Home | History | Annotate | Line # | Download | only in net
bpf.c revision 1.109
      1 /*	$NetBSD: bpf.c,v 1.109 2005/06/22 10:36:16 peter Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1990, 1991, 1993
      5  *	The Regents of the University of California.  All rights reserved.
      6  *
      7  * This code is derived from the Stanford/CMU enet packet filter,
      8  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
      9  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
     10  * Berkeley Laboratory.
     11  *
     12  * Redistribution and use in source and binary forms, with or without
     13  * modification, are permitted provided that the following conditions
     14  * are met:
     15  * 1. Redistributions of source code must retain the above copyright
     16  *    notice, this list of conditions and the following disclaimer.
     17  * 2. Redistributions in binary form must reproduce the above copyright
     18  *    notice, this list of conditions and the following disclaimer in the
     19  *    documentation and/or other materials provided with the distribution.
     20  * 3. Neither the name of the University nor the names of its contributors
     21  *    may be used to endorse or promote products derived from this software
     22  *    without specific prior written permission.
     23  *
     24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     34  * SUCH DAMAGE.
     35  *
     36  *	@(#)bpf.c	8.4 (Berkeley) 1/9/95
     37  * static char rcsid[] =
     38  * "Header: bpf.c,v 1.67 96/09/26 22:00:52 leres Exp ";
     39  */
     40 
     41 #include <sys/cdefs.h>
     42 __KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.109 2005/06/22 10:36:16 peter Exp $");
     43 
     44 #include <sys/param.h>
     45 #include <sys/systm.h>
     46 #include <sys/mbuf.h>
     47 #include <sys/buf.h>
     48 #include <sys/time.h>
     49 #include <sys/proc.h>
     50 #include <sys/user.h>
     51 #include <sys/ioctl.h>
     52 #include <sys/conf.h>
     53 #include <sys/vnode.h>
     54 #include <sys/queue.h>
     55 
     56 #include <sys/file.h>
     57 #include <sys/filedesc.h>
     58 #include <sys/tty.h>
     59 #include <sys/uio.h>
     60 
     61 #include <sys/protosw.h>
     62 #include <sys/socket.h>
     63 #include <sys/errno.h>
     64 #include <sys/kernel.h>
     65 #include <sys/poll.h>
     66 #include <sys/sysctl.h>
     67 
     68 #include <net/if.h>
     69 #include <net/slip.h>
     70 
     71 #include <net/bpf.h>
     72 #include <net/bpfdesc.h>
     73 
     74 #include <net/if_arc.h>
     75 #include <net/if_ether.h>
     76 
     77 #include <netinet/in.h>
     78 #include <netinet/if_inarp.h>
     79 
     80 #if defined(_KERNEL_OPT)
     81 #include "opt_bpf.h"
     82 #include "sl.h"
     83 #include "strip.h"
     84 #endif
     85 
     86 #ifndef BPF_BUFSIZE
     87 /*
     88  * 4096 is too small for FDDI frames. 8192 is too small for gigabit Ethernet
     89  * jumbos (circa 9k), ATM, or Intel gig/10gig ethernet jumbos (16k).
     90  */
     91 # define BPF_BUFSIZE 32768
     92 #endif
     93 
     94 #define PRINET  26			/* interruptible */
     95 
     96 /*
     97  * The default read buffer size, and limit for BIOCSBLEN, is sysctl'able.
     98  * XXX the default values should be computed dynamically based
     99  * on available memory size and available mbuf clusters.
    100  */
    101 int bpf_bufsize = BPF_BUFSIZE;
    102 int bpf_maxbufsize = BPF_DFLTBUFSIZE;	/* XXX set dynamically, see above */
    103 
    104 /*
    105  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
    106  *  bpf_dtab holds the descriptors, indexed by minor device #
    107  */
    108 struct bpf_if	*bpf_iflist;
    109 LIST_HEAD(, bpf_d) bpf_list;
    110 
    111 static int	bpf_allocbufs(struct bpf_d *);
    112 static void	bpf_deliver(struct bpf_if *,
    113 		            void *(*cpfn)(void *, const void *, size_t),
    114 			    void *, u_int, u_int, struct ifnet *);
    115 static void	bpf_freed(struct bpf_d *);
    116 static void	bpf_ifname(struct ifnet *, struct ifreq *);
    117 static void	*bpf_mcpy(void *, const void *, size_t);
    118 static int	bpf_movein(struct uio *, int, int,
    119 			        struct mbuf **, struct sockaddr *);
    120 static void	bpf_attachd(struct bpf_d *, struct bpf_if *);
    121 static void	bpf_detachd(struct bpf_d *);
    122 static int	bpf_setif(struct bpf_d *, struct ifreq *);
    123 static void	bpf_timed_out(void *);
    124 static __inline void
    125 		bpf_wakeup(struct bpf_d *);
    126 static void	catchpacket(struct bpf_d *, u_char *, u_int, u_int,
    127 				 void *(*)(void *, const void *, size_t));
    128 static void	reset_d(struct bpf_d *);
    129 static int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
    130 static int	bpf_setdlt(struct bpf_d *, u_int);
    131 
    132 static int	bpf_read(struct file *, off_t *, struct uio *, struct ucred *,
    133     int);
    134 static int	bpf_write(struct file *, off_t *, struct uio *, struct ucred *,
    135     int);
    136 static int	bpf_ioctl(struct file *, u_long, void *, struct proc *);
    137 static int	bpf_poll(struct file *, int, struct proc *);
    138 static int	bpf_close(struct file *, struct proc *);
    139 static int	bpf_kqfilter(struct file *, struct knote *);
    140 
    141 static const struct fileops bpf_fileops = {
    142 	bpf_read,
    143 	bpf_write,
    144 	bpf_ioctl,
    145 	fnullop_fcntl,
    146 	bpf_poll,
    147 	fbadop_stat,
    148 	bpf_close,
    149 	bpf_kqfilter,
    150 };
    151 
    152 dev_type_open(bpfopen);
    153 
    154 const struct cdevsw bpf_cdevsw = {
    155 	bpfopen, noclose, noread, nowrite, noioctl,
    156 	nostop, notty, nopoll, nommap, nokqfilter,
    157 };
    158 
    159 static int
    160 bpf_movein(uio, linktype, mtu, mp, sockp)
    161 	struct uio *uio;
    162 	int linktype;
    163 	int mtu;
    164 	struct mbuf **mp;
    165 	struct sockaddr *sockp;
    166 {
    167 	struct mbuf *m;
    168 	int error;
    169 	int len;
    170 	int hlen;
    171 	int align;
    172 
    173 	/*
    174 	 * Build a sockaddr based on the data link layer type.
    175 	 * We do this at this level because the ethernet header
    176 	 * is copied directly into the data field of the sockaddr.
    177 	 * In the case of SLIP, there is no header and the packet
    178 	 * is forwarded as is.
    179 	 * Also, we are careful to leave room at the front of the mbuf
    180 	 * for the link level header.
    181 	 */
    182 	switch (linktype) {
    183 
    184 	case DLT_SLIP:
    185 		sockp->sa_family = AF_INET;
    186 		hlen = 0;
    187 		align = 0;
    188 		break;
    189 
    190 	case DLT_PPP:
    191 		sockp->sa_family = AF_UNSPEC;
    192 		hlen = 0;
    193 		align = 0;
    194 		break;
    195 
    196 	case DLT_EN10MB:
    197 		sockp->sa_family = AF_UNSPEC;
    198 		/* XXX Would MAXLINKHDR be better? */
    199  		/* 6(dst)+6(src)+2(type) */
    200 		hlen = sizeof(struct ether_header);
    201 		align = 2;
    202 		break;
    203 
    204 	case DLT_ARCNET:
    205 		sockp->sa_family = AF_UNSPEC;
    206 		hlen = ARC_HDRLEN;
    207 		align = 5;
    208 		break;
    209 
    210 	case DLT_FDDI:
    211 		sockp->sa_family = AF_LINK;
    212 		/* XXX 4(FORMAC)+6(dst)+6(src) */
    213 		hlen = 16;
    214 		align = 0;
    215 		break;
    216 
    217 	case DLT_ECONET:
    218 		sockp->sa_family = AF_UNSPEC;
    219 		hlen = 6;
    220 		align = 2;
    221 		break;
    222 
    223 	case DLT_NULL:
    224 		sockp->sa_family = AF_UNSPEC;
    225 		hlen = 0;
    226 		align = 0;
    227 		break;
    228 
    229 	default:
    230 		return (EIO);
    231 	}
    232 
    233 	len = uio->uio_resid;
    234 	/*
    235 	 * If there aren't enough bytes for a link level header or the
    236 	 * packet length exceeds the interface mtu, return an error.
    237 	 */
    238 	if (len < hlen || len - hlen > mtu)
    239 		return (EMSGSIZE);
    240 
    241 	/*
    242 	 * XXX Avoid complicated buffer chaining ---
    243 	 * bail if it won't fit in a single mbuf.
    244 	 * (Take into account possible alignment bytes)
    245 	 */
    246 	if ((unsigned)len > MCLBYTES - align)
    247 		return (EIO);
    248 
    249 	m = m_gethdr(M_WAIT, MT_DATA);
    250 	m->m_pkthdr.rcvif = 0;
    251 	m->m_pkthdr.len = len - hlen;
    252 	if (len > MHLEN - align) {
    253 		m_clget(m, M_WAIT);
    254 		if ((m->m_flags & M_EXT) == 0) {
    255 			error = ENOBUFS;
    256 			goto bad;
    257 		}
    258 	}
    259 
    260 	/* Insure the data is properly aligned */
    261 	if (align > 0) {
    262 		m->m_data += align;
    263 		m->m_len -= align;
    264 	}
    265 
    266 	error = uiomove(mtod(m, void *), len, uio);
    267 	if (error)
    268 		goto bad;
    269 	if (hlen != 0) {
    270 		memcpy(sockp->sa_data, mtod(m, void *), hlen);
    271 		m->m_data += hlen; /* XXX */
    272 		len -= hlen;
    273 	}
    274 	m->m_len = len;
    275 	*mp = m;
    276 	return (0);
    277 
    278 bad:
    279 	m_freem(m);
    280 	return (error);
    281 }
    282 
    283 /*
    284  * Attach file to the bpf interface, i.e. make d listen on bp.
    285  * Must be called at splnet.
    286  */
    287 static void
    288 bpf_attachd(d, bp)
    289 	struct bpf_d *d;
    290 	struct bpf_if *bp;
    291 {
    292 	/*
    293 	 * Point d at bp, and add d to the interface's list of listeners.
    294 	 * Finally, point the driver's bpf cookie at the interface so
    295 	 * it will divert packets to bpf.
    296 	 */
    297 	d->bd_bif = bp;
    298 	d->bd_next = bp->bif_dlist;
    299 	bp->bif_dlist = d;
    300 
    301 	*bp->bif_driverp = bp;
    302 }
    303 
    304 /*
    305  * Detach a file from its interface.
    306  */
    307 static void
    308 bpf_detachd(d)
    309 	struct bpf_d *d;
    310 {
    311 	struct bpf_d **p;
    312 	struct bpf_if *bp;
    313 
    314 	bp = d->bd_bif;
    315 	/*
    316 	 * Check if this descriptor had requested promiscuous mode.
    317 	 * If so, turn it off.
    318 	 */
    319 	if (d->bd_promisc) {
    320 		int error;
    321 
    322 		d->bd_promisc = 0;
    323 		/*
    324 		 * Take device out of promiscuous mode.  Since we were
    325 		 * able to enter promiscuous mode, we should be able
    326 		 * to turn it off.  But we can get an error if
    327 		 * the interface was configured down, so only panic
    328 		 * if we don't get an unexpected error.
    329 		 */
    330   		error = ifpromisc(bp->bif_ifp, 0);
    331 		if (error && error != EINVAL)
    332 			panic("bpf: ifpromisc failed");
    333 	}
    334 	/* Remove d from the interface's descriptor list. */
    335 	p = &bp->bif_dlist;
    336 	while (*p != d) {
    337 		p = &(*p)->bd_next;
    338 		if (*p == 0)
    339 			panic("bpf_detachd: descriptor not in list");
    340 	}
    341 	*p = (*p)->bd_next;
    342 	if (bp->bif_dlist == 0)
    343 		/*
    344 		 * Let the driver know that there are no more listeners.
    345 		 */
    346 		*d->bd_bif->bif_driverp = 0;
    347 	d->bd_bif = 0;
    348 }
    349 
    350 
    351 /*
    352  * Mark a descriptor free by making it point to itself.
    353  * This is probably cheaper than marking with a constant since
    354  * the address should be in a register anyway.
    355  */
    356 
    357 /*
    358  * bpfilterattach() is called at boot time.
    359  */
    360 /* ARGSUSED */
    361 void
    362 bpfilterattach(n)
    363 	int n;
    364 {
    365 	LIST_INIT(&bpf_list);
    366 }
    367 
    368 /*
    369  * Open ethernet device. Clones.
    370  */
    371 /* ARGSUSED */
    372 int
    373 bpfopen(dev, flag, mode, p)
    374 	dev_t dev;
    375 	int flag;
    376 	int mode;
    377 	struct proc *p;
    378 {
    379 	struct bpf_d *d;
    380 	struct file *fp;
    381 	int error, fd;
    382 
    383 	/* falloc() will use the descriptor for us. */
    384 	if ((error = falloc(p, &fp, &fd)) != 0)
    385 		return error;
    386 
    387 	d = malloc(sizeof(*d), M_DEVBUF, M_WAITOK);
    388 	(void)memset(d, 0, sizeof(*d));
    389 	d->bd_bufsize = bpf_bufsize;
    390 	d->bd_seesent = 1;
    391 	callout_init(&d->bd_callout);
    392 
    393 	LIST_INSERT_HEAD(&bpf_list, d, bd_list);
    394 
    395 	return fdclone(p, fp, fd, flag, &bpf_fileops, d);
    396 }
    397 
    398 /*
    399  * Close the descriptor by detaching it from its interface,
    400  * deallocating its buffers, and marking it free.
    401  */
    402 /* ARGSUSED */
    403 static int
    404 bpf_close(struct file *fp, struct proc *p)
    405 {
    406 	struct bpf_d *d = fp->f_data;
    407 	int s;
    408 
    409 	s = splnet();
    410 	if (d->bd_state == BPF_WAITING)
    411 		callout_stop(&d->bd_callout);
    412 	d->bd_state = BPF_IDLE;
    413 	if (d->bd_bif)
    414 		bpf_detachd(d);
    415 	splx(s);
    416 	bpf_freed(d);
    417 	LIST_REMOVE(d, bd_list);
    418 	free(d, M_DEVBUF);
    419 	fp->f_data = NULL;
    420 
    421 	return (0);
    422 }
    423 
    424 /*
    425  * Rotate the packet buffers in descriptor d.  Move the store buffer
    426  * into the hold slot, and the free buffer into the store slot.
    427  * Zero the length of the new store buffer.
    428  */
    429 #define ROTATE_BUFFERS(d) \
    430 	(d)->bd_hbuf = (d)->bd_sbuf; \
    431 	(d)->bd_hlen = (d)->bd_slen; \
    432 	(d)->bd_sbuf = (d)->bd_fbuf; \
    433 	(d)->bd_slen = 0; \
    434 	(d)->bd_fbuf = 0;
    435 /*
    436  *  bpfread - read next chunk of packets from buffers
    437  */
    438 static int
    439 bpf_read(struct file *fp, off_t *offp, struct uio *uio,
    440     struct ucred *cred, int flags)
    441 {
    442 	struct bpf_d *d = fp->f_data;
    443 	int timed_out;
    444 	int error;
    445 	int s;
    446 
    447 	/*
    448 	 * Restrict application to use a buffer the same size as
    449 	 * as kernel buffers.
    450 	 */
    451 	if (uio->uio_resid != d->bd_bufsize)
    452 		return (EINVAL);
    453 
    454 	s = splnet();
    455 	if (d->bd_state == BPF_WAITING)
    456 		callout_stop(&d->bd_callout);
    457 	timed_out = (d->bd_state == BPF_TIMED_OUT);
    458 	d->bd_state = BPF_IDLE;
    459 	/*
    460 	 * If the hold buffer is empty, then do a timed sleep, which
    461 	 * ends when the timeout expires or when enough packets
    462 	 * have arrived to fill the store buffer.
    463 	 */
    464 	while (d->bd_hbuf == 0) {
    465 		if (fp->f_flag & FNONBLOCK) {
    466 			if (d->bd_slen == 0) {
    467 				splx(s);
    468 				return (EWOULDBLOCK);
    469 			}
    470 			ROTATE_BUFFERS(d);
    471 			break;
    472 		}
    473 
    474 		if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
    475 			/*
    476 			 * A packet(s) either arrived since the previous
    477 			 * read or arrived while we were asleep.
    478 			 * Rotate the buffers and return what's here.
    479 			 */
    480 			ROTATE_BUFFERS(d);
    481 			break;
    482 		}
    483 		error = tsleep(d, PRINET|PCATCH, "bpf",
    484 				d->bd_rtout);
    485 		if (error == EINTR || error == ERESTART) {
    486 			splx(s);
    487 			return (error);
    488 		}
    489 		if (error == EWOULDBLOCK) {
    490 			/*
    491 			 * On a timeout, return what's in the buffer,
    492 			 * which may be nothing.  If there is something
    493 			 * in the store buffer, we can rotate the buffers.
    494 			 */
    495 			if (d->bd_hbuf)
    496 				/*
    497 				 * We filled up the buffer in between
    498 				 * getting the timeout and arriving
    499 				 * here, so we don't need to rotate.
    500 				 */
    501 				break;
    502 
    503 			if (d->bd_slen == 0) {
    504 				splx(s);
    505 				return (0);
    506 			}
    507 			ROTATE_BUFFERS(d);
    508 			break;
    509 		}
    510 		if (error != 0)
    511 			goto done;
    512 	}
    513 	/*
    514 	 * At this point, we know we have something in the hold slot.
    515 	 */
    516 	splx(s);
    517 
    518 	/*
    519 	 * Move data from hold buffer into user space.
    520 	 * We know the entire buffer is transferred since
    521 	 * we checked above that the read buffer is bpf_bufsize bytes.
    522 	 */
    523 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
    524 
    525 	s = splnet();
    526 	d->bd_fbuf = d->bd_hbuf;
    527 	d->bd_hbuf = 0;
    528 	d->bd_hlen = 0;
    529 done:
    530 	splx(s);
    531 	return (error);
    532 }
    533 
    534 
    535 /*
    536  * If there are processes sleeping on this descriptor, wake them up.
    537  */
    538 static __inline void
    539 bpf_wakeup(d)
    540 	struct bpf_d *d;
    541 {
    542 	wakeup(d);
    543 	if (d->bd_async)
    544 		fownsignal(d->bd_pgid, SIGIO, 0, 0, NULL);
    545 
    546 	selnotify(&d->bd_sel, 0);
    547 	/* XXX */
    548 	d->bd_sel.sel_pid = 0;
    549 }
    550 
    551 
    552 static void
    553 bpf_timed_out(arg)
    554 	void *arg;
    555 {
    556 	struct bpf_d *d = arg;
    557 	int s;
    558 
    559 	s = splnet();
    560 	if (d->bd_state == BPF_WAITING) {
    561 		d->bd_state = BPF_TIMED_OUT;
    562 		if (d->bd_slen != 0)
    563 			bpf_wakeup(d);
    564 	}
    565 	splx(s);
    566 }
    567 
    568 
    569 static int
    570 bpf_write(struct file *fp, off_t *offp, struct uio *uio,
    571     struct ucred *cred, int flags)
    572 {
    573 	struct bpf_d *d = fp->f_data;
    574 	struct ifnet *ifp;
    575 	struct mbuf *m;
    576 	int error, s;
    577 	static struct sockaddr_storage dst;
    578 
    579 	if (d->bd_bif == 0)
    580 		return (ENXIO);
    581 
    582 	ifp = d->bd_bif->bif_ifp;
    583 
    584 	if (uio->uio_resid == 0)
    585 		return (0);
    586 
    587 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp->if_mtu, &m,
    588 		(struct sockaddr *) &dst);
    589 	if (error)
    590 		return (error);
    591 
    592 	if (m->m_pkthdr.len > ifp->if_mtu) {
    593 		m_freem(m);
    594 		return (EMSGSIZE);
    595 	}
    596 
    597 	if (d->bd_hdrcmplt)
    598 		dst.ss_family = pseudo_AF_HDRCMPLT;
    599 
    600 	s = splsoftnet();
    601 	error = (*ifp->if_output)(ifp, m, (struct sockaddr *) &dst, NULL);
    602 	splx(s);
    603 	/*
    604 	 * The driver frees the mbuf.
    605 	 */
    606 	return (error);
    607 }
    608 
    609 /*
    610  * Reset a descriptor by flushing its packet buffer and clearing the
    611  * receive and drop counts.  Should be called at splnet.
    612  */
    613 static void
    614 reset_d(d)
    615 	struct bpf_d *d;
    616 {
    617 	if (d->bd_hbuf) {
    618 		/* Free the hold buffer. */
    619 		d->bd_fbuf = d->bd_hbuf;
    620 		d->bd_hbuf = 0;
    621 	}
    622 	d->bd_slen = 0;
    623 	d->bd_hlen = 0;
    624 	d->bd_rcount = 0;
    625 	d->bd_dcount = 0;
    626 	d->bd_ccount = 0;
    627 }
    628 
    629 #ifdef BPF_KERN_FILTER
    630 extern struct bpf_insn *bpf_tcp_filter;
    631 extern struct bpf_insn *bpf_udp_filter;
    632 #endif
    633 
    634 /*
    635  *  FIONREAD		Check for read packet available.
    636  *  BIOCGBLEN		Get buffer len [for read()].
    637  *  BIOCSETF		Set ethernet read filter.
    638  *  BIOCFLUSH		Flush read packet buffer.
    639  *  BIOCPROMISC		Put interface into promiscuous mode.
    640  *  BIOCGDLT		Get link layer type.
    641  *  BIOCGETIF		Get interface name.
    642  *  BIOCSETIF		Set interface.
    643  *  BIOCSRTIMEOUT	Set read timeout.
    644  *  BIOCGRTIMEOUT	Get read timeout.
    645  *  BIOCGSTATS		Get packet stats.
    646  *  BIOCIMMEDIATE	Set immediate mode.
    647  *  BIOCVERSION		Get filter language version.
    648  *  BIOGHDRCMPLT	Get "header already complete" flag.
    649  *  BIOSHDRCMPLT	Set "header already complete" flag.
    650  */
    651 /* ARGSUSED */
    652 static int
    653 bpf_ioctl(struct file *fp, u_long cmd, void *addr, struct proc *p)
    654 {
    655 	struct bpf_d *d = fp->f_data;
    656 	int s, error = 0;
    657 #ifdef BPF_KERN_FILTER
    658 	struct bpf_insn **p;
    659 #endif
    660 
    661 	s = splnet();
    662 	if (d->bd_state == BPF_WAITING)
    663 		callout_stop(&d->bd_callout);
    664 	d->bd_state = BPF_IDLE;
    665 	splx(s);
    666 
    667 	switch (cmd) {
    668 
    669 	default:
    670 		error = EINVAL;
    671 		break;
    672 
    673 	/*
    674 	 * Check for read packet available.
    675 	 */
    676 	case FIONREAD:
    677 		{
    678 			int n;
    679 
    680 			s = splnet();
    681 			n = d->bd_slen;
    682 			if (d->bd_hbuf)
    683 				n += d->bd_hlen;
    684 			splx(s);
    685 
    686 			*(int *)addr = n;
    687 			break;
    688 		}
    689 
    690 	/*
    691 	 * Get buffer len [for read()].
    692 	 */
    693 	case BIOCGBLEN:
    694 		*(u_int *)addr = d->bd_bufsize;
    695 		break;
    696 
    697 	/*
    698 	 * Set buffer length.
    699 	 */
    700 	case BIOCSBLEN:
    701 		if (d->bd_bif != 0)
    702 			error = EINVAL;
    703 		else {
    704 			u_int size = *(u_int *)addr;
    705 
    706 			if (size > bpf_maxbufsize)
    707 				*(u_int *)addr = size = bpf_maxbufsize;
    708 			else if (size < BPF_MINBUFSIZE)
    709 				*(u_int *)addr = size = BPF_MINBUFSIZE;
    710 			d->bd_bufsize = size;
    711 		}
    712 		break;
    713 
    714 	/*
    715 	 * Set link layer read filter.
    716 	 */
    717 	case BIOCSETF:
    718 		error = bpf_setf(d, addr);
    719 		break;
    720 
    721 #ifdef BPF_KERN_FILTER
    722 	/*
    723 	 * Set TCP or UDP reject filter.
    724 	 */
    725 	case BIOCSTCPF:
    726 	case BIOCSUDPF:
    727 		if (!suser()) {
    728 			error = EPERM;
    729 			break;
    730 		}
    731 
    732 		/* Validate and store filter */
    733 		error = bpf_setf(d, addr);
    734 
    735 		/* Free possible old filter */
    736 		if (cmd == BIOCSTCPF)
    737 			p = &bpf_tcp_filter;
    738 		else
    739 			p = &bpf_udp_filter;
    740 		if (*p != NULL)
    741 			free(*p, M_DEVBUF);
    742 
    743 		/* Steal new filter (noop if error) */
    744 		s = splnet();
    745 		*p = d->bd_filter;
    746 		d->bd_filter = NULL;
    747 		splx(s);
    748 		break;
    749 #endif
    750 
    751 	/*
    752 	 * Flush read packet buffer.
    753 	 */
    754 	case BIOCFLUSH:
    755 		s = splnet();
    756 		reset_d(d);
    757 		splx(s);
    758 		break;
    759 
    760 	/*
    761 	 * Put interface into promiscuous mode.
    762 	 */
    763 	case BIOCPROMISC:
    764 		if (d->bd_bif == 0) {
    765 			/*
    766 			 * No interface attached yet.
    767 			 */
    768 			error = EINVAL;
    769 			break;
    770 		}
    771 		s = splnet();
    772 		if (d->bd_promisc == 0) {
    773 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
    774 			if (error == 0)
    775 				d->bd_promisc = 1;
    776 		}
    777 		splx(s);
    778 		break;
    779 
    780 	/*
    781 	 * Get device parameters.
    782 	 */
    783 	case BIOCGDLT:
    784 		if (d->bd_bif == 0)
    785 			error = EINVAL;
    786 		else
    787 			*(u_int *)addr = d->bd_bif->bif_dlt;
    788 		break;
    789 
    790 	/*
    791 	 * Get a list of supported device parameters.
    792 	 */
    793 	case BIOCGDLTLIST:
    794 		if (d->bd_bif == 0)
    795 			error = EINVAL;
    796 		else
    797 			error = bpf_getdltlist(d, addr);
    798 		break;
    799 
    800 	/*
    801 	 * Set device parameters.
    802 	 */
    803 	case BIOCSDLT:
    804 		if (d->bd_bif == 0)
    805 			error = EINVAL;
    806 		else
    807 			error = bpf_setdlt(d, *(u_int *)addr);
    808 		break;
    809 
    810 	/*
    811 	 * Set interface name.
    812 	 */
    813 	case BIOCGETIF:
    814 		if (d->bd_bif == 0)
    815 			error = EINVAL;
    816 		else
    817 			bpf_ifname(d->bd_bif->bif_ifp, addr);
    818 		break;
    819 
    820 	/*
    821 	 * Set interface.
    822 	 */
    823 	case BIOCSETIF:
    824 		error = bpf_setif(d, addr);
    825 		break;
    826 
    827 	/*
    828 	 * Set read timeout.
    829 	 */
    830 	case BIOCSRTIMEOUT:
    831 		{
    832 			struct timeval *tv = addr;
    833 
    834 			/* Compute number of ticks. */
    835 			d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
    836 			if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
    837 				d->bd_rtout = 1;
    838 			break;
    839 		}
    840 
    841 	/*
    842 	 * Get read timeout.
    843 	 */
    844 	case BIOCGRTIMEOUT:
    845 		{
    846 			struct timeval *tv = addr;
    847 
    848 			tv->tv_sec = d->bd_rtout / hz;
    849 			tv->tv_usec = (d->bd_rtout % hz) * tick;
    850 			break;
    851 		}
    852 
    853 	/*
    854 	 * Get packet stats.
    855 	 */
    856 	case BIOCGSTATS:
    857 		{
    858 			struct bpf_stat *bs = addr;
    859 
    860 			bs->bs_recv = d->bd_rcount;
    861 			bs->bs_drop = d->bd_dcount;
    862 			bs->bs_capt = d->bd_ccount;
    863 			break;
    864 		}
    865 
    866 	case BIOCGSTATSOLD:
    867 		{
    868 			struct bpf_stat_old *bs = addr;
    869 
    870 			bs->bs_recv = d->bd_rcount;
    871 			bs->bs_drop = d->bd_dcount;
    872 			break;
    873 		}
    874 
    875 	/*
    876 	 * Set immediate mode.
    877 	 */
    878 	case BIOCIMMEDIATE:
    879 		d->bd_immediate = *(u_int *)addr;
    880 		break;
    881 
    882 	case BIOCVERSION:
    883 		{
    884 			struct bpf_version *bv = addr;
    885 
    886 			bv->bv_major = BPF_MAJOR_VERSION;
    887 			bv->bv_minor = BPF_MINOR_VERSION;
    888 			break;
    889 		}
    890 
    891 	case BIOCGHDRCMPLT:	/* get "header already complete" flag */
    892 		*(u_int *)addr = d->bd_hdrcmplt;
    893 		break;
    894 
    895 	case BIOCSHDRCMPLT:	/* set "header already complete" flag */
    896 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
    897 		break;
    898 
    899 	/*
    900 	 * Get "see sent packets" flag
    901 	 */
    902 	case BIOCGSEESENT:
    903 		*(u_int *)addr = d->bd_seesent;
    904 		break;
    905 
    906 	/*
    907 	 * Set "see sent" packets flag
    908 	 */
    909 	case BIOCSSEESENT:
    910 		d->bd_seesent = *(u_int *)addr;
    911 		break;
    912 
    913 	case FIONBIO:		/* Non-blocking I/O */
    914 		/*
    915 		 * No need to do anything special as we use IO_NDELAY in
    916 		 * bpfread() as an indication of whether or not to block
    917 		 * the read.
    918 		 */
    919 		break;
    920 
    921 	case FIOASYNC:		/* Send signal on receive packets */
    922 		d->bd_async = *(int *)addr;
    923 		break;
    924 
    925 	case TIOCSPGRP:		/* Process or group to send signals to */
    926 	case FIOSETOWN:
    927 		error = fsetown(p, &d->bd_pgid, cmd, addr);
    928 		break;
    929 
    930 	case TIOCGPGRP:
    931 	case FIOGETOWN:
    932 		error = fgetown(p, d->bd_pgid, cmd, addr);
    933 		break;
    934 	}
    935 	return (error);
    936 }
    937 
    938 /*
    939  * Set d's packet filter program to fp.  If this file already has a filter,
    940  * free it and replace it.  Returns EINVAL for bogus requests.
    941  */
    942 int
    943 bpf_setf(struct bpf_d *d, struct bpf_program *fp)
    944 {
    945 	struct bpf_insn *fcode, *old;
    946 	u_int flen, size;
    947 	int s;
    948 
    949 	old = d->bd_filter;
    950 	if (fp->bf_insns == 0) {
    951 		if (fp->bf_len != 0)
    952 			return (EINVAL);
    953 		s = splnet();
    954 		d->bd_filter = 0;
    955 		reset_d(d);
    956 		splx(s);
    957 		if (old != 0)
    958 			free(old, M_DEVBUF);
    959 		return (0);
    960 	}
    961 	flen = fp->bf_len;
    962 	if (flen > BPF_MAXINSNS)
    963 		return (EINVAL);
    964 
    965 	size = flen * sizeof(*fp->bf_insns);
    966 	fcode = malloc(size, M_DEVBUF, M_WAITOK);
    967 	if (copyin(fp->bf_insns, fcode, size) == 0 &&
    968 	    bpf_validate(fcode, (int)flen)) {
    969 		s = splnet();
    970 		d->bd_filter = fcode;
    971 		reset_d(d);
    972 		splx(s);
    973 		if (old != 0)
    974 			free(old, M_DEVBUF);
    975 
    976 		return (0);
    977 	}
    978 	free(fcode, M_DEVBUF);
    979 	return (EINVAL);
    980 }
    981 
    982 /*
    983  * Detach a file from its current interface (if attached at all) and attach
    984  * to the interface indicated by the name stored in ifr.
    985  * Return an errno or 0.
    986  */
    987 static int
    988 bpf_setif(struct bpf_d *d, struct ifreq *ifr)
    989 {
    990 	struct bpf_if *bp;
    991 	char *cp;
    992 	int unit_seen, i, s, error;
    993 
    994 	/*
    995 	 * Make sure the provided name has a unit number, and default
    996 	 * it to '0' if not specified.
    997 	 * XXX This is ugly ... do this differently?
    998 	 */
    999 	unit_seen = 0;
   1000 	cp = ifr->ifr_name;
   1001 	cp[sizeof(ifr->ifr_name) - 1] = '\0';	/* sanity */
   1002 	while (*cp++)
   1003 		if (*cp >= '0' && *cp <= '9')
   1004 			unit_seen = 1;
   1005 	if (!unit_seen) {
   1006 		/* Make sure to leave room for the '\0'. */
   1007 		for (i = 0; i < (IFNAMSIZ - 1); ++i) {
   1008 			if ((ifr->ifr_name[i] >= 'a' &&
   1009 			     ifr->ifr_name[i] <= 'z') ||
   1010 			    (ifr->ifr_name[i] >= 'A' &&
   1011 			     ifr->ifr_name[i] <= 'Z'))
   1012 				continue;
   1013 			ifr->ifr_name[i] = '0';
   1014 		}
   1015 	}
   1016 
   1017 	/*
   1018 	 * Look through attached interfaces for the named one.
   1019 	 */
   1020 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
   1021 		struct ifnet *ifp = bp->bif_ifp;
   1022 
   1023 		if (ifp == 0 ||
   1024 		    strcmp(ifp->if_xname, ifr->ifr_name) != 0)
   1025 			continue;
   1026 		/* skip additional entry */
   1027 		if (bp->bif_driverp != (struct bpf_if **)&ifp->if_bpf)
   1028 			continue;
   1029 		/*
   1030 		 * We found the requested interface.
   1031 		 * Allocate the packet buffers if we need to.
   1032 		 * If we're already attached to requested interface,
   1033 		 * just flush the buffer.
   1034 		 */
   1035 		if (d->bd_sbuf == 0) {
   1036 			error = bpf_allocbufs(d);
   1037 			if (error != 0)
   1038 				return (error);
   1039 		}
   1040 		s = splnet();
   1041 		if (bp != d->bd_bif) {
   1042 			if (d->bd_bif)
   1043 				/*
   1044 				 * Detach if attached to something else.
   1045 				 */
   1046 				bpf_detachd(d);
   1047 
   1048 			bpf_attachd(d, bp);
   1049 		}
   1050 		reset_d(d);
   1051 		splx(s);
   1052 		return (0);
   1053 	}
   1054 	/* Not found. */
   1055 	return (ENXIO);
   1056 }
   1057 
   1058 /*
   1059  * Copy the interface name to the ifreq.
   1060  */
   1061 static void
   1062 bpf_ifname(struct ifnet *ifp, struct ifreq *ifr)
   1063 {
   1064 	memcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
   1065 }
   1066 
   1067 /*
   1068  * Support for poll() system call
   1069  *
   1070  * Return true iff the specific operation will not block indefinitely - with
   1071  * the assumption that it is safe to positively acknowledge a request for the
   1072  * ability to write to the BPF device.
   1073  * Otherwise, return false but make a note that a selwakeup() must be done.
   1074  */
   1075 static int
   1076 bpf_poll(struct file *fp, int events, struct proc *p)
   1077 {
   1078 	struct bpf_d *d = fp->f_data;
   1079 	int s = splnet();
   1080 	int revents;
   1081 
   1082 	revents = events & (POLLOUT | POLLWRNORM);
   1083 	if (events & (POLLIN | POLLRDNORM)) {
   1084 		/*
   1085 		 * An imitation of the FIONREAD ioctl code.
   1086 		 */
   1087 		if ((d->bd_hlen != 0) ||
   1088 		    (d->bd_immediate && d->bd_slen != 0)) {
   1089 			revents |= events & (POLLIN | POLLRDNORM);
   1090 		} else if (d->bd_state == BPF_TIMED_OUT) {
   1091 			if (d->bd_slen != 0)
   1092 				revents |= events & (POLLIN | POLLRDNORM);
   1093 			else
   1094 				revents |= events & POLLIN;
   1095 		} else {
   1096 			selrecord(p, &d->bd_sel);
   1097 			/* Start the read timeout if necessary */
   1098 			if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
   1099 				callout_reset(&d->bd_callout, d->bd_rtout,
   1100 					      bpf_timed_out, d);
   1101 				d->bd_state = BPF_WAITING;
   1102 			}
   1103 		}
   1104 	}
   1105 
   1106 	splx(s);
   1107 	return (revents);
   1108 }
   1109 
   1110 static void
   1111 filt_bpfrdetach(struct knote *kn)
   1112 {
   1113 	struct bpf_d *d = kn->kn_hook;
   1114 	int s;
   1115 
   1116 	s = splnet();
   1117 	SLIST_REMOVE(&d->bd_sel.sel_klist, kn, knote, kn_selnext);
   1118 	splx(s);
   1119 }
   1120 
   1121 static int
   1122 filt_bpfread(struct knote *kn, long hint)
   1123 {
   1124 	struct bpf_d *d = kn->kn_hook;
   1125 
   1126 	kn->kn_data = d->bd_hlen;
   1127 	if (d->bd_immediate)
   1128 		kn->kn_data += d->bd_slen;
   1129 	return (kn->kn_data > 0);
   1130 }
   1131 
   1132 static const struct filterops bpfread_filtops =
   1133 	{ 1, NULL, filt_bpfrdetach, filt_bpfread };
   1134 
   1135 static int
   1136 bpf_kqfilter(struct file *fp, struct knote *kn)
   1137 {
   1138 	struct bpf_d *d = fp->f_data;
   1139 	struct klist *klist;
   1140 	int s;
   1141 
   1142 	switch (kn->kn_filter) {
   1143 	case EVFILT_READ:
   1144 		klist = &d->bd_sel.sel_klist;
   1145 		kn->kn_fop = &bpfread_filtops;
   1146 		break;
   1147 
   1148 	default:
   1149 		return (1);
   1150 	}
   1151 
   1152 	kn->kn_hook = d;
   1153 
   1154 	s = splnet();
   1155 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
   1156 	splx(s);
   1157 
   1158 	return (0);
   1159 }
   1160 
   1161 /*
   1162  * Incoming linkage from device drivers.  Process the packet pkt, of length
   1163  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
   1164  * by each process' filter, and if accepted, stashed into the corresponding
   1165  * buffer.
   1166  */
   1167 void
   1168 bpf_tap(void *arg, u_char *pkt, u_int pktlen)
   1169 {
   1170 	struct bpf_if *bp;
   1171 	struct bpf_d *d;
   1172 	u_int slen;
   1173 	/*
   1174 	 * Note that the ipl does not have to be raised at this point.
   1175 	 * The only problem that could arise here is that if two different
   1176 	 * interfaces shared any data.  This is not the case.
   1177 	 */
   1178 	bp = arg;
   1179 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
   1180 		++d->bd_rcount;
   1181 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
   1182 		if (slen != 0)
   1183 			catchpacket(d, pkt, pktlen, slen, memcpy);
   1184 	}
   1185 }
   1186 
   1187 /*
   1188  * Copy data from an mbuf chain into a buffer.  This code is derived
   1189  * from m_copydata in sys/uipc_mbuf.c.
   1190  */
   1191 static void *
   1192 bpf_mcpy(void *dst_arg, const void *src_arg, size_t len)
   1193 {
   1194 	const struct mbuf *m;
   1195 	u_int count;
   1196 	u_char *dst;
   1197 
   1198 	m = src_arg;
   1199 	dst = dst_arg;
   1200 	while (len > 0) {
   1201 		if (m == 0)
   1202 			panic("bpf_mcpy");
   1203 		count = min(m->m_len, len);
   1204 		memcpy(dst, mtod(m, void *), count);
   1205 		m = m->m_next;
   1206 		dst += count;
   1207 		len -= count;
   1208 	}
   1209 	return (dst_arg);
   1210 }
   1211 
   1212 /*
   1213  * Dispatch a packet to all the listeners on interface bp.
   1214  *
   1215  * marg    pointer to the packet, either a data buffer or an mbuf chain
   1216  * buflen  buffer length, if marg is a data buffer
   1217  * cpfn    a function that can copy marg into the listener's buffer
   1218  * pktlen  length of the packet
   1219  * rcvif   either NULL or the interface the packet came in on.
   1220  */
   1221 static __inline void
   1222 bpf_deliver(struct bpf_if *bp, void *(*cpfn)(void *, const void *, size_t),
   1223     void *marg, u_int pktlen, u_int buflen, struct ifnet *rcvif)
   1224 {
   1225 	u_int slen;
   1226 	struct bpf_d *d;
   1227 
   1228 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
   1229 		if (!d->bd_seesent && (rcvif == NULL))
   1230 			continue;
   1231 		++d->bd_rcount;
   1232 		slen = bpf_filter(d->bd_filter, marg, pktlen, buflen);
   1233 		if (slen != 0)
   1234 			catchpacket(d, marg, pktlen, slen, cpfn);
   1235 	}
   1236 }
   1237 
   1238 /*
   1239  * Incoming linkage from device drivers, when the head of the packet is in
   1240  * a buffer, and the tail is in an mbuf chain.
   1241  */
   1242 void
   1243 bpf_mtap2(void *arg, void *data, u_int dlen, struct mbuf *m)
   1244 {
   1245 	struct bpf_if *bp = arg;
   1246 	u_int pktlen;
   1247 	struct mbuf mb;
   1248 
   1249 	pktlen = m_length(m) + dlen;
   1250 
   1251 	/*
   1252 	 * Craft on-stack mbuf suitable for passing to bpf_filter.
   1253 	 * Note that we cut corners here; we only setup what's
   1254 	 * absolutely needed--this mbuf should never go anywhere else.
   1255 	 */
   1256 	(void)memset(&mb, 0, sizeof(mb));
   1257 	mb.m_next = m;
   1258 	mb.m_data = data;
   1259 	mb.m_len = dlen;
   1260 
   1261 	bpf_deliver(bp, bpf_mcpy, &mb, pktlen, 0, m->m_pkthdr.rcvif);
   1262 }
   1263 
   1264 /*
   1265  * Incoming linkage from device drivers, when packet is in an mbuf chain.
   1266  */
   1267 void
   1268 bpf_mtap(void *arg, struct mbuf *m)
   1269 {
   1270 	void *(*cpfn)(void *, const void *, size_t);
   1271 	struct bpf_if *bp = arg;
   1272 	u_int pktlen, buflen;
   1273 	void *marg;
   1274 
   1275 	pktlen = m_length(m);
   1276 
   1277 	if (pktlen == m->m_len) {
   1278 		cpfn = memcpy;
   1279 		marg = mtod(m, void *);
   1280 		buflen = pktlen;
   1281 	} else {
   1282 		cpfn = bpf_mcpy;
   1283 		marg = m;
   1284 		buflen = 0;
   1285 	}
   1286 
   1287 	bpf_deliver(bp, cpfn, marg, pktlen, buflen, m->m_pkthdr.rcvif);
   1288 }
   1289 
   1290 /*
   1291  * We need to prepend the address family as
   1292  * a four byte field.  Cons up a dummy header
   1293  * to pacify bpf.  This is safe because bpf
   1294  * will only read from the mbuf (i.e., it won't
   1295  * try to free it or keep a pointer a to it).
   1296  */
   1297 void
   1298 bpf_mtap_af(void *arg, u_int32_t af, struct mbuf *m)
   1299 {
   1300 	struct mbuf m0;
   1301 
   1302 	m0.m_flags = 0;
   1303 	m0.m_next = m;
   1304 	m0.m_len = 4;
   1305 	m0.m_data = (char *)&af;
   1306 
   1307 	bpf_mtap(arg, &m0);
   1308 }
   1309 
   1310 void
   1311 bpf_mtap_et(void *arg, u_int16_t et, struct mbuf *m)
   1312 {
   1313 	struct mbuf m0;
   1314 
   1315 	m0.m_flags = 0;
   1316 	m0.m_next = m;
   1317 	m0.m_len = 14;
   1318 	m0.m_data = m0.m_dat;
   1319 
   1320 	((u_int32_t *)m0.m_data)[0] = 0;
   1321 	((u_int32_t *)m0.m_data)[1] = 0;
   1322 	((u_int32_t *)m0.m_data)[2] = 0;
   1323 	((u_int16_t *)m0.m_data)[6] = et;
   1324 
   1325 	bpf_mtap(arg, &m0);
   1326 }
   1327 
   1328 #if NSL > 0 || NSTRIP > 0
   1329 /*
   1330  * Put the SLIP pseudo-"link header" in place.
   1331  * Note this M_PREPEND() should never fail,
   1332  * swince we know we always have enough space
   1333  * in the input buffer.
   1334  */
   1335 void
   1336 bpf_mtap_sl_in(void *arg, u_char *chdr, struct mbuf **m)
   1337 {
   1338 	int s;
   1339 	u_char *hp;
   1340 
   1341 	M_PREPEND(*m, SLIP_HDRLEN, M_DONTWAIT);
   1342 	if (*m == NULL)
   1343 		return;
   1344 
   1345 	hp = mtod(*m, u_char *);
   1346 	hp[SLX_DIR] = SLIPDIR_IN;
   1347 	(void)memcpy(&hp[SLX_CHDR], chdr, CHDR_LEN);
   1348 
   1349 	s = splnet();
   1350 	bpf_mtap(arg, *m);
   1351 	splx(s);
   1352 
   1353 	m_adj(*m, SLIP_HDRLEN);
   1354 }
   1355 
   1356 /*
   1357  * Put the SLIP pseudo-"link header" in
   1358  * place.  The compressed header is now
   1359  * at the beginning of the mbuf.
   1360  */
   1361 void
   1362 bpf_mtap_sl_out(void *arg, u_char *chdr, struct mbuf *m)
   1363 {
   1364 	struct mbuf m0;
   1365 	u_char *hp;
   1366 	int s;
   1367 
   1368 	m0.m_flags = 0;
   1369 	m0.m_next = m;
   1370 	m0.m_data = m0.m_dat;
   1371 	m0.m_len = SLIP_HDRLEN;
   1372 
   1373 	hp = mtod(&m0, u_char *);
   1374 
   1375 	hp[SLX_DIR] = SLIPDIR_OUT;
   1376 	(void)memcpy(&hp[SLX_CHDR], chdr, CHDR_LEN);
   1377 
   1378 	s = splnet();
   1379 	bpf_mtap(arg, &m0);
   1380 	splx(s);
   1381 	m_freem(m);
   1382 }
   1383 #endif
   1384 
   1385 /*
   1386  * Move the packet data from interface memory (pkt) into the
   1387  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
   1388  * otherwise 0.  "copy" is the routine called to do the actual data
   1389  * transfer.  memcpy is passed in to copy contiguous chunks, while
   1390  * bpf_mcpy is passed in to copy mbuf chains.  In the latter case,
   1391  * pkt is really an mbuf.
   1392  */
   1393 static void
   1394 catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
   1395     void *(*cpfn)(void *, const void *, size_t))
   1396 {
   1397 	struct bpf_hdr *hp;
   1398 	int totlen, curlen;
   1399 	int hdrlen = d->bd_bif->bif_hdrlen;
   1400 
   1401 	++d->bd_ccount;
   1402 	/*
   1403 	 * Figure out how many bytes to move.  If the packet is
   1404 	 * greater or equal to the snapshot length, transfer that
   1405 	 * much.  Otherwise, transfer the whole packet (unless
   1406 	 * we hit the buffer size limit).
   1407 	 */
   1408 	totlen = hdrlen + min(snaplen, pktlen);
   1409 	if (totlen > d->bd_bufsize)
   1410 		totlen = d->bd_bufsize;
   1411 
   1412 	/*
   1413 	 * Round up the end of the previous packet to the next longword.
   1414 	 */
   1415 	curlen = BPF_WORDALIGN(d->bd_slen);
   1416 	if (curlen + totlen > d->bd_bufsize) {
   1417 		/*
   1418 		 * This packet will overflow the storage buffer.
   1419 		 * Rotate the buffers if we can, then wakeup any
   1420 		 * pending reads.
   1421 		 */
   1422 		if (d->bd_fbuf == 0) {
   1423 			/*
   1424 			 * We haven't completed the previous read yet,
   1425 			 * so drop the packet.
   1426 			 */
   1427 			++d->bd_dcount;
   1428 			return;
   1429 		}
   1430 		ROTATE_BUFFERS(d);
   1431 		bpf_wakeup(d);
   1432 		curlen = 0;
   1433 	}
   1434 
   1435 	/*
   1436 	 * Append the bpf header.
   1437 	 */
   1438 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
   1439 	microtime(&hp->bh_tstamp);
   1440 	hp->bh_datalen = pktlen;
   1441 	hp->bh_hdrlen = hdrlen;
   1442 	/*
   1443 	 * Copy the packet data into the store buffer and update its length.
   1444 	 */
   1445 	(*cpfn)((u_char *)hp + hdrlen, pkt, (hp->bh_caplen = totlen - hdrlen));
   1446 	d->bd_slen = curlen + totlen;
   1447 
   1448 	/*
   1449 	 * Call bpf_wakeup after bd_slen has been updated so that kevent(2)
   1450 	 * will cause filt_bpfread() to be called with it adjusted.
   1451 	 */
   1452 	if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
   1453 		/*
   1454 		 * Immediate mode is set, or the read timeout has
   1455 		 * already expired during a select call.  A packet
   1456 		 * arrived, so the reader should be woken up.
   1457 		 */
   1458 		bpf_wakeup(d);
   1459 }
   1460 
   1461 /*
   1462  * Initialize all nonzero fields of a descriptor.
   1463  */
   1464 static int
   1465 bpf_allocbufs(struct bpf_d *d)
   1466 {
   1467 
   1468 	d->bd_fbuf = malloc(d->bd_bufsize, M_DEVBUF, M_NOWAIT);
   1469 	if (!d->bd_fbuf)
   1470 		return (ENOBUFS);
   1471 	d->bd_sbuf = malloc(d->bd_bufsize, M_DEVBUF, M_NOWAIT);
   1472 	if (!d->bd_sbuf) {
   1473 		free(d->bd_fbuf, M_DEVBUF);
   1474 		return (ENOBUFS);
   1475 	}
   1476 	d->bd_slen = 0;
   1477 	d->bd_hlen = 0;
   1478 	return (0);
   1479 }
   1480 
   1481 /*
   1482  * Free buffers currently in use by a descriptor.
   1483  * Called on close.
   1484  */
   1485 static void
   1486 bpf_freed(struct bpf_d *d)
   1487 {
   1488 	/*
   1489 	 * We don't need to lock out interrupts since this descriptor has
   1490 	 * been detached from its interface and it yet hasn't been marked
   1491 	 * free.
   1492 	 */
   1493 	if (d->bd_sbuf != 0) {
   1494 		free(d->bd_sbuf, M_DEVBUF);
   1495 		if (d->bd_hbuf != 0)
   1496 			free(d->bd_hbuf, M_DEVBUF);
   1497 		if (d->bd_fbuf != 0)
   1498 			free(d->bd_fbuf, M_DEVBUF);
   1499 	}
   1500 	if (d->bd_filter)
   1501 		free(d->bd_filter, M_DEVBUF);
   1502 }
   1503 
   1504 /*
   1505  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
   1506  * fixed size of the link header (variable length headers not yet supported).
   1507  */
   1508 void
   1509 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
   1510 {
   1511 
   1512 	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
   1513 }
   1514 
   1515 /*
   1516  * Attach additional dlt for a interface to bpf.  dlt is the link layer type;
   1517  * hdrlen is the fixed size of the link header for the specified dlt
   1518  * (variable length headers not yet supported).
   1519  */
   1520 void
   1521 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, void *driverp)
   1522 {
   1523 	struct bpf_if *bp;
   1524 	bp = malloc(sizeof(*bp), M_DEVBUF, M_DONTWAIT);
   1525 	if (bp == 0)
   1526 		panic("bpfattach");
   1527 
   1528 	bp->bif_dlist = 0;
   1529 	bp->bif_driverp = driverp;
   1530 	bp->bif_ifp = ifp;
   1531 	bp->bif_dlt = dlt;
   1532 
   1533 	bp->bif_next = bpf_iflist;
   1534 	bpf_iflist = bp;
   1535 
   1536 	*bp->bif_driverp = 0;
   1537 
   1538 	/*
   1539 	 * Compute the length of the bpf header.  This is not necessarily
   1540 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
   1541 	 * that the network layer header begins on a longword boundary (for
   1542 	 * performance reasons and to alleviate alignment restrictions).
   1543 	 */
   1544 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
   1545 
   1546 #if 0
   1547 	printf("bpf: %s attached\n", ifp->if_xname);
   1548 #endif
   1549 }
   1550 
   1551 /*
   1552  * Remove an interface from bpf.
   1553  */
   1554 void
   1555 bpfdetach(struct ifnet *ifp)
   1556 {
   1557 	struct bpf_if *bp, **pbp;
   1558 	struct bpf_d *d;
   1559 	int s;
   1560 
   1561 	/* Nuke the vnodes for any open instances */
   1562 	for (d = LIST_FIRST(&bpf_list); d != NULL; d = LIST_NEXT(d, bd_list)) {
   1563 		if (d->bd_bif != NULL && d->bd_bif->bif_ifp == ifp) {
   1564 			/*
   1565 			 * Detach the descriptor from an interface now.
   1566 			 * It will be free'ed later by close routine.
   1567 			 */
   1568 			s = splnet();
   1569 			d->bd_promisc = 0;	/* we can't touch device. */
   1570 			bpf_detachd(d);
   1571 			splx(s);
   1572 		}
   1573 	}
   1574 
   1575   again:
   1576 	for (bp = bpf_iflist, pbp = &bpf_iflist;
   1577 	     bp != NULL; pbp = &bp->bif_next, bp = bp->bif_next) {
   1578 		if (bp->bif_ifp == ifp) {
   1579 			*pbp = bp->bif_next;
   1580 			free(bp, M_DEVBUF);
   1581 			goto again;
   1582 		}
   1583 	}
   1584 }
   1585 
   1586 /*
   1587  * Change the data link type of a interface.
   1588  */
   1589 void
   1590 bpf_change_type(struct ifnet *ifp, u_int dlt, u_int hdrlen)
   1591 {
   1592 	struct bpf_if *bp;
   1593 
   1594 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
   1595 		if (bp->bif_driverp == (struct bpf_if **)&ifp->if_bpf)
   1596 			break;
   1597 	}
   1598 	if (bp == NULL)
   1599 		panic("bpf_change_type");
   1600 
   1601 	bp->bif_dlt = dlt;
   1602 
   1603 	/*
   1604 	 * Compute the length of the bpf header.  This is not necessarily
   1605 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
   1606 	 * that the network layer header begins on a longword boundary (for
   1607 	 * performance reasons and to alleviate alignment restrictions).
   1608 	 */
   1609 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
   1610 }
   1611 
   1612 /*
   1613  * Get a list of available data link type of the interface.
   1614  */
   1615 static int
   1616 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl)
   1617 {
   1618 	int n, error;
   1619 	struct ifnet *ifp;
   1620 	struct bpf_if *bp;
   1621 
   1622 	ifp = d->bd_bif->bif_ifp;
   1623 	n = 0;
   1624 	error = 0;
   1625 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
   1626 		if (bp->bif_ifp != ifp)
   1627 			continue;
   1628 		if (bfl->bfl_list != NULL) {
   1629 			if (n >= bfl->bfl_len)
   1630 				return ENOMEM;
   1631 			error = copyout(&bp->bif_dlt,
   1632 			    bfl->bfl_list + n, sizeof(u_int));
   1633 		}
   1634 		n++;
   1635 	}
   1636 	bfl->bfl_len = n;
   1637 	return error;
   1638 }
   1639 
   1640 /*
   1641  * Set the data link type of a BPF instance.
   1642  */
   1643 static int
   1644 bpf_setdlt(struct bpf_d *d, u_int dlt)
   1645 {
   1646 	int s, error, opromisc;
   1647 	struct ifnet *ifp;
   1648 	struct bpf_if *bp;
   1649 
   1650 	if (d->bd_bif->bif_dlt == dlt)
   1651 		return 0;
   1652 	ifp = d->bd_bif->bif_ifp;
   1653 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
   1654 		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
   1655 			break;
   1656 	}
   1657 	if (bp == NULL)
   1658 		return EINVAL;
   1659 	s = splnet();
   1660 	opromisc = d->bd_promisc;
   1661 	bpf_detachd(d);
   1662 	bpf_attachd(d, bp);
   1663 	reset_d(d);
   1664 	if (opromisc) {
   1665 		error = ifpromisc(bp->bif_ifp, 1);
   1666 		if (error)
   1667 			printf("%s: bpf_setdlt: ifpromisc failed (%d)\n",
   1668 			    bp->bif_ifp->if_xname, error);
   1669 		else
   1670 			d->bd_promisc = 1;
   1671 	}
   1672 	splx(s);
   1673 	return 0;
   1674 }
   1675 
   1676 static int
   1677 sysctl_net_bpf_maxbufsize(SYSCTLFN_ARGS)
   1678 {
   1679 	int newsize, error;
   1680 	struct sysctlnode node;
   1681 
   1682 	node = *rnode;
   1683 	node.sysctl_data = &newsize;
   1684 	newsize = bpf_maxbufsize;
   1685 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
   1686 	if (error || newp == NULL)
   1687 		return (error);
   1688 
   1689 	if (newsize < BPF_MINBUFSIZE || newsize > BPF_MAXBUFSIZE)
   1690 		return (EINVAL);
   1691 
   1692 	bpf_maxbufsize = newsize;
   1693 
   1694 	return (0);
   1695 }
   1696 
   1697 SYSCTL_SETUP(sysctl_net_bfp_setup, "sysctl net.bpf subtree setup")
   1698 {
   1699 	const struct sysctlnode *node;
   1700 
   1701 	sysctl_createv(clog, 0, NULL, NULL,
   1702 		       CTLFLAG_PERMANENT,
   1703 		       CTLTYPE_NODE, "net", NULL,
   1704 		       NULL, 0, NULL, 0,
   1705 		       CTL_NET, CTL_EOL);
   1706 
   1707 	node = NULL;
   1708 	sysctl_createv(clog, 0, NULL, &node,
   1709 		       CTLFLAG_PERMANENT,
   1710 		       CTLTYPE_NODE, "bpf",
   1711 		       SYSCTL_DESCR("BPF options"),
   1712 		       NULL, 0, NULL, 0,
   1713 		       CTL_NET, CTL_CREATE, CTL_EOL);
   1714 	if (node != NULL)
   1715 		sysctl_createv(clog, 0, NULL, NULL,
   1716 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1717 			CTLTYPE_INT, "maxbufsize",
   1718 			SYSCTL_DESCR("Maximum size for data capture buffer"),
   1719 			sysctl_net_bpf_maxbufsize, 0, &bpf_maxbufsize, 0,
   1720 			CTL_NET, node->sysctl_num, CTL_CREATE, CTL_EOL);
   1721 }
   1722