel-only buffers, but with
  957  * zero-copy buffers, we can't write to (or rotate) buffers that are
  958  * currently owned by userspace.  It would be nice if we could encapsulate
  959  * this logic in the buffer code rather than here.
  960  */
  961 static void
  962 reset_d(struct bpf_d *d)
  963 {
  964 
  965         mtx_assert(&d->bd_mtx, MA_OWNED);
  966 
  967         if ((d->bd_hbuf != NULL) &&
  968             (d->bd_bufmode != BPF_BUFMODE_ZBUF || bpf_canfreebuf(d))) {
  969                 /* Free the hold buffer. */
  970                 d->bd_fbuf = d->bd_hbuf;
  971                 d->bd_hbuf = NULL;
  972                 d->bd_hlen = 0;
  973                 bpf_buf_reclaimed(d);
  974         }
  975         if (bpf_canwritebuf(d))
  976                 d->bd_slen = 0;
  977         d->bd_rcount = 0;
  978         d->bd_dcount = 0;
  979         d->bd_fcount = 0;
  980         d->bd_wcount = 0;
  981         d->bd_wfcount = 0;
  982         d->bd_wdcount = 0;
  983         d->bd_zcopy = 0;
  984 }
  985 
  986 /*
  987  *  FIONREAD            Check for read packet available.
  988  *  SIOCGIFADDR         Get interface address - convenient hook to driver.
  989  *  BIOCGBLEN           Get buffer len [for read()].
  990  *  BIOCSETF            Set read filter.
  991  *  BIOCSETFNR          Set read filter without resetting descriptor.
  992  *  BIOCSETWF           Set write filter.
  993  *  BIOCFLUSH           Flush read packet buffer.
  994  *  BIOCPROMISC         Put interface into promiscuous mode.
  995  *  BIOCGDLT            Get link layer type.
  996  *  BIOCGETIF           Get interface name.
  997  *  BIOCSETIF           Set interface.
  998  *  BIOCSRTIMEOUT       Set read timeout.
  999  *  BIOCGRTIMEOUT       Get read timeout.
 1000  *  BIOCGSTATS          Get packet stats.
 1001  *  BIOCIMMEDIATE       Set immediate mode.
 1002  *  BIOCVERSION         Get filter language version.
 1003  *  BIOCGHDRCMPLT       Get "header already complete" flag
 1004  *  BIOCSHDRCMPLT       Set "header already complete" flag
 1005  *  BIOCGDIRECTION      Get packet direction flag
 1006  *  BIOCSDIRECTION      Set packet direction flag
 1007  *  BIOCLOCK            Set "locked" flag
 1008  *  BIOCFEEDBACK        Set packet feedback mode.
 1009  *  BIOCSETZBUF         Set current zero-copy buffer locations.
 1010  *  BIOCGETZMAX         Get maximum zero-copy buffer size.
 1011  *  BIOCROTZBUF         Force rotation of zero-copy buffer
 1012  *  BIOCSETBUFMODE      Set buffer mode.
 1013  *  BIOCGETBUFMODE      Get current buffer mode.
 1014  */
 1015 /* ARGSUSED */
 1016 static  int
 1017 bpfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags,
 1018     struct thread *td)
 1019 {
 1020         struct bpf_d *d;
 1021         int error;
 1022 
 1023         error = devfs_get_cdevpriv((void **)&d);
 1024         if (error != 0)
 1025                 return (error);
 1026 
 1027         /*
 1028          * Refresh PID associated with this descriptor.
 1029          */
 1030         BPFD_LOCK(d);
 1031         d->bd_pid = td->td_proc->p_pid;
 1032         if (d->bd_state == BPF_WAITING)
 1033                 callout_stop(&d->bd_callout);
 1034         d->bd_state = BPF_IDLE;
 1035         BPFD_UNLOCK(d);
 1036 
 1037         if (d->bd_locked == 1) {
 1038                 switch (cmd) {
 1039                 case BIOCGBLEN:
 1040                 case BIOCFLUSH:
 1041                 case BIOCGDLT:
 1042                 case BIOCGDLTLIST:
 1043 #ifdef COMPAT_FREEBSD32
 1044                 case BIOCGDLTLIST32:
 1045 #endif
 1046                 case BIOCGETIF:
 1047                 case BIOCGRTIMEOUT:
 1048 #ifdef COMPAT_FREEBSD32
 1049                 case BIOCGRTIMEOUT32:
 1050 #endif
 1051                 case BIOCGSTATS:
 1052                 case BIOCVERSION:
 1053                 case BIOCGRSIG:
 1054                 case BIOCGHDRCMPLT:
 1055                 case BIOCFEEDBACK:
 1056                 case FIONREAD:
 1057                 case BIOCLOCK:
 1058                 case BIOCSRTIMEOUT:
 1059 #ifdef COMPAT_FREEBSD32
 1060                 case BIOCSRTIMEOUT32:
 1061 #endif
 1062                 case BIOCIMMEDIATE:
 1063                 case TIOCGPGRP:
 1064                 case BIOCROTZBUF:
 1065                         break;
 1066                 default:
 1067                         return (EPERM);
 1068                 }
 1069         }
 1070 #ifdef COMPAT_FREEBSD32
 1071         /*
 1072          * If we see a 32-bit compat ioctl, mark the stream as 32-bit so
 1073          * that it will get 32-bit packet headers.
 1074          */
 1075         switch (cmd) {
 1076         case BIOCSETF32:
 1077         case BIOCSETFNR32:
 1078         case BIOCSETWF32:
 1079         case BIOCGDLTLIST32:
 1080         case BIOCGRTIMEOUT32:
 1081         case BIOCSRTIMEOUT32:
 1082                 d->bd_compat32 = 1;
 1083         }
 1084 #endif
 1085 
 1086         CURVNET_SET(TD_TO_VNET(td));
 1087         switch (cmd) {
 1088 
 1089         default:
 1090                 error = EINVAL;
 1091                 break;
 1092 
 1093         /*
 1094          * Check for read packet available.
 1095          */
 1096         case FIONREAD:
 1097                 {
 1098                         int n;
 1099 
 1100                         BPFD_LOCK(d);
 1101                         n = d->bd_slen;
 1102                         if (d->bd_hbuf)
 1103                                 n += d->bd_hlen;
 1104                         BPFD_UNLOCK(d);
 1105 
 1106                         *(int *)addr = n;
 1107                         break;
 1108                 }
 1109 
 1110         case SIOCGIFADDR:
 1111                 {
 1112                         struct ifnet *ifp;
 1113 
 1114                         if (d->bd_bif == NULL)
 1115                                 error = EINVAL;
 1116                         else {
 1117                                 ifp = d->bd_bif->bif_ifp;
 1118                                 error = (*ifp->if_ioctl)(ifp, cmd, addr);
 1119                         }
 1120                         break;
 1121                 }
 1122 
 1123         /*
 1124          * Get buffer len [for read()].
 1125          */
 1126         case BIOCGBLEN:
 1127                 *(u_int *)addr = d->bd_bufsize;
 1128                 break;
 1129 
 1130         /*
 1131          * Set buffer length.
 1132          */
 1133         case BIOCSBLEN:
 1134                 error = bpf_ioctl_sblen(d, (u_int *)addr);
 1135                 break;
 1136 
 1137         /*
 1138          * Set link layer read filter.
 1139          */
 1140         case BIOCSETF:
 1141         case BIOCSETFNR:
 1142         case BIOCSETWF:
 1143 #ifdef COMPAT_FREEBSD32
 1144         case BIOCSETF32:
 1145         case BIOCSETFNR32:
 1146         case BIOCSETWF32:
 1147 #endif
 1148                 error = bpf_setf(d, (struct bpf_program *)addr, cmd);
 1149                 break;
 1150 
 1151         /*
 1152          * Flush read packet buffer.
 1153          */
 1154         case BIOCFLUSH:
 1155                 BPFD_LOCK(d);
 1156                 reset_d(d);
 1157                 BPFD_UNLOCK(d);
 1158                 break;
 1159 
 1160         /*
 1161          * Put interface into promiscuous mode.
 1162          */
 1163         case BIOCPROMISC:
 1164                 if (d->bd_bif == NULL) {
 1165                         /*
 1166                          * No interface attached yet.
 1167                          */
 1168                         error = EINVAL;
 1169                         break;
 1170                 }
 1171                 if (d->bd_promisc == 0) {
 1172                         error = ifpromisc(d->bd_bif->bif_ifp, 1);
 1173                         if (error == 0)
 1174                                 d->bd_promisc = 1;
 1175                 }
 1176                 break;
 1177 
 1178         /*
 1179          * Get current data link type.
 1180          */
 1181         case BIOCGDLT:
 1182                 if (d->bd_bif == NULL)
 1183                         error = EINVAL;
 1184                 else
 1185                         *(u_int *)addr = d->bd_bif->bif_dlt;
 1186                 break;
 1187 
 1188         /*
 1189          * Get a list of supported data link types.
 1190          */
 1191 #ifdef COMPAT_FREEBSD32
 1192         case BIOCGDLTLIST32:
 1193                 {
 1194                         struct bpf_dltlist32 *list32;
 1195                         struct bpf_dltlist dltlist;
 1196 
 1197                         list32 = (struct bpf_dltlist32 *)addr;
 1198                         dltlist.bfl_len = list32->bfl_len;
 1199                         dltlist.bfl_list = PTRIN(list32->bfl_list);
 1200                         if (d->bd_bif == NULL)
 1201                                 error = EINVAL;
 1202                         else {
 1203                                 error = bpf_getdltlist(d, &dltlist);
 1204                                 if (error == 0)
 1205                                         list32->bfl_len = dltlist.bfl_len;
 1206                         }
 1207                         break;
 1208                 }
 1209 #endif
 1210 
 1211         case BIOCGDLTLIST:
 1212                 if (d->bd_bif == NULL)
 1213                         error = EINVAL;
 1214                 else
 1215                         error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
 1216                 break;
 1217 
 1218         /*
 1219          * Set data link type.
 1220          */
 1221         case BIOCSDLT:
 1222                 if (d->bd_bif == NULL)
 1223                         error = EINVAL;
 1224                 else
 1225                         error = bpf_setdlt(d, *(u_int *)addr);
 1226                 break;
 1227 
 1228         /*
 1229          * Get interface name.
 1230          */
 1231         case BIOCGETIF:
 1232                 if (d->bd_bif == NULL)
 1233                         error = EINVAL;
 1234                 else {
 1235                         struct ifnet *const ifp = d->bd_bif->bif_ifp;
 1236                         struct ifreq *const ifr = (struct ifreq *)addr;
 1237 
 1238                         strlcpy(ifr->ifr_name, ifp->if_xname,
 1239                             sizeof(ifr->ifr_name));
 1240                 }
 1241                 break;
 1242 
 1243         /*
 1244          * Set interface.
 1245          */
 1246         case BIOCSETIF:
 1247                 error = bpf_setif(d, (struct ifreq *)addr);
 1248                 break;
 1249 
 1250         /*
 1251          * Set read timeout.
 1252          */
 1253         case BIOCSRTIMEOUT:
 1254 #ifdef COMPAT_FREEBSD32
 1255         case BIOCSRTIMEOUT32:
 1256 #endif
 1257                 {
 1258                         struct timeval *tv = (struct timeval *)addr;
 1259 #ifdef COMPAT_FREEBSD32
 1260                         struct timeval32 *tv32;
 1261                         struct timeval tv64;
 1262 
 1263                         if (cmd == BIOCSRTIMEOUT32) {
 1264                                 tv32 = (struct timeval32 *)addr;
 1265                                 tv = &tv64;
 1266                                 tv->tv_sec = tv32->tv_sec;
 1267                                 tv->tv_usec = tv32->tv_usec;
 1268                         } else
 1269 #endif
 1270                                 tv = (struct timeval *)addr;
 1271 
 1272                         /*
 1273                          * Subtract 1 tick from tvtohz() since this isn't
 1274                          * a one-shot timer.
 1275                          */
 1276                         if ((error = itimerfix(tv)) == 0)
 1277                                 d->bd_rtout = tvtohz(tv) - 1;
 1278                         break;
 1279                 }
 1280 
 1281         /*
 1282          * Get read timeout.
 1283          */
 1284         case BIOCGRTIMEOUT:
 1285 #ifdef COMPAT_FREEBSD32
 1286         case BIOCGRTIMEOUT32:
 1287 #endif
 1288                 {
 1289                         struct timeval *tv;
 1290 #ifdef COMPAT_FREEBSD32
 1291                         struct timeval32 *tv32;
 1292                         struct timeval tv64;
 1293 
 1294                         if (cmd == BIOCGRTIMEOUT32)
 1295                                 tv = &tv64;
 1296                         else
 1297 #endif
 1298                                 tv = (struct timeval *)addr;
 1299 
 1300                         tv->tv_sec = d->bd_rtout / hz;
 1301                         tv->tv_usec = (d->bd_rtout % hz) * tick;
 1302 #ifdef COMPAT_FREEBSD32
 1303                         if (cmd == BIOCGRTIMEOUT32) {
 1304                                 tv32 = (struct timeval32 *)addr;
 1305                                 tv32->tv_sec = tv->tv_sec;
 1306                                 tv32->tv_usec = tv->tv_usec;
 1307                         }
 1308 #endif
 1309 
 1310                         break;
 1311                 }
 1312 
 1313         /*
 1314          * Get packet stats.
 1315          */
 1316         case BIOCGSTATS:
 1317                 {
 1318                         struct bpf_stat *bs = (struct bpf_stat *)addr;
 1319 
 1320                         /* XXXCSJP overflow */
 1321                         bs->bs_recv = d->bd_rcount;
 1322                         bs->bs_drop = d->bd_dcount;
 1323                         break;
 1324                 }
 1325 
 1326         /*
 1327          * Set immediate mode.
 1328          */
 1329         case BIOCIMMEDIATE:
 1330                 d->bd_immediate = *(u_int *)addr;
 1331                 break;
 1332 
 1333         case BIOCVERSION:
 1334                 {
 1335                         struct bpf_version *bv = (struct bpf_version *)addr;
 1336 
 1337                         bv->bv_major = BPF_MAJOR_VERSION;
 1338                         bv->bv_minor = BPF_MINOR_VERSION;
 1339                         break;
 1340                 }
 1341 
 1342         /*
 1343          * Get "header already complete" flag
 1344          */
 1345         case BIOCGHDRCMPLT:
 1346                 *(u_int *)addr = d->bd_hdrcmplt;
 1347                 break;
 1348 
 1349         /*
 1350          * Set "header already complete" flag
 1351          */
 1352         case BIOCSHDRCMPLT:
 1353                 d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
 1354                 break;
 1355 
 1356         /*
 1357          * Get packet direction flag
 1358          */
 1359         case BIOCGDIRECTION:
 1360                 *(u_int *)addr = d->bd_direction;
 1361                 break;
 1362 
 1363         /*
 1364          * Set packet direction flag
 1365          */
 1366         case BIOCSDIRECTION:
 1367                 {
 1368                         u_int   direction;
 1369 
 1370                         direction = *(u_int *)addr;
 1371                         switch (direction) {
 1372                         case BPF_D_IN:
 1373                         case BPF_D_INOUT:
 1374                         case BPF_D_OUT:
 1375                                 d->bd_direction = direction;
 1376                                 break;
 1377                         default:
 1378                                 error = EINVAL;
 1379                         }
 1380                 }
 1381                 break;
 1382 
 1383         case BIOCFEEDBACK:
 1384                 d->bd_feedback = *(u_int *)addr;
 1385                 break;
 1386 
 1387         case BIOCLOCK:
 1388                 d->bd_locked = 1;
 1389                 break;
 1390 
 1391         case FIONBIO:           /* Non-blocking I/O */
 1392                 break;
 1393 
 1394         case FIOASYNC:          /* Send signal on receive packets */
 1395                 d->bd_async = *(int *)addr;
 1396                 break;
 1397 
 1398         case FIOSETOWN:
 1399                 error = fsetown(*(int *)addr, &d->bd_sigio);
 1400                 break;
 1401 
 1402         case FIOGETOWN:
 1403                 *(int *)addr = fgetown(&d->bd_sigio);
 1404                 break;
 1405 
 1406         /* This is deprecated, FIOSETOWN should be used instead. */
 1407         case TIOCSPGRP:
 1408                 error = fsetown(-(*(int *)addr), &d->bd_sigio);
 1409                 break;
 1410 
 1411         /* This is deprecated, FIOGETOWN should be used instead. */
 1412         case TIOCGPGRP:
 1413                 *(int *)addr = -fgetown(&d->bd_sigio);
 1414                 break;
 1415 
 1416         case BIOCSRSIG:         /* Set receive signal */
 1417                 {
 1418                         u_int sig;
 1419 
 1420                         sig = *(u_int *)addr;
 1421 
 1422                         if (sig >= NSIG)
 1423                                 error = EINVAL;
 1424                         else
 1425                                 d->bd_sig = sig;
 1426                         break;
 1427                 }
 1428         case BIOCGRSIG:
 1429                 *(u_int *)addr = d->bd_sig;
 1430                 break;
 1431 
 1432         case BIOCGETBUFMODE:
 1433                 *(u_int *)addr = d->bd_bufmode;
 1434                 break;
 1435 
 1436         case BIOCSETBUFMODE:
 1437                 /*
 1438                  * Allow the buffering mode to be changed as long as we
 1439                  * haven't yet committed to a particular mode.  Our
 1440                  * definition of commitment, for now, is whether or not a
 1441                  * buffer has been allocated or an interface attached, since
 1442                  * that's the point where things get tricky.
 1443                  */
 1444                 switch (*(u_int *)addr) {
 1445                 case BPF_BUFMODE_BUFFER:
 1446                         break;
 1447 
 1448                 case BPF_BUFMODE_ZBUF:
 1449                         if (bpf_zerocopy_enable)
 1450                                 break;
 1451                         /* FALLSTHROUGH */
 1452 
 1453                 default:
 1454                         CURVNET_RESTORE();
 1455                         return (EINVAL);
 1456                 }
 1457 
 1458                 BPFD_LOCK(d);
 1459                 if (d->bd_sbuf != NULL || d->bd_hbuf != NULL ||
 1460                     d->bd_fbuf != NULL || d->bd_bif != NULL) {
 1461                         BPFD_UNLOCK(d);
 1462                         CURVNET_RESTORE();
 1463                         return (EBUSY);
 1464                 }
 1465                 d->bd_bufmode = *(u_int *)addr;
 1466                 BPFD_UNLOCK(d);
 1467                 break;
 1468 
 1469         case BIOCGETZMAX:
 1470                 error = bpf_ioctl_getzmax(td, d, (size_t *)addr);
 1471                 break;
 1472 
 1473         case BIOCSETZBUF:
 1474                 error = bpf_ioctl_setzbuf(td, d, (struct bpf_zbuf *)addr);
 1475                 break;
 1476 
 1477         case BIOCROTZBUF:
 1478                 error = bpf_ioctl_rotzbuf(td, d, (struct bpf_zbuf *)addr);
 1479                 break;
 1480         }
 1481         CURVNET_RESTORE();
 1482         return (error);
 1483 }
 1484 
 1485 /*
 1486  * Set d's packet filter program to fp.  If this file already has a filter,
 1487  * free it and replace it.  Returns EINVAL for bogus requests.
 1488  */
 1489 static int
 1490 bpf_setf(struct bpf_d *d, struct bpf_program *fp, u_long cmd)
 1491 {
 1492         struct bpf_insn *fcode, *old;
 1493         u_int wfilter, flen, size;
 1494 #ifdef BPF_JITTER
 1495         bpf_jit_filter *ofunc;
 1496 #endif
 1497 #ifdef COMPAT_FREEBSD32
 1498         struct bpf_program32 *fp32;
 1499         struct bpf_program fp_swab;
 1500 
 1501         if (cmd == BIOCSETWF32 || cmd == BIOCSETF32 || cmd == BIOCSETFNR32) {
 1502                 fp32 = (struct bpf_program32 *)fp;
 1503                 fp_swab.bf_len = fp32->bf_len;
 1504                 fp_swab.bf_insns = (struct bpf_insn *)(uintptr_t)fp32->bf_insns;
 1505                 fp = &fp_swab;
 1506                 if (cmd == BIOCSETWF32)
 1507                         cmd = BIOCSETWF;
 1508         }
 1509 #endif
 1510         if (cmd == BIOCSETWF) {
 1511                 old = d->bd_wfilter;
 1512                 wfilter = 1;
 1513 #ifdef BPF_JITTER
 1514                 ofunc = NULL;
 1515 #endif
 1516         } else {
 1517                 wfilter = 0;
 1518                 old = d->bd_rfilter;
 1519 #ifdef BPF_JITTER
 1520                 ofunc = d->bd_bfilter;
 1521 #endif
 1522         }
 1523         if (fp->bf_insns == NULL) {
 1524                 if (fp->bf_len != 0)
 1525                         return (EINVAL);
 1526                 BPFD_LOCK(d);
 1527                 if (wfilter)
 1528                         d->bd_wfilter = NULL;
 1529                 else {
 1530                         d->bd_rfilter = NULL;
 1531 #ifdef BPF_JITTER
 1532                         d->bd_bfilter = NULL;
 1533 #endif
 1534                         if (cmd == BIOCSETF)
 1535                                 reset_d(d);
 1536                 }
 1537                 BPFD_UNLOCK(d);
 1538                 if (old != NULL)
 1539                         free((caddr_t)old, M_BPF);
 1540 #ifdef BPF_JITTER
 1541                 if (ofunc != NULL)
 1542                         bpf_destroy_jit_filter(ofunc);
 1543 #endif
 1544                 return (0);
 1545         }
 1546         flen = fp->bf_len;
 1547         if (flen > bpf_maxinsns)
 1548                 return (EINVAL);
 1549 
 1550         size = flen * sizeof(*fp->bf_insns);
 1551         fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
 1552         if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
 1553             bpf_validate(fcode, (int)flen)) {
 1554                 BPFD_LOCK(d);
 1555                 if (wfilter)
 1556                         d->bd_wfilter = fcode;
 1557                 else {
 1558                         d->bd_rfilter = fcode;
 1559 #ifdef BPF_JITTER
 1560                         d->bd_bfilter = bpf_jitter(fcode, flen);
 1561 #endif
 1562                         if (cmd == BIOCSETF)
 1563                                 reset_d(d);
 1564                 }
 1565                 BPFD_UNLOCK(d);
 1566                 if (old != NULL)
 1567                         free((caddr_t)old, M_BPF);
 1568 #ifdef BPF_JITTER
 1569                 if (ofunc != NULL)
 1570                         bpf_destroy_jit_filter(ofunc);
 1571 #endif
 1572 
 1573                 return (0);
 1574         }
 1575         free((caddr_t)fcode, M_BPF);
 1576         return (EINVAL);
 1577 }
 1578 
 1579 /*
 1580  * Detach a file from its current interface (if attached at all) and attach
 1581  * to the interface indicated by the name stored in ifr.
 1582  * Return an errno or 0.
 1583  */
 1584 static int
 1585 bpf_setif(struct bpf_d *d, struct ifreq *ifr)
 1586 {
 1587         struct bpf_if *bp;
 1588         struct ifnet *theywant;
 1589 
 1590         theywant = ifunit(ifr->ifr_name);
 1591         if (theywant == NULL || theywant->if_bpf == NULL)
 1592                 return (ENXIO);
 1593 
 1594         bp = theywant->if_bpf;
 1595 
 1596         /*
 1597          * Behavior here depends on the buffering model.  If we're using
 1598          * kernel memory buffers, then we can allocate them here.  If we're
 1599          * using zero-copy, then the user process must have registered
 1600          * buffers by the time we get here.  If not, return an error.
 1601          *
 1602          * XXXRW: There are locking issues here with multi-threaded use: what
 1603          * if two threads try to set the interface at once?
 1604          */
 1605         switch (d->bd_bufmode) {
 1606         case BPF_BUFMODE_BUFFER:
 1607                 if (d->bd_sbuf == NULL)
 1608                         bpf_buffer_alloc(d);
 1609                 KASSERT(d->bd_sbuf != NULL, ("bpf_setif: bd_sbuf NULL"));
 1610                 break;
 1611 
 1612         case BPF_BUFMODE_ZBUF:
 1613                 if (d->bd_sbuf == NULL)
 1614                         return (EINVAL);
 1615                 break;
 1616 
 1617         default:
 1618                 panic("bpf_setif: bufmode %d", d->bd_bufmode);
 1619         }
 1620         if (bp != d->bd_bif) {
 1621                 if (d->bd_bif)
 1622                         /*
 1623                          * Detach if attached to something else.
 1624                          */
 1625                         bpf_detachd(d);
 1626 
 1627                 bpf_attachd(d, bp);
 1628         }
 1629         BPFD_LOCK(d);
 1630         reset_d(d);
 1631         BPFD_UNLOCK(d);
 1632         return (0);
 1633 }
 1634 
 1635 /*
 1636  * Support for select() and poll() system calls
 1637  *
 1638  * Return true iff the specific operation will not block indefinitely.
 1639  * Otherwise, return false but make a note that a selwakeup() must be done.
 1640  */
 1641 static int
 1642 bpfpoll(struct cdev *dev, int events, struct thread *td)
 1643 {
 1644         struct bpf_d *d;
 1645         int revents;
 1646 
 1647         if (devfs_get_cdevpriv((void **)&d) != 0 || d->bd_bif == NULL)
 1648                 return (events &
 1649                     (POLLHUP|POLLIN|POLLRDNORM|POLLOUT|POLLWRNORM));
 1650 
 1651         /*
 1652          * Refresh PID associated with this descriptor.
 1653          */
 1654         revents = events & (POLLOUT | POLLWRNORM);
 1655         BPFD_LOCK(d);
 1656         d->bd_pid = td->td_proc->p_pid;
 1657         if (events & (POLLIN | POLLRDNORM)) {
 1658                 if (bpf_ready(d))
 1659                         revents |= events & (POLLIN | POLLRDNORM);
 1660                 else {
 1661                         selrecord(td, &d->bd_sel);
 1662                         /* Start the read timeout if necessary. */
 1663                         if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
 1664                                 callout_reset(&d->bd_callout, d->bd_rtout,
 1665                                     bpf_timed_out, d);
 1666                                 d->bd_state = BPF_WAITING;
 1667                         }
 1668                 }
 1669         }
 1670         BPFD_UNLOCK(d);
 1671         return (revents);
 1672 }
 1673 
 1674 /*
 1675  * Support for kevent() system call.  Register EVFILT_READ filters and
 1676  * reject all others.
 1677  */
 1678 int
 1679 bpfkqfilter(struct cdev *dev, struct knote *kn)
 1680 {
 1681         struct bpf_d *d;
 1682 
 1683         if (devfs_get_cdevpriv((void **)&d) != 0 ||
 1684             kn->kn_filter != EVFILT_READ)
 1685                 return (1);
 1686 
 1687         /*
 1688          * Refresh PID associated with this descriptor.
 1689          */
 1690         BPFD_LOCK(d);
 1691         d->bd_pid = curthread->td_proc->p_pid;
 1692         kn->kn_fop = &bpfread_filtops;
 1693         kn->kn_hook = d;
 1694         knlist_add(&d->bd_sel.si_note, kn, 1);
 1695         BPFD_UNLOCK(d);
 1696 
 1697         return (0);
 1698 }
 1699 
 1700 static void
 1701 filt_bpfdetach(struct knote *kn)
 1702 {
 1703         struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
 1704 
 1705         knlist_remove(&d->bd_sel.si_note, kn, 0);
 1706 }
 1707 
 1708 static int
 1709 filt_bpfread(struct knote *kn, long hint)
 1710 {
 1711         struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
 1712         int ready;
 1713 
 1714         BPFD_LOCK_ASSERT(d);
 1715         ready = bpf_ready(d);
 1716         if (ready) {
 1717                 kn->kn_data = d->bd_slen;
 1718                 if (d->bd_hbuf)
 1719                         kn->kn_data += d->bd_hlen;
 1720         } else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
 1721                 callout_reset(&d->bd_callout, d->bd_rtout,
 1722                     bpf_timed_out, d);
 1723                 d->bd_state = BPF_WAITING;
 1724         }
 1725 
 1726         return (ready);
 1727 }
 1728 
 1729 /*
 1730  * Incoming linkage from device drivers.  Process the packet pkt, of length
 1731  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
 1732  * by each process' filter, and if accepted, stashed into the corresponding
 1733  * buffer.
 1734  */
 1735 void
 1736 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
 1737 {
 1738         struct bpf_d *d;
 1739 #ifdef BPF_JITTER
 1740         bpf_jit_filter *bf;
 1741 #endif
 1742         u_int slen;
 1743         int gottime;
 1744         struct timeval tv;
 1745 
 1746         gottime = 0;
 1747         BPFIF_LOCK(bp);
 1748         LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
 1749                 BPFD_LOCK(d);
 1750                 ++d->bd_rcount;
 1751                 /*
 1752                  * NB: We dont call BPF_CHECK_DIRECTION() here since there is no
 1753                  * way for the caller to indiciate to us whether this packet
 1754                  * is inbound or outbound.  In the bpf_mtap() routines, we use
 1755                  * the interface pointers on the mbuf to figure it out.
 1756                  */
 1757 #ifdef BPF_JITTER
 1758                 bf = bpf_jitter_enable != 0 ? d->bd_bfilter : NULL;
 1759                 if (bf != NULL)
 1760                         slen = (*(bf->func))(pkt, pktlen, pktlen);
 1761                 else
 1762 #endif
 1763                 slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen);
 1764                 if (slen != 0) {
 1765                         d->bd_fcount++;
 1766                         if (!gottime) {
 1767                                 microtime(&tv);
 1768                                 gottime = 1;
 1769                         }
 1770 #ifdef MAC
 1771                         if (mac_bpfdesc_check_receive(d, bp->bif_ifp) == 0)
 1772 #endif
 1773                                 catchpacket(d, pkt, pktlen, slen,
 1774                                     bpf_append_bytes, &tv);
 1775                 }
 1776                 BPFD_UNLOCK(d);
 1777         }
 1778         BPFIF_UNLOCK(bp);
 1779 }
 1780 
 1781 #define BPF_CHECK_DIRECTION(d, r, i)                            \
 1782             (((d)->bd_direction == BPF_D_IN && (r) != (i)) ||   \
 1783             ((d)->bd_direction == BPF_D_OUT && (r) == (i)))
 1784 
 1785 /*
 1786  * Incoming linkage from device drivers, when packet is in an mbuf chain.
 1787  */
 1788 void
 1789 bpf_mtap(struct bpf_if *bp, struct mbuf *m)
 1790 {
 1791         struct bpf_d *d;
 1792 #ifdef BPF_JITTER
 1793         bpf_jit_filter *bf;
 1794 #endif
 1795         u_int pktlen, slen;
 1796         int gottime;
 1797         struct timeval tv;
 1798 
 1799         /* Skip outgoing duplicate packets. */
 1800         if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
 1801                 m->m_flags &= ~M_PROMISC;
 1802                 return;
 1803         }
 1804 
 1805         gottime = 0;
 1806 
 1807         pktlen = m_length(m, NULL);
 1808 
 1809         BPFIF_LOCK(bp);
 1810         LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
 1811                 if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
 1812                         continue;
 1813                 BPFD_LOCK(d);
 1814                 ++d->bd_rcount;
 1815 #ifdef BPF_JITTER
 1816                 bf = bpf_jitter_enable != 0 ? d->bd_bfilter : NULL;
 1817                 /* XXX We cannot handle multiple mbufs. */
 1818                 if (bf != NULL && m->m_next == NULL)
 1819                         slen = (*(bf->func))(mtod(m, u_char *), pktlen, pktlen);
 1820                 else
 1821 #endif
 1822                 slen = bpf_filter(d->bd_rfilter, (u_char *)m, pktlen, 0);
 1823                 if (slen != 0) {
 1824                         d->bd_fcount++;
 1825                         if (!gottime) {
 1826                                 microtime(&tv);
 1827                                 gottime = 1;
 1828                         }
 1829 #ifdef MAC
 1830                         if (mac_bpfdesc_check_receive(d, bp->bif_ifp) == 0)
 1831 #endif
 1832                                 catchpacket(d, (u_char *)m, pktlen, slen,
 1833                                     bpf_append_mbuf, &tv);
 1834                 }
 1835                 BPFD_UNLOCK(d);
 1836         }
 1837         BPFIF_UNLOCK(bp);
 1838 }
 1839 
 1840 /*
 1841  * Incoming linkage from device drivers, when packet is in
 1842  * an mbuf chain and to be prepended by a contiguous header.
 1843  */
 1844 void
 1845 bpf_mtap2(struct bpf_if *bp, void *data, u_int dlen, struct mbuf *m)
 1846 {
 1847         struct mbuf mb;
 1848         struct bpf_d *d;
 1849         u_int pktlen, slen;
 1850         int gottime;
 1851         struct timeval tv;
 1852 
 1853         /* Skip outgoing duplicate packets. */
 1854         if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
 1855                 m->m_flags &= ~M_PROMISC;
 1856                 return;
 1857         }
 1858 
 1859         gottime = 0;
 1860 
 1861         pktlen = m_length(m, NULL);
 1862         /*
 1863          * Craft on-stack mbuf suitable for passing to bpf_filter.
 1864          * Note that we cut corners here; we only setup what's
 1865          * absolutely needed--this mbuf should never go anywhere else.
 1866          */
 1867         mb.m_next = m;
 1868         mb.m_data = data;
 1869         mb.m_len = dlen;
 1870         pktlen += dlen;
 1871 
 1872         BPFIF_LOCK(bp);
 1873         LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
 1874                 if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
 1875                         continue;
 1876                 BPFD_LOCK(d);
 1877                 ++d->bd_rcount;
 1878                 slen = bpf_filter(d->bd_rfilter, (u_char *)&mb, pktlen, 0);
 1879                 if (slen != 0) {
 1880                         d->bd_fcount++;
 1881                         if (!gottime) {
 1882                                 microtime(&tv);
 1883                                 gottime = 1;
 1884                         }
 1885 #ifdef MAC
 1886                         if (mac_bpfdesc_check_receive(d, bp->bif_ifp) == 0)
 1887 #endif
 1888                                 catchpacket(d, (u_char *)&mb, pktlen, slen,
 1889                                     bpf_append_mbuf, &tv);
 1890                 }
 1891                 BPFD_UNLOCK(d);
 1892         }
 1893         BPFIF_UNLOCK(bp);
 1894 }
 1895 
 1896 #undef  BPF_CHECK_DIRECTION
 1897 
 1898 /*
 1899  * Move the packet data from interface memory (pkt) into the
 1900  * store buffer.  "cpfn" is the routine called to do the actual data
 1901  * transfer.  bcopy is passed in to copy contiguous chunks, while
 1902  * bpf_append_mbuf is passed in to copy mbuf chains.  In the latter case,
 1903  * pkt is really an mbuf.
 1904  */
 1905 static void
 1906 catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
 1907     void (*cpfn)(struct bpf_d *, caddr_t, u_int, void *, u_int),
 1908     struct timeval *tv)
 1909 {
 1910         struct bpf_hdr hdr;
 1911 #ifdef COMPAT_FREEBSD32
 1912         struct bpf_hdr32 hdr32;
 1913 #endif
 1914         int totlen, curlen;
 1915         int hdrlen = d->bd_bif->bif_hdrlen;
 1916         int do_wakeup = 0;
 1917 
 1918         BPFD_LOCK_ASSERT(d);
 1919 
 1920         /*
 1921          * Detect whether user space has released a buffer back to us, and if
 1922          * so, move it from being a hold buffer to a free buffer.  This may
 1923          * not be the best place to do it (for example, we might only want to
 1924          * run this check if we need the space), but for now it's a reliable
 1925          * spot to do it.
 1926          */
 1927         if (d->bd_fbuf == NULL && bpf_canfreebuf(d)) {
 1928                 d->bd_fbuf = d->bd_hbuf;
 1929                 d->bd_hbuf = NULL;
 1930                 d->bd_hlen = 0;
 1931                 bpf_buf_reclaimed(d);
 1932         }
 1933 
 1934         /*
 1935          * Figure out how many bytes to move.  If the packet is
 1936          * greater or equal to the snapshot length, transfer that
 1937          * much.  Otherwise, transfer the whole packet (unless
 1938          * we hit the buffer size limit).
 1939          */
 1940         totlen = hdrlen + min(snaplen, pktlen);
 1941         if (totlen > d->bd_bufsize)
 1942                 totlen = d->bd_bufsize;
 1943 
 1944         /*
 1945          * Round up the end of the previous packet to the next longword.
 1946          *
 1947          * Drop the packet if there's no room and no hope of room
 1948          * If the packet would overflow the storage buffer or the storage
 1949          * buffer is considered immutable by the buffer model, try to rotate
 1950          * the buffer and wakeup pending processes.
 1951          */
 1952 #ifdef COMPAT_FREEBSD32
 1953         if (d->bd_compat32)
 1954                 curlen = BPF_WORDALIGN32(d->bd_slen);
 1955         else
 1956 #endif
 1957                 curlen = BPF_WORDALIGN(d->bd_slen);
 1958         if (curlen + totlen > d->bd_bufsize || !bpf_canwritebuf(d)) {
 1959                 if (d->bd_fbuf == NULL) {
 1960                         /*
 1961                          * There's no room in the store buffer, and no
 1962                          * prospect of room, so drop the packet.  Notify the
 1963                          * buffer model.
 1964                          */
 1965                         bpf_buffull(d);
 1966                         ++d->bd_dcount;
 1967                         return;
 1968                 }
 1969                 ROTATE_BUFFERS(d);
 1970                 do_wakeup = 1;
 1971                 curlen = 0;
 1972         } else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
 1973                 /*
 1974                  * Immediate mode is set, or the read timeout has already
 1975                  * expired during a select call.  A packet arrived, so the
 1976                  * reader should be woken up.
 1977                  */
 1978                 do_wakeup = 1;
 1979 #ifdef COMPAT_FREEBSD32
 1980         /*
 1981          * If this is a 32-bit stream, then stick a 32-bit header at the
 1982          * front and copy the data into the buffer.
 1983          */
 1984         if (d->bd_compat32) {
 1985                 bzero(&hdr32, sizeof(hdr32));
 1986                 hdr32.bh_tstamp.tv_sec = tv->tv_sec;
 1987                 hdr32.bh_tstamp.tv_usec = tv->tv_usec;
 1988                 hdr32.bh_datalen = pktlen;
 1989                 hdr32.bh_hdrlen = hdrlen;
 1990                 hdr.bh_caplen = hdr32.bh_caplen = totlen - hdrlen;
 1991                 bpf_append_bytes(d, d->bd_sbuf, curlen, &hdr32, sizeof(hdr32));
 1992                 goto copy;
 1993         }
 1994 #endif
 1995 
 1996         /*
 1997          * Append the bpf header.  Note we append the actual header size, but
 1998          * move forward the length of the header plus padding.
 1999          */
 2000         bzero(&hdr, sizeof(hdr));
 2001         hdr.bh_tstamp = *tv;
 2002         hdr.bh_datalen = pktlen;
 2003         hdr.bh_hdrlen = hdrlen;
 2004         hdr.bh_caplen = totlen - hdrlen;
 2005         bpf_append_bytes(d, d->bd_sbuf, curlen, &hdr, sizeof(hdr));
 2006 
 2007         /*
 2008          * Copy the packet data into the store buffer and update its length.
 2009          */
 2010 #ifdef COMPAT_FREEBSD32
 2011  copy:
 2012 #endif
 2013         (*cpfn)(d, d->bd_sbuf, curlen + hdrlen, pkt, hdr.bh_caplen);
 2014         d->bd_slen = curlen + totlen;
 2015 
 2016         if (do_wakeup)
 2017                 bpf_wakeup(d);
 2018 }
 2019 
 2020 /*
 2021  * Free buffers currently in use by a descriptor.
 2022  * Called on close.
 2023  */
 2024 static void
 2025 bpf_freed(struct bpf_d *d)
 2026 {
 2027 
 2028         /*
 2029          * We don't need to lock out interrupts since this descriptor has
 2030          * been detached from its interface and it yet hasn't been marked
 2031          * free.
 2032          */
 2033         bpf_free(d);
 2034         if (d->bd_rfilter != NULL) {
 2035                 free((caddr_t)d->bd_rfilter, M_BPF);
 2036 #ifdef BPF_JITTER
 2037                 if (d->bd_bfilter != NULL)
 2038                         bpf_destroy_jit_filter(d->bd_bfilter);
 2039 #endif
 2040         }
 2041         if (d->bd_wfilter != NULL)
 2042                 free((caddr_t)d->bd_wfilter, M_BPF);
 2043         mtx_destroy(&d->bd_mtx);
 2044 }
 2045 
 2046 /*
 2047  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
 2048  * fixed size of the link header (variable length headers not yet supported).
 2049  */
 2050 void
 2051 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
 2052 {
 2053 
 2054         bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
 2055 }
 2056 
 2057 /*
 2058  * Attach an interface to bpf.  ifp is a pointer to the structure
 2059  * defining the interface to be attached, dlt is the link layer type,
 2060  * and hdrlen is the fixed size of the link header (variable length
 2061  * headers are not yet supporrted).
 2062  */
 2063 void
 2064 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
 2065 {
 2066         struct bpf_if *bp;
 2067 
 2068         bp = malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
 2069         if (bp == NULL)
 2070                 panic("bpfattach");
 2071 
 2072         LIST_INIT(&bp->bif_dlist);
 2073         bp->bif_ifp = ifp;
 2074         bp->bif_dlt = dlt;
 2075         mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
 2076         KASSERT(*driverp == NULL, ("bpfattach2: driverp already initialized"));
 2077         *driverp = bp;
 2078 
 2079         mtx_lock(&bpf_mtx);
 2080         LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next);
 2081         mtx_unlock(&bpf_mtx);
 2082 
 2083         /*
 2084          * Compute the length of the bpf header.  This is not necessarily
 2085          * equal to SIZEOF_BPF_HDR because we want to insert spacing such
 2086          * that the network layer header begins on a longword boundary (for
 2087          * performance reasons and to alleviate alignment restrictions).
 2088          */
 2089         bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
 2090 
 2091         if (bootverbose)
 2092                 if_printf(ifp, "bpf attached\n");
 2093 }
 2094 
 2095 /*
 2096  * Detach bpf from an interface.  This involves detaching each descriptor
 2097  * associated with the interface, and leaving bd_bif NULL.  Notify each
 2098  * descriptor as it's detached so that any sleepers wake up and get
 2099  * ENXIO.
 2100  */
 2101 void
 2102 bpfdetach(struct ifnet *ifp)
 2103 {
 2104         struct bpf_if   *bp;
 2105         struct bpf_d    *d;
 2106 
 2107         /* Locate BPF interface information */
 2108         mtx_lock(&bpf_mtx);
 2109         LIST_FOREACH(bp, &bpf_iflist, bif_next) {
 2110                 if (ifp == bp->bif_ifp)
 2111                         break;
 2112         }
 2113 
 2114         /* Interface wasn't attached */
 2115         if ((bp == NULL) || (bp->bif_ifp == NULL)) {
 2116                 mtx_unlock(&bpf_mtx);
 2117                 printf("bpfdetach: %s was not attached\n", ifp->if_xname);
 2118                 return;
 2119         }
 2120 
 2121         LIST_REMOVE(bp, bif_next);
 2122         mtx_unlock(&bpf_mtx);
 2123 
 2124         while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) {
 2125                 bpf_detachd(d);
 2126                 BPFD_LOCK(d);
 2127                 bpf_wakeup(d);
 2128                 BPFD_UNLOCK(d);
 2129         }
 2130 
 2131         mtx_destroy(&bp->bif_mtx);
 2132         free(bp, M_BPF);
 2133 }
 2134 
 2135 /*
 2136  * Get a list of available data link type of the interface.
 2137  */
 2138 static int
 2139 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl)
 2140 {
 2141         int n, error;
 2142         struct ifnet *ifp;
 2143         struct bpf_if *bp;
 2144 
 2145         ifp = d->bd_bif->bif_ifp;
 2146         n = 0;
 2147         error = 0;
 2148         mtx_lock(&bpf_mtx);
 2149         LIST_FOREACH(bp, &bpf_iflist, bif_next) {
 2150                 if (bp->bif_ifp != ifp)
 2151                         continue;
 2152                 if (bfl->bfl_list != NULL) {
 2153                         if (n >= bfl->bfl_len) {
 2154                                 mtx_unlock(&bpf_mtx);
 2155                                 return (ENOMEM);
 2156                         }
 2157                         error = copyout(&bp->bif_dlt,
 2158                             bfl->bfl_list + n, sizeof(u_int));
 2159                 }
 2160                 n++;
 2161         }
 2162         mtx_unlock(&bpf_mtx);
 2163         bfl->bfl_len = n;
 2164         return (error);
 2165 }
 2166 
 2167 /*
 2168  * Set the data link type of a BPF instance.
 2169  */
 2170 static int
 2171 bpf_setdlt(struct bpf_d *d, u_int dlt)
 2172 {
 2173         int error, opromisc;
 2174         struct ifnet *ifp;
 2175         struct bpf_if *bp;
 2176 
 2177         if (d->bd_bif->bif_dlt == dlt)
 2178                 return (0);
 2179         ifp = d->bd_bif->bif_ifp;
 2180         mtx_lock(&bpf_mtx);
 2181         LIST_FOREACH(bp, &bpf_iflist, bif_next) {
 2182                 if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
 2183                         break;
 2184         }
 2185         mtx_unlock(&bpf_mtx);
 2186         if (bp != NULL) {
 2187                 opromisc = d->bd_promisc;
 2188                 bpf_detachd(d);
 2189                 bpf_attachd(d, bp);
 2190                 BPFD_LOCK(d);
 2191                 reset_d(d);
 2192                 BPFD_UNLOCK(d);
 2193                 if (opromisc) {
 2194                         error = ifpromisc(bp->bif_ifp, 1);
 2195                         if (error)
 2196                                 if_printf(bp->bif_ifp,
 2197                                         "bpf_setdlt: ifpromisc failed (%d)\n",
 2198                                         error);
 2199                         else
 2200                                 d->bd_promisc = 1;
 2201                 }
 2202         }
 2203         return (bp == NULL ? EINVAL : 0);
 2204 }
 2205 
 2206 static void
 2207 bpf_drvinit(void *unused)
 2208 {
 2209         struct cdev *dev;
 2210 
 2211         mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
 2212         LIST_INIT(&bpf_iflist);
 2213 
 2214         dev = make_dev(&bpf_cdevsw, 0, UID_ROOT, GID_WHEEL, 0600, "bpf");
 2215         /* For compatibility */
 2216         make_dev_alias(dev, "bpf0");
 2217 }
 2218 
 2219 /*
 2220  * Zero out the various packet counters associated with all of the bpf
 2221  * descriptors.  At some point, we will probably want to get a bit more
 2222  * granular and allow the user to specify descriptors to be zeroed.
 2223  */
 2224 static void
 2225 bpf_zero_counters(void)
 2226 {
 2227         struct bpf_if *bp;
 2228         struct bpf_d *bd;
 2229 
 2230         mtx_lock(&bpf_mtx);
 2231         LIST_FOREACH(bp, &bpf_iflist, bif_next) {
 2232                 BPFIF_LOCK(bp);
 2233                 LIST_FOREACH(bd, &bp->bif_dlist, bd_next) {
 2234                         BPFD_LOCK(bd);
 2235                         bd->bd_rcount = 0;
 2236                         bd->bd_dcount = 0;
 2237                         bd->bd_fcount = 0;
 2238                         bd->bd_wcount = 0;
 2239                         bd->bd_wfcount = 0;
 2240                         bd->bd_zcopy = 0;
 2241                         BPFD_UNLOCK(bd);
 2242                 }
 2243                 BPFIF_UNLOCK(bp);
 2244         }
 2245         mtx_unlock(&bpf_mtx);
 2246 }
 2247 
 2248 static void
 2249 bpfstats_fill_xbpf(struct xbpf_d *d, struct bpf_d *bd)
 2250 {
 2251 
 2252         bzero(d, sizeof(*d));
 2253         BPFD_LOCK_ASSERT(bd);
 2254         d->bd_structsize = sizeof(*d);
 2255         d->bd_immediate = bd->bd_immediate;
 2256         d->bd_promisc = bd->bd_promisc;
 2257         d->bd_hdrcmplt = bd->bd_hdrcmplt;
 2258         d->bd_direction = bd->bd_direction;
 2259         d->bd_feedback = bd->bd_feedback;
 2260         d->bd_async = bd->bd_async;
 2261         d->bd_rcount = bd->bd_rcount;
 2262         d->bd_dcount = bd->bd_dcount;
 2263         d->bd_fcount = bd->bd_fcount;
 2264         d->bd_sig = bd->bd_sig;
 2265         d->bd_slen = bd->bd_slen;
 2266         d->bd_hlen = bd->bd_hlen;
 2267         d->bd_bufsize = bd->bd_bufsize;
 2268         d->bd_pid = bd->bd_pid;
 2269         strlcpy(d->bd_ifname,
 2270             bd->bd_bif->bif_ifp->if_xname, IFNAMSIZ);
 2271         d->bd_locked = bd->bd_locked;
 2272         d->bd_wcount = bd->bd_wcount;
 2273         d->bd_wdcount = bd->bd_wdcount;
 2274         d->bd_wfcount = bd->bd_wfcount;
 2275         d->bd_zcopy = bd->bd_zcopy;
 2276         d->bd_bufmode = bd->bd_bufmode;
 2277 }
 2278 
 2279 static int
 2280 bpf_stats_sysctl(SYSCTL_HANDLER_ARGS)
 2281 {
 2282         struct xbpf_d *xbdbuf, *xbd, zerostats;
 2283         int index, error;
 2284         struct bpf_if *bp;
 2285         struct bpf_d *bd;
 2286 
 2287         /*
 2288          * XXX This is not technically correct. It is possible for non
 2289          * privileged users to open bpf devices. It would make sense
 2290          * if the users who opened the devices were able to retrieve
 2291          * the statistics for them, too.
 2292          */
 2293         error = priv_check(req->td, PRIV_NET_BPF);
 2294         if (error)
 2295                 return (error);
 2296         /*
 2297          * Check to see if the user is requesting that the counters be
 2298          * zeroed out.  Explicitly check that the supplied data is zeroed,
 2299          * as we aren't allowing the user to set the counters currently.
 2300          */
 2301         if (req->newptr != NULL) {
 2302                 if (req->newlen != sizeof(zerostats))
 2303                         return (EINVAL);
 2304                 bzero(&zerostats, sizeof(zerostats));
 2305                 xbd = req->newptr;
 2306                 if (bcmp(xbd, &zerostats, sizeof(*xbd)) != 0)
 2307                         return (EINVAL);
 2308                 bpf_zero_counters();
 2309                 return (0);
 2310         }
 2311         if (req->oldptr == NULL)
 2312                 return (SYSCTL_OUT(req, 0, bpf_bpfd_cnt * sizeof(*xbd)));
 2313         if (bpf_bpfd_cnt == 0)
 2314                 return (SYSCTL_OUT(req, 0, 0));
 2315         xbdbuf = malloc(req->oldlen, M_BPF, M_WAITOK);
 2316         mtx_lock(&bpf_mtx);
 2317         if (req->oldlen < (bpf_bpfd_cnt * sizeof(*xbd))) {
 2318                 mtx_unlock(&bpf_mtx);
 2319                 free(xbdbuf, M_BPF);
 2320                 return (ENOMEM);
 2321         }
 2322         index = 0;
 2323         LIST_FOREACH(bp, &bpf_iflist, bif_next) {
 2324                 BPFIF_LOCK(bp);
 2325                 LIST_FOREACH(bd, &bp->bif_dlist, bd_next) {
 2326                         xbd = &xbdbuf[index++];
 2327                         BPFD_LOCK(bd);
 2328                         bpfstats_fill_xbpf(xbd, bd);
 2329                         BPFD_UNLOCK(bd);
 2330                 }
 2331                 BPFIF_UNLOCK(bp);
 2332         }
 2333         mtx_unlock(&bpf_mtx);
 2334         error = SYSCTL_OUT(req, xbdbuf, index * sizeof(*xbd));
 2335         free(xbdbuf, M_BPF);
 2336         return (error);
 2337 }
 2338 
 2339 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL);
 2340 
 2341 #else /* !DEV_BPF && !NETGRAPH_BPF */
 2342 /*
 2343  * NOP stubs to allow bpf-using drivers to load and function.
 2344  *
 2345  * A 'better' implementation would allow the core bpf functionality
 2346  * to be loaded at runtime.
 2347  */
 2348 static struct bpf_if bp_null;
 2349 
 2350 void
 2351 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
 2352 {
 2353 }
 2354 
 2355 void
 2356 bpf_mtap(struct bpf_if *bp, struct mbuf *m)
 2357 {
 2358 }
 2359 
 2360 void
 2361 bpf_mtap2(struct bpf_if *bp, void *d, u_int l, struct mbuf *m)
 2362 {
 2363 }
 2364 
 2365 void
 2366 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
 2367 {
 2368 
 2369         bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
 2370 }
 2371 
 2372 void
 2373 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
 2374 {
 2375 
 2376         *driverp = &bp_null;
 2377 }
 2378 
 2379 void
 2380 bpfdetach(struct ifnet *ifp)
 2381 {
 2382 }
 2383 
 2384 u_int
 2385 bpf_filter(const struct bpf_insn *pc, u_char *p, u_int wirelen, u_int buflen)
 2386 {
 2387         return -1;      /* "no filter" behaviour */
 2388 }
 2389 
 2390 int
 2391 bpf_validate(const struct bpf_insn *f, int len)
 2392 {
 2393         return 0;               /* false */
 2394 }
 2395 
 2396 #endif /* !DEV_BPF && !NETGRAPH_BPF */

Cache object: d21c210648208d9b96fdeae4eee41fac


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.