SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/mm.h>
  54 #include <linux/capability.h>
  55 #include <linux/fcntl.h>
  56 #include <linux/socket.h>
  57 #include <linux/in.h>
  58 #include <linux/inet.h>
  59 #include <linux/netdevice.h>
  60 #include <linux/if_packet.h>
  61 #include <linux/wireless.h>
  62 #include <linux/kernel.h>
  63 #include <linux/kmod.h>
  64 #include <net/ip.h>
  65 #include <net/protocol.h>
  66 #include <linux/skbuff.h>
  67 #include <net/sock.h>
  68 #include <linux/errno.h>
  69 #include <linux/timer.h>
  70 #include <asm/system.h>
  71 #include <asm/uaccess.h>
  72 #include <asm/ioctls.h>
  73 #include <asm/page.h>
  74 #include <asm/cacheflush.h>
  75 #include <asm/io.h>
  76 #include <linux/proc_fs.h>
  77 #include <linux/seq_file.h>
  78 #include <linux/poll.h>
  79 #include <linux/module.h>
  80 #include <linux/init.h>
  81
  82 #ifdef CONFIG_INET
  83 #include <net/inet_common.h>
  84 #endif
  85
  86 #define CONFIG_SOCK_PACKET      1
  87
  88 /*
  89    Proposed replacement for SIOC{ADD,DEL}MULTI and
  90    IFF_PROMISC, IFF_ALLMULTI flags.
  91
  92    It is more expensive, but I believe,
  93    it is really correct solution: reentereble, safe and fault tolerant.
  94
  95    IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping
  96    reference count and global flag, so that real status is
  97    (gflag|(count != 0)), so that we can use obsolete faulty interface
  98    not harming clever users.
  99  */
 100 #define CONFIG_PACKET_MULTICAST 1
 101
 102 /*
 103    Assumptions:
 104    - if device has no dev->hard_header routine, it adds and removes ll header
 105      inside itself. In this case ll header is invisible outside of device,
 106      but higher levels still should reserve dev->hard_header_len.
 107      Some devices are enough clever to reallocate skb, when header
 108      will not fit to reserved space (tunnel), another ones are silly
 109      (PPP).
 110    - packet socket receives packets with pulled ll header,
 111      so that SOCK_RAW should push it back.
 112
 113 On receive:
 114 -----------
 115
 116 Incoming, dev->hard_header!=NULL
 117    mac.raw -> ll header
 118    data    -> data
 119
 120 Outgoing, dev->hard_header!=NULL
 121    mac.raw -> ll header
 122    data    -> ll header
 123
 124 Incoming, dev->hard_header==NULL
 125    mac.raw -> UNKNOWN position. It is very likely, that it points to ll header.
 126               PPP makes it, that is wrong, because introduce assymetry
 127               between rx and tx paths.
 128    data    -> data
 129
 130 Outgoing, dev->hard_header==NULL
 131    mac.raw -> data. ll header is still not built!
 132    data    -> data
 133
 134 Resume
 135   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 136
 137
 138 On transmit:
 139 ------------
 140
 141 dev->hard_header != NULL
 142    mac.raw -> ll header
 143    data    -> ll header
 144
 145 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 146    mac.raw -> data
 147    data -> data
 148
 149    We should set nh.raw on output to correct posistion,
 150    packet classifier depends on it.
 151  */
 152
 153 /* List of all packet sockets. */
 154 static HLIST_HEAD(packet_sklist);
 155 static DEFINE_RWLOCK(packet_sklist_lock);
 156
 157 static atomic_t packet_socks_nr;
 158
 159
 160 /* Private packet socket structures. */
 161
 162 #ifdef CONFIG_PACKET_MULTICAST
 163 struct packet_mclist
 164 {
 165         struct packet_mclist    *next;
 166         int                     ifindex;
 167         int                     count;
 168         unsigned short          type;
 169         unsigned short          alen;
 170         unsigned char           addr[MAX_ADDR_LEN];
 171 };
 172 /* identical to struct packet_mreq except it has
 173  * a longer address field.
 174  */
 175 struct packet_mreq_max
 176 {
 177         int             mr_ifindex;
 178         unsigned short  mr_type;
 179         unsigned short  mr_alen;
 180         unsigned char   mr_address[MAX_ADDR_LEN];
 181 };
 182 #endif
 183 #ifdef CONFIG_PACKET_MMAP
 184 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 185 #endif
 186
 187 static void packet_flush_mclist(struct sock *sk);
 188
 189 struct packet_sock {
 190         /* struct sock has to be the first member of packet_sock */
 191         struct sock             sk;
 192         struct tpacket_stats    stats;
 193 #ifdef CONFIG_PACKET_MMAP
 194         char *                  *pg_vec;
 195         unsigned int            head;
 196         unsigned int            frames_per_block;
 197         unsigned int            frame_size;
 198         unsigned int            frame_max;
 199         int                     copy_thresh;
 200 #endif
 201         struct packet_type      prot_hook;
 202         spinlock_t              bind_lock;
 203         unsigned int            running:1,      /* prot_hook is attached*/
 204                                 auxdata:1;
 205         int                     ifindex;        /* bound device         */
 206         __be16                  num;
 207 #ifdef CONFIG_PACKET_MULTICAST
 208         struct packet_mclist    *mclist;
 209 #endif
 210 #ifdef CONFIG_PACKET_MMAP
 211         atomic_t                mapped;
 212         unsigned int            pg_vec_order;
 213         unsigned int            pg_vec_pages;
 214         unsigned int            pg_vec_len;
 215 #endif
 216 };
 217
 218 struct packet_skb_cb {
 219         unsigned int origlen;
 220         union {
 221                 struct sockaddr_pkt pkt;
 222                 struct sockaddr_ll ll;
 223         } sa;
 224 };
 225
 226 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 227
 228 #ifdef CONFIG_PACKET_MMAP
 229
 230 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 231 {
 232         unsigned int pg_vec_pos, frame_offset;
 233
 234         pg_vec_pos = position / po->frames_per_block;
 235         frame_offset = position % po->frames_per_block;
 236
 237         return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
 238 }
 239 #endif
 240
 241 static inline struct packet_sock *pkt_sk(struct sock *sk)
 242 {
 243         return (struct packet_sock *)sk;
 244 }
 245
 246 static void packet_sock_destruct(struct sock *sk)
 247 {
 248         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 249         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 250
 251         if (!sock_flag(sk, SOCK_DEAD)) {
 252                 printk("Attempt to release alive packet socket: %p\n", sk);
 253                 return;
 254         }
 255
 256         atomic_dec(&packet_socks_nr);
 257 #ifdef PACKET_REFCNT_DEBUG
 258         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 259 #endif
 260 }
 261
 262
 263 static const struct proto_ops packet_ops;
 264
 265 #ifdef CONFIG_SOCK_PACKET
 266 static const struct proto_ops packet_ops_spkt;
 267
 268 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 269 {
 270         struct sock *sk;
 271         struct sockaddr_pkt *spkt;
 272
 273         /*
 274          *      When we registered the protocol we saved the socket in the data
 275          *      field for just this event.
 276          */
 277
 278         sk = pt->af_packet_priv;
 279
 280         /*
 281          *      Yank back the headers [hope the device set this
 282          *      right or kerboom...]
 283          *
 284          *      Incoming packets have ll header pulled,
 285          *      push it back.
 286          *
 287          *      For outgoing ones skb->data == skb->mac.raw
 288          *      so that this procedure is noop.
 289          */
 290
 291         if (skb->pkt_type == PACKET_LOOPBACK)
 292                 goto out;
 293
 294         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 295                 goto oom;
 296
 297         /* drop any routing info */
 298         dst_release(skb->dst);
 299         skb->dst = NULL;
 300
 301         /* drop conntrack reference */
 302         nf_reset(skb);
 303
 304         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 305
 306         skb_push(skb, skb->data-skb->mac.raw);
 307
 308         /*
 309          *      The SOCK_PACKET socket receives _all_ frames.
 310          */
 311
 312         spkt->spkt_family = dev->type;
 313         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 314         spkt->spkt_protocol = skb->protocol;
 315
 316         /*
 317          *      Charge the memory to the socket. This is done specifically
 318          *      to prevent sockets using all the memory up.
 319          */
 320
 321         if (sock_queue_rcv_skb(sk,skb) == 0)
 322                 return 0;
 323
 324 out:
 325         kfree_skb(skb);
 326 oom:
 327         return 0;
 328 }
 329
 330
 331 /*
 332  *      Output a raw packet to a device layer. This bypasses all the other
 333  *      protocol layers and you must therefore supply it with a complete frame
 334  */
 335
 336 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 337                                struct msghdr *msg, size_t len)
 338 {
 339         struct sock *sk = sock->sk;
 340         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 341         struct sk_buff *skb;
 342         struct net_device *dev;
 343         __be16 proto=0;
 344         int err;
 345
 346         /*
 347          *      Get and verify the address.
 348          */
 349
 350         if (saddr)
 351         {
 352                 if (msg->msg_namelen < sizeof(struct sockaddr))
 353                         return(-EINVAL);
 354                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 355                         proto=saddr->spkt_protocol;
 356         }
 357         else
 358                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 359
 360         /*
 361          *      Find the device first to size check it
 362          */
 363
 364         saddr->spkt_device[13] = 0;
 365         dev = dev_get_by_name(saddr->spkt_device);
 366         err = -ENODEV;
 367         if (dev == NULL)
 368                 goto out_unlock;
 369
 370         err = -ENETDOWN;
 371         if (!(dev->flags & IFF_UP))
 372                 goto out_unlock;
 373
 374         /*
 375          *      You may not queue a frame bigger than the mtu. This is the lowest level
 376          *      raw protocol and you must do your own fragmentation at this level.
 377          */
 378
 379         err = -EMSGSIZE;
 380         if (len > dev->mtu + dev->hard_header_len)
 381                 goto out_unlock;
 382
 383         err = -ENOBUFS;
 384         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 385
 386         /*
 387          *      If the write buffer is full, then tough. At this level the user gets to
 388          *      deal with the problem - do your own algorithmic backoffs. That's far
 389          *      more flexible.
 390          */
 391
 392         if (skb == NULL)
 393                 goto out_unlock;
 394
 395         /*
 396          *      Fill it in
 397          */
 398
 399         /* FIXME: Save some space for broken drivers that write a
 400          * hard header at transmission time by themselves. PPP is the
 401          * notable one here. This should really be fixed at the driver level.
 402          */
 403         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 404         skb->nh.raw = skb->data;
 405
 406         /* Try to align data part correctly */
 407         if (dev->hard_header) {
 408                 skb->data -= dev->hard_header_len;
 409                 skb->tail -= dev->hard_header_len;
 410                 if (len < dev->hard_header_len)
 411                         skb->nh.raw = skb->data;
 412         }
 413
 414         /* Returns -EFAULT on error */
 415         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 416         skb->protocol = proto;
 417         skb->dev = dev;
 418         skb->priority = sk->sk_priority;
 419         if (err)
 420                 goto out_free;
 421
 422         /*
 423          *      Now send it
 424          */
 425
 426         dev_queue_xmit(skb);
 427         dev_put(dev);
 428         return(len);
 429
 430 out_free:
 431         kfree_skb(skb);
 432 out_unlock:
 433         if (dev)
 434                 dev_put(dev);
 435         return err;
 436 }
 437 #endif
 438
 439 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 440                                       unsigned int res)
 441 {
 442         struct sk_filter *filter;
 443
 444         rcu_read_lock_bh();
 445         filter = rcu_dereference(sk->sk_filter);
 446         if (filter != NULL)
 447                 res = sk_run_filter(skb, filter->insns, filter->len);
 448         rcu_read_unlock_bh();
 449
 450         return res;
 451 }
 452
 453 /*
 454    This function makes lazy skb cloning in hope that most of packets
 455    are discarded by BPF.
 456
 457    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 458    and skb->cb are mangled. It works because (and until) packets
 459    falling here are owned by current CPU. Output packets are cloned
 460    by dev_queue_xmit_nit(), input packets are processed by net_bh
 461    sequencially, so that if we return skb to original state on exit,
 462    we will not harm anyone.
 463  */
 464
 465 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 466 {
 467         struct sock *sk;
 468         struct sockaddr_ll *sll;
 469         struct packet_sock *po;
 470         u8 * skb_head = skb->data;
 471         int skb_len = skb->len;
 472         unsigned int snaplen, res;
 473
 474         if (skb->pkt_type == PACKET_LOOPBACK)
 475                 goto drop;
 476
 477         sk = pt->af_packet_priv;
 478         po = pkt_sk(sk);
 479
 480         skb->dev = dev;
 481
 482         if (dev->hard_header) {
 483                 /* The device has an explicit notion of ll header,
 484                    exported to higher levels.
 485
 486                    Otherwise, the device hides datails of it frame
 487                    structure, so that corresponding packet head
 488                    never delivered to user.
 489                  */
 490                 if (sk->sk_type != SOCK_DGRAM)
 491                         skb_push(skb, skb->data - skb->mac.raw);
 492                 else if (skb->pkt_type == PACKET_OUTGOING) {
 493                         /* Special case: outgoing packets have ll header at head */
 494                         skb_pull(skb, skb->nh.raw - skb->data);
 495                 }
 496         }
 497
 498         snaplen = skb->len;
 499
 500         res = run_filter(skb, sk, snaplen);
 501         if (!res)
 502                 goto drop_n_restore;
 503         if (snaplen > res)
 504                 snaplen = res;
 505
 506         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 507             (unsigned)sk->sk_rcvbuf)
 508                 goto drop_n_acct;
 509
 510         if (skb_shared(skb)) {
 511                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 512                 if (nskb == NULL)
 513                         goto drop_n_acct;
 514
 515                 if (skb_head != skb->data) {
 516                         skb->data = skb_head;
 517                         skb->len = skb_len;
 518                 }
 519                 kfree_skb(skb);
 520                 skb = nskb;
 521         }
 522
 523         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 524                      sizeof(skb->cb));
 525
 526         sll = &PACKET_SKB_CB(skb)->sa.ll;
 527         sll->sll_family = AF_PACKET;
 528         sll->sll_hatype = dev->type;
 529         sll->sll_protocol = skb->protocol;
 530         sll->sll_pkttype = skb->pkt_type;
 531         sll->sll_ifindex = dev->ifindex;
 532         sll->sll_halen = 0;
 533
 534         if (dev->hard_header_parse)
 535                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 536
 537         PACKET_SKB_CB(skb)->origlen = skb->len;
 538
 539         if (pskb_trim(skb, snaplen))
 540                 goto drop_n_acct;
 541
 542         skb_set_owner_r(skb, sk);
 543         skb->dev = NULL;
 544         dst_release(skb->dst);
 545         skb->dst = NULL;
 546
 547         /* drop conntrack reference */
 548         nf_reset(skb);
 549
 550         spin_lock(&sk->sk_receive_queue.lock);
 551         po->stats.tp_packets++;
 552         __skb_queue_tail(&sk->sk_receive_queue, skb);
 553         spin_unlock(&sk->sk_receive_queue.lock);
 554         sk->sk_data_ready(sk, skb->len);
 555         return 0;
 556
 557 drop_n_acct:
 558         spin_lock(&sk->sk_receive_queue.lock);
 559         po->stats.tp_drops++;
 560         spin_unlock(&sk->sk_receive_queue.lock);
 561
 562 drop_n_restore:
 563         if (skb_head != skb->data && skb_shared(skb)) {
 564                 skb->data = skb_head;
 565                 skb->len = skb_len;
 566         }
 567 drop:
 568         kfree_skb(skb);
 569         return 0;
 570 }
 571
 572 #ifdef CONFIG_PACKET_MMAP
 573 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 574 {
 575         struct sock *sk;
 576         struct packet_sock *po;
 577         struct sockaddr_ll *sll;
 578         struct tpacket_hdr *h;
 579         u8 * skb_head = skb->data;
 580         int skb_len = skb->len;
 581         unsigned int snaplen, res;
 582         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 583         unsigned short macoff, netoff;
 584         struct sk_buff *copy_skb = NULL;
 585         struct timeval tv;
 586
 587         if (skb->pkt_type == PACKET_LOOPBACK)
 588                 goto drop;
 589
 590         sk = pt->af_packet_priv;
 591         po = pkt_sk(sk);
 592
 593         if (dev->hard_header) {
 594                 if (sk->sk_type != SOCK_DGRAM)
 595                         skb_push(skb, skb->data - skb->mac.raw);
 596                 else if (skb->pkt_type == PACKET_OUTGOING) {
 597                         /* Special case: outgoing packets have ll header at head */
 598                         skb_pull(skb, skb->nh.raw - skb->data);
 599                 }
 600         }
 601
 602         if (skb->ip_summed == CHECKSUM_PARTIAL)
 603                 status |= TP_STATUS_CSUMNOTREADY;
 604
 605         snaplen = skb->len;
 606
 607         res = run_filter(skb, sk, snaplen);
 608         if (!res)
 609                 goto drop_n_restore;
 610         if (snaplen > res)
 611                 snaplen = res;
 612
 613         if (sk->sk_type == SOCK_DGRAM) {
 614                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 615         } else {
 616                 unsigned maclen = skb->nh.raw - skb->data;
 617                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 618                 macoff = netoff - maclen;
 619         }
 620
 621         if (macoff + snaplen > po->frame_size) {
 622                 if (po->copy_thresh &&
 623                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 624                     (unsigned)sk->sk_rcvbuf) {
 625                         if (skb_shared(skb)) {
 626                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 627                         } else {
 628                                 copy_skb = skb_get(skb);
 629                                 skb_head = skb->data;
 630                         }
 631                         if (copy_skb)
 632                                 skb_set_owner_r(copy_skb, sk);
 633                 }
 634                 snaplen = po->frame_size - macoff;
 635                 if ((int)snaplen < 0)
 636                         snaplen = 0;
 637         }
 638
 639         spin_lock(&sk->sk_receive_queue.lock);
 640         h = packet_lookup_frame(po, po->head);
 641
 642         if (h->tp_status)
 643                 goto ring_is_full;
 644         po->head = po->head != po->frame_max ? po->head+1 : 0;
 645         po->stats.tp_packets++;
 646         if (copy_skb) {
 647                 status |= TP_STATUS_COPY;
 648                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 649         }
 650         if (!po->stats.tp_drops)
 651                 status &= ~TP_STATUS_LOSING;
 652         spin_unlock(&sk->sk_receive_queue.lock);
 653
 654         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 655
 656         h->tp_len = skb->len;
 657         h->tp_snaplen = snaplen;
 658         h->tp_mac = macoff;
 659         h->tp_net = netoff;
 660         if (skb->tstamp.tv64 == 0) {
 661                 __net_timestamp(skb);
 662                 sock_enable_timestamp(sk);
 663         }
 664         tv = ktime_to_timeval(skb->tstamp);
 665         h->tp_sec = tv.tv_sec;
 666         h->tp_usec = tv.tv_usec;
 667
 668         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 669         sll->sll_halen = 0;
 670         if (dev->hard_header_parse)
 671                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 672         sll->sll_family = AF_PACKET;
 673         sll->sll_hatype = dev->type;
 674         sll->sll_protocol = skb->protocol;
 675         sll->sll_pkttype = skb->pkt_type;
 676         sll->sll_ifindex = dev->ifindex;
 677
 678         h->tp_status = status;
 679         smp_mb();
 680
 681         {
 682                 struct page *p_start, *p_end;
 683                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 684
 685                 p_start = virt_to_page(h);
 686                 p_end = virt_to_page(h_end);
 687                 while (p_start <= p_end) {
 688                         flush_dcache_page(p_start);
 689                         p_start++;
 690                 }
 691         }
 692
 693         sk->sk_data_ready(sk, 0);
 694
 695 drop_n_restore:
 696         if (skb_head != skb->data && skb_shared(skb)) {
 697                 skb->data = skb_head;
 698                 skb->len = skb_len;
 699         }
 700 drop:
 701         kfree_skb(skb);
 702         return 0;
 703
 704 ring_is_full:
 705         po->stats.tp_drops++;
 706         spin_unlock(&sk->sk_receive_queue.lock);
 707
 708         sk->sk_data_ready(sk, 0);
 709         if (copy_skb)
 710                 kfree_skb(copy_skb);
 711         goto drop_n_restore;
 712 }
 713
 714 #endif
 715
 716
 717 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 718                           struct msghdr *msg, size_t len)
 719 {
 720         struct sock *sk = sock->sk;
 721         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 722         struct sk_buff *skb;
 723         struct net_device *dev;
 724         __be16 proto;
 725         unsigned char *addr;
 726         int ifindex, err, reserve = 0;
 727
 728         /*
 729          *      Get and verify the address.
 730          */
 731
 732         if (saddr == NULL) {
 733                 struct packet_sock *po = pkt_sk(sk);
 734
 735                 ifindex = po->ifindex;
 736                 proto   = po->num;
 737                 addr    = NULL;
 738         } else {
 739                 err = -EINVAL;
 740                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 741                         goto out;
 742                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 743                         goto out;
 744                 ifindex = saddr->sll_ifindex;
 745                 proto   = saddr->sll_protocol;
 746                 addr    = saddr->sll_addr;
 747         }
 748
 749
 750         dev = dev_get_by_index(ifindex);
 751         err = -ENXIO;
 752         if (dev == NULL)
 753                 goto out_unlock;
 754         if (sock->type == SOCK_RAW)
 755                 reserve = dev->hard_header_len;
 756
 757         err = -ENETDOWN;
 758         if (!(dev->flags & IFF_UP))
 759                 goto out_unlock;
 760
 761         err = -EMSGSIZE;
 762         if (len > dev->mtu+reserve)
 763                 goto out_unlock;
 764
 765         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 766                                 msg->msg_flags & MSG_DONTWAIT, &err);
 767         if (skb==NULL)
 768                 goto out_unlock;
 769
 770         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 771         skb->nh.raw = skb->data;
 772
 773         if (dev->hard_header) {
 774                 int res;
 775                 err = -EINVAL;
 776                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 777                 if (sock->type != SOCK_DGRAM) {
 778                         skb->tail = skb->data;
 779                         skb->len = 0;
 780                 } else if (res < 0)
 781                         goto out_free;
 782         }
 783
 784         /* Returns -EFAULT on error */
 785         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 786         if (err)
 787                 goto out_free;
 788
 789         skb->protocol = proto;
 790         skb->dev = dev;
 791         skb->priority = sk->sk_priority;
 792
 793         /*
 794          *      Now send it
 795          */
 796
 797         err = dev_queue_xmit(skb);
 798         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 799                 goto out_unlock;
 800
 801         dev_put(dev);
 802
 803         return(len);
 804
 805 out_free:
 806         kfree_skb(skb);
 807 out_unlock:
 808         if (dev)
 809                 dev_put(dev);
 810 out:
 811         return err;
 812 }
 813
 814 /*
 815  *      Close a PACKET socket. This is fairly simple. We immediately go
 816  *      to 'closed' state and remove our protocol entry in the device list.
 817  */
 818
 819 static int packet_release(struct socket *sock)
 820 {
 821         struct sock *sk = sock->sk;
 822         struct packet_sock *po;
 823
 824         if (!sk)
 825                 return 0;
 826
 827         po = pkt_sk(sk);
 828
 829         write_lock_bh(&packet_sklist_lock);
 830         sk_del_node_init(sk);
 831         write_unlock_bh(&packet_sklist_lock);
 832
 833         /*
 834          *      Unhook packet receive handler.
 835          */
 836
 837         if (po->running) {
 838                 /*
 839                  *      Remove the protocol hook
 840                  */
 841                 dev_remove_pack(&po->prot_hook);
 842                 po->running = 0;
 843                 po->num = 0;
 844                 __sock_put(sk);
 845         }
 846
 847 #ifdef CONFIG_PACKET_MULTICAST
 848         packet_flush_mclist(sk);
 849 #endif
 850
 851 #ifdef CONFIG_PACKET_MMAP
 852         if (po->pg_vec) {
 853                 struct tpacket_req req;
 854                 memset(&req, 0, sizeof(req));
 855                 packet_set_ring(sk, &req, 1);
 856         }
 857 #endif
 858
 859         /*
 860          *      Now the socket is dead. No more input will appear.
 861          */
 862
 863         sock_orphan(sk);
 864         sock->sk = NULL;
 865
 866         /* Purge queues */
 867
 868         skb_queue_purge(&sk->sk_receive_queue);
 869
 870         sock_put(sk);
 871         return 0;
 872 }
 873
 874 /*
 875  *      Attach a packet hook.
 876  */
 877
 878 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 879 {
 880         struct packet_sock *po = pkt_sk(sk);
 881         /*
 882          *      Detach an existing hook if present.
 883          */
 884
 885         lock_sock(sk);
 886
 887         spin_lock(&po->bind_lock);
 888         if (po->running) {
 889                 __sock_put(sk);
 890                 po->running = 0;
 891                 po->num = 0;
 892                 spin_unlock(&po->bind_lock);
 893                 dev_remove_pack(&po->prot_hook);
 894                 spin_lock(&po->bind_lock);
 895         }
 896
 897         po->num = protocol;
 898         po->prot_hook.type = protocol;
 899         po->prot_hook.dev = dev;
 900
 901         po->ifindex = dev ? dev->ifindex : 0;
 902
 903         if (protocol == 0)
 904                 goto out_unlock;
 905
 906         if (dev) {
 907                 if (dev->flags&IFF_UP) {
 908                         dev_add_pack(&po->prot_hook);
 909                         sock_hold(sk);
 910                         po->running = 1;
 911                 } else {
 912                         sk->sk_err = ENETDOWN;
 913                         if (!sock_flag(sk, SOCK_DEAD))
 914                                 sk->sk_error_report(sk);
 915                 }
 916         } else {
 917                 dev_add_pack(&po->prot_hook);
 918                 sock_hold(sk);
 919                 po->running = 1;
 920         }
 921
 922 out_unlock:
 923         spin_unlock(&po->bind_lock);
 924         release_sock(sk);
 925         return 0;
 926 }
 927
 928 /*
 929  *      Bind a packet socket to a device
 930  */
 931
 932 #ifdef CONFIG_SOCK_PACKET
 933
 934 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 935 {
 936         struct sock *sk=sock->sk;
 937         char name[15];
 938         struct net_device *dev;
 939         int err = -ENODEV;
 940
 941         /*
 942          *      Check legality
 943          */
 944
 945         if (addr_len != sizeof(struct sockaddr))
 946                 return -EINVAL;
 947         strlcpy(name,uaddr->sa_data,sizeof(name));
 948
 949         dev = dev_get_by_name(name);
 950         if (dev) {
 951                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 952                 dev_put(dev);
 953         }
 954         return err;
 955 }
 956 #endif
 957
 958 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 959 {
 960         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 961         struct sock *sk=sock->sk;
 962         struct net_device *dev = NULL;
 963         int err;
 964
 965
 966         /*
 967          *      Check legality
 968          */
 969
 970         if (addr_len < sizeof(struct sockaddr_ll))
 971                 return -EINVAL;
 972         if (sll->sll_family != AF_PACKET)
 973                 return -EINVAL;
 974
 975         if (sll->sll_ifindex) {
 976                 err = -ENODEV;
 977                 dev = dev_get_by_index(sll->sll_ifindex);
 978                 if (dev == NULL)
 979                         goto out;
 980         }
 981         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 982         if (dev)
 983                 dev_put(dev);
 984
 985 out:
 986         return err;
 987 }
 988
 989 static struct proto packet_proto = {
 990         .name     = "PACKET",
 991         .owner    = THIS_MODULE,
 992         .obj_size = sizeof(struct packet_sock),
 993 };
 994
 995 /*
 996  *      Create a packet of type SOCK_PACKET.
 997  */
 998
 999 static int packet_create(struct socket *sock, int protocol)
1000 {
1001         struct sock *sk;
1002         struct packet_sock *po;
1003         __be16 proto = (__force __be16)protocol; /* weird, but documented */
1004         int err;
1005
1006         if (!capable(CAP_NET_RAW))
1007                 return -EPERM;
1008         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
1009 #ifdef CONFIG_SOCK_PACKET
1010             && sock->type != SOCK_PACKET
1011 #endif
1012             )
1013                 return -ESOCKTNOSUPPORT;
1014
1015         sock->state = SS_UNCONNECTED;
1016
1017         err = -ENOBUFS;
1018         sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1019         if (sk == NULL)
1020                 goto out;
1021
1022         sock->ops = &packet_ops;
1023 #ifdef CONFIG_SOCK_PACKET
1024         if (sock->type == SOCK_PACKET)
1025                 sock->ops = &packet_ops_spkt;
1026 #endif
1027         sock_init_data(sock, sk);
1028
1029         po = pkt_sk(sk);
1030         sk->sk_family = PF_PACKET;
1031         po->num = proto;
1032
1033         sk->sk_destruct = packet_sock_destruct;
1034         atomic_inc(&packet_socks_nr);
1035
1036         /*
1037          *      Attach a protocol block
1038          */
1039
1040         spin_lock_init(&po->bind_lock);
1041         po->prot_hook.func = packet_rcv;
1042 #ifdef CONFIG_SOCK_PACKET
1043         if (sock->type == SOCK_PACKET)
1044                 po->prot_hook.func = packet_rcv_spkt;
1045 #endif
1046         po->prot_hook.af_packet_priv = sk;
1047
1048         if (proto) {
1049                 po->prot_hook.type = proto;
1050                 dev_add_pack(&po->prot_hook);
1051                 sock_hold(sk);
1052                 po->running = 1;
1053         }
1054
1055         write_lock_bh(&packet_sklist_lock);
1056         sk_add_node(sk, &packet_sklist);
1057         write_unlock_bh(&packet_sklist_lock);
1058         return(0);
1059 out:
1060         return err;
1061 }
1062
1063 /*
1064  *      Pull a packet from our receive queue and hand it to the user.
1065  *      If necessary we block.
1066  */
1067
1068 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1069                           struct msghdr *msg, size_t len, int flags)
1070 {
1071         struct sock *sk = sock->sk;
1072         struct sk_buff *skb;
1073         int copied, err;
1074         struct sockaddr_ll *sll;
1075
1076         err = -EINVAL;
1077         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1078                 goto out;
1079
1080 #if 0
1081         /* What error should we return now? EUNATTACH? */
1082         if (pkt_sk(sk)->ifindex < 0)
1083                 return -ENODEV;
1084 #endif
1085
1086         /*
1087          *      Call the generic datagram receiver. This handles all sorts
1088          *      of horrible races and re-entrancy so we can forget about it
1089          *      in the protocol layers.
1090          *
1091          *      Now it will return ENETDOWN, if device have just gone down,
1092          *      but then it will block.
1093          */
1094
1095         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1096
1097         /*
1098          *      An error occurred so return it. Because skb_recv_datagram()
1099          *      handles the blocking we don't see and worry about blocking
1100          *      retries.
1101          */
1102
1103         if (skb == NULL)
1104                 goto out;
1105
1106         /*
1107          *      If the address length field is there to be filled in, we fill
1108          *      it in now.
1109          */
1110
1111         sll = &PACKET_SKB_CB(skb)->sa.ll;
1112         if (sock->type == SOCK_PACKET)
1113                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1114         else
1115                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1116
1117         /*
1118          *      You lose any data beyond the buffer you gave. If it worries a
1119          *      user program they can ask the device for its MTU anyway.
1120          */
1121
1122         copied = skb->len;
1123         if (copied > len)
1124         {
1125                 copied=len;
1126                 msg->msg_flags|=MSG_TRUNC;
1127         }
1128
1129         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1130         if (err)
1131                 goto out_free;
1132
1133         sock_recv_timestamp(msg, sk, skb);
1134
1135         if (msg->msg_name)
1136                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1137                        msg->msg_namelen);
1138
1139         if (pkt_sk(sk)->auxdata) {
1140                 struct tpacket_auxdata aux;
1141
1142                 aux.tp_status = TP_STATUS_USER;
1143                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1144                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1145                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1146                 aux.tp_snaplen = skb->len;
1147                 aux.tp_mac = 0;
1148                 aux.tp_net = skb->nh.raw - skb->data;
1149
1150                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1151         }
1152
1153         /*
1154          *      Free or return the buffer as appropriate. Again this
1155          *      hides all the races and re-entrancy issues from us.
1156          */
1157         err = (flags&MSG_TRUNC) ? skb->len : copied;
1158
1159 out_free:
1160         skb_free_datagram(sk, skb);
1161 out:
1162         return err;
1163 }
1164
1165 #ifdef CONFIG_SOCK_PACKET
1166 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1167                                int *uaddr_len, int peer)
1168 {
1169         struct net_device *dev;
1170         struct sock *sk = sock->sk;
1171
1172         if (peer)
1173                 return -EOPNOTSUPP;
1174
1175         uaddr->sa_family = AF_PACKET;
1176         dev = dev_get_by_index(pkt_sk(sk)->ifindex);
1177         if (dev) {
1178                 strlcpy(uaddr->sa_data, dev->name, 15);
1179                 dev_put(dev);
1180         } else
1181                 memset(uaddr->sa_data, 0, 14);
1182         *uaddr_len = sizeof(*uaddr);
1183
1184         return 0;
1185 }
1186 #endif
1187
1188 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1189                           int *uaddr_len, int peer)
1190 {
1191         struct net_device *dev;
1192         struct sock *sk = sock->sk;
1193         struct packet_sock *po = pkt_sk(sk);
1194         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1195
1196         if (peer)
1197                 return -EOPNOTSUPP;
1198
1199         sll->sll_family = AF_PACKET;
1200         sll->sll_ifindex = po->ifindex;
1201         sll->sll_protocol = po->num;
1202         dev = dev_get_by_index(po->ifindex);
1203         if (dev) {
1204                 sll->sll_hatype = dev->type;
1205                 sll->sll_halen = dev->addr_len;
1206                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1207                 dev_put(dev);
1208         } else {
1209                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1210                 sll->sll_halen = 0;
1211         }
1212         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1213
1214         return 0;
1215 }
1216
1217 #ifdef CONFIG_PACKET_MULTICAST
1218 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1219 {
1220         switch (i->type) {
1221         case PACKET_MR_MULTICAST:
1222                 if (what > 0)
1223                         dev_mc_add(dev, i->addr, i->alen, 0);
1224                 else
1225                         dev_mc_delete(dev, i->addr, i->alen, 0);
1226                 break;
1227         case PACKET_MR_PROMISC:
1228                 dev_set_promiscuity(dev, what);
1229                 break;
1230         case PACKET_MR_ALLMULTI:
1231                 dev_set_allmulti(dev, what);
1232                 break;
1233         default:;
1234         }
1235 }
1236
1237 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1238 {
1239         for ( ; i; i=i->next) {
1240                 if (i->ifindex == dev->ifindex)
1241                         packet_dev_mc(dev, i, what);
1242         }
1243 }
1244
1245 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1246 {
1247         struct packet_sock *po = pkt_sk(sk);
1248         struct packet_mclist *ml, *i;
1249         struct net_device *dev;
1250         int err;
1251
1252         rtnl_lock();
1253
1254         err = -ENODEV;
1255         dev = __dev_get_by_index(mreq->mr_ifindex);
1256         if (!dev)
1257                 goto done;
1258
1259         err = -EINVAL;
1260         if (mreq->mr_alen > dev->addr_len)
1261                 goto done;
1262
1263         err = -ENOBUFS;
1264         i = kmalloc(sizeof(*i), GFP_KERNEL);
1265         if (i == NULL)
1266                 goto done;
1267
1268         err = 0;
1269         for (ml = po->mclist; ml; ml = ml->next) {
1270                 if (ml->ifindex == mreq->mr_ifindex &&
1271                     ml->type == mreq->mr_type &&
1272                     ml->alen == mreq->mr_alen &&
1273                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1274                         ml->count++;
1275                         /* Free the new element ... */
1276                         kfree(i);
1277                         goto done;
1278                 }
1279         }
1280
1281         i->type = mreq->mr_type;
1282         i->ifindex = mreq->mr_ifindex;
1283         i->alen = mreq->mr_alen;
1284         memcpy(i->addr, mreq->mr_address, i->alen);
1285         i->count = 1;
1286         i->next = po->mclist;
1287         po->mclist = i;
1288         packet_dev_mc(dev, i, +1);
1289
1290 done:
1291         rtnl_unlock();
1292         return err;
1293 }
1294
1295 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1296 {
1297         struct packet_mclist *ml, **mlp;
1298
1299         rtnl_lock();
1300
1301         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1302                 if (ml->ifindex == mreq->mr_ifindex &&
1303                     ml->type == mreq->mr_type &&
1304                     ml->alen == mreq->mr_alen &&
1305                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1306                         if (--ml->count == 0) {
1307                                 struct net_device *dev;
1308                                 *mlp = ml->next;
1309                                 dev = dev_get_by_index(ml->ifindex);
1310                                 if (dev) {
1311                                         packet_dev_mc(dev, ml, -1);
1312                                         dev_put(dev);
1313                                 }
1314                                 kfree(ml);
1315                         }
1316                         rtnl_unlock();
1317                         return 0;
1318                 }
1319         }
1320         rtnl_unlock();
1321         return -EADDRNOTAVAIL;
1322 }
1323
1324 static void packet_flush_mclist(struct sock *sk)
1325 {
1326         struct packet_sock *po = pkt_sk(sk);
1327         struct packet_mclist *ml;
1328
1329         if (!po->mclist)
1330                 return;
1331
1332         rtnl_lock();
1333         while ((ml = po->mclist) != NULL) {
1334                 struct net_device *dev;
1335
1336                 po->mclist = ml->next;
1337                 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) {
1338                         packet_dev_mc(dev, ml, -1);
1339                         dev_put(dev);
1340                 }
1341                 kfree(ml);
1342         }
1343         rtnl_unlock();
1344 }
1345 #endif
1346
1347 static int
1348 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1349 {
1350         struct sock *sk = sock->sk;
1351         struct packet_sock *po = pkt_sk(sk);
1352         int ret;
1353
1354         if (level != SOL_PACKET)
1355                 return -ENOPROTOOPT;
1356
1357         switch(optname) {
1358 #ifdef CONFIG_PACKET_MULTICAST
1359         case PACKET_ADD_MEMBERSHIP:
1360         case PACKET_DROP_MEMBERSHIP:
1361         {
1362                 struct packet_mreq_max mreq;
1363                 int len = optlen;
1364                 memset(&mreq, 0, sizeof(mreq));
1365                 if (len < sizeof(struct packet_mreq))
1366                         return -EINVAL;
1367                 if (len > sizeof(mreq))
1368                         len = sizeof(mreq);
1369                 if (copy_from_user(&mreq,optval,len))
1370                         return -EFAULT;
1371                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1372                         return -EINVAL;
1373                 if (optname == PACKET_ADD_MEMBERSHIP)
1374                         ret = packet_mc_add(sk, &mreq);
1375                 else
1376                         ret = packet_mc_drop(sk, &mreq);
1377                 return ret;
1378         }
1379 #endif
1380 #ifdef CONFIG_PACKET_MMAP
1381         case PACKET_RX_RING:
1382         {
1383                 struct tpacket_req req;
1384
1385                 if (optlen<sizeof(req))
1386                         return -EINVAL;
1387                 if (copy_from_user(&req,optval,sizeof(req)))
1388                         return -EFAULT;
1389                 return packet_set_ring(sk, &req, 0);
1390         }
1391         case PACKET_COPY_THRESH:
1392         {
1393                 int val;
1394
1395                 if (optlen!=sizeof(val))
1396                         return -EINVAL;
1397                 if (copy_from_user(&val,optval,sizeof(val)))
1398                         return -EFAULT;
1399
1400                 pkt_sk(sk)->copy_thresh = val;
1401                 return 0;
1402         }
1403 #endif
1404         case PACKET_AUXDATA:
1405         {
1406                 int val;
1407
1408                 if (optlen < sizeof(val))
1409                         return -EINVAL;
1410                 if (copy_from_user(&val, optval, sizeof(val)))
1411                         return -EFAULT;
1412
1413                 po->auxdata = !!val;
1414                 return 0;
1415         }
1416         default:
1417                 return -ENOPROTOOPT;
1418         }
1419 }
1420
1421 static int packet_getsockopt(struct socket *sock, int level, int optname,
1422                              char __user *optval, int __user *optlen)
1423 {
1424         int len;
1425         int val;
1426         struct sock *sk = sock->sk;
1427         struct packet_sock *po = pkt_sk(sk);
1428         void *data;
1429         struct tpacket_stats st;
1430
1431         if (level != SOL_PACKET)
1432                 return -ENOPROTOOPT;
1433
1434         if (get_user(len, optlen))
1435                 return -EFAULT;
1436
1437         if (len < 0)
1438                 return -EINVAL;
1439
1440         switch(optname) {
1441         case PACKET_STATISTICS:
1442                 if (len > sizeof(struct tpacket_stats))
1443                         len = sizeof(struct tpacket_stats);
1444                 spin_lock_bh(&sk->sk_receive_queue.lock);
1445                 st = po->stats;
1446                 memset(&po->stats, 0, sizeof(st));
1447                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1448                 st.tp_packets += st.tp_drops;
1449
1450                 data = &st;
1451                 break;
1452         case PACKET_AUXDATA:
1453                 if (len > sizeof(int))
1454                         len = sizeof(int);
1455                 val = po->auxdata;
1456
1457                 data = &val;
1458                 break;
1459         default:
1460                 return -ENOPROTOOPT;
1461         }
1462
1463         if (put_user(len, optlen))
1464                 return -EFAULT;
1465         if (copy_to_user(optval, data, len))
1466                 return -EFAULT;
1467         return 0;
1468 }
1469
1470
1471 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1472 {
1473         struct sock *sk;
1474         struct hlist_node *node;
1475         struct net_device *dev = data;
1476
1477         read_lock(&packet_sklist_lock);
1478         sk_for_each(sk, node, &packet_sklist) {
1479                 struct packet_sock *po = pkt_sk(sk);
1480
1481                 switch (msg) {
1482                 case NETDEV_UNREGISTER:
1483 #ifdef CONFIG_PACKET_MULTICAST
1484                         if (po->mclist)
1485                                 packet_dev_mclist(dev, po->mclist, -1);
1486                         // fallthrough
1487 #endif
1488                 case NETDEV_DOWN:
1489                         if (dev->ifindex == po->ifindex) {
1490                                 spin_lock(&po->bind_lock);
1491                                 if (po->running) {
1492                                         __dev_remove_pack(&po->prot_hook);
1493                                         __sock_put(sk);
1494                                         po->running = 0;
1495                                         sk->sk_err = ENETDOWN;
1496                                         if (!sock_flag(sk, SOCK_DEAD))
1497                                                 sk->sk_error_report(sk);
1498                                 }
1499                                 if (msg == NETDEV_UNREGISTER) {
1500                                         po->ifindex = -1;
1501                                         po->prot_hook.dev = NULL;
1502                                 }
1503                                 spin_unlock(&po->bind_lock);
1504                         }
1505                         break;
1506                 case NETDEV_UP:
1507                         spin_lock(&po->bind_lock);
1508                         if (dev->ifindex == po->ifindex && po->num &&
1509                             !po->running) {
1510                                 dev_add_pack(&po->prot_hook);
1511                                 sock_hold(sk);
1512                                 po->running = 1;
1513                         }
1514                         spin_unlock(&po->bind_lock);
1515                         break;
1516                 }
1517         }
1518         read_unlock(&packet_sklist_lock);
1519         return NOTIFY_DONE;
1520 }
1521
1522
1523 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1524                         unsigned long arg)
1525 {
1526         struct sock *sk = sock->sk;
1527
1528         switch(cmd) {
1529                 case SIOCOUTQ:
1530                 {
1531                         int amount = atomic_read(&sk->sk_wmem_alloc);
1532                         return put_user(amount, (int __user *)arg);
1533                 }
1534                 case SIOCINQ:
1535                 {
1536                         struct sk_buff *skb;
1537                         int amount = 0;
1538
1539                         spin_lock_bh(&sk->sk_receive_queue.lock);
1540                         skb = skb_peek(&sk->sk_receive_queue);
1541                         if (skb)
1542                                 amount = skb->len;
1543                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1544                         return put_user(amount, (int __user *)arg);
1545                 }
1546                 case SIOCGSTAMP:
1547                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1548                 case SIOCGSTAMPNS:
1549                         return sock_get_timestampns(sk, (struct timespec __user *)arg);
1550
1551 #ifdef CONFIG_INET
1552                 case SIOCADDRT:
1553                 case SIOCDELRT:
1554                 case SIOCDARP:
1555                 case SIOCGARP:
1556                 case SIOCSARP:
1557                 case SIOCGIFADDR:
1558                 case SIOCSIFADDR:
1559                 case SIOCGIFBRDADDR:
1560                 case SIOCSIFBRDADDR:
1561                 case SIOCGIFNETMASK:
1562                 case SIOCSIFNETMASK:
1563                 case SIOCGIFDSTADDR:
1564                 case SIOCSIFDSTADDR:
1565                 case SIOCSIFFLAGS:
1566                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1567 #endif
1568
1569                 default:
1570                         return -ENOIOCTLCMD;
1571         }
1572         return 0;
1573 }
1574
1575 #ifndef CONFIG_PACKET_MMAP
1576 #define packet_mmap sock_no_mmap
1577 #define packet_poll datagram_poll
1578 #else
1579
1580 static unsigned int packet_poll(struct file * file, struct socket *sock,
1581                                 poll_table *wait)
1582 {
1583         struct sock *sk = sock->sk;
1584         struct packet_sock *po = pkt_sk(sk);
1585         unsigned int mask = datagram_poll(file, sock, wait);
1586
1587         spin_lock_bh(&sk->sk_receive_queue.lock);
1588         if (po->pg_vec) {
1589                 unsigned last = po->head ? po->head-1 : po->frame_max;
1590                 struct tpacket_hdr *h;
1591
1592                 h = packet_lookup_frame(po, last);
1593
1594                 if (h->tp_status)
1595                         mask |= POLLIN | POLLRDNORM;
1596         }
1597         spin_unlock_bh(&sk->sk_receive_queue.lock);
1598         return mask;
1599 }
1600
1601
1602 /* Dirty? Well, I still did not learn better way to account
1603  * for user mmaps.
1604  */
1605
1606 static void packet_mm_open(struct vm_area_struct *vma)
1607 {
1608         struct file *file = vma->vm_file;
1609         struct socket * sock = file->private_data;
1610         struct sock *sk = sock->sk;
1611
1612         if (sk)
1613                 atomic_inc(&pkt_sk(sk)->mapped);
1614 }
1615
1616 static void packet_mm_close(struct vm_area_struct *vma)
1617 {
1618         struct file *file = vma->vm_file;
1619         struct socket * sock = file->private_data;
1620         struct sock *sk = sock->sk;
1621
1622         if (sk)
1623                 atomic_dec(&pkt_sk(sk)->mapped);
1624 }
1625
1626 static struct vm_operations_struct packet_mmap_ops = {
1627         .open = packet_mm_open,
1628         .close =packet_mm_close,
1629 };
1630
1631 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1632 {
1633         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1634 }
1635
1636 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1637 {
1638         int i;
1639
1640         for (i = 0; i < len; i++) {
1641                 if (likely(pg_vec[i]))
1642                         free_pages((unsigned long) pg_vec[i], order);
1643         }
1644         kfree(pg_vec);
1645 }
1646
1647 static inline char *alloc_one_pg_vec_page(unsigned long order)
1648 {
1649         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1650                                          order);
1651 }
1652
1653 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1654 {
1655         unsigned int block_nr = req->tp_block_nr;
1656         char **pg_vec;
1657         int i;
1658
1659         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1660         if (unlikely(!pg_vec))
1661                 goto out;
1662
1663         for (i = 0; i < block_nr; i++) {
1664                 pg_vec[i] = alloc_one_pg_vec_page(order);
1665                 if (unlikely(!pg_vec[i]))
1666                         goto out_free_pgvec;
1667         }
1668
1669 out:
1670         return pg_vec;
1671
1672 out_free_pgvec:
1673         free_pg_vec(pg_vec, order, block_nr);
1674         pg_vec = NULL;
1675         goto out;
1676 }
1677
1678 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1679 {
1680         char **pg_vec = NULL;
1681         struct packet_sock *po = pkt_sk(sk);
1682         int was_running, order = 0;
1683         __be16 num;
1684         int err = 0;
1685
1686         if (req->tp_block_nr) {
1687                 int i, l;
1688
1689                 /* Sanity tests and some calculations */
1690
1691                 if (unlikely(po->pg_vec))
1692                         return -EBUSY;
1693
1694                 if (unlikely((int)req->tp_block_size <= 0))
1695                         return -EINVAL;
1696                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1697                         return -EINVAL;
1698                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1699                         return -EINVAL;
1700                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1701                         return -EINVAL;
1702
1703                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1704                 if (unlikely(po->frames_per_block <= 0))
1705                         return -EINVAL;
1706                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1707                              req->tp_frame_nr))
1708                         return -EINVAL;
1709
1710                 err = -ENOMEM;
1711                 order = get_order(req->tp_block_size);
1712                 pg_vec = alloc_pg_vec(req, order);
1713                 if (unlikely(!pg_vec))
1714                         goto out;
1715
1716                 l = 0;
1717                 for (i = 0; i < req->tp_block_nr; i++) {
1718                         char *ptr = pg_vec[i];
1719                         struct tpacket_hdr *header;
1720                         int k;
1721
1722                         for (k = 0; k < po->frames_per_block; k++) {
1723                                 header = (struct tpacket_hdr *) ptr;
1724                                 header->tp_status = TP_STATUS_KERNEL;
1725                                 ptr += req->tp_frame_size;
1726                         }
1727                 }
1728                 /* Done */
1729         } else {
1730                 if (unlikely(req->tp_frame_nr))
1731                         return -EINVAL;
1732         }
1733
1734         lock_sock(sk);
1735
1736         /* Detach socket from network */
1737         spin_lock(&po->bind_lock);
1738         was_running = po->running;
1739         num = po->num;
1740         if (was_running) {
1741                 __dev_remove_pack(&po->prot_hook);
1742                 po->num = 0;
1743                 po->running = 0;
1744                 __sock_put(sk);
1745         }
1746         spin_unlock(&po->bind_lock);
1747
1748         synchronize_net();
1749
1750         err = -EBUSY;
1751         if (closing || atomic_read(&po->mapped) == 0) {
1752                 err = 0;
1753 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1754
1755                 spin_lock_bh(&sk->sk_receive_queue.lock);
1756                 pg_vec = XC(po->pg_vec, pg_vec);
1757                 po->frame_max = (req->tp_frame_nr - 1);
1758                 po->head = 0;
1759                 po->frame_size = req->tp_frame_size;
1760                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1761
1762                 order = XC(po->pg_vec_order, order);
1763                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1764
1765                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1766                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1767                 skb_queue_purge(&sk->sk_receive_queue);
1768 #undef XC
1769                 if (atomic_read(&po->mapped))
1770                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1771         }
1772
1773         spin_lock(&po->bind_lock);
1774         if (was_running && !po->running) {
1775                 sock_hold(sk);
1776                 po->running = 1;
1777                 po->num = num;
1778                 dev_add_pack(&po->prot_hook);
1779         }
1780         spin_unlock(&po->bind_lock);
1781
1782         release_sock(sk);
1783
1784         if (pg_vec)
1785                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1786 out:
1787         return err;
1788 }
1789
1790 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1791 {
1792         struct sock *sk = sock->sk;
1793         struct packet_sock *po = pkt_sk(sk);
1794         unsigned long size;
1795         unsigned long start;
1796         int err = -EINVAL;
1797         int i;
1798
1799         if (vma->vm_pgoff)
1800                 return -EINVAL;
1801
1802         size = vma->vm_end - vma->vm_start;
1803
1804         lock_sock(sk);
1805         if (po->pg_vec == NULL)
1806                 goto out;
1807         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1808                 goto out;
1809
1810         start = vma->vm_start;
1811         for (i = 0; i < po->pg_vec_len; i++) {
1812                 struct page *page = virt_to_page(po->pg_vec[i]);
1813                 int pg_num;
1814
1815                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1816                         err = vm_insert_page(vma, start, page);
1817                         if (unlikely(err))
1818                                 goto out;
1819                         start += PAGE_SIZE;
1820                 }
1821         }
1822         atomic_inc(&po->mapped);
1823         vma->vm_ops = &packet_mmap_ops;
1824         err = 0;
1825
1826 out:
1827         release_sock(sk);
1828         return err;
1829 }
1830 #endif
1831
1832
1833 #ifdef CONFIG_SOCK_PACKET
1834 static const struct proto_ops packet_ops_spkt = {
1835         .family =       PF_PACKET,
1836         .owner =        THIS_MODULE,
1837         .release =      packet_release,
1838         .bind =         packet_bind_spkt,
1839         .connect =      sock_no_connect,
1840         .socketpair =   sock_no_socketpair,
1841         .accept =       sock_no_accept,
1842         .getname =      packet_getname_spkt,
1843         .poll =         datagram_poll,
1844         .ioctl =        packet_ioctl,
1845         .listen =       sock_no_listen,
1846         .shutdown =     sock_no_shutdown,
1847         .setsockopt =   sock_no_setsockopt,
1848         .getsockopt =   sock_no_getsockopt,
1849         .sendmsg =      packet_sendmsg_spkt,
1850         .recvmsg =      packet_recvmsg,
1851         .mmap =         sock_no_mmap,
1852         .sendpage =     sock_no_sendpage,
1853 };
1854 #endif
1855
1856 static const struct proto_ops packet_ops = {
1857         .family =       PF_PACKET,
1858         .owner =        THIS_MODULE,
1859         .release =      packet_release,
1860         .bind =         packet_bind,
1861         .connect =      sock_no_connect,
1862         .socketpair =   sock_no_socketpair,
1863         .accept =       sock_no_accept,
1864         .getname =      packet_getname,
1865         .poll =         packet_poll,
1866         .ioctl =        packet_ioctl,
1867         .listen =       sock_no_listen,
1868         .shutdown =     sock_no_shutdown,
1869         .setsockopt =   packet_setsockopt,
1870         .getsockopt =   packet_getsockopt,
1871         .sendmsg =      packet_sendmsg,
1872         .recvmsg =      packet_recvmsg,
1873         .mmap =         packet_mmap,
1874         .sendpage =     sock_no_sendpage,
1875 };
1876
1877 static struct net_proto_family packet_family_ops = {
1878         .family =       PF_PACKET,
1879         .create =       packet_create,
1880         .owner  =       THIS_MODULE,
1881 };
1882
1883 static struct notifier_block packet_netdev_notifier = {
1884         .notifier_call =packet_notifier,
1885 };
1886
1887 #ifdef CONFIG_PROC_FS
1888 static inline struct sock *packet_seq_idx(loff_t off)
1889 {
1890         struct sock *s;
1891         struct hlist_node *node;
1892
1893         sk_for_each(s, node, &packet_sklist) {
1894                 if (!off--)
1895                         return s;
1896         }
1897         return NULL;
1898 }
1899
1900 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1901 {
1902         read_lock(&packet_sklist_lock);
1903         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1904 }
1905
1906 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1907 {
1908         ++*pos;
1909         return  (v == SEQ_START_TOKEN)
1910                 ? sk_head(&packet_sklist)
1911                 : sk_next((struct sock*)v) ;
1912 }
1913
1914 static void packet_seq_stop(struct seq_file *seq, void *v)
1915 {
1916         read_unlock(&packet_sklist_lock);
1917 }
1918
1919 static int packet_seq_show(struct seq_file *seq, void *v)
1920 {
1921         if (v == SEQ_START_TOKEN)
1922                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1923         else {
1924                 struct sock *s = v;
1925                 const struct packet_sock *po = pkt_sk(s);
1926
1927                 seq_printf(seq,
1928                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1929                            s,
1930                            atomic_read(&s->sk_refcnt),
1931                            s->sk_type,
1932                            ntohs(po->num),
1933                            po->ifindex,
1934                            po->running,
1935                            atomic_read(&s->sk_rmem_alloc),
1936                            sock_i_uid(s),
1937                            sock_i_ino(s) );
1938         }
1939
1940         return 0;
1941 }
1942
1943 static struct seq_operations packet_seq_ops = {
1944         .start  = packet_seq_start,
1945         .next   = packet_seq_next,
1946         .stop   = packet_seq_stop,
1947         .show   = packet_seq_show,
1948 };
1949
1950 static int packet_seq_open(struct inode *inode, struct file *file)
1951 {
1952         return seq_open(file, &packet_seq_ops);
1953 }
1954
1955 static const struct file_operations packet_seq_fops = {
1956         .owner          = THIS_MODULE,
1957         .open           = packet_seq_open,
1958         .read           = seq_read,
1959         .llseek         = seq_lseek,
1960         .release        = seq_release,
1961 };
1962
1963 #endif
1964
1965 static void __exit packet_exit(void)
1966 {
1967         proc_net_remove("packet");
1968         unregister_netdevice_notifier(&packet_netdev_notifier);
1969         sock_unregister(PF_PACKET);
1970         proto_unregister(&packet_proto);
1971 }
1972
1973 static int __init packet_init(void)
1974 {
1975         int rc = proto_register(&packet_proto, 0);
1976
1977         if (rc != 0)
1978                 goto out;
1979
1980         sock_register(&packet_family_ops);
1981         register_netdevice_notifier(&packet_netdev_notifier);
1982         proc_net_fops_create("packet", 0, &packet_seq_fops);
1983 out:
1984         return rc;
1985 }
1986
1987 module_init(packet_init);
1988 module_exit(packet_exit);
1989 MODULE_LICENSE("GPL");
1990 MODULE_ALIAS_NETPROTO(PF_PACKET);