SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/mm.h>
  54 #include <linux/capability.h>
  55 #include <linux/fcntl.h>
  56 #include <linux/socket.h>
  57 #include <linux/in.h>
  58 #include <linux/inet.h>
  59 #include <linux/netdevice.h>
  60 #include <linux/if_packet.h>
  61 #include <linux/wireless.h>
  62 #include <linux/kernel.h>
  63 #include <linux/kmod.h>
  64 #include <net/ip.h>
  65 #include <net/protocol.h>
  66 #include <linux/skbuff.h>
  67 #include <net/sock.h>
  68 #include <linux/errno.h>
  69 #include <linux/timer.h>
  70 #include <asm/system.h>
  71 #include <asm/uaccess.h>
  72 #include <asm/ioctls.h>
  73 #include <asm/page.h>
  74 #include <asm/cacheflush.h>
  75 #include <asm/io.h>
  76 #include <linux/proc_fs.h>
  77 #include <linux/seq_file.h>
  78 #include <linux/poll.h>
  79 #include <linux/module.h>
  80 #include <linux/init.h>
  81
  82 #ifdef CONFIG_INET
  83 #include <net/inet_common.h>
  84 #endif
  85
  86 #define CONFIG_SOCK_PACKET      1
  87
  88 /*
  89    Proposed replacement for SIOC{ADD,DEL}MULTI and
  90    IFF_PROMISC, IFF_ALLMULTI flags.
  91
  92    It is more expensive, but I believe,
  93    it is really correct solution: reentereble, safe and fault tolerant.
  94
  95    IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping
  96    reference count and global flag, so that real status is
  97    (gflag|(count != 0)), so that we can use obsolete faulty interface
  98    not harming clever users.
  99  */
 100 #define CONFIG_PACKET_MULTICAST 1
 101
 102 /*
 103    Assumptions:
 104    - if device has no dev->hard_header routine, it adds and removes ll header
 105      inside itself. In this case ll header is invisible outside of device,
 106      but higher levels still should reserve dev->hard_header_len.
 107      Some devices are enough clever to reallocate skb, when header
 108      will not fit to reserved space (tunnel), another ones are silly
 109      (PPP).
 110    - packet socket receives packets with pulled ll header,
 111      so that SOCK_RAW should push it back.
 112
 113 On receive:
 114 -----------
 115
 116 Incoming, dev->hard_header!=NULL
 117    mac.raw -> ll header
 118    data    -> data
 119
 120 Outgoing, dev->hard_header!=NULL
 121    mac.raw -> ll header
 122    data    -> ll header
 123
 124 Incoming, dev->hard_header==NULL
 125    mac.raw -> UNKNOWN position. It is very likely, that it points to ll header.
 126               PPP makes it, that is wrong, because introduce assymetry
 127               between rx and tx paths.
 128    data    -> data
 129
 130 Outgoing, dev->hard_header==NULL
 131    mac.raw -> data. ll header is still not built!
 132    data    -> data
 133
 134 Resume
 135   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 136
 137
 138 On transmit:
 139 ------------
 140
 141 dev->hard_header != NULL
 142    mac.raw -> ll header
 143    data    -> ll header
 144
 145 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 146    mac.raw -> data
 147    data -> data
 148
 149    We should set nh.raw on output to correct posistion,
 150    packet classifier depends on it.
 151  */
 152
 153 /* List of all packet sockets. */
 154 static HLIST_HEAD(packet_sklist);
 155 static DEFINE_RWLOCK(packet_sklist_lock);
 156
 157 static atomic_t packet_socks_nr;
 158
 159
 160 /* Private packet socket structures. */
 161
 162 #ifdef CONFIG_PACKET_MULTICAST
 163 struct packet_mclist
 164 {
 165         struct packet_mclist    *next;
 166         int                     ifindex;
 167         int                     count;
 168         unsigned short          type;
 169         unsigned short          alen;
 170         unsigned char           addr[MAX_ADDR_LEN];
 171 };
 172 /* identical to struct packet_mreq except it has
 173  * a longer address field.
 174  */
 175 struct packet_mreq_max
 176 {
 177         int             mr_ifindex;
 178         unsigned short  mr_type;
 179         unsigned short  mr_alen;
 180         unsigned char   mr_address[MAX_ADDR_LEN];
 181 };
 182 #endif
 183 #ifdef CONFIG_PACKET_MMAP
 184 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 185 #endif
 186
 187 static void packet_flush_mclist(struct sock *sk);
 188
 189 struct packet_sock {
 190         /* struct sock has to be the first member of packet_sock */
 191         struct sock             sk;
 192         struct tpacket_stats    stats;
 193 #ifdef CONFIG_PACKET_MMAP
 194         char *                  *pg_vec;
 195         unsigned int            head;
 196         unsigned int            frames_per_block;
 197         unsigned int            frame_size;
 198         unsigned int            frame_max;
 199         int                     copy_thresh;
 200 #endif
 201         struct packet_type      prot_hook;
 202         spinlock_t              bind_lock;
 203         unsigned int            running:1,      /* prot_hook is attached*/
 204                                 auxdata:1;
 205         int                     ifindex;        /* bound device         */
 206         __be16                  num;
 207 #ifdef CONFIG_PACKET_MULTICAST
 208         struct packet_mclist    *mclist;
 209 #endif
 210 #ifdef CONFIG_PACKET_MMAP
 211         atomic_t                mapped;
 212         unsigned int            pg_vec_order;
 213         unsigned int            pg_vec_pages;
 214         unsigned int            pg_vec_len;
 215 #endif
 216 };
 217
 218 struct packet_skb_cb {
 219         unsigned int origlen;
 220         union {
 221                 struct sockaddr_pkt pkt;
 222                 struct sockaddr_ll ll;
 223         } sa;
 224 };
 225
 226 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 227
 228 #ifdef CONFIG_PACKET_MMAP
 229
 230 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 231 {
 232         unsigned int pg_vec_pos, frame_offset;
 233
 234         pg_vec_pos = position / po->frames_per_block;
 235         frame_offset = position % po->frames_per_block;
 236
 237         return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
 238 }
 239 #endif
 240
 241 static inline struct packet_sock *pkt_sk(struct sock *sk)
 242 {
 243         return (struct packet_sock *)sk;
 244 }
 245
 246 static void packet_sock_destruct(struct sock *sk)
 247 {
 248         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 249         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 250
 251         if (!sock_flag(sk, SOCK_DEAD)) {
 252                 printk("Attempt to release alive packet socket: %p\n", sk);
 253                 return;
 254         }
 255
 256         atomic_dec(&packet_socks_nr);
 257 #ifdef PACKET_REFCNT_DEBUG
 258         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 259 #endif
 260 }
 261
 262
 263 static const struct proto_ops packet_ops;
 264
 265 #ifdef CONFIG_SOCK_PACKET
 266 static const struct proto_ops packet_ops_spkt;
 267
 268 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 269 {
 270         struct sock *sk;
 271         struct sockaddr_pkt *spkt;
 272
 273         /*
 274          *      When we registered the protocol we saved the socket in the data
 275          *      field for just this event.
 276          */
 277
 278         sk = pt->af_packet_priv;
 279
 280         /*
 281          *      Yank back the headers [hope the device set this
 282          *      right or kerboom...]
 283          *
 284          *      Incoming packets have ll header pulled,
 285          *      push it back.
 286          *
 287          *      For outgoing ones skb->data == skb->mac.raw
 288          *      so that this procedure is noop.
 289          */
 290
 291         if (skb->pkt_type == PACKET_LOOPBACK)
 292                 goto out;
 293
 294         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 295                 goto oom;
 296
 297         /* drop any routing info */
 298         dst_release(skb->dst);
 299         skb->dst = NULL;
 300
 301         /* drop conntrack reference */
 302         nf_reset(skb);
 303
 304         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 305
 306         skb_push(skb, skb->data-skb->mac.raw);
 307
 308         /*
 309          *      The SOCK_PACKET socket receives _all_ frames.
 310          */
 311
 312         spkt->spkt_family = dev->type;
 313         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 314         spkt->spkt_protocol = skb->protocol;
 315
 316         /*
 317          *      Charge the memory to the socket. This is done specifically
 318          *      to prevent sockets using all the memory up.
 319          */
 320
 321         if (sock_queue_rcv_skb(sk,skb) == 0)
 322                 return 0;
 323
 324 out:
 325         kfree_skb(skb);
 326 oom:
 327         return 0;
 328 }
 329
 330
 331 /*
 332  *      Output a raw packet to a device layer. This bypasses all the other
 333  *      protocol layers and you must therefore supply it with a complete frame
 334  */
 335
 336 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 337                                struct msghdr *msg, size_t len)
 338 {
 339         struct sock *sk = sock->sk;
 340         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 341         struct sk_buff *skb;
 342         struct net_device *dev;
 343         __be16 proto=0;
 344         int err;
 345
 346         /*
 347          *      Get and verify the address.
 348          */
 349
 350         if (saddr)
 351         {
 352                 if (msg->msg_namelen < sizeof(struct sockaddr))
 353                         return(-EINVAL);
 354                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 355                         proto=saddr->spkt_protocol;
 356         }
 357         else
 358                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 359
 360         /*
 361          *      Find the device first to size check it
 362          */
 363
 364         saddr->spkt_device[13] = 0;
 365         dev = dev_get_by_name(saddr->spkt_device);
 366         err = -ENODEV;
 367         if (dev == NULL)
 368                 goto out_unlock;
 369
 370         err = -ENETDOWN;
 371         if (!(dev->flags & IFF_UP))
 372                 goto out_unlock;
 373
 374         /*
 375          *      You may not queue a frame bigger than the mtu. This is the lowest level
 376          *      raw protocol and you must do your own fragmentation at this level.
 377          */
 378
 379         err = -EMSGSIZE;
 380         if (len > dev->mtu + dev->hard_header_len)
 381                 goto out_unlock;
 382
 383         err = -ENOBUFS;
 384         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 385
 386         /*
 387          *      If the write buffer is full, then tough. At this level the user gets to
 388          *      deal with the problem - do your own algorithmic backoffs. That's far
 389          *      more flexible.
 390          */
 391
 392         if (skb == NULL)
 393                 goto out_unlock;
 394
 395         /*
 396          *      Fill it in
 397          */
 398
 399         /* FIXME: Save some space for broken drivers that write a
 400          * hard header at transmission time by themselves. PPP is the
 401          * notable one here. This should really be fixed at the driver level.
 402          */
 403         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 404         skb->nh.raw = skb->data;
 405
 406         /* Try to align data part correctly */
 407         if (dev->hard_header) {
 408                 skb->data -= dev->hard_header_len;
 409                 skb->tail -= dev->hard_header_len;
 410                 if (len < dev->hard_header_len)
 411                         skb->nh.raw = skb->data;
 412         }
 413
 414         /* Returns -EFAULT on error */
 415         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 416         skb->protocol = proto;
 417         skb->dev = dev;
 418         skb->priority = sk->sk_priority;
 419         if (err)
 420                 goto out_free;
 421
 422         /*
 423          *      Now send it
 424          */
 425
 426         dev_queue_xmit(skb);
 427         dev_put(dev);
 428         return(len);
 429
 430 out_free:
 431         kfree_skb(skb);
 432 out_unlock:
 433         if (dev)
 434                 dev_put(dev);
 435         return err;
 436 }
 437 #endif
 438
 439 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 440                                       unsigned int res)
 441 {
 442         struct sk_filter *filter;
 443
 444         rcu_read_lock_bh();
 445         filter = rcu_dereference(sk->sk_filter);
 446         if (filter != NULL)
 447                 res = sk_run_filter(skb, filter->insns, filter->len);
 448         rcu_read_unlock_bh();
 449
 450         return res;
 451 }
 452
 453 /*
 454    This function makes lazy skb cloning in hope that most of packets
 455    are discarded by BPF.
 456
 457    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 458    and skb->cb are mangled. It works because (and until) packets
 459    falling here are owned by current CPU. Output packets are cloned
 460    by dev_queue_xmit_nit(), input packets are processed by net_bh
 461    sequencially, so that if we return skb to original state on exit,
 462    we will not harm anyone.
 463  */
 464
 465 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 466 {
 467         struct sock *sk;
 468         struct sockaddr_ll *sll;
 469         struct packet_sock *po;
 470         u8 * skb_head = skb->data;
 471         int skb_len = skb->len;
 472         unsigned int snaplen, res;
 473
 474         if (skb->pkt_type == PACKET_LOOPBACK)
 475                 goto drop;
 476
 477         sk = pt->af_packet_priv;
 478         po = pkt_sk(sk);
 479
 480         skb->dev = dev;
 481
 482         if (dev->hard_header) {
 483                 /* The device has an explicit notion of ll header,
 484                    exported to higher levels.
 485
 486                    Otherwise, the device hides datails of it frame
 487                    structure, so that corresponding packet head
 488                    never delivered to user.
 489                  */
 490                 if (sk->sk_type != SOCK_DGRAM)
 491                         skb_push(skb, skb->data - skb->mac.raw);
 492                 else if (skb->pkt_type == PACKET_OUTGOING) {
 493                         /* Special case: outgoing packets have ll header at head */
 494                         skb_pull(skb, skb->nh.raw - skb->data);
 495                 }
 496         }
 497
 498         snaplen = skb->len;
 499
 500         res = run_filter(skb, sk, snaplen);
 501         if (!res)
 502                 goto drop_n_restore;
 503         if (snaplen > res)
 504                 snaplen = res;
 505
 506         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 507             (unsigned)sk->sk_rcvbuf)
 508                 goto drop_n_acct;
 509
 510         if (skb_shared(skb)) {
 511                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 512                 if (nskb == NULL)
 513                         goto drop_n_acct;
 514
 515                 if (skb_head != skb->data) {
 516                         skb->data = skb_head;
 517                         skb->len = skb_len;
 518                 }
 519                 kfree_skb(skb);
 520                 skb = nskb;
 521         }
 522
 523         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 524                      sizeof(skb->cb));
 525
 526         sll = &PACKET_SKB_CB(skb)->sa.ll;
 527         sll->sll_family = AF_PACKET;
 528         sll->sll_hatype = dev->type;
 529         sll->sll_protocol = skb->protocol;
 530         sll->sll_pkttype = skb->pkt_type;
 531         sll->sll_ifindex = dev->ifindex;
 532         sll->sll_halen = 0;
 533
 534         if (dev->hard_header_parse)
 535                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 536
 537         PACKET_SKB_CB(skb)->origlen = skb->len;
 538
 539         if (pskb_trim(skb, snaplen))
 540                 goto drop_n_acct;
 541
 542         skb_set_owner_r(skb, sk);
 543         skb->dev = NULL;
 544         dst_release(skb->dst);
 545         skb->dst = NULL;
 546
 547         /* drop conntrack reference */
 548         nf_reset(skb);
 549
 550         spin_lock(&sk->sk_receive_queue.lock);
 551         po->stats.tp_packets++;
 552         __skb_queue_tail(&sk->sk_receive_queue, skb);
 553         spin_unlock(&sk->sk_receive_queue.lock);
 554         sk->sk_data_ready(sk, skb->len);
 555         return 0;
 556
 557 drop_n_acct:
 558         spin_lock(&sk->sk_receive_queue.lock);
 559         po->stats.tp_drops++;
 560         spin_unlock(&sk->sk_receive_queue.lock);
 561
 562 drop_n_restore:
 563         if (skb_head != skb->data && skb_shared(skb)) {
 564                 skb->data = skb_head;
 565                 skb->len = skb_len;
 566         }
 567 drop:
 568         kfree_skb(skb);
 569         return 0;
 570 }
 571
 572 #ifdef CONFIG_PACKET_MMAP
 573 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 574 {
 575         struct sock *sk;
 576         struct packet_sock *po;
 577         struct sockaddr_ll *sll;
 578         struct tpacket_hdr *h;
 579         u8 * skb_head = skb->data;
 580         int skb_len = skb->len;
 581         unsigned int snaplen, res;
 582         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 583         unsigned short macoff, netoff;
 584         struct sk_buff *copy_skb = NULL;
 585
 586         if (skb->pkt_type == PACKET_LOOPBACK)
 587                 goto drop;
 588
 589         sk = pt->af_packet_priv;
 590         po = pkt_sk(sk);
 591
 592         if (dev->hard_header) {
 593                 if (sk->sk_type != SOCK_DGRAM)
 594                         skb_push(skb, skb->data - skb->mac.raw);
 595                 else if (skb->pkt_type == PACKET_OUTGOING) {
 596                         /* Special case: outgoing packets have ll header at head */
 597                         skb_pull(skb, skb->nh.raw - skb->data);
 598                 }
 599         }
 600
 601         if (skb->ip_summed == CHECKSUM_PARTIAL)
 602                 status |= TP_STATUS_CSUMNOTREADY;
 603
 604         snaplen = skb->len;
 605
 606         res = run_filter(skb, sk, snaplen);
 607         if (!res)
 608                 goto drop_n_restore;
 609         if (snaplen > res)
 610                 snaplen = res;
 611
 612         if (sk->sk_type == SOCK_DGRAM) {
 613                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 614         } else {
 615                 unsigned maclen = skb->nh.raw - skb->data;
 616                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 617                 macoff = netoff - maclen;
 618         }
 619
 620         if (macoff + snaplen > po->frame_size) {
 621                 if (po->copy_thresh &&
 622                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 623                     (unsigned)sk->sk_rcvbuf) {
 624                         if (skb_shared(skb)) {
 625                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 626                         } else {
 627                                 copy_skb = skb_get(skb);
 628                                 skb_head = skb->data;
 629                         }
 630                         if (copy_skb)
 631                                 skb_set_owner_r(copy_skb, sk);
 632                 }
 633                 snaplen = po->frame_size - macoff;
 634                 if ((int)snaplen < 0)
 635                         snaplen = 0;
 636         }
 637
 638         spin_lock(&sk->sk_receive_queue.lock);
 639         h = packet_lookup_frame(po, po->head);
 640
 641         if (h->tp_status)
 642                 goto ring_is_full;
 643         po->head = po->head != po->frame_max ? po->head+1 : 0;
 644         po->stats.tp_packets++;
 645         if (copy_skb) {
 646                 status |= TP_STATUS_COPY;
 647                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 648         }
 649         if (!po->stats.tp_drops)
 650                 status &= ~TP_STATUS_LOSING;
 651         spin_unlock(&sk->sk_receive_queue.lock);
 652
 653         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 654
 655         h->tp_len = skb->len;
 656         h->tp_snaplen = snaplen;
 657         h->tp_mac = macoff;
 658         h->tp_net = netoff;
 659         if (skb->tstamp.off_sec == 0) {
 660                 __net_timestamp(skb);
 661                 sock_enable_timestamp(sk);
 662         }
 663         h->tp_sec = skb->tstamp.off_sec;
 664         h->tp_usec = skb->tstamp.off_usec;
 665
 666         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 667         sll->sll_halen = 0;
 668         if (dev->hard_header_parse)
 669                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 670         sll->sll_family = AF_PACKET;
 671         sll->sll_hatype = dev->type;
 672         sll->sll_protocol = skb->protocol;
 673         sll->sll_pkttype = skb->pkt_type;
 674         sll->sll_ifindex = dev->ifindex;
 675
 676         h->tp_status = status;
 677         smp_mb();
 678
 679         {
 680                 struct page *p_start, *p_end;
 681                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 682
 683                 p_start = virt_to_page(h);
 684                 p_end = virt_to_page(h_end);
 685                 while (p_start <= p_end) {
 686                         flush_dcache_page(p_start);
 687                         p_start++;
 688                 }
 689         }
 690
 691         sk->sk_data_ready(sk, 0);
 692
 693 drop_n_restore:
 694         if (skb_head != skb->data && skb_shared(skb)) {
 695                 skb->data = skb_head;
 696                 skb->len = skb_len;
 697         }
 698 drop:
 699         kfree_skb(skb);
 700         return 0;
 701
 702 ring_is_full:
 703         po->stats.tp_drops++;
 704         spin_unlock(&sk->sk_receive_queue.lock);
 705
 706         sk->sk_data_ready(sk, 0);
 707         if (copy_skb)
 708                 kfree_skb(copy_skb);
 709         goto drop_n_restore;
 710 }
 711
 712 #endif
 713
 714
 715 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 716                           struct msghdr *msg, size_t len)
 717 {
 718         struct sock *sk = sock->sk;
 719         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 720         struct sk_buff *skb;
 721         struct net_device *dev;
 722         __be16 proto;
 723         unsigned char *addr;
 724         int ifindex, err, reserve = 0;
 725
 726         /*
 727          *      Get and verify the address.
 728          */
 729
 730         if (saddr == NULL) {
 731                 struct packet_sock *po = pkt_sk(sk);
 732
 733                 ifindex = po->ifindex;
 734                 proto   = po->num;
 735                 addr    = NULL;
 736         } else {
 737                 err = -EINVAL;
 738                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 739                         goto out;
 740                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 741                         goto out;
 742                 ifindex = saddr->sll_ifindex;
 743                 proto   = saddr->sll_protocol;
 744                 addr    = saddr->sll_addr;
 745         }
 746
 747
 748         dev = dev_get_by_index(ifindex);
 749         err = -ENXIO;
 750         if (dev == NULL)
 751                 goto out_unlock;
 752         if (sock->type == SOCK_RAW)
 753                 reserve = dev->hard_header_len;
 754
 755         err = -ENETDOWN;
 756         if (!(dev->flags & IFF_UP))
 757                 goto out_unlock;
 758
 759         err = -EMSGSIZE;
 760         if (len > dev->mtu+reserve)
 761                 goto out_unlock;
 762
 763         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 764                                 msg->msg_flags & MSG_DONTWAIT, &err);
 765         if (skb==NULL)
 766                 goto out_unlock;
 767
 768         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 769         skb->nh.raw = skb->data;
 770
 771         if (dev->hard_header) {
 772                 int res;
 773                 err = -EINVAL;
 774                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 775                 if (sock->type != SOCK_DGRAM) {
 776                         skb->tail = skb->data;
 777                         skb->len = 0;
 778                 } else if (res < 0)
 779                         goto out_free;
 780         }
 781
 782         /* Returns -EFAULT on error */
 783         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 784         if (err)
 785                 goto out_free;
 786
 787         skb->protocol = proto;
 788         skb->dev = dev;
 789         skb->priority = sk->sk_priority;
 790
 791         /*
 792          *      Now send it
 793          */
 794
 795         err = dev_queue_xmit(skb);
 796         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 797                 goto out_unlock;
 798
 799         dev_put(dev);
 800
 801         return(len);
 802
 803 out_free:
 804         kfree_skb(skb);
 805 out_unlock:
 806         if (dev)
 807                 dev_put(dev);
 808 out:
 809         return err;
 810 }
 811
 812 /*
 813  *      Close a PACKET socket. This is fairly simple. We immediately go
 814  *      to 'closed' state and remove our protocol entry in the device list.
 815  */
 816
 817 static int packet_release(struct socket *sock)
 818 {
 819         struct sock *sk = sock->sk;
 820         struct packet_sock *po;
 821
 822         if (!sk)
 823                 return 0;
 824
 825         po = pkt_sk(sk);
 826
 827         write_lock_bh(&packet_sklist_lock);
 828         sk_del_node_init(sk);
 829         write_unlock_bh(&packet_sklist_lock);
 830
 831         /*
 832          *      Unhook packet receive handler.
 833          */
 834
 835         if (po->running) {
 836                 /*
 837                  *      Remove the protocol hook
 838                  */
 839                 dev_remove_pack(&po->prot_hook);
 840                 po->running = 0;
 841                 po->num = 0;
 842                 __sock_put(sk);
 843         }
 844
 845 #ifdef CONFIG_PACKET_MULTICAST
 846         packet_flush_mclist(sk);
 847 #endif
 848
 849 #ifdef CONFIG_PACKET_MMAP
 850         if (po->pg_vec) {
 851                 struct tpacket_req req;
 852                 memset(&req, 0, sizeof(req));
 853                 packet_set_ring(sk, &req, 1);
 854         }
 855 #endif
 856
 857         /*
 858          *      Now the socket is dead. No more input will appear.
 859          */
 860
 861         sock_orphan(sk);
 862         sock->sk = NULL;
 863
 864         /* Purge queues */
 865
 866         skb_queue_purge(&sk->sk_receive_queue);
 867
 868         sock_put(sk);
 869         return 0;
 870 }
 871
 872 /*
 873  *      Attach a packet hook.
 874  */
 875
 876 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 877 {
 878         struct packet_sock *po = pkt_sk(sk);
 879         /*
 880          *      Detach an existing hook if present.
 881          */
 882
 883         lock_sock(sk);
 884
 885         spin_lock(&po->bind_lock);
 886         if (po->running) {
 887                 __sock_put(sk);
 888                 po->running = 0;
 889                 po->num = 0;
 890                 spin_unlock(&po->bind_lock);
 891                 dev_remove_pack(&po->prot_hook);
 892                 spin_lock(&po->bind_lock);
 893         }
 894
 895         po->num = protocol;
 896         po->prot_hook.type = protocol;
 897         po->prot_hook.dev = dev;
 898
 899         po->ifindex = dev ? dev->ifindex : 0;
 900
 901         if (protocol == 0)
 902                 goto out_unlock;
 903
 904         if (dev) {
 905                 if (dev->flags&IFF_UP) {
 906                         dev_add_pack(&po->prot_hook);
 907                         sock_hold(sk);
 908                         po->running = 1;
 909                 } else {
 910                         sk->sk_err = ENETDOWN;
 911                         if (!sock_flag(sk, SOCK_DEAD))
 912                                 sk->sk_error_report(sk);
 913                 }
 914         } else {
 915                 dev_add_pack(&po->prot_hook);
 916                 sock_hold(sk);
 917                 po->running = 1;
 918         }
 919
 920 out_unlock:
 921         spin_unlock(&po->bind_lock);
 922         release_sock(sk);
 923         return 0;
 924 }
 925
 926 /*
 927  *      Bind a packet socket to a device
 928  */
 929
 930 #ifdef CONFIG_SOCK_PACKET
 931
 932 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 933 {
 934         struct sock *sk=sock->sk;
 935         char name[15];
 936         struct net_device *dev;
 937         int err = -ENODEV;
 938
 939         /*
 940          *      Check legality
 941          */
 942
 943         if (addr_len != sizeof(struct sockaddr))
 944                 return -EINVAL;
 945         strlcpy(name,uaddr->sa_data,sizeof(name));
 946
 947         dev = dev_get_by_name(name);
 948         if (dev) {
 949                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 950                 dev_put(dev);
 951         }
 952         return err;
 953 }
 954 #endif
 955
 956 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 957 {
 958         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 959         struct sock *sk=sock->sk;
 960         struct net_device *dev = NULL;
 961         int err;
 962
 963
 964         /*
 965          *      Check legality
 966          */
 967
 968         if (addr_len < sizeof(struct sockaddr_ll))
 969                 return -EINVAL;
 970         if (sll->sll_family != AF_PACKET)
 971                 return -EINVAL;
 972
 973         if (sll->sll_ifindex) {
 974                 err = -ENODEV;
 975                 dev = dev_get_by_index(sll->sll_ifindex);
 976                 if (dev == NULL)
 977                         goto out;
 978         }
 979         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 980         if (dev)
 981                 dev_put(dev);
 982
 983 out:
 984         return err;
 985 }
 986
 987 static struct proto packet_proto = {
 988         .name     = "PACKET",
 989         .owner    = THIS_MODULE,
 990         .obj_size = sizeof(struct packet_sock),
 991 };
 992
 993 /*
 994  *      Create a packet of type SOCK_PACKET.
 995  */
 996
 997 static int packet_create(struct socket *sock, int protocol)
 998 {
 999         struct sock *sk;
1000         struct packet_sock *po;
1001         __be16 proto = (__force __be16)protocol; /* weird, but documented */
1002         int err;
1003
1004         if (!capable(CAP_NET_RAW))
1005                 return -EPERM;
1006         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
1007 #ifdef CONFIG_SOCK_PACKET
1008             && sock->type != SOCK_PACKET
1009 #endif
1010             )
1011                 return -ESOCKTNOSUPPORT;
1012
1013         sock->state = SS_UNCONNECTED;
1014
1015         err = -ENOBUFS;
1016         sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1017         if (sk == NULL)
1018                 goto out;
1019
1020         sock->ops = &packet_ops;
1021 #ifdef CONFIG_SOCK_PACKET
1022         if (sock->type == SOCK_PACKET)
1023                 sock->ops = &packet_ops_spkt;
1024 #endif
1025         sock_init_data(sock, sk);
1026
1027         po = pkt_sk(sk);
1028         sk->sk_family = PF_PACKET;
1029         po->num = proto;
1030
1031         sk->sk_destruct = packet_sock_destruct;
1032         atomic_inc(&packet_socks_nr);
1033
1034         /*
1035          *      Attach a protocol block
1036          */
1037
1038         spin_lock_init(&po->bind_lock);
1039         po->prot_hook.func = packet_rcv;
1040 #ifdef CONFIG_SOCK_PACKET
1041         if (sock->type == SOCK_PACKET)
1042                 po->prot_hook.func = packet_rcv_spkt;
1043 #endif
1044         po->prot_hook.af_packet_priv = sk;
1045
1046         if (proto) {
1047                 po->prot_hook.type = proto;
1048                 dev_add_pack(&po->prot_hook);
1049                 sock_hold(sk);
1050                 po->running = 1;
1051         }
1052
1053         write_lock_bh(&packet_sklist_lock);
1054         sk_add_node(sk, &packet_sklist);
1055         write_unlock_bh(&packet_sklist_lock);
1056         return(0);
1057 out:
1058         return err;
1059 }
1060
1061 /*
1062  *      Pull a packet from our receive queue and hand it to the user.
1063  *      If necessary we block.
1064  */
1065
1066 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1067                           struct msghdr *msg, size_t len, int flags)
1068 {
1069         struct sock *sk = sock->sk;
1070         struct sk_buff *skb;
1071         int copied, err;
1072         struct sockaddr_ll *sll;
1073
1074         err = -EINVAL;
1075         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1076                 goto out;
1077
1078 #if 0
1079         /* What error should we return now? EUNATTACH? */
1080         if (pkt_sk(sk)->ifindex < 0)
1081                 return -ENODEV;
1082 #endif
1083
1084         /*
1085          *      Call the generic datagram receiver. This handles all sorts
1086          *      of horrible races and re-entrancy so we can forget about it
1087          *      in the protocol layers.
1088          *
1089          *      Now it will return ENETDOWN, if device have just gone down,
1090          *      but then it will block.
1091          */
1092
1093         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1094
1095         /*
1096          *      An error occurred so return it. Because skb_recv_datagram()
1097          *      handles the blocking we don't see and worry about blocking
1098          *      retries.
1099          */
1100
1101         if (skb == NULL)
1102                 goto out;
1103
1104         /*
1105          *      If the address length field is there to be filled in, we fill
1106          *      it in now.
1107          */
1108
1109         sll = &PACKET_SKB_CB(skb)->sa.ll;
1110         if (sock->type == SOCK_PACKET)
1111                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1112         else
1113                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1114
1115         /*
1116          *      You lose any data beyond the buffer you gave. If it worries a
1117          *      user program they can ask the device for its MTU anyway.
1118          */
1119
1120         copied = skb->len;
1121         if (copied > len)
1122         {
1123                 copied=len;
1124                 msg->msg_flags|=MSG_TRUNC;
1125         }
1126
1127         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1128         if (err)
1129                 goto out_free;
1130
1131         sock_recv_timestamp(msg, sk, skb);
1132
1133         if (msg->msg_name)
1134                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1135                        msg->msg_namelen);
1136
1137         if (pkt_sk(sk)->auxdata) {
1138                 struct tpacket_auxdata aux;
1139
1140                 aux.tp_status = TP_STATUS_USER;
1141                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1142                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1143                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1144                 aux.tp_snaplen = skb->len;
1145                 aux.tp_mac = 0;
1146                 aux.tp_net = skb->nh.raw - skb->data;
1147
1148                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1149         }
1150
1151         /*
1152          *      Free or return the buffer as appropriate. Again this
1153          *      hides all the races and re-entrancy issues from us.
1154          */
1155         err = (flags&MSG_TRUNC) ? skb->len : copied;
1156
1157 out_free:
1158         skb_free_datagram(sk, skb);
1159 out:
1160         return err;
1161 }
1162
1163 #ifdef CONFIG_SOCK_PACKET
1164 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1165                                int *uaddr_len, int peer)
1166 {
1167         struct net_device *dev;
1168         struct sock *sk = sock->sk;
1169
1170         if (peer)
1171                 return -EOPNOTSUPP;
1172
1173         uaddr->sa_family = AF_PACKET;
1174         dev = dev_get_by_index(pkt_sk(sk)->ifindex);
1175         if (dev) {
1176                 strlcpy(uaddr->sa_data, dev->name, 15);
1177                 dev_put(dev);
1178         } else
1179                 memset(uaddr->sa_data, 0, 14);
1180         *uaddr_len = sizeof(*uaddr);
1181
1182         return 0;
1183 }
1184 #endif
1185
1186 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1187                           int *uaddr_len, int peer)
1188 {
1189         struct net_device *dev;
1190         struct sock *sk = sock->sk;
1191         struct packet_sock *po = pkt_sk(sk);
1192         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1193
1194         if (peer)
1195                 return -EOPNOTSUPP;
1196
1197         sll->sll_family = AF_PACKET;
1198         sll->sll_ifindex = po->ifindex;
1199         sll->sll_protocol = po->num;
1200         dev = dev_get_by_index(po->ifindex);
1201         if (dev) {
1202                 sll->sll_hatype = dev->type;
1203                 sll->sll_halen = dev->addr_len;
1204                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1205                 dev_put(dev);
1206         } else {
1207                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1208                 sll->sll_halen = 0;
1209         }
1210         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1211
1212         return 0;
1213 }
1214
1215 #ifdef CONFIG_PACKET_MULTICAST
1216 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1217 {
1218         switch (i->type) {
1219         case PACKET_MR_MULTICAST:
1220                 if (what > 0)
1221                         dev_mc_add(dev, i->addr, i->alen, 0);
1222                 else
1223                         dev_mc_delete(dev, i->addr, i->alen, 0);
1224                 break;
1225         case PACKET_MR_PROMISC:
1226                 dev_set_promiscuity(dev, what);
1227                 break;
1228         case PACKET_MR_ALLMULTI:
1229                 dev_set_allmulti(dev, what);
1230                 break;
1231         default:;
1232         }
1233 }
1234
1235 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1236 {
1237         for ( ; i; i=i->next) {
1238                 if (i->ifindex == dev->ifindex)
1239                         packet_dev_mc(dev, i, what);
1240         }
1241 }
1242
1243 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1244 {
1245         struct packet_sock *po = pkt_sk(sk);
1246         struct packet_mclist *ml, *i;
1247         struct net_device *dev;
1248         int err;
1249
1250         rtnl_lock();
1251
1252         err = -ENODEV;
1253         dev = __dev_get_by_index(mreq->mr_ifindex);
1254         if (!dev)
1255                 goto done;
1256
1257         err = -EINVAL;
1258         if (mreq->mr_alen > dev->addr_len)
1259                 goto done;
1260
1261         err = -ENOBUFS;
1262         i = kmalloc(sizeof(*i), GFP_KERNEL);
1263         if (i == NULL)
1264                 goto done;
1265
1266         err = 0;
1267         for (ml = po->mclist; ml; ml = ml->next) {
1268                 if (ml->ifindex == mreq->mr_ifindex &&
1269                     ml->type == mreq->mr_type &&
1270                     ml->alen == mreq->mr_alen &&
1271                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1272                         ml->count++;
1273                         /* Free the new element ... */
1274                         kfree(i);
1275                         goto done;
1276                 }
1277         }
1278
1279         i->type = mreq->mr_type;
1280         i->ifindex = mreq->mr_ifindex;
1281         i->alen = mreq->mr_alen;
1282         memcpy(i->addr, mreq->mr_address, i->alen);
1283         i->count = 1;
1284         i->next = po->mclist;
1285         po->mclist = i;
1286         packet_dev_mc(dev, i, +1);
1287
1288 done:
1289         rtnl_unlock();
1290         return err;
1291 }
1292
1293 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1294 {
1295         struct packet_mclist *ml, **mlp;
1296
1297         rtnl_lock();
1298
1299         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1300                 if (ml->ifindex == mreq->mr_ifindex &&
1301                     ml->type == mreq->mr_type &&
1302                     ml->alen == mreq->mr_alen &&
1303                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1304                         if (--ml->count == 0) {
1305                                 struct net_device *dev;
1306                                 *mlp = ml->next;
1307                                 dev = dev_get_by_index(ml->ifindex);
1308                                 if (dev) {
1309                                         packet_dev_mc(dev, ml, -1);
1310                                         dev_put(dev);
1311                                 }
1312                                 kfree(ml);
1313                         }
1314                         rtnl_unlock();
1315                         return 0;
1316                 }
1317         }
1318         rtnl_unlock();
1319         return -EADDRNOTAVAIL;
1320 }
1321
1322 static void packet_flush_mclist(struct sock *sk)
1323 {
1324         struct packet_sock *po = pkt_sk(sk);
1325         struct packet_mclist *ml;
1326
1327         if (!po->mclist)
1328                 return;
1329
1330         rtnl_lock();
1331         while ((ml = po->mclist) != NULL) {
1332                 struct net_device *dev;
1333
1334                 po->mclist = ml->next;
1335                 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) {
1336                         packet_dev_mc(dev, ml, -1);
1337                         dev_put(dev);
1338                 }
1339                 kfree(ml);
1340         }
1341         rtnl_unlock();
1342 }
1343 #endif
1344
1345 static int
1346 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1347 {
1348         struct sock *sk = sock->sk;
1349         struct packet_sock *po = pkt_sk(sk);
1350         int ret;
1351
1352         if (level != SOL_PACKET)
1353                 return -ENOPROTOOPT;
1354
1355         switch(optname) {
1356 #ifdef CONFIG_PACKET_MULTICAST
1357         case PACKET_ADD_MEMBERSHIP:
1358         case PACKET_DROP_MEMBERSHIP:
1359         {
1360                 struct packet_mreq_max mreq;
1361                 int len = optlen;
1362                 memset(&mreq, 0, sizeof(mreq));
1363                 if (len < sizeof(struct packet_mreq))
1364                         return -EINVAL;
1365                 if (len > sizeof(mreq))
1366                         len = sizeof(mreq);
1367                 if (copy_from_user(&mreq,optval,len))
1368                         return -EFAULT;
1369                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1370                         return -EINVAL;
1371                 if (optname == PACKET_ADD_MEMBERSHIP)
1372                         ret = packet_mc_add(sk, &mreq);
1373                 else
1374                         ret = packet_mc_drop(sk, &mreq);
1375                 return ret;
1376         }
1377 #endif
1378 #ifdef CONFIG_PACKET_MMAP
1379         case PACKET_RX_RING:
1380         {
1381                 struct tpacket_req req;
1382
1383                 if (optlen<sizeof(req))
1384                         return -EINVAL;
1385                 if (copy_from_user(&req,optval,sizeof(req)))
1386                         return -EFAULT;
1387                 return packet_set_ring(sk, &req, 0);
1388         }
1389         case PACKET_COPY_THRESH:
1390         {
1391                 int val;
1392
1393                 if (optlen!=sizeof(val))
1394                         return -EINVAL;
1395                 if (copy_from_user(&val,optval,sizeof(val)))
1396                         return -EFAULT;
1397
1398                 pkt_sk(sk)->copy_thresh = val;
1399                 return 0;
1400         }
1401 #endif
1402         case PACKET_AUXDATA:
1403         {
1404                 int val;
1405
1406                 if (optlen < sizeof(val))
1407                         return -EINVAL;
1408                 if (copy_from_user(&val, optval, sizeof(val)))
1409                         return -EFAULT;
1410
1411                 po->auxdata = !!val;
1412                 return 0;
1413         }
1414         default:
1415                 return -ENOPROTOOPT;
1416         }
1417 }
1418
1419 static int packet_getsockopt(struct socket *sock, int level, int optname,
1420                              char __user *optval, int __user *optlen)
1421 {
1422         int len;
1423         int val;
1424         struct sock *sk = sock->sk;
1425         struct packet_sock *po = pkt_sk(sk);
1426         void *data;
1427         struct tpacket_stats st;
1428
1429         if (level != SOL_PACKET)
1430                 return -ENOPROTOOPT;
1431
1432         if (get_user(len, optlen))
1433                 return -EFAULT;
1434
1435         if (len < 0)
1436                 return -EINVAL;
1437
1438         switch(optname) {
1439         case PACKET_STATISTICS:
1440                 if (len > sizeof(struct tpacket_stats))
1441                         len = sizeof(struct tpacket_stats);
1442                 spin_lock_bh(&sk->sk_receive_queue.lock);
1443                 st = po->stats;
1444                 memset(&po->stats, 0, sizeof(st));
1445                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1446                 st.tp_packets += st.tp_drops;
1447
1448                 data = &st;
1449                 break;
1450         case PACKET_AUXDATA:
1451                 if (len > sizeof(int))
1452                         len = sizeof(int);
1453                 val = po->auxdata;
1454
1455                 data = &val;
1456                 break;
1457         default:
1458                 return -ENOPROTOOPT;
1459         }
1460
1461         if (put_user(len, optlen))
1462                 return -EFAULT;
1463         if (copy_to_user(optval, data, len))
1464                 return -EFAULT;
1465         return 0;
1466 }
1467
1468
1469 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1470 {
1471         struct sock *sk;
1472         struct hlist_node *node;
1473         struct net_device *dev = data;
1474
1475         read_lock(&packet_sklist_lock);
1476         sk_for_each(sk, node, &packet_sklist) {
1477                 struct packet_sock *po = pkt_sk(sk);
1478
1479                 switch (msg) {
1480                 case NETDEV_UNREGISTER:
1481 #ifdef CONFIG_PACKET_MULTICAST
1482                         if (po->mclist)
1483                                 packet_dev_mclist(dev, po->mclist, -1);
1484                         // fallthrough
1485 #endif
1486                 case NETDEV_DOWN:
1487                         if (dev->ifindex == po->ifindex) {
1488                                 spin_lock(&po->bind_lock);
1489                                 if (po->running) {
1490                                         __dev_remove_pack(&po->prot_hook);
1491                                         __sock_put(sk);
1492                                         po->running = 0;
1493                                         sk->sk_err = ENETDOWN;
1494                                         if (!sock_flag(sk, SOCK_DEAD))
1495                                                 sk->sk_error_report(sk);
1496                                 }
1497                                 if (msg == NETDEV_UNREGISTER) {
1498                                         po->ifindex = -1;
1499                                         po->prot_hook.dev = NULL;
1500                                 }
1501                                 spin_unlock(&po->bind_lock);
1502                         }
1503                         break;
1504                 case NETDEV_UP:
1505                         spin_lock(&po->bind_lock);
1506                         if (dev->ifindex == po->ifindex && po->num &&
1507                             !po->running) {
1508                                 dev_add_pack(&po->prot_hook);
1509                                 sock_hold(sk);
1510                                 po->running = 1;
1511                         }
1512                         spin_unlock(&po->bind_lock);
1513                         break;
1514                 }
1515         }
1516         read_unlock(&packet_sklist_lock);
1517         return NOTIFY_DONE;
1518 }
1519
1520
1521 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1522                         unsigned long arg)
1523 {
1524         struct sock *sk = sock->sk;
1525
1526         switch(cmd) {
1527                 case SIOCOUTQ:
1528                 {
1529                         int amount = atomic_read(&sk->sk_wmem_alloc);
1530                         return put_user(amount, (int __user *)arg);
1531                 }
1532                 case SIOCINQ:
1533                 {
1534                         struct sk_buff *skb;
1535                         int amount = 0;
1536
1537                         spin_lock_bh(&sk->sk_receive_queue.lock);
1538                         skb = skb_peek(&sk->sk_receive_queue);
1539                         if (skb)
1540                                 amount = skb->len;
1541                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1542                         return put_user(amount, (int __user *)arg);
1543                 }
1544                 case SIOCGSTAMP:
1545                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1546
1547 #ifdef CONFIG_INET
1548                 case SIOCADDRT:
1549                 case SIOCDELRT:
1550                 case SIOCDARP:
1551                 case SIOCGARP:
1552                 case SIOCSARP:
1553                 case SIOCGIFADDR:
1554                 case SIOCSIFADDR:
1555                 case SIOCGIFBRDADDR:
1556                 case SIOCSIFBRDADDR:
1557                 case SIOCGIFNETMASK:
1558                 case SIOCSIFNETMASK:
1559                 case SIOCGIFDSTADDR:
1560                 case SIOCSIFDSTADDR:
1561                 case SIOCSIFFLAGS:
1562                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1563 #endif
1564
1565                 default:
1566                         return -ENOIOCTLCMD;
1567         }
1568         return 0;
1569 }
1570
1571 #ifndef CONFIG_PACKET_MMAP
1572 #define packet_mmap sock_no_mmap
1573 #define packet_poll datagram_poll
1574 #else
1575
1576 static unsigned int packet_poll(struct file * file, struct socket *sock,
1577                                 poll_table *wait)
1578 {
1579         struct sock *sk = sock->sk;
1580         struct packet_sock *po = pkt_sk(sk);
1581         unsigned int mask = datagram_poll(file, sock, wait);
1582
1583         spin_lock_bh(&sk->sk_receive_queue.lock);
1584         if (po->pg_vec) {
1585                 unsigned last = po->head ? po->head-1 : po->frame_max;
1586                 struct tpacket_hdr *h;
1587
1588                 h = packet_lookup_frame(po, last);
1589
1590                 if (h->tp_status)
1591                         mask |= POLLIN | POLLRDNORM;
1592         }
1593         spin_unlock_bh(&sk->sk_receive_queue.lock);
1594         return mask;
1595 }
1596
1597
1598 /* Dirty? Well, I still did not learn better way to account
1599  * for user mmaps.
1600  */
1601
1602 static void packet_mm_open(struct vm_area_struct *vma)
1603 {
1604         struct file *file = vma->vm_file;
1605         struct socket * sock = file->private_data;
1606         struct sock *sk = sock->sk;
1607
1608         if (sk)
1609                 atomic_inc(&pkt_sk(sk)->mapped);
1610 }
1611
1612 static void packet_mm_close(struct vm_area_struct *vma)
1613 {
1614         struct file *file = vma->vm_file;
1615         struct socket * sock = file->private_data;
1616         struct sock *sk = sock->sk;
1617
1618         if (sk)
1619                 atomic_dec(&pkt_sk(sk)->mapped);
1620 }
1621
1622 static struct vm_operations_struct packet_mmap_ops = {
1623         .open = packet_mm_open,
1624         .close =packet_mm_close,
1625 };
1626
1627 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1628 {
1629         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1630 }
1631
1632 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1633 {
1634         int i;
1635
1636         for (i = 0; i < len; i++) {
1637                 if (likely(pg_vec[i]))
1638                         free_pages((unsigned long) pg_vec[i], order);
1639         }
1640         kfree(pg_vec);
1641 }
1642
1643 static inline char *alloc_one_pg_vec_page(unsigned long order)
1644 {
1645         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1646                                          order);
1647 }
1648
1649 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1650 {
1651         unsigned int block_nr = req->tp_block_nr;
1652         char **pg_vec;
1653         int i;
1654
1655         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1656         if (unlikely(!pg_vec))
1657                 goto out;
1658
1659         for (i = 0; i < block_nr; i++) {
1660                 pg_vec[i] = alloc_one_pg_vec_page(order);
1661                 if (unlikely(!pg_vec[i]))
1662                         goto out_free_pgvec;
1663         }
1664
1665 out:
1666         return pg_vec;
1667
1668 out_free_pgvec:
1669         free_pg_vec(pg_vec, order, block_nr);
1670         pg_vec = NULL;
1671         goto out;
1672 }
1673
1674 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1675 {
1676         char **pg_vec = NULL;
1677         struct packet_sock *po = pkt_sk(sk);
1678         int was_running, order = 0;
1679         __be16 num;
1680         int err = 0;
1681
1682         if (req->tp_block_nr) {
1683                 int i, l;
1684
1685                 /* Sanity tests and some calculations */
1686
1687                 if (unlikely(po->pg_vec))
1688                         return -EBUSY;
1689
1690                 if (unlikely((int)req->tp_block_size <= 0))
1691                         return -EINVAL;
1692                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1693                         return -EINVAL;
1694                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1695                         return -EINVAL;
1696                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1697                         return -EINVAL;
1698
1699                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1700                 if (unlikely(po->frames_per_block <= 0))
1701                         return -EINVAL;
1702                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1703                              req->tp_frame_nr))
1704                         return -EINVAL;
1705
1706                 err = -ENOMEM;
1707                 order = get_order(req->tp_block_size);
1708                 pg_vec = alloc_pg_vec(req, order);
1709                 if (unlikely(!pg_vec))
1710                         goto out;
1711
1712                 l = 0;
1713                 for (i = 0; i < req->tp_block_nr; i++) {
1714                         char *ptr = pg_vec[i];
1715                         struct tpacket_hdr *header;
1716                         int k;
1717
1718                         for (k = 0; k < po->frames_per_block; k++) {
1719                                 header = (struct tpacket_hdr *) ptr;
1720                                 header->tp_status = TP_STATUS_KERNEL;
1721                                 ptr += req->tp_frame_size;
1722                         }
1723                 }
1724                 /* Done */
1725         } else {
1726                 if (unlikely(req->tp_frame_nr))
1727                         return -EINVAL;
1728         }
1729
1730         lock_sock(sk);
1731
1732         /* Detach socket from network */
1733         spin_lock(&po->bind_lock);
1734         was_running = po->running;
1735         num = po->num;
1736         if (was_running) {
1737                 __dev_remove_pack(&po->prot_hook);
1738                 po->num = 0;
1739                 po->running = 0;
1740                 __sock_put(sk);
1741         }
1742         spin_unlock(&po->bind_lock);
1743
1744         synchronize_net();
1745
1746         err = -EBUSY;
1747         if (closing || atomic_read(&po->mapped) == 0) {
1748                 err = 0;
1749 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1750
1751                 spin_lock_bh(&sk->sk_receive_queue.lock);
1752                 pg_vec = XC(po->pg_vec, pg_vec);
1753                 po->frame_max = (req->tp_frame_nr - 1);
1754                 po->head = 0;
1755                 po->frame_size = req->tp_frame_size;
1756                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1757
1758                 order = XC(po->pg_vec_order, order);
1759                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1760
1761                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1762                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1763                 skb_queue_purge(&sk->sk_receive_queue);
1764 #undef XC
1765                 if (atomic_read(&po->mapped))
1766                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1767         }
1768
1769         spin_lock(&po->bind_lock);
1770         if (was_running && !po->running) {
1771                 sock_hold(sk);
1772                 po->running = 1;
1773                 po->num = num;
1774                 dev_add_pack(&po->prot_hook);
1775         }
1776         spin_unlock(&po->bind_lock);
1777
1778         release_sock(sk);
1779
1780         if (pg_vec)
1781                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1782 out:
1783         return err;
1784 }
1785
1786 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1787 {
1788         struct sock *sk = sock->sk;
1789         struct packet_sock *po = pkt_sk(sk);
1790         unsigned long size;
1791         unsigned long start;
1792         int err = -EINVAL;
1793         int i;
1794
1795         if (vma->vm_pgoff)
1796                 return -EINVAL;
1797
1798         size = vma->vm_end - vma->vm_start;
1799
1800         lock_sock(sk);
1801         if (po->pg_vec == NULL)
1802                 goto out;
1803         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1804                 goto out;
1805
1806         start = vma->vm_start;
1807         for (i = 0; i < po->pg_vec_len; i++) {
1808                 struct page *page = virt_to_page(po->pg_vec[i]);
1809                 int pg_num;
1810
1811                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1812                         err = vm_insert_page(vma, start, page);
1813                         if (unlikely(err))
1814                                 goto out;
1815                         start += PAGE_SIZE;
1816                 }
1817         }
1818         atomic_inc(&po->mapped);
1819         vma->vm_ops = &packet_mmap_ops;
1820         err = 0;
1821
1822 out:
1823         release_sock(sk);
1824         return err;
1825 }
1826 #endif
1827
1828
1829 #ifdef CONFIG_SOCK_PACKET
1830 static const struct proto_ops packet_ops_spkt = {
1831         .family =       PF_PACKET,
1832         .owner =        THIS_MODULE,
1833         .release =      packet_release,
1834         .bind =         packet_bind_spkt,
1835         .connect =      sock_no_connect,
1836         .socketpair =   sock_no_socketpair,
1837         .accept =       sock_no_accept,
1838         .getname =      packet_getname_spkt,
1839         .poll =         datagram_poll,
1840         .ioctl =        packet_ioctl,
1841         .listen =       sock_no_listen,
1842         .shutdown =     sock_no_shutdown,
1843         .setsockopt =   sock_no_setsockopt,
1844         .getsockopt =   sock_no_getsockopt,
1845         .sendmsg =      packet_sendmsg_spkt,
1846         .recvmsg =      packet_recvmsg,
1847         .mmap =         sock_no_mmap,
1848         .sendpage =     sock_no_sendpage,
1849 };
1850 #endif
1851
1852 static const struct proto_ops packet_ops = {
1853         .family =       PF_PACKET,
1854         .owner =        THIS_MODULE,
1855         .release =      packet_release,
1856         .bind =         packet_bind,
1857         .connect =      sock_no_connect,
1858         .socketpair =   sock_no_socketpair,
1859         .accept =       sock_no_accept,
1860         .getname =      packet_getname,
1861         .poll =         packet_poll,
1862         .ioctl =        packet_ioctl,
1863         .listen =       sock_no_listen,
1864         .shutdown =     sock_no_shutdown,
1865         .setsockopt =   packet_setsockopt,
1866         .getsockopt =   packet_getsockopt,
1867         .sendmsg =      packet_sendmsg,
1868         .recvmsg =      packet_recvmsg,
1869         .mmap =         packet_mmap,
1870         .sendpage =     sock_no_sendpage,
1871 };
1872
1873 static struct net_proto_family packet_family_ops = {
1874         .family =       PF_PACKET,
1875         .create =       packet_create,
1876         .owner  =       THIS_MODULE,
1877 };
1878
1879 static struct notifier_block packet_netdev_notifier = {
1880         .notifier_call =packet_notifier,
1881 };
1882
1883 #ifdef CONFIG_PROC_FS
1884 static inline struct sock *packet_seq_idx(loff_t off)
1885 {
1886         struct sock *s;
1887         struct hlist_node *node;
1888
1889         sk_for_each(s, node, &packet_sklist) {
1890                 if (!off--)
1891                         return s;
1892         }
1893         return NULL;
1894 }
1895
1896 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1897 {
1898         read_lock(&packet_sklist_lock);
1899         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1900 }
1901
1902 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1903 {
1904         ++*pos;
1905         return  (v == SEQ_START_TOKEN)
1906                 ? sk_head(&packet_sklist)
1907                 : sk_next((struct sock*)v) ;
1908 }
1909
1910 static void packet_seq_stop(struct seq_file *seq, void *v)
1911 {
1912         read_unlock(&packet_sklist_lock);
1913 }
1914
1915 static int packet_seq_show(struct seq_file *seq, void *v)
1916 {
1917         if (v == SEQ_START_TOKEN)
1918                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1919         else {
1920                 struct sock *s = v;
1921                 const struct packet_sock *po = pkt_sk(s);
1922
1923                 seq_printf(seq,
1924                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1925                            s,
1926                            atomic_read(&s->sk_refcnt),
1927                            s->sk_type,
1928                            ntohs(po->num),
1929                            po->ifindex,
1930                            po->running,
1931                            atomic_read(&s->sk_rmem_alloc),
1932                            sock_i_uid(s),
1933                            sock_i_ino(s) );
1934         }
1935
1936         return 0;
1937 }
1938
1939 static struct seq_operations packet_seq_ops = {
1940         .start  = packet_seq_start,
1941         .next   = packet_seq_next,
1942         .stop   = packet_seq_stop,
1943         .show   = packet_seq_show,
1944 };
1945
1946 static int packet_seq_open(struct inode *inode, struct file *file)
1947 {
1948         return seq_open(file, &packet_seq_ops);
1949 }
1950
1951 static const struct file_operations packet_seq_fops = {
1952         .owner          = THIS_MODULE,
1953         .open           = packet_seq_open,
1954         .read           = seq_read,
1955         .llseek         = seq_lseek,
1956         .release        = seq_release,
1957 };
1958
1959 #endif
1960
1961 static void __exit packet_exit(void)
1962 {
1963         proc_net_remove("packet");
1964         unregister_netdevice_notifier(&packet_netdev_notifier);
1965         sock_unregister(PF_PACKET);
1966         proto_unregister(&packet_proto);
1967 }
1968
1969 static int __init packet_init(void)
1970 {
1971         int rc = proto_register(&packet_proto, 0);
1972
1973         if (rc != 0)
1974                 goto out;
1975
1976         sock_register(&packet_family_ops);
1977         register_netdevice_notifier(&packet_netdev_notifier);
1978         proc_net_fops_create("packet", 0, &packet_seq_fops);
1979 out:
1980         return rc;
1981 }
1982
1983 module_init(packet_init);
1984 module_exit(packet_exit);
1985 MODULE_LICENSE("GPL");
1986 MODULE_ALIAS_NETPROTO(PF_PACKET);