-.\" $OpenBSD: bpf_mtap.9,v 1.11 2018/01/12 02:19:47 dlg Exp $
+.\" $OpenBSD: bpf_mtap.9,v 1.12 2018/01/24 00:33:45 dlg Exp $
.\"
.\" Copyright (c) 2016 David Gwynne <dlg@openbsd.org>
.\"
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
-.Dd $Mdocdate: January 12 2018 $
+.Dd $Mdocdate: January 24 2018 $
.Dt BPF_MTAP 9
.Os
.Sh NAME
.Nm bpfattach ,
.Nm bpfdetach ,
+.Nm bpfsattach ,
+.Nm bpfsdetach ,
.Nm bpf_filter ,
.Nm bpf_mfilter ,
.Nm bpf_validate ,
.Fc
.Ft void
.Fn bpfdetach "struct ifnet *ifp"
+.Ft void *
+.Fn bpfsattach "caddr_t *bpfp" "const char *name" "u_int dlt" "u_int hdrlen"
+.Ft void
+.Fn bpfsdetach "void *bpfif"
.Ft u_int
.Fo bpf_filter
.Fa "const struct bpf_insn *pc"
the network interface
.Fa ifp .
.Pp
+.Fn bpfsattach
+allocates and configures a BPF interface for use by the subsystem
+identified by
+.Fa name .
+The
+.Fa bpfp ,
+.Fa dlt ,
+.Fa hdrlen
+arguments work like those in
+.Fn bpfattach .
+.Pp
+.Fn bpfsdetach
+removes and frees the BPF interface referenced by
+.Fa bpfif .
+.Pp
.Fn bpf_filter
executes the BPF program referenced by
.Fa pc
m->m_pkthdr.pf.prio
before matching occurs.
.Sh CONTEXT
+.Fn bpfattach ,
+.Fn bpfdetach ,
+.Fn bpfsattach ,
+and
+.Fn bpfsdetach
+can be called from process context.
+.Pp
.Fn bpf_filter ,
.Fn bpf_mfilter ,
and
can be called from process context, or from an interrupt context at or below
.Dv IPL_NET .
.Sh RETURN VALUES
+.Fn bpfsattach
+returns a reference to the BPF interface it allocates.
+.Pp
.Fn bpf_filter ,
and
.Fn bpf_mfilter