SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/mm.h>
  54 #include <linux/capability.h>
  55 #include <linux/fcntl.h>
  56 #include <linux/socket.h>
  57 #include <linux/in.h>
  58 #include <linux/inet.h>
  59 #include <linux/netdevice.h>
  60 #include <linux/if_packet.h>
  61 #include <linux/wireless.h>
  62 #include <linux/kernel.h>
  63 #include <linux/kmod.h>
  64 #include <net/net_namespace.h>
  65 #include <net/ip.h>
  66 #include <net/protocol.h>
  67 #include <linux/skbuff.h>
  68 #include <net/sock.h>
  69 #include <linux/errno.h>
  70 #include <linux/timer.h>
  71 #include <asm/system.h>
  72 #include <asm/uaccess.h>
  73 #include <asm/ioctls.h>
  74 #include <asm/page.h>
  75 #include <asm/cacheflush.h>
  76 #include <asm/io.h>
  77 #include <linux/proc_fs.h>
  78 #include <linux/seq_file.h>
  79 #include <linux/poll.h>
  80 #include <linux/module.h>
  81 #include <linux/init.h>
  82
  83 #ifdef CONFIG_INET
  84 #include <net/inet_common.h>
  85 #endif
  86
  87 /*
  88    Assumptions:
  89    - if device has no dev->hard_header routine, it adds and removes ll header
  90      inside itself. In this case ll header is invisible outside of device,
  91      but higher levels still should reserve dev->hard_header_len.
  92      Some devices are enough clever to reallocate skb, when header
  93      will not fit to reserved space (tunnel), another ones are silly
  94      (PPP).
  95    - packet socket receives packets with pulled ll header,
  96      so that SOCK_RAW should push it back.
  97
  98 On receive:
  99 -----------
 100
 101 Incoming, dev->hard_header!=NULL
 102    mac_header -> ll header
 103    data       -> data
 104
 105 Outgoing, dev->hard_header!=NULL
 106    mac_header -> ll header
 107    data       -> ll header
 108
 109 Incoming, dev->hard_header==NULL
 110    mac_header -> UNKNOWN position. It is very likely, that it points to ll
 111                  header.  PPP makes it, that is wrong, because introduce
 112                  assymetry between rx and tx paths.
 113    data       -> data
 114
 115 Outgoing, dev->hard_header==NULL
 116    mac_header -> data. ll header is still not built!
 117    data       -> data
 118
 119 Resume
 120   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 121
 122
 123 On transmit:
 124 ------------
 125
 126 dev->hard_header != NULL
 127    mac_header -> ll header
 128    data       -> ll header
 129
 130 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 131    mac_header -> data
 132    data       -> data
 133
 134    We should set nh.raw on output to correct posistion,
 135    packet classifier depends on it.
 136  */
 137
 138 /* List of all packet sockets. */
 139 static HLIST_HEAD(packet_sklist);
 140 static DEFINE_RWLOCK(packet_sklist_lock);
 141
 142 static atomic_t packet_socks_nr;
 143
 144
 145 /* Private packet socket structures. */
 146
 147 struct packet_mclist
 148 {
 149         struct packet_mclist    *next;
 150         int                     ifindex;
 151         int                     count;
 152         unsigned short          type;
 153         unsigned short          alen;
 154         unsigned char           addr[MAX_ADDR_LEN];
 155 };
 156 /* identical to struct packet_mreq except it has
 157  * a longer address field.
 158  */
 159 struct packet_mreq_max
 160 {
 161         int             mr_ifindex;
 162         unsigned short  mr_type;
 163         unsigned short  mr_alen;
 164         unsigned char   mr_address[MAX_ADDR_LEN];
 165 };
 166
 167 #ifdef CONFIG_PACKET_MMAP
 168 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 169 #endif
 170
 171 static void packet_flush_mclist(struct sock *sk);
 172
 173 struct packet_sock {
 174         /* struct sock has to be the first member of packet_sock */
 175         struct sock             sk;
 176         struct tpacket_stats    stats;
 177 #ifdef CONFIG_PACKET_MMAP
 178         char *                  *pg_vec;
 179         unsigned int            head;
 180         unsigned int            frames_per_block;
 181         unsigned int            frame_size;
 182         unsigned int            frame_max;
 183         int                     copy_thresh;
 184 #endif
 185         struct packet_type      prot_hook;
 186         spinlock_t              bind_lock;
 187         unsigned int            running:1,      /* prot_hook is attached*/
 188                                 auxdata:1,
 189                                 origdev:1;
 190         int                     ifindex;        /* bound device         */
 191         __be16                  num;
 192         struct packet_mclist    *mclist;
 193 #ifdef CONFIG_PACKET_MMAP
 194         atomic_t                mapped;
 195         unsigned int            pg_vec_order;
 196         unsigned int            pg_vec_pages;
 197         unsigned int            pg_vec_len;
 198 #endif
 199 };
 200
 201 struct packet_skb_cb {
 202         unsigned int origlen;
 203         union {
 204                 struct sockaddr_pkt pkt;
 205                 struct sockaddr_ll ll;
 206         } sa;
 207 };
 208
 209 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 210
 211 #ifdef CONFIG_PACKET_MMAP
 212
 213 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 214 {
 215         unsigned int pg_vec_pos, frame_offset;
 216
 217         pg_vec_pos = position / po->frames_per_block;
 218         frame_offset = position % po->frames_per_block;
 219
 220         return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
 221 }
 222 #endif
 223
 224 static inline struct packet_sock *pkt_sk(struct sock *sk)
 225 {
 226         return (struct packet_sock *)sk;
 227 }
 228
 229 static void packet_sock_destruct(struct sock *sk)
 230 {
 231         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 232         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 233
 234         if (!sock_flag(sk, SOCK_DEAD)) {
 235                 printk("Attempt to release alive packet socket: %p\n", sk);
 236                 return;
 237         }
 238
 239         atomic_dec(&packet_socks_nr);
 240 #ifdef PACKET_REFCNT_DEBUG
 241         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 242 #endif
 243 }
 244
 245
 246 static const struct proto_ops packet_ops;
 247
 248 static const struct proto_ops packet_ops_spkt;
 249
 250 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 251 {
 252         struct sock *sk;
 253         struct sockaddr_pkt *spkt;
 254
 255         if (dev->nd_net != &init_net)
 256                 goto out;
 257
 258         /*
 259          *      When we registered the protocol we saved the socket in the data
 260          *      field for just this event.
 261          */
 262
 263         sk = pt->af_packet_priv;
 264
 265         /*
 266          *      Yank back the headers [hope the device set this
 267          *      right or kerboom...]
 268          *
 269          *      Incoming packets have ll header pulled,
 270          *      push it back.
 271          *
 272          *      For outgoing ones skb->data == skb_mac_header(skb)
 273          *      so that this procedure is noop.
 274          */
 275
 276         if (skb->pkt_type == PACKET_LOOPBACK)
 277                 goto out;
 278
 279         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 280                 goto oom;
 281
 282         /* drop any routing info */
 283         dst_release(skb->dst);
 284         skb->dst = NULL;
 285
 286         /* drop conntrack reference */
 287         nf_reset(skb);
 288
 289         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 290
 291         skb_push(skb, skb->data - skb_mac_header(skb));
 292
 293         /*
 294          *      The SOCK_PACKET socket receives _all_ frames.
 295          */
 296
 297         spkt->spkt_family = dev->type;
 298         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 299         spkt->spkt_protocol = skb->protocol;
 300
 301         /*
 302          *      Charge the memory to the socket. This is done specifically
 303          *      to prevent sockets using all the memory up.
 304          */
 305
 306         if (sock_queue_rcv_skb(sk,skb) == 0)
 307                 return 0;
 308
 309 out:
 310         kfree_skb(skb);
 311 oom:
 312         return 0;
 313 }
 314
 315
 316 /*
 317  *      Output a raw packet to a device layer. This bypasses all the other
 318  *      protocol layers and you must therefore supply it with a complete frame
 319  */
 320
 321 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 322                                struct msghdr *msg, size_t len)
 323 {
 324         struct sock *sk = sock->sk;
 325         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 326         struct sk_buff *skb;
 327         struct net_device *dev;
 328         __be16 proto=0;
 329         int err;
 330
 331         /*
 332          *      Get and verify the address.
 333          */
 334
 335         if (saddr)
 336         {
 337                 if (msg->msg_namelen < sizeof(struct sockaddr))
 338                         return(-EINVAL);
 339                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 340                         proto=saddr->spkt_protocol;
 341         }
 342         else
 343                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 344
 345         /*
 346          *      Find the device first to size check it
 347          */
 348
 349         saddr->spkt_device[13] = 0;
 350         dev = dev_get_by_name(&init_net, saddr->spkt_device);
 351         err = -ENODEV;
 352         if (dev == NULL)
 353                 goto out_unlock;
 354
 355         err = -ENETDOWN;
 356         if (!(dev->flags & IFF_UP))
 357                 goto out_unlock;
 358
 359         /*
 360          *      You may not queue a frame bigger than the mtu. This is the lowest level
 361          *      raw protocol and you must do your own fragmentation at this level.
 362          */
 363
 364         err = -EMSGSIZE;
 365         if (len > dev->mtu + dev->hard_header_len)
 366                 goto out_unlock;
 367
 368         err = -ENOBUFS;
 369         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 370
 371         /*
 372          *      If the write buffer is full, then tough. At this level the user gets to
 373          *      deal with the problem - do your own algorithmic backoffs. That's far
 374          *      more flexible.
 375          */
 376
 377         if (skb == NULL)
 378                 goto out_unlock;
 379
 380         /*
 381          *      Fill it in
 382          */
 383
 384         /* FIXME: Save some space for broken drivers that write a
 385          * hard header at transmission time by themselves. PPP is the
 386          * notable one here. This should really be fixed at the driver level.
 387          */
 388         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 389         skb_reset_network_header(skb);
 390
 391         /* Try to align data part correctly */
 392         if (dev->hard_header) {
 393                 skb->data -= dev->hard_header_len;
 394                 skb->tail -= dev->hard_header_len;
 395                 if (len < dev->hard_header_len)
 396                         skb_reset_network_header(skb);
 397         }
 398
 399         /* Returns -EFAULT on error */
 400         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 401         skb->protocol = proto;
 402         skb->dev = dev;
 403         skb->priority = sk->sk_priority;
 404         if (err)
 405                 goto out_free;
 406
 407         /*
 408          *      Now send it
 409          */
 410
 411         dev_queue_xmit(skb);
 412         dev_put(dev);
 413         return(len);
 414
 415 out_free:
 416         kfree_skb(skb);
 417 out_unlock:
 418         if (dev)
 419                 dev_put(dev);
 420         return err;
 421 }
 422
 423 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 424                                       unsigned int res)
 425 {
 426         struct sk_filter *filter;
 427
 428         rcu_read_lock_bh();
 429         filter = rcu_dereference(sk->sk_filter);
 430         if (filter != NULL)
 431                 res = sk_run_filter(skb, filter->insns, filter->len);
 432         rcu_read_unlock_bh();
 433
 434         return res;
 435 }
 436
 437 /*
 438    This function makes lazy skb cloning in hope that most of packets
 439    are discarded by BPF.
 440
 441    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 442    and skb->cb are mangled. It works because (and until) packets
 443    falling here are owned by current CPU. Output packets are cloned
 444    by dev_queue_xmit_nit(), input packets are processed by net_bh
 445    sequencially, so that if we return skb to original state on exit,
 446    we will not harm anyone.
 447  */
 448
 449 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 450 {
 451         struct sock *sk;
 452         struct sockaddr_ll *sll;
 453         struct packet_sock *po;
 454         u8 * skb_head = skb->data;
 455         int skb_len = skb->len;
 456         unsigned int snaplen, res;
 457
 458         if (dev->nd_net != &init_net)
 459                 goto drop;
 460
 461         if (skb->pkt_type == PACKET_LOOPBACK)
 462                 goto drop;
 463
 464         sk = pt->af_packet_priv;
 465         po = pkt_sk(sk);
 466
 467         skb->dev = dev;
 468
 469         if (dev->hard_header) {
 470                 /* The device has an explicit notion of ll header,
 471                    exported to higher levels.
 472
 473                    Otherwise, the device hides datails of it frame
 474                    structure, so that corresponding packet head
 475                    never delivered to user.
 476                  */
 477                 if (sk->sk_type != SOCK_DGRAM)
 478                         skb_push(skb, skb->data - skb_mac_header(skb));
 479                 else if (skb->pkt_type == PACKET_OUTGOING) {
 480                         /* Special case: outgoing packets have ll header at head */
 481                         skb_pull(skb, skb_network_offset(skb));
 482                 }
 483         }
 484
 485         snaplen = skb->len;
 486
 487         res = run_filter(skb, sk, snaplen);
 488         if (!res)
 489                 goto drop_n_restore;
 490         if (snaplen > res)
 491                 snaplen = res;
 492
 493         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 494             (unsigned)sk->sk_rcvbuf)
 495                 goto drop_n_acct;
 496
 497         if (skb_shared(skb)) {
 498                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 499                 if (nskb == NULL)
 500                         goto drop_n_acct;
 501
 502                 if (skb_head != skb->data) {
 503                         skb->data = skb_head;
 504                         skb->len = skb_len;
 505                 }
 506                 kfree_skb(skb);
 507                 skb = nskb;
 508         }
 509
 510         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 511                      sizeof(skb->cb));
 512
 513         sll = &PACKET_SKB_CB(skb)->sa.ll;
 514         sll->sll_family = AF_PACKET;
 515         sll->sll_hatype = dev->type;
 516         sll->sll_protocol = skb->protocol;
 517         sll->sll_pkttype = skb->pkt_type;
 518         if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
 519                 sll->sll_ifindex = orig_dev->ifindex;
 520         else
 521                 sll->sll_ifindex = dev->ifindex;
 522         sll->sll_halen = 0;
 523
 524         if (dev->hard_header_parse)
 525                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 526
 527         PACKET_SKB_CB(skb)->origlen = skb->len;
 528
 529         if (pskb_trim(skb, snaplen))
 530                 goto drop_n_acct;
 531
 532         skb_set_owner_r(skb, sk);
 533         skb->dev = NULL;
 534         dst_release(skb->dst);
 535         skb->dst = NULL;
 536
 537         /* drop conntrack reference */
 538         nf_reset(skb);
 539
 540         spin_lock(&sk->sk_receive_queue.lock);
 541         po->stats.tp_packets++;
 542         __skb_queue_tail(&sk->sk_receive_queue, skb);
 543         spin_unlock(&sk->sk_receive_queue.lock);
 544         sk->sk_data_ready(sk, skb->len);
 545         return 0;
 546
 547 drop_n_acct:
 548         spin_lock(&sk->sk_receive_queue.lock);
 549         po->stats.tp_drops++;
 550         spin_unlock(&sk->sk_receive_queue.lock);
 551
 552 drop_n_restore:
 553         if (skb_head != skb->data && skb_shared(skb)) {
 554                 skb->data = skb_head;
 555                 skb->len = skb_len;
 556         }
 557 drop:
 558         kfree_skb(skb);
 559         return 0;
 560 }
 561
 562 #ifdef CONFIG_PACKET_MMAP
 563 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 564 {
 565         struct sock *sk;
 566         struct packet_sock *po;
 567         struct sockaddr_ll *sll;
 568         struct tpacket_hdr *h;
 569         u8 * skb_head = skb->data;
 570         int skb_len = skb->len;
 571         unsigned int snaplen, res;
 572         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 573         unsigned short macoff, netoff;
 574         struct sk_buff *copy_skb = NULL;
 575         struct timeval tv;
 576
 577         if (dev->nd_net != &init_net)
 578                 goto drop;
 579
 580         if (skb->pkt_type == PACKET_LOOPBACK)
 581                 goto drop;
 582
 583         sk = pt->af_packet_priv;
 584         po = pkt_sk(sk);
 585
 586         if (dev->hard_header) {
 587                 if (sk->sk_type != SOCK_DGRAM)
 588                         skb_push(skb, skb->data - skb_mac_header(skb));
 589                 else if (skb->pkt_type == PACKET_OUTGOING) {
 590                         /* Special case: outgoing packets have ll header at head */
 591                         skb_pull(skb, skb_network_offset(skb));
 592                 }
 593         }
 594
 595         if (skb->ip_summed == CHECKSUM_PARTIAL)
 596                 status |= TP_STATUS_CSUMNOTREADY;
 597
 598         snaplen = skb->len;
 599
 600         res = run_filter(skb, sk, snaplen);
 601         if (!res)
 602                 goto drop_n_restore;
 603         if (snaplen > res)
 604                 snaplen = res;
 605
 606         if (sk->sk_type == SOCK_DGRAM) {
 607                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 608         } else {
 609                 unsigned maclen = skb_network_offset(skb);
 610                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 611                 macoff = netoff - maclen;
 612         }
 613
 614         if (macoff + snaplen > po->frame_size) {
 615                 if (po->copy_thresh &&
 616                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 617                     (unsigned)sk->sk_rcvbuf) {
 618                         if (skb_shared(skb)) {
 619                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 620                         } else {
 621                                 copy_skb = skb_get(skb);
 622                                 skb_head = skb->data;
 623                         }
 624                         if (copy_skb)
 625                                 skb_set_owner_r(copy_skb, sk);
 626                 }
 627                 snaplen = po->frame_size - macoff;
 628                 if ((int)snaplen < 0)
 629                         snaplen = 0;
 630         }
 631
 632         spin_lock(&sk->sk_receive_queue.lock);
 633         h = packet_lookup_frame(po, po->head);
 634
 635         if (h->tp_status)
 636                 goto ring_is_full;
 637         po->head = po->head != po->frame_max ? po->head+1 : 0;
 638         po->stats.tp_packets++;
 639         if (copy_skb) {
 640                 status |= TP_STATUS_COPY;
 641                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 642         }
 643         if (!po->stats.tp_drops)
 644                 status &= ~TP_STATUS_LOSING;
 645         spin_unlock(&sk->sk_receive_queue.lock);
 646
 647         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 648
 649         h->tp_len = skb->len;
 650         h->tp_snaplen = snaplen;
 651         h->tp_mac = macoff;
 652         h->tp_net = netoff;
 653         if (skb->tstamp.tv64)
 654                 tv = ktime_to_timeval(skb->tstamp);
 655         else
 656                 do_gettimeofday(&tv);
 657         h->tp_sec = tv.tv_sec;
 658         h->tp_usec = tv.tv_usec;
 659
 660         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 661         sll->sll_halen = 0;
 662         if (dev->hard_header_parse)
 663                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 664         sll->sll_family = AF_PACKET;
 665         sll->sll_hatype = dev->type;
 666         sll->sll_protocol = skb->protocol;
 667         sll->sll_pkttype = skb->pkt_type;
 668         if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
 669                 sll->sll_ifindex = orig_dev->ifindex;
 670         else
 671                 sll->sll_ifindex = dev->ifindex;
 672
 673         h->tp_status = status;
 674         smp_mb();
 675
 676         {
 677                 struct page *p_start, *p_end;
 678                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 679
 680                 p_start = virt_to_page(h);
 681                 p_end = virt_to_page(h_end);
 682                 while (p_start <= p_end) {
 683                         flush_dcache_page(p_start);
 684                         p_start++;
 685                 }
 686         }
 687
 688         sk->sk_data_ready(sk, 0);
 689
 690 drop_n_restore:
 691         if (skb_head != skb->data && skb_shared(skb)) {
 692                 skb->data = skb_head;
 693                 skb->len = skb_len;
 694         }
 695 drop:
 696         kfree_skb(skb);
 697         return 0;
 698
 699 ring_is_full:
 700         po->stats.tp_drops++;
 701         spin_unlock(&sk->sk_receive_queue.lock);
 702
 703         sk->sk_data_ready(sk, 0);
 704         if (copy_skb)
 705                 kfree_skb(copy_skb);
 706         goto drop_n_restore;
 707 }
 708
 709 #endif
 710
 711
 712 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 713                           struct msghdr *msg, size_t len)
 714 {
 715         struct sock *sk = sock->sk;
 716         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 717         struct sk_buff *skb;
 718         struct net_device *dev;
 719         __be16 proto;
 720         unsigned char *addr;
 721         int ifindex, err, reserve = 0;
 722
 723         /*
 724          *      Get and verify the address.
 725          */
 726
 727         if (saddr == NULL) {
 728                 struct packet_sock *po = pkt_sk(sk);
 729
 730                 ifindex = po->ifindex;
 731                 proto   = po->num;
 732                 addr    = NULL;
 733         } else {
 734                 err = -EINVAL;
 735                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 736                         goto out;
 737                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 738                         goto out;
 739                 ifindex = saddr->sll_ifindex;
 740                 proto   = saddr->sll_protocol;
 741                 addr    = saddr->sll_addr;
 742         }
 743
 744
 745         dev = dev_get_by_index(&init_net, ifindex);
 746         err = -ENXIO;
 747         if (dev == NULL)
 748                 goto out_unlock;
 749         if (sock->type == SOCK_RAW)
 750                 reserve = dev->hard_header_len;
 751
 752         err = -ENETDOWN;
 753         if (!(dev->flags & IFF_UP))
 754                 goto out_unlock;
 755
 756         err = -EMSGSIZE;
 757         if (len > dev->mtu+reserve)
 758                 goto out_unlock;
 759
 760         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 761                                 msg->msg_flags & MSG_DONTWAIT, &err);
 762         if (skb==NULL)
 763                 goto out_unlock;
 764
 765         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 766         skb_reset_network_header(skb);
 767
 768         if (dev->hard_header) {
 769                 int res;
 770                 err = -EINVAL;
 771                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 772                 if (sock->type != SOCK_DGRAM) {
 773                         skb_reset_tail_pointer(skb);
 774                         skb->len = 0;
 775                 } else if (res < 0)
 776                         goto out_free;
 777         }
 778
 779         /* Returns -EFAULT on error */
 780         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 781         if (err)
 782                 goto out_free;
 783
 784         skb->protocol = proto;
 785         skb->dev = dev;
 786         skb->priority = sk->sk_priority;
 787
 788         /*
 789          *      Now send it
 790          */
 791
 792         err = dev_queue_xmit(skb);
 793         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 794                 goto out_unlock;
 795
 796         dev_put(dev);
 797
 798         return(len);
 799
 800 out_free:
 801         kfree_skb(skb);
 802 out_unlock:
 803         if (dev)
 804                 dev_put(dev);
 805 out:
 806         return err;
 807 }
 808
 809 /*
 810  *      Close a PACKET socket. This is fairly simple. We immediately go
 811  *      to 'closed' state and remove our protocol entry in the device list.
 812  */
 813
 814 static int packet_release(struct socket *sock)
 815 {
 816         struct sock *sk = sock->sk;
 817         struct packet_sock *po;
 818
 819         if (!sk)
 820                 return 0;
 821
 822         po = pkt_sk(sk);
 823
 824         write_lock_bh(&packet_sklist_lock);
 825         sk_del_node_init(sk);
 826         write_unlock_bh(&packet_sklist_lock);
 827
 828         /*
 829          *      Unhook packet receive handler.
 830          */
 831
 832         if (po->running) {
 833                 /*
 834                  *      Remove the protocol hook
 835                  */
 836                 dev_remove_pack(&po->prot_hook);
 837                 po->running = 0;
 838                 po->num = 0;
 839                 __sock_put(sk);
 840         }
 841
 842         packet_flush_mclist(sk);
 843
 844 #ifdef CONFIG_PACKET_MMAP
 845         if (po->pg_vec) {
 846                 struct tpacket_req req;
 847                 memset(&req, 0, sizeof(req));
 848                 packet_set_ring(sk, &req, 1);
 849         }
 850 #endif
 851
 852         /*
 853          *      Now the socket is dead. No more input will appear.
 854          */
 855
 856         sock_orphan(sk);
 857         sock->sk = NULL;
 858
 859         /* Purge queues */
 860
 861         skb_queue_purge(&sk->sk_receive_queue);
 862
 863         sock_put(sk);
 864         return 0;
 865 }
 866
 867 /*
 868  *      Attach a packet hook.
 869  */
 870
 871 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 872 {
 873         struct packet_sock *po = pkt_sk(sk);
 874         /*
 875          *      Detach an existing hook if present.
 876          */
 877
 878         lock_sock(sk);
 879
 880         spin_lock(&po->bind_lock);
 881         if (po->running) {
 882                 __sock_put(sk);
 883                 po->running = 0;
 884                 po->num = 0;
 885                 spin_unlock(&po->bind_lock);
 886                 dev_remove_pack(&po->prot_hook);
 887                 spin_lock(&po->bind_lock);
 888         }
 889
 890         po->num = protocol;
 891         po->prot_hook.type = protocol;
 892         po->prot_hook.dev = dev;
 893
 894         po->ifindex = dev ? dev->ifindex : 0;
 895
 896         if (protocol == 0)
 897                 goto out_unlock;
 898
 899         if (dev) {
 900                 if (dev->flags&IFF_UP) {
 901                         dev_add_pack(&po->prot_hook);
 902                         sock_hold(sk);
 903                         po->running = 1;
 904                 } else {
 905                         sk->sk_err = ENETDOWN;
 906                         if (!sock_flag(sk, SOCK_DEAD))
 907                                 sk->sk_error_report(sk);
 908                 }
 909         } else {
 910                 dev_add_pack(&po->prot_hook);
 911                 sock_hold(sk);
 912                 po->running = 1;
 913         }
 914
 915 out_unlock:
 916         spin_unlock(&po->bind_lock);
 917         release_sock(sk);
 918         return 0;
 919 }
 920
 921 /*
 922  *      Bind a packet socket to a device
 923  */
 924
 925 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 926 {
 927         struct sock *sk=sock->sk;
 928         char name[15];
 929         struct net_device *dev;
 930         int err = -ENODEV;
 931
 932         /*
 933          *      Check legality
 934          */
 935
 936         if (addr_len != sizeof(struct sockaddr))
 937                 return -EINVAL;
 938         strlcpy(name,uaddr->sa_data,sizeof(name));
 939
 940         dev = dev_get_by_name(&init_net, name);
 941         if (dev) {
 942                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 943                 dev_put(dev);
 944         }
 945         return err;
 946 }
 947
 948 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 949 {
 950         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 951         struct sock *sk=sock->sk;
 952         struct net_device *dev = NULL;
 953         int err;
 954
 955
 956         /*
 957          *      Check legality
 958          */
 959
 960         if (addr_len < sizeof(struct sockaddr_ll))
 961                 return -EINVAL;
 962         if (sll->sll_family != AF_PACKET)
 963                 return -EINVAL;
 964
 965         if (sll->sll_ifindex) {
 966                 err = -ENODEV;
 967                 dev = dev_get_by_index(&init_net, sll->sll_ifindex);
 968                 if (dev == NULL)
 969                         goto out;
 970         }
 971         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 972         if (dev)
 973                 dev_put(dev);
 974
 975 out:
 976         return err;
 977 }
 978
 979 static struct proto packet_proto = {
 980         .name     = "PACKET",
 981         .owner    = THIS_MODULE,
 982         .obj_size = sizeof(struct packet_sock),
 983 };
 984
 985 /*
 986  *      Create a packet of type SOCK_PACKET.
 987  */
 988
 989 static int packet_create(struct net *net, struct socket *sock, int protocol)
 990 {
 991         struct sock *sk;
 992         struct packet_sock *po;
 993         __be16 proto = (__force __be16)protocol; /* weird, but documented */
 994         int err;
 995
 996         if (net != &init_net)
 997                 return -EAFNOSUPPORT;
 998
 999         if (!capable(CAP_NET_RAW))
1000                 return -EPERM;
1001         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
1002             sock->type != SOCK_PACKET)
1003                 return -ESOCKTNOSUPPORT;
1004
1005         sock->state = SS_UNCONNECTED;
1006
1007         err = -ENOBUFS;
1008         sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1009         if (sk == NULL)
1010                 goto out;
1011
1012         sock->ops = &packet_ops;
1013         if (sock->type == SOCK_PACKET)
1014                 sock->ops = &packet_ops_spkt;
1015
1016         sock_init_data(sock, sk);
1017
1018         po = pkt_sk(sk);
1019         sk->sk_family = PF_PACKET;
1020         po->num = proto;
1021
1022         sk->sk_destruct = packet_sock_destruct;
1023         atomic_inc(&packet_socks_nr);
1024
1025         /*
1026          *      Attach a protocol block
1027          */
1028
1029         spin_lock_init(&po->bind_lock);
1030         po->prot_hook.func = packet_rcv;
1031
1032         if (sock->type == SOCK_PACKET)
1033                 po->prot_hook.func = packet_rcv_spkt;
1034
1035         po->prot_hook.af_packet_priv = sk;
1036
1037         if (proto) {
1038                 po->prot_hook.type = proto;
1039                 dev_add_pack(&po->prot_hook);
1040                 sock_hold(sk);
1041                 po->running = 1;
1042         }
1043
1044         write_lock_bh(&packet_sklist_lock);
1045         sk_add_node(sk, &packet_sklist);
1046         write_unlock_bh(&packet_sklist_lock);
1047         return(0);
1048 out:
1049         return err;
1050 }
1051
1052 /*
1053  *      Pull a packet from our receive queue and hand it to the user.
1054  *      If necessary we block.
1055  */
1056
1057 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1058                           struct msghdr *msg, size_t len, int flags)
1059 {
1060         struct sock *sk = sock->sk;
1061         struct sk_buff *skb;
1062         int copied, err;
1063         struct sockaddr_ll *sll;
1064
1065         err = -EINVAL;
1066         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1067                 goto out;
1068
1069 #if 0
1070         /* What error should we return now? EUNATTACH? */
1071         if (pkt_sk(sk)->ifindex < 0)
1072                 return -ENODEV;
1073 #endif
1074
1075         /*
1076          *      Call the generic datagram receiver. This handles all sorts
1077          *      of horrible races and re-entrancy so we can forget about it
1078          *      in the protocol layers.
1079          *
1080          *      Now it will return ENETDOWN, if device have just gone down,
1081          *      but then it will block.
1082          */
1083
1084         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1085
1086         /*
1087          *      An error occurred so return it. Because skb_recv_datagram()
1088          *      handles the blocking we don't see and worry about blocking
1089          *      retries.
1090          */
1091
1092         if (skb == NULL)
1093                 goto out;
1094
1095         /*
1096          *      If the address length field is there to be filled in, we fill
1097          *      it in now.
1098          */
1099
1100         sll = &PACKET_SKB_CB(skb)->sa.ll;
1101         if (sock->type == SOCK_PACKET)
1102                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1103         else
1104                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1105
1106         /*
1107          *      You lose any data beyond the buffer you gave. If it worries a
1108          *      user program they can ask the device for its MTU anyway.
1109          */
1110
1111         copied = skb->len;
1112         if (copied > len)
1113         {
1114                 copied=len;
1115                 msg->msg_flags|=MSG_TRUNC;
1116         }
1117
1118         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1119         if (err)
1120                 goto out_free;
1121
1122         sock_recv_timestamp(msg, sk, skb);
1123
1124         if (msg->msg_name)
1125                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1126                        msg->msg_namelen);
1127
1128         if (pkt_sk(sk)->auxdata) {
1129                 struct tpacket_auxdata aux;
1130
1131                 aux.tp_status = TP_STATUS_USER;
1132                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1133                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1134                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1135                 aux.tp_snaplen = skb->len;
1136                 aux.tp_mac = 0;
1137                 aux.tp_net = skb_network_offset(skb);
1138
1139                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1140         }
1141
1142         /*
1143          *      Free or return the buffer as appropriate. Again this
1144          *      hides all the races and re-entrancy issues from us.
1145          */
1146         err = (flags&MSG_TRUNC) ? skb->len : copied;
1147
1148 out_free:
1149         skb_free_datagram(sk, skb);
1150 out:
1151         return err;
1152 }
1153
1154 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1155                                int *uaddr_len, int peer)
1156 {
1157         struct net_device *dev;
1158         struct sock *sk = sock->sk;
1159
1160         if (peer)
1161                 return -EOPNOTSUPP;
1162
1163         uaddr->sa_family = AF_PACKET;
1164         dev = dev_get_by_index(&init_net, pkt_sk(sk)->ifindex);
1165         if (dev) {
1166                 strlcpy(uaddr->sa_data, dev->name, 15);
1167                 dev_put(dev);
1168         } else
1169                 memset(uaddr->sa_data, 0, 14);
1170         *uaddr_len = sizeof(*uaddr);
1171
1172         return 0;
1173 }
1174
1175 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1176                           int *uaddr_len, int peer)
1177 {
1178         struct net_device *dev;
1179         struct sock *sk = sock->sk;
1180         struct packet_sock *po = pkt_sk(sk);
1181         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1182
1183         if (peer)
1184                 return -EOPNOTSUPP;
1185
1186         sll->sll_family = AF_PACKET;
1187         sll->sll_ifindex = po->ifindex;
1188         sll->sll_protocol = po->num;
1189         dev = dev_get_by_index(&init_net, po->ifindex);
1190         if (dev) {
1191                 sll->sll_hatype = dev->type;
1192                 sll->sll_halen = dev->addr_len;
1193                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1194                 dev_put(dev);
1195         } else {
1196                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1197                 sll->sll_halen = 0;
1198         }
1199         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1200
1201         return 0;
1202 }
1203
1204 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1205 {
1206         switch (i->type) {
1207         case PACKET_MR_MULTICAST:
1208                 if (what > 0)
1209                         dev_mc_add(dev, i->addr, i->alen, 0);
1210                 else
1211                         dev_mc_delete(dev, i->addr, i->alen, 0);
1212                 break;
1213         case PACKET_MR_PROMISC:
1214                 dev_set_promiscuity(dev, what);
1215                 break;
1216         case PACKET_MR_ALLMULTI:
1217                 dev_set_allmulti(dev, what);
1218                 break;
1219         default:;
1220         }
1221 }
1222
1223 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1224 {
1225         for ( ; i; i=i->next) {
1226                 if (i->ifindex == dev->ifindex)
1227                         packet_dev_mc(dev, i, what);
1228         }
1229 }
1230
1231 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1232 {
1233         struct packet_sock *po = pkt_sk(sk);
1234         struct packet_mclist *ml, *i;
1235         struct net_device *dev;
1236         int err;
1237
1238         rtnl_lock();
1239
1240         err = -ENODEV;
1241         dev = __dev_get_by_index(&init_net, mreq->mr_ifindex);
1242         if (!dev)
1243                 goto done;
1244
1245         err = -EINVAL;
1246         if (mreq->mr_alen > dev->addr_len)
1247                 goto done;
1248
1249         err = -ENOBUFS;
1250         i = kmalloc(sizeof(*i), GFP_KERNEL);
1251         if (i == NULL)
1252                 goto done;
1253
1254         err = 0;
1255         for (ml = po->mclist; ml; ml = ml->next) {
1256                 if (ml->ifindex == mreq->mr_ifindex &&
1257                     ml->type == mreq->mr_type &&
1258                     ml->alen == mreq->mr_alen &&
1259                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1260                         ml->count++;
1261                         /* Free the new element ... */
1262                         kfree(i);
1263                         goto done;
1264                 }
1265         }
1266
1267         i->type = mreq->mr_type;
1268         i->ifindex = mreq->mr_ifindex;
1269         i->alen = mreq->mr_alen;
1270         memcpy(i->addr, mreq->mr_address, i->alen);
1271         i->count = 1;
1272         i->next = po->mclist;
1273         po->mclist = i;
1274         packet_dev_mc(dev, i, +1);
1275
1276 done:
1277         rtnl_unlock();
1278         return err;
1279 }
1280
1281 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1282 {
1283         struct packet_mclist *ml, **mlp;
1284
1285         rtnl_lock();
1286
1287         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1288                 if (ml->ifindex == mreq->mr_ifindex &&
1289                     ml->type == mreq->mr_type &&
1290                     ml->alen == mreq->mr_alen &&
1291                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1292                         if (--ml->count == 0) {
1293                                 struct net_device *dev;
1294                                 *mlp = ml->next;
1295                                 dev = dev_get_by_index(&init_net, ml->ifindex);
1296                                 if (dev) {
1297                                         packet_dev_mc(dev, ml, -1);
1298                                         dev_put(dev);
1299                                 }
1300                                 kfree(ml);
1301                         }
1302                         rtnl_unlock();
1303                         return 0;
1304                 }
1305         }
1306         rtnl_unlock();
1307         return -EADDRNOTAVAIL;
1308 }
1309
1310 static void packet_flush_mclist(struct sock *sk)
1311 {
1312         struct packet_sock *po = pkt_sk(sk);
1313         struct packet_mclist *ml;
1314
1315         if (!po->mclist)
1316                 return;
1317
1318         rtnl_lock();
1319         while ((ml = po->mclist) != NULL) {
1320                 struct net_device *dev;
1321
1322                 po->mclist = ml->next;
1323                 if ((dev = dev_get_by_index(&init_net, ml->ifindex)) != NULL) {
1324                         packet_dev_mc(dev, ml, -1);
1325                         dev_put(dev);
1326                 }
1327                 kfree(ml);
1328         }
1329         rtnl_unlock();
1330 }
1331
1332 static int
1333 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1334 {
1335         struct sock *sk = sock->sk;
1336         struct packet_sock *po = pkt_sk(sk);
1337         int ret;
1338
1339         if (level != SOL_PACKET)
1340                 return -ENOPROTOOPT;
1341
1342         switch(optname) {
1343         case PACKET_ADD_MEMBERSHIP:
1344         case PACKET_DROP_MEMBERSHIP:
1345         {
1346                 struct packet_mreq_max mreq;
1347                 int len = optlen;
1348                 memset(&mreq, 0, sizeof(mreq));
1349                 if (len < sizeof(struct packet_mreq))
1350                         return -EINVAL;
1351                 if (len > sizeof(mreq))
1352                         len = sizeof(mreq);
1353                 if (copy_from_user(&mreq,optval,len))
1354                         return -EFAULT;
1355                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1356                         return -EINVAL;
1357                 if (optname == PACKET_ADD_MEMBERSHIP)
1358                         ret = packet_mc_add(sk, &mreq);
1359                 else
1360                         ret = packet_mc_drop(sk, &mreq);
1361                 return ret;
1362         }
1363
1364 #ifdef CONFIG_PACKET_MMAP
1365         case PACKET_RX_RING:
1366         {
1367                 struct tpacket_req req;
1368
1369                 if (optlen<sizeof(req))
1370                         return -EINVAL;
1371                 if (copy_from_user(&req,optval,sizeof(req)))
1372                         return -EFAULT;
1373                 return packet_set_ring(sk, &req, 0);
1374         }
1375         case PACKET_COPY_THRESH:
1376         {
1377                 int val;
1378
1379                 if (optlen!=sizeof(val))
1380                         return -EINVAL;
1381                 if (copy_from_user(&val,optval,sizeof(val)))
1382                         return -EFAULT;
1383
1384                 pkt_sk(sk)->copy_thresh = val;
1385                 return 0;
1386         }
1387 #endif
1388         case PACKET_AUXDATA:
1389         {
1390                 int val;
1391
1392                 if (optlen < sizeof(val))
1393                         return -EINVAL;
1394                 if (copy_from_user(&val, optval, sizeof(val)))
1395                         return -EFAULT;
1396
1397                 po->auxdata = !!val;
1398                 return 0;
1399         }
1400         case PACKET_ORIGDEV:
1401         {
1402                 int val;
1403
1404                 if (optlen < sizeof(val))
1405                         return -EINVAL;
1406                 if (copy_from_user(&val, optval, sizeof(val)))
1407                         return -EFAULT;
1408
1409                 po->origdev = !!val;
1410                 return 0;
1411         }
1412         default:
1413                 return -ENOPROTOOPT;
1414         }
1415 }
1416
1417 static int packet_getsockopt(struct socket *sock, int level, int optname,
1418                              char __user *optval, int __user *optlen)
1419 {
1420         int len;
1421         int val;
1422         struct sock *sk = sock->sk;
1423         struct packet_sock *po = pkt_sk(sk);
1424         void *data;
1425         struct tpacket_stats st;
1426
1427         if (level != SOL_PACKET)
1428                 return -ENOPROTOOPT;
1429
1430         if (get_user(len, optlen))
1431                 return -EFAULT;
1432
1433         if (len < 0)
1434                 return -EINVAL;
1435
1436         switch(optname) {
1437         case PACKET_STATISTICS:
1438                 if (len > sizeof(struct tpacket_stats))
1439                         len = sizeof(struct tpacket_stats);
1440                 spin_lock_bh(&sk->sk_receive_queue.lock);
1441                 st = po->stats;
1442                 memset(&po->stats, 0, sizeof(st));
1443                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1444                 st.tp_packets += st.tp_drops;
1445
1446                 data = &st;
1447                 break;
1448         case PACKET_AUXDATA:
1449                 if (len > sizeof(int))
1450                         len = sizeof(int);
1451                 val = po->auxdata;
1452
1453                 data = &val;
1454                 break;
1455         case PACKET_ORIGDEV:
1456                 if (len > sizeof(int))
1457                         len = sizeof(int);
1458                 val = po->origdev;
1459
1460                 data = &val;
1461                 break;
1462         default:
1463                 return -ENOPROTOOPT;
1464         }
1465
1466         if (put_user(len, optlen))
1467                 return -EFAULT;
1468         if (copy_to_user(optval, data, len))
1469                 return -EFAULT;
1470         return 0;
1471 }
1472
1473
1474 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1475 {
1476         struct sock *sk;
1477         struct hlist_node *node;
1478         struct net_device *dev = data;
1479
1480         if (dev->nd_net != &init_net)
1481                 return NOTIFY_DONE;
1482
1483         read_lock(&packet_sklist_lock);
1484         sk_for_each(sk, node, &packet_sklist) {
1485                 struct packet_sock *po = pkt_sk(sk);
1486
1487                 switch (msg) {
1488                 case NETDEV_UNREGISTER:
1489                         if (po->mclist)
1490                                 packet_dev_mclist(dev, po->mclist, -1);
1491                         /* fallthrough */
1492
1493                 case NETDEV_DOWN:
1494                         if (dev->ifindex == po->ifindex) {
1495                                 spin_lock(&po->bind_lock);
1496                                 if (po->running) {
1497                                         __dev_remove_pack(&po->prot_hook);
1498                                         __sock_put(sk);
1499                                         po->running = 0;
1500                                         sk->sk_err = ENETDOWN;
1501                                         if (!sock_flag(sk, SOCK_DEAD))
1502                                                 sk->sk_error_report(sk);
1503                                 }
1504                                 if (msg == NETDEV_UNREGISTER) {
1505                                         po->ifindex = -1;
1506                                         po->prot_hook.dev = NULL;
1507                                 }
1508                                 spin_unlock(&po->bind_lock);
1509                         }
1510                         break;
1511                 case NETDEV_UP:
1512                         spin_lock(&po->bind_lock);
1513                         if (dev->ifindex == po->ifindex && po->num &&
1514                             !po->running) {
1515                                 dev_add_pack(&po->prot_hook);
1516                                 sock_hold(sk);
1517                                 po->running = 1;
1518                         }
1519                         spin_unlock(&po->bind_lock);
1520                         break;
1521                 }
1522         }
1523         read_unlock(&packet_sklist_lock);
1524         return NOTIFY_DONE;
1525 }
1526
1527
1528 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1529                         unsigned long arg)
1530 {
1531         struct sock *sk = sock->sk;
1532
1533         switch(cmd) {
1534                 case SIOCOUTQ:
1535                 {
1536                         int amount = atomic_read(&sk->sk_wmem_alloc);
1537                         return put_user(amount, (int __user *)arg);
1538                 }
1539                 case SIOCINQ:
1540                 {
1541                         struct sk_buff *skb;
1542                         int amount = 0;
1543
1544                         spin_lock_bh(&sk->sk_receive_queue.lock);
1545                         skb = skb_peek(&sk->sk_receive_queue);
1546                         if (skb)
1547                                 amount = skb->len;
1548                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1549                         return put_user(amount, (int __user *)arg);
1550                 }
1551                 case SIOCGSTAMP:
1552                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1553                 case SIOCGSTAMPNS:
1554                         return sock_get_timestampns(sk, (struct timespec __user *)arg);
1555
1556 #ifdef CONFIG_INET
1557                 case SIOCADDRT:
1558                 case SIOCDELRT:
1559                 case SIOCDARP:
1560                 case SIOCGARP:
1561                 case SIOCSARP:
1562                 case SIOCGIFADDR:
1563                 case SIOCSIFADDR:
1564                 case SIOCGIFBRDADDR:
1565                 case SIOCSIFBRDADDR:
1566                 case SIOCGIFNETMASK:
1567                 case SIOCSIFNETMASK:
1568                 case SIOCGIFDSTADDR:
1569                 case SIOCSIFDSTADDR:
1570                 case SIOCSIFFLAGS:
1571                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1572 #endif
1573
1574                 default:
1575                         return -ENOIOCTLCMD;
1576         }
1577         return 0;
1578 }
1579
1580 #ifndef CONFIG_PACKET_MMAP
1581 #define packet_mmap sock_no_mmap
1582 #define packet_poll datagram_poll
1583 #else
1584
1585 static unsigned int packet_poll(struct file * file, struct socket *sock,
1586                                 poll_table *wait)
1587 {
1588         struct sock *sk = sock->sk;
1589         struct packet_sock *po = pkt_sk(sk);
1590         unsigned int mask = datagram_poll(file, sock, wait);
1591
1592         spin_lock_bh(&sk->sk_receive_queue.lock);
1593         if (po->pg_vec) {
1594                 unsigned last = po->head ? po->head-1 : po->frame_max;
1595                 struct tpacket_hdr *h;
1596
1597                 h = packet_lookup_frame(po, last);
1598
1599                 if (h->tp_status)
1600                         mask |= POLLIN | POLLRDNORM;
1601         }
1602         spin_unlock_bh(&sk->sk_receive_queue.lock);
1603         return mask;
1604 }
1605
1606
1607 /* Dirty? Well, I still did not learn better way to account
1608  * for user mmaps.
1609  */
1610
1611 static void packet_mm_open(struct vm_area_struct *vma)
1612 {
1613         struct file *file = vma->vm_file;
1614         struct socket * sock = file->private_data;
1615         struct sock *sk = sock->sk;
1616
1617         if (sk)
1618                 atomic_inc(&pkt_sk(sk)->mapped);
1619 }
1620
1621 static void packet_mm_close(struct vm_area_struct *vma)
1622 {
1623         struct file *file = vma->vm_file;
1624         struct socket * sock = file->private_data;
1625         struct sock *sk = sock->sk;
1626
1627         if (sk)
1628                 atomic_dec(&pkt_sk(sk)->mapped);
1629 }
1630
1631 static struct vm_operations_struct packet_mmap_ops = {
1632         .open = packet_mm_open,
1633         .close =packet_mm_close,
1634 };
1635
1636 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1637 {
1638         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1639 }
1640
1641 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1642 {
1643         int i;
1644
1645         for (i = 0; i < len; i++) {
1646                 if (likely(pg_vec[i]))
1647                         free_pages((unsigned long) pg_vec[i], order);
1648         }
1649         kfree(pg_vec);
1650 }
1651
1652 static inline char *alloc_one_pg_vec_page(unsigned long order)
1653 {
1654         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1655                                          order);
1656 }
1657
1658 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1659 {
1660         unsigned int block_nr = req->tp_block_nr;
1661         char **pg_vec;
1662         int i;
1663
1664         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1665         if (unlikely(!pg_vec))
1666                 goto out;
1667
1668         for (i = 0; i < block_nr; i++) {
1669                 pg_vec[i] = alloc_one_pg_vec_page(order);
1670                 if (unlikely(!pg_vec[i]))
1671                         goto out_free_pgvec;
1672         }
1673
1674 out:
1675         return pg_vec;
1676
1677 out_free_pgvec:
1678         free_pg_vec(pg_vec, order, block_nr);
1679         pg_vec = NULL;
1680         goto out;
1681 }
1682
1683 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1684 {
1685         char **pg_vec = NULL;
1686         struct packet_sock *po = pkt_sk(sk);
1687         int was_running, order = 0;
1688         __be16 num;
1689         int err = 0;
1690
1691         if (req->tp_block_nr) {
1692                 int i, l;
1693
1694                 /* Sanity tests and some calculations */
1695
1696                 if (unlikely(po->pg_vec))
1697                         return -EBUSY;
1698
1699                 if (unlikely((int)req->tp_block_size <= 0))
1700                         return -EINVAL;
1701                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1702                         return -EINVAL;
1703                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1704                         return -EINVAL;
1705                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1706                         return -EINVAL;
1707
1708                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1709                 if (unlikely(po->frames_per_block <= 0))
1710                         return -EINVAL;
1711                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1712                              req->tp_frame_nr))
1713                         return -EINVAL;
1714
1715                 err = -ENOMEM;
1716                 order = get_order(req->tp_block_size);
1717                 pg_vec = alloc_pg_vec(req, order);
1718                 if (unlikely(!pg_vec))
1719                         goto out;
1720
1721                 l = 0;
1722                 for (i = 0; i < req->tp_block_nr; i++) {
1723                         char *ptr = pg_vec[i];
1724                         struct tpacket_hdr *header;
1725                         int k;
1726
1727                         for (k = 0; k < po->frames_per_block; k++) {
1728                                 header = (struct tpacket_hdr *) ptr;
1729                                 header->tp_status = TP_STATUS_KERNEL;
1730                                 ptr += req->tp_frame_size;
1731                         }
1732                 }
1733                 /* Done */
1734         } else {
1735                 if (unlikely(req->tp_frame_nr))
1736                         return -EINVAL;
1737         }
1738
1739         lock_sock(sk);
1740
1741         /* Detach socket from network */
1742         spin_lock(&po->bind_lock);
1743         was_running = po->running;
1744         num = po->num;
1745         if (was_running) {
1746                 __dev_remove_pack(&po->prot_hook);
1747                 po->num = 0;
1748                 po->running = 0;
1749                 __sock_put(sk);
1750         }
1751         spin_unlock(&po->bind_lock);
1752
1753         synchronize_net();
1754
1755         err = -EBUSY;
1756         if (closing || atomic_read(&po->mapped) == 0) {
1757                 err = 0;
1758 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1759
1760                 spin_lock_bh(&sk->sk_receive_queue.lock);
1761                 pg_vec = XC(po->pg_vec, pg_vec);
1762                 po->frame_max = (req->tp_frame_nr - 1);
1763                 po->head = 0;
1764                 po->frame_size = req->tp_frame_size;
1765                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1766
1767                 order = XC(po->pg_vec_order, order);
1768                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1769
1770                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1771                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1772                 skb_queue_purge(&sk->sk_receive_queue);
1773 #undef XC
1774                 if (atomic_read(&po->mapped))
1775                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1776         }
1777
1778         spin_lock(&po->bind_lock);
1779         if (was_running && !po->running) {
1780                 sock_hold(sk);
1781                 po->running = 1;
1782                 po->num = num;
1783                 dev_add_pack(&po->prot_hook);
1784         }
1785         spin_unlock(&po->bind_lock);
1786
1787         release_sock(sk);
1788
1789         if (pg_vec)
1790                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1791 out:
1792         return err;
1793 }
1794
1795 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1796 {
1797         struct sock *sk = sock->sk;
1798         struct packet_sock *po = pkt_sk(sk);
1799         unsigned long size;
1800         unsigned long start;
1801         int err = -EINVAL;
1802         int i;
1803
1804         if (vma->vm_pgoff)
1805                 return -EINVAL;
1806
1807         size = vma->vm_end - vma->vm_start;
1808
1809         lock_sock(sk);
1810         if (po->pg_vec == NULL)
1811                 goto out;
1812         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1813                 goto out;
1814
1815         start = vma->vm_start;
1816         for (i = 0; i < po->pg_vec_len; i++) {
1817                 struct page *page = virt_to_page(po->pg_vec[i]);
1818                 int pg_num;
1819
1820                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1821                         err = vm_insert_page(vma, start, page);
1822                         if (unlikely(err))
1823                                 goto out;
1824                         start += PAGE_SIZE;
1825                 }
1826         }
1827         atomic_inc(&po->mapped);
1828         vma->vm_ops = &packet_mmap_ops;
1829         err = 0;
1830
1831 out:
1832         release_sock(sk);
1833         return err;
1834 }
1835 #endif
1836
1837
1838 static const struct proto_ops packet_ops_spkt = {
1839         .family =       PF_PACKET,
1840         .owner =        THIS_MODULE,
1841         .release =      packet_release,
1842         .bind =         packet_bind_spkt,
1843         .connect =      sock_no_connect,
1844         .socketpair =   sock_no_socketpair,
1845         .accept =       sock_no_accept,
1846         .getname =      packet_getname_spkt,
1847         .poll =         datagram_poll,
1848         .ioctl =        packet_ioctl,
1849         .listen =       sock_no_listen,
1850         .shutdown =     sock_no_shutdown,
1851         .setsockopt =   sock_no_setsockopt,
1852         .getsockopt =   sock_no_getsockopt,
1853         .sendmsg =      packet_sendmsg_spkt,
1854         .recvmsg =      packet_recvmsg,
1855         .mmap =         sock_no_mmap,
1856         .sendpage =     sock_no_sendpage,
1857 };
1858
1859 static const struct proto_ops packet_ops = {
1860         .family =       PF_PACKET,
1861         .owner =        THIS_MODULE,
1862         .release =      packet_release,
1863         .bind =         packet_bind,
1864         .connect =      sock_no_connect,
1865         .socketpair =   sock_no_socketpair,
1866         .accept =       sock_no_accept,
1867         .getname =      packet_getname,
1868         .poll =         packet_poll,
1869         .ioctl =        packet_ioctl,
1870         .listen =       sock_no_listen,
1871         .shutdown =     sock_no_shutdown,
1872         .setsockopt =   packet_setsockopt,
1873         .getsockopt =   packet_getsockopt,
1874         .sendmsg =      packet_sendmsg,
1875         .recvmsg =      packet_recvmsg,
1876         .mmap =         packet_mmap,
1877         .sendpage =     sock_no_sendpage,
1878 };
1879
1880 static struct net_proto_family packet_family_ops = {
1881         .family =       PF_PACKET,
1882         .create =       packet_create,
1883         .owner  =       THIS_MODULE,
1884 };
1885
1886 static struct notifier_block packet_netdev_notifier = {
1887         .notifier_call =packet_notifier,
1888 };
1889
1890 #ifdef CONFIG_PROC_FS
1891 static inline struct sock *packet_seq_idx(loff_t off)
1892 {
1893         struct sock *s;
1894         struct hlist_node *node;
1895
1896         sk_for_each(s, node, &packet_sklist) {
1897                 if (!off--)
1898                         return s;
1899         }
1900         return NULL;
1901 }
1902
1903 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1904 {
1905         read_lock(&packet_sklist_lock);
1906         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1907 }
1908
1909 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1910 {
1911         ++*pos;
1912         return  (v == SEQ_START_TOKEN)
1913                 ? sk_head(&packet_sklist)
1914                 : sk_next((struct sock*)v) ;
1915 }
1916
1917 static void packet_seq_stop(struct seq_file *seq, void *v)
1918 {
1919         read_unlock(&packet_sklist_lock);
1920 }
1921
1922 static int packet_seq_show(struct seq_file *seq, void *v)
1923 {
1924         if (v == SEQ_START_TOKEN)
1925                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1926         else {
1927                 struct sock *s = v;
1928                 const struct packet_sock *po = pkt_sk(s);
1929
1930                 seq_printf(seq,
1931                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1932                            s,
1933                            atomic_read(&s->sk_refcnt),
1934                            s->sk_type,
1935                            ntohs(po->num),
1936                            po->ifindex,
1937                            po->running,
1938                            atomic_read(&s->sk_rmem_alloc),
1939                            sock_i_uid(s),
1940                            sock_i_ino(s) );
1941         }
1942
1943         return 0;
1944 }
1945
1946 static const struct seq_operations packet_seq_ops = {
1947         .start  = packet_seq_start,
1948         .next   = packet_seq_next,
1949         .stop   = packet_seq_stop,
1950         .show   = packet_seq_show,
1951 };
1952
1953 static int packet_seq_open(struct inode *inode, struct file *file)
1954 {
1955         return seq_open(file, &packet_seq_ops);
1956 }
1957
1958 static const struct file_operations packet_seq_fops = {
1959         .owner          = THIS_MODULE,
1960         .open           = packet_seq_open,
1961         .read           = seq_read,
1962         .llseek         = seq_lseek,
1963         .release        = seq_release,
1964 };
1965
1966 #endif
1967
1968 static void __exit packet_exit(void)
1969 {
1970         proc_net_remove(&init_net, "packet");
1971         unregister_netdevice_notifier(&packet_netdev_notifier);
1972         sock_unregister(PF_PACKET);
1973         proto_unregister(&packet_proto);
1974 }
1975
1976 static int __init packet_init(void)
1977 {
1978         int rc = proto_register(&packet_proto, 0);
1979
1980         if (rc != 0)
1981                 goto out;
1982
1983         sock_register(&packet_family_ops);
1984         register_netdevice_notifier(&packet_netdev_notifier);
1985         proc_net_fops_create(&init_net, "packet", 0, &packet_seq_fops);
1986 out:
1987         return rc;
1988 }
1989
1990 module_init(packet_init);
1991 module_exit(packet_exit);
1992 MODULE_LICENSE("GPL");
1993 MODULE_ALIAS_NETPROTO(PF_PACKET);