SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/sched.h>
  54 #include <linux/mm.h>
  55 #include <linux/capability.h>
  56 #include <linux/fcntl.h>
  57 #include <linux/socket.h>
  58 #include <linux/in.h>
  59 #include <linux/inet.h>
  60 #include <linux/netdevice.h>
  61 #include <linux/if_packet.h>
  62 #include <linux/wireless.h>
  63 #include <linux/kmod.h>
  64 #include <net/ip.h>
  65 #include <net/protocol.h>
  66 #include <linux/skbuff.h>
  67 #include <net/sock.h>
  68 #include <linux/errno.h>
  69 #include <linux/timer.h>
  70 #include <asm/system.h>
  71 #include <asm/uaccess.h>
  72 #include <asm/ioctls.h>
  73 #include <asm/page.h>
  74 #include <asm/cacheflush.h>
  75 #include <asm/io.h>
  76 #include <linux/proc_fs.h>
  77 #include <linux/seq_file.h>
  78 #include <linux/poll.h>
  79 #include <linux/module.h>
  80 #include <linux/init.h>
  81
  82 #ifdef CONFIG_INET
  83 #include <net/inet_common.h>
  84 #endif
  85
  86 #define CONFIG_SOCK_PACKET      1
  87
  88 /*
  89    Proposed replacement for SIOC{ADD,DEL}MULTI and
  90    IFF_PROMISC, IFF_ALLMULTI flags.
  91
  92    It is more expensive, but I believe,
  93    it is really correct solution: reentereble, safe and fault tolerant.
  94
  95    IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping
  96    reference count and global flag, so that real status is
  97    (gflag|(count != 0)), so that we can use obsolete faulty interface
  98    not harming clever users.
  99  */
 100 #define CONFIG_PACKET_MULTICAST 1
 101
 102 /*
 103    Assumptions:
 104    - if device has no dev->hard_header routine, it adds and removes ll header
 105      inside itself. In this case ll header is invisible outside of device,
 106      but higher levels still should reserve dev->hard_header_len.
 107      Some devices are enough clever to reallocate skb, when header
 108      will not fit to reserved space (tunnel), another ones are silly
 109      (PPP).
 110    - packet socket receives packets with pulled ll header,
 111      so that SOCK_RAW should push it back.
 112
 113 On receive:
 114 -----------
 115
 116 Incoming, dev->hard_header!=NULL
 117    mac.raw -> ll header
 118    data    -> data
 119
 120 Outgoing, dev->hard_header!=NULL
 121    mac.raw -> ll header
 122    data    -> ll header
 123
 124 Incoming, dev->hard_header==NULL
 125    mac.raw -> UNKNOWN position. It is very likely, that it points to ll header.
 126               PPP makes it, that is wrong, because introduce assymetry
 127               between rx and tx paths.
 128    data    -> data
 129
 130 Outgoing, dev->hard_header==NULL
 131    mac.raw -> data. ll header is still not built!
 132    data    -> data
 133
 134 Resume
 135   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 136
 137
 138 On transmit:
 139 ------------
 140
 141 dev->hard_header != NULL
 142    mac.raw -> ll header
 143    data    -> ll header
 144
 145 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 146    mac.raw -> data
 147    data -> data
 148
 149    We should set nh.raw on output to correct posistion,
 150    packet classifier depends on it.
 151  */
 152
 153 /* List of all packet sockets. */
 154 static HLIST_HEAD(packet_sklist);
 155 static DEFINE_RWLOCK(packet_sklist_lock);
 156
 157 static atomic_t packet_socks_nr;
 158
 159
 160 /* Private packet socket structures. */
 161
 162 #ifdef CONFIG_PACKET_MULTICAST
 163 struct packet_mclist
 164 {
 165         struct packet_mclist    *next;
 166         int                     ifindex;
 167         int                     count;
 168         unsigned short          type;
 169         unsigned short          alen;
 170         unsigned char           addr[MAX_ADDR_LEN];
 171 };
 172 /* identical to struct packet_mreq except it has
 173  * a longer address field.
 174  */
 175 struct packet_mreq_max
 176 {
 177         int             mr_ifindex;
 178         unsigned short  mr_type;
 179         unsigned short  mr_alen;
 180         unsigned char   mr_address[MAX_ADDR_LEN];
 181 };
 182 #endif
 183 #ifdef CONFIG_PACKET_MMAP
 184 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 185 #endif
 186
 187 static void packet_flush_mclist(struct sock *sk);
 188
 189 struct packet_sock {
 190         /* struct sock has to be the first member of packet_sock */
 191         struct sock             sk;
 192         struct tpacket_stats    stats;
 193 #ifdef CONFIG_PACKET_MMAP
 194         char *                  *pg_vec;
 195         unsigned int            head;
 196         unsigned int            frames_per_block;
 197         unsigned int            frame_size;
 198         unsigned int            frame_max;
 199         int                     copy_thresh;
 200 #endif
 201         struct packet_type      prot_hook;
 202         spinlock_t              bind_lock;
 203         unsigned int            running:1,      /* prot_hook is attached*/
 204                                 auxdata:1;
 205         int                     ifindex;        /* bound device         */
 206         __be16                  num;
 207 #ifdef CONFIG_PACKET_MULTICAST
 208         struct packet_mclist    *mclist;
 209 #endif
 210 #ifdef CONFIG_PACKET_MMAP
 211         atomic_t                mapped;
 212         unsigned int            pg_vec_order;
 213         unsigned int            pg_vec_pages;
 214         unsigned int            pg_vec_len;
 215 #endif
 216 };
 217
 218 #define PACKET_SKB_CB(__skb)    ((struct tpacket_auxdata *)((__skb)->cb))
 219
 220 #ifdef CONFIG_PACKET_MMAP
 221
 222 static inline char *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 223 {
 224         unsigned int pg_vec_pos, frame_offset;
 225         char *frame;
 226
 227         pg_vec_pos = position / po->frames_per_block;
 228         frame_offset = position % po->frames_per_block;
 229
 230         frame = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
 231
 232         return frame;
 233 }
 234 #endif
 235
 236 static inline struct packet_sock *pkt_sk(struct sock *sk)
 237 {
 238         return (struct packet_sock *)sk;
 239 }
 240
 241 static void packet_sock_destruct(struct sock *sk)
 242 {
 243         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 244         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 245
 246         if (!sock_flag(sk, SOCK_DEAD)) {
 247                 printk("Attempt to release alive packet socket: %p\n", sk);
 248                 return;
 249         }
 250
 251         atomic_dec(&packet_socks_nr);
 252 #ifdef PACKET_REFCNT_DEBUG
 253         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 254 #endif
 255 }
 256
 257
 258 static const struct proto_ops packet_ops;
 259
 260 #ifdef CONFIG_SOCK_PACKET
 261 static const struct proto_ops packet_ops_spkt;
 262
 263 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 264 {
 265         struct sock *sk;
 266         struct sockaddr_pkt *spkt;
 267
 268         /*
 269          *      When we registered the protocol we saved the socket in the data
 270          *      field for just this event.
 271          */
 272
 273         sk = pt->af_packet_priv;
 274
 275         /*
 276          *      Yank back the headers [hope the device set this
 277          *      right or kerboom...]
 278          *
 279          *      Incoming packets have ll header pulled,
 280          *      push it back.
 281          *
 282          *      For outgoing ones skb->data == skb->mac.raw
 283          *      so that this procedure is noop.
 284          */
 285
 286         if (skb->pkt_type == PACKET_LOOPBACK)
 287                 goto out;
 288
 289         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 290                 goto oom;
 291
 292         /* drop any routing info */
 293         dst_release(skb->dst);
 294         skb->dst = NULL;
 295
 296         /* drop conntrack reference */
 297         nf_reset(skb);
 298
 299         spkt = (struct sockaddr_pkt*)skb->cb;
 300
 301         skb_push(skb, skb->data-skb->mac.raw);
 302
 303         /*
 304          *      The SOCK_PACKET socket receives _all_ frames.
 305          */
 306
 307         spkt->spkt_family = dev->type;
 308         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 309         spkt->spkt_protocol = skb->protocol;
 310
 311         /*
 312          *      Charge the memory to the socket. This is done specifically
 313          *      to prevent sockets using all the memory up.
 314          */
 315
 316         if (sock_queue_rcv_skb(sk,skb) == 0)
 317                 return 0;
 318
 319 out:
 320         kfree_skb(skb);
 321 oom:
 322         return 0;
 323 }
 324
 325
 326 /*
 327  *      Output a raw packet to a device layer. This bypasses all the other
 328  *      protocol layers and you must therefore supply it with a complete frame
 329  */
 330
 331 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 332                                struct msghdr *msg, size_t len)
 333 {
 334         struct sock *sk = sock->sk;
 335         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 336         struct sk_buff *skb;
 337         struct net_device *dev;
 338         __be16 proto=0;
 339         int err;
 340
 341         /*
 342          *      Get and verify the address.
 343          */
 344
 345         if (saddr)
 346         {
 347                 if (msg->msg_namelen < sizeof(struct sockaddr))
 348                         return(-EINVAL);
 349                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 350                         proto=saddr->spkt_protocol;
 351         }
 352         else
 353                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 354
 355         /*
 356          *      Find the device first to size check it
 357          */
 358
 359         saddr->spkt_device[13] = 0;
 360         dev = dev_get_by_name(saddr->spkt_device);
 361         err = -ENODEV;
 362         if (dev == NULL)
 363                 goto out_unlock;
 364
 365         err = -ENETDOWN;
 366         if (!(dev->flags & IFF_UP))
 367                 goto out_unlock;
 368
 369         /*
 370          *      You may not queue a frame bigger than the mtu. This is the lowest level
 371          *      raw protocol and you must do your own fragmentation at this level.
 372          */
 373
 374         err = -EMSGSIZE;
 375         if (len > dev->mtu + dev->hard_header_len)
 376                 goto out_unlock;
 377
 378         err = -ENOBUFS;
 379         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 380
 381         /*
 382          *      If the write buffer is full, then tough. At this level the user gets to
 383          *      deal with the problem - do your own algorithmic backoffs. That's far
 384          *      more flexible.
 385          */
 386
 387         if (skb == NULL)
 388                 goto out_unlock;
 389
 390         /*
 391          *      Fill it in
 392          */
 393
 394         /* FIXME: Save some space for broken drivers that write a
 395          * hard header at transmission time by themselves. PPP is the
 396          * notable one here. This should really be fixed at the driver level.
 397          */
 398         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 399         skb->nh.raw = skb->data;
 400
 401         /* Try to align data part correctly */
 402         if (dev->hard_header) {
 403                 skb->data -= dev->hard_header_len;
 404                 skb->tail -= dev->hard_header_len;
 405                 if (len < dev->hard_header_len)
 406                         skb->nh.raw = skb->data;
 407         }
 408
 409         /* Returns -EFAULT on error */
 410         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 411         skb->protocol = proto;
 412         skb->dev = dev;
 413         skb->priority = sk->sk_priority;
 414         if (err)
 415                 goto out_free;
 416
 417         /*
 418          *      Now send it
 419          */
 420
 421         dev_queue_xmit(skb);
 422         dev_put(dev);
 423         return(len);
 424
 425 out_free:
 426         kfree_skb(skb);
 427 out_unlock:
 428         if (dev)
 429                 dev_put(dev);
 430         return err;
 431 }
 432 #endif
 433
 434 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 435                                       unsigned int res)
 436 {
 437         struct sk_filter *filter;
 438
 439         rcu_read_lock_bh();
 440         filter = rcu_dereference(sk->sk_filter);
 441         if (filter != NULL)
 442                 res = sk_run_filter(skb, filter->insns, filter->len);
 443         rcu_read_unlock_bh();
 444
 445         return res;
 446 }
 447
 448 /*
 449    This function makes lazy skb cloning in hope that most of packets
 450    are discarded by BPF.
 451
 452    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 453    and skb->cb are mangled. It works because (and until) packets
 454    falling here are owned by current CPU. Output packets are cloned
 455    by dev_queue_xmit_nit(), input packets are processed by net_bh
 456    sequencially, so that if we return skb to original state on exit,
 457    we will not harm anyone.
 458  */
 459
 460 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 461 {
 462         struct sock *sk;
 463         struct sockaddr_ll *sll;
 464         struct packet_sock *po;
 465         u8 * skb_head = skb->data;
 466         int skb_len = skb->len;
 467         unsigned int snaplen, res;
 468         struct tpacket_auxdata *aux;
 469
 470         if (skb->pkt_type == PACKET_LOOPBACK)
 471                 goto drop;
 472
 473         sk = pt->af_packet_priv;
 474         po = pkt_sk(sk);
 475
 476         skb->dev = dev;
 477
 478         if (dev->hard_header) {
 479                 /* The device has an explicit notion of ll header,
 480                    exported to higher levels.
 481
 482                    Otherwise, the device hides datails of it frame
 483                    structure, so that corresponding packet head
 484                    never delivered to user.
 485                  */
 486                 if (sk->sk_type != SOCK_DGRAM)
 487                         skb_push(skb, skb->data - skb->mac.raw);
 488                 else if (skb->pkt_type == PACKET_OUTGOING) {
 489                         /* Special case: outgoing packets have ll header at head */
 490                         skb_pull(skb, skb->nh.raw - skb->data);
 491                 }
 492         }
 493
 494         snaplen = skb->len;
 495
 496         res = run_filter(skb, sk, snaplen);
 497         if (!res)
 498                 goto drop_n_restore;
 499         if (snaplen > res)
 500                 snaplen = res;
 501
 502         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 503             (unsigned)sk->sk_rcvbuf)
 504                 goto drop_n_acct;
 505
 506         if (skb_shared(skb)) {
 507                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 508                 if (nskb == NULL)
 509                         goto drop_n_acct;
 510
 511                 if (skb_head != skb->data) {
 512                         skb->data = skb_head;
 513                         skb->len = skb_len;
 514                 }
 515                 kfree_skb(skb);
 516                 skb = nskb;
 517         }
 518
 519         sll = (struct sockaddr_ll*)skb->cb;
 520         sll->sll_family = AF_PACKET;
 521         sll->sll_hatype = dev->type;
 522         sll->sll_protocol = skb->protocol;
 523         sll->sll_pkttype = skb->pkt_type;
 524         sll->sll_ifindex = dev->ifindex;
 525         sll->sll_halen = 0;
 526
 527         if (dev->hard_header_parse)
 528                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 529
 530         aux = PACKET_SKB_CB(skb);
 531         aux->tp_status = TP_STATUS_USER;
 532         if (skb->ip_summed == CHECKSUM_PARTIAL)
 533                 aux->tp_status |= TP_STATUS_CSUMNOTREADY;
 534         aux->tp_len = skb->len;
 535         aux->tp_snaplen = snaplen;
 536         aux->tp_mac = 0;
 537         aux->tp_net = skb->nh.raw - skb->data;
 538
 539         if (pskb_trim(skb, snaplen))
 540                 goto drop_n_acct;
 541
 542         skb_set_owner_r(skb, sk);
 543         skb->dev = NULL;
 544         dst_release(skb->dst);
 545         skb->dst = NULL;
 546
 547         /* drop conntrack reference */
 548         nf_reset(skb);
 549
 550         spin_lock(&sk->sk_receive_queue.lock);
 551         po->stats.tp_packets++;
 552         __skb_queue_tail(&sk->sk_receive_queue, skb);
 553         spin_unlock(&sk->sk_receive_queue.lock);
 554         sk->sk_data_ready(sk, skb->len);
 555         return 0;
 556
 557 drop_n_acct:
 558         spin_lock(&sk->sk_receive_queue.lock);
 559         po->stats.tp_drops++;
 560         spin_unlock(&sk->sk_receive_queue.lock);
 561
 562 drop_n_restore:
 563         if (skb_head != skb->data && skb_shared(skb)) {
 564                 skb->data = skb_head;
 565                 skb->len = skb_len;
 566         }
 567 drop:
 568         kfree_skb(skb);
 569         return 0;
 570 }
 571
 572 #ifdef CONFIG_PACKET_MMAP
 573 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 574 {
 575         struct sock *sk;
 576         struct packet_sock *po;
 577         struct sockaddr_ll *sll;
 578         struct tpacket_hdr *h;
 579         u8 * skb_head = skb->data;
 580         int skb_len = skb->len;
 581         unsigned int snaplen, res;
 582         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 583         unsigned short macoff, netoff;
 584         struct sk_buff *copy_skb = NULL;
 585
 586         if (skb->pkt_type == PACKET_LOOPBACK)
 587                 goto drop;
 588
 589         sk = pt->af_packet_priv;
 590         po = pkt_sk(sk);
 591
 592         if (dev->hard_header) {
 593                 if (sk->sk_type != SOCK_DGRAM)
 594                         skb_push(skb, skb->data - skb->mac.raw);
 595                 else if (skb->pkt_type == PACKET_OUTGOING) {
 596                         /* Special case: outgoing packets have ll header at head */
 597                         skb_pull(skb, skb->nh.raw - skb->data);
 598                 }
 599         }
 600
 601         if (skb->ip_summed == CHECKSUM_PARTIAL)
 602                 status |= TP_STATUS_CSUMNOTREADY;
 603
 604         snaplen = skb->len;
 605
 606         res = run_filter(skb, sk, snaplen);
 607         if (!res)
 608                 goto drop_n_restore;
 609         if (snaplen > res)
 610                 snaplen = res;
 611
 612         if (sk->sk_type == SOCK_DGRAM) {
 613                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 614         } else {
 615                 unsigned maclen = skb->nh.raw - skb->data;
 616                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 617                 macoff = netoff - maclen;
 618         }
 619
 620         if (macoff + snaplen > po->frame_size) {
 621                 if (po->copy_thresh &&
 622                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 623                     (unsigned)sk->sk_rcvbuf) {
 624                         if (skb_shared(skb)) {
 625                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 626                         } else {
 627                                 copy_skb = skb_get(skb);
 628                                 skb_head = skb->data;
 629                         }
 630                         if (copy_skb)
 631                                 skb_set_owner_r(copy_skb, sk);
 632                 }
 633                 snaplen = po->frame_size - macoff;
 634                 if ((int)snaplen < 0)
 635                         snaplen = 0;
 636         }
 637
 638         spin_lock(&sk->sk_receive_queue.lock);
 639         h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
 640
 641         if (h->tp_status)
 642                 goto ring_is_full;
 643         po->head = po->head != po->frame_max ? po->head+1 : 0;
 644         po->stats.tp_packets++;
 645         if (copy_skb) {
 646                 status |= TP_STATUS_COPY;
 647                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 648         }
 649         if (!po->stats.tp_drops)
 650                 status &= ~TP_STATUS_LOSING;
 651         spin_unlock(&sk->sk_receive_queue.lock);
 652
 653         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 654
 655         h->tp_len = skb->len;
 656         h->tp_snaplen = snaplen;
 657         h->tp_mac = macoff;
 658         h->tp_net = netoff;
 659         if (skb->tstamp.off_sec == 0) {
 660                 __net_timestamp(skb);
 661                 sock_enable_timestamp(sk);
 662         }
 663         h->tp_sec = skb->tstamp.off_sec;
 664         h->tp_usec = skb->tstamp.off_usec;
 665
 666         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 667         sll->sll_halen = 0;
 668         if (dev->hard_header_parse)
 669                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 670         sll->sll_family = AF_PACKET;
 671         sll->sll_hatype = dev->type;
 672         sll->sll_protocol = skb->protocol;
 673         sll->sll_pkttype = skb->pkt_type;
 674         sll->sll_ifindex = dev->ifindex;
 675
 676         h->tp_status = status;
 677         smp_mb();
 678
 679         {
 680                 struct page *p_start, *p_end;
 681                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 682
 683                 p_start = virt_to_page(h);
 684                 p_end = virt_to_page(h_end);
 685                 while (p_start <= p_end) {
 686                         flush_dcache_page(p_start);
 687                         p_start++;
 688                 }
 689         }
 690
 691         sk->sk_data_ready(sk, 0);
 692
 693 drop_n_restore:
 694         if (skb_head != skb->data && skb_shared(skb)) {
 695                 skb->data = skb_head;
 696                 skb->len = skb_len;
 697         }
 698 drop:
 699         kfree_skb(skb);
 700         return 0;
 701
 702 ring_is_full:
 703         po->stats.tp_drops++;
 704         spin_unlock(&sk->sk_receive_queue.lock);
 705
 706         sk->sk_data_ready(sk, 0);
 707         if (copy_skb)
 708                 kfree_skb(copy_skb);
 709         goto drop_n_restore;
 710 }
 711
 712 #endif
 713
 714
 715 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 716                           struct msghdr *msg, size_t len)
 717 {
 718         struct sock *sk = sock->sk;
 719         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 720         struct sk_buff *skb;
 721         struct net_device *dev;
 722         __be16 proto;
 723         unsigned char *addr;
 724         int ifindex, err, reserve = 0;
 725
 726         /*
 727          *      Get and verify the address.
 728          */
 729
 730         if (saddr == NULL) {
 731                 struct packet_sock *po = pkt_sk(sk);
 732
 733                 ifindex = po->ifindex;
 734                 proto   = po->num;
 735                 addr    = NULL;
 736         } else {
 737                 err = -EINVAL;
 738                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 739                         goto out;
 740                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 741                         goto out;
 742                 ifindex = saddr->sll_ifindex;
 743                 proto   = saddr->sll_protocol;
 744                 addr    = saddr->sll_addr;
 745         }
 746
 747
 748         dev = dev_get_by_index(ifindex);
 749         err = -ENXIO;
 750         if (dev == NULL)
 751                 goto out_unlock;
 752         if (sock->type == SOCK_RAW)
 753                 reserve = dev->hard_header_len;
 754
 755         err = -ENETDOWN;
 756         if (!(dev->flags & IFF_UP))
 757                 goto out_unlock;
 758
 759         err = -EMSGSIZE;
 760         if (len > dev->mtu+reserve)
 761                 goto out_unlock;
 762
 763         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 764                                 msg->msg_flags & MSG_DONTWAIT, &err);
 765         if (skb==NULL)
 766                 goto out_unlock;
 767
 768         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 769         skb->nh.raw = skb->data;
 770
 771         if (dev->hard_header) {
 772                 int res;
 773                 err = -EINVAL;
 774                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 775                 if (sock->type != SOCK_DGRAM) {
 776                         skb->tail = skb->data;
 777                         skb->len = 0;
 778                 } else if (res < 0)
 779                         goto out_free;
 780         }
 781
 782         /* Returns -EFAULT on error */
 783         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 784         if (err)
 785                 goto out_free;
 786
 787         skb->protocol = proto;
 788         skb->dev = dev;
 789         skb->priority = sk->sk_priority;
 790
 791         /*
 792          *      Now send it
 793          */
 794
 795         err = dev_queue_xmit(skb);
 796         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 797                 goto out_unlock;
 798
 799         dev_put(dev);
 800
 801         return(len);
 802
 803 out_free:
 804         kfree_skb(skb);
 805 out_unlock:
 806         if (dev)
 807                 dev_put(dev);
 808 out:
 809         return err;
 810 }
 811
 812 /*
 813  *      Close a PACKET socket. This is fairly simple. We immediately go
 814  *      to 'closed' state and remove our protocol entry in the device list.
 815  */
 816
 817 static int packet_release(struct socket *sock)
 818 {
 819         struct sock *sk = sock->sk;
 820         struct packet_sock *po;
 821
 822         if (!sk)
 823                 return 0;
 824
 825         po = pkt_sk(sk);
 826
 827         write_lock_bh(&packet_sklist_lock);
 828         sk_del_node_init(sk);
 829         write_unlock_bh(&packet_sklist_lock);
 830
 831         /*
 832          *      Unhook packet receive handler.
 833          */
 834
 835         if (po->running) {
 836                 /*
 837                  *      Remove the protocol hook
 838                  */
 839                 dev_remove_pack(&po->prot_hook);
 840                 po->running = 0;
 841                 po->num = 0;
 842                 __sock_put(sk);
 843         }
 844
 845 #ifdef CONFIG_PACKET_MULTICAST
 846         packet_flush_mclist(sk);
 847 #endif
 848
 849 #ifdef CONFIG_PACKET_MMAP
 850         if (po->pg_vec) {
 851                 struct tpacket_req req;
 852                 memset(&req, 0, sizeof(req));
 853                 packet_set_ring(sk, &req, 1);
 854         }
 855 #endif
 856
 857         /*
 858          *      Now the socket is dead. No more input will appear.
 859          */
 860
 861         sock_orphan(sk);
 862         sock->sk = NULL;
 863
 864         /* Purge queues */
 865
 866         skb_queue_purge(&sk->sk_receive_queue);
 867
 868         sock_put(sk);
 869         return 0;
 870 }
 871
 872 /*
 873  *      Attach a packet hook.
 874  */
 875
 876 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 877 {
 878         struct packet_sock *po = pkt_sk(sk);
 879         /*
 880          *      Detach an existing hook if present.
 881          */
 882
 883         lock_sock(sk);
 884
 885         spin_lock(&po->bind_lock);
 886         if (po->running) {
 887                 __sock_put(sk);
 888                 po->running = 0;
 889                 po->num = 0;
 890                 spin_unlock(&po->bind_lock);
 891                 dev_remove_pack(&po->prot_hook);
 892                 spin_lock(&po->bind_lock);
 893         }
 894
 895         po->num = protocol;
 896         po->prot_hook.type = protocol;
 897         po->prot_hook.dev = dev;
 898
 899         po->ifindex = dev ? dev->ifindex : 0;
 900
 901         if (protocol == 0)
 902                 goto out_unlock;
 903
 904         if (dev) {
 905                 if (dev->flags&IFF_UP) {
 906                         dev_add_pack(&po->prot_hook);
 907                         sock_hold(sk);
 908                         po->running = 1;
 909                 } else {
 910                         sk->sk_err = ENETDOWN;
 911                         if (!sock_flag(sk, SOCK_DEAD))
 912                                 sk->sk_error_report(sk);
 913                 }
 914         } else {
 915                 dev_add_pack(&po->prot_hook);
 916                 sock_hold(sk);
 917                 po->running = 1;
 918         }
 919
 920 out_unlock:
 921         spin_unlock(&po->bind_lock);
 922         release_sock(sk);
 923         return 0;
 924 }
 925
 926 /*
 927  *      Bind a packet socket to a device
 928  */
 929
 930 #ifdef CONFIG_SOCK_PACKET
 931
 932 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 933 {
 934         struct sock *sk=sock->sk;
 935         char name[15];
 936         struct net_device *dev;
 937         int err = -ENODEV;
 938
 939         /*
 940          *      Check legality
 941          */
 942
 943         if (addr_len != sizeof(struct sockaddr))
 944                 return -EINVAL;
 945         strlcpy(name,uaddr->sa_data,sizeof(name));
 946
 947         dev = dev_get_by_name(name);
 948         if (dev) {
 949                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 950                 dev_put(dev);
 951         }
 952         return err;
 953 }
 954 #endif
 955
 956 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 957 {
 958         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 959         struct sock *sk=sock->sk;
 960         struct net_device *dev = NULL;
 961         int err;
 962
 963
 964         /*
 965          *      Check legality
 966          */
 967
 968         if (addr_len < sizeof(struct sockaddr_ll))
 969                 return -EINVAL;
 970         if (sll->sll_family != AF_PACKET)
 971                 return -EINVAL;
 972
 973         if (sll->sll_ifindex) {
 974                 err = -ENODEV;
 975                 dev = dev_get_by_index(sll->sll_ifindex);
 976                 if (dev == NULL)
 977                         goto out;
 978         }
 979         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 980         if (dev)
 981                 dev_put(dev);
 982
 983 out:
 984         return err;
 985 }
 986
 987 static struct proto packet_proto = {
 988         .name     = "PACKET",
 989         .owner    = THIS_MODULE,
 990         .obj_size = sizeof(struct packet_sock),
 991 };
 992
 993 /*
 994  *      Create a packet of type SOCK_PACKET.
 995  */
 996
 997 static int packet_create(struct socket *sock, int protocol)
 998 {
 999         struct sock *sk;
1000         struct packet_sock *po;
1001         __be16 proto = (__force __be16)protocol; /* weird, but documented */
1002         int err;
1003
1004         if (!capable(CAP_NET_RAW))
1005                 return -EPERM;
1006         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
1007 #ifdef CONFIG_SOCK_PACKET
1008             && sock->type != SOCK_PACKET
1009 #endif
1010             )
1011                 return -ESOCKTNOSUPPORT;
1012
1013         sock->state = SS_UNCONNECTED;
1014
1015         err = -ENOBUFS;
1016         sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1017         if (sk == NULL)
1018                 goto out;
1019
1020         sock->ops = &packet_ops;
1021 #ifdef CONFIG_SOCK_PACKET
1022         if (sock->type == SOCK_PACKET)
1023                 sock->ops = &packet_ops_spkt;
1024 #endif
1025         sock_init_data(sock, sk);
1026
1027         po = pkt_sk(sk);
1028         sk->sk_family = PF_PACKET;
1029         po->num = proto;
1030
1031         sk->sk_destruct = packet_sock_destruct;
1032         atomic_inc(&packet_socks_nr);
1033
1034         /*
1035          *      Attach a protocol block
1036          */
1037
1038         spin_lock_init(&po->bind_lock);
1039         po->prot_hook.func = packet_rcv;
1040 #ifdef CONFIG_SOCK_PACKET
1041         if (sock->type == SOCK_PACKET)
1042                 po->prot_hook.func = packet_rcv_spkt;
1043 #endif
1044         po->prot_hook.af_packet_priv = sk;
1045
1046         if (proto) {
1047                 po->prot_hook.type = proto;
1048                 dev_add_pack(&po->prot_hook);
1049                 sock_hold(sk);
1050                 po->running = 1;
1051         }
1052
1053         write_lock_bh(&packet_sklist_lock);
1054         sk_add_node(sk, &packet_sklist);
1055         write_unlock_bh(&packet_sklist_lock);
1056         return(0);
1057 out:
1058         return err;
1059 }
1060
1061 /*
1062  *      Pull a packet from our receive queue and hand it to the user.
1063  *      If necessary we block.
1064  */
1065
1066 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1067                           struct msghdr *msg, size_t len, int flags)
1068 {
1069         struct sock *sk = sock->sk;
1070         struct sk_buff *skb;
1071         int copied, err;
1072         struct sockaddr_ll *sll;
1073
1074         err = -EINVAL;
1075         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1076                 goto out;
1077
1078 #if 0
1079         /* What error should we return now? EUNATTACH? */
1080         if (pkt_sk(sk)->ifindex < 0)
1081                 return -ENODEV;
1082 #endif
1083
1084         /*
1085          *      Call the generic datagram receiver. This handles all sorts
1086          *      of horrible races and re-entrancy so we can forget about it
1087          *      in the protocol layers.
1088          *
1089          *      Now it will return ENETDOWN, if device have just gone down,
1090          *      but then it will block.
1091          */
1092
1093         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1094
1095         /*
1096          *      An error occurred so return it. Because skb_recv_datagram()
1097          *      handles the blocking we don't see and worry about blocking
1098          *      retries.
1099          */
1100
1101         if (skb == NULL)
1102                 goto out;
1103
1104         /*
1105          *      If the address length field is there to be filled in, we fill
1106          *      it in now.
1107          */
1108
1109         sll = (struct sockaddr_ll*)skb->cb;
1110         if (sock->type == SOCK_PACKET)
1111                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1112         else
1113                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1114
1115         /*
1116          *      You lose any data beyond the buffer you gave. If it worries a
1117          *      user program they can ask the device for its MTU anyway.
1118          */
1119
1120         copied = skb->len;
1121         if (copied > len)
1122         {
1123                 copied=len;
1124                 msg->msg_flags|=MSG_TRUNC;
1125         }
1126
1127         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1128         if (err)
1129                 goto out_free;
1130
1131         sock_recv_timestamp(msg, sk, skb);
1132
1133         if (msg->msg_name)
1134                 memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
1135
1136         if (pkt_sk(sk)->auxdata) {
1137                 struct tpacket_auxdata *aux = PACKET_SKB_CB(skb);
1138                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(*aux), aux);
1139         }
1140
1141         /*
1142          *      Free or return the buffer as appropriate. Again this
1143          *      hides all the races and re-entrancy issues from us.
1144          */
1145         err = (flags&MSG_TRUNC) ? skb->len : copied;
1146
1147 out_free:
1148         skb_free_datagram(sk, skb);
1149 out:
1150         return err;
1151 }
1152
1153 #ifdef CONFIG_SOCK_PACKET
1154 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1155                                int *uaddr_len, int peer)
1156 {
1157         struct net_device *dev;
1158         struct sock *sk = sock->sk;
1159
1160         if (peer)
1161                 return -EOPNOTSUPP;
1162
1163         uaddr->sa_family = AF_PACKET;
1164         dev = dev_get_by_index(pkt_sk(sk)->ifindex);
1165         if (dev) {
1166                 strlcpy(uaddr->sa_data, dev->name, 15);
1167                 dev_put(dev);
1168         } else
1169                 memset(uaddr->sa_data, 0, 14);
1170         *uaddr_len = sizeof(*uaddr);
1171
1172         return 0;
1173 }
1174 #endif
1175
1176 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1177                           int *uaddr_len, int peer)
1178 {
1179         struct net_device *dev;
1180         struct sock *sk = sock->sk;
1181         struct packet_sock *po = pkt_sk(sk);
1182         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1183
1184         if (peer)
1185                 return -EOPNOTSUPP;
1186
1187         sll->sll_family = AF_PACKET;
1188         sll->sll_ifindex = po->ifindex;
1189         sll->sll_protocol = po->num;
1190         dev = dev_get_by_index(po->ifindex);
1191         if (dev) {
1192                 sll->sll_hatype = dev->type;
1193                 sll->sll_halen = dev->addr_len;
1194                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1195                 dev_put(dev);
1196         } else {
1197                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1198                 sll->sll_halen = 0;
1199         }
1200         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1201
1202         return 0;
1203 }
1204
1205 #ifdef CONFIG_PACKET_MULTICAST
1206 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1207 {
1208         switch (i->type) {
1209         case PACKET_MR_MULTICAST:
1210                 if (what > 0)
1211                         dev_mc_add(dev, i->addr, i->alen, 0);
1212                 else
1213                         dev_mc_delete(dev, i->addr, i->alen, 0);
1214                 break;
1215         case PACKET_MR_PROMISC:
1216                 dev_set_promiscuity(dev, what);
1217                 break;
1218         case PACKET_MR_ALLMULTI:
1219                 dev_set_allmulti(dev, what);
1220                 break;
1221         default:;
1222         }
1223 }
1224
1225 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1226 {
1227         for ( ; i; i=i->next) {
1228                 if (i->ifindex == dev->ifindex)
1229                         packet_dev_mc(dev, i, what);
1230         }
1231 }
1232
1233 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1234 {
1235         struct packet_sock *po = pkt_sk(sk);
1236         struct packet_mclist *ml, *i;
1237         struct net_device *dev;
1238         int err;
1239
1240         rtnl_lock();
1241
1242         err = -ENODEV;
1243         dev = __dev_get_by_index(mreq->mr_ifindex);
1244         if (!dev)
1245                 goto done;
1246
1247         err = -EINVAL;
1248         if (mreq->mr_alen > dev->addr_len)
1249                 goto done;
1250
1251         err = -ENOBUFS;
1252         i = kmalloc(sizeof(*i), GFP_KERNEL);
1253         if (i == NULL)
1254                 goto done;
1255
1256         err = 0;
1257         for (ml = po->mclist; ml; ml = ml->next) {
1258                 if (ml->ifindex == mreq->mr_ifindex &&
1259                     ml->type == mreq->mr_type &&
1260                     ml->alen == mreq->mr_alen &&
1261                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1262                         ml->count++;
1263                         /* Free the new element ... */
1264                         kfree(i);
1265                         goto done;
1266                 }
1267         }
1268
1269         i->type = mreq->mr_type;
1270         i->ifindex = mreq->mr_ifindex;
1271         i->alen = mreq->mr_alen;
1272         memcpy(i->addr, mreq->mr_address, i->alen);
1273         i->count = 1;
1274         i->next = po->mclist;
1275         po->mclist = i;
1276         packet_dev_mc(dev, i, +1);
1277
1278 done:
1279         rtnl_unlock();
1280         return err;
1281 }
1282
1283 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1284 {
1285         struct packet_mclist *ml, **mlp;
1286
1287         rtnl_lock();
1288
1289         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1290                 if (ml->ifindex == mreq->mr_ifindex &&
1291                     ml->type == mreq->mr_type &&
1292                     ml->alen == mreq->mr_alen &&
1293                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1294                         if (--ml->count == 0) {
1295                                 struct net_device *dev;
1296                                 *mlp = ml->next;
1297                                 dev = dev_get_by_index(ml->ifindex);
1298                                 if (dev) {
1299                                         packet_dev_mc(dev, ml, -1);
1300                                         dev_put(dev);
1301                                 }
1302                                 kfree(ml);
1303                         }
1304                         rtnl_unlock();
1305                         return 0;
1306                 }
1307         }
1308         rtnl_unlock();
1309         return -EADDRNOTAVAIL;
1310 }
1311
1312 static void packet_flush_mclist(struct sock *sk)
1313 {
1314         struct packet_sock *po = pkt_sk(sk);
1315         struct packet_mclist *ml;
1316
1317         if (!po->mclist)
1318                 return;
1319
1320         rtnl_lock();
1321         while ((ml = po->mclist) != NULL) {
1322                 struct net_device *dev;
1323
1324                 po->mclist = ml->next;
1325                 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) {
1326                         packet_dev_mc(dev, ml, -1);
1327                         dev_put(dev);
1328                 }
1329                 kfree(ml);
1330         }
1331         rtnl_unlock();
1332 }
1333 #endif
1334
1335 static int
1336 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1337 {
1338         struct sock *sk = sock->sk;
1339         struct packet_sock *po = pkt_sk(sk);
1340         int ret;
1341
1342         if (level != SOL_PACKET)
1343                 return -ENOPROTOOPT;
1344
1345         switch(optname) {
1346 #ifdef CONFIG_PACKET_MULTICAST
1347         case PACKET_ADD_MEMBERSHIP:
1348         case PACKET_DROP_MEMBERSHIP:
1349         {
1350                 struct packet_mreq_max mreq;
1351                 int len = optlen;
1352                 memset(&mreq, 0, sizeof(mreq));
1353                 if (len < sizeof(struct packet_mreq))
1354                         return -EINVAL;
1355                 if (len > sizeof(mreq))
1356                         len = sizeof(mreq);
1357                 if (copy_from_user(&mreq,optval,len))
1358                         return -EFAULT;
1359                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1360                         return -EINVAL;
1361                 if (optname == PACKET_ADD_MEMBERSHIP)
1362                         ret = packet_mc_add(sk, &mreq);
1363                 else
1364                         ret = packet_mc_drop(sk, &mreq);
1365                 return ret;
1366         }
1367 #endif
1368 #ifdef CONFIG_PACKET_MMAP
1369         case PACKET_RX_RING:
1370         {
1371                 struct tpacket_req req;
1372
1373                 if (optlen<sizeof(req))
1374                         return -EINVAL;
1375                 if (copy_from_user(&req,optval,sizeof(req)))
1376                         return -EFAULT;
1377                 return packet_set_ring(sk, &req, 0);
1378         }
1379         case PACKET_COPY_THRESH:
1380         {
1381                 int val;
1382
1383                 if (optlen!=sizeof(val))
1384                         return -EINVAL;
1385                 if (copy_from_user(&val,optval,sizeof(val)))
1386                         return -EFAULT;
1387
1388                 pkt_sk(sk)->copy_thresh = val;
1389                 return 0;
1390         }
1391 #endif
1392         case PACKET_AUXDATA:
1393         {
1394                 int val;
1395
1396                 if (optlen < sizeof(val))
1397                         return -EINVAL;
1398                 if (copy_from_user(&val, optval, sizeof(val)))
1399                         return -EFAULT;
1400
1401                 po->auxdata = !!val;
1402                 return 0;
1403         }
1404         default:
1405                 return -ENOPROTOOPT;
1406         }
1407 }
1408
1409 static int packet_getsockopt(struct socket *sock, int level, int optname,
1410                              char __user *optval, int __user *optlen)
1411 {
1412         int len;
1413         int val;
1414         struct sock *sk = sock->sk;
1415         struct packet_sock *po = pkt_sk(sk);
1416         void *data;
1417         struct tpacket_stats st;
1418
1419         if (level != SOL_PACKET)
1420                 return -ENOPROTOOPT;
1421
1422         if (get_user(len, optlen))
1423                 return -EFAULT;
1424
1425         if (len < 0)
1426                 return -EINVAL;
1427
1428         switch(optname) {
1429         case PACKET_STATISTICS:
1430                 if (len > sizeof(struct tpacket_stats))
1431                         len = sizeof(struct tpacket_stats);
1432                 spin_lock_bh(&sk->sk_receive_queue.lock);
1433                 st = po->stats;
1434                 memset(&po->stats, 0, sizeof(st));
1435                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1436                 st.tp_packets += st.tp_drops;
1437
1438                 data = &st;
1439                 break;
1440         case PACKET_AUXDATA:
1441                 if (len > sizeof(int))
1442                         len = sizeof(int);
1443                 val = po->auxdata;
1444
1445                 data = &val;
1446                 break;
1447         default:
1448                 return -ENOPROTOOPT;
1449         }
1450
1451         if (put_user(len, optlen))
1452                 return -EFAULT;
1453         if (copy_to_user(optval, data, len))
1454                 return -EFAULT;
1455         return 0;
1456 }
1457
1458
1459 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1460 {
1461         struct sock *sk;
1462         struct hlist_node *node;
1463         struct net_device *dev = (struct net_device*)data;
1464
1465         read_lock(&packet_sklist_lock);
1466         sk_for_each(sk, node, &packet_sklist) {
1467                 struct packet_sock *po = pkt_sk(sk);
1468
1469                 switch (msg) {
1470                 case NETDEV_UNREGISTER:
1471 #ifdef CONFIG_PACKET_MULTICAST
1472                         if (po->mclist)
1473                                 packet_dev_mclist(dev, po->mclist, -1);
1474                         // fallthrough
1475 #endif
1476                 case NETDEV_DOWN:
1477                         if (dev->ifindex == po->ifindex) {
1478                                 spin_lock(&po->bind_lock);
1479                                 if (po->running) {
1480                                         __dev_remove_pack(&po->prot_hook);
1481                                         __sock_put(sk);
1482                                         po->running = 0;
1483                                         sk->sk_err = ENETDOWN;
1484                                         if (!sock_flag(sk, SOCK_DEAD))
1485                                                 sk->sk_error_report(sk);
1486                                 }
1487                                 if (msg == NETDEV_UNREGISTER) {
1488                                         po->ifindex = -1;
1489                                         po->prot_hook.dev = NULL;
1490                                 }
1491                                 spin_unlock(&po->bind_lock);
1492                         }
1493                         break;
1494                 case NETDEV_UP:
1495                         spin_lock(&po->bind_lock);
1496                         if (dev->ifindex == po->ifindex && po->num &&
1497                             !po->running) {
1498                                 dev_add_pack(&po->prot_hook);
1499                                 sock_hold(sk);
1500                                 po->running = 1;
1501                         }
1502                         spin_unlock(&po->bind_lock);
1503                         break;
1504                 }
1505         }
1506         read_unlock(&packet_sklist_lock);
1507         return NOTIFY_DONE;
1508 }
1509
1510
1511 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1512                         unsigned long arg)
1513 {
1514         struct sock *sk = sock->sk;
1515
1516         switch(cmd) {
1517                 case SIOCOUTQ:
1518                 {
1519                         int amount = atomic_read(&sk->sk_wmem_alloc);
1520                         return put_user(amount, (int __user *)arg);
1521                 }
1522                 case SIOCINQ:
1523                 {
1524                         struct sk_buff *skb;
1525                         int amount = 0;
1526
1527                         spin_lock_bh(&sk->sk_receive_queue.lock);
1528                         skb = skb_peek(&sk->sk_receive_queue);
1529                         if (skb)
1530                                 amount = skb->len;
1531                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1532                         return put_user(amount, (int __user *)arg);
1533                 }
1534                 case SIOCGSTAMP:
1535                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1536
1537 #ifdef CONFIG_INET
1538                 case SIOCADDRT:
1539                 case SIOCDELRT:
1540                 case SIOCDARP:
1541                 case SIOCGARP:
1542                 case SIOCSARP:
1543                 case SIOCGIFADDR:
1544                 case SIOCSIFADDR:
1545                 case SIOCGIFBRDADDR:
1546                 case SIOCSIFBRDADDR:
1547                 case SIOCGIFNETMASK:
1548                 case SIOCSIFNETMASK:
1549                 case SIOCGIFDSTADDR:
1550                 case SIOCSIFDSTADDR:
1551                 case SIOCSIFFLAGS:
1552                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1553 #endif
1554
1555                 default:
1556                         return -ENOIOCTLCMD;
1557         }
1558         return 0;
1559 }
1560
1561 #ifndef CONFIG_PACKET_MMAP
1562 #define packet_mmap sock_no_mmap
1563 #define packet_poll datagram_poll
1564 #else
1565
1566 static unsigned int packet_poll(struct file * file, struct socket *sock,
1567                                 poll_table *wait)
1568 {
1569         struct sock *sk = sock->sk;
1570         struct packet_sock *po = pkt_sk(sk);
1571         unsigned int mask = datagram_poll(file, sock, wait);
1572
1573         spin_lock_bh(&sk->sk_receive_queue.lock);
1574         if (po->pg_vec) {
1575                 unsigned last = po->head ? po->head-1 : po->frame_max;
1576                 struct tpacket_hdr *h;
1577
1578                 h = (struct tpacket_hdr *)packet_lookup_frame(po, last);
1579
1580                 if (h->tp_status)
1581                         mask |= POLLIN | POLLRDNORM;
1582         }
1583         spin_unlock_bh(&sk->sk_receive_queue.lock);
1584         return mask;
1585 }
1586
1587
1588 /* Dirty? Well, I still did not learn better way to account
1589  * for user mmaps.
1590  */
1591
1592 static void packet_mm_open(struct vm_area_struct *vma)
1593 {
1594         struct file *file = vma->vm_file;
1595         struct socket * sock = file->private_data;
1596         struct sock *sk = sock->sk;
1597
1598         if (sk)
1599                 atomic_inc(&pkt_sk(sk)->mapped);
1600 }
1601
1602 static void packet_mm_close(struct vm_area_struct *vma)
1603 {
1604         struct file *file = vma->vm_file;
1605         struct socket * sock = file->private_data;
1606         struct sock *sk = sock->sk;
1607
1608         if (sk)
1609                 atomic_dec(&pkt_sk(sk)->mapped);
1610 }
1611
1612 static struct vm_operations_struct packet_mmap_ops = {
1613         .open = packet_mm_open,
1614         .close =packet_mm_close,
1615 };
1616
1617 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1618 {
1619         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1620 }
1621
1622 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1623 {
1624         int i;
1625
1626         for (i = 0; i < len; i++) {
1627                 if (likely(pg_vec[i]))
1628                         free_pages((unsigned long) pg_vec[i], order);
1629         }
1630         kfree(pg_vec);
1631 }
1632
1633 static inline char *alloc_one_pg_vec_page(unsigned long order)
1634 {
1635         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1636                                          order);
1637 }
1638
1639 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1640 {
1641         unsigned int block_nr = req->tp_block_nr;
1642         char **pg_vec;
1643         int i;
1644
1645         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1646         if (unlikely(!pg_vec))
1647                 goto out;
1648
1649         for (i = 0; i < block_nr; i++) {
1650                 pg_vec[i] = alloc_one_pg_vec_page(order);
1651                 if (unlikely(!pg_vec[i]))
1652                         goto out_free_pgvec;
1653         }
1654
1655 out:
1656         return pg_vec;
1657
1658 out_free_pgvec:
1659         free_pg_vec(pg_vec, order, block_nr);
1660         pg_vec = NULL;
1661         goto out;
1662 }
1663
1664 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1665 {
1666         char **pg_vec = NULL;
1667         struct packet_sock *po = pkt_sk(sk);
1668         int was_running, order = 0;
1669         __be16 num;
1670         int err = 0;
1671
1672         if (req->tp_block_nr) {
1673                 int i, l;
1674
1675                 /* Sanity tests and some calculations */
1676
1677                 if (unlikely(po->pg_vec))
1678                         return -EBUSY;
1679
1680                 if (unlikely((int)req->tp_block_size <= 0))
1681                         return -EINVAL;
1682                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1683                         return -EINVAL;
1684                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1685                         return -EINVAL;
1686                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1687                         return -EINVAL;
1688
1689                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1690                 if (unlikely(po->frames_per_block <= 0))
1691                         return -EINVAL;
1692                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1693                              req->tp_frame_nr))
1694                         return -EINVAL;
1695
1696                 err = -ENOMEM;
1697                 order = get_order(req->tp_block_size);
1698                 pg_vec = alloc_pg_vec(req, order);
1699                 if (unlikely(!pg_vec))
1700                         goto out;
1701
1702                 l = 0;
1703                 for (i = 0; i < req->tp_block_nr; i++) {
1704                         char *ptr = pg_vec[i];
1705                         struct tpacket_hdr *header;
1706                         int k;
1707
1708                         for (k = 0; k < po->frames_per_block; k++) {
1709                                 header = (struct tpacket_hdr *) ptr;
1710                                 header->tp_status = TP_STATUS_KERNEL;
1711                                 ptr += req->tp_frame_size;
1712                         }
1713                 }
1714                 /* Done */
1715         } else {
1716                 if (unlikely(req->tp_frame_nr))
1717                         return -EINVAL;
1718         }
1719
1720         lock_sock(sk);
1721
1722         /* Detach socket from network */
1723         spin_lock(&po->bind_lock);
1724         was_running = po->running;
1725         num = po->num;
1726         if (was_running) {
1727                 __dev_remove_pack(&po->prot_hook);
1728                 po->num = 0;
1729                 po->running = 0;
1730                 __sock_put(sk);
1731         }
1732         spin_unlock(&po->bind_lock);
1733
1734         synchronize_net();
1735
1736         err = -EBUSY;
1737         if (closing || atomic_read(&po->mapped) == 0) {
1738                 err = 0;
1739 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1740
1741                 spin_lock_bh(&sk->sk_receive_queue.lock);
1742                 pg_vec = XC(po->pg_vec, pg_vec);
1743                 po->frame_max = (req->tp_frame_nr - 1);
1744                 po->head = 0;
1745                 po->frame_size = req->tp_frame_size;
1746                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1747
1748                 order = XC(po->pg_vec_order, order);
1749                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1750
1751                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1752                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1753                 skb_queue_purge(&sk->sk_receive_queue);
1754 #undef XC
1755                 if (atomic_read(&po->mapped))
1756                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1757         }
1758
1759         spin_lock(&po->bind_lock);
1760         if (was_running && !po->running) {
1761                 sock_hold(sk);
1762                 po->running = 1;
1763                 po->num = num;
1764                 dev_add_pack(&po->prot_hook);
1765         }
1766         spin_unlock(&po->bind_lock);
1767
1768         release_sock(sk);
1769
1770         if (pg_vec)
1771                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1772 out:
1773         return err;
1774 }
1775
1776 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1777 {
1778         struct sock *sk = sock->sk;
1779         struct packet_sock *po = pkt_sk(sk);
1780         unsigned long size;
1781         unsigned long start;
1782         int err = -EINVAL;
1783         int i;
1784
1785         if (vma->vm_pgoff)
1786                 return -EINVAL;
1787
1788         size = vma->vm_end - vma->vm_start;
1789
1790         lock_sock(sk);
1791         if (po->pg_vec == NULL)
1792                 goto out;
1793         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1794                 goto out;
1795
1796         start = vma->vm_start;
1797         for (i = 0; i < po->pg_vec_len; i++) {
1798                 struct page *page = virt_to_page(po->pg_vec[i]);
1799                 int pg_num;
1800
1801                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1802                         err = vm_insert_page(vma, start, page);
1803                         if (unlikely(err))
1804                                 goto out;
1805                         start += PAGE_SIZE;
1806                 }
1807         }
1808         atomic_inc(&po->mapped);
1809         vma->vm_ops = &packet_mmap_ops;
1810         err = 0;
1811
1812 out:
1813         release_sock(sk);
1814         return err;
1815 }
1816 #endif
1817
1818
1819 #ifdef CONFIG_SOCK_PACKET
1820 static const struct proto_ops packet_ops_spkt = {
1821         .family =       PF_PACKET,
1822         .owner =        THIS_MODULE,
1823         .release =      packet_release,
1824         .bind =         packet_bind_spkt,
1825         .connect =      sock_no_connect,
1826         .socketpair =   sock_no_socketpair,
1827         .accept =       sock_no_accept,
1828         .getname =      packet_getname_spkt,
1829         .poll =         datagram_poll,
1830         .ioctl =        packet_ioctl,
1831         .listen =       sock_no_listen,
1832         .shutdown =     sock_no_shutdown,
1833         .setsockopt =   sock_no_setsockopt,
1834         .getsockopt =   sock_no_getsockopt,
1835         .sendmsg =      packet_sendmsg_spkt,
1836         .recvmsg =      packet_recvmsg,
1837         .mmap =         sock_no_mmap,
1838         .sendpage =     sock_no_sendpage,
1839 };
1840 #endif
1841
1842 static const struct proto_ops packet_ops = {
1843         .family =       PF_PACKET,
1844         .owner =        THIS_MODULE,
1845         .release =      packet_release,
1846         .bind =         packet_bind,
1847         .connect =      sock_no_connect,
1848         .socketpair =   sock_no_socketpair,
1849         .accept =       sock_no_accept,
1850         .getname =      packet_getname,
1851         .poll =         packet_poll,
1852         .ioctl =        packet_ioctl,
1853         .listen =       sock_no_listen,
1854         .shutdown =     sock_no_shutdown,
1855         .setsockopt =   packet_setsockopt,
1856         .getsockopt =   packet_getsockopt,
1857         .sendmsg =      packet_sendmsg,
1858         .recvmsg =      packet_recvmsg,
1859         .mmap =         packet_mmap,
1860         .sendpage =     sock_no_sendpage,
1861 };
1862
1863 static struct net_proto_family packet_family_ops = {
1864         .family =       PF_PACKET,
1865         .create =       packet_create,
1866         .owner  =       THIS_MODULE,
1867 };
1868
1869 static struct notifier_block packet_netdev_notifier = {
1870         .notifier_call =packet_notifier,
1871 };
1872
1873 #ifdef CONFIG_PROC_FS
1874 static inline struct sock *packet_seq_idx(loff_t off)
1875 {
1876         struct sock *s;
1877         struct hlist_node *node;
1878
1879         sk_for_each(s, node, &packet_sklist) {
1880                 if (!off--)
1881                         return s;
1882         }
1883         return NULL;
1884 }
1885
1886 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1887 {
1888         read_lock(&packet_sklist_lock);
1889         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1890 }
1891
1892 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1893 {
1894         ++*pos;
1895         return  (v == SEQ_START_TOKEN)
1896                 ? sk_head(&packet_sklist)
1897                 : sk_next((struct sock*)v) ;
1898 }
1899
1900 static void packet_seq_stop(struct seq_file *seq, void *v)
1901 {
1902         read_unlock(&packet_sklist_lock);
1903 }
1904
1905 static int packet_seq_show(struct seq_file *seq, void *v)
1906 {
1907         if (v == SEQ_START_TOKEN)
1908                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1909         else {
1910                 struct sock *s = v;
1911                 const struct packet_sock *po = pkt_sk(s);
1912
1913                 seq_printf(seq,
1914                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1915                            s,
1916                            atomic_read(&s->sk_refcnt),
1917                            s->sk_type,
1918                            ntohs(po->num),
1919                            po->ifindex,
1920                            po->running,
1921                            atomic_read(&s->sk_rmem_alloc),
1922                            sock_i_uid(s),
1923                            sock_i_ino(s) );
1924         }
1925
1926         return 0;
1927 }
1928
1929 static struct seq_operations packet_seq_ops = {
1930         .start  = packet_seq_start,
1931         .next   = packet_seq_next,
1932         .stop   = packet_seq_stop,
1933         .show   = packet_seq_show,
1934 };
1935
1936 static int packet_seq_open(struct inode *inode, struct file *file)
1937 {
1938         return seq_open(file, &packet_seq_ops);
1939 }
1940
1941 static struct file_operations packet_seq_fops = {
1942         .owner          = THIS_MODULE,
1943         .open           = packet_seq_open,
1944         .read           = seq_read,
1945         .llseek         = seq_lseek,
1946         .release        = seq_release,
1947 };
1948
1949 #endif
1950
1951 static void __exit packet_exit(void)
1952 {
1953         proc_net_remove("packet");
1954         unregister_netdevice_notifier(&packet_netdev_notifier);
1955         sock_unregister(PF_PACKET);
1956         proto_unregister(&packet_proto);
1957 }
1958
1959 static int __init packet_init(void)
1960 {
1961         int rc = proto_register(&packet_proto, 0);
1962
1963         if (rc != 0)
1964                 goto out;
1965
1966         sock_register(&packet_family_ops);
1967         register_netdevice_notifier(&packet_netdev_notifier);
1968         proc_net_fops_create("packet", 0, &packet_seq_fops);
1969 out:
1970         return rc;
1971 }
1972
1973 module_init(packet_init);
1974 module_exit(packet_exit);
1975 MODULE_LICENSE("GPL");
1976 MODULE_ALIAS_NETPROTO(PF_PACKET);