1 /* $NetBSD: if_tap.c,v 1.124 2021/09/26 15:58:33 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 2003, 2004, 2008, 2009 The NetBSD Foundation. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * tap(4) is a virtual Ethernet interface. It appears as a real Ethernet 31 * device to the system, but can also be accessed by userland through a 32 * character device interface, which allows reading and injecting frames. 33 */ 34 35 #include <sys/cdefs.h> 36 __KERNEL_RCSID(0, "$NetBSD: if_tap.c,v 1.124 2021/09/26 15:58:33 thorpej Exp $"); 37 38 #if defined(_KERNEL_OPT) 39 40 #include "opt_modular.h" 41 #endif 42 43 #include <sys/param.h> 44 #include <sys/atomic.h> 45 #include <sys/conf.h> 46 #include <sys/cprng.h> 47 #include <sys/device.h> 48 #include <sys/file.h> 49 #include <sys/filedesc.h> 50 #include <sys/intr.h> 51 #include <sys/kauth.h> 52 #include <sys/kernel.h> 53 #include <sys/kmem.h> 54 #include <sys/module.h> 55 #include <sys/mutex.h> 56 #include <sys/condvar.h> 57 #include <sys/poll.h> 58 #include <sys/proc.h> 59 #include <sys/select.h> 60 #include <sys/sockio.h> 61 #include <sys/stat.h> 62 #include <sys/sysctl.h> 63 #include <sys/systm.h> 64 65 #include <net/if.h> 66 #include <net/if_dl.h> 67 #include <net/if_ether.h> 68 #include <net/if_tap.h> 69 #include <net/bpf.h> 70 71 #include "ioconf.h" 72 73 /* 74 * sysctl node management 75 * 76 * It's not really possible to use a SYSCTL_SETUP block with 77 * current module implementation, so it is easier to just define 78 * our own function. 79 * 80 * The handler function is a "helper" in Andrew Brown's sysctl 81 * framework terminology. It is used as a gateway for sysctl 82 * requests over the nodes. 83 * 84 * tap_log allows the module to log creations of nodes and 85 * destroy them all at once using sysctl_teardown. 86 */ 87 static int tap_node; 88 static int tap_sysctl_handler(SYSCTLFN_PROTO); 89 static void sysctl_tap_setup(struct sysctllog **); 90 91 struct tap_softc { 92 device_t sc_dev; 93 struct ethercom sc_ec; 94 int sc_flags; 95 #define TAP_INUSE 0x00000001 /* tap device can only be opened once */ 96 #define TAP_ASYNCIO 0x00000002 /* user is using async I/O (SIGIO) on the device */ 97 #define TAP_NBIO 0x00000004 /* user wants calls to avoid blocking */ 98 #define TAP_GOING 0x00000008 /* interface is being destroyed */ 99 struct selinfo sc_rsel; 100 pid_t sc_pgid; /* For async. IO */ 101 kmutex_t sc_lock; 102 kcondvar_t sc_cv; 103 void *sc_sih; 104 struct timespec sc_atime; 105 struct timespec sc_mtime; 106 struct timespec sc_btime; 107 }; 108 109 /* autoconf(9) glue */ 110 111 static int tap_match(device_t, cfdata_t, void *); 112 static void tap_attach(device_t, device_t, void *); 113 static int tap_detach(device_t, int); 114 115 CFATTACH_DECL_NEW(tap, sizeof(struct tap_softc), 116 tap_match, tap_attach, tap_detach, NULL); 117 extern struct cfdriver tap_cd; 118 119 /* Real device access routines */ 120 static int tap_dev_close(struct tap_softc *); 121 static int tap_dev_read(int, struct uio *, int); 122 static int tap_dev_write(int, struct uio *, int); 123 static int tap_dev_ioctl(int, u_long, void *, struct lwp *); 124 static int tap_dev_poll(int, int, struct lwp *); 125 static int tap_dev_kqfilter(int, struct knote *); 126 127 /* Fileops access routines */ 128 static int tap_fops_close(file_t *); 129 static int tap_fops_read(file_t *, off_t *, struct uio *, 130 kauth_cred_t, int); 131 static int tap_fops_write(file_t *, off_t *, struct uio *, 132 kauth_cred_t, int); 133 static int tap_fops_ioctl(file_t *, u_long, void *); 134 static int tap_fops_poll(file_t *, int); 135 static int tap_fops_stat(file_t *, struct stat *); 136 static int tap_fops_kqfilter(file_t *, struct knote *); 137 138 static const struct fileops tap_fileops = { 139 .fo_name = "tap", 140 .fo_read = tap_fops_read, 141 .fo_write = tap_fops_write, 142 .fo_ioctl = tap_fops_ioctl, 143 .fo_fcntl = fnullop_fcntl, 144 .fo_poll = tap_fops_poll, 145 .fo_stat = tap_fops_stat, 146 .fo_close = tap_fops_close, 147 .fo_kqfilter = tap_fops_kqfilter, 148 .fo_restart = fnullop_restart, 149 }; 150 151 /* Helper for cloning open() */ 152 static int tap_dev_cloner(struct lwp *); 153 154 /* Character device routines */ 155 static int tap_cdev_open(dev_t, int, int, struct lwp *); 156 static int tap_cdev_close(dev_t, int, int, struct lwp *); 157 static int tap_cdev_read(dev_t, struct uio *, int); 158 static int tap_cdev_write(dev_t, struct uio *, int); 159 static int tap_cdev_ioctl(dev_t, u_long, void *, int, struct lwp *); 160 static int tap_cdev_poll(dev_t, int, struct lwp *); 161 static int tap_cdev_kqfilter(dev_t, struct knote *); 162 163 const struct cdevsw tap_cdevsw = { 164 .d_open = tap_cdev_open, 165 .d_close = tap_cdev_close, 166 .d_read = tap_cdev_read, 167 .d_write = tap_cdev_write, 168 .d_ioctl = tap_cdev_ioctl, 169 .d_stop = nostop, 170 .d_tty = notty, 171 .d_poll = tap_cdev_poll, 172 .d_mmap = nommap, 173 .d_kqfilter = tap_cdev_kqfilter, 174 .d_discard = nodiscard, 175 .d_flag = D_OTHER | D_MPSAFE 176 }; 177 178 #define TAP_CLONER 0xfffff /* Maximal minor value */ 179 180 /* kqueue-related routines */ 181 static void tap_kqdetach(struct knote *); 182 static int tap_kqread(struct knote *, long); 183 184 /* 185 * Those are needed by the ifnet interface, and would typically be 186 * there for any network interface driver. 187 * Some other routines are optional: watchdog and drain. 188 */ 189 static void tap_start(struct ifnet *); 190 static void tap_stop(struct ifnet *, int); 191 static int tap_init(struct ifnet *); 192 static int tap_ioctl(struct ifnet *, u_long, void *); 193 194 /* Internal functions */ 195 static int tap_lifaddr(struct ifnet *, u_long, struct ifaliasreq *); 196 static void tap_softintr(void *); 197 198 /* 199 * tap is a clonable interface, although it is highly unrealistic for 200 * an Ethernet device. 201 * 202 * Here are the bits needed for a clonable interface. 203 */ 204 static int tap_clone_create(struct if_clone *, int); 205 static int tap_clone_destroy(struct ifnet *); 206 207 struct if_clone tap_cloners = IF_CLONE_INITIALIZER("tap", 208 tap_clone_create, 209 tap_clone_destroy); 210 211 /* Helper functions shared by the two cloning code paths */ 212 static struct tap_softc * tap_clone_creator(int); 213 int tap_clone_destroyer(device_t); 214 215 static struct sysctllog *tap_sysctl_clog; 216 217 #ifdef _MODULE 218 devmajor_t tap_bmajor = -1, tap_cmajor = -1; 219 #endif 220 221 static u_int tap_count; 222 223 void 224 tapattach(int n) 225 { 226 227 /* 228 * Nothing to do here, initialization is handled by the 229 * module initialization code in tapinit() below). 230 */ 231 } 232 233 static void 234 tapinit(void) 235 { 236 int error = config_cfattach_attach(tap_cd.cd_name, &tap_ca); 237 238 if (error) { 239 aprint_error("%s: unable to register cfattach\n", 240 tap_cd.cd_name); 241 (void)config_cfdriver_detach(&tap_cd); 242 return; 243 } 244 245 if_clone_attach(&tap_cloners); 246 sysctl_tap_setup(&tap_sysctl_clog); 247 #ifdef _MODULE 248 devsw_attach("tap", NULL, &tap_bmajor, &tap_cdevsw, &tap_cmajor); 249 #endif 250 } 251 252 static int 253 tapdetach(void) 254 { 255 int error = 0; 256 257 if_clone_detach(&tap_cloners); 258 #ifdef _MODULE 259 error = devsw_detach(NULL, &tap_cdevsw); 260 if (error != 0) 261 goto out2; 262 #endif 263 264 if (tap_count != 0) { 265 error = EBUSY; 266 goto out1; 267 } 268 269 error = config_cfattach_detach(tap_cd.cd_name, &tap_ca); 270 if (error != 0) 271 goto out1; 272 273 sysctl_teardown(&tap_sysctl_clog); 274 275 return 0; 276 277 out1: 278 #ifdef _MODULE 279 devsw_attach("tap", NULL, &tap_bmajor, &tap_cdevsw, &tap_cmajor); 280 out2: 281 #endif 282 if_clone_attach(&tap_cloners); 283 284 return error; 285 } 286 287 /* Pretty much useless for a pseudo-device */ 288 static int 289 tap_match(device_t parent, cfdata_t cfdata, void *arg) 290 { 291 292 return 1; 293 } 294 295 void 296 tap_attach(device_t parent, device_t self, void *aux) 297 { 298 struct tap_softc *sc = device_private(self); 299 struct ifnet *ifp; 300 const struct sysctlnode *node; 301 int error; 302 uint8_t enaddr[ETHER_ADDR_LEN] = 303 { 0xf2, 0x0b, 0xa4, 0xff, 0xff, 0xff }; 304 char enaddrstr[3 * ETHER_ADDR_LEN]; 305 306 sc->sc_dev = self; 307 sc->sc_sih = NULL; 308 getnanotime(&sc->sc_btime); 309 sc->sc_atime = sc->sc_mtime = sc->sc_btime; 310 sc->sc_flags = 0; 311 selinit(&sc->sc_rsel); 312 313 cv_init(&sc->sc_cv, "tapread"); 314 mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NET); 315 316 if (!pmf_device_register(self, NULL, NULL)) 317 aprint_error_dev(self, "couldn't establish power handler\n"); 318 319 /* 320 * In order to obtain unique initial Ethernet address on a host, 321 * do some randomisation. It's not meant for anything but avoiding 322 * hard-coding an address. 323 */ 324 cprng_fast(&enaddr[3], 3); 325 326 aprint_verbose_dev(self, "Ethernet address %s\n", 327 ether_snprintf(enaddrstr, sizeof(enaddrstr), enaddr)); 328 329 /* 330 * One should note that an interface must do multicast in order 331 * to support IPv6. 332 */ 333 ifp = &sc->sc_ec.ec_if; 334 strcpy(ifp->if_xname, device_xname(self)); 335 ifp->if_softc = sc; 336 ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST; 337 #ifdef NET_MPSAFE 338 ifp->if_extflags = IFEF_MPSAFE; 339 #endif 340 ifp->if_ioctl = tap_ioctl; 341 ifp->if_start = tap_start; 342 ifp->if_stop = tap_stop; 343 ifp->if_init = tap_init; 344 IFQ_SET_READY(&ifp->if_snd); 345 346 sc->sc_ec.ec_capabilities = ETHERCAP_VLAN_MTU | ETHERCAP_JUMBO_MTU; 347 348 /* Those steps are mandatory for an Ethernet driver. */ 349 if_initialize(ifp); 350 ifp->if_percpuq = if_percpuq_create(ifp); 351 ether_ifattach(ifp, enaddr); 352 /* Opening the device will bring the link state up. */ 353 ifp->if_link_state = LINK_STATE_DOWN; 354 if_register(ifp); 355 356 /* 357 * Add a sysctl node for that interface. 358 * 359 * The pointer transmitted is not a string, but instead a pointer to 360 * the softc structure, which we can use to build the string value on 361 * the fly in the helper function of the node. See the comments for 362 * tap_sysctl_handler for details. 363 * 364 * Usually sysctl_createv is called with CTL_CREATE as the before-last 365 * component. However, we can allocate a number ourselves, as we are 366 * the only consumer of the net.link.<iface> node. In this case, the 367 * unit number is conveniently used to number the node. CTL_CREATE 368 * would just work, too. 369 */ 370 if ((error = sysctl_createv(NULL, 0, NULL, 371 &node, CTLFLAG_READWRITE, 372 CTLTYPE_STRING, device_xname(self), NULL, 373 tap_sysctl_handler, 0, (void *)sc, 18, 374 CTL_NET, AF_LINK, tap_node, device_unit(sc->sc_dev), 375 CTL_EOL)) != 0) 376 aprint_error_dev(self, 377 "sysctl_createv returned %d, ignoring\n", error); 378 } 379 380 /* 381 * When detaching, we do the inverse of what is done in the attach 382 * routine, in reversed order. 383 */ 384 static int 385 tap_detach(device_t self, int flags) 386 { 387 struct tap_softc *sc = device_private(self); 388 struct ifnet *ifp = &sc->sc_ec.ec_if; 389 int error; 390 391 sc->sc_flags |= TAP_GOING; 392 tap_stop(ifp, 1); 393 if_down(ifp); 394 395 if (sc->sc_sih != NULL) { 396 softint_disestablish(sc->sc_sih); 397 sc->sc_sih = NULL; 398 } 399 400 /* 401 * Destroying a single leaf is a very straightforward operation using 402 * sysctl_destroyv. One should be sure to always end the path with 403 * CTL_EOL. 404 */ 405 if ((error = sysctl_destroyv(NULL, CTL_NET, AF_LINK, tap_node, 406 device_unit(sc->sc_dev), CTL_EOL)) != 0) 407 aprint_error_dev(self, 408 "sysctl_destroyv returned %d, ignoring\n", error); 409 ether_ifdetach(ifp); 410 if_detach(ifp); 411 seldestroy(&sc->sc_rsel); 412 mutex_destroy(&sc->sc_lock); 413 cv_destroy(&sc->sc_cv); 414 415 pmf_device_deregister(self); 416 417 return 0; 418 } 419 420 /* 421 * This is the function where we SEND packets. 422 * 423 * There is no 'receive' equivalent. A typical driver will get 424 * interrupts from the hardware, and from there will inject new packets 425 * into the network stack. 426 * 427 * Once handled, a packet must be freed. A real driver might not be able 428 * to fit all the pending packets into the hardware, and is allowed to 429 * return before having sent all the packets. It should then use the 430 * if_flags flag IFF_OACTIVE to notify the upper layer. 431 * 432 * There are also other flags one should check, such as IFF_PAUSE. 433 * 434 * It is our duty to make packets available to BPF listeners. 435 * 436 * You should be aware that this function is called by the Ethernet layer 437 * at splnet(). 438 * 439 * When the device is opened, we have to pass the packet(s) to the 440 * userland. For that we stay in OACTIVE mode while the userland gets 441 * the packets, and we send a signal to the processes waiting to read. 442 * 443 * wakeup(sc) is the counterpart to the tsleep call in 444 * tap_dev_read, while selnotify() is used for kevent(2) and 445 * poll(2) (which includes select(2)) listeners. 446 */ 447 static void 448 tap_start(struct ifnet *ifp) 449 { 450 struct tap_softc *sc = (struct tap_softc *)ifp->if_softc; 451 struct mbuf *m0; 452 453 mutex_enter(&sc->sc_lock); 454 if ((sc->sc_flags & TAP_INUSE) == 0) { 455 /* Simply drop packets */ 456 for (;;) { 457 IFQ_DEQUEUE(&ifp->if_snd, m0); 458 if (m0 == NULL) 459 goto done; 460 461 if_statadd2(ifp, if_opackets, 1, if_obytes, m0->m_len); 462 bpf_mtap(ifp, m0, BPF_D_OUT); 463 464 m_freem(m0); 465 } 466 } else if (!IFQ_IS_EMPTY(&ifp->if_snd)) { 467 ifp->if_flags |= IFF_OACTIVE; 468 cv_broadcast(&sc->sc_cv); 469 selnotify(&sc->sc_rsel, 0, 1); 470 if (sc->sc_flags & TAP_ASYNCIO) { 471 kpreempt_disable(); 472 softint_schedule(sc->sc_sih); 473 kpreempt_enable(); 474 } 475 } 476 done: 477 mutex_exit(&sc->sc_lock); 478 } 479 480 static void 481 tap_softintr(void *cookie) 482 { 483 struct tap_softc *sc; 484 struct ifnet *ifp; 485 int a, b; 486 487 sc = cookie; 488 489 if (sc->sc_flags & TAP_ASYNCIO) { 490 ifp = &sc->sc_ec.ec_if; 491 if (ifp->if_flags & IFF_RUNNING) { 492 a = POLL_IN; 493 b = POLLIN | POLLRDNORM; 494 } else { 495 a = POLL_HUP; 496 b = 0; 497 } 498 fownsignal(sc->sc_pgid, SIGIO, a, b, NULL); 499 } 500 } 501 502 /* 503 * A typical driver will only contain the following handlers for 504 * ioctl calls, except SIOCSIFPHYADDR. 505 * The latter is a hack I used to set the Ethernet address of the 506 * faked device. 507 * 508 * Note that ether_ioctl() has to be called under splnet(). 509 */ 510 static int 511 tap_ioctl(struct ifnet *ifp, u_long cmd, void *data) 512 { 513 int s, error; 514 515 s = splnet(); 516 517 switch (cmd) { 518 case SIOCSIFPHYADDR: 519 error = tap_lifaddr(ifp, cmd, (struct ifaliasreq *)data); 520 break; 521 default: 522 error = ether_ioctl(ifp, cmd, data); 523 if (error == ENETRESET) 524 error = 0; 525 break; 526 } 527 528 splx(s); 529 530 return error; 531 } 532 533 /* 534 * Helper function to set Ethernet address. This has been replaced by 535 * the generic SIOCALIFADDR ioctl on a PF_LINK socket. 536 */ 537 static int 538 tap_lifaddr(struct ifnet *ifp, u_long cmd, struct ifaliasreq *ifra) 539 { 540 const struct sockaddr *sa = &ifra->ifra_addr; 541 542 if (sa->sa_family != AF_LINK) 543 return EINVAL; 544 545 if_set_sadl(ifp, sa->sa_data, ETHER_ADDR_LEN, false); 546 547 return 0; 548 } 549 550 /* 551 * _init() would typically be called when an interface goes up, 552 * meaning it should configure itself into the state in which it 553 * can send packets. 554 */ 555 static int 556 tap_init(struct ifnet *ifp) 557 { 558 ifp->if_flags |= IFF_RUNNING; 559 560 tap_start(ifp); 561 562 return 0; 563 } 564 565 /* 566 * _stop() is called when an interface goes down. It is our 567 * responsability to validate that state by clearing the 568 * IFF_RUNNING flag. 569 * 570 * We have to wake up all the sleeping processes to have the pending 571 * read requests cancelled. 572 */ 573 static void 574 tap_stop(struct ifnet *ifp, int disable) 575 { 576 struct tap_softc *sc = (struct tap_softc *)ifp->if_softc; 577 578 mutex_enter(&sc->sc_lock); 579 ifp->if_flags &= ~IFF_RUNNING; 580 cv_broadcast(&sc->sc_cv); 581 selnotify(&sc->sc_rsel, 0, 1); 582 if (sc->sc_flags & TAP_ASYNCIO) { 583 kpreempt_disable(); 584 softint_schedule(sc->sc_sih); 585 kpreempt_enable(); 586 } 587 mutex_exit(&sc->sc_lock); 588 } 589 590 /* 591 * The 'create' command of ifconfig can be used to create 592 * any numbered instance of a given device. Thus we have to 593 * make sure we have enough room in cd_devs to create the 594 * user-specified instance. config_attach_pseudo will do this 595 * for us. 596 */ 597 static int 598 tap_clone_create(struct if_clone *ifc, int unit) 599 { 600 601 if (tap_clone_creator(unit) == NULL) { 602 aprint_error("%s%d: unable to attach an instance\n", 603 tap_cd.cd_name, unit); 604 return ENXIO; 605 } 606 atomic_inc_uint(&tap_count); 607 return 0; 608 } 609 610 /* 611 * tap(4) can be cloned by two ways: 612 * using 'ifconfig tap0 create', which will use the network 613 * interface cloning API, and call tap_clone_create above. 614 * opening the cloning device node, whose minor number is TAP_CLONER. 615 * See below for an explanation on how this part work. 616 */ 617 static struct tap_softc * 618 tap_clone_creator(int unit) 619 { 620 cfdata_t cf; 621 622 cf = kmem_alloc(sizeof(*cf), KM_SLEEP); 623 cf->cf_name = tap_cd.cd_name; 624 cf->cf_atname = tap_ca.ca_name; 625 if (unit == -1) { 626 /* let autoconf find the first free one */ 627 cf->cf_unit = 0; 628 cf->cf_fstate = FSTATE_STAR; 629 } else { 630 cf->cf_unit = unit; 631 cf->cf_fstate = FSTATE_NOTFOUND; 632 } 633 634 return device_private(config_attach_pseudo(cf)); 635 } 636 637 /* 638 * The clean design of if_clone and autoconf(9) makes that part 639 * really straightforward. The second argument of config_detach 640 * means neither QUIET nor FORCED. 641 */ 642 static int 643 tap_clone_destroy(struct ifnet *ifp) 644 { 645 struct tap_softc *sc = ifp->if_softc; 646 int error = tap_clone_destroyer(sc->sc_dev); 647 648 if (error == 0) 649 atomic_dec_uint(&tap_count); 650 return error; 651 } 652 653 int 654 tap_clone_destroyer(device_t dev) 655 { 656 cfdata_t cf = device_cfdata(dev); 657 int error; 658 659 if ((error = config_detach(dev, 0)) != 0) 660 aprint_error_dev(dev, "unable to detach instance\n"); 661 kmem_free(cf, sizeof(*cf)); 662 663 return error; 664 } 665 666 /* 667 * tap(4) is a bit of an hybrid device. It can be used in two different 668 * ways: 669 * 1. ifconfig tapN create, then use /dev/tapN to read/write off it. 670 * 2. open /dev/tap, get a new interface created and read/write off it. 671 * That interface is destroyed when the process that had it created exits. 672 * 673 * The first way is managed by the cdevsw structure, and you access interfaces 674 * through a (major, minor) mapping: tap4 is obtained by the minor number 675 * 4. The entry points for the cdevsw interface are prefixed by tap_cdev_. 676 * 677 * The second way is the so-called "cloning" device. It's a special minor 678 * number (chosen as the maximal number, to allow as much tap devices as 679 * possible). The user first opens the cloner (e.g., /dev/tap), and that 680 * call ends in tap_cdev_open. The actual place where it is handled is 681 * tap_dev_cloner. 682 * 683 * An tap device cannot be opened more than once at a time, so the cdevsw 684 * part of open() does nothing but noting that the interface is being used and 685 * hence ready to actually handle packets. 686 */ 687 688 static int 689 tap_cdev_open(dev_t dev, int flags, int fmt, struct lwp *l) 690 { 691 struct tap_softc *sc; 692 693 if (minor(dev) == TAP_CLONER) 694 return tap_dev_cloner(l); 695 696 sc = device_lookup_private(&tap_cd, minor(dev)); 697 if (sc == NULL) 698 return ENXIO; 699 700 /* The device can only be opened once */ 701 if (sc->sc_flags & TAP_INUSE) 702 return EBUSY; 703 sc->sc_flags |= TAP_INUSE; 704 if_link_state_change(&sc->sc_ec.ec_if, LINK_STATE_UP); 705 706 return 0; 707 } 708 709 /* 710 * There are several kinds of cloning devices, and the most simple is the one 711 * tap(4) uses. What it does is change the file descriptor with a new one, 712 * with its own fileops structure (which maps to the various read, write, 713 * ioctl functions). It starts allocating a new file descriptor with falloc, 714 * then actually creates the new tap devices. 715 * 716 * Once those two steps are successful, we can re-wire the existing file 717 * descriptor to its new self. This is done with fdclone(): it fills the fp 718 * structure as needed (notably f_devunit gets filled with the fifth parameter 719 * passed, the unit of the tap device which will allows us identifying the 720 * device later), and returns EMOVEFD. 721 * 722 * That magic value is interpreted by sys_open() which then replaces the 723 * current file descriptor by the new one (through a magic member of struct 724 * lwp, l_dupfd). 725 * 726 * The tap device is flagged as being busy since it otherwise could be 727 * externally accessed through the corresponding device node with the cdevsw 728 * interface. 729 */ 730 731 static int 732 tap_dev_cloner(struct lwp *l) 733 { 734 struct tap_softc *sc; 735 file_t *fp; 736 int error, fd; 737 738 if ((error = fd_allocfile(&fp, &fd)) != 0) 739 return error; 740 741 if ((sc = tap_clone_creator(-1)) == NULL) { 742 fd_abort(curproc, fp, fd); 743 return ENXIO; 744 } 745 746 sc->sc_flags |= TAP_INUSE; 747 748 return fd_clone(fp, fd, FREAD | FWRITE, &tap_fileops, 749 (void *)(intptr_t)device_unit(sc->sc_dev)); 750 } 751 752 /* 753 * While all other operations (read, write, ioctl, poll and kqfilter) are 754 * really the same whether we are in cdevsw or fileops mode, the close() 755 * function is slightly different in the two cases. 756 * 757 * As for the other, the core of it is shared in tap_dev_close. What 758 * it does is sufficient for the cdevsw interface, but the cloning interface 759 * needs another thing: the interface is destroyed when the processes that 760 * created it closes it. 761 */ 762 static int 763 tap_cdev_close(dev_t dev, int flags, int fmt, struct lwp *l) 764 { 765 struct tap_softc *sc = device_lookup_private(&tap_cd, minor(dev)); 766 767 if (sc == NULL) 768 return ENXIO; 769 770 return tap_dev_close(sc); 771 } 772 773 /* 774 * It might happen that the administrator used ifconfig to externally destroy 775 * the interface. In that case, tap_fops_close will be called while 776 * tap_detach is already happening. If we called it again from here, we 777 * would dead lock. TAP_GOING ensures that this situation doesn't happen. 778 */ 779 static int 780 tap_fops_close(file_t *fp) 781 { 782 struct tap_softc *sc; 783 int unit = fp->f_devunit; 784 int error; 785 786 sc = device_lookup_private(&tap_cd, unit); 787 if (sc == NULL) 788 return ENXIO; 789 790 /* tap_dev_close currently always succeeds, but it might not 791 * always be the case. */ 792 KERNEL_LOCK(1, NULL); 793 if ((error = tap_dev_close(sc)) != 0) { 794 KERNEL_UNLOCK_ONE(NULL); 795 return error; 796 } 797 798 /* Destroy the device now that it is no longer useful, 799 * unless it's already being destroyed. */ 800 if ((sc->sc_flags & TAP_GOING) != 0) { 801 KERNEL_UNLOCK_ONE(NULL); 802 return 0; 803 } 804 805 error = tap_clone_destroyer(sc->sc_dev); 806 KERNEL_UNLOCK_ONE(NULL); 807 return error; 808 } 809 810 static int 811 tap_dev_close(struct tap_softc *sc) 812 { 813 struct ifnet *ifp; 814 int s; 815 816 s = splnet(); 817 /* Let tap_start handle packets again */ 818 ifp = &sc->sc_ec.ec_if; 819 ifp->if_flags &= ~IFF_OACTIVE; 820 821 /* Purge output queue */ 822 if (!(IFQ_IS_EMPTY(&ifp->if_snd))) { 823 struct mbuf *m; 824 825 for (;;) { 826 IFQ_DEQUEUE(&ifp->if_snd, m); 827 if (m == NULL) 828 break; 829 830 if_statadd2(ifp, if_opackets, 1, if_obytes, m->m_len); 831 bpf_mtap(ifp, m, BPF_D_OUT); 832 m_freem(m); 833 } 834 } 835 splx(s); 836 837 if (sc->sc_sih != NULL) { 838 softint_disestablish(sc->sc_sih); 839 sc->sc_sih = NULL; 840 } 841 sc->sc_flags &= ~(TAP_INUSE | TAP_ASYNCIO); 842 if_link_state_change(ifp, LINK_STATE_DOWN); 843 844 return 0; 845 } 846 847 static int 848 tap_cdev_read(dev_t dev, struct uio *uio, int flags) 849 { 850 851 return tap_dev_read(minor(dev), uio, flags); 852 } 853 854 static int 855 tap_fops_read(file_t *fp, off_t *offp, struct uio *uio, 856 kauth_cred_t cred, int flags) 857 { 858 int error; 859 860 KERNEL_LOCK(1, NULL); 861 error = tap_dev_read(fp->f_devunit, uio, flags); 862 KERNEL_UNLOCK_ONE(NULL); 863 return error; 864 } 865 866 static int 867 tap_dev_read(int unit, struct uio *uio, int flags) 868 { 869 struct tap_softc *sc = device_lookup_private(&tap_cd, unit); 870 struct ifnet *ifp; 871 struct mbuf *m, *n; 872 int error = 0; 873 874 if (sc == NULL) 875 return ENXIO; 876 877 getnanotime(&sc->sc_atime); 878 879 ifp = &sc->sc_ec.ec_if; 880 if ((ifp->if_flags & IFF_UP) == 0) 881 return EHOSTDOWN; 882 883 /* In the TAP_NBIO case, we have to make sure we won't be sleeping */ 884 if ((sc->sc_flags & TAP_NBIO) != 0) { 885 if (!mutex_tryenter(&sc->sc_lock)) 886 return EWOULDBLOCK; 887 } else 888 mutex_enter(&sc->sc_lock); 889 890 if (IFQ_IS_EMPTY(&ifp->if_snd)) { 891 ifp->if_flags &= ~IFF_OACTIVE; 892 if (sc->sc_flags & TAP_NBIO) 893 error = EWOULDBLOCK; 894 else 895 error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock); 896 897 if (error != 0) { 898 mutex_exit(&sc->sc_lock); 899 return error; 900 } 901 /* The device might have been downed */ 902 if ((ifp->if_flags & IFF_UP) == 0) { 903 mutex_exit(&sc->sc_lock); 904 return EHOSTDOWN; 905 } 906 } 907 908 IFQ_DEQUEUE(&ifp->if_snd, m); 909 mutex_exit(&sc->sc_lock); 910 911 ifp->if_flags &= ~IFF_OACTIVE; 912 if (m == NULL) { 913 error = 0; 914 goto out; 915 } 916 917 if_statadd2(ifp, if_opackets, 1, 918 if_obytes, m->m_len); /* XXX only first in chain */ 919 bpf_mtap(ifp, m, BPF_D_OUT); 920 if ((error = pfil_run_hooks(ifp->if_pfil, &m, ifp, PFIL_OUT)) != 0) 921 goto out; 922 if (m == NULL) 923 goto out; 924 925 /* 926 * One read is one packet. 927 */ 928 do { 929 error = uiomove(mtod(m, void *), 930 uimin(m->m_len, uio->uio_resid), uio); 931 m = n = m_free(m); 932 } while (m != NULL && uio->uio_resid > 0 && error == 0); 933 934 if (m != NULL) 935 m_freem(m); 936 937 out: 938 return error; 939 } 940 941 static int 942 tap_fops_stat(file_t *fp, struct stat *st) 943 { 944 int error = 0; 945 struct tap_softc *sc; 946 int unit = fp->f_devunit; 947 948 (void)memset(st, 0, sizeof(*st)); 949 950 KERNEL_LOCK(1, NULL); 951 sc = device_lookup_private(&tap_cd, unit); 952 if (sc == NULL) { 953 error = ENXIO; 954 goto out; 955 } 956 957 st->st_dev = makedev(cdevsw_lookup_major(&tap_cdevsw), unit); 958 st->st_atimespec = sc->sc_atime; 959 st->st_mtimespec = sc->sc_mtime; 960 st->st_ctimespec = st->st_birthtimespec = sc->sc_btime; 961 st->st_uid = kauth_cred_geteuid(fp->f_cred); 962 st->st_gid = kauth_cred_getegid(fp->f_cred); 963 out: 964 KERNEL_UNLOCK_ONE(NULL); 965 return error; 966 } 967 968 static int 969 tap_cdev_write(dev_t dev, struct uio *uio, int flags) 970 { 971 972 return tap_dev_write(minor(dev), uio, flags); 973 } 974 975 static int 976 tap_fops_write(file_t *fp, off_t *offp, struct uio *uio, 977 kauth_cred_t cred, int flags) 978 { 979 int error; 980 981 KERNEL_LOCK(1, NULL); 982 error = tap_dev_write(fp->f_devunit, uio, flags); 983 KERNEL_UNLOCK_ONE(NULL); 984 return error; 985 } 986 987 static int 988 tap_dev_write(int unit, struct uio *uio, int flags) 989 { 990 struct tap_softc *sc = 991 device_lookup_private(&tap_cd, unit); 992 struct ifnet *ifp; 993 struct mbuf *m, **mp; 994 size_t len = 0; 995 int error = 0; 996 997 if (sc == NULL) 998 return ENXIO; 999 1000 getnanotime(&sc->sc_mtime); 1001 ifp = &sc->sc_ec.ec_if; 1002 1003 /* One write, one packet, that's the rule */ 1004 MGETHDR(m, M_DONTWAIT, MT_DATA); 1005 if (m == NULL) { 1006 if_statinc(ifp, if_ierrors); 1007 return ENOBUFS; 1008 } 1009 m->m_pkthdr.len = uio->uio_resid; 1010 1011 mp = &m; 1012 while (error == 0 && uio->uio_resid > 0) { 1013 if (*mp != m) { 1014 MGET(*mp, M_DONTWAIT, MT_DATA); 1015 if (*mp == NULL) { 1016 error = ENOBUFS; 1017 break; 1018 } 1019 } 1020 (*mp)->m_len = uimin(MHLEN, uio->uio_resid); 1021 len += (*mp)->m_len; 1022 error = uiomove(mtod(*mp, void *), (*mp)->m_len, uio); 1023 mp = &(*mp)->m_next; 1024 } 1025 if (error) { 1026 if_statinc(ifp, if_ierrors); 1027 m_freem(m); 1028 return error; 1029 } 1030 1031 m_set_rcvif(m, ifp); 1032 1033 if_statadd2(ifp, if_ipackets, 1, if_ibytes, len); 1034 bpf_mtap(ifp, m, BPF_D_IN); 1035 if ((error = pfil_run_hooks(ifp->if_pfil, &m, ifp, PFIL_IN)) != 0) 1036 return error; 1037 if (m == NULL) 1038 return 0; 1039 1040 if_percpuq_enqueue(ifp->if_percpuq, m); 1041 1042 return 0; 1043 } 1044 1045 static int 1046 tap_cdev_ioctl(dev_t dev, u_long cmd, void *data, int flags, struct lwp *l) 1047 { 1048 1049 return tap_dev_ioctl(minor(dev), cmd, data, l); 1050 } 1051 1052 static int 1053 tap_fops_ioctl(file_t *fp, u_long cmd, void *data) 1054 { 1055 1056 return tap_dev_ioctl(fp->f_devunit, cmd, data, curlwp); 1057 } 1058 1059 static int 1060 tap_dev_ioctl(int unit, u_long cmd, void *data, struct lwp *l) 1061 { 1062 struct tap_softc *sc = device_lookup_private(&tap_cd, unit); 1063 1064 if (sc == NULL) 1065 return ENXIO; 1066 1067 switch (cmd) { 1068 case FIONREAD: 1069 { 1070 struct ifnet *ifp = &sc->sc_ec.ec_if; 1071 struct mbuf *m; 1072 int s; 1073 1074 s = splnet(); 1075 IFQ_POLL(&ifp->if_snd, m); 1076 1077 if (m == NULL) 1078 *(int *)data = 0; 1079 else 1080 *(int *)data = m->m_pkthdr.len; 1081 splx(s); 1082 return 0; 1083 } 1084 case TIOCSPGRP: 1085 case FIOSETOWN: 1086 return fsetown(&sc->sc_pgid, cmd, data); 1087 case TIOCGPGRP: 1088 case FIOGETOWN: 1089 return fgetown(sc->sc_pgid, cmd, data); 1090 case FIOASYNC: 1091 if (*(int *)data) { 1092 if (sc->sc_sih == NULL) { 1093 sc->sc_sih = softint_establish(SOFTINT_CLOCK, 1094 tap_softintr, sc); 1095 if (sc->sc_sih == NULL) 1096 return EBUSY; /* XXX */ 1097 } 1098 sc->sc_flags |= TAP_ASYNCIO; 1099 } else { 1100 sc->sc_flags &= ~TAP_ASYNCIO; 1101 if (sc->sc_sih != NULL) { 1102 softint_disestablish(sc->sc_sih); 1103 sc->sc_sih = NULL; 1104 } 1105 } 1106 return 0; 1107 case FIONBIO: 1108 if (*(int *)data) 1109 sc->sc_flags |= TAP_NBIO; 1110 else 1111 sc->sc_flags &= ~TAP_NBIO; 1112 return 0; 1113 case TAPGIFNAME: 1114 { 1115 struct ifreq *ifr = (struct ifreq *)data; 1116 struct ifnet *ifp = &sc->sc_ec.ec_if; 1117 1118 strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ); 1119 return 0; 1120 } 1121 default: 1122 return ENOTTY; 1123 } 1124 } 1125 1126 static int 1127 tap_cdev_poll(dev_t dev, int events, struct lwp *l) 1128 { 1129 1130 return tap_dev_poll(minor(dev), events, l); 1131 } 1132 1133 static int 1134 tap_fops_poll(file_t *fp, int events) 1135 { 1136 1137 return tap_dev_poll(fp->f_devunit, events, curlwp); 1138 } 1139 1140 static int 1141 tap_dev_poll(int unit, int events, struct lwp *l) 1142 { 1143 struct tap_softc *sc = device_lookup_private(&tap_cd, unit); 1144 int revents = 0; 1145 1146 if (sc == NULL) 1147 return POLLERR; 1148 1149 if (events & (POLLIN | POLLRDNORM)) { 1150 struct ifnet *ifp = &sc->sc_ec.ec_if; 1151 struct mbuf *m; 1152 int s; 1153 1154 s = splnet(); 1155 IFQ_POLL(&ifp->if_snd, m); 1156 1157 if (m != NULL) 1158 revents |= events & (POLLIN | POLLRDNORM); 1159 else { 1160 mutex_spin_enter(&sc->sc_lock); 1161 selrecord(l, &sc->sc_rsel); 1162 mutex_spin_exit(&sc->sc_lock); 1163 } 1164 splx(s); 1165 } 1166 revents |= events & (POLLOUT | POLLWRNORM); 1167 1168 return revents; 1169 } 1170 1171 static struct filterops tap_read_filterops = { 1172 .f_flags = FILTEROP_ISFD, 1173 .f_attach = NULL, 1174 .f_detach = tap_kqdetach, 1175 .f_event = tap_kqread, 1176 }; 1177 1178 static int 1179 tap_cdev_kqfilter(dev_t dev, struct knote *kn) 1180 { 1181 1182 return tap_dev_kqfilter(minor(dev), kn); 1183 } 1184 1185 static int 1186 tap_fops_kqfilter(file_t *fp, struct knote *kn) 1187 { 1188 1189 return tap_dev_kqfilter(fp->f_devunit, kn); 1190 } 1191 1192 static int 1193 tap_dev_kqfilter(int unit, struct knote *kn) 1194 { 1195 struct tap_softc *sc = device_lookup_private(&tap_cd, unit); 1196 1197 if (sc == NULL) 1198 return ENXIO; 1199 1200 switch(kn->kn_filter) { 1201 case EVFILT_READ: 1202 kn->kn_fop = &tap_read_filterops; 1203 kn->kn_hook = sc; 1204 KERNEL_LOCK(1, NULL); 1205 mutex_spin_enter(&sc->sc_lock); 1206 selrecord_knote(&sc->sc_rsel, kn); 1207 mutex_spin_exit(&sc->sc_lock); 1208 KERNEL_UNLOCK_ONE(NULL); 1209 break; 1210 1211 case EVFILT_WRITE: 1212 kn->kn_fop = &seltrue_filtops; 1213 break; 1214 1215 default: 1216 return EINVAL; 1217 } 1218 1219 return 0; 1220 } 1221 1222 static void 1223 tap_kqdetach(struct knote *kn) 1224 { 1225 struct tap_softc *sc = (struct tap_softc *)kn->kn_hook; 1226 1227 KERNEL_LOCK(1, NULL); 1228 mutex_spin_enter(&sc->sc_lock); 1229 selremove_knote(&sc->sc_rsel, kn); 1230 mutex_spin_exit(&sc->sc_lock); 1231 KERNEL_UNLOCK_ONE(NULL); 1232 } 1233 1234 static int 1235 tap_kqread(struct knote *kn, long hint) 1236 { 1237 struct tap_softc *sc = (struct tap_softc *)kn->kn_hook; 1238 struct ifnet *ifp = &sc->sc_ec.ec_if; 1239 struct mbuf *m; 1240 int s, rv; 1241 1242 KERNEL_LOCK(1, NULL); 1243 s = splnet(); 1244 IFQ_POLL(&ifp->if_snd, m); 1245 1246 if (m == NULL) 1247 kn->kn_data = 0; 1248 else 1249 kn->kn_data = m->m_pkthdr.len; 1250 splx(s); 1251 rv = (kn->kn_data != 0 ? 1 : 0); 1252 KERNEL_UNLOCK_ONE(NULL); 1253 return rv; 1254 } 1255 1256 /* 1257 * sysctl management routines 1258 * You can set the address of an interface through: 1259 * net.link.tap.tap<number> 1260 * 1261 * Note the consistent use of tap_log in order to use 1262 * sysctl_teardown at unload time. 1263 * 1264 * In the kernel you will find a lot of SYSCTL_SETUP blocks. Those 1265 * blocks register a function in a special section of the kernel 1266 * (called a link set) which is used at init_sysctl() time to cycle 1267 * through all those functions to create the kernel's sysctl tree. 1268 * 1269 * It is not possible to use link sets in a module, so the 1270 * easiest is to simply call our own setup routine at load time. 1271 * 1272 * In the SYSCTL_SETUP blocks you find in the kernel, nodes have the 1273 * CTLFLAG_PERMANENT flag, meaning they cannot be removed. Once the 1274 * whole kernel sysctl tree is built, it is not possible to add any 1275 * permanent node. 1276 * 1277 * It should be noted that we're not saving the sysctlnode pointer 1278 * we are returned when creating the "tap" node. That structure 1279 * cannot be trusted once out of the calling function, as it might 1280 * get reused. So we just save the MIB number, and always give the 1281 * full path starting from the root for later calls to sysctl_createv 1282 * and sysctl_destroyv. 1283 */ 1284 static void 1285 sysctl_tap_setup(struct sysctllog **clog) 1286 { 1287 const struct sysctlnode *node; 1288 int error = 0; 1289 1290 if ((error = sysctl_createv(clog, 0, NULL, NULL, 1291 CTLFLAG_PERMANENT, 1292 CTLTYPE_NODE, "link", NULL, 1293 NULL, 0, NULL, 0, 1294 CTL_NET, AF_LINK, CTL_EOL)) != 0) 1295 return; 1296 1297 /* 1298 * The first four parameters of sysctl_createv are for management. 1299 * 1300 * The four that follows, here starting with a '0' for the flags, 1301 * describe the node. 1302 * 1303 * The next series of four set its value, through various possible 1304 * means. 1305 * 1306 * Last but not least, the path to the node is described. That path 1307 * is relative to the given root (third argument). Here we're 1308 * starting from the root. 1309 */ 1310 if ((error = sysctl_createv(clog, 0, NULL, &node, 1311 CTLFLAG_PERMANENT, 1312 CTLTYPE_NODE, "tap", NULL, 1313 NULL, 0, NULL, 0, 1314 CTL_NET, AF_LINK, CTL_CREATE, CTL_EOL)) != 0) 1315 return; 1316 tap_node = node->sysctl_num; 1317 } 1318 1319 /* 1320 * The helper functions make Andrew Brown's interface really 1321 * shine. It makes possible to create value on the fly whether 1322 * the sysctl value is read or written. 1323 * 1324 * As shown as an example in the man page, the first step is to 1325 * create a copy of the node to have sysctl_lookup work on it. 1326 * 1327 * Here, we have more work to do than just a copy, since we have 1328 * to create the string. The first step is to collect the actual 1329 * value of the node, which is a convenient pointer to the softc 1330 * of the interface. From there we create the string and use it 1331 * as the value, but only for the *copy* of the node. 1332 * 1333 * Then we let sysctl_lookup do the magic, which consists in 1334 * setting oldp and newp as required by the operation. When the 1335 * value is read, that means that the string will be copied to 1336 * the user, and when it is written, the new value will be copied 1337 * over in the addr array. 1338 * 1339 * If newp is NULL, the user was reading the value, so we don't 1340 * have anything else to do. If a new value was written, we 1341 * have to check it. 1342 * 1343 * If it is incorrect, we can return an error and leave 'node' as 1344 * it is: since it is a copy of the actual node, the change will 1345 * be forgotten. 1346 * 1347 * Upon a correct input, we commit the change to the ifnet 1348 * structure of our interface. 1349 */ 1350 static int 1351 tap_sysctl_handler(SYSCTLFN_ARGS) 1352 { 1353 struct sysctlnode node; 1354 struct tap_softc *sc; 1355 struct ifnet *ifp; 1356 int error; 1357 size_t len; 1358 char addr[3 * ETHER_ADDR_LEN]; 1359 uint8_t enaddr[ETHER_ADDR_LEN]; 1360 1361 node = *rnode; 1362 sc = node.sysctl_data; 1363 ifp = &sc->sc_ec.ec_if; 1364 (void)ether_snprintf(addr, sizeof(addr), CLLADDR(ifp->if_sadl)); 1365 node.sysctl_data = addr; 1366 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 1367 if (error || newp == NULL) 1368 return error; 1369 1370 len = strlen(addr); 1371 if (len < 11 || len > 17) 1372 return EINVAL; 1373 1374 /* Commit change */ 1375 if (ether_aton_r(enaddr, sizeof(enaddr), addr) != 0) 1376 return EINVAL; 1377 if_set_sadl(ifp, enaddr, ETHER_ADDR_LEN, false); 1378 return error; 1379 } 1380 1381 /* 1382 * Module infrastructure 1383 */ 1384 #include "if_module.h" 1385 1386 IF_MODULE(MODULE_CLASS_DRIVER, tap, NULL) 1387