1 /*      $NetBSD: bpf.c,v 1.143 2009/03/11 05:55:22 mrg Exp $    */
   2 
   3 /*
   4  * Copyright (c) 1990, 1991, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * This code is derived from the Stanford/CMU enet packet filter,
   8  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
   9  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
  10  * Berkeley Laboratory.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. Neither the name of the University nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  *      @(#)bpf.c       8.4 (Berkeley) 1/9/95
  37  * static char rcsid[] =
  38  * "Header: bpf.c,v 1.67 96/09/26 22:00:52 leres Exp ";
  39  */
  40 /*
  41  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  42  * Use is subject to license terms.
  43  * Copyright 2017 Joyent, Inc.
  44  */
  45 
  46 /*
  47  * The BPF implements the following access controls for zones attempting
  48  * to read and write data. Writing of data requires that the net_rawaccess
  49  * privilege is held whilst reading data requires either net_rawaccess or
  50  * net_observerability.
  51  *
  52  *                              | Shared |  Exclusive |   Global
  53  * -----------------------------+--------+------------+------------+
  54  * DLT_IPNET in local zone      |  Read  |    Read    |    Read    |
  55  * -----------------------------+--------+------------+------------+
  56  * Raw access to local zone NIC |  None  | Read/Write | Read/Write |
  57  * -----------------------------+--------+------------+------------+
  58  * Raw access to all NICs       |  None  |    None    | Read/Write |
  59  * -----------------------------+--------+------------+------------+
  60  *
  61  * The BPF driver is written as a cloning driver: each call to bpfopen()
  62  * allocates a new minor number. This provides BPF with a 1:1 relationship
  63  * between open's and close's. There is some amount of "descriptor state"
  64  * that is kept per open. Pointers to this data are stored in a hash table
  65  * (bpf_hash) that is index'd by the minor device number for each open file.
  66  */
  67 #include <sys/param.h>
  68 #include <sys/systm.h>
  69 #include <sys/time.h>
  70 #include <sys/ioctl.h>
  71 #include <sys/queue.h>
  72 #include <sys/filio.h>
  73 #include <sys/policy.h>
  74 #include <sys/cmn_err.h>
  75 #include <sys/uio.h>
  76 #include <sys/file.h>
  77 #include <sys/sysmacros.h>
  78 #include <sys/zone.h>
  79 
  80 #include <sys/socket.h>
  81 #include <sys/errno.h>
  82 #include <sys/poll.h>
  83 #include <sys/dlpi.h>
  84 #include <sys/neti.h>
  85 
  86 #include <net/if.h>
  87 
  88 #include <net/bpf.h>
  89 #include <net/bpfdesc.h>
  90 #include <net/dlt.h>
  91 
  92 #include <netinet/in.h>
  93 #include <sys/mac.h>
  94 #include <sys/mac_client.h>
  95 #include <sys/mac_impl.h>
  96 #include <sys/time_std_impl.h>
  97 #include <sys/hook.h>
  98 #include <sys/hook_event.h>
  99 
 100 
 101 #define mtod(_v, _t)    (_t)((_v)->b_rptr)
 102 #define M_LEN(_m)       ((_m)->b_wptr - (_m)->b_rptr)
 103 
 104 /*
 105  * 4096 is too small for FDDI frames. 8192 is too small for gigabit Ethernet
 106  * jumbos (circa 9k), ATM, or Intel gig/10gig ethernet jumbos (16k).
 107  */
 108 #define BPF_BUFSIZE (32 * 1024)
 109 
 110 typedef void *(*cp_fn_t)(void *, const void *, size_t);
 111 
 112 /*
 113  * The default read buffer size, and limit for BIOCSBLEN.
 114  */
 115 int bpf_bufsize = BPF_BUFSIZE;
 116 int bpf_maxbufsize = (16 * 1024 * 1024);
 117 static mod_hash_t *bpf_hash = NULL;
 118 
 119 /*
 120  * Use a mutex to avoid a race condition between gathering the stats/peers
 121  * and opening/closing the device.
 122  */
 123 static kcondvar_t bpf_dlt_waiter;
 124 static kmutex_t bpf_mtx;
 125 static bpf_kstats_t ks_stats;
 126 static bpf_kstats_t bpf_kstats = {
 127         { "readWait",           KSTAT_DATA_UINT64 },
 128         { "writeOk",            KSTAT_DATA_UINT64 },
 129         { "writeError",         KSTAT_DATA_UINT64 },
 130         { "receive",            KSTAT_DATA_UINT64 },
 131         { "captured",           KSTAT_DATA_UINT64 },
 132         { "dropped",            KSTAT_DATA_UINT64 },
 133 };
 134 static kstat_t *bpf_ksp;
 135 
 136 /*
 137  *  bpf_list is a list of the BPF descriptors currently open
 138  */
 139 LIST_HEAD(, bpf_d) bpf_list;
 140 
 141 static int      bpf_allocbufs(struct bpf_d *);
 142 static void     bpf_clear_timeout(struct bpf_d *);
 143 static void     bpf_deliver(struct bpf_d *, cp_fn_t,
 144                     void *, uint_t, uint_t, boolean_t);
 145 static void     bpf_freed(struct bpf_d *);
 146 static int      bpf_ifname(struct bpf_d *d, char *, int);
 147 static void     *bpf_mcpy(void *, const void *, size_t);
 148 static int      bpf_attachd(struct bpf_d *, const char *, int);
 149 static void     bpf_detachd(struct bpf_d *);
 150 static int      bpf_setif(struct bpf_d *, char *, int);
 151 static void     bpf_timed_out(void *);
 152 static inline void
 153                 bpf_wakeup(struct bpf_d *);
 154 static void     catchpacket(struct bpf_d *, uchar_t *, uint_t, uint_t,
 155                     cp_fn_t, struct timeval *);
 156 static void     reset_d(struct bpf_d *);
 157 static int      bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
 158 static int      bpf_setdlt(struct bpf_d *, void *);
 159 static void     bpf_dev_add(struct bpf_d *);
 160 static struct bpf_d *bpf_dev_find(minor_t);
 161 static struct bpf_d *bpf_dev_get(minor_t);
 162 static void     bpf_dev_remove(struct bpf_d *);
 163 
 164 static int
 165 bpf_movein(struct uio *uio, int linktype, int mtu, mblk_t **mp)
 166 {
 167         mblk_t *m;
 168         int error;
 169         int len;
 170         int hlen;
 171         int align;
 172 
 173         /*
 174          * Build a sockaddr based on the data link layer type.
 175          * We do this at this level because the ethernet header
 176          * is copied directly into the data field of the sockaddr.
 177          * In the case of SLIP, there is no header and the packet
 178          * is forwarded as is.
 179          * Also, we are careful to leave room at the front of the mbuf
 180          * for the link level header.
 181          */
 182         switch (linktype) {
 183 
 184         case DLT_EN10MB:
 185                 hlen = sizeof (struct ether_header);
 186                 break;
 187 
 188         case DLT_FDDI:
 189                 hlen = 16;
 190                 break;
 191 
 192         case DLT_NULL:
 193                 hlen = 0;
 194                 break;
 195 
 196         case DLT_IPOIB:
 197                 hlen = 44;
 198                 break;
 199 
 200         default:
 201                 return (EIO);
 202         }
 203 
 204         align = 4 - (hlen & 3);
 205 
 206         len = uio->uio_resid;
 207         /*
 208          * If there aren't enough bytes for a link level header or the
 209          * packet length exceeds the interface mtu, return an error.
 210          */
 211         if (len < hlen || len - hlen > mtu)
 212                 return (EMSGSIZE);
 213 
 214         m = allocb(len + align, BPRI_MED);
 215         if (m == NULL) {
 216                 error = ENOBUFS;
 217                 goto bad;
 218         }
 219 
 220         /* Insure the data is properly aligned */
 221         if (align > 0)
 222                 m->b_rptr += align;
 223         m->b_wptr = m->b_rptr + len;
 224 
 225         error = uiomove(mtod(m, void *), len, UIO_WRITE, uio);
 226         if (error)
 227                 goto bad;
 228         *mp = m;
 229         return (0);
 230 
 231 bad:
 232         if (m != NULL)
 233                 freemsg(m);
 234         return (error);
 235 }
 236 
 237 
 238 /*
 239  * Attach file to the bpf interface, i.e. make d listen on bp.
 240  */
 241 static int
 242 bpf_attachd(struct bpf_d *d, const char *ifname, int dlt)
 243 {
 244         bpf_provider_list_t *bp;
 245         bpf_provider_t *bpr;
 246         boolean_t zonematch;
 247         zoneid_t niczone;
 248         uintptr_t mcip;
 249         zoneid_t zone;
 250         uint_t nicdlt;
 251         uintptr_t mh;
 252         int hdrlen;
 253         int error;
 254 
 255         ASSERT(d->bd_bif == NULL);
 256         ASSERT(d->bd_mcip == NULL);
 257         zone = d->bd_zone;
 258         zonematch = B_TRUE;
 259 again:
 260         mh = 0;
 261         mcip = 0;
 262         LIST_FOREACH(bp, &bpf_providers, bpl_next) {
 263                 bpr = bp->bpl_what;
 264                 error = MBPF_OPEN(bpr, ifname, &mh, zone);
 265                 if (error != 0)
 266                         goto next;
 267                 error = MBPF_CLIENT_OPEN(bpr, mh, &mcip);
 268                 if (error != 0)
 269                         goto next;
 270                 error = MBPF_GET_DLT(bpr, mh, &nicdlt);
 271                 if (error != 0)
 272                         goto next;
 273 
 274                 nicdlt = bpf_dl_to_dlt(nicdlt);
 275                 if (dlt != -1 && dlt != nicdlt) {
 276                         error = ENOENT;
 277                         goto next;
 278                 }
 279 
 280                 error = MBPF_GET_ZONE(bpr, mh, &niczone);
 281                 if (error != 0)
 282                         goto next;
 283 
 284                 DTRACE_PROBE4(bpf__attach, struct bpf_provider_s *, bpr,
 285                     uintptr_t, mh, int, nicdlt, zoneid_t, niczone);
 286 
 287                 if (zonematch && niczone != zone) {
 288                         error = ENOENT;
 289                         goto next;
 290                 }
 291                 break;
 292 next:
 293                 if (mcip != 0) {
 294                         MBPF_CLIENT_CLOSE(bpr, mcip);
 295                         mcip = 0;
 296                 }
 297                 if (mh != NULL) {
 298                         MBPF_CLOSE(bpr, mh);
 299                         mh = 0;
 300                 }
 301         }
 302         if (error != 0) {
 303                 if (zonematch && (zone == GLOBAL_ZONEID)) {
 304                         /*
 305                          * If we failed to do an exact match for the global
 306                          * zone using the global zoneid, try again in case
 307                          * the network interface is owned by a local zone.
 308                          */
 309                         zonematch = B_FALSE;
 310                         goto again;
 311                 }
 312                 return (error);
 313         }
 314 
 315         d->bd_mac = *bpr;
 316         d->bd_mcip = mcip;
 317         d->bd_bif = mh;
 318         d->bd_dlt = nicdlt;
 319         hdrlen = bpf_dl_hdrsize(nicdlt);
 320         d->bd_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
 321 
 322         (void) strlcpy(d->bd_ifname, MBPF_CLIENT_NAME(&d->bd_mac, mcip),
 323             sizeof (d->bd_ifname));
 324 
 325         (void) MBPF_GET_LINKID(&d->bd_mac, d->bd_ifname, &d->bd_linkid,
 326             zone);
 327         (void) MBPF_PROMISC_ADD(&d->bd_mac, d->bd_mcip, 0, d,
 328             &d->bd_promisc_handle, d->bd_promisc_flags);
 329         return (0);
 330 }
 331 
 332 /*
 333  * Detach a file from its interface.
 334  */
 335 static void
 336 bpf_detachd(struct bpf_d *d)
 337 {
 338         uintptr_t mph;
 339         uintptr_t mch;
 340         uintptr_t mh;
 341 
 342         ASSERT(d->bd_inuse == -1);
 343         mch = d->bd_mcip;
 344         d->bd_mcip = 0;
 345         mh = d->bd_bif;
 346         d->bd_bif = 0;
 347 
 348         /*
 349          * Check if this descriptor had requested promiscuous mode.
 350          * If so, turn it off. There's no need to take any action
 351          * here, that is done when MBPF_PROMISC_REMOVE is used;
 352          * bd_promisc is just a local flag to stop promiscuous mode
 353          * from being set more than once.
 354          */
 355         if (d->bd_promisc)
 356                 d->bd_promisc = 0;
 357 
 358         /*
 359          * Take device out of "promiscuous" mode.  Since we were able to
 360          * enter "promiscuous" mode, we should be able to turn it off.
 361          * Note, this field stores a pointer used to support both
 362          * promiscuous and non-promiscuous callbacks for packets.
 363          */
 364         mph = d->bd_promisc_handle;
 365         d->bd_promisc_handle = 0;
 366 
 367         /*
 368          * The lock has to be dropped here because mac_promisc_remove may
 369          * need to wait for mac_promisc_dispatch, which has called into
 370          * bpf and catchpacket is waiting for bd_lock...
 371          * i.e mac_promisc_remove() needs to be called with none of the
 372          * locks held that are part of the bpf_mtap() call path.
 373          */
 374         mutex_exit(&d->bd_lock);
 375         if (mph != 0)
 376                 MBPF_PROMISC_REMOVE(&d->bd_mac, mph);
 377 
 378         if (mch != 0)
 379                 MBPF_CLIENT_CLOSE(&d->bd_mac, mch);
 380 
 381         if (mh != 0)
 382                 MBPF_CLOSE(&d->bd_mac, mh);
 383 
 384         /*
 385          * Because this function is called with bd_lock held, so it must
 386          * exit with it held.
 387          */
 388         mutex_enter(&d->bd_lock);
 389         *d->bd_ifname = '\0';
 390         (void) memset(&d->bd_mac, 0, sizeof (d->bd_mac));
 391 }
 392 
 393 
 394 /*
 395  * bpfilterattach() is called at load time.
 396  */
 397 int
 398 bpfilterattach(void)
 399 {
 400 
 401         bpf_hash = mod_hash_create_idhash("bpf_dev_tab", 31,
 402             mod_hash_null_keydtor);
 403         if (bpf_hash == NULL)
 404                 return (ENOMEM);
 405 
 406         (void) memcpy(&ks_stats, &bpf_kstats, sizeof (bpf_kstats));
 407 
 408         bpf_ksp = kstat_create("bpf", 0, "global", "misc",
 409             KSTAT_TYPE_NAMED, sizeof (bpf_kstats) / sizeof (kstat_named_t),
 410             KSTAT_FLAG_VIRTUAL);
 411         if (bpf_ksp != NULL) {
 412                 bpf_ksp->ks_data = &ks_stats;
 413                 kstat_install(bpf_ksp);
 414         } else {
 415                 mod_hash_destroy_idhash(bpf_hash);
 416                 bpf_hash = NULL;
 417                 return (EEXIST);
 418         }
 419 
 420         cv_init(&bpf_dlt_waiter, NULL, CV_DRIVER, NULL);
 421         mutex_init(&bpf_mtx, NULL, MUTEX_DRIVER, NULL);
 422 
 423         LIST_INIT(&bpf_list);
 424 
 425         return (0);
 426 }
 427 
 428 
 429 /*
 430  * bpfilterdetach() is called at unload time.
 431  */
 432 int
 433 bpfilterdetach(void)
 434 {
 435 
 436         if (bpf_ksp != NULL) {
 437                 kstat_delete(bpf_ksp);
 438                 bpf_ksp = NULL;
 439         }
 440 
 441         mod_hash_destroy_idhash(bpf_hash);
 442         bpf_hash = NULL;
 443 
 444         cv_destroy(&bpf_dlt_waiter);
 445         mutex_destroy(&bpf_mtx);
 446 
 447         return (0);
 448 }
 449 
 450 /*
 451  * Open ethernet device. Clones.
 452  */
 453 /* ARGSUSED */
 454 int
 455 bpfopen(dev_t *devp, int flag, int mode, cred_t *cred)
 456 {
 457         struct bpf_d *d;
 458         uint_t dmin;
 459 
 460         /*
 461          * The security policy described at the top of this file is
 462          * enforced here.
 463          */
 464         if ((flag & FWRITE) != 0) {
 465                 if (secpolicy_net_rawaccess(cred) != 0)
 466                         return (EACCES);
 467         }
 468 
 469         if ((flag & FREAD) != 0) {
 470                 if ((secpolicy_net_observability(cred) != 0) &&
 471                     (secpolicy_net_rawaccess(cred) != 0))
 472                         return (EACCES);
 473         }
 474 
 475         if ((flag & (FWRITE|FREAD)) == 0)
 476                 return (ENXIO);
 477 
 478         /*
 479          * A structure is allocated per open file in BPF to store settings
 480          * such as buffer capture size, provide private buffers, etc.
 481          */
 482         d = (struct bpf_d *)kmem_zalloc(sizeof (*d), KM_SLEEP);
 483         d->bd_bufsize = bpf_bufsize;
 484         d->bd_fmode = flag;
 485         d->bd_zone = crgetzoneid(cred);
 486         d->bd_seesent = 1;
 487         d->bd_promisc_flags = MAC_PROMISC_FLAGS_NO_PHYS|
 488             MAC_PROMISC_FLAGS_NO_COPY;
 489         mutex_init(&d->bd_lock, NULL, MUTEX_DRIVER, NULL);
 490         cv_init(&d->bd_wait, NULL, CV_DRIVER, NULL);
 491 
 492         mutex_enter(&bpf_mtx);
 493         /*
 494          * Find an unused minor number. Obviously this is an O(n) algorithm
 495          * and doesn't scale particularly well, so if there are large numbers
 496          * of open file descriptors happening in real use, this design may
 497          * need to be revisited.
 498          */
 499         for (dmin = 0; dmin < L_MAXMIN; dmin++)
 500                 if (bpf_dev_find(dmin) == NULL)
 501                         break;
 502         if (dmin == L_MAXMIN) {
 503                 mutex_exit(&bpf_mtx);
 504                 kmem_free(d, sizeof (*d));
 505                 return (ENXIO);
 506         }
 507         d->bd_dev = dmin;
 508         LIST_INSERT_HEAD(&bpf_list, d, bd_list);
 509         bpf_dev_add(d);
 510         mutex_exit(&bpf_mtx);
 511 
 512         *devp = makedevice(getmajor(*devp), dmin);
 513 
 514         return (0);
 515 }
 516 
 517 /*
 518  * Close the descriptor by detaching it from its interface,
 519  * deallocating its buffers, and marking it free.
 520  *
 521  * Because we only allow a device to be opened once, there is always a
 522  * 1 to 1 relationship between opens and closes supporting this function.
 523  */
 524 /* ARGSUSED */
 525 int
 526 bpfclose(dev_t dev, int flag, int otyp, cred_t *cred_p)
 527 {
 528         struct bpf_d *d = bpf_dev_get(getminor(dev));
 529 
 530         mutex_enter(&d->bd_lock);
 531 
 532         while (d->bd_inuse != 0) {
 533                 d->bd_waiting++;
 534                 if (cv_wait_sig(&d->bd_wait, &d->bd_lock) <= 0) {
 535                         d->bd_waiting--;
 536                         mutex_exit(&d->bd_lock);
 537                         return (EINTR);
 538                 }
 539                 d->bd_waiting--;
 540         }
 541 
 542         d->bd_inuse = -1;
 543         if (d->bd_state == BPF_WAITING)
 544                 bpf_clear_timeout(d);
 545         d->bd_state = BPF_IDLE;
 546         if (d->bd_bif)
 547                 bpf_detachd(d);
 548         mutex_exit(&d->bd_lock);
 549 
 550         mutex_enter(&bpf_mtx);
 551         LIST_REMOVE(d, bd_list);
 552         bpf_dev_remove(d);
 553         mutex_exit(&bpf_mtx);
 554 
 555         mutex_enter(&d->bd_lock);
 556         mutex_destroy(&d->bd_lock);
 557         cv_destroy(&d->bd_wait);
 558 
 559         bpf_freed(d);
 560         kmem_free(d, sizeof (*d));
 561 
 562         return (0);
 563 }
 564 
 565 /*
 566  * Rotate the packet buffers in descriptor d.  Move the store buffer
 567  * into the hold slot, and the free buffer into the store slot.
 568  * Zero the length of the new store buffer.
 569  */
 570 #define ROTATE_BUFFERS(d) \
 571         (d)->bd_hbuf = (d)->bd_sbuf; \
 572         (d)->bd_hlen = (d)->bd_slen; \
 573         (d)->bd_sbuf = (d)->bd_fbuf; \
 574         (d)->bd_slen = 0; \
 575         (d)->bd_fbuf = 0;
 576 /*
 577  *  bpfread - read next chunk of packets from buffers
 578  */
 579 /* ARGSUSED */
 580 int
 581 bpfread(dev_t dev, struct uio *uio, cred_t *cred)
 582 {
 583         struct bpf_d *d = bpf_dev_get(getminor(dev));
 584         int timed_out;
 585         ulong_t delay;
 586         int error;
 587 
 588         if ((d->bd_fmode & FREAD) == 0)
 589                 return (EBADF);
 590 
 591         /*
 592          * Restrict application to use a buffer the same size as
 593          * the kernel buffers.
 594          */
 595         if (uio->uio_resid != d->bd_bufsize)
 596                 return (EINVAL);
 597 
 598         mutex_enter(&d->bd_lock);
 599         if (d->bd_state == BPF_WAITING)
 600                 bpf_clear_timeout(d);
 601         timed_out = (d->bd_state == BPF_TIMED_OUT);
 602         d->bd_state = BPF_IDLE;
 603         /*
 604          * If the hold buffer is empty, then do a timed sleep, which
 605          * ends when the timeout expires or when enough packets
 606          * have arrived to fill the store buffer.
 607          */
 608         while (d->bd_hbuf == 0) {
 609                 if (d->bd_nonblock) {
 610                         if (d->bd_slen == 0) {
 611                                 mutex_exit(&d->bd_lock);
 612                                 return (EWOULDBLOCK);
 613                         }
 614                         ROTATE_BUFFERS(d);
 615                         break;
 616                 }
 617 
 618                 if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
 619                         /*
 620                          * A packet(s) either arrived since the previous
 621                          * read or arrived while we were asleep.
 622                          * Rotate the buffers and return what's here.
 623                          */
 624                         ROTATE_BUFFERS(d);
 625                         break;
 626                 }
 627                 ks_stats.kp_read_wait.value.ui64++;
 628                 delay = ddi_get_lbolt() + d->bd_rtout;
 629                 error = cv_timedwait_sig(&d->bd_wait, &d->bd_lock, delay);
 630                 if (error == 0) {
 631                         mutex_exit(&d->bd_lock);
 632                         return (EINTR);
 633                 }
 634                 if (error == -1) {
 635                         /*
 636                          * On a timeout, return what's in the buffer,
 637                          * which may be nothing.  If there is something
 638                          * in the store buffer, we can rotate the buffers.
 639                          */
 640                         if (d->bd_hbuf)
 641                                 /*
 642                                  * We filled up the buffer in between
 643                                  * getting the timeout and arriving
 644                                  * here, so we don't need to rotate.
 645                                  */
 646                                 break;
 647 
 648                         if (d->bd_slen == 0) {
 649                                 mutex_exit(&d->bd_lock);
 650                                 return (0);
 651                         }
 652                         ROTATE_BUFFERS(d);
 653                 }
 654         }
 655         /*
 656          * At this point, we know we have something in the hold slot.
 657          */
 658         mutex_exit(&d->bd_lock);
 659 
 660         /*
 661          * Move data from hold buffer into user space.
 662          * We know the entire buffer is transferred since
 663          * we checked above that the read buffer is bpf_bufsize bytes.
 664          */
 665         error = uiomove(d->bd_hbuf, d->bd_hlen, UIO_READ, uio);
 666 
 667         mutex_enter(&d->bd_lock);
 668         d->bd_fbuf = d->bd_hbuf;
 669         d->bd_hbuf = 0;
 670         d->bd_hlen = 0;
 671 done:
 672         mutex_exit(&d->bd_lock);
 673         return (error);
 674 }
 675 
 676 
 677 /*
 678  * If there are processes sleeping on this descriptor, wake them up.
 679  * NOTE: the lock for bd_wait is bd_lock and is held by bpf_deliver,
 680  * so there is no code here grabbing it.
 681  */
 682 static inline void
 683 bpf_wakeup(struct bpf_d *d)
 684 {
 685         cv_signal(&d->bd_wait);
 686 }
 687 
 688 static void
 689 bpf_timed_out(void *arg)
 690 {
 691         struct bpf_d *d = arg;
 692 
 693         mutex_enter(&d->bd_lock);
 694         if (d->bd_state == BPF_WAITING) {
 695                 d->bd_state = BPF_TIMED_OUT;
 696                 if (d->bd_slen != 0)
 697                         cv_signal(&d->bd_wait);
 698         }
 699         mutex_exit(&d->bd_lock);
 700 }
 701 
 702 
 703 /* ARGSUSED */
 704 int
 705 bpfwrite(dev_t dev, struct uio *uio, cred_t *cred)
 706 {
 707         struct bpf_d *d = bpf_dev_get(getminor(dev));
 708         uintptr_t mch;
 709         uint_t mtu;
 710         mblk_t *m;
 711         int error;
 712         int dlt;
 713 
 714         if ((d->bd_fmode & FWRITE) == 0)
 715                 return (EBADF);
 716 
 717         mutex_enter(&d->bd_lock);
 718         if (d->bd_bif == 0 || d->bd_mcip == 0 || d->bd_bif == 0) {
 719                 mutex_exit(&d->bd_lock);
 720                 return (EINTR);
 721         }
 722 
 723         if (uio->uio_resid == 0) {
 724                 mutex_exit(&d->bd_lock);
 725                 return (0);
 726         }
 727 
 728         while (d->bd_inuse < 0) {
 729                 d->bd_waiting++;
 730                 if (cv_wait_sig(&d->bd_wait, &d->bd_lock) <= 0) {
 731                         d->bd_waiting--;
 732                         mutex_exit(&d->bd_lock);
 733                         return (EINTR);
 734                 }
 735                 d->bd_waiting--;
 736         }
 737 
 738         mutex_exit(&d->bd_lock);
 739 
 740         dlt = d->bd_dlt;
 741         mch = d->bd_mcip;
 742         MBPF_SDU_GET(&d->bd_mac, d->bd_bif, &mtu);
 743         d->bd_inuse++;
 744 
 745         m = NULL;
 746         if (dlt == DLT_IPNET) {
 747                 error = EIO;
 748                 goto done;
 749         }
 750 
 751         error = bpf_movein(uio, dlt, mtu, &m);
 752         if (error)
 753                 goto done;
 754 
 755         DTRACE_PROBE4(bpf__tx, struct bpf_d *, d, int, dlt,
 756             uint_t, mtu, mblk_t *, m);
 757 
 758         if (M_LEN(m) > mtu) {
 759                 error = EMSGSIZE;
 760                 goto done;
 761         }
 762 
 763         error = MBPF_TX(&d->bd_mac, mch, m);
 764         /*
 765          * The "tx" action here is required to consume the mblk_t.
 766          */
 767         m = NULL;
 768 
 769 done:
 770         if (error == 0)
 771                 ks_stats.kp_write_ok.value.ui64++;
 772         else
 773                 ks_stats.kp_write_error.value.ui64++;
 774         if (m != NULL)
 775                 freemsg(m);
 776 
 777         mutex_enter(&d->bd_lock);
 778         d->bd_inuse--;
 779         if ((d->bd_inuse == 0) && (d->bd_waiting != 0))
 780                 cv_signal(&d->bd_wait);
 781         mutex_exit(&d->bd_lock);
 782 
 783         /*
 784          * The driver frees the mbuf.
 785          */
 786         return (error);
 787 }
 788 
 789 
 790 /*
 791  * Reset a descriptor by flushing its packet buffer and clearing the
 792  * receive and drop counts.  Should be called at splnet.
 793  */
 794 static void
 795 reset_d(struct bpf_d *d)
 796 {
 797         if (d->bd_hbuf) {
 798                 /* Free the hold buffer. */
 799                 d->bd_fbuf = d->bd_hbuf;
 800                 d->bd_hbuf = 0;
 801         }
 802         d->bd_slen = 0;
 803         d->bd_hlen = 0;
 804         d->bd_rcount = 0;
 805         d->bd_dcount = 0;
 806         d->bd_ccount = 0;
 807 }
 808 
 809 /*
 810  *  FIONREAD            Check for read packet available.
 811  *  BIOCGBLEN           Get buffer len [for read()].
 812  *  BIOCSETF            Set ethernet read filter.
 813  *  BIOCFLUSH           Flush read packet buffer.
 814  *  BIOCPROMISC         Put interface into promiscuous mode.
 815  *  BIOCGDLT            Get link layer type.
 816  *  BIOCGETIF           Get interface name.
 817  *  BIOCSETIF           Set interface.
 818  *  BIOCSRTIMEOUT       Set read timeout.
 819  *  BIOCGRTIMEOUT       Get read timeout.
 820  *  BIOCGSTATS          Get packet stats.
 821  *  BIOCIMMEDIATE       Set immediate mode.
 822  *  BIOCVERSION         Get filter language version.
 823  *  BIOCGHDRCMPLT       Get "header already complete" flag.
 824  *  BIOCSHDRCMPLT       Set "header already complete" flag.
 825  */
 826 /* ARGSUSED */
 827 int
 828 bpfioctl(dev_t dev, int cmd, intptr_t addr, int mode, cred_t *cred, int *rval)
 829 {
 830         struct bpf_d *d = bpf_dev_get(getminor(dev));
 831         struct bpf_program prog;
 832         struct lifreq lifreq;
 833         struct ifreq ifreq;
 834         int error = 0;
 835         uint_t size;
 836 
 837         /*
 838          * Refresh the PID associated with this bpf file.
 839          */
 840         mutex_enter(&d->bd_lock);
 841         if (d->bd_state == BPF_WAITING)
 842                 bpf_clear_timeout(d);
 843         d->bd_state = BPF_IDLE;
 844         mutex_exit(&d->bd_lock);
 845 
 846         switch (cmd) {
 847 
 848         default:
 849                 error = EINVAL;
 850                 break;
 851 
 852         /*
 853          * Check for read packet available.
 854          */
 855         case FIONREAD:
 856                 {
 857                         int n;
 858 
 859                         mutex_enter(&d->bd_lock);
 860                         n = d->bd_slen;
 861                         if (d->bd_hbuf)
 862                                 n += d->bd_hlen;
 863                         mutex_exit(&d->bd_lock);
 864 
 865                         *(int *)addr = n;
 866                         break;
 867                 }
 868 
 869         /*
 870          * Get buffer len [for read()].
 871          */
 872         case BIOCGBLEN:
 873                 error = copyout(&d->bd_bufsize, (void *)addr,
 874                     sizeof (d->bd_bufsize));
 875                 break;
 876 
 877         /*
 878          * Set buffer length.
 879          */
 880         case BIOCSBLEN:
 881                 if (copyin((void *)addr, &size, sizeof (size)) != 0) {
 882                         error = EFAULT;
 883                         break;
 884                 }
 885 
 886                 mutex_enter(&d->bd_lock);
 887                 if (d->bd_bif != 0) {
 888                         error = EINVAL;
 889                 } else {
 890                         if (size > bpf_maxbufsize)
 891                                 size = bpf_maxbufsize;
 892                         else if (size < BPF_MINBUFSIZE)
 893                                 size = BPF_MINBUFSIZE;
 894 
 895                         d->bd_bufsize = size;
 896                 }
 897                 mutex_exit(&d->bd_lock);
 898 
 899                 if (error == 0)
 900                         error = copyout(&size, (void *)addr, sizeof (size));
 901                 break;
 902 
 903         /*
 904          * Set link layer read filter.
 905          */
 906         case BIOCSETF:
 907                 if (ddi_copyin((void *)addr, &prog, sizeof (prog), mode)) {
 908                         error = EFAULT;
 909                         break;
 910                 }
 911                 error = bpf_setf(d, &prog);
 912                 break;
 913 
 914         /*
 915          * Flush read packet buffer.
 916          */
 917         case BIOCFLUSH:
 918                 mutex_enter(&d->bd_lock);
 919                 reset_d(d);
 920                 mutex_exit(&d->bd_lock);
 921                 break;
 922 
 923         /*
 924          * Put interface into promiscuous mode.
 925          * This is a one-way ioctl, it is not used to turn promiscuous
 926          * mode off.
 927          */
 928         case BIOCPROMISC:
 929                 if (d->bd_bif == 0) {
 930                         /*
 931                          * No interface attached yet.
 932                          */
 933                         error = EINVAL;
 934                         break;
 935                 }
 936                 mutex_enter(&d->bd_lock);
 937                 if (d->bd_promisc == 0) {
 938 
 939                         if (d->bd_promisc_handle) {
 940                                 uintptr_t mph;
 941 
 942                                 mph = d->bd_promisc_handle;
 943                                 d->bd_promisc_handle = 0;
 944 
 945                                 mutex_exit(&d->bd_lock);
 946                                 MBPF_PROMISC_REMOVE(&d->bd_mac, mph);
 947                                 mutex_enter(&d->bd_lock);
 948                         }
 949 
 950                         d->bd_promisc_flags = MAC_PROMISC_FLAGS_NO_COPY;
 951                         error = MBPF_PROMISC_ADD(&d->bd_mac,
 952                             d->bd_mcip, MAC_CLIENT_PROMISC_ALL, d,
 953                             &d->bd_promisc_handle, d->bd_promisc_flags);
 954                         if (error == 0)
 955                                 d->bd_promisc = 1;
 956                 }
 957                 mutex_exit(&d->bd_lock);
 958                 break;
 959 
 960         /*
 961          * Get device parameters.
 962          */
 963         case BIOCGDLT:
 964                 if (d->bd_bif == 0)
 965                         error = EINVAL;
 966                 else
 967                         error = copyout(&d->bd_dlt, (void *)addr,
 968                             sizeof (d->bd_dlt));
 969                 break;
 970 
 971         /*
 972          * Get a list of supported device parameters.
 973          */
 974         case BIOCGDLTLIST:
 975                 if (d->bd_bif == 0) {
 976                         error = EINVAL;
 977                 } else {
 978                         struct bpf_dltlist list;
 979 
 980                         if (copyin((void *)addr, &list, sizeof (list)) != 0) {
 981                                 error = EFAULT;
 982                                 break;
 983                         }
 984                         error = bpf_getdltlist(d, &list);
 985                         if ((error == 0) &&
 986                             copyout(&list, (void *)addr, sizeof (list)) != 0)
 987                                 error = EFAULT;
 988                 }
 989                 break;
 990 
 991         /*
 992          * Set device parameters.
 993          */
 994         case BIOCSDLT:
 995                 error = bpf_setdlt(d, (void *)addr);
 996                 break;
 997 
 998         /*
 999          * Get interface name.
1000          */
1001         case BIOCGETIF:
1002                 if (copyin((void *)addr, &ifreq, sizeof (ifreq)) != 0) {
1003                         error = EFAULT;
1004                         break;
1005                 }
1006                 error = bpf_ifname(d, ifreq.ifr_name, sizeof (ifreq.ifr_name));
1007                 if ((error == 0) &&
1008                     copyout(&ifreq, (void *)addr, sizeof (ifreq)) != 0) {
1009                         error = EFAULT;
1010                         break;
1011                 }
1012                 break;
1013 
1014         /*
1015          * Set interface.
1016          */
1017         case BIOCSETIF:
1018                 if (copyin((void *)addr, &ifreq, sizeof (ifreq)) != 0) {
1019                         error = EFAULT;
1020                         break;
1021                 }
1022                 error = bpf_setif(d, ifreq.ifr_name, sizeof (ifreq.ifr_name));
1023                 break;
1024 
1025         /*
1026          * Get interface name.
1027          */
1028         case BIOCGETLIF:
1029                 if (copyin((void *)addr, &lifreq, sizeof (lifreq)) != 0) {
1030                         error = EFAULT;
1031                         break;
1032                 }
1033                 error = bpf_ifname(d, lifreq.lifr_name,
1034                     sizeof (lifreq.lifr_name));
1035                 if ((error == 0) &&
1036                     copyout(&lifreq, (void *)addr, sizeof (lifreq)) != 0) {
1037                         error = EFAULT;
1038                         break;
1039                 }
1040                 break;
1041 
1042         /*
1043          * Set interface.
1044          */
1045         case BIOCSETLIF:
1046                 if (copyin((void *)addr, &lifreq, sizeof (lifreq)) != 0) {
1047                         error = EFAULT;
1048                         break;
1049                 }
1050                 error = bpf_setif(d, lifreq.lifr_name,
1051                     sizeof (lifreq.lifr_name));
1052                 break;
1053 
1054 #ifdef _SYSCALL32_IMPL
1055         /*
1056          * Set read timeout.
1057          */
1058         case BIOCSRTIMEOUT32:
1059                 {
1060                         struct timeval32 tv;
1061 
1062                         if (copyin((void *)addr, &tv, sizeof (tv)) != 0) {
1063                                 error = EFAULT;
1064                                 break;
1065                         }
1066 
1067                         /* Convert the timeout in microseconds to ticks */
1068                         d->bd_rtout = drv_usectohz(tv.tv_sec * 1000000 +
1069                             tv.tv_usec);
1070                         if ((d->bd_rtout == 0) && (tv.tv_usec != 0))
1071                                 d->bd_rtout = 1;
1072                         break;
1073                 }
1074 
1075         /*
1076          * Get read timeout.
1077          */
1078         case BIOCGRTIMEOUT32:
1079                 {
1080                         struct timeval32 tv;
1081                         clock_t ticks;
1082 
1083                         ticks = drv_hztousec(d->bd_rtout);
1084                         tv.tv_sec = ticks / 1000000;
1085                         tv.tv_usec = ticks - (tv.tv_sec * 1000000);
1086                         error = copyout(&tv, (void *)addr, sizeof (tv));
1087                         break;
1088                 }
1089 
1090         /*
1091          * Get a list of supported device parameters.
1092          */
1093         case BIOCGDLTLIST32:
1094                 if (d->bd_bif == 0) {
1095                         error = EINVAL;
1096                 } else {
1097                         struct bpf_dltlist32 lst32;
1098                         struct bpf_dltlist list;
1099 
1100                         if (copyin((void *)addr, &lst32, sizeof (lst32)) != 0) {
1101                                 error = EFAULT;
1102                                 break;
1103                         }
1104 
1105                         list.bfl_len = lst32.bfl_len;
1106                         list.bfl_list = (void *)(uint64_t)lst32.bfl_list;
1107                         error = bpf_getdltlist(d, &list);
1108                         if (error == 0) {
1109                                 lst32.bfl_len = list.bfl_len;
1110 
1111                                 if (copyout(&lst32, (void *)addr,
1112                                     sizeof (lst32)) != 0)
1113                                         error = EFAULT;
1114                         }
1115                 }
1116                 break;
1117 
1118         /*
1119          * Set link layer read filter.
1120          */
1121         case BIOCSETF32: {
1122                 struct bpf_program32 prog32;
1123 
1124                 if (ddi_copyin((void *)addr, &prog32, sizeof (prog), mode)) {
1125                         error = EFAULT;
1126                         break;
1127                 }
1128                 prog.bf_len = prog32.bf_len;
1129                 prog.bf_insns = (void *)(uint64_t)prog32.bf_insns;
1130                 error = bpf_setf(d, &prog);
1131                 break;
1132         }
1133 #endif
1134 
1135         /*
1136          * Set read timeout.
1137          */
1138         case BIOCSRTIMEOUT:
1139                 {
1140                         struct timeval tv;
1141 
1142                         if (copyin((void *)addr, &tv, sizeof (tv)) != 0) {
1143                                 error = EFAULT;
1144                                 break;
1145                         }
1146 
1147                         /* Convert the timeout in microseconds to ticks */
1148                         d->bd_rtout = drv_usectohz(tv.tv_sec * 1000000 +
1149                             tv.tv_usec);
1150                         if ((d->bd_rtout == 0) && (tv.tv_usec != 0))
1151                                 d->bd_rtout = 1;
1152                         break;
1153                 }
1154 
1155         /*
1156          * Get read timeout.
1157          */
1158         case BIOCGRTIMEOUT:
1159                 {
1160                         struct timeval tv;
1161                         clock_t ticks;
1162 
1163                         ticks = drv_hztousec(d->bd_rtout);
1164                         tv.tv_sec = ticks / 1000000;
1165                         tv.tv_usec = ticks - (tv.tv_sec * 1000000);
1166                         if (copyout(&tv, (void *)addr, sizeof (tv)) != 0)
1167                                 error = EFAULT;
1168                         break;
1169                 }
1170 
1171         /*
1172          * Get packet stats.
1173          */
1174         case BIOCGSTATS:
1175                 {
1176                         struct bpf_stat bs;
1177 
1178                         bs.bs_recv = d->bd_rcount;
1179                         bs.bs_drop = d->bd_dcount;
1180                         bs.bs_capt = d->bd_ccount;
1181                         if (copyout(&bs, (void *)addr, sizeof (bs)) != 0)
1182                                 error = EFAULT;
1183                         break;
1184                 }
1185 
1186         /*
1187          * Set immediate mode.
1188          */
1189         case BIOCIMMEDIATE:
1190                 if (copyin((void *)addr, &d->bd_immediate,
1191                     sizeof (d->bd_immediate)) != 0)
1192                         error = EFAULT;
1193                 break;
1194 
1195         case BIOCVERSION:
1196                 {
1197                         struct bpf_version bv;
1198 
1199                         bv.bv_major = BPF_MAJOR_VERSION;
1200                         bv.bv_minor = BPF_MINOR_VERSION;
1201                         if (copyout(&bv, (void *)addr, sizeof (bv)) != 0)
1202                                 error = EFAULT;
1203                         break;
1204                 }
1205 
1206         case BIOCGHDRCMPLT:     /* get "header already complete" flag */
1207                 if (copyout(&d->bd_hdrcmplt, (void *)addr,
1208                     sizeof (d->bd_hdrcmplt)) != 0)
1209                         error = EFAULT;
1210                 break;
1211 
1212         case BIOCSHDRCMPLT:     /* set "header already complete" flag */
1213                 if (copyin((void *)addr, &d->bd_hdrcmplt,
1214                     sizeof (d->bd_hdrcmplt)) != 0)
1215                         error = EFAULT;
1216                 break;
1217 
1218         /*
1219          * Get "see sent packets" flag
1220          */
1221         case BIOCGSEESENT:
1222                 if (copyout(&d->bd_seesent, (void *)addr,
1223                     sizeof (d->bd_seesent)) != 0)
1224                         error = EFAULT;
1225                 break;
1226 
1227         /*
1228          * Set "see sent" packets flag
1229          */
1230         case BIOCSSEESENT:
1231                 if (copyin((void *)addr, &d->bd_seesent,
1232                     sizeof (d->bd_seesent)) != 0)
1233                         error = EFAULT;
1234                 break;
1235 
1236         case FIONBIO:           /* Non-blocking I/O */
1237                 if (copyin((void *)addr, &d->bd_nonblock,
1238                     sizeof (d->bd_nonblock)) != 0)
1239                         error = EFAULT;
1240                 break;
1241         }
1242         return (error);
1243 }
1244 
1245 /*
1246  * Set d's packet filter program to fp.  If this file already has a filter,
1247  * free it and replace it. If the new filter is "empty" (has a 0 size), then
1248  * the result is to just remove and free the existing filter.
1249  * Returns EINVAL for bogus requests.
1250  */
1251 int
1252 bpf_setf(struct bpf_d *d, struct bpf_program *fp)
1253 {
1254         struct bpf_insn *fcode, *old;
1255         uint_t flen, size;
1256         size_t oldsize;
1257 
1258         if (fp->bf_insns == 0) {
1259                 if (fp->bf_len != 0)
1260                         return (EINVAL);
1261                 mutex_enter(&d->bd_lock);
1262                 old = d->bd_filter;
1263                 oldsize = d->bd_filter_size;
1264                 d->bd_filter = 0;
1265                 d->bd_filter_size = 0;
1266                 reset_d(d);
1267                 mutex_exit(&d->bd_lock);
1268                 if (old != 0)
1269                         kmem_free(old, oldsize);
1270                 return (0);
1271         }
1272         flen = fp->bf_len;
1273         if (flen > BPF_MAXINSNS)
1274                 return (EINVAL);
1275 
1276         size = flen * sizeof (*fp->bf_insns);
1277         fcode = kmem_alloc(size, KM_SLEEP);
1278         if (copyin(fp->bf_insns, fcode, size) != 0)
1279                 return (EFAULT);
1280 
1281         if (bpf_validate(fcode, (int)flen)) {
1282                 mutex_enter(&d->bd_lock);
1283                 old = d->bd_filter;
1284                 oldsize = d->bd_filter_size;
1285                 d->bd_filter = fcode;
1286                 d->bd_filter_size = size;
1287                 reset_d(d);
1288                 mutex_exit(&d->bd_lock);
1289                 if (old != 0)
1290                         kmem_free(old, oldsize);
1291 
1292                 return (0);
1293         }
1294         kmem_free(fcode, size);
1295         return (EINVAL);
1296 }
1297 
1298 /*
1299  * Detach a file from its current interface (if attached at all) and attach
1300  * to the interface indicated by the name stored in ifname.
1301  * Return an errno or 0.
1302  */
1303 static int
1304 bpf_setif(struct bpf_d *d, char *ifname, int namesize)
1305 {
1306         int unit_seen;
1307         int error = 0;
1308         char *cp;
1309         int i;
1310 
1311         /*
1312          * Make sure the provided name has a unit number, and default
1313          * it to '0' if not specified.
1314          * XXX This is ugly ... do this differently?
1315          */
1316         unit_seen = 0;
1317         cp = ifname;
1318         cp[namesize - 1] = '\0';        /* sanity */
1319         while (*cp++)
1320                 if (*cp >= '0' && *cp <= '9')
1321                         unit_seen = 1;
1322         if (!unit_seen) {
1323                 /* Make sure to leave room for the '\0'. */
1324                 for (i = 0; i < (namesize - 1); ++i) {
1325                         if ((ifname[i] >= 'a' && ifname[i] <= 'z') ||
1326                             (ifname[i] >= 'A' && ifname[i] <= 'Z'))
1327                                 continue;
1328                         ifname[i] = '0';
1329                 }
1330         }
1331 
1332         /*
1333          * Make sure that only one call to this function happens at a time
1334          * and that we're not interleaving a read/write
1335          */
1336         mutex_enter(&d->bd_lock);
1337         while (d->bd_inuse != 0) {
1338                 d->bd_waiting++;
1339                 if (cv_wait_sig(&d->bd_wait, &d->bd_lock) <= 0) {
1340                         d->bd_waiting--;
1341                         mutex_exit(&d->bd_lock);
1342                         return (EINTR);
1343                 }
1344                 d->bd_waiting--;
1345         }
1346         d->bd_inuse = -1;
1347         mutex_exit(&d->bd_lock);
1348 
1349         if (d->bd_sbuf == 0)
1350                 error = bpf_allocbufs(d);
1351 
1352         if (error == 0) {
1353                 mutex_enter(&d->bd_lock);
1354                 if (d->bd_bif)
1355                         /*
1356                          * Detach if attached to something else.
1357                          */
1358                         bpf_detachd(d);
1359 
1360                 error = bpf_attachd(d, ifname, -1);
1361                 reset_d(d);
1362                 d->bd_inuse = 0;
1363                 if (d->bd_waiting != 0)
1364                         cv_signal(&d->bd_wait);
1365                 mutex_exit(&d->bd_lock);
1366                 return (error);
1367         }
1368 
1369         mutex_enter(&d->bd_lock);
1370         d->bd_inuse = 0;
1371         if (d->bd_waiting != 0)
1372                 cv_signal(&d->bd_wait);
1373         mutex_exit(&d->bd_lock);
1374 
1375         /*
1376          * Try tickle the mac layer into attaching the device...
1377          */
1378         return (bpf_provider_tickle(ifname, d->bd_zone));
1379 }
1380 
1381 /*
1382  * Copy the interface name to the ifreq.
1383  */
1384 static int
1385 bpf_ifname(struct bpf_d *d, char *buffer, int bufsize)
1386 {
1387 
1388         mutex_enter(&d->bd_lock);
1389         if (d->bd_bif == NULL) {
1390                 mutex_exit(&d->bd_lock);
1391                 return (EINVAL);
1392         }
1393 
1394         (void) strlcpy(buffer, d->bd_ifname, bufsize);
1395         mutex_exit(&d->bd_lock);
1396 
1397         return (0);
1398 }
1399 
1400 /* ARGSUSED */
1401 int
1402 bpfchpoll(dev_t dev, short events, int anyyet, short *reventsp,
1403     struct pollhead **phpp)
1404 {
1405         struct bpf_d *d = bpf_dev_get(getminor(dev));
1406 
1407         /*
1408          * Until this driver is modified to issue proper pollwakeup() calls on
1409          * its pollhead, edge-triggered polling is not allowed.
1410          */
1411         if (events & POLLET) {
1412                 return (EPERM);
1413         }
1414 
1415         if (events & (POLLIN | POLLRDNORM)) {
1416                 /*
1417                  * An imitation of the FIONREAD ioctl code.
1418                  */
1419                 mutex_enter(&d->bd_lock);
1420                 if (d->bd_hlen != 0 ||
1421                     ((d->bd_immediate || d->bd_state == BPF_TIMED_OUT) &&
1422                     d->bd_slen != 0)) {
1423                         *reventsp |= events & (POLLIN | POLLRDNORM);
1424                 } else {
1425                         /*
1426                          * Until the bpf driver has been updated to include
1427                          * adequate pollwakeup() logic, no pollhead will be
1428                          * emitted here, preventing the resource from being
1429                          * cached by poll()/devpoll/epoll.
1430                          */
1431                         *reventsp = 0;
1432                         /* Start the read timeout if necessary */
1433                         if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1434                                 bpf_clear_timeout(d);
1435                                 /*
1436                                  * Only allow the timeout to be set once.
1437                                  */
1438                                 if (d->bd_callout == 0)
1439                                         d->bd_callout = timeout(bpf_timed_out,
1440                                             d, d->bd_rtout);
1441                                 d->bd_state = BPF_WAITING;
1442                         }
1443                 }
1444                 mutex_exit(&d->bd_lock);
1445         }
1446 
1447         return (0);
1448 }
1449 
1450 /*
1451  * Copy data from an mblk_t chain into a buffer. This works for ipnet
1452  * because the dl_ipnetinfo_t is placed in an mblk_t that leads the
1453  * packet itself.
1454  */
1455 static void *
1456 bpf_mcpy(void *dst_arg, const void *src_arg, size_t len)
1457 {
1458         const mblk_t *m;
1459         uint_t count;
1460         uchar_t *dst;
1461 
1462         m = src_arg;
1463         dst = dst_arg;
1464         while (len > 0) {
1465                 if (m == NULL)
1466                         panic("bpf_mcpy");
1467                 count = (uint_t)min(M_LEN(m), len);
1468                 (void) memcpy(dst, mtod(m, const void *), count);
1469                 m = m->b_cont;
1470                 dst += count;
1471                 len -= count;
1472         }
1473         return (dst_arg);
1474 }
1475 
1476 /*
1477  * Dispatch a packet to all the listeners on interface bp.
1478  *
1479  * marg    pointer to the packet, either a data buffer or an mbuf chain
1480  * buflen  buffer length, if marg is a data buffer
1481  * cpfn    a function that can copy marg into the listener's buffer
1482  * pktlen  length of the packet
1483  * issent  boolean indicating whether the packet was sent or receive
1484  */
1485 static inline void
1486 bpf_deliver(struct bpf_d *d, cp_fn_t cpfn, void *marg, uint_t pktlen,
1487     uint_t buflen, boolean_t issent)
1488 {
1489         struct timeval tv;
1490         uint_t slen;
1491 
1492         if (!d->bd_seesent && issent)
1493                 return;
1494 
1495         /*
1496          * Accuracy of the packet counters in BPF is vital so it
1497          * is important to protect even the outer ones.
1498          */
1499         mutex_enter(&d->bd_lock);
1500         slen = bpf_filter(d->bd_filter, marg, pktlen, buflen);
1501         DTRACE_PROBE5(bpf__packet, struct bpf_if *, d->bd_bif,
1502             struct bpf_d *, d, void *, marg, uint_t, pktlen, uint_t, slen);
1503         d->bd_rcount++;
1504         ks_stats.kp_receive.value.ui64++;
1505         if (slen != 0) {
1506                 uniqtime(&tv);
1507                 catchpacket(d, marg, pktlen, slen, cpfn, &tv);
1508         }
1509         mutex_exit(&d->bd_lock);
1510 }
1511 
1512 /*
1513  * Incoming linkage from device drivers.
1514  */
1515 /* ARGSUSED */
1516 void
1517 bpf_mtap(void *arg, mac_resource_handle_t mrh, mblk_t *m, boolean_t issent)
1518 {
1519         cp_fn_t cpfn;
1520         struct bpf_d *d = arg;
1521         uint_t pktlen, buflen;
1522         void *marg;
1523 
1524         pktlen = msgdsize(m);
1525 
1526         if (pktlen == M_LEN(m)) {
1527                 cpfn = (cp_fn_t)memcpy;
1528                 marg = mtod(m, void *);
1529                 buflen = pktlen;
1530         } else {
1531                 cpfn = bpf_mcpy;
1532                 marg = m;
1533                 buflen = 0;
1534         }
1535 
1536         bpf_deliver(d, cpfn, marg, pktlen, buflen, issent);
1537 }
1538 
1539 /*
1540  * Incoming linkage from ipnet.
1541  * In ipnet, there is only one event, NH_OBSERVE, that delivers packets
1542  * from all network interfaces. Thus the tap function needs to apply a
1543  * filter using the interface index/id to immitate snoop'ing on just the
1544  * specified interface.
1545  */
1546 /* ARGSUSED */
1547 void
1548 bpf_itap(void *arg, mblk_t *m, boolean_t issent, uint_t length)
1549 {
1550         hook_pkt_observe_t *hdr;
1551         struct bpf_d *d = arg;
1552 
1553         hdr = (hook_pkt_observe_t *)m->b_rptr;
1554         if (ntohl(hdr->hpo_ifindex) != d->bd_linkid)
1555                 return;
1556         bpf_deliver(d, bpf_mcpy, m, length, 0, issent);
1557 
1558 }
1559 
1560 /*
1561  * Move the packet data from interface memory (pkt) into the
1562  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1563  * otherwise 0.  "copy" is the routine called to do the actual data
1564  * transfer.  memcpy is passed in to copy contiguous chunks, while
1565  * bpf_mcpy is passed in to copy mbuf chains.  In the latter case,
1566  * pkt is really an mbuf.
1567  */
1568 static void
1569 catchpacket(struct bpf_d *d, uchar_t *pkt, uint_t pktlen, uint_t snaplen,
1570     cp_fn_t cpfn, struct timeval *tv)
1571 {
1572         struct bpf_hdr *hp;
1573         int totlen, curlen;
1574         int hdrlen = d->bd_hdrlen;
1575         int do_wakeup = 0;
1576 
1577         ++d->bd_ccount;
1578         ks_stats.kp_capture.value.ui64++;
1579         /*
1580          * Figure out how many bytes to move.  If the packet is
1581          * greater or equal to the snapshot length, transfer that
1582          * much.  Otherwise, transfer the whole packet (unless
1583          * we hit the buffer size limit).
1584          */
1585         totlen = hdrlen + min(snaplen, pktlen);
1586         if (totlen > d->bd_bufsize)
1587                 totlen = d->bd_bufsize;
1588 
1589         /*
1590          * Round up the end of the previous packet to the next longword.
1591          */
1592         curlen = BPF_WORDALIGN(d->bd_slen);
1593         if (curlen + totlen > d->bd_bufsize) {
1594                 /*
1595                  * This packet will overflow the storage buffer.
1596                  * Rotate the buffers if we can, then wakeup any
1597                  * pending reads.
1598                  */
1599                 if (d->bd_fbuf == 0) {
1600                         /*
1601                          * We haven't completed the previous read yet,
1602                          * so drop the packet.
1603                          */
1604                         ++d->bd_dcount;
1605                         ks_stats.kp_dropped.value.ui64++;
1606                         return;
1607                 }
1608                 ROTATE_BUFFERS(d);
1609                 do_wakeup = 1;
1610                 curlen = 0;
1611         } else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT) {
1612                 /*
1613                  * Immediate mode is set, or the read timeout has
1614                  * already expired during a select call.  A packet
1615                  * arrived, so the reader should be woken up.
1616                  */
1617                 do_wakeup = 1;
1618         }
1619 
1620         /*
1621          * Append the bpf header to the existing buffer before we add
1622          * on the actual packet data.
1623          */
1624         hp = (struct bpf_hdr *)((char *)d->bd_sbuf + curlen);
1625         hp->bh_tstamp.tv_sec = tv->tv_sec;
1626         hp->bh_tstamp.tv_usec = tv->tv_usec;
1627         hp->bh_datalen = pktlen;
1628         hp->bh_hdrlen = (uint16_t)hdrlen;
1629         /*
1630          * Copy the packet data into the store buffer and update its length.
1631          */
1632         (*cpfn)((uchar_t *)hp + hdrlen, pkt,
1633             (hp->bh_caplen = totlen - hdrlen));
1634         d->bd_slen = curlen + totlen;
1635 
1636         /*
1637          * Call bpf_wakeup after bd_slen has been updated.
1638          */
1639         if (do_wakeup)
1640                 bpf_wakeup(d);
1641 }
1642 
1643 /*
1644  * Initialize all nonzero fields of a descriptor.
1645  */
1646 static int
1647 bpf_allocbufs(struct bpf_d *d)
1648 {
1649 
1650         d->bd_fbuf = kmem_zalloc(d->bd_bufsize, KM_NOSLEEP);
1651         if (!d->bd_fbuf)
1652                 return (ENOBUFS);
1653         d->bd_sbuf = kmem_zalloc(d->bd_bufsize, KM_NOSLEEP);
1654         if (!d->bd_sbuf) {
1655                 kmem_free(d->bd_fbuf, d->bd_bufsize);
1656                 return (ENOBUFS);
1657         }
1658         d->bd_slen = 0;
1659         d->bd_hlen = 0;
1660         return (0);
1661 }
1662 
1663 /*
1664  * Free buffers currently in use by a descriptor.
1665  * Called on close.
1666  */
1667 static void
1668 bpf_freed(struct bpf_d *d)
1669 {
1670         /*
1671          * At this point the descriptor has been detached from its
1672          * interface and it yet hasn't been marked free.
1673          */
1674         if (d->bd_sbuf != 0) {
1675                 kmem_free(d->bd_sbuf, d->bd_bufsize);
1676                 if (d->bd_hbuf != 0)
1677                         kmem_free(d->bd_hbuf, d->bd_bufsize);
1678                 if (d->bd_fbuf != 0)
1679                         kmem_free(d->bd_fbuf, d->bd_bufsize);
1680         }
1681         if (d->bd_filter)
1682                 kmem_free(d->bd_filter, d->bd_filter_size);
1683 }
1684 
1685 /*
1686  * Get a list of available data link type of the interface.
1687  */
1688 static int
1689 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *listp)
1690 {
1691         bpf_provider_list_t *bp;
1692         bpf_provider_t *bpr;
1693         zoneid_t zoneid;
1694         uintptr_t mcip;
1695         uint_t nicdlt;
1696         uintptr_t mh;
1697         int error;
1698         int n;
1699 
1700         n = 0;
1701         mh = 0;
1702         mcip = 0;
1703         error = 0;
1704         mutex_enter(&d->bd_lock);
1705         LIST_FOREACH(bp, &bpf_providers, bpl_next) {
1706                 bpr = bp->bpl_what;
1707                 error = MBPF_OPEN(bpr, d->bd_ifname, &mh, d->bd_zone);
1708                 if (error != 0)
1709                         goto next;
1710                 error = MBPF_CLIENT_OPEN(bpr, mh, &mcip);
1711                 if (error != 0)
1712                         goto next;
1713                 error = MBPF_GET_ZONE(bpr, mh, &zoneid);
1714                 if (error != 0)
1715                         goto next;
1716                 if (d->bd_zone != GLOBAL_ZONEID &&
1717                     d->bd_zone != zoneid)
1718                         goto next;
1719                 error = MBPF_GET_DLT(bpr, mh, &nicdlt);
1720                 if (error != 0)
1721                         goto next;
1722                 nicdlt = bpf_dl_to_dlt(nicdlt);
1723                 if (listp->bfl_list != NULL) {
1724                         if (n >= listp->bfl_len) {
1725                                 MBPF_CLIENT_CLOSE(bpr, mcip);
1726                                 MBPF_CLOSE(bpr, mh);
1727                                 break;
1728                         }
1729                         /*
1730                          * Bumping of bd_inuse ensures the structure does not
1731                          * disappear while the copyout runs and allows the for
1732                          * loop to be continued.
1733                          */
1734                         d->bd_inuse++;
1735                         mutex_exit(&d->bd_lock);
1736                         if (copyout(&nicdlt,
1737                             listp->bfl_list + n, sizeof (uint_t)) != 0)
1738                                 error = EFAULT;
1739                         mutex_enter(&d->bd_lock);
1740                         if (error != 0)
1741                                 break;
1742                         d->bd_inuse--;
1743                 }
1744                 n++;
1745 next:
1746                 if (mcip != 0) {
1747                         MBPF_CLIENT_CLOSE(bpr, mcip);
1748                         mcip = 0;
1749                 }
1750                 if (mh != 0) {
1751                         MBPF_CLOSE(bpr, mh);
1752                         mh = 0;
1753                 }
1754         }
1755         mutex_exit(&d->bd_lock);
1756 
1757         /*
1758          * It is quite possible that one or more provider to BPF may not
1759          * know about a link name whlist others do. In that case, so long
1760          * as we have one success, do not declare an error unless it was
1761          * an EFAULT as this indicates a problem that needs to be reported.
1762          */
1763         if ((error != EFAULT) && (n > 0))
1764                 error = 0;
1765 
1766         listp->bfl_len = n;
1767         return (error);
1768 }
1769 
1770 /*
1771  * Set the data link type of a BPF instance.
1772  */
1773 static int
1774 bpf_setdlt(struct bpf_d *d, void *addr)
1775 {
1776         char ifname[LIFNAMSIZ+1];
1777         zoneid_t niczone;
1778         int error;
1779         int dlt;
1780 
1781         if (copyin(addr, &dlt, sizeof (dlt)) != 0)
1782                 return (EFAULT);
1783 
1784         mutex_enter(&d->bd_lock);
1785 
1786         if (d->bd_bif == 0) {                        /* Interface not set */
1787                 mutex_exit(&d->bd_lock);
1788                 return (EINVAL);
1789         }
1790         if (d->bd_dlt == dlt) {      /* NULL-op */
1791                 mutex_exit(&d->bd_lock);
1792                 return (0);
1793         }
1794 
1795         error = MBPF_GET_ZONE(&d->bd_mac, d->bd_bif, &niczone);
1796         if (error != 0) {
1797                 mutex_exit(&d->bd_lock);
1798                 return (error);
1799         }
1800 
1801         /*
1802          * See the matrix at the top of the file for the permissions table
1803          * enforced by this driver.
1804          */
1805         if ((d->bd_zone != GLOBAL_ZONEID) && (dlt != DLT_IPNET) &&
1806             (niczone != d->bd_zone)) {
1807                 mutex_exit(&d->bd_lock);
1808                 return (EINVAL);
1809         }
1810 
1811         (void) strlcpy(ifname, d->bd_ifname, sizeof (ifname));
1812         d->bd_inuse = -1;
1813         bpf_detachd(d);
1814         error = bpf_attachd(d, ifname, dlt);
1815         reset_d(d);
1816         d->bd_inuse = 0;
1817 
1818         mutex_exit(&d->bd_lock);
1819         return (error);
1820 }
1821 
1822 /*
1823  * bpf_clear_timeout is called with the bd_lock mutex held, providing it
1824  * with the necessary protection to retrieve and modify bd_callout but it
1825  * does not hold the lock for its entire duration... see below...
1826  */
1827 static void
1828 bpf_clear_timeout(struct bpf_d *d)
1829 {
1830         timeout_id_t tid = d->bd_callout;
1831         d->bd_callout = 0;
1832         d->bd_inuse++;
1833 
1834         /*
1835          * If the timeout has fired and is waiting on bd_lock, we could
1836          * deadlock here because untimeout if bd_lock is held and would
1837          * wait for bpf_timed_out to finish and it never would.
1838          */
1839         if (tid != 0) {
1840                 mutex_exit(&d->bd_lock);
1841                 (void) untimeout(tid);
1842                 mutex_enter(&d->bd_lock);
1843         }
1844 
1845         d->bd_inuse--;
1846 }
1847 
1848 /*
1849  * As a cloning device driver, BPF needs to keep track of which device
1850  * numbers are in use and which ones are not. A hash table, indexed by
1851  * the minor device number, is used to store the pointers to the
1852  * individual descriptors that are allocated in bpfopen().
1853  * The functions below present the interface for that hash table to
1854  * the rest of the driver.
1855  */
1856 static struct bpf_d *
1857 bpf_dev_find(minor_t minor)
1858 {
1859         struct bpf_d *d = NULL;
1860 
1861         (void) mod_hash_find(bpf_hash, (mod_hash_key_t)(uintptr_t)minor,
1862             (mod_hash_val_t *)&d);
1863 
1864         return (d);
1865 }
1866 
1867 static void
1868 bpf_dev_add(struct bpf_d *d)
1869 {
1870         (void) mod_hash_insert(bpf_hash, (mod_hash_key_t)(uintptr_t)d->bd_dev,
1871             (mod_hash_val_t)d);
1872 }
1873 
1874 static void
1875 bpf_dev_remove(struct bpf_d *d)
1876 {
1877         struct bpf_d *stor;
1878 
1879         (void) mod_hash_remove(bpf_hash, (mod_hash_key_t)(uintptr_t)d->bd_dev,
1880             (mod_hash_val_t *)&stor);
1881         ASSERT(stor == d);
1882 }
1883 
1884 /*
1885  * bpf_def_get should only ever be called for a minor number that exists,
1886  * thus there should always be a pointer in the hash table that corresponds
1887  * to it.
1888  */
1889 static struct bpf_d *
1890 bpf_dev_get(minor_t minor)
1891 {
1892         struct bpf_d *d = NULL;
1893 
1894         (void) mod_hash_find(bpf_hash, (mod_hash_key_t)(uintptr_t)minor,
1895             (mod_hash_val_t *)&d);
1896         ASSERT(d != NULL);
1897 
1898         return (d);
1899 }