SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/mm.h>
  54 #include <linux/capability.h>
  55 #include <linux/fcntl.h>
  56 #include <linux/socket.h>
  57 #include <linux/in.h>
  58 #include <linux/inet.h>
  59 #include <linux/netdevice.h>
  60 #include <linux/if_packet.h>
  61 #include <linux/wireless.h>
  62 #include <linux/kernel.h>
  63 #include <linux/kmod.h>
  64 #include <net/net_namespace.h>
  65 #include <net/ip.h>
  66 #include <net/protocol.h>
  67 #include <linux/skbuff.h>
  68 #include <net/sock.h>
  69 #include <linux/errno.h>
  70 #include <linux/timer.h>
  71 #include <asm/system.h>
  72 #include <asm/uaccess.h>
  73 #include <asm/ioctls.h>
  74 #include <asm/page.h>
  75 #include <asm/cacheflush.h>
  76 #include <asm/io.h>
  77 #include <linux/proc_fs.h>
  78 #include <linux/seq_file.h>
  79 #include <linux/poll.h>
  80 #include <linux/module.h>
  81 #include <linux/init.h>
  82
  83 #ifdef CONFIG_INET
  84 #include <net/inet_common.h>
  85 #endif
  86
  87 /*
  88    Assumptions:
  89    - if device has no dev->hard_header routine, it adds and removes ll header
  90      inside itself. In this case ll header is invisible outside of device,
  91      but higher levels still should reserve dev->hard_header_len.
  92      Some devices are enough clever to reallocate skb, when header
  93      will not fit to reserved space (tunnel), another ones are silly
  94      (PPP).
  95    - packet socket receives packets with pulled ll header,
  96      so that SOCK_RAW should push it back.
  97
  98 On receive:
  99 -----------
 100
 101 Incoming, dev->hard_header!=NULL
 102    mac_header -> ll header
 103    data       -> data
 104
 105 Outgoing, dev->hard_header!=NULL
 106    mac_header -> ll header
 107    data       -> ll header
 108
 109 Incoming, dev->hard_header==NULL
 110    mac_header -> UNKNOWN position. It is very likely, that it points to ll
 111                  header.  PPP makes it, that is wrong, because introduce
 112                  assymetry between rx and tx paths.
 113    data       -> data
 114
 115 Outgoing, dev->hard_header==NULL
 116    mac_header -> data. ll header is still not built!
 117    data       -> data
 118
 119 Resume
 120   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 121
 122
 123 On transmit:
 124 ------------
 125
 126 dev->hard_header != NULL
 127    mac_header -> ll header
 128    data       -> ll header
 129
 130 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 131    mac_header -> data
 132    data       -> data
 133
 134    We should set nh.raw on output to correct posistion,
 135    packet classifier depends on it.
 136  */
 137
 138 /* List of all packet sockets. */
 139 static HLIST_HEAD(packet_sklist);
 140 static DEFINE_RWLOCK(packet_sklist_lock);
 141
 142 static atomic_t packet_socks_nr;
 143
 144
 145 /* Private packet socket structures. */
 146
 147 struct packet_mclist
 148 {
 149         struct packet_mclist    *next;
 150         int                     ifindex;
 151         int                     count;
 152         unsigned short          type;
 153         unsigned short          alen;
 154         unsigned char           addr[MAX_ADDR_LEN];
 155 };
 156 /* identical to struct packet_mreq except it has
 157  * a longer address field.
 158  */
 159 struct packet_mreq_max
 160 {
 161         int             mr_ifindex;
 162         unsigned short  mr_type;
 163         unsigned short  mr_alen;
 164         unsigned char   mr_address[MAX_ADDR_LEN];
 165 };
 166
 167 #ifdef CONFIG_PACKET_MMAP
 168 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 169 #endif
 170
 171 static void packet_flush_mclist(struct sock *sk);
 172
 173 struct packet_sock {
 174         /* struct sock has to be the first member of packet_sock */
 175         struct sock             sk;
 176         struct tpacket_stats    stats;
 177 #ifdef CONFIG_PACKET_MMAP
 178         char *                  *pg_vec;
 179         unsigned int            head;
 180         unsigned int            frames_per_block;
 181         unsigned int            frame_size;
 182         unsigned int            frame_max;
 183         int                     copy_thresh;
 184 #endif
 185         struct packet_type      prot_hook;
 186         spinlock_t              bind_lock;
 187         unsigned int            running:1,      /* prot_hook is attached*/
 188                                 auxdata:1,
 189                                 origdev:1;
 190         int                     ifindex;        /* bound device         */
 191         __be16                  num;
 192         struct packet_mclist    *mclist;
 193 #ifdef CONFIG_PACKET_MMAP
 194         atomic_t                mapped;
 195         unsigned int            pg_vec_order;
 196         unsigned int            pg_vec_pages;
 197         unsigned int            pg_vec_len;
 198 #endif
 199 };
 200
 201 struct packet_skb_cb {
 202         unsigned int origlen;
 203         union {
 204                 struct sockaddr_pkt pkt;
 205                 struct sockaddr_ll ll;
 206         } sa;
 207 };
 208
 209 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 210
 211 #ifdef CONFIG_PACKET_MMAP
 212
 213 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 214 {
 215         unsigned int pg_vec_pos, frame_offset;
 216
 217         pg_vec_pos = position / po->frames_per_block;
 218         frame_offset = position % po->frames_per_block;
 219
 220         return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
 221 }
 222 #endif
 223
 224 static inline struct packet_sock *pkt_sk(struct sock *sk)
 225 {
 226         return (struct packet_sock *)sk;
 227 }
 228
 229 static void packet_sock_destruct(struct sock *sk)
 230 {
 231         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 232         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 233
 234         if (!sock_flag(sk, SOCK_DEAD)) {
 235                 printk("Attempt to release alive packet socket: %p\n", sk);
 236                 return;
 237         }
 238
 239         atomic_dec(&packet_socks_nr);
 240 #ifdef PACKET_REFCNT_DEBUG
 241         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 242 #endif
 243 }
 244
 245
 246 static const struct proto_ops packet_ops;
 247
 248 static const struct proto_ops packet_ops_spkt;
 249
 250 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 251 {
 252         struct sock *sk;
 253         struct sockaddr_pkt *spkt;
 254
 255         if (dev->nd_net != &init_net)
 256                 goto out;
 257
 258         /*
 259          *      When we registered the protocol we saved the socket in the data
 260          *      field for just this event.
 261          */
 262
 263         sk = pt->af_packet_priv;
 264
 265         /*
 266          *      Yank back the headers [hope the device set this
 267          *      right or kerboom...]
 268          *
 269          *      Incoming packets have ll header pulled,
 270          *      push it back.
 271          *
 272          *      For outgoing ones skb->data == skb_mac_header(skb)
 273          *      so that this procedure is noop.
 274          */
 275
 276         if (skb->pkt_type == PACKET_LOOPBACK)
 277                 goto out;
 278
 279         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 280                 goto oom;
 281
 282         /* drop any routing info */
 283         dst_release(skb->dst);
 284         skb->dst = NULL;
 285
 286         /* drop conntrack reference */
 287         nf_reset(skb);
 288
 289         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 290
 291         skb_push(skb, skb->data - skb_mac_header(skb));
 292
 293         /*
 294          *      The SOCK_PACKET socket receives _all_ frames.
 295          */
 296
 297         spkt->spkt_family = dev->type;
 298         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 299         spkt->spkt_protocol = skb->protocol;
 300
 301         /*
 302          *      Charge the memory to the socket. This is done specifically
 303          *      to prevent sockets using all the memory up.
 304          */
 305
 306         if (sock_queue_rcv_skb(sk,skb) == 0)
 307                 return 0;
 308
 309 out:
 310         kfree_skb(skb);
 311 oom:
 312         return 0;
 313 }
 314
 315
 316 /*
 317  *      Output a raw packet to a device layer. This bypasses all the other
 318  *      protocol layers and you must therefore supply it with a complete frame
 319  */
 320
 321 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 322                                struct msghdr *msg, size_t len)
 323 {
 324         struct sock *sk = sock->sk;
 325         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 326         struct sk_buff *skb;
 327         struct net_device *dev;
 328         __be16 proto=0;
 329         int err;
 330
 331         /*
 332          *      Get and verify the address.
 333          */
 334
 335         if (saddr)
 336         {
 337                 if (msg->msg_namelen < sizeof(struct sockaddr))
 338                         return(-EINVAL);
 339                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 340                         proto=saddr->spkt_protocol;
 341         }
 342         else
 343                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 344
 345         /*
 346          *      Find the device first to size check it
 347          */
 348
 349         saddr->spkt_device[13] = 0;
 350         dev = dev_get_by_name(&init_net, saddr->spkt_device);
 351         err = -ENODEV;
 352         if (dev == NULL)
 353                 goto out_unlock;
 354
 355         err = -ENETDOWN;
 356         if (!(dev->flags & IFF_UP))
 357                 goto out_unlock;
 358
 359         /*
 360          *      You may not queue a frame bigger than the mtu. This is the lowest level
 361          *      raw protocol and you must do your own fragmentation at this level.
 362          */
 363
 364         err = -EMSGSIZE;
 365         if (len > dev->mtu + dev->hard_header_len)
 366                 goto out_unlock;
 367
 368         err = -ENOBUFS;
 369         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 370
 371         /*
 372          *      If the write buffer is full, then tough. At this level the user gets to
 373          *      deal with the problem - do your own algorithmic backoffs. That's far
 374          *      more flexible.
 375          */
 376
 377         if (skb == NULL)
 378                 goto out_unlock;
 379
 380         /*
 381          *      Fill it in
 382          */
 383
 384         /* FIXME: Save some space for broken drivers that write a
 385          * hard header at transmission time by themselves. PPP is the
 386          * notable one here. This should really be fixed at the driver level.
 387          */
 388         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 389         skb_reset_network_header(skb);
 390
 391         /* Try to align data part correctly */
 392         if (dev->hard_header) {
 393                 skb->data -= dev->hard_header_len;
 394                 skb->tail -= dev->hard_header_len;
 395                 if (len < dev->hard_header_len)
 396                         skb_reset_network_header(skb);
 397         }
 398
 399         /* Returns -EFAULT on error */
 400         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 401         skb->protocol = proto;
 402         skb->dev = dev;
 403         skb->priority = sk->sk_priority;
 404         if (err)
 405                 goto out_free;
 406
 407         /*
 408          *      Now send it
 409          */
 410
 411         dev_queue_xmit(skb);
 412         dev_put(dev);
 413         return(len);
 414
 415 out_free:
 416         kfree_skb(skb);
 417 out_unlock:
 418         if (dev)
 419                 dev_put(dev);
 420         return err;
 421 }
 422
 423 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 424                                       unsigned int res)
 425 {
 426         struct sk_filter *filter;
 427
 428         rcu_read_lock_bh();
 429         filter = rcu_dereference(sk->sk_filter);
 430         if (filter != NULL)
 431                 res = sk_run_filter(skb, filter->insns, filter->len);
 432         rcu_read_unlock_bh();
 433
 434         return res;
 435 }
 436
 437 /*
 438    This function makes lazy skb cloning in hope that most of packets
 439    are discarded by BPF.
 440
 441    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 442    and skb->cb are mangled. It works because (and until) packets
 443    falling here are owned by current CPU. Output packets are cloned
 444    by dev_queue_xmit_nit(), input packets are processed by net_bh
 445    sequencially, so that if we return skb to original state on exit,
 446    we will not harm anyone.
 447  */
 448
 449 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 450 {
 451         struct sock *sk;
 452         struct sockaddr_ll *sll;
 453         struct packet_sock *po;
 454         u8 * skb_head = skb->data;
 455         int skb_len = skb->len;
 456         unsigned int snaplen, res;
 457
 458         if (dev->nd_net != &init_net)
 459                 goto drop;
 460
 461         if (skb->pkt_type == PACKET_LOOPBACK)
 462                 goto drop;
 463
 464         sk = pt->af_packet_priv;
 465         po = pkt_sk(sk);
 466
 467         skb->dev = dev;
 468
 469         if (dev->hard_header) {
 470                 /* The device has an explicit notion of ll header,
 471                    exported to higher levels.
 472
 473                    Otherwise, the device hides datails of it frame
 474                    structure, so that corresponding packet head
 475                    never delivered to user.
 476                  */
 477                 if (sk->sk_type != SOCK_DGRAM)
 478                         skb_push(skb, skb->data - skb_mac_header(skb));
 479                 else if (skb->pkt_type == PACKET_OUTGOING) {
 480                         /* Special case: outgoing packets have ll header at head */
 481                         skb_pull(skb, skb_network_offset(skb));
 482                 }
 483         }
 484
 485         snaplen = skb->len;
 486
 487         res = run_filter(skb, sk, snaplen);
 488         if (!res)
 489                 goto drop_n_restore;
 490         if (snaplen > res)
 491                 snaplen = res;
 492
 493         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 494             (unsigned)sk->sk_rcvbuf)
 495                 goto drop_n_acct;
 496
 497         if (skb_shared(skb)) {
 498                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 499                 if (nskb == NULL)
 500                         goto drop_n_acct;
 501
 502                 if (skb_head != skb->data) {
 503                         skb->data = skb_head;
 504                         skb->len = skb_len;
 505                 }
 506                 kfree_skb(skb);
 507                 skb = nskb;
 508         }
 509
 510         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 511                      sizeof(skb->cb));
 512
 513         sll = &PACKET_SKB_CB(skb)->sa.ll;
 514         sll->sll_family = AF_PACKET;
 515         sll->sll_hatype = dev->type;
 516         sll->sll_protocol = skb->protocol;
 517         sll->sll_pkttype = skb->pkt_type;
 518         if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
 519                 sll->sll_ifindex = orig_dev->ifindex;
 520         else
 521                 sll->sll_ifindex = dev->ifindex;
 522         sll->sll_halen = 0;
 523
 524         if (dev->hard_header_parse)
 525                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 526
 527         PACKET_SKB_CB(skb)->origlen = skb->len;
 528
 529         if (pskb_trim(skb, snaplen))
 530                 goto drop_n_acct;
 531
 532         skb_set_owner_r(skb, sk);
 533         skb->dev = NULL;
 534         dst_release(skb->dst);
 535         skb->dst = NULL;
 536
 537         /* drop conntrack reference */
 538         nf_reset(skb);
 539
 540         spin_lock(&sk->sk_receive_queue.lock);
 541         po->stats.tp_packets++;
 542         __skb_queue_tail(&sk->sk_receive_queue, skb);
 543         spin_unlock(&sk->sk_receive_queue.lock);
 544         sk->sk_data_ready(sk, skb->len);
 545         return 0;
 546
 547 drop_n_acct:
 548         spin_lock(&sk->sk_receive_queue.lock);
 549         po->stats.tp_drops++;
 550         spin_unlock(&sk->sk_receive_queue.lock);
 551
 552 drop_n_restore:
 553         if (skb_head != skb->data && skb_shared(skb)) {
 554                 skb->data = skb_head;
 555                 skb->len = skb_len;
 556         }
 557 drop:
 558         kfree_skb(skb);
 559         return 0;
 560 }
 561
 562 #ifdef CONFIG_PACKET_MMAP
 563 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 564 {
 565         struct sock *sk;
 566         struct packet_sock *po;
 567         struct sockaddr_ll *sll;
 568         struct tpacket_hdr *h;
 569         u8 * skb_head = skb->data;
 570         int skb_len = skb->len;
 571         unsigned int snaplen, res;
 572         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 573         unsigned short macoff, netoff;
 574         struct sk_buff *copy_skb = NULL;
 575         struct timeval tv;
 576
 577         if (dev->nd_net != &init_net)
 578                 goto drop;
 579
 580         if (skb->pkt_type == PACKET_LOOPBACK)
 581                 goto drop;
 582
 583         sk = pt->af_packet_priv;
 584         po = pkt_sk(sk);
 585
 586         if (dev->hard_header) {
 587                 if (sk->sk_type != SOCK_DGRAM)
 588                         skb_push(skb, skb->data - skb_mac_header(skb));
 589                 else if (skb->pkt_type == PACKET_OUTGOING) {
 590                         /* Special case: outgoing packets have ll header at head */
 591                         skb_pull(skb, skb_network_offset(skb));
 592                 }
 593         }
 594
 595         if (skb->ip_summed == CHECKSUM_PARTIAL)
 596                 status |= TP_STATUS_CSUMNOTREADY;
 597
 598         snaplen = skb->len;
 599
 600         res = run_filter(skb, sk, snaplen);
 601         if (!res)
 602                 goto drop_n_restore;
 603         if (snaplen > res)
 604                 snaplen = res;
 605
 606         if (sk->sk_type == SOCK_DGRAM) {
 607                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 608         } else {
 609                 unsigned maclen = skb_network_offset(skb);
 610                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 611                 macoff = netoff - maclen;
 612         }
 613
 614         if (macoff + snaplen > po->frame_size) {
 615                 if (po->copy_thresh &&
 616                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 617                     (unsigned)sk->sk_rcvbuf) {
 618                         if (skb_shared(skb)) {
 619                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 620                         } else {
 621                                 copy_skb = skb_get(skb);
 622                                 skb_head = skb->data;
 623                         }
 624                         if (copy_skb)
 625                                 skb_set_owner_r(copy_skb, sk);
 626                 }
 627                 snaplen = po->frame_size - macoff;
 628                 if ((int)snaplen < 0)
 629                         snaplen = 0;
 630         }
 631
 632         spin_lock(&sk->sk_receive_queue.lock);
 633         h = packet_lookup_frame(po, po->head);
 634
 635         if (h->tp_status)
 636                 goto ring_is_full;
 637         po->head = po->head != po->frame_max ? po->head+1 : 0;
 638         po->stats.tp_packets++;
 639         if (copy_skb) {
 640                 status |= TP_STATUS_COPY;
 641                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 642         }
 643         if (!po->stats.tp_drops)
 644                 status &= ~TP_STATUS_LOSING;
 645         spin_unlock(&sk->sk_receive_queue.lock);
 646
 647         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 648
 649         h->tp_len = skb->len;
 650         h->tp_snaplen = snaplen;
 651         h->tp_mac = macoff;
 652         h->tp_net = netoff;
 653         if (skb->tstamp.tv64)
 654                 tv = ktime_to_timeval(skb->tstamp);
 655         else
 656                 do_gettimeofday(&tv);
 657         h->tp_sec = tv.tv_sec;
 658         h->tp_usec = tv.tv_usec;
 659
 660         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 661         sll->sll_halen = 0;
 662         if (dev->hard_header_parse)
 663                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 664         sll->sll_family = AF_PACKET;
 665         sll->sll_hatype = dev->type;
 666         sll->sll_protocol = skb->protocol;
 667         sll->sll_pkttype = skb->pkt_type;
 668         if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
 669                 sll->sll_ifindex = orig_dev->ifindex;
 670         else
 671                 sll->sll_ifindex = dev->ifindex;
 672
 673         h->tp_status = status;
 674         smp_mb();
 675
 676         {
 677                 struct page *p_start, *p_end;
 678                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 679
 680                 p_start = virt_to_page(h);
 681                 p_end = virt_to_page(h_end);
 682                 while (p_start <= p_end) {
 683                         flush_dcache_page(p_start);
 684                         p_start++;
 685                 }
 686         }
 687
 688         sk->sk_data_ready(sk, 0);
 689
 690 drop_n_restore:
 691         if (skb_head != skb->data && skb_shared(skb)) {
 692                 skb->data = skb_head;
 693                 skb->len = skb_len;
 694         }
 695 drop:
 696         kfree_skb(skb);
 697         return 0;
 698
 699 ring_is_full:
 700         po->stats.tp_drops++;
 701         spin_unlock(&sk->sk_receive_queue.lock);
 702
 703         sk->sk_data_ready(sk, 0);
 704         if (copy_skb)
 705                 kfree_skb(copy_skb);
 706         goto drop_n_restore;
 707 }
 708
 709 #endif
 710
 711
 712 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 713                           struct msghdr *msg, size_t len)
 714 {
 715         struct sock *sk = sock->sk;
 716         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 717         struct sk_buff *skb;
 718         struct net_device *dev;
 719         __be16 proto;
 720         unsigned char *addr;
 721         int ifindex, err, reserve = 0;
 722
 723         /*
 724          *      Get and verify the address.
 725          */
 726
 727         if (saddr == NULL) {
 728                 struct packet_sock *po = pkt_sk(sk);
 729
 730                 ifindex = po->ifindex;
 731                 proto   = po->num;
 732                 addr    = NULL;
 733         } else {
 734                 err = -EINVAL;
 735                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 736                         goto out;
 737                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 738                         goto out;
 739                 ifindex = saddr->sll_ifindex;
 740                 proto   = saddr->sll_protocol;
 741                 addr    = saddr->sll_addr;
 742         }
 743
 744
 745         dev = dev_get_by_index(&init_net, ifindex);
 746         err = -ENXIO;
 747         if (dev == NULL)
 748                 goto out_unlock;
 749         if (sock->type == SOCK_RAW)
 750                 reserve = dev->hard_header_len;
 751
 752         err = -ENETDOWN;
 753         if (!(dev->flags & IFF_UP))
 754                 goto out_unlock;
 755
 756         err = -EMSGSIZE;
 757         if (len > dev->mtu+reserve)
 758                 goto out_unlock;
 759
 760         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 761                                 msg->msg_flags & MSG_DONTWAIT, &err);
 762         if (skb==NULL)
 763                 goto out_unlock;
 764
 765         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 766         skb_reset_network_header(skb);
 767
 768         err = -EINVAL;
 769         if (sock->type == SOCK_DGRAM &&
 770             dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
 771                 goto out_free;
 772
 773         /* Returns -EFAULT on error */
 774         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 775         if (err)
 776                 goto out_free;
 777
 778         skb->protocol = proto;
 779         skb->dev = dev;
 780         skb->priority = sk->sk_priority;
 781
 782         /*
 783          *      Now send it
 784          */
 785
 786         err = dev_queue_xmit(skb);
 787         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 788                 goto out_unlock;
 789
 790         dev_put(dev);
 791
 792         return(len);
 793
 794 out_free:
 795         kfree_skb(skb);
 796 out_unlock:
 797         if (dev)
 798                 dev_put(dev);
 799 out:
 800         return err;
 801 }
 802
 803 /*
 804  *      Close a PACKET socket. This is fairly simple. We immediately go
 805  *      to 'closed' state and remove our protocol entry in the device list.
 806  */
 807
 808 static int packet_release(struct socket *sock)
 809 {
 810         struct sock *sk = sock->sk;
 811         struct packet_sock *po;
 812
 813         if (!sk)
 814                 return 0;
 815
 816         po = pkt_sk(sk);
 817
 818         write_lock_bh(&packet_sklist_lock);
 819         sk_del_node_init(sk);
 820         write_unlock_bh(&packet_sklist_lock);
 821
 822         /*
 823          *      Unhook packet receive handler.
 824          */
 825
 826         if (po->running) {
 827                 /*
 828                  *      Remove the protocol hook
 829                  */
 830                 dev_remove_pack(&po->prot_hook);
 831                 po->running = 0;
 832                 po->num = 0;
 833                 __sock_put(sk);
 834         }
 835
 836         packet_flush_mclist(sk);
 837
 838 #ifdef CONFIG_PACKET_MMAP
 839         if (po->pg_vec) {
 840                 struct tpacket_req req;
 841                 memset(&req, 0, sizeof(req));
 842                 packet_set_ring(sk, &req, 1);
 843         }
 844 #endif
 845
 846         /*
 847          *      Now the socket is dead. No more input will appear.
 848          */
 849
 850         sock_orphan(sk);
 851         sock->sk = NULL;
 852
 853         /* Purge queues */
 854
 855         skb_queue_purge(&sk->sk_receive_queue);
 856
 857         sock_put(sk);
 858         return 0;
 859 }
 860
 861 /*
 862  *      Attach a packet hook.
 863  */
 864
 865 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 866 {
 867         struct packet_sock *po = pkt_sk(sk);
 868         /*
 869          *      Detach an existing hook if present.
 870          */
 871
 872         lock_sock(sk);
 873
 874         spin_lock(&po->bind_lock);
 875         if (po->running) {
 876                 __sock_put(sk);
 877                 po->running = 0;
 878                 po->num = 0;
 879                 spin_unlock(&po->bind_lock);
 880                 dev_remove_pack(&po->prot_hook);
 881                 spin_lock(&po->bind_lock);
 882         }
 883
 884         po->num = protocol;
 885         po->prot_hook.type = protocol;
 886         po->prot_hook.dev = dev;
 887
 888         po->ifindex = dev ? dev->ifindex : 0;
 889
 890         if (protocol == 0)
 891                 goto out_unlock;
 892
 893         if (dev) {
 894                 if (dev->flags&IFF_UP) {
 895                         dev_add_pack(&po->prot_hook);
 896                         sock_hold(sk);
 897                         po->running = 1;
 898                 } else {
 899                         sk->sk_err = ENETDOWN;
 900                         if (!sock_flag(sk, SOCK_DEAD))
 901                                 sk->sk_error_report(sk);
 902                 }
 903         } else {
 904                 dev_add_pack(&po->prot_hook);
 905                 sock_hold(sk);
 906                 po->running = 1;
 907         }
 908
 909 out_unlock:
 910         spin_unlock(&po->bind_lock);
 911         release_sock(sk);
 912         return 0;
 913 }
 914
 915 /*
 916  *      Bind a packet socket to a device
 917  */
 918
 919 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 920 {
 921         struct sock *sk=sock->sk;
 922         char name[15];
 923         struct net_device *dev;
 924         int err = -ENODEV;
 925
 926         /*
 927          *      Check legality
 928          */
 929
 930         if (addr_len != sizeof(struct sockaddr))
 931                 return -EINVAL;
 932         strlcpy(name,uaddr->sa_data,sizeof(name));
 933
 934         dev = dev_get_by_name(&init_net, name);
 935         if (dev) {
 936                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 937                 dev_put(dev);
 938         }
 939         return err;
 940 }
 941
 942 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 943 {
 944         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 945         struct sock *sk=sock->sk;
 946         struct net_device *dev = NULL;
 947         int err;
 948
 949
 950         /*
 951          *      Check legality
 952          */
 953
 954         if (addr_len < sizeof(struct sockaddr_ll))
 955                 return -EINVAL;
 956         if (sll->sll_family != AF_PACKET)
 957                 return -EINVAL;
 958
 959         if (sll->sll_ifindex) {
 960                 err = -ENODEV;
 961                 dev = dev_get_by_index(&init_net, sll->sll_ifindex);
 962                 if (dev == NULL)
 963                         goto out;
 964         }
 965         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 966         if (dev)
 967                 dev_put(dev);
 968
 969 out:
 970         return err;
 971 }
 972
 973 static struct proto packet_proto = {
 974         .name     = "PACKET",
 975         .owner    = THIS_MODULE,
 976         .obj_size = sizeof(struct packet_sock),
 977 };
 978
 979 /*
 980  *      Create a packet of type SOCK_PACKET.
 981  */
 982
 983 static int packet_create(struct net *net, struct socket *sock, int protocol)
 984 {
 985         struct sock *sk;
 986         struct packet_sock *po;
 987         __be16 proto = (__force __be16)protocol; /* weird, but documented */
 988         int err;
 989
 990         if (net != &init_net)
 991                 return -EAFNOSUPPORT;
 992
 993         if (!capable(CAP_NET_RAW))
 994                 return -EPERM;
 995         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
 996             sock->type != SOCK_PACKET)
 997                 return -ESOCKTNOSUPPORT;
 998
 999         sock->state = SS_UNCONNECTED;
1000
1001         err = -ENOBUFS;
1002         sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1003         if (sk == NULL)
1004                 goto out;
1005
1006         sock->ops = &packet_ops;
1007         if (sock->type == SOCK_PACKET)
1008                 sock->ops = &packet_ops_spkt;
1009
1010         sock_init_data(sock, sk);
1011
1012         po = pkt_sk(sk);
1013         sk->sk_family = PF_PACKET;
1014         po->num = proto;
1015
1016         sk->sk_destruct = packet_sock_destruct;
1017         atomic_inc(&packet_socks_nr);
1018
1019         /*
1020          *      Attach a protocol block
1021          */
1022
1023         spin_lock_init(&po->bind_lock);
1024         po->prot_hook.func = packet_rcv;
1025
1026         if (sock->type == SOCK_PACKET)
1027                 po->prot_hook.func = packet_rcv_spkt;
1028
1029         po->prot_hook.af_packet_priv = sk;
1030
1031         if (proto) {
1032                 po->prot_hook.type = proto;
1033                 dev_add_pack(&po->prot_hook);
1034                 sock_hold(sk);
1035                 po->running = 1;
1036         }
1037
1038         write_lock_bh(&packet_sklist_lock);
1039         sk_add_node(sk, &packet_sklist);
1040         write_unlock_bh(&packet_sklist_lock);
1041         return(0);
1042 out:
1043         return err;
1044 }
1045
1046 /*
1047  *      Pull a packet from our receive queue and hand it to the user.
1048  *      If necessary we block.
1049  */
1050
1051 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1052                           struct msghdr *msg, size_t len, int flags)
1053 {
1054         struct sock *sk = sock->sk;
1055         struct sk_buff *skb;
1056         int copied, err;
1057         struct sockaddr_ll *sll;
1058
1059         err = -EINVAL;
1060         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1061                 goto out;
1062
1063 #if 0
1064         /* What error should we return now? EUNATTACH? */
1065         if (pkt_sk(sk)->ifindex < 0)
1066                 return -ENODEV;
1067 #endif
1068
1069         /*
1070          *      Call the generic datagram receiver. This handles all sorts
1071          *      of horrible races and re-entrancy so we can forget about it
1072          *      in the protocol layers.
1073          *
1074          *      Now it will return ENETDOWN, if device have just gone down,
1075          *      but then it will block.
1076          */
1077
1078         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1079
1080         /*
1081          *      An error occurred so return it. Because skb_recv_datagram()
1082          *      handles the blocking we don't see and worry about blocking
1083          *      retries.
1084          */
1085
1086         if (skb == NULL)
1087                 goto out;
1088
1089         /*
1090          *      If the address length field is there to be filled in, we fill
1091          *      it in now.
1092          */
1093
1094         sll = &PACKET_SKB_CB(skb)->sa.ll;
1095         if (sock->type == SOCK_PACKET)
1096                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1097         else
1098                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1099
1100         /*
1101          *      You lose any data beyond the buffer you gave. If it worries a
1102          *      user program they can ask the device for its MTU anyway.
1103          */
1104
1105         copied = skb->len;
1106         if (copied > len)
1107         {
1108                 copied=len;
1109                 msg->msg_flags|=MSG_TRUNC;
1110         }
1111
1112         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1113         if (err)
1114                 goto out_free;
1115
1116         sock_recv_timestamp(msg, sk, skb);
1117
1118         if (msg->msg_name)
1119                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1120                        msg->msg_namelen);
1121
1122         if (pkt_sk(sk)->auxdata) {
1123                 struct tpacket_auxdata aux;
1124
1125                 aux.tp_status = TP_STATUS_USER;
1126                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1127                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1128                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1129                 aux.tp_snaplen = skb->len;
1130                 aux.tp_mac = 0;
1131                 aux.tp_net = skb_network_offset(skb);
1132
1133                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1134         }
1135
1136         /*
1137          *      Free or return the buffer as appropriate. Again this
1138          *      hides all the races and re-entrancy issues from us.
1139          */
1140         err = (flags&MSG_TRUNC) ? skb->len : copied;
1141
1142 out_free:
1143         skb_free_datagram(sk, skb);
1144 out:
1145         return err;
1146 }
1147
1148 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1149                                int *uaddr_len, int peer)
1150 {
1151         struct net_device *dev;
1152         struct sock *sk = sock->sk;
1153
1154         if (peer)
1155                 return -EOPNOTSUPP;
1156
1157         uaddr->sa_family = AF_PACKET;
1158         dev = dev_get_by_index(&init_net, pkt_sk(sk)->ifindex);
1159         if (dev) {
1160                 strlcpy(uaddr->sa_data, dev->name, 15);
1161                 dev_put(dev);
1162         } else
1163                 memset(uaddr->sa_data, 0, 14);
1164         *uaddr_len = sizeof(*uaddr);
1165
1166         return 0;
1167 }
1168
1169 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1170                           int *uaddr_len, int peer)
1171 {
1172         struct net_device *dev;
1173         struct sock *sk = sock->sk;
1174         struct packet_sock *po = pkt_sk(sk);
1175         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1176
1177         if (peer)
1178                 return -EOPNOTSUPP;
1179
1180         sll->sll_family = AF_PACKET;
1181         sll->sll_ifindex = po->ifindex;
1182         sll->sll_protocol = po->num;
1183         dev = dev_get_by_index(&init_net, po->ifindex);
1184         if (dev) {
1185                 sll->sll_hatype = dev->type;
1186                 sll->sll_halen = dev->addr_len;
1187                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1188                 dev_put(dev);
1189         } else {
1190                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1191                 sll->sll_halen = 0;
1192         }
1193         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1194
1195         return 0;
1196 }
1197
1198 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1199 {
1200         switch (i->type) {
1201         case PACKET_MR_MULTICAST:
1202                 if (what > 0)
1203                         dev_mc_add(dev, i->addr, i->alen, 0);
1204                 else
1205                         dev_mc_delete(dev, i->addr, i->alen, 0);
1206                 break;
1207         case PACKET_MR_PROMISC:
1208                 dev_set_promiscuity(dev, what);
1209                 break;
1210         case PACKET_MR_ALLMULTI:
1211                 dev_set_allmulti(dev, what);
1212                 break;
1213         default:;
1214         }
1215 }
1216
1217 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1218 {
1219         for ( ; i; i=i->next) {
1220                 if (i->ifindex == dev->ifindex)
1221                         packet_dev_mc(dev, i, what);
1222         }
1223 }
1224
1225 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1226 {
1227         struct packet_sock *po = pkt_sk(sk);
1228         struct packet_mclist *ml, *i;
1229         struct net_device *dev;
1230         int err;
1231
1232         rtnl_lock();
1233
1234         err = -ENODEV;
1235         dev = __dev_get_by_index(&init_net, mreq->mr_ifindex);
1236         if (!dev)
1237                 goto done;
1238
1239         err = -EINVAL;
1240         if (mreq->mr_alen > dev->addr_len)
1241                 goto done;
1242
1243         err = -ENOBUFS;
1244         i = kmalloc(sizeof(*i), GFP_KERNEL);
1245         if (i == NULL)
1246                 goto done;
1247
1248         err = 0;
1249         for (ml = po->mclist; ml; ml = ml->next) {
1250                 if (ml->ifindex == mreq->mr_ifindex &&
1251                     ml->type == mreq->mr_type &&
1252                     ml->alen == mreq->mr_alen &&
1253                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1254                         ml->count++;
1255                         /* Free the new element ... */
1256                         kfree(i);
1257                         goto done;
1258                 }
1259         }
1260
1261         i->type = mreq->mr_type;
1262         i->ifindex = mreq->mr_ifindex;
1263         i->alen = mreq->mr_alen;
1264         memcpy(i->addr, mreq->mr_address, i->alen);
1265         i->count = 1;
1266         i->next = po->mclist;
1267         po->mclist = i;
1268         packet_dev_mc(dev, i, +1);
1269
1270 done:
1271         rtnl_unlock();
1272         return err;
1273 }
1274
1275 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1276 {
1277         struct packet_mclist *ml, **mlp;
1278
1279         rtnl_lock();
1280
1281         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1282                 if (ml->ifindex == mreq->mr_ifindex &&
1283                     ml->type == mreq->mr_type &&
1284                     ml->alen == mreq->mr_alen &&
1285                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1286                         if (--ml->count == 0) {
1287                                 struct net_device *dev;
1288                                 *mlp = ml->next;
1289                                 dev = dev_get_by_index(&init_net, ml->ifindex);
1290                                 if (dev) {
1291                                         packet_dev_mc(dev, ml, -1);
1292                                         dev_put(dev);
1293                                 }
1294                                 kfree(ml);
1295                         }
1296                         rtnl_unlock();
1297                         return 0;
1298                 }
1299         }
1300         rtnl_unlock();
1301         return -EADDRNOTAVAIL;
1302 }
1303
1304 static void packet_flush_mclist(struct sock *sk)
1305 {
1306         struct packet_sock *po = pkt_sk(sk);
1307         struct packet_mclist *ml;
1308
1309         if (!po->mclist)
1310                 return;
1311
1312         rtnl_lock();
1313         while ((ml = po->mclist) != NULL) {
1314                 struct net_device *dev;
1315
1316                 po->mclist = ml->next;
1317                 if ((dev = dev_get_by_index(&init_net, ml->ifindex)) != NULL) {
1318                         packet_dev_mc(dev, ml, -1);
1319                         dev_put(dev);
1320                 }
1321                 kfree(ml);
1322         }
1323         rtnl_unlock();
1324 }
1325
1326 static int
1327 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1328 {
1329         struct sock *sk = sock->sk;
1330         struct packet_sock *po = pkt_sk(sk);
1331         int ret;
1332
1333         if (level != SOL_PACKET)
1334                 return -ENOPROTOOPT;
1335
1336         switch(optname) {
1337         case PACKET_ADD_MEMBERSHIP:
1338         case PACKET_DROP_MEMBERSHIP:
1339         {
1340                 struct packet_mreq_max mreq;
1341                 int len = optlen;
1342                 memset(&mreq, 0, sizeof(mreq));
1343                 if (len < sizeof(struct packet_mreq))
1344                         return -EINVAL;
1345                 if (len > sizeof(mreq))
1346                         len = sizeof(mreq);
1347                 if (copy_from_user(&mreq,optval,len))
1348                         return -EFAULT;
1349                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1350                         return -EINVAL;
1351                 if (optname == PACKET_ADD_MEMBERSHIP)
1352                         ret = packet_mc_add(sk, &mreq);
1353                 else
1354                         ret = packet_mc_drop(sk, &mreq);
1355                 return ret;
1356         }
1357
1358 #ifdef CONFIG_PACKET_MMAP
1359         case PACKET_RX_RING:
1360         {
1361                 struct tpacket_req req;
1362
1363                 if (optlen<sizeof(req))
1364                         return -EINVAL;
1365                 if (copy_from_user(&req,optval,sizeof(req)))
1366                         return -EFAULT;
1367                 return packet_set_ring(sk, &req, 0);
1368         }
1369         case PACKET_COPY_THRESH:
1370         {
1371                 int val;
1372
1373                 if (optlen!=sizeof(val))
1374                         return -EINVAL;
1375                 if (copy_from_user(&val,optval,sizeof(val)))
1376                         return -EFAULT;
1377
1378                 pkt_sk(sk)->copy_thresh = val;
1379                 return 0;
1380         }
1381 #endif
1382         case PACKET_AUXDATA:
1383         {
1384                 int val;
1385
1386                 if (optlen < sizeof(val))
1387                         return -EINVAL;
1388                 if (copy_from_user(&val, optval, sizeof(val)))
1389                         return -EFAULT;
1390
1391                 po->auxdata = !!val;
1392                 return 0;
1393         }
1394         case PACKET_ORIGDEV:
1395         {
1396                 int val;
1397
1398                 if (optlen < sizeof(val))
1399                         return -EINVAL;
1400                 if (copy_from_user(&val, optval, sizeof(val)))
1401                         return -EFAULT;
1402
1403                 po->origdev = !!val;
1404                 return 0;
1405         }
1406         default:
1407                 return -ENOPROTOOPT;
1408         }
1409 }
1410
1411 static int packet_getsockopt(struct socket *sock, int level, int optname,
1412                              char __user *optval, int __user *optlen)
1413 {
1414         int len;
1415         int val;
1416         struct sock *sk = sock->sk;
1417         struct packet_sock *po = pkt_sk(sk);
1418         void *data;
1419         struct tpacket_stats st;
1420
1421         if (level != SOL_PACKET)
1422                 return -ENOPROTOOPT;
1423
1424         if (get_user(len, optlen))
1425                 return -EFAULT;
1426
1427         if (len < 0)
1428                 return -EINVAL;
1429
1430         switch(optname) {
1431         case PACKET_STATISTICS:
1432                 if (len > sizeof(struct tpacket_stats))
1433                         len = sizeof(struct tpacket_stats);
1434                 spin_lock_bh(&sk->sk_receive_queue.lock);
1435                 st = po->stats;
1436                 memset(&po->stats, 0, sizeof(st));
1437                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1438                 st.tp_packets += st.tp_drops;
1439
1440                 data = &st;
1441                 break;
1442         case PACKET_AUXDATA:
1443                 if (len > sizeof(int))
1444                         len = sizeof(int);
1445                 val = po->auxdata;
1446
1447                 data = &val;
1448                 break;
1449         case PACKET_ORIGDEV:
1450                 if (len > sizeof(int))
1451                         len = sizeof(int);
1452                 val = po->origdev;
1453
1454                 data = &val;
1455                 break;
1456         default:
1457                 return -ENOPROTOOPT;
1458         }
1459
1460         if (put_user(len, optlen))
1461                 return -EFAULT;
1462         if (copy_to_user(optval, data, len))
1463                 return -EFAULT;
1464         return 0;
1465 }
1466
1467
1468 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1469 {
1470         struct sock *sk;
1471         struct hlist_node *node;
1472         struct net_device *dev = data;
1473
1474         if (dev->nd_net != &init_net)
1475                 return NOTIFY_DONE;
1476
1477         read_lock(&packet_sklist_lock);
1478         sk_for_each(sk, node, &packet_sklist) {
1479                 struct packet_sock *po = pkt_sk(sk);
1480
1481                 switch (msg) {
1482                 case NETDEV_UNREGISTER:
1483                         if (po->mclist)
1484                                 packet_dev_mclist(dev, po->mclist, -1);
1485                         /* fallthrough */
1486
1487                 case NETDEV_DOWN:
1488                         if (dev->ifindex == po->ifindex) {
1489                                 spin_lock(&po->bind_lock);
1490                                 if (po->running) {
1491                                         __dev_remove_pack(&po->prot_hook);
1492                                         __sock_put(sk);
1493                                         po->running = 0;
1494                                         sk->sk_err = ENETDOWN;
1495                                         if (!sock_flag(sk, SOCK_DEAD))
1496                                                 sk->sk_error_report(sk);
1497                                 }
1498                                 if (msg == NETDEV_UNREGISTER) {
1499                                         po->ifindex = -1;
1500                                         po->prot_hook.dev = NULL;
1501                                 }
1502                                 spin_unlock(&po->bind_lock);
1503                         }
1504                         break;
1505                 case NETDEV_UP:
1506                         spin_lock(&po->bind_lock);
1507                         if (dev->ifindex == po->ifindex && po->num &&
1508                             !po->running) {
1509                                 dev_add_pack(&po->prot_hook);
1510                                 sock_hold(sk);
1511                                 po->running = 1;
1512                         }
1513                         spin_unlock(&po->bind_lock);
1514                         break;
1515                 }
1516         }
1517         read_unlock(&packet_sklist_lock);
1518         return NOTIFY_DONE;
1519 }
1520
1521
1522 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1523                         unsigned long arg)
1524 {
1525         struct sock *sk = sock->sk;
1526
1527         switch(cmd) {
1528                 case SIOCOUTQ:
1529                 {
1530                         int amount = atomic_read(&sk->sk_wmem_alloc);
1531                         return put_user(amount, (int __user *)arg);
1532                 }
1533                 case SIOCINQ:
1534                 {
1535                         struct sk_buff *skb;
1536                         int amount = 0;
1537
1538                         spin_lock_bh(&sk->sk_receive_queue.lock);
1539                         skb = skb_peek(&sk->sk_receive_queue);
1540                         if (skb)
1541                                 amount = skb->len;
1542                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1543                         return put_user(amount, (int __user *)arg);
1544                 }
1545                 case SIOCGSTAMP:
1546                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1547                 case SIOCGSTAMPNS:
1548                         return sock_get_timestampns(sk, (struct timespec __user *)arg);
1549
1550 #ifdef CONFIG_INET
1551                 case SIOCADDRT:
1552                 case SIOCDELRT:
1553                 case SIOCDARP:
1554                 case SIOCGARP:
1555                 case SIOCSARP:
1556                 case SIOCGIFADDR:
1557                 case SIOCSIFADDR:
1558                 case SIOCGIFBRDADDR:
1559                 case SIOCSIFBRDADDR:
1560                 case SIOCGIFNETMASK:
1561                 case SIOCSIFNETMASK:
1562                 case SIOCGIFDSTADDR:
1563                 case SIOCSIFDSTADDR:
1564                 case SIOCSIFFLAGS:
1565                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1566 #endif
1567
1568                 default:
1569                         return -ENOIOCTLCMD;
1570         }
1571         return 0;
1572 }
1573
1574 #ifndef CONFIG_PACKET_MMAP
1575 #define packet_mmap sock_no_mmap
1576 #define packet_poll datagram_poll
1577 #else
1578
1579 static unsigned int packet_poll(struct file * file, struct socket *sock,
1580                                 poll_table *wait)
1581 {
1582         struct sock *sk = sock->sk;
1583         struct packet_sock *po = pkt_sk(sk);
1584         unsigned int mask = datagram_poll(file, sock, wait);
1585
1586         spin_lock_bh(&sk->sk_receive_queue.lock);
1587         if (po->pg_vec) {
1588                 unsigned last = po->head ? po->head-1 : po->frame_max;
1589                 struct tpacket_hdr *h;
1590
1591                 h = packet_lookup_frame(po, last);
1592
1593                 if (h->tp_status)
1594                         mask |= POLLIN | POLLRDNORM;
1595         }
1596         spin_unlock_bh(&sk->sk_receive_queue.lock);
1597         return mask;
1598 }
1599
1600
1601 /* Dirty? Well, I still did not learn better way to account
1602  * for user mmaps.
1603  */
1604
1605 static void packet_mm_open(struct vm_area_struct *vma)
1606 {
1607         struct file *file = vma->vm_file;
1608         struct socket * sock = file->private_data;
1609         struct sock *sk = sock->sk;
1610
1611         if (sk)
1612                 atomic_inc(&pkt_sk(sk)->mapped);
1613 }
1614
1615 static void packet_mm_close(struct vm_area_struct *vma)
1616 {
1617         struct file *file = vma->vm_file;
1618         struct socket * sock = file->private_data;
1619         struct sock *sk = sock->sk;
1620
1621         if (sk)
1622                 atomic_dec(&pkt_sk(sk)->mapped);
1623 }
1624
1625 static struct vm_operations_struct packet_mmap_ops = {
1626         .open = packet_mm_open,
1627         .close =packet_mm_close,
1628 };
1629
1630 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1631 {
1632         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1633 }
1634
1635 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1636 {
1637         int i;
1638
1639         for (i = 0; i < len; i++) {
1640                 if (likely(pg_vec[i]))
1641                         free_pages((unsigned long) pg_vec[i], order);
1642         }
1643         kfree(pg_vec);
1644 }
1645
1646 static inline char *alloc_one_pg_vec_page(unsigned long order)
1647 {
1648         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1649                                          order);
1650 }
1651
1652 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1653 {
1654         unsigned int block_nr = req->tp_block_nr;
1655         char **pg_vec;
1656         int i;
1657
1658         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1659         if (unlikely(!pg_vec))
1660                 goto out;
1661
1662         for (i = 0; i < block_nr; i++) {
1663                 pg_vec[i] = alloc_one_pg_vec_page(order);
1664                 if (unlikely(!pg_vec[i]))
1665                         goto out_free_pgvec;
1666         }
1667
1668 out:
1669         return pg_vec;
1670
1671 out_free_pgvec:
1672         free_pg_vec(pg_vec, order, block_nr);
1673         pg_vec = NULL;
1674         goto out;
1675 }
1676
1677 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1678 {
1679         char **pg_vec = NULL;
1680         struct packet_sock *po = pkt_sk(sk);
1681         int was_running, order = 0;
1682         __be16 num;
1683         int err = 0;
1684
1685         if (req->tp_block_nr) {
1686                 int i, l;
1687
1688                 /* Sanity tests and some calculations */
1689
1690                 if (unlikely(po->pg_vec))
1691                         return -EBUSY;
1692
1693                 if (unlikely((int)req->tp_block_size <= 0))
1694                         return -EINVAL;
1695                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1696                         return -EINVAL;
1697                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1698                         return -EINVAL;
1699                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1700                         return -EINVAL;
1701
1702                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1703                 if (unlikely(po->frames_per_block <= 0))
1704                         return -EINVAL;
1705                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1706                              req->tp_frame_nr))
1707                         return -EINVAL;
1708
1709                 err = -ENOMEM;
1710                 order = get_order(req->tp_block_size);
1711                 pg_vec = alloc_pg_vec(req, order);
1712                 if (unlikely(!pg_vec))
1713                         goto out;
1714
1715                 l = 0;
1716                 for (i = 0; i < req->tp_block_nr; i++) {
1717                         char *ptr = pg_vec[i];
1718                         struct tpacket_hdr *header;
1719                         int k;
1720
1721                         for (k = 0; k < po->frames_per_block; k++) {
1722                                 header = (struct tpacket_hdr *) ptr;
1723                                 header->tp_status = TP_STATUS_KERNEL;
1724                                 ptr += req->tp_frame_size;
1725                         }
1726                 }
1727                 /* Done */
1728         } else {
1729                 if (unlikely(req->tp_frame_nr))
1730                         return -EINVAL;
1731         }
1732
1733         lock_sock(sk);
1734
1735         /* Detach socket from network */
1736         spin_lock(&po->bind_lock);
1737         was_running = po->running;
1738         num = po->num;
1739         if (was_running) {
1740                 __dev_remove_pack(&po->prot_hook);
1741                 po->num = 0;
1742                 po->running = 0;
1743                 __sock_put(sk);
1744         }
1745         spin_unlock(&po->bind_lock);
1746
1747         synchronize_net();
1748
1749         err = -EBUSY;
1750         if (closing || atomic_read(&po->mapped) == 0) {
1751                 err = 0;
1752 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1753
1754                 spin_lock_bh(&sk->sk_receive_queue.lock);
1755                 pg_vec = XC(po->pg_vec, pg_vec);
1756                 po->frame_max = (req->tp_frame_nr - 1);
1757                 po->head = 0;
1758                 po->frame_size = req->tp_frame_size;
1759                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1760
1761                 order = XC(po->pg_vec_order, order);
1762                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1763
1764                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1765                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1766                 skb_queue_purge(&sk->sk_receive_queue);
1767 #undef XC
1768                 if (atomic_read(&po->mapped))
1769                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1770         }
1771
1772         spin_lock(&po->bind_lock);
1773         if (was_running && !po->running) {
1774                 sock_hold(sk);
1775                 po->running = 1;
1776                 po->num = num;
1777                 dev_add_pack(&po->prot_hook);
1778         }
1779         spin_unlock(&po->bind_lock);
1780
1781         release_sock(sk);
1782
1783         if (pg_vec)
1784                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1785 out:
1786         return err;
1787 }
1788
1789 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1790 {
1791         struct sock *sk = sock->sk;
1792         struct packet_sock *po = pkt_sk(sk);
1793         unsigned long size;
1794         unsigned long start;
1795         int err = -EINVAL;
1796         int i;
1797
1798         if (vma->vm_pgoff)
1799                 return -EINVAL;
1800
1801         size = vma->vm_end - vma->vm_start;
1802
1803         lock_sock(sk);
1804         if (po->pg_vec == NULL)
1805                 goto out;
1806         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1807                 goto out;
1808
1809         start = vma->vm_start;
1810         for (i = 0; i < po->pg_vec_len; i++) {
1811                 struct page *page = virt_to_page(po->pg_vec[i]);
1812                 int pg_num;
1813
1814                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1815                         err = vm_insert_page(vma, start, page);
1816                         if (unlikely(err))
1817                                 goto out;
1818                         start += PAGE_SIZE;
1819                 }
1820         }
1821         atomic_inc(&po->mapped);
1822         vma->vm_ops = &packet_mmap_ops;
1823         err = 0;
1824
1825 out:
1826         release_sock(sk);
1827         return err;
1828 }
1829 #endif
1830
1831
1832 static const struct proto_ops packet_ops_spkt = {
1833         .family =       PF_PACKET,
1834         .owner =        THIS_MODULE,
1835         .release =      packet_release,
1836         .bind =         packet_bind_spkt,
1837         .connect =      sock_no_connect,
1838         .socketpair =   sock_no_socketpair,
1839         .accept =       sock_no_accept,
1840         .getname =      packet_getname_spkt,
1841         .poll =         datagram_poll,
1842         .ioctl =        packet_ioctl,
1843         .listen =       sock_no_listen,
1844         .shutdown =     sock_no_shutdown,
1845         .setsockopt =   sock_no_setsockopt,
1846         .getsockopt =   sock_no_getsockopt,
1847         .sendmsg =      packet_sendmsg_spkt,
1848         .recvmsg =      packet_recvmsg,
1849         .mmap =         sock_no_mmap,
1850         .sendpage =     sock_no_sendpage,
1851 };
1852
1853 static const struct proto_ops packet_ops = {
1854         .family =       PF_PACKET,
1855         .owner =        THIS_MODULE,
1856         .release =      packet_release,
1857         .bind =         packet_bind,
1858         .connect =      sock_no_connect,
1859         .socketpair =   sock_no_socketpair,
1860         .accept =       sock_no_accept,
1861         .getname =      packet_getname,
1862         .poll =         packet_poll,
1863         .ioctl =        packet_ioctl,
1864         .listen =       sock_no_listen,
1865         .shutdown =     sock_no_shutdown,
1866         .setsockopt =   packet_setsockopt,
1867         .getsockopt =   packet_getsockopt,
1868         .sendmsg =      packet_sendmsg,
1869         .recvmsg =      packet_recvmsg,
1870         .mmap =         packet_mmap,
1871         .sendpage =     sock_no_sendpage,
1872 };
1873
1874 static struct net_proto_family packet_family_ops = {
1875         .family =       PF_PACKET,
1876         .create =       packet_create,
1877         .owner  =       THIS_MODULE,
1878 };
1879
1880 static struct notifier_block packet_netdev_notifier = {
1881         .notifier_call =packet_notifier,
1882 };
1883
1884 #ifdef CONFIG_PROC_FS
1885 static inline struct sock *packet_seq_idx(loff_t off)
1886 {
1887         struct sock *s;
1888         struct hlist_node *node;
1889
1890         sk_for_each(s, node, &packet_sklist) {
1891                 if (!off--)
1892                         return s;
1893         }
1894         return NULL;
1895 }
1896
1897 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1898 {
1899         read_lock(&packet_sklist_lock);
1900         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1901 }
1902
1903 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1904 {
1905         ++*pos;
1906         return  (v == SEQ_START_TOKEN)
1907                 ? sk_head(&packet_sklist)
1908                 : sk_next((struct sock*)v) ;
1909 }
1910
1911 static void packet_seq_stop(struct seq_file *seq, void *v)
1912 {
1913         read_unlock(&packet_sklist_lock);
1914 }
1915
1916 static int packet_seq_show(struct seq_file *seq, void *v)
1917 {
1918         if (v == SEQ_START_TOKEN)
1919                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1920         else {
1921                 struct sock *s = v;
1922                 const struct packet_sock *po = pkt_sk(s);
1923
1924                 seq_printf(seq,
1925                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1926                            s,
1927                            atomic_read(&s->sk_refcnt),
1928                            s->sk_type,
1929                            ntohs(po->num),
1930                            po->ifindex,
1931                            po->running,
1932                            atomic_read(&s->sk_rmem_alloc),
1933                            sock_i_uid(s),
1934                            sock_i_ino(s) );
1935         }
1936
1937         return 0;
1938 }
1939
1940 static const struct seq_operations packet_seq_ops = {
1941         .start  = packet_seq_start,
1942         .next   = packet_seq_next,
1943         .stop   = packet_seq_stop,
1944         .show   = packet_seq_show,
1945 };
1946
1947 static int packet_seq_open(struct inode *inode, struct file *file)
1948 {
1949         return seq_open(file, &packet_seq_ops);
1950 }
1951
1952 static const struct file_operations packet_seq_fops = {
1953         .owner          = THIS_MODULE,
1954         .open           = packet_seq_open,
1955         .read           = seq_read,
1956         .llseek         = seq_lseek,
1957         .release        = seq_release,
1958 };
1959
1960 #endif
1961
1962 static void __exit packet_exit(void)
1963 {
1964         proc_net_remove(&init_net, "packet");
1965         unregister_netdevice_notifier(&packet_netdev_notifier);
1966         sock_unregister(PF_PACKET);
1967         proto_unregister(&packet_proto);
1968 }
1969
1970 static int __init packet_init(void)
1971 {
1972         int rc = proto_register(&packet_proto, 0);
1973
1974         if (rc != 0)
1975                 goto out;
1976
1977         sock_register(&packet_family_ops);
1978         register_netdevice_notifier(&packet_netdev_notifier);
1979         proc_net_fops_create(&init_net, "packet", 0, &packet_seq_fops);
1980 out:
1981         return rc;
1982 }
1983
1984 module_init(packet_init);
1985 module_exit(packet_exit);
1986 MODULE_LICENSE("GPL");
1987 MODULE_ALIAS_NETPROTO(PF_PACKET);