/* LWIP service - bpfdev.c - Berkeley Packet Filter (/dev/bpf) interface */

/*

* BPF is a cloning device: opening /dev/bpf returns a new BPF device which is

* independent from any other opened BPF devices. We assume that each BPF

* device is used by one single user process, and this implementation therefore

* does not support multiple concurrent device calls on the same BPF device.

*

* Packet buffering basically follows the BSD model: each BPF device that is

* configured (that is, it has been attached to an interface) has two buffers,

* each of the configured size: a store buffer, where new packets are stored,

* and a hold buffer, which is typically full and awaiting retrieval through a

* read call from userland. The buffers are swapped ("rotated") when the store

* buffer is filled up and the hold buffer is empty - if the hold buffer is not

* empty is not empty either, additional packets are dropped.

*

* These buffers are allocated when the BPF device is attached to an interface.

* The interface may later disappear, in which case the BPF device is detached

* from it, allowing any final packets to be read before read requests start

* returning I/O errors. The buffers are freed only when the device is closed.

*/

#include "lwip.h"

#include "bpfdev.h"

#include <minix/chardriver.h>

#include <net/if.h>

#include <net/bpfdesc.h>

#include <minix/bpf.h>

#include <sys/mman.h>

/*

* Make sure that our implementation matches the BPF version in the NetBSD

* headers. If they change the version number, we may have to make changes

* here accordingly.

*/

#if BPF_MAJOR_VERSION != 1 || BPF_MINOR_VERSION != 1

#error "NetBSD BPF version has changed"

#endif

/* The number of BPF devices. */

#define NR_BPFDEV 16

/* BPF receive buffer size: allowed range and default. */

#define BPF_BUF_MIN BPF_WORDALIGN(sizeof(struct bpf_hdr))

#define BPF_BUF_DEF 32768

#define BPF_BUF_MAX 262144

/*

* By opening /dev/bpf, one will obtain a cloned device with a different minor

* number, which maps to one of the BPF devices.

*/

#define BPFDEV_MINOR 0 /* minor number of /dev/bpf */

#define BPFDEV_BASE_MINOR 1 /* base minor number for BPF devices */

static struct bpfdev {

struct bpfdev_link bpf_link; /* structure link, MUST be first */

TAILQ_ENTRY(bpfdev) bpf_next; /* next on free or interface list */

struct ifdev *bpf_ifdev; /* associated interface, or NULL */

unsigned int bpf_flags; /* flags (BPFF_) */

size_t bpf_size; /* size of packet buffers */

char *bpf_sbuf; /* store buffer (mmap'd, or NULL) */

char *bpf_hbuf; /* hold buffer (mmap'd, or NULL) */

size_t bpf_slen; /* used part of store buffer */

size_t bpf_hlen; /* used part of hold buffer */

struct bpf_insn *bpf_filter; /* verified BPF filter, or NULL */

size_t bpf_filterlen; /* length of filter, for munmap */

pid_t bpf_pid; /* process ID of last using process */

clock_t bpf_timeout; /* timeout for read calls (0 = none) */

struct { /* state for pending read request */

endpoint_t br_endpt; /* reading endpoint, or NONE */

cp_grant_id_t br_grant; /* grant for reader's buffer */

cdev_id_t br_id; /* read request identifier */

minix_timer_t br_timer; /* timer for read timeout */

} bpf_read;

struct { /* state for pending select request */

endpoint_t bs_endpt; /* selecting endpoint, or NONE */

unsigned int bs_selops; /* pending select operations */

} bpf_select;

struct { /* packet capture statistics */

uint64_t bs_recv; /* # of packets run through filter */

uint64_t bs_drop; /* # of packets dropped: buffer full */

uint64_t bs_capt; /* # of packets accepted by filter */

} bpf_stat;

} bpf_array[NR_BPFDEV];

#define BPFF_IN_USE 0x01 /* this BPF device object is in use */

#define BPFF_PROMISC 0x02 /* promiscuous mode enabled */

#define BPFF_IMMEDIATE 0x04 /* immediate mode is enabled */

#define BPFF_SEESENT 0x08 /* also process host-sent packets */

#define BPFF_HDRCMPLT 0x10 /* do not fill in link-layer source */

#define BPFF_FEEDBACK 0x20 /* feed back written packet as input */

static TAILQ_HEAD(, bpfdev_link) bpfl_freelist; /* list of free BPF devices */

static struct bpf_stat bpf_stat;

static ssize_t bpfdev_peers(struct rmib_call *, struct rmib_node *,

struct rmib_oldp *, struct rmib_newp *);

/* The CTL_NET NET_BPF subtree. All nodes are dynamically numbered. */

static struct rmib_node net_bpf_table[] = {

RMIB_INT(RMIB_RO, BPF_BUF_MAX, "maxbufsize",

"Maximum size for data capture buffer"), /* TODO: read-write */

RMIB_STRUCT(RMIB_RO, sizeof(bpf_stat), &bpf_stat, "stats",

"BPF stats"),

RMIB_FUNC(RMIB_RO | CTLTYPE_NODE, 0, bpfdev_peers, "peers",

"BPF peers"),

};

static struct rmib_node net_bpf_node =

RMIB_NODE(RMIB_RO, net_bpf_table, "bpf", "BPF options");

/*

* Initialize the BPF module.

*/

void

bpfdev_init(void)

{

const int mib[] = { CTL_NET, NET_BPF };

unsigned int slot;

int r;

/* Initialize data structures. */

TAILQ_INIT(&bpfl_freelist);

for (slot = 0; slot < __arraycount(bpf_array); slot++) {

bpf_array[slot].bpf_flags = 0;

TAILQ_INSERT_TAIL(&bpfl_freelist, &bpf_array[slot].bpf_link,

bpfl_next);

}

memset(&bpf_stat, 0, sizeof(bpf_stat));

/* Register the "net.bpf" subtree with the MIB service. */

if ((r = rmib_register(mib, __arraycount(mib), &net_bpf_node)) != OK)

panic("unable to register net.bpf RMIB tree: %d", r);

}

/*

* Given a BPF device object, return the corresponding minor number.

*/

static devminor_t

bpfdev_get_minor(struct bpfdev * bpfdev)

{

assert(bpfdev != NULL);

return BPFDEV_BASE_MINOR + (devminor_t)(bpfdev - bpf_array);

}

/*

* Given a minor number, return the corresponding BPF device object, or NULL if

* the minor number does not identify a BPF device.

*/

static struct bpfdev *

bpfdev_get_by_minor(devminor_t minor)

{

if (minor < BPFDEV_BASE_MINOR ||

(unsigned int)minor >= BPFDEV_BASE_MINOR + __arraycount(bpf_array))

return NULL;

return &bpf_array[minor - BPFDEV_BASE_MINOR];

}

/*

* Open a BPF device, returning a cloned device instance.

*/

static int

bpfdev_open(devminor_t minor, int access __unused, endpoint_t user_endpt)

{

struct bpfdev_link *bpfl;

struct bpfdev *bpf;

/* Disallow opening cloned devices through device nodes. */

if (minor != BPFDEV_MINOR)

return ENXIO;

if (TAILQ_EMPTY(&bpfl_freelist))

return ENOBUFS;

bpfl = TAILQ_FIRST(&bpfl_freelist);

TAILQ_REMOVE(&bpfl_freelist, bpfl, bpfl_next);

bpf = (struct bpfdev *)bpfl;

memset(bpf, 0, sizeof(*bpf));

bpf->bpf_flags = BPFF_IN_USE | BPFF_SEESENT;

bpf->bpf_size = BPF_BUF_DEF;

bpf->bpf_pid = getnpid(user_endpt);

bpf->bpf_read.br_endpt = NONE;

bpf->bpf_select.bs_endpt = NONE;

return CDEV_CLONED | bpfdev_get_minor(bpf);

}

/*

* Close a BPF device.

*/

static int

bpfdev_close(devminor_t minor)

{

struct bpfdev *bpf;

if ((bpf = bpfdev_get_by_minor(minor)) == NULL)

return EINVAL;

/*

* There cannot possibly be a pending read request, so we never need to

* cancel the read timer from here either.

*/

assert(bpf->bpf_read.br_endpt == NONE);

if (bpf->bpf_sbuf != NULL) {

assert(bpf->bpf_hbuf != NULL);

if (munmap(bpf->bpf_sbuf, bpf->bpf_size) != 0)

panic("munmap failed: %d", -errno);

if (munmap(bpf->bpf_hbuf, bpf->bpf_size) != 0)

panic("munmap failed: %d", -errno);

bpf->bpf_sbuf = NULL;

bpf->bpf_hbuf = NULL;

} else

assert(bpf->bpf_hbuf == NULL);

if (bpf->bpf_filter != NULL) {

assert(bpf->bpf_filterlen > 0);

if (munmap(bpf->bpf_filter, bpf->bpf_filterlen) != 0)

panic("munmap failed: %d", -errno);

bpf->bpf_filter = NULL;

}

/*

* If the BPF device was attached to an interface, and that interface

* has not disappeared in the meantime, detach from it now.

*/

if (bpf->bpf_ifdev != NULL) {

if (bpf->bpf_flags & BPFF_PROMISC)

ifdev_clear_promisc(bpf->bpf_ifdev);

ifdev_detach_bpf(bpf->bpf_ifdev, &bpf->bpf_link);

bpf->bpf_ifdev = NULL;

}

bpf->bpf_flags = 0; /* mark as no longer in use */

TAILQ_INSERT_HEAD(&bpfl_freelist, &bpf->bpf_link, bpfl_next);

return OK;

}

/*

* Rotate buffers for the BPF device, by swapping the store buffer and the hold

* buffer.

*/

static void

bpfdev_rotate(struct bpfdev * bpf)

{

char *buf;

size_t len;

/*

* When rotating, the store buffer may or may not be empty, but the

* hold buffer must always be empty.

*/

assert(bpf->bpf_hlen == 0);

buf = bpf->bpf_sbuf;

len = bpf->bpf_slen;

bpf->bpf_sbuf = bpf->bpf_hbuf;

bpf->bpf_slen = bpf->bpf_hlen;

bpf->bpf_hbuf = buf;

bpf->bpf_hlen = len;

}

/*

* Test whether any of the given select operations are ready on the BPF device,

* and return the set of ready operations.

*/

static unsigned int

bpfdev_test_select(struct bpfdev * bpf, unsigned int ops)

{

unsigned int ready_ops;

ready_ops = 0;

/*

* The BPF device is ready for reading if the hold buffer is not empty

* (i.e.: the store buffer has been filled up completely and was

* therefore rotated) or if immediate mode is set and the store buffer

* is not empty (i.e.: any packet is available at all). In the latter

* case, the buffers will be rotated during the read. We do not

* support applying the read timeout to selects and maintaining state

* between the select and the following read, because despite that

* libpcap claims that it is the right behavior, that is just insane.

*/

if (ops & CDEV_OP_RD) {

if (bpf->bpf_ifdev == NULL)

ready_ops |= CDEV_OP_RD;

else if (bpf->bpf_hlen > 0)

ready_ops |= CDEV_OP_RD;

else if ((bpf->bpf_flags & BPFF_IMMEDIATE) &&

bpf->bpf_slen > 0)

ready_ops |= CDEV_OP_RD;

}

if (ops & CDEV_OP_WR)

ready_ops |= CDEV_OP_WR;

return ready_ops;

}

/*

* There has been a state change on the BPF device. If now possible, resume a

* pending select query, if any.

*/

static void

bpfdev_resume_select(struct bpfdev * bpf)

{

unsigned int ops, ready_ops;

endpoint_t endpt;

/* First see if there is a pending select request at all. */

if ((endpt = bpf->bpf_select.bs_endpt) == NONE)

return;

ops = bpf->bpf_select.bs_selops;

assert(ops != 0);

/* Then see if any of the pending operations are now ready. */

if ((ready_ops = bpfdev_test_select(bpf, ops)) == 0)

return;

/* If so, notify VFS about the ready operations. */

chardriver_reply_select(bpf->bpf_select.bs_endpt,

bpfdev_get_minor(bpf), ready_ops);

/*

* Forget about the ready operations. If that leaves no pending

* operations, forget about the select request altogether.

*/

if ((bpf->bpf_select.bs_selops &= ~ready_ops) == 0)

bpf->bpf_select.bs_endpt = NONE;

}

/*

* There has been a state change on the BPF device. If now possible, resume a

* pending read request, if any. If the call is a result of a timeout,

* 'is_timeout' is set. In that case, the read request must be resumed with an

* EAGAIN error if no packets are available, and the running timer must be

* canceled. Otherwise, the resumption is due to a full buffer or a

* disappeared interface, and 'is_timeout' is not set. In this case, the read

* request must be resumed with an I/O error if no packets are available.

*/

static void

bpfdev_resume_read(struct bpfdev * bpf, int is_timeout)

{

ssize_t r;

assert(bpf->bpf_read.br_endpt != NONE);

/*

* If the hold buffer is still empty, see if the store buffer has

* any packets to copy out.

*/

if (bpf->bpf_hlen == 0)

bpfdev_rotate(bpf);

/* Return any available packets, or otherwise an error. */

if (bpf->bpf_hlen > 0) {

assert(bpf->bpf_hlen <= bpf->bpf_size);

r = sys_safecopyto(bpf->bpf_read.br_endpt,

bpf->bpf_read.br_grant, 0, (vir_bytes)bpf->bpf_hbuf,

bpf->bpf_hlen);

if (r == OK) {

r = (ssize_t)bpf->bpf_hlen;

bpf->bpf_hlen = 0;

assert(bpf->bpf_slen != bpf->bpf_size);

/*

* Allow readers to get the last packets after the

* interface has disappeared, before getting errors.

*/

if (bpf->bpf_ifdev == NULL)

bpfdev_rotate(bpf);

}

} else

r = (is_timeout) ? EAGAIN : EIO;

chardriver_reply_task(bpf->bpf_read.br_endpt, bpf->bpf_read.br_id, r);

bpf->bpf_read.br_endpt = NONE;

/* Was there still a timer running? Then cancel it now. */

if (bpf->bpf_timeout > 0 && !is_timeout)

cancel_timer(&bpf->bpf_read.br_timer);

}

/*

* A read timeout has triggered for the BPF device. Wake up the pending read

* request.

*/

static void

bpfdev_timeout(int arg)

{

struct bpfdev *bpf;

assert(arg >= 0 && (unsigned int)arg < __arraycount(bpf_array));

bpf = &bpf_array[arg];

assert(bpf->bpf_read.br_endpt != NONE);

bpfdev_resume_read(bpf, TRUE /*is_timeout*/);

}

/*

* Read from a BPF device.

*/

static ssize_t

bpfdev_read(devminor_t minor, uint64_t position, endpoint_t endpt,

cp_grant_id_t grant, size_t size, int flags, cdev_id_t id)

{

struct bpfdev *bpf;

ssize_t r;

int suspend;

if ((bpf = bpfdev_get_by_minor(minor)) == NULL)

return EINVAL;

/* Allow only one read call at a time. */

if (bpf->bpf_read.br_endpt != NONE)

return EIO;

/* Has this BPF device been configured at all yet? */

if (bpf->bpf_sbuf == NULL)

return EINVAL;

/*

* Does the read call size match the entire buffer size? This is a

* ridiculous requirement but it makes our job quite a bit easier..

*/

if (size != bpf->bpf_size)

return EINVAL;

/*

* Following standard receive semantics, if the interface is gone,

* return all the packets that were pending before returning an error.

* This requires extra buffer rotations after read completion, too.

*/

if (bpf->bpf_ifdev == NULL && bpf->bpf_hlen == 0)

return EIO;

/*

* If immediate mode is not enabled, we should always suspend the read

* call if the hold buffer is empty. If immediate mode is enabled, we

* should only suspend the read call if both buffers are empty, and

* return data from the hold buffer or otherwise the store buffer,

* whichever is not empty. A non-blocking call behaves as though

* immediate mode is enabled, except it will return EAGAIN instead of

* suspending the read call if both buffers are empty. Thus, we may

* have to rotate buffers for both immediate mode and non-blocking

* calls. The latter is necessary for libpcap to behave correctly.

*/

if ((flags & CDEV_NONBLOCK) || (bpf->bpf_flags & BPFF_IMMEDIATE))

suspend = (bpf->bpf_hlen == 0 && bpf->bpf_slen == 0);

else

suspend = (bpf->bpf_hlen == 0);

if (suspend) {

if (flags & CDEV_NONBLOCK)

return EAGAIN;

/* Suspend the read call for later. */

bpf->bpf_read.br_endpt = endpt;

bpf->bpf_read.br_grant = grant;

bpf->bpf_read.br_id = id;

/* Set a timer if requested. */

if (bpf->bpf_timeout > 0)

set_timer(&bpf->bpf_read.br_timer, bpf->bpf_timeout,

bpfdev_timeout, (int)(bpf - bpf_array));

return EDONTREPLY;

}

/* If we get here, either buffer has data; rotate buffers if needed. */

if (bpf->bpf_hlen == 0)

bpfdev_rotate(bpf);

assert(bpf->bpf_hlen > 0);

if ((r = sys_safecopyto(endpt, grant, 0, (vir_bytes)bpf->bpf_hbuf,

bpf->bpf_hlen)) != OK)

return r;

r = (ssize_t)bpf->bpf_hlen;

bpf->bpf_hlen = 0;

/*

* If the store buffer is exactly full, rotate it now. Also, if the

* interface has disappeared, the store buffer will never fill up.

* Rotate it so that the application will get any remaining data before

* getting errors about the interface being gone.

*/

if (bpf->bpf_slen == bpf->bpf_size || bpf->bpf_ifdev == NULL)

bpfdev_rotate(bpf);

return r;

}

/*

* Write to a BPF device.

*/

static ssize_t

bpfdev_write(devminor_t minor, uint64_t position, endpoint_t endpt,

cp_grant_id_t grant, size_t size, int flags, cdev_id_t id)

{

struct bpfdev *bpf;

struct pbuf *pbuf, *pptr, *pcopy;

size_t off;

err_t err;

int r;

if ((bpf = bpfdev_get_by_minor(minor)) == NULL)

return EINVAL;

if (bpf->bpf_ifdev == NULL)

return EINVAL;

/* VFS skips zero-sized I/O calls right now, but that may change. */

if (size == 0)

return 0; /* nothing to do */

if (size > ifdev_get_hdrlen(bpf->bpf_ifdev) +

ifdev_get_mtu(bpf->bpf_ifdev))

return EMSGSIZE;

if ((pbuf = pchain_alloc(PBUF_LINK, size)) == NULL)

return ENOMEM;

/* TODO: turn this into a series of vector copies. */

off = 0;

for (pptr = pbuf; pptr != NULL; pptr = pptr->next) {

if ((r = sys_safecopyfrom(endpt, grant, off,

(vir_bytes)pptr->payload, pptr->len)) != OK) {

pbuf_free(pbuf);

return r;

}

off += pptr->len;

}

assert(off == size);

/*

* In feedback mode, we cannot use the same packet buffers for both

* output and input, so make a copy. We do this before calling the

* output function, which may change part of the buffers, because the

* BSDs take this approach as well.

*/

if (bpf->bpf_flags & BPFF_FEEDBACK) {

if ((pcopy = pchain_alloc(PBUF_LINK, size)) == NULL) {

pbuf_free(pbuf);

return ENOMEM;

}

if (pbuf_copy(pcopy, pbuf) != ERR_OK)

panic("unexpected pbuf copy failure");

} else

pcopy = NULL;

/* Pass in the packet as output, and free it again. */

err = ifdev_output(bpf->bpf_ifdev, pbuf, NULL /*netif*/,

TRUE /*to_bpf*/, !!(bpf->bpf_flags & BPFF_HDRCMPLT));

pbuf_free(pbuf);

/* In feedback mode, pass in the copy as input, if output succeeded. */

if (err == ERR_OK && (bpf->bpf_flags & BPFF_FEEDBACK))

ifdev_input(bpf->bpf_ifdev, pcopy, NULL /*netif*/,

FALSE /*to_bpf*/);

else if (pcopy != NULL)

pbuf_free(pcopy);

return (err == ERR_OK) ? (ssize_t)size : util_convert_err(err);

}

/*

* Attach a BPF device to a network interface, using the interface name given

* in an ifreq structure. As side effect, allocate hold and store buffers for

* the device. These buffers will stay allocated until the device is closed,

* even though the interface may disappear before that. Return OK if the BPF

* device was successfully attached to the interface, or a negative error code

* otherwise.

*/

static int

bpfdev_attach(struct bpfdev * bpf, struct ifreq * ifr)

{

struct ifdev *ifdev;

void *sbuf, *hbuf;

/* Find the interface with the given name. */

ifr->ifr_name[sizeof(ifr->ifr_name) - 1] = '\0';

if ((ifdev = ifdev_find_by_name(ifr->ifr_name)) == NULL)

return ENXIO;

/*

* Allocate a store buffer and a hold buffer. Preallocate the memory,

* or we might get killed later during low-memory conditions.

*/

if ((sbuf = (char *)mmap(NULL, bpf->bpf_size, PROT_READ | PROT_WRITE,

MAP_ANON | MAP_PRIVATE | MAP_PREALLOC, -1, 0)) == MAP_FAILED)

return ENOMEM;

if ((hbuf = (char *)mmap(NULL, bpf->bpf_size, PROT_READ | PROT_WRITE,

MAP_ANON | MAP_PRIVATE | MAP_PREALLOC, -1, 0)) == MAP_FAILED) {

(void)munmap(sbuf, bpf->bpf_size);

return ENOMEM;

}

bpf->bpf_ifdev = ifdev;

bpf->bpf_sbuf = sbuf;

bpf->bpf_hbuf = hbuf;

assert(bpf->bpf_slen == 0);

assert(bpf->bpf_hlen == 0);

ifdev_attach_bpf(ifdev, &bpf->bpf_link);

return OK;

}

/*

* Detach the BPF device from its interface, which is about to disappear.

*/

void

bpfdev_detach(struct bpfdev_link * bpfl)

{

struct bpfdev *bpf = (struct bpfdev *)bpfl;

assert(bpf->bpf_flags & BPFF_IN_USE);

assert(bpf->bpf_ifdev != NULL);

/*

* We deliberately leave the buffers allocated here, for two reasons:

*

* 1) it lets applications to read any last packets in the buffers;

* 2) it prevents reattaching the BPF device to another interface.

*/

bpf->bpf_ifdev = NULL;

/*

* Resume pending read and select requests, returning any data left,

* or an error if none.

*/

if (bpf->bpf_hlen == 0)

bpfdev_rotate(bpf);

if (bpf->bpf_read.br_endpt != NONE)

bpfdev_resume_read(bpf, FALSE /*is_timeout*/);

bpfdev_resume_select(bpf);

}

/*

* Flush the given BPF device, resetting its buffer contents and statistics

* counters.

*/

static void

bpfdev_flush(struct bpfdev * bpf)

{

bpf->bpf_slen = 0;

bpf->bpf_hlen = 0;

bpf->bpf_stat.bs_recv = 0;

bpf->bpf_stat.bs_drop = 0;

bpf->bpf_stat.bs_capt = 0;

}

/*

* Install a filter program on the BPF device. A new filter replaces any old

* one. A zero-sized filter simply clears a previous filter. On success,

* perform a flush and return OK. On failure, return a negative error code

* without making any modifications to the current filter.

*/

static int

bpfdev_setfilter(struct bpfdev * bpf, endpoint_t endpt, cp_grant_id_t grant)

{

struct bpf_insn *filter;

unsigned int count;

size_t len;

int r;

if ((r = sys_safecopyfrom(endpt, grant,

offsetof(struct minix_bpf_program, mbf_len), (vir_bytes)&count,

sizeof(count))) != OK)

return r;

if (count > BPF_MAXINSNS)

return EINVAL;

len = count * sizeof(struct bpf_insn);

if (len > 0) {

if ((filter = (struct bpf_insn *)mmap(NULL, len,

PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0)) ==

MAP_FAILED)

return ENOMEM;

if ((r = sys_safecopyfrom(endpt, grant,

offsetof(struct minix_bpf_program, mbf_insns),

(vir_bytes)filter, len)) != OK) {

(void)munmap(filter, len);

return r;

}

if (!bpf_validate(filter, count)) {

(void)munmap(filter, len);

return EINVAL;

}

} else

filter = NULL;

if (bpf->bpf_filter != NULL)

(void)munmap(bpf->bpf_filter, bpf->bpf_filterlen);

bpf->bpf_filter = filter;

bpf->bpf_filterlen = len;

bpfdev_flush(bpf);

return OK;

}

/*

* Process an I/O control request on the BPF device.

*/

static int

bpfdev_ioctl(devminor_t minor, unsigned long request, endpoint_t endpt,

cp_grant_id_t grant, int flags, endpoint_t user_endpt, cdev_id_t id)

{

struct bpfdev *bpf;

struct bpf_stat bs;

struct bpf_version bv;

struct bpf_dltlist bfl;

struct timeval tv;

struct ifreq ifr;

unsigned int uval;

int r, val;

if ((bpf = bpfdev_get_by_minor(minor)) == NULL)

return EINVAL;

/*

* We do not support multiple concurrent requests in this module. That

* not only means that we forbid a read(2) call on a BPF device object

* while another read(2) is already pending: we also disallow IOCTL

* IOCTL calls while such a read(2) call is in progress. This

* restriction should never be a problem for user programs, and allows

* us to rely on the fact that that no settings can change between the

* start and end of any read call. As a side note, pending select(2)

* queries may be similarly affected, and will also not be fully

* accurate if any options are changed while pending.

*/

if (bpf->bpf_read.br_endpt != NONE)

return EIO;

bpf->bpf_pid = getnpid(user_endpt);

/* These are in order of the NetBSD BIOC.. IOCTL numbers. */

switch (request) {

case BIOCGBLEN:

uval = bpf->bpf_size;

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval));

case BIOCSBLEN:

if (bpf->bpf_sbuf != NULL)

return EINVAL;

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval))) != OK)

return r;

if (uval < BPF_BUF_MIN)

uval = BPF_BUF_MIN;

else if (uval > BPF_BUF_MAX)

uval = BPF_BUF_MAX;

/* Is this the right thing to do? It doesn't matter for us. */

uval = BPF_WORDALIGN(uval);

if ((r = sys_safecopyto(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval))) != OK)

return r;

bpf->bpf_size = uval;

return OK;

case MINIX_BIOCSETF:

return bpfdev_setfilter(bpf, endpt, grant);

case BIOCPROMISC:

if (bpf->bpf_ifdev == NULL)

return EINVAL;

if (!(bpf->bpf_flags & BPFF_PROMISC)) {

if (!ifdev_set_promisc(bpf->bpf_ifdev))

return EINVAL;

bpf->bpf_flags |= BPFF_PROMISC;

}

return OK;

case BIOCFLUSH:

bpfdev_flush(bpf);

return OK;

case BIOCGDLT:

if (bpf->bpf_ifdev == NULL)

return EINVAL;

/* TODO: support for type configuration per BPF device. */

uval = ifdev_get_dlt(bpf->bpf_ifdev);

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval));

case BIOCGETIF:

if (bpf->bpf_ifdev == NULL)

return EINVAL;

memset(&ifr, 0, sizeof(ifr));

strlcpy(ifr.ifr_name, ifdev_get_name(bpf->bpf_ifdev),

sizeof(ifr.ifr_name));

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&ifr,

sizeof(ifr));

case BIOCSETIF:

/*

* Test on the presence of a buffer rather than on an interface

* since the latter may disappear and thus be reset to NULL, in

* which case we do not want to allow rebinding to another.

*/

if (bpf->bpf_sbuf != NULL)

return EINVAL;

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&ifr,

sizeof(ifr))) != OK)

return r;

return bpfdev_attach(bpf, &ifr);

case BIOCGSTATS:

/*

* Why do we not embed a bpf_stat structure directly in the

* BPF device structure? Well, bpf_stat has massive padding..

*/

memset(&bs, 0, sizeof(bs));

bs.bs_recv = bpf->bpf_stat.bs_recv;

bs.bs_drop = bpf->bpf_stat.bs_drop;

bs.bs_capt = bpf->bpf_stat.bs_capt;

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&bs,

sizeof(bs));

case BIOCIMMEDIATE:

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval))) != OK)

return r;

if (uval)

bpf->bpf_flags |= BPFF_IMMEDIATE;

else

bpf->bpf_flags &= ~BPFF_IMMEDIATE;

return OK;

case BIOCVERSION:

memset(&bv, 0, sizeof(bv));

bv.bv_major = BPF_MAJOR_VERSION;

bv.bv_minor = BPF_MINOR_VERSION;

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&bv,

sizeof(bv));

case BIOCGHDRCMPLT:

uval = !!(bpf->bpf_flags & BPFF_HDRCMPLT);

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval));

case BIOCSHDRCMPLT:

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval))) != OK)

return r;

if (uval)

bpf->bpf_flags |= BPFF_HDRCMPLT;

else

bpf->bpf_flags &= ~BPFF_HDRCMPLT;

return OK;

case BIOCSDLT:

if (bpf->bpf_ifdev == NULL)

return EINVAL;

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval))) != OK)

return r;

/* TODO: support for type configuration per BPF device. */

if (uval != ifdev_get_dlt(bpf->bpf_ifdev))

return EINVAL;

return OK;

case MINIX_BIOCGDLTLIST:

if (bpf->bpf_ifdev == NULL)

return EINVAL;

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&bfl,

sizeof(bfl))) != OK)

return r;

if (bfl.bfl_list != NULL) {

if (bfl.bfl_len < 1)

return ENOMEM;

/*

* Copy out the 'list', which consists of one entry.

* If we were to produce multiple entries, we would

* have to check against the MINIX_BPF_MAXDLT limit.

*/

uval = ifdev_get_dlt(bpf->bpf_ifdev);

if ((r = sys_safecopyto(endpt, grant,

offsetof(struct minix_bpf_dltlist, mbfl_list),

(vir_bytes)&uval, sizeof(uval))) != OK)

return r;

}

bfl.bfl_len = 1;

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&bfl,

sizeof(bfl));

case BIOCGSEESENT:

uval = !!(bpf->bpf_flags & BPFF_SEESENT);

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval));

case BIOCSSEESENT:

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&uval,

sizeof(uval))) != OK)

return r;

if (uval)

bpf->bpf_flags |= BPFF_SEESENT;

else

bpf->bpf_flags &= ~BPFF_SEESENT;

return OK;

case BIOCSRTIMEOUT:

if ((r = sys_safecopyfrom(endpt, grant, 0, (vir_bytes)&tv,

sizeof(tv))) != OK)

return r;

if ((r = util_timeval_to_ticks(&tv, &bpf->bpf_timeout)) != OK)

return r;

return OK;

case BIOCGRTIMEOUT:

util_ticks_to_timeval(bpf->bpf_timeout, &tv);

return sys_safecopyto(endpt, grant, 0, (vir_bytes)&tv,

sizeof(tv));

case BIOCGFEEDBACK: