bpf.c revision 144389
1/*-
2 * Copyright (c) 1990, 1991, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * This code is derived from the Stanford/CMU enet packet filter,
6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8 * Berkeley Laboratory.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 * 4. Neither the name of the University nor the names of its contributors
19 *    may be used to endorse or promote products derived from this software
20 *    without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 *      @(#)bpf.c	8.4 (Berkeley) 1/9/95
35 *
36 * $FreeBSD: head/sys/net/bpf.c 144389 2005-03-31 12:19:44Z phk $
37 */
38
39#include "opt_bpf.h"
40#include "opt_mac.h"
41#include "opt_netgraph.h"
42
43#include <sys/types.h>
44#include <sys/param.h>
45#include <sys/systm.h>
46#include <sys/conf.h>
47#include <sys/fcntl.h>
48#include <sys/mac.h>
49#include <sys/malloc.h>
50#include <sys/mbuf.h>
51#include <sys/time.h>
52#include <sys/proc.h>
53#include <sys/signalvar.h>
54#include <sys/filio.h>
55#include <sys/sockio.h>
56#include <sys/ttycom.h>
57#include <sys/uio.h>
58
59#include <sys/event.h>
60#include <sys/file.h>
61#include <sys/poll.h>
62#include <sys/proc.h>
63
64#include <sys/socket.h>
65
66#include <net/if.h>
67#include <net/bpf.h>
68#include <net/bpfdesc.h>
69
70#include <netinet/in.h>
71#include <netinet/if_ether.h>
72#include <sys/kernel.h>
73#include <sys/sysctl.h>
74
75static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
76
77#if defined(DEV_BPF) || defined(NETGRAPH_BPF)
78
79#define PRINET  26			/* interruptible */
80
81/*
82 * The default read buffer size is patchable.
83 */
84static int bpf_bufsize = 4096;
85SYSCTL_INT(_debug, OID_AUTO, bpf_bufsize, CTLFLAG_RW,
86	&bpf_bufsize, 0, "");
87static int bpf_maxbufsize = BPF_MAXBUFSIZE;
88SYSCTL_INT(_debug, OID_AUTO, bpf_maxbufsize, CTLFLAG_RW,
89	&bpf_maxbufsize, 0, "");
90
91/*
92 * bpf_iflist is a list of BPF interface structures, each corresponding to a
93 * specific DLT.  The same network interface might have several BPF interface
94 * structures registered by different layers in the stack (i.e., 802.11
95 * frames, ethernet frames, etc).
96 */
97static LIST_HEAD(, bpf_if)	bpf_iflist;
98static struct mtx	bpf_mtx;		/* bpf global lock */
99
100static int	bpf_allocbufs(struct bpf_d *);
101static void	bpf_attachd(struct bpf_d *d, struct bpf_if *bp);
102static void	bpf_detachd(struct bpf_d *d);
103static void	bpf_freed(struct bpf_d *);
104static void	bpf_mcopy(const void *, void *, size_t);
105static int	bpf_movein(struct uio *, int,
106		    struct mbuf **, struct sockaddr *, int *);
107static int	bpf_setif(struct bpf_d *, struct ifreq *);
108static void	bpf_timed_out(void *);
109static __inline void
110		bpf_wakeup(struct bpf_d *);
111static void	catchpacket(struct bpf_d *, u_char *, u_int,
112		    u_int, void (*)(const void *, void *, size_t));
113static void	reset_d(struct bpf_d *);
114static int	 bpf_setf(struct bpf_d *, struct bpf_program *);
115static int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
116static int	bpf_setdlt(struct bpf_d *, u_int);
117static void	filt_bpfdetach(struct knote *);
118static int	filt_bpfread(struct knote *, long);
119
120static	d_open_t	bpfopen;
121static	d_close_t	bpfclose;
122static	d_read_t	bpfread;
123static	d_write_t	bpfwrite;
124static	d_ioctl_t	bpfioctl;
125static	d_poll_t	bpfpoll;
126static	d_kqfilter_t	bpfkqfilter;
127
128static struct cdevsw bpf_cdevsw = {
129	.d_version =	D_VERSION,
130	.d_flags =	D_NEEDGIANT,
131	.d_open =	bpfopen,
132	.d_close =	bpfclose,
133	.d_read =	bpfread,
134	.d_write =	bpfwrite,
135	.d_ioctl =	bpfioctl,
136	.d_poll =	bpfpoll,
137	.d_name =	"bpf",
138	.d_kqfilter =	bpfkqfilter,
139};
140
141static struct filterops bpfread_filtops =
142	{ 1, NULL, filt_bpfdetach, filt_bpfread };
143
144static int
145bpf_movein(uio, linktype, mp, sockp, datlen)
146	struct uio *uio;
147	int linktype, *datlen;
148	struct mbuf **mp;
149	struct sockaddr *sockp;
150{
151	struct mbuf *m;
152	int error;
153	int len;
154	int hlen;
155
156	/*
157	 * Build a sockaddr based on the data link layer type.
158	 * We do this at this level because the ethernet header
159	 * is copied directly into the data field of the sockaddr.
160	 * In the case of SLIP, there is no header and the packet
161	 * is forwarded as is.
162	 * Also, we are careful to leave room at the front of the mbuf
163	 * for the link level header.
164	 */
165	switch (linktype) {
166
167	case DLT_SLIP:
168		sockp->sa_family = AF_INET;
169		hlen = 0;
170		break;
171
172	case DLT_EN10MB:
173		sockp->sa_family = AF_UNSPEC;
174		/* XXX Would MAXLINKHDR be better? */
175		hlen = ETHER_HDR_LEN;
176		break;
177
178	case DLT_FDDI:
179		sockp->sa_family = AF_IMPLINK;
180		hlen = 0;
181		break;
182
183	case DLT_RAW:
184	case DLT_NULL:
185		sockp->sa_family = AF_UNSPEC;
186		hlen = 0;
187		break;
188
189	case DLT_ATM_RFC1483:
190		/*
191		 * en atm driver requires 4-byte atm pseudo header.
192		 * though it isn't standard, vpi:vci needs to be
193		 * specified anyway.
194		 */
195		sockp->sa_family = AF_UNSPEC;
196		hlen = 12;	/* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
197		break;
198
199	case DLT_PPP:
200		sockp->sa_family = AF_UNSPEC;
201		hlen = 4;	/* This should match PPP_HDRLEN */
202		break;
203
204	default:
205		return (EIO);
206	}
207
208	len = uio->uio_resid;
209	*datlen = len - hlen;
210	if ((unsigned)len > MCLBYTES)
211		return (EIO);
212
213	if (len > MHLEN) {
214		m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR);
215	} else {
216		MGETHDR(m, M_TRYWAIT, MT_DATA);
217	}
218	if (m == NULL)
219		return (ENOBUFS);
220	m->m_pkthdr.len = m->m_len = len;
221	m->m_pkthdr.rcvif = NULL;
222	*mp = m;
223
224	/*
225	 * Make room for link header.
226	 */
227	if (hlen != 0) {
228		m->m_pkthdr.len -= hlen;
229		m->m_len -= hlen;
230#if BSD >= 199103
231		m->m_data += hlen; /* XXX */
232#else
233		m->m_off += hlen;
234#endif
235		error = uiomove(sockp->sa_data, hlen, uio);
236		if (error)
237			goto bad;
238	}
239	error = uiomove(mtod(m, void *), len - hlen, uio);
240	if (!error)
241		return (0);
242bad:
243	m_freem(m);
244	return (error);
245}
246
247/*
248 * Attach file to the bpf interface, i.e. make d listen on bp.
249 */
250static void
251bpf_attachd(d, bp)
252	struct bpf_d *d;
253	struct bpf_if *bp;
254{
255	/*
256	 * Point d at bp, and add d to the interface's list of listeners.
257	 * Finally, point the driver's bpf cookie at the interface so
258	 * it will divert packets to bpf.
259	 */
260	BPFIF_LOCK(bp);
261	d->bd_bif = bp;
262	LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
263
264	*bp->bif_driverp = bp;
265	BPFIF_UNLOCK(bp);
266}
267
268/*
269 * Detach a file from its interface.
270 */
271static void
272bpf_detachd(d)
273	struct bpf_d *d;
274{
275	int error;
276	struct bpf_if *bp;
277	struct ifnet *ifp;
278
279	bp = d->bd_bif;
280	BPFIF_LOCK(bp);
281	BPFD_LOCK(d);
282	ifp = d->bd_bif->bif_ifp;
283
284	/*
285	 * Remove d from the interface's descriptor list.
286	 */
287	LIST_REMOVE(d, bd_next);
288
289	/*
290	 * Let the driver know that there are no more listeners.
291	 */
292	if (LIST_EMPTY(&bp->bif_dlist))
293		*bp->bif_driverp = NULL;
294
295	d->bd_bif = NULL;
296	BPFD_UNLOCK(d);
297	BPFIF_UNLOCK(bp);
298
299	/*
300	 * Check if this descriptor had requested promiscuous mode.
301	 * If so, turn it off.
302	 */
303	if (d->bd_promisc) {
304		d->bd_promisc = 0;
305		error = ifpromisc(ifp, 0);
306		if (error != 0 && error != ENXIO) {
307			/*
308			 * ENXIO can happen if a pccard is unplugged
309			 * Something is really wrong if we were able to put
310			 * the driver into promiscuous mode, but can't
311			 * take it out.
312			 */
313			if_printf(bp->bif_ifp,
314				"bpf_detach: ifpromisc failed (%d)\n", error);
315		}
316	}
317}
318
319/*
320 * Open ethernet device.  Returns ENXIO for illegal minor device number,
321 * EBUSY if file is open by another process.
322 */
323/* ARGSUSED */
324static	int
325bpfopen(dev, flags, fmt, td)
326	struct cdev *dev;
327	int flags;
328	int fmt;
329	struct thread *td;
330{
331	struct bpf_d *d;
332
333	mtx_lock(&bpf_mtx);
334	d = dev->si_drv1;
335	/*
336	 * Each minor can be opened by only one process.  If the requested
337	 * minor is in use, return EBUSY.
338	 */
339	if (d != NULL) {
340		mtx_unlock(&bpf_mtx);
341		return (EBUSY);
342	}
343	dev->si_drv1 = (struct bpf_d *)~0;	/* mark device in use */
344	mtx_unlock(&bpf_mtx);
345
346	if ((dev->si_flags & SI_NAMED) == 0)
347		make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600,
348		    "bpf%d", dev2unit(dev));
349	MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK | M_ZERO);
350	dev->si_drv1 = d;
351	d->bd_bufsize = bpf_bufsize;
352	d->bd_sig = SIGIO;
353	d->bd_seesent = 1;
354#ifdef MAC
355	mac_init_bpfdesc(d);
356	mac_create_bpfdesc(td->td_ucred, d);
357#endif
358	mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
359	callout_init(&d->bd_callout, NET_CALLOUT_MPSAFE);
360	knlist_init(&d->bd_sel.si_note, &d->bd_mtx);
361
362	return (0);
363}
364
365/*
366 * Close the descriptor by detaching it from its interface,
367 * deallocating its buffers, and marking it free.
368 */
369/* ARGSUSED */
370static	int
371bpfclose(dev, flags, fmt, td)
372	struct cdev *dev;
373	int flags;
374	int fmt;
375	struct thread *td;
376{
377	struct bpf_d *d = dev->si_drv1;
378
379	BPFD_LOCK(d);
380	if (d->bd_state == BPF_WAITING)
381		callout_stop(&d->bd_callout);
382	d->bd_state = BPF_IDLE;
383	BPFD_UNLOCK(d);
384	funsetown(&d->bd_sigio);
385	mtx_lock(&bpf_mtx);
386	if (d->bd_bif)
387		bpf_detachd(d);
388	mtx_unlock(&bpf_mtx);
389	selwakeuppri(&d->bd_sel, PRINET);
390#ifdef MAC
391	mac_destroy_bpfdesc(d);
392#endif /* MAC */
393	knlist_destroy(&d->bd_sel.si_note);
394	bpf_freed(d);
395	dev->si_drv1 = NULL;
396	free(d, M_BPF);
397
398	return (0);
399}
400
401
402/*
403 * Rotate the packet buffers in descriptor d.  Move the store buffer
404 * into the hold slot, and the free buffer into the store slot.
405 * Zero the length of the new store buffer.
406 */
407#define ROTATE_BUFFERS(d) \
408	(d)->bd_hbuf = (d)->bd_sbuf; \
409	(d)->bd_hlen = (d)->bd_slen; \
410	(d)->bd_sbuf = (d)->bd_fbuf; \
411	(d)->bd_slen = 0; \
412	(d)->bd_fbuf = NULL;
413/*
414 *  bpfread - read next chunk of packets from buffers
415 */
416static	int
417bpfread(dev, uio, ioflag)
418	struct cdev *dev;
419	struct uio *uio;
420	int ioflag;
421{
422	struct bpf_d *d = dev->si_drv1;
423	int timed_out;
424	int error;
425
426	/*
427	 * Restrict application to use a buffer the same size as
428	 * as kernel buffers.
429	 */
430	if (uio->uio_resid != d->bd_bufsize)
431		return (EINVAL);
432
433	BPFD_LOCK(d);
434	if (d->bd_state == BPF_WAITING)
435		callout_stop(&d->bd_callout);
436	timed_out = (d->bd_state == BPF_TIMED_OUT);
437	d->bd_state = BPF_IDLE;
438	/*
439	 * If the hold buffer is empty, then do a timed sleep, which
440	 * ends when the timeout expires or when enough packets
441	 * have arrived to fill the store buffer.
442	 */
443	while (d->bd_hbuf == NULL) {
444		if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
445			/*
446			 * A packet(s) either arrived since the previous
447			 * read or arrived while we were asleep.
448			 * Rotate the buffers and return what's here.
449			 */
450			ROTATE_BUFFERS(d);
451			break;
452		}
453
454		/*
455		 * No data is available, check to see if the bpf device
456		 * is still pointed at a real interface.  If not, return
457		 * ENXIO so that the userland process knows to rebind
458		 * it before using it again.
459		 */
460		if (d->bd_bif == NULL) {
461			BPFD_UNLOCK(d);
462			return (ENXIO);
463		}
464
465		if (ioflag & O_NONBLOCK) {
466			BPFD_UNLOCK(d);
467			return (EWOULDBLOCK);
468		}
469		error = msleep(d, &d->bd_mtx, PRINET|PCATCH,
470		     "bpf", d->bd_rtout);
471		if (error == EINTR || error == ERESTART) {
472			BPFD_UNLOCK(d);
473			return (error);
474		}
475		if (error == EWOULDBLOCK) {
476			/*
477			 * On a timeout, return what's in the buffer,
478			 * which may be nothing.  If there is something
479			 * in the store buffer, we can rotate the buffers.
480			 */
481			if (d->bd_hbuf)
482				/*
483				 * We filled up the buffer in between
484				 * getting the timeout and arriving
485				 * here, so we don't need to rotate.
486				 */
487				break;
488
489			if (d->bd_slen == 0) {
490				BPFD_UNLOCK(d);
491				return (0);
492			}
493			ROTATE_BUFFERS(d);
494			break;
495		}
496	}
497	/*
498	 * At this point, we know we have something in the hold slot.
499	 */
500	BPFD_UNLOCK(d);
501
502	/*
503	 * Move data from hold buffer into user space.
504	 * We know the entire buffer is transferred since
505	 * we checked above that the read buffer is bpf_bufsize bytes.
506	 */
507	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
508
509	BPFD_LOCK(d);
510	d->bd_fbuf = d->bd_hbuf;
511	d->bd_hbuf = NULL;
512	d->bd_hlen = 0;
513	BPFD_UNLOCK(d);
514
515	return (error);
516}
517
518
519/*
520 * If there are processes sleeping on this descriptor, wake them up.
521 */
522static __inline void
523bpf_wakeup(d)
524	struct bpf_d *d;
525{
526	if (d->bd_state == BPF_WAITING) {
527		callout_stop(&d->bd_callout);
528		d->bd_state = BPF_IDLE;
529	}
530	wakeup(d);
531	if (d->bd_async && d->bd_sig && d->bd_sigio)
532		pgsigio(&d->bd_sigio, d->bd_sig, 0);
533
534	selwakeuppri(&d->bd_sel, PRINET);
535	KNOTE_LOCKED(&d->bd_sel.si_note, 0);
536}
537
538static void
539bpf_timed_out(arg)
540	void *arg;
541{
542	struct bpf_d *d = (struct bpf_d *)arg;
543
544	BPFD_LOCK(d);
545	if (d->bd_state == BPF_WAITING) {
546		d->bd_state = BPF_TIMED_OUT;
547		if (d->bd_slen != 0)
548			bpf_wakeup(d);
549	}
550	BPFD_UNLOCK(d);
551}
552
553static	int
554bpfwrite(dev, uio, ioflag)
555	struct cdev *dev;
556	struct uio *uio;
557	int ioflag;
558{
559	struct bpf_d *d = dev->si_drv1;
560	struct ifnet *ifp;
561	struct mbuf *m;
562	int error;
563	struct sockaddr dst;
564	int datlen;
565
566	if (d->bd_bif == NULL)
567		return (ENXIO);
568
569	ifp = d->bd_bif->bif_ifp;
570
571	if ((ifp->if_flags & IFF_UP) == 0)
572		return (ENETDOWN);
573
574	if (uio->uio_resid == 0)
575		return (0);
576
577	bzero(&dst, sizeof(dst));
578	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, &m, &dst, &datlen);
579	if (error)
580		return (error);
581
582	if (datlen > ifp->if_mtu) {
583		m_freem(m);
584		return (EMSGSIZE);
585	}
586
587	if (d->bd_hdrcmplt)
588		dst.sa_family = pseudo_AF_HDRCMPLT;
589
590#ifdef MAC
591	BPFD_LOCK(d);
592	mac_create_mbuf_from_bpfdesc(d, m);
593	BPFD_UNLOCK(d);
594#endif
595	NET_LOCK_GIANT();
596	error = (*ifp->if_output)(ifp, m, &dst, NULL);
597	NET_UNLOCK_GIANT();
598	/*
599	 * The driver frees the mbuf.
600	 */
601	return (error);
602}
603
604/*
605 * Reset a descriptor by flushing its packet buffer and clearing the
606 * receive and drop counts.
607 */
608static void
609reset_d(d)
610	struct bpf_d *d;
611{
612
613	mtx_assert(&d->bd_mtx, MA_OWNED);
614	if (d->bd_hbuf) {
615		/* Free the hold buffer. */
616		d->bd_fbuf = d->bd_hbuf;
617		d->bd_hbuf = NULL;
618	}
619	d->bd_slen = 0;
620	d->bd_hlen = 0;
621	d->bd_rcount = 0;
622	d->bd_dcount = 0;
623}
624
625/*
626 *  FIONREAD		Check for read packet available.
627 *  SIOCGIFADDR		Get interface address - convenient hook to driver.
628 *  BIOCGBLEN		Get buffer len [for read()].
629 *  BIOCSETF		Set ethernet read filter.
630 *  BIOCFLUSH		Flush read packet buffer.
631 *  BIOCPROMISC		Put interface into promiscuous mode.
632 *  BIOCGDLT		Get link layer type.
633 *  BIOCGETIF		Get interface name.
634 *  BIOCSETIF		Set interface.
635 *  BIOCSRTIMEOUT	Set read timeout.
636 *  BIOCGRTIMEOUT	Get read timeout.
637 *  BIOCGSTATS		Get packet stats.
638 *  BIOCIMMEDIATE	Set immediate mode.
639 *  BIOCVERSION		Get filter language version.
640 *  BIOCGHDRCMPLT	Get "header already complete" flag
641 *  BIOCSHDRCMPLT	Set "header already complete" flag
642 *  BIOCGSEESENT	Get "see packets sent" flag
643 *  BIOCSSEESENT	Set "see packets sent" flag
644 */
645/* ARGSUSED */
646static	int
647bpfioctl(dev, cmd, addr, flags, td)
648	struct cdev *dev;
649	u_long cmd;
650	caddr_t addr;
651	int flags;
652	struct thread *td;
653{
654	struct bpf_d *d = dev->si_drv1;
655	int error = 0;
656
657	BPFD_LOCK(d);
658	if (d->bd_state == BPF_WAITING)
659		callout_stop(&d->bd_callout);
660	d->bd_state = BPF_IDLE;
661	BPFD_UNLOCK(d);
662
663	switch (cmd) {
664
665	default:
666		error = EINVAL;
667		break;
668
669	/*
670	 * Check for read packet available.
671	 */
672	case FIONREAD:
673		{
674			int n;
675
676			BPFD_LOCK(d);
677			n = d->bd_slen;
678			if (d->bd_hbuf)
679				n += d->bd_hlen;
680			BPFD_UNLOCK(d);
681
682			*(int *)addr = n;
683			break;
684		}
685
686	case SIOCGIFADDR:
687		{
688			struct ifnet *ifp;
689
690			if (d->bd_bif == NULL)
691				error = EINVAL;
692			else {
693				ifp = d->bd_bif->bif_ifp;
694				error = (*ifp->if_ioctl)(ifp, cmd, addr);
695			}
696			break;
697		}
698
699	/*
700	 * Get buffer len [for read()].
701	 */
702	case BIOCGBLEN:
703		*(u_int *)addr = d->bd_bufsize;
704		break;
705
706	/*
707	 * Set buffer length.
708	 */
709	case BIOCSBLEN:
710		if (d->bd_bif != NULL)
711			error = EINVAL;
712		else {
713			u_int size = *(u_int *)addr;
714
715			if (size > bpf_maxbufsize)
716				*(u_int *)addr = size = bpf_maxbufsize;
717			else if (size < BPF_MINBUFSIZE)
718				*(u_int *)addr = size = BPF_MINBUFSIZE;
719			d->bd_bufsize = size;
720		}
721		break;
722
723	/*
724	 * Set link layer read filter.
725	 */
726	case BIOCSETF:
727		error = bpf_setf(d, (struct bpf_program *)addr);
728		break;
729
730	/*
731	 * Flush read packet buffer.
732	 */
733	case BIOCFLUSH:
734		BPFD_LOCK(d);
735		reset_d(d);
736		BPFD_UNLOCK(d);
737		break;
738
739	/*
740	 * Put interface into promiscuous mode.
741	 */
742	case BIOCPROMISC:
743		if (d->bd_bif == NULL) {
744			/*
745			 * No interface attached yet.
746			 */
747			error = EINVAL;
748			break;
749		}
750		if (d->bd_promisc == 0) {
751			mtx_lock(&Giant);
752			error = ifpromisc(d->bd_bif->bif_ifp, 1);
753			mtx_unlock(&Giant);
754			if (error == 0)
755				d->bd_promisc = 1;
756		}
757		break;
758
759	/*
760	 * Get current data link type.
761	 */
762	case BIOCGDLT:
763		if (d->bd_bif == NULL)
764			error = EINVAL;
765		else
766			*(u_int *)addr = d->bd_bif->bif_dlt;
767		break;
768
769	/*
770	 * Get a list of supported data link types.
771	 */
772	case BIOCGDLTLIST:
773		if (d->bd_bif == NULL)
774			error = EINVAL;
775		else
776			error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
777		break;
778
779	/*
780	 * Set data link type.
781	 */
782	case BIOCSDLT:
783		if (d->bd_bif == NULL)
784			error = EINVAL;
785		else
786			error = bpf_setdlt(d, *(u_int *)addr);
787		break;
788
789	/*
790	 * Get interface name.
791	 */
792	case BIOCGETIF:
793		if (d->bd_bif == NULL)
794			error = EINVAL;
795		else {
796			struct ifnet *const ifp = d->bd_bif->bif_ifp;
797			struct ifreq *const ifr = (struct ifreq *)addr;
798
799			strlcpy(ifr->ifr_name, ifp->if_xname,
800			    sizeof(ifr->ifr_name));
801		}
802		break;
803
804	/*
805	 * Set interface.
806	 */
807	case BIOCSETIF:
808		error = bpf_setif(d, (struct ifreq *)addr);
809		break;
810
811	/*
812	 * Set read timeout.
813	 */
814	case BIOCSRTIMEOUT:
815		{
816			struct timeval *tv = (struct timeval *)addr;
817
818			/*
819			 * Subtract 1 tick from tvtohz() since this isn't
820			 * a one-shot timer.
821			 */
822			if ((error = itimerfix(tv)) == 0)
823				d->bd_rtout = tvtohz(tv) - 1;
824			break;
825		}
826
827	/*
828	 * Get read timeout.
829	 */
830	case BIOCGRTIMEOUT:
831		{
832			struct timeval *tv = (struct timeval *)addr;
833
834			tv->tv_sec = d->bd_rtout / hz;
835			tv->tv_usec = (d->bd_rtout % hz) * tick;
836			break;
837		}
838
839	/*
840	 * Get packet stats.
841	 */
842	case BIOCGSTATS:
843		{
844			struct bpf_stat *bs = (struct bpf_stat *)addr;
845
846			bs->bs_recv = d->bd_rcount;
847			bs->bs_drop = d->bd_dcount;
848			break;
849		}
850
851	/*
852	 * Set immediate mode.
853	 */
854	case BIOCIMMEDIATE:
855		d->bd_immediate = *(u_int *)addr;
856		break;
857
858	case BIOCVERSION:
859		{
860			struct bpf_version *bv = (struct bpf_version *)addr;
861
862			bv->bv_major = BPF_MAJOR_VERSION;
863			bv->bv_minor = BPF_MINOR_VERSION;
864			break;
865		}
866
867	/*
868	 * Get "header already complete" flag
869	 */
870	case BIOCGHDRCMPLT:
871		*(u_int *)addr = d->bd_hdrcmplt;
872		break;
873
874	/*
875	 * Set "header already complete" flag
876	 */
877	case BIOCSHDRCMPLT:
878		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
879		break;
880
881	/*
882	 * Get "see sent packets" flag
883	 */
884	case BIOCGSEESENT:
885		*(u_int *)addr = d->bd_seesent;
886		break;
887
888	/*
889	 * Set "see sent packets" flag
890	 */
891	case BIOCSSEESENT:
892		d->bd_seesent = *(u_int *)addr;
893		break;
894
895	case FIONBIO:		/* Non-blocking I/O */
896		break;
897
898	case FIOASYNC:		/* Send signal on receive packets */
899		d->bd_async = *(int *)addr;
900		break;
901
902	case FIOSETOWN:
903		error = fsetown(*(int *)addr, &d->bd_sigio);
904		break;
905
906	case FIOGETOWN:
907		*(int *)addr = fgetown(&d->bd_sigio);
908		break;
909
910	/* This is deprecated, FIOSETOWN should be used instead. */
911	case TIOCSPGRP:
912		error = fsetown(-(*(int *)addr), &d->bd_sigio);
913		break;
914
915	/* This is deprecated, FIOGETOWN should be used instead. */
916	case TIOCGPGRP:
917		*(int *)addr = -fgetown(&d->bd_sigio);
918		break;
919
920	case BIOCSRSIG:		/* Set receive signal */
921		{
922			u_int sig;
923
924			sig = *(u_int *)addr;
925
926			if (sig >= NSIG)
927				error = EINVAL;
928			else
929				d->bd_sig = sig;
930			break;
931		}
932	case BIOCGRSIG:
933		*(u_int *)addr = d->bd_sig;
934		break;
935	}
936	return (error);
937}
938
939/*
940 * Set d's packet filter program to fp.  If this file already has a filter,
941 * free it and replace it.  Returns EINVAL for bogus requests.
942 */
943static int
944bpf_setf(d, fp)
945	struct bpf_d *d;
946	struct bpf_program *fp;
947{
948	struct bpf_insn *fcode, *old;
949	u_int flen, size;
950
951	if (fp->bf_insns == NULL) {
952		if (fp->bf_len != 0)
953			return (EINVAL);
954		BPFD_LOCK(d);
955		old = d->bd_filter;
956		d->bd_filter = NULL;
957		reset_d(d);
958		BPFD_UNLOCK(d);
959		if (old != NULL)
960			free((caddr_t)old, M_BPF);
961		return (0);
962	}
963	flen = fp->bf_len;
964	if (flen > BPF_MAXINSNS)
965		return (EINVAL);
966
967	size = flen * sizeof(*fp->bf_insns);
968	fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
969	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
970	    bpf_validate(fcode, (int)flen)) {
971		BPFD_LOCK(d);
972		old = d->bd_filter;
973		d->bd_filter = fcode;
974		reset_d(d);
975		BPFD_UNLOCK(d);
976		if (old != NULL)
977			free((caddr_t)old, M_BPF);
978
979		return (0);
980	}
981	free((caddr_t)fcode, M_BPF);
982	return (EINVAL);
983}
984
985/*
986 * Detach a file from its current interface (if attached at all) and attach
987 * to the interface indicated by the name stored in ifr.
988 * Return an errno or 0.
989 */
990static int
991bpf_setif(d, ifr)
992	struct bpf_d *d;
993	struct ifreq *ifr;
994{
995	struct bpf_if *bp;
996	int error;
997	struct ifnet *theywant;
998
999	theywant = ifunit(ifr->ifr_name);
1000	if (theywant == NULL)
1001		return ENXIO;
1002
1003	/*
1004	 * Look through attached interfaces for the named one.
1005	 */
1006	mtx_lock(&bpf_mtx);
1007	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1008		struct ifnet *ifp = bp->bif_ifp;
1009
1010		if (ifp == NULL || ifp != theywant)
1011			continue;
1012		/* skip additional entry */
1013		if (bp->bif_driverp != (struct bpf_if **)&ifp->if_bpf)
1014			continue;
1015
1016		mtx_unlock(&bpf_mtx);
1017		/*
1018		 * We found the requested interface.
1019		 * Allocate the packet buffers if we need to.
1020		 * If we're already attached to requested interface,
1021		 * just flush the buffer.
1022		 */
1023		if (d->bd_sbuf == NULL) {
1024			error = bpf_allocbufs(d);
1025			if (error != 0)
1026				return (error);
1027		}
1028		if (bp != d->bd_bif) {
1029			if (d->bd_bif)
1030				/*
1031				 * Detach if attached to something else.
1032				 */
1033				bpf_detachd(d);
1034
1035			bpf_attachd(d, bp);
1036		}
1037		BPFD_LOCK(d);
1038		reset_d(d);
1039		BPFD_UNLOCK(d);
1040		return (0);
1041	}
1042	mtx_unlock(&bpf_mtx);
1043	/* Not found. */
1044	return (ENXIO);
1045}
1046
1047/*
1048 * Support for select() and poll() system calls
1049 *
1050 * Return true iff the specific operation will not block indefinitely.
1051 * Otherwise, return false but make a note that a selwakeup() must be done.
1052 */
1053static int
1054bpfpoll(dev, events, td)
1055	struct cdev *dev;
1056	int events;
1057	struct thread *td;
1058{
1059	struct bpf_d *d;
1060	int revents;
1061
1062	d = dev->si_drv1;
1063	if (d->bd_bif == NULL)
1064		return (ENXIO);
1065
1066	revents = events & (POLLOUT | POLLWRNORM);
1067	BPFD_LOCK(d);
1068	if (events & (POLLIN | POLLRDNORM)) {
1069		if (bpf_ready(d))
1070			revents |= events & (POLLIN | POLLRDNORM);
1071		else {
1072			selrecord(td, &d->bd_sel);
1073			/* Start the read timeout if necessary. */
1074			if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1075				callout_reset(&d->bd_callout, d->bd_rtout,
1076				    bpf_timed_out, d);
1077				d->bd_state = BPF_WAITING;
1078			}
1079		}
1080	}
1081	BPFD_UNLOCK(d);
1082	return (revents);
1083}
1084
1085/*
1086 * Support for kevent() system call.  Register EVFILT_READ filters and
1087 * reject all others.
1088 */
1089int
1090bpfkqfilter(dev, kn)
1091	struct cdev *dev;
1092	struct knote *kn;
1093{
1094	struct bpf_d *d = (struct bpf_d *)dev->si_drv1;
1095
1096	if (kn->kn_filter != EVFILT_READ)
1097		return (1);
1098
1099	kn->kn_fop = &bpfread_filtops;
1100	kn->kn_hook = d;
1101	knlist_add(&d->bd_sel.si_note, kn, 0);
1102
1103	return (0);
1104}
1105
1106static void
1107filt_bpfdetach(kn)
1108	struct knote *kn;
1109{
1110	struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1111
1112	knlist_remove(&d->bd_sel.si_note, kn, 0);
1113}
1114
1115static int
1116filt_bpfread(kn, hint)
1117	struct knote *kn;
1118	long hint;
1119{
1120	struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1121	int ready;
1122
1123	BPFD_LOCK_ASSERT(d);
1124	ready = bpf_ready(d);
1125	if (ready) {
1126		kn->kn_data = d->bd_slen;
1127		if (d->bd_hbuf)
1128			kn->kn_data += d->bd_hlen;
1129	}
1130	else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1131		callout_reset(&d->bd_callout, d->bd_rtout,
1132		    bpf_timed_out, d);
1133		d->bd_state = BPF_WAITING;
1134	}
1135
1136	return (ready);
1137}
1138
1139/*
1140 * Incoming linkage from device drivers.  Process the packet pkt, of length
1141 * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1142 * by each process' filter, and if accepted, stashed into the corresponding
1143 * buffer.
1144 */
1145void
1146bpf_tap(bp, pkt, pktlen)
1147	struct bpf_if *bp;
1148	u_char *pkt;
1149	u_int pktlen;
1150{
1151	struct bpf_d *d;
1152	u_int slen;
1153
1154	/*
1155	 * Lockless read to avoid cost of locking the interface if there are
1156	 * no descriptors attached.
1157	 */
1158	if (LIST_EMPTY(&bp->bif_dlist))
1159		return;
1160
1161	BPFIF_LOCK(bp);
1162	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1163		BPFD_LOCK(d);
1164		++d->bd_rcount;
1165		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1166		if (slen != 0) {
1167#ifdef MAC
1168			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1169#endif
1170				catchpacket(d, pkt, pktlen, slen, bcopy);
1171		}
1172		BPFD_UNLOCK(d);
1173	}
1174	BPFIF_UNLOCK(bp);
1175}
1176
1177/*
1178 * Copy data from an mbuf chain into a buffer.  This code is derived
1179 * from m_copydata in sys/uipc_mbuf.c.
1180 */
1181static void
1182bpf_mcopy(src_arg, dst_arg, len)
1183	const void *src_arg;
1184	void *dst_arg;
1185	size_t len;
1186{
1187	const struct mbuf *m;
1188	u_int count;
1189	u_char *dst;
1190
1191	m = src_arg;
1192	dst = dst_arg;
1193	while (len > 0) {
1194		if (m == NULL)
1195			panic("bpf_mcopy");
1196		count = min(m->m_len, len);
1197		bcopy(mtod(m, void *), dst, count);
1198		m = m->m_next;
1199		dst += count;
1200		len -= count;
1201	}
1202}
1203
1204/*
1205 * Incoming linkage from device drivers, when packet is in an mbuf chain.
1206 */
1207void
1208bpf_mtap(bp, m)
1209	struct bpf_if *bp;
1210	struct mbuf *m;
1211{
1212	struct bpf_d *d;
1213	u_int pktlen, slen;
1214
1215	/*
1216	 * Lockless read to avoid cost of locking the interface if there are
1217	 * no descriptors attached.
1218	 */
1219	if (LIST_EMPTY(&bp->bif_dlist))
1220		return;
1221
1222	pktlen = m_length(m, NULL);
1223	if (pktlen == m->m_len) {
1224		bpf_tap(bp, mtod(m, u_char *), pktlen);
1225		return;
1226	}
1227
1228	BPFIF_LOCK(bp);
1229	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1230		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1231			continue;
1232		BPFD_LOCK(d);
1233		++d->bd_rcount;
1234		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1235		if (slen != 0)
1236#ifdef MAC
1237			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1238#endif
1239				catchpacket(d, (u_char *)m, pktlen, slen,
1240				    bpf_mcopy);
1241		BPFD_UNLOCK(d);
1242	}
1243	BPFIF_UNLOCK(bp);
1244}
1245
1246/*
1247 * Incoming linkage from device drivers, when packet is in
1248 * an mbuf chain and to be prepended by a contiguous header.
1249 */
1250void
1251bpf_mtap2(bp, data, dlen, m)
1252	struct bpf_if *bp;
1253	void *data;
1254	u_int dlen;
1255	struct mbuf *m;
1256{
1257	struct mbuf mb;
1258	struct bpf_d *d;
1259	u_int pktlen, slen;
1260
1261	/*
1262	 * Lockless read to avoid cost of locking the interface if there are
1263	 * no descriptors attached.
1264	 */
1265	if (LIST_EMPTY(&bp->bif_dlist))
1266		return;
1267
1268	pktlen = m_length(m, NULL);
1269	/*
1270	 * Craft on-stack mbuf suitable for passing to bpf_filter.
1271	 * Note that we cut corners here; we only setup what's
1272	 * absolutely needed--this mbuf should never go anywhere else.
1273	 */
1274	mb.m_next = m;
1275	mb.m_data = data;
1276	mb.m_len = dlen;
1277	pktlen += dlen;
1278
1279	BPFIF_LOCK(bp);
1280	LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1281		if (!d->bd_seesent && (m->m_pkthdr.rcvif == NULL))
1282			continue;
1283		BPFD_LOCK(d);
1284		++d->bd_rcount;
1285		slen = bpf_filter(d->bd_filter, (u_char *)&mb, pktlen, 0);
1286		if (slen != 0)
1287#ifdef MAC
1288			if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1289#endif
1290				catchpacket(d, (u_char *)&mb, pktlen, slen,
1291				    bpf_mcopy);
1292		BPFD_UNLOCK(d);
1293	}
1294	BPFIF_UNLOCK(bp);
1295}
1296
1297/*
1298 * Move the packet data from interface memory (pkt) into the
1299 * store buffer.  "cpfn" is the routine called to do the actual data
1300 * transfer.  bcopy is passed in to copy contiguous chunks, while
1301 * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1302 * pkt is really an mbuf.
1303 */
1304static void
1305catchpacket(d, pkt, pktlen, snaplen, cpfn)
1306	struct bpf_d *d;
1307	u_char *pkt;
1308	u_int pktlen, snaplen;
1309	void (*cpfn)(const void *, void *, size_t);
1310{
1311	struct bpf_hdr *hp;
1312	int totlen, curlen;
1313	int hdrlen = d->bd_bif->bif_hdrlen;
1314	int do_wakeup = 0;
1315
1316	/*
1317	 * Figure out how many bytes to move.  If the packet is
1318	 * greater or equal to the snapshot length, transfer that
1319	 * much.  Otherwise, transfer the whole packet (unless
1320	 * we hit the buffer size limit).
1321	 */
1322	totlen = hdrlen + min(snaplen, pktlen);
1323	if (totlen > d->bd_bufsize)
1324		totlen = d->bd_bufsize;
1325
1326	/*
1327	 * Round up the end of the previous packet to the next longword.
1328	 */
1329	curlen = BPF_WORDALIGN(d->bd_slen);
1330	if (curlen + totlen > d->bd_bufsize) {
1331		/*
1332		 * This packet will overflow the storage buffer.
1333		 * Rotate the buffers if we can, then wakeup any
1334		 * pending reads.
1335		 */
1336		if (d->bd_fbuf == NULL) {
1337			/*
1338			 * We haven't completed the previous read yet,
1339			 * so drop the packet.
1340			 */
1341			++d->bd_dcount;
1342			return;
1343		}
1344		ROTATE_BUFFERS(d);
1345		do_wakeup = 1;
1346		curlen = 0;
1347	}
1348	else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1349		/*
1350		 * Immediate mode is set, or the read timeout has
1351		 * already expired during a select call.  A packet
1352		 * arrived, so the reader should be woken up.
1353		 */
1354		do_wakeup = 1;
1355
1356	/*
1357	 * Append the bpf header.
1358	 */
1359	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1360	microtime(&hp->bh_tstamp);
1361	hp->bh_datalen = pktlen;
1362	hp->bh_hdrlen = hdrlen;
1363	/*
1364	 * Copy the packet data into the store buffer and update its length.
1365	 */
1366	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1367	d->bd_slen = curlen + totlen;
1368
1369	if (do_wakeup)
1370		bpf_wakeup(d);
1371}
1372
1373/*
1374 * Initialize all nonzero fields of a descriptor.
1375 */
1376static int
1377bpf_allocbufs(d)
1378	struct bpf_d *d;
1379{
1380	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1381	if (d->bd_fbuf == NULL)
1382		return (ENOBUFS);
1383
1384	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1385	if (d->bd_sbuf == NULL) {
1386		free(d->bd_fbuf, M_BPF);
1387		return (ENOBUFS);
1388	}
1389	d->bd_slen = 0;
1390	d->bd_hlen = 0;
1391	return (0);
1392}
1393
1394/*
1395 * Free buffers currently in use by a descriptor.
1396 * Called on close.
1397 */
1398static void
1399bpf_freed(d)
1400	struct bpf_d *d;
1401{
1402	/*
1403	 * We don't need to lock out interrupts since this descriptor has
1404	 * been detached from its interface and it yet hasn't been marked
1405	 * free.
1406	 */
1407	if (d->bd_sbuf != NULL) {
1408		free(d->bd_sbuf, M_BPF);
1409		if (d->bd_hbuf != NULL)
1410			free(d->bd_hbuf, M_BPF);
1411		if (d->bd_fbuf != NULL)
1412			free(d->bd_fbuf, M_BPF);
1413	}
1414	if (d->bd_filter)
1415		free((caddr_t)d->bd_filter, M_BPF);
1416	mtx_destroy(&d->bd_mtx);
1417}
1418
1419/*
1420 * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
1421 * fixed size of the link header (variable length headers not yet supported).
1422 */
1423void
1424bpfattach(ifp, dlt, hdrlen)
1425	struct ifnet *ifp;
1426	u_int dlt, hdrlen;
1427{
1428
1429	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1430}
1431
1432/*
1433 * Attach an interface to bpf.  ifp is a pointer to the structure
1434 * defining the interface to be attached, dlt is the link layer type,
1435 * and hdrlen is the fixed size of the link header (variable length
1436 * headers are not yet supporrted).
1437 */
1438void
1439bpfattach2(ifp, dlt, hdrlen, driverp)
1440	struct ifnet *ifp;
1441	u_int dlt, hdrlen;
1442	struct bpf_if **driverp;
1443{
1444	struct bpf_if *bp;
1445	bp = (struct bpf_if *)malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
1446	if (bp == NULL)
1447		panic("bpfattach");
1448
1449	LIST_INIT(&bp->bif_dlist);
1450	bp->bif_driverp = driverp;
1451	bp->bif_ifp = ifp;
1452	bp->bif_dlt = dlt;
1453	mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
1454
1455	mtx_lock(&bpf_mtx);
1456	LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next);
1457	mtx_unlock(&bpf_mtx);
1458
1459	*bp->bif_driverp = NULL;
1460
1461	/*
1462	 * Compute the length of the bpf header.  This is not necessarily
1463	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1464	 * that the network layer header begins on a longword boundary (for
1465	 * performance reasons and to alleviate alignment restrictions).
1466	 */
1467	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1468
1469	if (bootverbose)
1470		if_printf(ifp, "bpf attached\n");
1471}
1472
1473/*
1474 * Detach bpf from an interface.  This involves detaching each descriptor
1475 * associated with the interface, and leaving bd_bif NULL.  Notify each
1476 * descriptor as it's detached so that any sleepers wake up and get
1477 * ENXIO.
1478 */
1479void
1480bpfdetach(ifp)
1481	struct ifnet *ifp;
1482{
1483	struct bpf_if	*bp;
1484	struct bpf_d	*d;
1485
1486	/* Locate BPF interface information */
1487	mtx_lock(&bpf_mtx);
1488	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1489		if (ifp == bp->bif_ifp)
1490			break;
1491	}
1492
1493	/* Interface wasn't attached */
1494	if ((bp == NULL) || (bp->bif_ifp == NULL)) {
1495		mtx_unlock(&bpf_mtx);
1496		printf("bpfdetach: %s was not attached\n", ifp->if_xname);
1497		return;
1498	}
1499
1500	LIST_REMOVE(bp, bif_next);
1501	mtx_unlock(&bpf_mtx);
1502
1503	while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) {
1504		bpf_detachd(d);
1505		BPFD_LOCK(d);
1506		bpf_wakeup(d);
1507		BPFD_UNLOCK(d);
1508	}
1509
1510	mtx_destroy(&bp->bif_mtx);
1511	free(bp, M_BPF);
1512}
1513
1514/*
1515 * Get a list of available data link type of the interface.
1516 */
1517static int
1518bpf_getdltlist(d, bfl)
1519	struct bpf_d *d;
1520	struct bpf_dltlist *bfl;
1521{
1522	int n, error;
1523	struct ifnet *ifp;
1524	struct bpf_if *bp;
1525
1526	ifp = d->bd_bif->bif_ifp;
1527	n = 0;
1528	error = 0;
1529	mtx_lock(&bpf_mtx);
1530	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1531		if (bp->bif_ifp != ifp)
1532			continue;
1533		if (bfl->bfl_list != NULL) {
1534			if (n >= bfl->bfl_len) {
1535				mtx_unlock(&bpf_mtx);
1536				return (ENOMEM);
1537			}
1538			error = copyout(&bp->bif_dlt,
1539			    bfl->bfl_list + n, sizeof(u_int));
1540		}
1541		n++;
1542	}
1543	mtx_unlock(&bpf_mtx);
1544	bfl->bfl_len = n;
1545	return (error);
1546}
1547
1548/*
1549 * Set the data link type of a BPF instance.
1550 */
1551static int
1552bpf_setdlt(d, dlt)
1553	struct bpf_d *d;
1554	u_int dlt;
1555{
1556	int error, opromisc;
1557	struct ifnet *ifp;
1558	struct bpf_if *bp;
1559
1560	if (d->bd_bif->bif_dlt == dlt)
1561		return (0);
1562	ifp = d->bd_bif->bif_ifp;
1563	mtx_lock(&bpf_mtx);
1564	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1565		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1566			break;
1567	}
1568	mtx_unlock(&bpf_mtx);
1569	if (bp != NULL) {
1570		opromisc = d->bd_promisc;
1571		bpf_detachd(d);
1572		bpf_attachd(d, bp);
1573		BPFD_LOCK(d);
1574		reset_d(d);
1575		BPFD_UNLOCK(d);
1576		if (opromisc) {
1577			error = ifpromisc(bp->bif_ifp, 1);
1578			if (error)
1579				if_printf(bp->bif_ifp,
1580					"bpf_setdlt: ifpromisc failed (%d)\n",
1581					error);
1582			else
1583				d->bd_promisc = 1;
1584		}
1585	}
1586	return (bp == NULL ? EINVAL : 0);
1587}
1588
1589static void bpf_drvinit(void *unused);
1590
1591static void bpf_clone(void *arg, char *name, int namelen, struct cdev **dev);
1592
1593static void
1594bpf_clone(arg, name, namelen, dev)
1595	void *arg;
1596	char *name;
1597	int namelen;
1598	struct cdev **dev;
1599{
1600	int u;
1601
1602	if (*dev != NULL)
1603		return;
1604	if (dev_stdclone(name, NULL, "bpf", &u) != 1)
1605		return;
1606	*dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
1607	    "bpf%d", u);
1608	dev_ref(*dev);
1609	(*dev)->si_flags |= SI_CHEAPCLONE;
1610	return;
1611}
1612
1613static void
1614bpf_drvinit(unused)
1615	void *unused;
1616{
1617
1618	mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
1619	LIST_INIT(&bpf_iflist);
1620	EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000);
1621}
1622
1623SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL)
1624
1625#else /* !DEV_BPF && !NETGRAPH_BPF */
1626/*
1627 * NOP stubs to allow bpf-using drivers to load and function.
1628 *
1629 * A 'better' implementation would allow the core bpf functionality
1630 * to be loaded at runtime.
1631 */
1632
1633void
1634bpf_tap(bp, pkt, pktlen)
1635	struct bpf_if *bp;
1636	u_char *pkt;
1637	u_int pktlen;
1638{
1639}
1640
1641void
1642bpf_mtap(bp, m)
1643	struct bpf_if *bp;
1644	struct mbuf *m;
1645{
1646}
1647
1648void
1649bpf_mtap2(bp, d, l, m)
1650	struct bpf_if *bp;
1651	void *d;
1652	u_int l;
1653	struct mbuf *m;
1654{
1655}
1656
1657void
1658bpfattach(ifp, dlt, hdrlen)
1659	struct ifnet *ifp;
1660	u_int dlt, hdrlen;
1661{
1662}
1663
1664void
1665bpfattach2(ifp, dlt, hdrlen, driverp)
1666	struct ifnet *ifp;
1667	u_int dlt, hdrlen;
1668	struct bpf_if **driverp;
1669{
1670}
1671
1672void
1673bpfdetach(ifp)
1674	struct ifnet *ifp;
1675{
1676}
1677
1678u_int
1679bpf_filter(pc, p, wirelen, buflen)
1680	const struct bpf_insn *pc;
1681	u_char *p;
1682	u_int wirelen;
1683	u_int buflen;
1684{
1685	return -1;	/* "no filter" behaviour */
1686}
1687
1688int
1689bpf_validate(f, len)
1690	const struct bpf_insn *f;
1691	int len;
1692{
1693	return 0;		/* false */
1694}
1695
1696#endif /* !DEV_BPF && !NETGRAPH_BPF */
1697