xref: /netbsd-src/sys/net/if_tap.c (revision cd22f25e6f6d1cc1f197fe8c5468a80f51d1c4e1)
1 /*	$NetBSD: if_tap.c,v 1.43 2008/04/29 06:53:03 martin Exp $	*/
2 
3 /*
4  *  Copyright (c) 2003, 2004, 2008 The NetBSD Foundation.
5  *  All rights reserved.
6  *
7  *  Redistribution and use in source and binary forms, with or without
8  *  modification, are permitted provided that the following conditions
9  *  are met:
10  *  1. Redistributions of source code must retain the above copyright
11  *     notice, this list of conditions and the following disclaimer.
12  *  2. Redistributions in binary form must reproduce the above copyright
13  *     notice, this list of conditions and the following disclaimer in the
14  *     documentation and/or other materials provided with the distribution.
15  *
16  *  THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  *  ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  *  TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  *  PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  *  BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  *  POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * tap(4) is a virtual Ethernet interface.  It appears as a real Ethernet
31  * device to the system, but can also be accessed by userland through a
32  * character device interface, which allows reading and injecting frames.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: if_tap.c,v 1.43 2008/04/29 06:53:03 martin Exp $");
37 
38 #if defined(_KERNEL_OPT)
39 #include "bpfilter.h"
40 #endif
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/malloc.h>
46 #include <sys/conf.h>
47 #include <sys/device.h>
48 #include <sys/file.h>
49 #include <sys/filedesc.h>
50 #include <sys/ksyms.h>
51 #include <sys/poll.h>
52 #include <sys/select.h>
53 #include <sys/sockio.h>
54 #include <sys/sysctl.h>
55 #include <sys/kauth.h>
56 #include <sys/mutex.h>
57 #include <sys/simplelock.h>
58 #include <sys/intr.h>
59 
60 #include <net/if.h>
61 #include <net/if_dl.h>
62 #include <net/if_ether.h>
63 #include <net/if_media.h>
64 #include <net/if_tap.h>
65 #if NBPFILTER > 0
66 #include <net/bpf.h>
67 #endif
68 
69 #include <compat/sys/sockio.h>
70 
71 /*
72  * sysctl node management
73  *
74  * It's not really possible to use a SYSCTL_SETUP block with
75  * current LKM implementation, so it is easier to just define
76  * our own function.
77  *
78  * The handler function is a "helper" in Andrew Brown's sysctl
79  * framework terminology.  It is used as a gateway for sysctl
80  * requests over the nodes.
81  *
82  * tap_log allows the module to log creations of nodes and
83  * destroy them all at once using sysctl_teardown.
84  */
85 static int tap_node;
86 static int	tap_sysctl_handler(SYSCTLFN_PROTO);
87 SYSCTL_SETUP_PROTO(sysctl_tap_setup);
88 
89 /*
90  * Since we're an Ethernet device, we need the 3 following
91  * components: a leading struct device, a struct ethercom,
92  * and also a struct ifmedia since we don't attach a PHY to
93  * ourselves. We could emulate one, but there's no real
94  * point.
95  */
96 
97 struct tap_softc {
98 	device_t	sc_dev;
99 	struct ifmedia	sc_im;
100 	struct ethercom	sc_ec;
101 	int		sc_flags;
102 #define	TAP_INUSE	0x00000001	/* tap device can only be opened once */
103 #define TAP_ASYNCIO	0x00000002	/* user is using async I/O (SIGIO) on the device */
104 #define TAP_NBIO	0x00000004	/* user wants calls to avoid blocking */
105 #define TAP_GOING	0x00000008	/* interface is being destroyed */
106 	struct selinfo	sc_rsel;
107 	pid_t		sc_pgid; /* For async. IO */
108 	kmutex_t	sc_rdlock;
109 	struct simplelock	sc_kqlock;
110 	void		*sc_sih;
111 };
112 
113 /* autoconf(9) glue */
114 
115 void	tapattach(int);
116 
117 static int	tap_match(device_t, cfdata_t, void *);
118 static void	tap_attach(device_t, device_t, void *);
119 static int	tap_detach(device_t, int);
120 
121 CFATTACH_DECL_NEW(tap, sizeof(struct tap_softc),
122     tap_match, tap_attach, tap_detach, NULL);
123 extern struct cfdriver tap_cd;
124 
125 /* Real device access routines */
126 static int	tap_dev_close(struct tap_softc *);
127 static int	tap_dev_read(int, struct uio *, int);
128 static int	tap_dev_write(int, struct uio *, int);
129 static int	tap_dev_ioctl(int, u_long, void *, struct lwp *);
130 static int	tap_dev_poll(int, int, struct lwp *);
131 static int	tap_dev_kqfilter(int, struct knote *);
132 
133 /* Fileops access routines */
134 static int	tap_fops_close(file_t *);
135 static int	tap_fops_read(file_t *, off_t *, struct uio *,
136     kauth_cred_t, int);
137 static int	tap_fops_write(file_t *, off_t *, struct uio *,
138     kauth_cred_t, int);
139 static int	tap_fops_ioctl(file_t *, u_long, void *);
140 static int	tap_fops_poll(file_t *, int);
141 static int	tap_fops_kqfilter(file_t *, struct knote *);
142 
143 static const struct fileops tap_fileops = {
144 	tap_fops_read,
145 	tap_fops_write,
146 	tap_fops_ioctl,
147 	fnullop_fcntl,
148 	tap_fops_poll,
149 	fbadop_stat,
150 	tap_fops_close,
151 	tap_fops_kqfilter,
152 };
153 
154 /* Helper for cloning open() */
155 static int	tap_dev_cloner(struct lwp *);
156 
157 /* Character device routines */
158 static int	tap_cdev_open(dev_t, int, int, struct lwp *);
159 static int	tap_cdev_close(dev_t, int, int, struct lwp *);
160 static int	tap_cdev_read(dev_t, struct uio *, int);
161 static int	tap_cdev_write(dev_t, struct uio *, int);
162 static int	tap_cdev_ioctl(dev_t, u_long, void *, int, struct lwp *);
163 static int	tap_cdev_poll(dev_t, int, struct lwp *);
164 static int	tap_cdev_kqfilter(dev_t, struct knote *);
165 
166 const struct cdevsw tap_cdevsw = {
167 	tap_cdev_open, tap_cdev_close,
168 	tap_cdev_read, tap_cdev_write,
169 	tap_cdev_ioctl, nostop, notty,
170 	tap_cdev_poll, nommap,
171 	tap_cdev_kqfilter,
172 	D_OTHER,
173 };
174 
175 #define TAP_CLONER	0xfffff		/* Maximal minor value */
176 
177 /* kqueue-related routines */
178 static void	tap_kqdetach(struct knote *);
179 static int	tap_kqread(struct knote *, long);
180 
181 /*
182  * Those are needed by the if_media interface.
183  */
184 
185 static int	tap_mediachange(struct ifnet *);
186 static void	tap_mediastatus(struct ifnet *, struct ifmediareq *);
187 
188 /*
189  * Those are needed by the ifnet interface, and would typically be
190  * there for any network interface driver.
191  * Some other routines are optional: watchdog and drain.
192  */
193 
194 static void	tap_start(struct ifnet *);
195 static void	tap_stop(struct ifnet *, int);
196 static int	tap_init(struct ifnet *);
197 static int	tap_ioctl(struct ifnet *, u_long, void *);
198 
199 /* Internal functions */
200 static int	tap_lifaddr(struct ifnet *, u_long, struct ifaliasreq *);
201 static void	tap_softintr(void *);
202 
203 /*
204  * tap is a clonable interface, although it is highly unrealistic for
205  * an Ethernet device.
206  *
207  * Here are the bits needed for a clonable interface.
208  */
209 static int	tap_clone_create(struct if_clone *, int);
210 static int	tap_clone_destroy(struct ifnet *);
211 
212 struct if_clone tap_cloners = IF_CLONE_INITIALIZER("tap",
213 					tap_clone_create,
214 					tap_clone_destroy);
215 
216 /* Helper functionis shared by the two cloning code paths */
217 static struct tap_softc *	tap_clone_creator(int);
218 int	tap_clone_destroyer(device_t);
219 
220 void
221 tapattach(int n)
222 {
223 	int error;
224 
225 	error = config_cfattach_attach(tap_cd.cd_name, &tap_ca);
226 	if (error) {
227 		aprint_error("%s: unable to register cfattach\n",
228 		    tap_cd.cd_name);
229 		(void)config_cfdriver_detach(&tap_cd);
230 		return;
231 	}
232 
233 	if_clone_attach(&tap_cloners);
234 }
235 
236 /* Pretty much useless for a pseudo-device */
237 static int
238 tap_match(device_t parent, cfdata_t cfdata, void *arg)
239 {
240 
241 	return (1);
242 }
243 
244 void
245 tap_attach(device_t parent, device_t self, void *aux)
246 {
247 	struct tap_softc *sc = device_private(self);
248 	struct ifnet *ifp;
249 	const struct sysctlnode *node;
250 	uint8_t enaddr[ETHER_ADDR_LEN] =
251 	    { 0xf2, 0x0b, 0xa4, 0xff, 0xff, 0xff };
252 	char enaddrstr[3 * ETHER_ADDR_LEN];
253 	struct timeval tv;
254 	uint32_t ui;
255 	int error;
256 
257 	sc->sc_dev = self;
258 	sc->sc_sih = softint_establish(SOFTINT_CLOCK, tap_softintr, sc);
259 
260 	/*
261 	 * In order to obtain unique initial Ethernet address on a host,
262 	 * do some randomisation using the current uptime.  It's not meant
263 	 * for anything but avoiding hard-coding an address.
264 	 */
265 	getmicrouptime(&tv);
266 	ui = (tv.tv_sec ^ tv.tv_usec) & 0xffffff;
267 	memcpy(enaddr+3, (uint8_t *)&ui, 3);
268 
269 	aprint_verbose_dev(self, "Ethernet address %s\n",
270 	    ether_snprintf(enaddrstr, sizeof(enaddrstr), enaddr));
271 
272 	/*
273 	 * Why 1000baseT? Why not? You can add more.
274 	 *
275 	 * Note that there are 3 steps: init, one or several additions to
276 	 * list of supported media, and in the end, the selection of one
277 	 * of them.
278 	 */
279 	ifmedia_init(&sc->sc_im, 0, tap_mediachange, tap_mediastatus);
280 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_1000_T, 0, NULL);
281 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_1000_T|IFM_FDX, 0, NULL);
282 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_100_TX, 0, NULL);
283 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
284 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_10_T, 0, NULL);
285 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
286 	ifmedia_add(&sc->sc_im, IFM_ETHER|IFM_AUTO, 0, NULL);
287 	ifmedia_set(&sc->sc_im, IFM_ETHER|IFM_AUTO);
288 
289 	/*
290 	 * One should note that an interface must do multicast in order
291 	 * to support IPv6.
292 	 */
293 	ifp = &sc->sc_ec.ec_if;
294 	strcpy(ifp->if_xname, device_xname(self));
295 	ifp->if_softc	= sc;
296 	ifp->if_flags	= IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
297 	ifp->if_ioctl	= tap_ioctl;
298 	ifp->if_start	= tap_start;
299 	ifp->if_stop	= tap_stop;
300 	ifp->if_init	= tap_init;
301 	IFQ_SET_READY(&ifp->if_snd);
302 
303 	sc->sc_ec.ec_capabilities = ETHERCAP_VLAN_MTU | ETHERCAP_JUMBO_MTU;
304 
305 	/* Those steps are mandatory for an Ethernet driver, the fisrt call
306 	 * being common to all network interface drivers. */
307 	if_attach(ifp);
308 	ether_ifattach(ifp, enaddr);
309 
310 	sc->sc_flags = 0;
311 
312 	/*
313 	 * Add a sysctl node for that interface.
314 	 *
315 	 * The pointer transmitted is not a string, but instead a pointer to
316 	 * the softc structure, which we can use to build the string value on
317 	 * the fly in the helper function of the node.  See the comments for
318 	 * tap_sysctl_handler for details.
319 	 *
320 	 * Usually sysctl_createv is called with CTL_CREATE as the before-last
321 	 * component.  However, we can allocate a number ourselves, as we are
322 	 * the only consumer of the net.link.<iface> node.  In this case, the
323 	 * unit number is conveniently used to number the node.  CTL_CREATE
324 	 * would just work, too.
325 	 */
326 	if ((error = sysctl_createv(NULL, 0, NULL,
327 	    &node, CTLFLAG_READWRITE,
328 	    CTLTYPE_STRING, device_xname(self), NULL,
329 	    tap_sysctl_handler, 0, sc, 18,
330 	    CTL_NET, AF_LINK, tap_node, device_unit(sc->sc_dev),
331 	    CTL_EOL)) != 0)
332 		aprint_error_dev(self, "sysctl_createv returned %d, ignoring\n",
333 		    error);
334 
335 	/*
336 	 * Initialize the two locks for the device.
337 	 *
338 	 * We need a lock here because even though the tap device can be
339 	 * opened only once, the file descriptor might be passed to another
340 	 * process, say a fork(2)ed child.
341 	 *
342 	 * The Giant saves us from most of the hassle, but since the read
343 	 * operation can sleep, we don't want two processes to wake up at
344 	 * the same moment and both try and dequeue a single packet.
345 	 *
346 	 * The queue for event listeners (used by kqueue(9), see below) has
347 	 * to be protected, too, but we don't need the same level of
348 	 * complexity for that lock, so a simple spinning lock is fine.
349 	 */
350 	mutex_init(&sc->sc_rdlock, MUTEX_DEFAULT, IPL_NONE);
351 	simple_lock_init(&sc->sc_kqlock);
352 }
353 
354 /*
355  * When detaching, we do the inverse of what is done in the attach
356  * routine, in reversed order.
357  */
358 static int
359 tap_detach(device_t self, int flags)
360 {
361 	struct tap_softc *sc = device_private(self);
362 	struct ifnet *ifp = &sc->sc_ec.ec_if;
363 	int error, s;
364 
365 	sc->sc_flags |= TAP_GOING;
366 	s = splnet();
367 	tap_stop(ifp, 1);
368 	if_down(ifp);
369 	splx(s);
370 
371 	softint_disestablish(sc->sc_sih);
372 
373 	/*
374 	 * Destroying a single leaf is a very straightforward operation using
375 	 * sysctl_destroyv.  One should be sure to always end the path with
376 	 * CTL_EOL.
377 	 */
378 	if ((error = sysctl_destroyv(NULL, CTL_NET, AF_LINK, tap_node,
379 	    device_unit(sc->sc_dev), CTL_EOL)) != 0)
380 		aprint_error_dev(self,
381 		    "sysctl_destroyv returned %d, ignoring\n", error);
382 	ether_ifdetach(ifp);
383 	if_detach(ifp);
384 	ifmedia_delete_instance(&sc->sc_im, IFM_INST_ANY);
385 	mutex_destroy(&sc->sc_rdlock);
386 
387 	return (0);
388 }
389 
390 /*
391  * This function is called by the ifmedia layer to notify the driver
392  * that the user requested a media change.  A real driver would
393  * reconfigure the hardware.
394  */
395 static int
396 tap_mediachange(struct ifnet *ifp)
397 {
398 	return (0);
399 }
400 
401 /*
402  * Here the user asks for the currently used media.
403  */
404 static void
405 tap_mediastatus(struct ifnet *ifp, struct ifmediareq *imr)
406 {
407 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
408 	imr->ifm_active = sc->sc_im.ifm_cur->ifm_media;
409 }
410 
411 /*
412  * This is the function where we SEND packets.
413  *
414  * There is no 'receive' equivalent.  A typical driver will get
415  * interrupts from the hardware, and from there will inject new packets
416  * into the network stack.
417  *
418  * Once handled, a packet must be freed.  A real driver might not be able
419  * to fit all the pending packets into the hardware, and is allowed to
420  * return before having sent all the packets.  It should then use the
421  * if_flags flag IFF_OACTIVE to notify the upper layer.
422  *
423  * There are also other flags one should check, such as IFF_PAUSE.
424  *
425  * It is our duty to make packets available to BPF listeners.
426  *
427  * You should be aware that this function is called by the Ethernet layer
428  * at splnet().
429  *
430  * When the device is opened, we have to pass the packet(s) to the
431  * userland.  For that we stay in OACTIVE mode while the userland gets
432  * the packets, and we send a signal to the processes waiting to read.
433  *
434  * wakeup(sc) is the counterpart to the tsleep call in
435  * tap_dev_read, while selnotify() is used for kevent(2) and
436  * poll(2) (which includes select(2)) listeners.
437  */
438 static void
439 tap_start(struct ifnet *ifp)
440 {
441 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
442 	struct mbuf *m0;
443 
444 	if ((sc->sc_flags & TAP_INUSE) == 0) {
445 		/* Simply drop packets */
446 		for(;;) {
447 			IFQ_DEQUEUE(&ifp->if_snd, m0);
448 			if (m0 == NULL)
449 				return;
450 
451 			ifp->if_opackets++;
452 #if NBPFILTER > 0
453 			if (ifp->if_bpf)
454 				bpf_mtap(ifp->if_bpf, m0);
455 #endif
456 
457 			m_freem(m0);
458 		}
459 	} else if (!IFQ_IS_EMPTY(&ifp->if_snd)) {
460 		ifp->if_flags |= IFF_OACTIVE;
461 		wakeup(sc);
462 		selnotify(&sc->sc_rsel, 0, 1);
463 		if (sc->sc_flags & TAP_ASYNCIO)
464 			softint_schedule(sc->sc_sih);
465 	}
466 }
467 
468 static void
469 tap_softintr(void *cookie)
470 {
471 	struct tap_softc *sc;
472 	struct ifnet *ifp;
473 	int a, b;
474 
475 	sc = cookie;
476 
477 	if (sc->sc_flags & TAP_ASYNCIO) {
478 		ifp = &sc->sc_ec.ec_if;
479 		if (ifp->if_flags & IFF_RUNNING) {
480 			a = POLL_IN;
481 			b = POLLIN|POLLRDNORM;
482 		} else {
483 			a = POLL_HUP;
484 			b = 0;
485 		}
486 		fownsignal(sc->sc_pgid, SIGIO, a, b, NULL);
487 	}
488 }
489 
490 /*
491  * A typical driver will only contain the following handlers for
492  * ioctl calls, except SIOCSIFPHYADDR.
493  * The latter is a hack I used to set the Ethernet address of the
494  * faked device.
495  *
496  * Note that both ifmedia_ioctl() and ether_ioctl() have to be
497  * called under splnet().
498  */
499 static int
500 tap_ioctl(struct ifnet *ifp, u_long cmd, void *data)
501 {
502 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
503 	struct ifreq *ifr = (struct ifreq *)data;
504 	int s, error;
505 
506 	s = splnet();
507 
508 	switch (cmd) {
509 #ifdef OSIOCSIFMEDIA
510 	case OSIOCSIFMEDIA:
511 #endif
512 	case SIOCSIFMEDIA:
513 	case SIOCGIFMEDIA:
514 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_im, cmd);
515 		break;
516 	case SIOCSIFPHYADDR:
517 		error = tap_lifaddr(ifp, cmd, (struct ifaliasreq *)data);
518 		break;
519 	default:
520 		error = ether_ioctl(ifp, cmd, data);
521 		if (error == ENETRESET)
522 			error = 0;
523 		break;
524 	}
525 
526 	splx(s);
527 
528 	return (error);
529 }
530 
531 /*
532  * Helper function to set Ethernet address.  This shouldn't be done there,
533  * and should actually be available to all Ethernet drivers, real or not.
534  */
535 static int
536 tap_lifaddr(struct ifnet *ifp, u_long cmd, struct ifaliasreq *ifra)
537 {
538 	const struct sockaddr_dl *sdl = satosdl(&ifra->ifra_addr);
539 
540 	if (sdl->sdl_family != AF_LINK)
541 		return (EINVAL);
542 
543 	if_set_sadl(ifp, CLLADDR(sdl), ETHER_ADDR_LEN);
544 
545 	return (0);
546 }
547 
548 /*
549  * _init() would typically be called when an interface goes up,
550  * meaning it should configure itself into the state in which it
551  * can send packets.
552  */
553 static int
554 tap_init(struct ifnet *ifp)
555 {
556 	ifp->if_flags |= IFF_RUNNING;
557 
558 	tap_start(ifp);
559 
560 	return (0);
561 }
562 
563 /*
564  * _stop() is called when an interface goes down.  It is our
565  * responsability to validate that state by clearing the
566  * IFF_RUNNING flag.
567  *
568  * We have to wake up all the sleeping processes to have the pending
569  * read requests cancelled.
570  */
571 static void
572 tap_stop(struct ifnet *ifp, int disable)
573 {
574 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
575 
576 	ifp->if_flags &= ~IFF_RUNNING;
577 	wakeup(sc);
578 	selnotify(&sc->sc_rsel, 0, 1);
579 	if (sc->sc_flags & TAP_ASYNCIO)
580 		softint_schedule(sc->sc_sih);
581 }
582 
583 /*
584  * The 'create' command of ifconfig can be used to create
585  * any numbered instance of a given device.  Thus we have to
586  * make sure we have enough room in cd_devs to create the
587  * user-specified instance.  config_attach_pseudo will do this
588  * for us.
589  */
590 static int
591 tap_clone_create(struct if_clone *ifc, int unit)
592 {
593 	if (tap_clone_creator(unit) == NULL) {
594 		aprint_error("%s%d: unable to attach an instance\n",
595                     tap_cd.cd_name, unit);
596 		return (ENXIO);
597 	}
598 
599 	return (0);
600 }
601 
602 /*
603  * tap(4) can be cloned by two ways:
604  *   using 'ifconfig tap0 create', which will use the network
605  *     interface cloning API, and call tap_clone_create above.
606  *   opening the cloning device node, whose minor number is TAP_CLONER.
607  *     See below for an explanation on how this part work.
608  */
609 static struct tap_softc *
610 tap_clone_creator(int unit)
611 {
612 	struct cfdata *cf;
613 
614 	cf = malloc(sizeof(*cf), M_DEVBUF, M_WAITOK);
615 	cf->cf_name = tap_cd.cd_name;
616 	cf->cf_atname = tap_ca.ca_name;
617 	if (unit == -1) {
618 		/* let autoconf find the first free one */
619 		cf->cf_unit = 0;
620 		cf->cf_fstate = FSTATE_STAR;
621 	} else {
622 		cf->cf_unit = unit;
623 		cf->cf_fstate = FSTATE_NOTFOUND;
624 	}
625 
626 	return device_private(config_attach_pseudo(cf));
627 }
628 
629 /*
630  * The clean design of if_clone and autoconf(9) makes that part
631  * really straightforward.  The second argument of config_detach
632  * means neither QUIET nor FORCED.
633  */
634 static int
635 tap_clone_destroy(struct ifnet *ifp)
636 {
637 	return tap_clone_destroyer(device_private(ifp->if_softc));
638 }
639 
640 int
641 tap_clone_destroyer(device_t dev)
642 {
643 	cfdata_t cf = device_cfdata(dev);
644 	int error;
645 
646 	if ((error = config_detach(dev, 0)) != 0)
647 		aprint_error_dev(dev, "unable to detach instance\n");
648 	free(cf, M_DEVBUF);
649 
650 	return (error);
651 }
652 
653 /*
654  * tap(4) is a bit of an hybrid device.  It can be used in two different
655  * ways:
656  *  1. ifconfig tapN create, then use /dev/tapN to read/write off it.
657  *  2. open /dev/tap, get a new interface created and read/write off it.
658  *     That interface is destroyed when the process that had it created exits.
659  *
660  * The first way is managed by the cdevsw structure, and you access interfaces
661  * through a (major, minor) mapping:  tap4 is obtained by the minor number
662  * 4.  The entry points for the cdevsw interface are prefixed by tap_cdev_.
663  *
664  * The second way is the so-called "cloning" device.  It's a special minor
665  * number (chosen as the maximal number, to allow as much tap devices as
666  * possible).  The user first opens the cloner (e.g., /dev/tap), and that
667  * call ends in tap_cdev_open.  The actual place where it is handled is
668  * tap_dev_cloner.
669  *
670  * An tap device cannot be opened more than once at a time, so the cdevsw
671  * part of open() does nothing but noting that the interface is being used and
672  * hence ready to actually handle packets.
673  */
674 
675 static int
676 tap_cdev_open(dev_t dev, int flags, int fmt, struct lwp *l)
677 {
678 	struct tap_softc *sc;
679 
680 	if (minor(dev) == TAP_CLONER)
681 		return tap_dev_cloner(l);
682 
683 	sc = device_private(device_lookup(&tap_cd, minor(dev)));
684 	if (sc == NULL)
685 		return (ENXIO);
686 
687 	/* The device can only be opened once */
688 	if (sc->sc_flags & TAP_INUSE)
689 		return (EBUSY);
690 	sc->sc_flags |= TAP_INUSE;
691 	return (0);
692 }
693 
694 /*
695  * There are several kinds of cloning devices, and the most simple is the one
696  * tap(4) uses.  What it does is change the file descriptor with a new one,
697  * with its own fileops structure (which maps to the various read, write,
698  * ioctl functions).  It starts allocating a new file descriptor with falloc,
699  * then actually creates the new tap devices.
700  *
701  * Once those two steps are successful, we can re-wire the existing file
702  * descriptor to its new self.  This is done with fdclone():  it fills the fp
703  * structure as needed (notably f_data gets filled with the fifth parameter
704  * passed, the unit of the tap device which will allows us identifying the
705  * device later), and returns EMOVEFD.
706  *
707  * That magic value is interpreted by sys_open() which then replaces the
708  * current file descriptor by the new one (through a magic member of struct
709  * lwp, l_dupfd).
710  *
711  * The tap device is flagged as being busy since it otherwise could be
712  * externally accessed through the corresponding device node with the cdevsw
713  * interface.
714  */
715 
716 static int
717 tap_dev_cloner(struct lwp *l)
718 {
719 	struct tap_softc *sc;
720 	file_t *fp;
721 	int error, fd;
722 
723 	if ((error = fd_allocfile(&fp, &fd)) != 0)
724 		return (error);
725 
726 	if ((sc = tap_clone_creator(-1)) == NULL) {
727 		fd_abort(curproc, fp, fd);
728 		return (ENXIO);
729 	}
730 
731 	sc->sc_flags |= TAP_INUSE;
732 
733 	return fd_clone(fp, fd, FREAD|FWRITE, &tap_fileops,
734 	    (void *)(intptr_t)device_unit(sc->sc_dev));
735 }
736 
737 /*
738  * While all other operations (read, write, ioctl, poll and kqfilter) are
739  * really the same whether we are in cdevsw or fileops mode, the close()
740  * function is slightly different in the two cases.
741  *
742  * As for the other, the core of it is shared in tap_dev_close.  What
743  * it does is sufficient for the cdevsw interface, but the cloning interface
744  * needs another thing:  the interface is destroyed when the processes that
745  * created it closes it.
746  */
747 static int
748 tap_cdev_close(dev_t dev, int flags, int fmt,
749     struct lwp *l)
750 {
751 	struct tap_softc *sc =
752 	    device_private(device_lookup(&tap_cd, minor(dev)));
753 
754 	if (sc == NULL)
755 		return (ENXIO);
756 
757 	return tap_dev_close(sc);
758 }
759 
760 /*
761  * It might happen that the administrator used ifconfig to externally destroy
762  * the interface.  In that case, tap_fops_close will be called while
763  * tap_detach is already happening.  If we called it again from here, we
764  * would dead lock.  TAP_GOING ensures that this situation doesn't happen.
765  */
766 static int
767 tap_fops_close(file_t *fp)
768 {
769 	int unit = (intptr_t)fp->f_data;
770 	struct tap_softc *sc;
771 	int error;
772 
773 	sc = device_private(device_lookup(&tap_cd, unit));
774 	if (sc == NULL)
775 		return (ENXIO);
776 
777 	/* tap_dev_close currently always succeeds, but it might not
778 	 * always be the case. */
779 	if ((error = tap_dev_close(sc)) != 0)
780 		return (error);
781 
782 	/* Destroy the device now that it is no longer useful,
783 	 * unless it's already being destroyed. */
784 	if ((sc->sc_flags & TAP_GOING) != 0)
785 		return (0);
786 
787 	return tap_clone_destroyer(sc->sc_dev);
788 }
789 
790 static int
791 tap_dev_close(struct tap_softc *sc)
792 {
793 	struct ifnet *ifp;
794 	int s;
795 
796 	s = splnet();
797 	/* Let tap_start handle packets again */
798 	ifp = &sc->sc_ec.ec_if;
799 	ifp->if_flags &= ~IFF_OACTIVE;
800 
801 	/* Purge output queue */
802 	if (!(IFQ_IS_EMPTY(&ifp->if_snd))) {
803 		struct mbuf *m;
804 
805 		for (;;) {
806 			IFQ_DEQUEUE(&ifp->if_snd, m);
807 			if (m == NULL)
808 				break;
809 
810 			ifp->if_opackets++;
811 #if NBPFILTER > 0
812 			if (ifp->if_bpf)
813 				bpf_mtap(ifp->if_bpf, m);
814 #endif
815 		}
816 	}
817 	splx(s);
818 
819 	sc->sc_flags &= ~(TAP_INUSE | TAP_ASYNCIO);
820 
821 	return (0);
822 }
823 
824 static int
825 tap_cdev_read(dev_t dev, struct uio *uio, int flags)
826 {
827 	return tap_dev_read(minor(dev), uio, flags);
828 }
829 
830 static int
831 tap_fops_read(file_t *fp, off_t *offp, struct uio *uio,
832     kauth_cred_t cred, int flags)
833 {
834 	return tap_dev_read((intptr_t)fp->f_data, uio, flags);
835 }
836 
837 static int
838 tap_dev_read(int unit, struct uio *uio, int flags)
839 {
840 	struct tap_softc *sc =
841 	    device_private(device_lookup(&tap_cd, unit));
842 	struct ifnet *ifp;
843 	struct mbuf *m, *n;
844 	int error = 0, s;
845 
846 	if (sc == NULL)
847 		return (ENXIO);
848 
849 	ifp = &sc->sc_ec.ec_if;
850 	if ((ifp->if_flags & IFF_UP) == 0)
851 		return (EHOSTDOWN);
852 
853 	/*
854 	 * In the TAP_NBIO case, we have to make sure we won't be sleeping
855 	 */
856 	if ((sc->sc_flags & TAP_NBIO) != 0) {
857 		if (!mutex_tryenter(&sc->sc_rdlock))
858 			return (EWOULDBLOCK);
859 	} else {
860 		mutex_enter(&sc->sc_rdlock);
861 	}
862 
863 	s = splnet();
864 	if (IFQ_IS_EMPTY(&ifp->if_snd)) {
865 		ifp->if_flags &= ~IFF_OACTIVE;
866 		splx(s);
867 		/*
868 		 * We must release the lock before sleeping, and re-acquire it
869 		 * after.
870 		 */
871 		mutex_exit(&sc->sc_rdlock);
872 		if (sc->sc_flags & TAP_NBIO)
873 			error = EWOULDBLOCK;
874 		else
875 			error = tsleep(sc, PSOCK|PCATCH, "tap", 0);
876 		if (error != 0)
877 			return (error);
878 		/* The device might have been downed */
879 		if ((ifp->if_flags & IFF_UP) == 0)
880 			return (EHOSTDOWN);
881 		if ((sc->sc_flags & TAP_NBIO)) {
882 			if (!mutex_tryenter(&sc->sc_rdlock))
883 				return (EWOULDBLOCK);
884 		} else {
885 			mutex_enter(&sc->sc_rdlock);
886 		}
887 		s = splnet();
888 	}
889 
890 	IFQ_DEQUEUE(&ifp->if_snd, m);
891 	ifp->if_flags &= ~IFF_OACTIVE;
892 	splx(s);
893 	if (m == NULL) {
894 		error = 0;
895 		goto out;
896 	}
897 
898 	ifp->if_opackets++;
899 #if NBPFILTER > 0
900 	if (ifp->if_bpf)
901 		bpf_mtap(ifp->if_bpf, m);
902 #endif
903 
904 	/*
905 	 * One read is one packet.
906 	 */
907 	do {
908 		error = uiomove(mtod(m, void *),
909 		    min(m->m_len, uio->uio_resid), uio);
910 		MFREE(m, n);
911 		m = n;
912 	} while (m != NULL && uio->uio_resid > 0 && error == 0);
913 
914 	if (m != NULL)
915 		m_freem(m);
916 
917 out:
918 	mutex_exit(&sc->sc_rdlock);
919 	return (error);
920 }
921 
922 static int
923 tap_cdev_write(dev_t dev, struct uio *uio, int flags)
924 {
925 	return tap_dev_write(minor(dev), uio, flags);
926 }
927 
928 static int
929 tap_fops_write(file_t *fp, off_t *offp, struct uio *uio,
930     kauth_cred_t cred, int flags)
931 {
932 	return tap_dev_write((intptr_t)fp->f_data, uio, flags);
933 }
934 
935 static int
936 tap_dev_write(int unit, struct uio *uio, int flags)
937 {
938 	struct tap_softc *sc =
939 	    device_private(device_lookup(&tap_cd, unit));
940 	struct ifnet *ifp;
941 	struct mbuf *m, **mp;
942 	int error = 0;
943 	int s;
944 
945 	if (sc == NULL)
946 		return (ENXIO);
947 
948 	ifp = &sc->sc_ec.ec_if;
949 
950 	/* One write, one packet, that's the rule */
951 	MGETHDR(m, M_DONTWAIT, MT_DATA);
952 	if (m == NULL) {
953 		ifp->if_ierrors++;
954 		return (ENOBUFS);
955 	}
956 	m->m_pkthdr.len = uio->uio_resid;
957 
958 	mp = &m;
959 	while (error == 0 && uio->uio_resid > 0) {
960 		if (*mp != m) {
961 			MGET(*mp, M_DONTWAIT, MT_DATA);
962 			if (*mp == NULL) {
963 				error = ENOBUFS;
964 				break;
965 			}
966 		}
967 		(*mp)->m_len = min(MHLEN, uio->uio_resid);
968 		error = uiomove(mtod(*mp, void *), (*mp)->m_len, uio);
969 		mp = &(*mp)->m_next;
970 	}
971 	if (error) {
972 		ifp->if_ierrors++;
973 		m_freem(m);
974 		return (error);
975 	}
976 
977 	ifp->if_ipackets++;
978 	m->m_pkthdr.rcvif = ifp;
979 
980 #if NBPFILTER > 0
981 	if (ifp->if_bpf)
982 		bpf_mtap(ifp->if_bpf, m);
983 #endif
984 	s =splnet();
985 	(*ifp->if_input)(ifp, m);
986 	splx(s);
987 
988 	return (0);
989 }
990 
991 static int
992 tap_cdev_ioctl(dev_t dev, u_long cmd, void *data, int flags,
993     struct lwp *l)
994 {
995 	return tap_dev_ioctl(minor(dev), cmd, data, l);
996 }
997 
998 static int
999 tap_fops_ioctl(file_t *fp, u_long cmd, void *data)
1000 {
1001 	return tap_dev_ioctl((intptr_t)fp->f_data, cmd, data, curlwp);
1002 }
1003 
1004 static int
1005 tap_dev_ioctl(int unit, u_long cmd, void *data, struct lwp *l)
1006 {
1007 	struct tap_softc *sc =
1008 	    device_private(device_lookup(&tap_cd, unit));
1009 	int error = 0;
1010 
1011 	if (sc == NULL)
1012 		return (ENXIO);
1013 
1014 	switch (cmd) {
1015 	case FIONREAD:
1016 		{
1017 			struct ifnet *ifp = &sc->sc_ec.ec_if;
1018 			struct mbuf *m;
1019 			int s;
1020 
1021 			s = splnet();
1022 			IFQ_POLL(&ifp->if_snd, m);
1023 
1024 			if (m == NULL)
1025 				*(int *)data = 0;
1026 			else
1027 				*(int *)data = m->m_pkthdr.len;
1028 			splx(s);
1029 		} break;
1030 	case TIOCSPGRP:
1031 	case FIOSETOWN:
1032 		error = fsetown(&sc->sc_pgid, cmd, data);
1033 		break;
1034 	case TIOCGPGRP:
1035 	case FIOGETOWN:
1036 		error = fgetown(sc->sc_pgid, cmd, data);
1037 		break;
1038 	case FIOASYNC:
1039 		if (*(int *)data)
1040 			sc->sc_flags |= TAP_ASYNCIO;
1041 		else
1042 			sc->sc_flags &= ~TAP_ASYNCIO;
1043 		break;
1044 	case FIONBIO:
1045 		if (*(int *)data)
1046 			sc->sc_flags |= TAP_NBIO;
1047 		else
1048 			sc->sc_flags &= ~TAP_NBIO;
1049 		break;
1050 #ifdef OTAPGIFNAME
1051 	case OTAPGIFNAME:
1052 #endif
1053 	case TAPGIFNAME:
1054 		{
1055 			struct ifreq *ifr = (struct ifreq *)data;
1056 			struct ifnet *ifp = &sc->sc_ec.ec_if;
1057 
1058 			strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
1059 		} break;
1060 	default:
1061 		error = ENOTTY;
1062 		break;
1063 	}
1064 
1065 	return (0);
1066 }
1067 
1068 static int
1069 tap_cdev_poll(dev_t dev, int events, struct lwp *l)
1070 {
1071 	return tap_dev_poll(minor(dev), events, l);
1072 }
1073 
1074 static int
1075 tap_fops_poll(file_t *fp, int events)
1076 {
1077 	return tap_dev_poll((intptr_t)fp->f_data, events, curlwp);
1078 }
1079 
1080 static int
1081 tap_dev_poll(int unit, int events, struct lwp *l)
1082 {
1083 	struct tap_softc *sc =
1084 	    device_private(device_lookup(&tap_cd, unit));
1085 	int revents = 0;
1086 
1087 	if (sc == NULL)
1088 		return POLLERR;
1089 
1090 	if (events & (POLLIN|POLLRDNORM)) {
1091 		struct ifnet *ifp = &sc->sc_ec.ec_if;
1092 		struct mbuf *m;
1093 		int s;
1094 
1095 		s = splnet();
1096 		IFQ_POLL(&ifp->if_snd, m);
1097 		splx(s);
1098 
1099 		if (m != NULL)
1100 			revents |= events & (POLLIN|POLLRDNORM);
1101 		else {
1102 			simple_lock(&sc->sc_kqlock);
1103 			selrecord(l, &sc->sc_rsel);
1104 			simple_unlock(&sc->sc_kqlock);
1105 		}
1106 	}
1107 	revents |= events & (POLLOUT|POLLWRNORM);
1108 
1109 	return (revents);
1110 }
1111 
1112 static struct filterops tap_read_filterops = { 1, NULL, tap_kqdetach,
1113 	tap_kqread };
1114 static struct filterops tap_seltrue_filterops = { 1, NULL, tap_kqdetach,
1115 	filt_seltrue };
1116 
1117 static int
1118 tap_cdev_kqfilter(dev_t dev, struct knote *kn)
1119 {
1120 	return tap_dev_kqfilter(minor(dev), kn);
1121 }
1122 
1123 static int
1124 tap_fops_kqfilter(file_t *fp, struct knote *kn)
1125 {
1126 	return tap_dev_kqfilter((intptr_t)fp->f_data, kn);
1127 }
1128 
1129 static int
1130 tap_dev_kqfilter(int unit, struct knote *kn)
1131 {
1132 	struct tap_softc *sc =
1133 	    device_private(device_lookup(&tap_cd, unit));
1134 
1135 	if (sc == NULL)
1136 		return (ENXIO);
1137 
1138 	switch(kn->kn_filter) {
1139 	case EVFILT_READ:
1140 		kn->kn_fop = &tap_read_filterops;
1141 		break;
1142 	case EVFILT_WRITE:
1143 		kn->kn_fop = &tap_seltrue_filterops;
1144 		break;
1145 	default:
1146 		return (EINVAL);
1147 	}
1148 
1149 	kn->kn_hook = sc;
1150 	simple_lock(&sc->sc_kqlock);
1151 	SLIST_INSERT_HEAD(&sc->sc_rsel.sel_klist, kn, kn_selnext);
1152 	simple_unlock(&sc->sc_kqlock);
1153 	return (0);
1154 }
1155 
1156 static void
1157 tap_kqdetach(struct knote *kn)
1158 {
1159 	struct tap_softc *sc = (struct tap_softc *)kn->kn_hook;
1160 
1161 	simple_lock(&sc->sc_kqlock);
1162 	SLIST_REMOVE(&sc->sc_rsel.sel_klist, kn, knote, kn_selnext);
1163 	simple_unlock(&sc->sc_kqlock);
1164 }
1165 
1166 static int
1167 tap_kqread(struct knote *kn, long hint)
1168 {
1169 	struct tap_softc *sc = (struct tap_softc *)kn->kn_hook;
1170 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1171 	struct mbuf *m;
1172 	int s;
1173 
1174 	s = splnet();
1175 	IFQ_POLL(&ifp->if_snd, m);
1176 
1177 	if (m == NULL)
1178 		kn->kn_data = 0;
1179 	else
1180 		kn->kn_data = m->m_pkthdr.len;
1181 	splx(s);
1182 	return (kn->kn_data != 0 ? 1 : 0);
1183 }
1184 
1185 /*
1186  * sysctl management routines
1187  * You can set the address of an interface through:
1188  * net.link.tap.tap<number>
1189  *
1190  * Note the consistent use of tap_log in order to use
1191  * sysctl_teardown at unload time.
1192  *
1193  * In the kernel you will find a lot of SYSCTL_SETUP blocks.  Those
1194  * blocks register a function in a special section of the kernel
1195  * (called a link set) which is used at init_sysctl() time to cycle
1196  * through all those functions to create the kernel's sysctl tree.
1197  *
1198  * It is not (currently) possible to use link sets in a LKM, so the
1199  * easiest is to simply call our own setup routine at load time.
1200  *
1201  * In the SYSCTL_SETUP blocks you find in the kernel, nodes have the
1202  * CTLFLAG_PERMANENT flag, meaning they cannot be removed.  Once the
1203  * whole kernel sysctl tree is built, it is not possible to add any
1204  * permanent node.
1205  *
1206  * It should be noted that we're not saving the sysctlnode pointer
1207  * we are returned when creating the "tap" node.  That structure
1208  * cannot be trusted once out of the calling function, as it might
1209  * get reused.  So we just save the MIB number, and always give the
1210  * full path starting from the root for later calls to sysctl_createv
1211  * and sysctl_destroyv.
1212  */
1213 SYSCTL_SETUP(sysctl_tap_setup, "sysctl net.link.tap subtree setup")
1214 {
1215 	const struct sysctlnode *node;
1216 	int error = 0;
1217 
1218 	if ((error = sysctl_createv(clog, 0, NULL, NULL,
1219 	    CTLFLAG_PERMANENT,
1220 	    CTLTYPE_NODE, "net", NULL,
1221 	    NULL, 0, NULL, 0,
1222 	    CTL_NET, CTL_EOL)) != 0)
1223 		return;
1224 
1225 	if ((error = sysctl_createv(clog, 0, NULL, NULL,
1226 	    CTLFLAG_PERMANENT,
1227 	    CTLTYPE_NODE, "link", NULL,
1228 	    NULL, 0, NULL, 0,
1229 	    CTL_NET, AF_LINK, CTL_EOL)) != 0)
1230 		return;
1231 
1232 	/*
1233 	 * The first four parameters of sysctl_createv are for management.
1234 	 *
1235 	 * The four that follows, here starting with a '0' for the flags,
1236 	 * describe the node.
1237 	 *
1238 	 * The next series of four set its value, through various possible
1239 	 * means.
1240 	 *
1241 	 * Last but not least, the path to the node is described.  That path
1242 	 * is relative to the given root (third argument).  Here we're
1243 	 * starting from the root.
1244 	 */
1245 	if ((error = sysctl_createv(clog, 0, NULL, &node,
1246 	    CTLFLAG_PERMANENT,
1247 	    CTLTYPE_NODE, "tap", NULL,
1248 	    NULL, 0, NULL, 0,
1249 	    CTL_NET, AF_LINK, CTL_CREATE, CTL_EOL)) != 0)
1250 		return;
1251 	tap_node = node->sysctl_num;
1252 }
1253 
1254 /*
1255  * The helper functions make Andrew Brown's interface really
1256  * shine.  It makes possible to create value on the fly whether
1257  * the sysctl value is read or written.
1258  *
1259  * As shown as an example in the man page, the first step is to
1260  * create a copy of the node to have sysctl_lookup work on it.
1261  *
1262  * Here, we have more work to do than just a copy, since we have
1263  * to create the string.  The first step is to collect the actual
1264  * value of the node, which is a convenient pointer to the softc
1265  * of the interface.  From there we create the string and use it
1266  * as the value, but only for the *copy* of the node.
1267  *
1268  * Then we let sysctl_lookup do the magic, which consists in
1269  * setting oldp and newp as required by the operation.  When the
1270  * value is read, that means that the string will be copied to
1271  * the user, and when it is written, the new value will be copied
1272  * over in the addr array.
1273  *
1274  * If newp is NULL, the user was reading the value, so we don't
1275  * have anything else to do.  If a new value was written, we
1276  * have to check it.
1277  *
1278  * If it is incorrect, we can return an error and leave 'node' as
1279  * it is:  since it is a copy of the actual node, the change will
1280  * be forgotten.
1281  *
1282  * Upon a correct input, we commit the change to the ifnet
1283  * structure of our interface.
1284  */
1285 static int
1286 tap_sysctl_handler(SYSCTLFN_ARGS)
1287 {
1288 	struct sysctlnode node;
1289 	struct tap_softc *sc;
1290 	struct ifnet *ifp;
1291 	int error;
1292 	size_t len;
1293 	char addr[3 * ETHER_ADDR_LEN];
1294 	uint8_t enaddr[ETHER_ADDR_LEN];
1295 
1296 	node = *rnode;
1297 	sc = node.sysctl_data;
1298 	ifp = &sc->sc_ec.ec_if;
1299 	(void)ether_snprintf(addr, sizeof(addr), CLLADDR(ifp->if_sadl));
1300 	node.sysctl_data = addr;
1301 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1302 	if (error || newp == NULL)
1303 		return (error);
1304 
1305 	len = strlen(addr);
1306 	if (len < 11 || len > 17)
1307 		return (EINVAL);
1308 
1309 	/* Commit change */
1310 	if (ether_nonstatic_aton(enaddr, addr) != 0)
1311 		return (EINVAL);
1312 	if_set_sadl(ifp, enaddr, ETHER_ADDR_LEN);
1313 	return (error);
1314 }
1315