SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/mm.h>
  54 #include <linux/capability.h>
  55 #include <linux/fcntl.h>
  56 #include <linux/socket.h>
  57 #include <linux/in.h>
  58 #include <linux/inet.h>
  59 #include <linux/netdevice.h>
  60 #include <linux/if_packet.h>
  61 #include <linux/wireless.h>
  62 #include <linux/kernel.h>
  63 #include <linux/kmod.h>
  64 #include <net/net_namespace.h>
  65 #include <net/ip.h>
  66 #include <net/protocol.h>
  67 #include <linux/skbuff.h>
  68 #include <net/sock.h>
  69 #include <linux/errno.h>
  70 #include <linux/timer.h>
  71 #include <asm/system.h>
  72 #include <asm/uaccess.h>
  73 #include <asm/ioctls.h>
  74 #include <asm/page.h>
  75 #include <asm/cacheflush.h>
  76 #include <asm/io.h>
  77 #include <linux/proc_fs.h>
  78 #include <linux/seq_file.h>
  79 #include <linux/poll.h>
  80 #include <linux/module.h>
  81 #include <linux/init.h>
  82
  83 #ifdef CONFIG_INET
  84 #include <net/inet_common.h>
  85 #endif
  86
  87 /*
  88    Assumptions:
  89    - if device has no dev->hard_header routine, it adds and removes ll header
  90      inside itself. In this case ll header is invisible outside of device,
  91      but higher levels still should reserve dev->hard_header_len.
  92      Some devices are enough clever to reallocate skb, when header
  93      will not fit to reserved space (tunnel), another ones are silly
  94      (PPP).
  95    - packet socket receives packets with pulled ll header,
  96      so that SOCK_RAW should push it back.
  97
  98 On receive:
  99 -----------
 100
 101 Incoming, dev->hard_header!=NULL
 102    mac_header -> ll header
 103    data       -> data
 104
 105 Outgoing, dev->hard_header!=NULL
 106    mac_header -> ll header
 107    data       -> ll header
 108
 109 Incoming, dev->hard_header==NULL
 110    mac_header -> UNKNOWN position. It is very likely, that it points to ll
 111                  header.  PPP makes it, that is wrong, because introduce
 112                  assymetry between rx and tx paths.
 113    data       -> data
 114
 115 Outgoing, dev->hard_header==NULL
 116    mac_header -> data. ll header is still not built!
 117    data       -> data
 118
 119 Resume
 120   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 121
 122
 123 On transmit:
 124 ------------
 125
 126 dev->hard_header != NULL
 127    mac_header -> ll header
 128    data       -> ll header
 129
 130 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 131    mac_header -> data
 132    data       -> data
 133
 134    We should set nh.raw on output to correct posistion,
 135    packet classifier depends on it.
 136  */
 137
 138 /* List of all packet sockets. */
 139 static HLIST_HEAD(packet_sklist);
 140 static DEFINE_RWLOCK(packet_sklist_lock);
 141
 142 static atomic_t packet_socks_nr;
 143
 144
 145 /* Private packet socket structures. */
 146
 147 struct packet_mclist
 148 {
 149         struct packet_mclist    *next;
 150         int                     ifindex;
 151         int                     count;
 152         unsigned short          type;
 153         unsigned short          alen;
 154         unsigned char           addr[MAX_ADDR_LEN];
 155 };
 156 /* identical to struct packet_mreq except it has
 157  * a longer address field.
 158  */
 159 struct packet_mreq_max
 160 {
 161         int             mr_ifindex;
 162         unsigned short  mr_type;
 163         unsigned short  mr_alen;
 164         unsigned char   mr_address[MAX_ADDR_LEN];
 165 };
 166
 167 #ifdef CONFIG_PACKET_MMAP
 168 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 169 #endif
 170
 171 static void packet_flush_mclist(struct sock *sk);
 172
 173 struct packet_sock {
 174         /* struct sock has to be the first member of packet_sock */
 175         struct sock             sk;
 176         struct tpacket_stats    stats;
 177 #ifdef CONFIG_PACKET_MMAP
 178         char *                  *pg_vec;
 179         unsigned int            head;
 180         unsigned int            frames_per_block;
 181         unsigned int            frame_size;
 182         unsigned int            frame_max;
 183         int                     copy_thresh;
 184 #endif
 185         struct packet_type      prot_hook;
 186         spinlock_t              bind_lock;
 187         unsigned int            running:1,      /* prot_hook is attached*/
 188                                 auxdata:1,
 189                                 origdev:1;
 190         int                     ifindex;        /* bound device         */
 191         __be16                  num;
 192         struct packet_mclist    *mclist;
 193 #ifdef CONFIG_PACKET_MMAP
 194         atomic_t                mapped;
 195         unsigned int            pg_vec_order;
 196         unsigned int            pg_vec_pages;
 197         unsigned int            pg_vec_len;
 198 #endif
 199 };
 200
 201 struct packet_skb_cb {
 202         unsigned int origlen;
 203         union {
 204                 struct sockaddr_pkt pkt;
 205                 struct sockaddr_ll ll;
 206         } sa;
 207 };
 208
 209 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 210
 211 #ifdef CONFIG_PACKET_MMAP
 212
 213 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 214 {
 215         unsigned int pg_vec_pos, frame_offset;
 216
 217         pg_vec_pos = position / po->frames_per_block;
 218         frame_offset = position % po->frames_per_block;
 219
 220         return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
 221 }
 222 #endif
 223
 224 static inline struct packet_sock *pkt_sk(struct sock *sk)
 225 {
 226         return (struct packet_sock *)sk;
 227 }
 228
 229 static void packet_sock_destruct(struct sock *sk)
 230 {
 231         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 232         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 233
 234         if (!sock_flag(sk, SOCK_DEAD)) {
 235                 printk("Attempt to release alive packet socket: %p\n", sk);
 236                 return;
 237         }
 238
 239         atomic_dec(&packet_socks_nr);
 240 #ifdef PACKET_REFCNT_DEBUG
 241         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 242 #endif
 243 }
 244
 245
 246 static const struct proto_ops packet_ops;
 247
 248 static const struct proto_ops packet_ops_spkt;
 249
 250 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 251 {
 252         struct sock *sk;
 253         struct sockaddr_pkt *spkt;
 254
 255         if (dev->nd_net != &init_net)
 256                 goto out;
 257
 258         /*
 259          *      When we registered the protocol we saved the socket in the data
 260          *      field for just this event.
 261          */
 262
 263         sk = pt->af_packet_priv;
 264
 265         /*
 266          *      Yank back the headers [hope the device set this
 267          *      right or kerboom...]
 268          *
 269          *      Incoming packets have ll header pulled,
 270          *      push it back.
 271          *
 272          *      For outgoing ones skb->data == skb_mac_header(skb)
 273          *      so that this procedure is noop.
 274          */
 275
 276         if (skb->pkt_type == PACKET_LOOPBACK)
 277                 goto out;
 278
 279         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 280                 goto oom;
 281
 282         /* drop any routing info */
 283         dst_release(skb->dst);
 284         skb->dst = NULL;
 285
 286         /* drop conntrack reference */
 287         nf_reset(skb);
 288
 289         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 290
 291         skb_push(skb, skb->data - skb_mac_header(skb));
 292
 293         /*
 294          *      The SOCK_PACKET socket receives _all_ frames.
 295          */
 296
 297         spkt->spkt_family = dev->type;
 298         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 299         spkt->spkt_protocol = skb->protocol;
 300
 301         /*
 302          *      Charge the memory to the socket. This is done specifically
 303          *      to prevent sockets using all the memory up.
 304          */
 305
 306         if (sock_queue_rcv_skb(sk,skb) == 0)
 307                 return 0;
 308
 309 out:
 310         kfree_skb(skb);
 311 oom:
 312         return 0;
 313 }
 314
 315
 316 /*
 317  *      Output a raw packet to a device layer. This bypasses all the other
 318  *      protocol layers and you must therefore supply it with a complete frame
 319  */
 320
 321 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 322                                struct msghdr *msg, size_t len)
 323 {
 324         struct sock *sk = sock->sk;
 325         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 326         struct sk_buff *skb;
 327         struct net_device *dev;
 328         __be16 proto=0;
 329         int err;
 330
 331         /*
 332          *      Get and verify the address.
 333          */
 334
 335         if (saddr)
 336         {
 337                 if (msg->msg_namelen < sizeof(struct sockaddr))
 338                         return(-EINVAL);
 339                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 340                         proto=saddr->spkt_protocol;
 341         }
 342         else
 343                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 344
 345         /*
 346          *      Find the device first to size check it
 347          */
 348
 349         saddr->spkt_device[13] = 0;
 350         dev = dev_get_by_name(&init_net, saddr->spkt_device);
 351         err = -ENODEV;
 352         if (dev == NULL)
 353                 goto out_unlock;
 354
 355         err = -ENETDOWN;
 356         if (!(dev->flags & IFF_UP))
 357                 goto out_unlock;
 358
 359         /*
 360          *      You may not queue a frame bigger than the mtu. This is the lowest level
 361          *      raw protocol and you must do your own fragmentation at this level.
 362          */
 363
 364         err = -EMSGSIZE;
 365         if (len > dev->mtu + dev->hard_header_len)
 366                 goto out_unlock;
 367
 368         err = -ENOBUFS;
 369         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 370
 371         /*
 372          *      If the write buffer is full, then tough. At this level the user gets to
 373          *      deal with the problem - do your own algorithmic backoffs. That's far
 374          *      more flexible.
 375          */
 376
 377         if (skb == NULL)
 378                 goto out_unlock;
 379
 380         /*
 381          *      Fill it in
 382          */
 383
 384         /* FIXME: Save some space for broken drivers that write a
 385          * hard header at transmission time by themselves. PPP is the
 386          * notable one here. This should really be fixed at the driver level.
 387          */
 388         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 389         skb_reset_network_header(skb);
 390
 391         /* Try to align data part correctly */
 392         if (dev->header_ops) {
 393                 skb->data -= dev->hard_header_len;
 394                 skb->tail -= dev->hard_header_len;
 395                 if (len < dev->hard_header_len)
 396                         skb_reset_network_header(skb);
 397         }
 398
 399         /* Returns -EFAULT on error */
 400         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 401         skb->protocol = proto;
 402         skb->dev = dev;
 403         skb->priority = sk->sk_priority;
 404         if (err)
 405                 goto out_free;
 406
 407         /*
 408          *      Now send it
 409          */
 410
 411         dev_queue_xmit(skb);
 412         dev_put(dev);
 413         return(len);
 414
 415 out_free:
 416         kfree_skb(skb);
 417 out_unlock:
 418         if (dev)
 419                 dev_put(dev);
 420         return err;
 421 }
 422
 423 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 424                                       unsigned int res)
 425 {
 426         struct sk_filter *filter;
 427
 428         rcu_read_lock_bh();
 429         filter = rcu_dereference(sk->sk_filter);
 430         if (filter != NULL)
 431                 res = sk_run_filter(skb, filter->insns, filter->len);
 432         rcu_read_unlock_bh();
 433
 434         return res;
 435 }
 436
 437 /*
 438    This function makes lazy skb cloning in hope that most of packets
 439    are discarded by BPF.
 440
 441    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 442    and skb->cb are mangled. It works because (and until) packets
 443    falling here are owned by current CPU. Output packets are cloned
 444    by dev_queue_xmit_nit(), input packets are processed by net_bh
 445    sequencially, so that if we return skb to original state on exit,
 446    we will not harm anyone.
 447  */
 448
 449 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 450 {
 451         struct sock *sk;
 452         struct sockaddr_ll *sll;
 453         struct packet_sock *po;
 454         u8 * skb_head = skb->data;
 455         int skb_len = skb->len;
 456         unsigned int snaplen, res;
 457
 458         if (dev->nd_net != &init_net)
 459                 goto drop;
 460
 461         if (skb->pkt_type == PACKET_LOOPBACK)
 462                 goto drop;
 463
 464         sk = pt->af_packet_priv;
 465         po = pkt_sk(sk);
 466
 467         skb->dev = dev;
 468
 469         if (dev->header_ops) {
 470                 /* The device has an explicit notion of ll header,
 471                    exported to higher levels.
 472
 473                    Otherwise, the device hides datails of it frame
 474                    structure, so that corresponding packet head
 475                    never delivered to user.
 476                  */
 477                 if (sk->sk_type != SOCK_DGRAM)
 478                         skb_push(skb, skb->data - skb_mac_header(skb));
 479                 else if (skb->pkt_type == PACKET_OUTGOING) {
 480                         /* Special case: outgoing packets have ll header at head */
 481                         skb_pull(skb, skb_network_offset(skb));
 482                 }
 483         }
 484
 485         snaplen = skb->len;
 486
 487         res = run_filter(skb, sk, snaplen);
 488         if (!res)
 489                 goto drop_n_restore;
 490         if (snaplen > res)
 491                 snaplen = res;
 492
 493         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 494             (unsigned)sk->sk_rcvbuf)
 495                 goto drop_n_acct;
 496
 497         if (skb_shared(skb)) {
 498                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 499                 if (nskb == NULL)
 500                         goto drop_n_acct;
 501
 502                 if (skb_head != skb->data) {
 503                         skb->data = skb_head;
 504                         skb->len = skb_len;
 505                 }
 506                 kfree_skb(skb);
 507                 skb = nskb;
 508         }
 509
 510         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 511                      sizeof(skb->cb));
 512
 513         sll = &PACKET_SKB_CB(skb)->sa.ll;
 514         sll->sll_family = AF_PACKET;
 515         sll->sll_hatype = dev->type;
 516         sll->sll_protocol = skb->protocol;
 517         sll->sll_pkttype = skb->pkt_type;
 518         if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
 519                 sll->sll_ifindex = orig_dev->ifindex;
 520         else
 521                 sll->sll_ifindex = dev->ifindex;
 522
 523         sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
 524
 525         PACKET_SKB_CB(skb)->origlen = skb->len;
 526
 527         if (pskb_trim(skb, snaplen))
 528                 goto drop_n_acct;
 529
 530         skb_set_owner_r(skb, sk);
 531         skb->dev = NULL;
 532         dst_release(skb->dst);
 533         skb->dst = NULL;
 534
 535         /* drop conntrack reference */
 536         nf_reset(skb);
 537
 538         spin_lock(&sk->sk_receive_queue.lock);
 539         po->stats.tp_packets++;
 540         __skb_queue_tail(&sk->sk_receive_queue, skb);
 541         spin_unlock(&sk->sk_receive_queue.lock);
 542         sk->sk_data_ready(sk, skb->len);
 543         return 0;
 544
 545 drop_n_acct:
 546         spin_lock(&sk->sk_receive_queue.lock);
 547         po->stats.tp_drops++;
 548         spin_unlock(&sk->sk_receive_queue.lock);
 549
 550 drop_n_restore:
 551         if (skb_head != skb->data && skb_shared(skb)) {
 552                 skb->data = skb_head;
 553                 skb->len = skb_len;
 554         }
 555 drop:
 556         kfree_skb(skb);
 557         return 0;
 558 }
 559
 560 #ifdef CONFIG_PACKET_MMAP
 561 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 562 {
 563         struct sock *sk;
 564         struct packet_sock *po;
 565         struct sockaddr_ll *sll;
 566         struct tpacket_hdr *h;
 567         u8 * skb_head = skb->data;
 568         int skb_len = skb->len;
 569         unsigned int snaplen, res;
 570         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 571         unsigned short macoff, netoff;
 572         struct sk_buff *copy_skb = NULL;
 573         struct timeval tv;
 574
 575         if (dev->nd_net != &init_net)
 576                 goto drop;
 577
 578         if (skb->pkt_type == PACKET_LOOPBACK)
 579                 goto drop;
 580
 581         sk = pt->af_packet_priv;
 582         po = pkt_sk(sk);
 583
 584         if (dev->header_ops) {
 585                 if (sk->sk_type != SOCK_DGRAM)
 586                         skb_push(skb, skb->data - skb_mac_header(skb));
 587                 else if (skb->pkt_type == PACKET_OUTGOING) {
 588                         /* Special case: outgoing packets have ll header at head */
 589                         skb_pull(skb, skb_network_offset(skb));
 590                 }
 591         }
 592
 593         if (skb->ip_summed == CHECKSUM_PARTIAL)
 594                 status |= TP_STATUS_CSUMNOTREADY;
 595
 596         snaplen = skb->len;
 597
 598         res = run_filter(skb, sk, snaplen);
 599         if (!res)
 600                 goto drop_n_restore;
 601         if (snaplen > res)
 602                 snaplen = res;
 603
 604         if (sk->sk_type == SOCK_DGRAM) {
 605                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 606         } else {
 607                 unsigned maclen = skb_network_offset(skb);
 608                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 609                 macoff = netoff - maclen;
 610         }
 611
 612         if (macoff + snaplen > po->frame_size) {
 613                 if (po->copy_thresh &&
 614                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 615                     (unsigned)sk->sk_rcvbuf) {
 616                         if (skb_shared(skb)) {
 617                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 618                         } else {
 619                                 copy_skb = skb_get(skb);
 620                                 skb_head = skb->data;
 621                         }
 622                         if (copy_skb)
 623                                 skb_set_owner_r(copy_skb, sk);
 624                 }
 625                 snaplen = po->frame_size - macoff;
 626                 if ((int)snaplen < 0)
 627                         snaplen = 0;
 628         }
 629
 630         spin_lock(&sk->sk_receive_queue.lock);
 631         h = packet_lookup_frame(po, po->head);
 632
 633         if (h->tp_status)
 634                 goto ring_is_full;
 635         po->head = po->head != po->frame_max ? po->head+1 : 0;
 636         po->stats.tp_packets++;
 637         if (copy_skb) {
 638                 status |= TP_STATUS_COPY;
 639                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 640         }
 641         if (!po->stats.tp_drops)
 642                 status &= ~TP_STATUS_LOSING;
 643         spin_unlock(&sk->sk_receive_queue.lock);
 644
 645         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 646
 647         h->tp_len = skb->len;
 648         h->tp_snaplen = snaplen;
 649         h->tp_mac = macoff;
 650         h->tp_net = netoff;
 651         if (skb->tstamp.tv64)
 652                 tv = ktime_to_timeval(skb->tstamp);
 653         else
 654                 do_gettimeofday(&tv);
 655         h->tp_sec = tv.tv_sec;
 656         h->tp_usec = tv.tv_usec;
 657
 658         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 659         sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
 660         sll->sll_family = AF_PACKET;
 661         sll->sll_hatype = dev->type;
 662         sll->sll_protocol = skb->protocol;
 663         sll->sll_pkttype = skb->pkt_type;
 664         if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
 665                 sll->sll_ifindex = orig_dev->ifindex;
 666         else
 667                 sll->sll_ifindex = dev->ifindex;
 668
 669         h->tp_status = status;
 670         smp_mb();
 671
 672         {
 673                 struct page *p_start, *p_end;
 674                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 675
 676                 p_start = virt_to_page(h);
 677                 p_end = virt_to_page(h_end);
 678                 while (p_start <= p_end) {
 679                         flush_dcache_page(p_start);
 680                         p_start++;
 681                 }
 682         }
 683
 684         sk->sk_data_ready(sk, 0);
 685
 686 drop_n_restore:
 687         if (skb_head != skb->data && skb_shared(skb)) {
 688                 skb->data = skb_head;
 689                 skb->len = skb_len;
 690         }
 691 drop:
 692         kfree_skb(skb);
 693         return 0;
 694
 695 ring_is_full:
 696         po->stats.tp_drops++;
 697         spin_unlock(&sk->sk_receive_queue.lock);
 698
 699         sk->sk_data_ready(sk, 0);
 700         if (copy_skb)
 701                 kfree_skb(copy_skb);
 702         goto drop_n_restore;
 703 }
 704
 705 #endif
 706
 707
 708 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 709                           struct msghdr *msg, size_t len)
 710 {
 711         struct sock *sk = sock->sk;
 712         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 713         struct sk_buff *skb;
 714         struct net_device *dev;
 715         __be16 proto;
 716         unsigned char *addr;
 717         int ifindex, err, reserve = 0;
 718
 719         /*
 720          *      Get and verify the address.
 721          */
 722
 723         if (saddr == NULL) {
 724                 struct packet_sock *po = pkt_sk(sk);
 725
 726                 ifindex = po->ifindex;
 727                 proto   = po->num;
 728                 addr    = NULL;
 729         } else {
 730                 err = -EINVAL;
 731                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 732                         goto out;
 733                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 734                         goto out;
 735                 ifindex = saddr->sll_ifindex;
 736                 proto   = saddr->sll_protocol;
 737                 addr    = saddr->sll_addr;
 738         }
 739
 740
 741         dev = dev_get_by_index(&init_net, ifindex);
 742         err = -ENXIO;
 743         if (dev == NULL)
 744                 goto out_unlock;
 745         if (sock->type == SOCK_RAW)
 746                 reserve = dev->hard_header_len;
 747
 748         err = -ENETDOWN;
 749         if (!(dev->flags & IFF_UP))
 750                 goto out_unlock;
 751
 752         err = -EMSGSIZE;
 753         if (len > dev->mtu+reserve)
 754                 goto out_unlock;
 755
 756         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 757                                 msg->msg_flags & MSG_DONTWAIT, &err);
 758         if (skb==NULL)
 759                 goto out_unlock;
 760
 761         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 762         skb_reset_network_header(skb);
 763
 764         err = -EINVAL;
 765         if (sock->type == SOCK_DGRAM &&
 766             dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
 767                 goto out_free;
 768
 769         /* Returns -EFAULT on error */
 770         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 771         if (err)
 772                 goto out_free;
 773
 774         skb->protocol = proto;
 775         skb->dev = dev;
 776         skb->priority = sk->sk_priority;
 777
 778         /*
 779          *      Now send it
 780          */
 781
 782         err = dev_queue_xmit(skb);
 783         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 784                 goto out_unlock;
 785
 786         dev_put(dev);
 787
 788         return(len);
 789
 790 out_free:
 791         kfree_skb(skb);
 792 out_unlock:
 793         if (dev)
 794                 dev_put(dev);
 795 out:
 796         return err;
 797 }
 798
 799 /*
 800  *      Close a PACKET socket. This is fairly simple. We immediately go
 801  *      to 'closed' state and remove our protocol entry in the device list.
 802  */
 803
 804 static int packet_release(struct socket *sock)
 805 {
 806         struct sock *sk = sock->sk;
 807         struct packet_sock *po;
 808
 809         if (!sk)
 810                 return 0;
 811
 812         po = pkt_sk(sk);
 813
 814         write_lock_bh(&packet_sklist_lock);
 815         sk_del_node_init(sk);
 816         write_unlock_bh(&packet_sklist_lock);
 817
 818         /*
 819          *      Unhook packet receive handler.
 820          */
 821
 822         if (po->running) {
 823                 /*
 824                  *      Remove the protocol hook
 825                  */
 826                 dev_remove_pack(&po->prot_hook);
 827                 po->running = 0;
 828                 po->num = 0;
 829                 __sock_put(sk);
 830         }
 831
 832         packet_flush_mclist(sk);
 833
 834 #ifdef CONFIG_PACKET_MMAP
 835         if (po->pg_vec) {
 836                 struct tpacket_req req;
 837                 memset(&req, 0, sizeof(req));
 838                 packet_set_ring(sk, &req, 1);
 839         }
 840 #endif
 841
 842         /*
 843          *      Now the socket is dead. No more input will appear.
 844          */
 845
 846         sock_orphan(sk);
 847         sock->sk = NULL;
 848
 849         /* Purge queues */
 850
 851         skb_queue_purge(&sk->sk_receive_queue);
 852
 853         sock_put(sk);
 854         return 0;
 855 }
 856
 857 /*
 858  *      Attach a packet hook.
 859  */
 860
 861 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 862 {
 863         struct packet_sock *po = pkt_sk(sk);
 864         /*
 865          *      Detach an existing hook if present.
 866          */
 867
 868         lock_sock(sk);
 869
 870         spin_lock(&po->bind_lock);
 871         if (po->running) {
 872                 __sock_put(sk);
 873                 po->running = 0;
 874                 po->num = 0;
 875                 spin_unlock(&po->bind_lock);
 876                 dev_remove_pack(&po->prot_hook);
 877                 spin_lock(&po->bind_lock);
 878         }
 879
 880         po->num = protocol;
 881         po->prot_hook.type = protocol;
 882         po->prot_hook.dev = dev;
 883
 884         po->ifindex = dev ? dev->ifindex : 0;
 885
 886         if (protocol == 0)
 887                 goto out_unlock;
 888
 889         if (dev) {
 890                 if (dev->flags&IFF_UP) {
 891                         dev_add_pack(&po->prot_hook);
 892                         sock_hold(sk);
 893                         po->running = 1;
 894                 } else {
 895                         sk->sk_err = ENETDOWN;
 896                         if (!sock_flag(sk, SOCK_DEAD))
 897                                 sk->sk_error_report(sk);
 898                 }
 899         } else {
 900                 dev_add_pack(&po->prot_hook);
 901                 sock_hold(sk);
 902                 po->running = 1;
 903         }
 904
 905 out_unlock:
 906         spin_unlock(&po->bind_lock);
 907         release_sock(sk);
 908         return 0;
 909 }
 910
 911 /*
 912  *      Bind a packet socket to a device
 913  */
 914
 915 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 916 {
 917         struct sock *sk=sock->sk;
 918         char name[15];
 919         struct net_device *dev;
 920         int err = -ENODEV;
 921
 922         /*
 923          *      Check legality
 924          */
 925
 926         if (addr_len != sizeof(struct sockaddr))
 927                 return -EINVAL;
 928         strlcpy(name,uaddr->sa_data,sizeof(name));
 929
 930         dev = dev_get_by_name(&init_net, name);
 931         if (dev) {
 932                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 933                 dev_put(dev);
 934         }
 935         return err;
 936 }
 937
 938 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 939 {
 940         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 941         struct sock *sk=sock->sk;
 942         struct net_device *dev = NULL;
 943         int err;
 944
 945
 946         /*
 947          *      Check legality
 948          */
 949
 950         if (addr_len < sizeof(struct sockaddr_ll))
 951                 return -EINVAL;
 952         if (sll->sll_family != AF_PACKET)
 953                 return -EINVAL;
 954
 955         if (sll->sll_ifindex) {
 956                 err = -ENODEV;
 957                 dev = dev_get_by_index(&init_net, sll->sll_ifindex);
 958                 if (dev == NULL)
 959                         goto out;
 960         }
 961         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 962         if (dev)
 963                 dev_put(dev);
 964
 965 out:
 966         return err;
 967 }
 968
 969 static struct proto packet_proto = {
 970         .name     = "PACKET",
 971         .owner    = THIS_MODULE,
 972         .obj_size = sizeof(struct packet_sock),
 973 };
 974
 975 /*
 976  *      Create a packet of type SOCK_PACKET.
 977  */
 978
 979 static int packet_create(struct net *net, struct socket *sock, int protocol)
 980 {
 981         struct sock *sk;
 982         struct packet_sock *po;
 983         __be16 proto = (__force __be16)protocol; /* weird, but documented */
 984         int err;
 985
 986         if (net != &init_net)
 987                 return -EAFNOSUPPORT;
 988
 989         if (!capable(CAP_NET_RAW))
 990                 return -EPERM;
 991         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
 992             sock->type != SOCK_PACKET)
 993                 return -ESOCKTNOSUPPORT;
 994
 995         sock->state = SS_UNCONNECTED;
 996
 997         err = -ENOBUFS;
 998         sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto, 1);
 999         if (sk == NULL)
1000                 goto out;
1001
1002         sock->ops = &packet_ops;
1003         if (sock->type == SOCK_PACKET)
1004                 sock->ops = &packet_ops_spkt;
1005
1006         sock_init_data(sock, sk);
1007
1008         po = pkt_sk(sk);
1009         sk->sk_family = PF_PACKET;
1010         po->num = proto;
1011
1012         sk->sk_destruct = packet_sock_destruct;
1013         atomic_inc(&packet_socks_nr);
1014
1015         /*
1016          *      Attach a protocol block
1017          */
1018
1019         spin_lock_init(&po->bind_lock);
1020         po->prot_hook.func = packet_rcv;
1021
1022         if (sock->type == SOCK_PACKET)
1023                 po->prot_hook.func = packet_rcv_spkt;
1024
1025         po->prot_hook.af_packet_priv = sk;
1026
1027         if (proto) {
1028                 po->prot_hook.type = proto;
1029                 dev_add_pack(&po->prot_hook);
1030                 sock_hold(sk);
1031                 po->running = 1;
1032         }
1033
1034         write_lock_bh(&packet_sklist_lock);
1035         sk_add_node(sk, &packet_sklist);
1036         write_unlock_bh(&packet_sklist_lock);
1037         return(0);
1038 out:
1039         return err;
1040 }
1041
1042 /*
1043  *      Pull a packet from our receive queue and hand it to the user.
1044  *      If necessary we block.
1045  */
1046
1047 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1048                           struct msghdr *msg, size_t len, int flags)
1049 {
1050         struct sock *sk = sock->sk;
1051         struct sk_buff *skb;
1052         int copied, err;
1053         struct sockaddr_ll *sll;
1054
1055         err = -EINVAL;
1056         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1057                 goto out;
1058
1059 #if 0
1060         /* What error should we return now? EUNATTACH? */
1061         if (pkt_sk(sk)->ifindex < 0)
1062                 return -ENODEV;
1063 #endif
1064
1065         /*
1066          *      Call the generic datagram receiver. This handles all sorts
1067          *      of horrible races and re-entrancy so we can forget about it
1068          *      in the protocol layers.
1069          *
1070          *      Now it will return ENETDOWN, if device have just gone down,
1071          *      but then it will block.
1072          */
1073
1074         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1075
1076         /*
1077          *      An error occurred so return it. Because skb_recv_datagram()
1078          *      handles the blocking we don't see and worry about blocking
1079          *      retries.
1080          */
1081
1082         if (skb == NULL)
1083                 goto out;
1084
1085         /*
1086          *      If the address length field is there to be filled in, we fill
1087          *      it in now.
1088          */
1089
1090         sll = &PACKET_SKB_CB(skb)->sa.ll;
1091         if (sock->type == SOCK_PACKET)
1092                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1093         else
1094                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1095
1096         /*
1097          *      You lose any data beyond the buffer you gave. If it worries a
1098          *      user program they can ask the device for its MTU anyway.
1099          */
1100
1101         copied = skb->len;
1102         if (copied > len)
1103         {
1104                 copied=len;
1105                 msg->msg_flags|=MSG_TRUNC;
1106         }
1107
1108         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1109         if (err)
1110                 goto out_free;
1111
1112         sock_recv_timestamp(msg, sk, skb);
1113
1114         if (msg->msg_name)
1115                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1116                        msg->msg_namelen);
1117
1118         if (pkt_sk(sk)->auxdata) {
1119                 struct tpacket_auxdata aux;
1120
1121                 aux.tp_status = TP_STATUS_USER;
1122                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1123                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1124                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1125                 aux.tp_snaplen = skb->len;
1126                 aux.tp_mac = 0;
1127                 aux.tp_net = skb_network_offset(skb);
1128
1129                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1130         }
1131
1132         /*
1133          *      Free or return the buffer as appropriate. Again this
1134          *      hides all the races and re-entrancy issues from us.
1135          */
1136         err = (flags&MSG_TRUNC) ? skb->len : copied;
1137
1138 out_free:
1139         skb_free_datagram(sk, skb);
1140 out:
1141         return err;
1142 }
1143
1144 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1145                                int *uaddr_len, int peer)
1146 {
1147         struct net_device *dev;
1148         struct sock *sk = sock->sk;
1149
1150         if (peer)
1151                 return -EOPNOTSUPP;
1152
1153         uaddr->sa_family = AF_PACKET;
1154         dev = dev_get_by_index(&init_net, pkt_sk(sk)->ifindex);
1155         if (dev) {
1156                 strlcpy(uaddr->sa_data, dev->name, 15);
1157                 dev_put(dev);
1158         } else
1159                 memset(uaddr->sa_data, 0, 14);
1160         *uaddr_len = sizeof(*uaddr);
1161
1162         return 0;
1163 }
1164
1165 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1166                           int *uaddr_len, int peer)
1167 {
1168         struct net_device *dev;
1169         struct sock *sk = sock->sk;
1170         struct packet_sock *po = pkt_sk(sk);
1171         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1172
1173         if (peer)
1174                 return -EOPNOTSUPP;
1175
1176         sll->sll_family = AF_PACKET;
1177         sll->sll_ifindex = po->ifindex;
1178         sll->sll_protocol = po->num;
1179         dev = dev_get_by_index(&init_net, po->ifindex);
1180         if (dev) {
1181                 sll->sll_hatype = dev->type;
1182                 sll->sll_halen = dev->addr_len;
1183                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1184                 dev_put(dev);
1185         } else {
1186                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1187                 sll->sll_halen = 0;
1188         }
1189         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1190
1191         return 0;
1192 }
1193
1194 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1195 {
1196         switch (i->type) {
1197         case PACKET_MR_MULTICAST:
1198                 if (what > 0)
1199                         dev_mc_add(dev, i->addr, i->alen, 0);
1200                 else
1201                         dev_mc_delete(dev, i->addr, i->alen, 0);
1202                 break;
1203         case PACKET_MR_PROMISC:
1204                 dev_set_promiscuity(dev, what);
1205                 break;
1206         case PACKET_MR_ALLMULTI:
1207                 dev_set_allmulti(dev, what);
1208                 break;
1209         default:;
1210         }
1211 }
1212
1213 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1214 {
1215         for ( ; i; i=i->next) {
1216                 if (i->ifindex == dev->ifindex)
1217                         packet_dev_mc(dev, i, what);
1218         }
1219 }
1220
1221 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1222 {
1223         struct packet_sock *po = pkt_sk(sk);
1224         struct packet_mclist *ml, *i;
1225         struct net_device *dev;
1226         int err;
1227
1228         rtnl_lock();
1229
1230         err = -ENODEV;
1231         dev = __dev_get_by_index(&init_net, mreq->mr_ifindex);
1232         if (!dev)
1233                 goto done;
1234
1235         err = -EINVAL;
1236         if (mreq->mr_alen > dev->addr_len)
1237                 goto done;
1238
1239         err = -ENOBUFS;
1240         i = kmalloc(sizeof(*i), GFP_KERNEL);
1241         if (i == NULL)
1242                 goto done;
1243
1244         err = 0;
1245         for (ml = po->mclist; ml; ml = ml->next) {
1246                 if (ml->ifindex == mreq->mr_ifindex &&
1247                     ml->type == mreq->mr_type &&
1248                     ml->alen == mreq->mr_alen &&
1249                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1250                         ml->count++;
1251                         /* Free the new element ... */
1252                         kfree(i);
1253                         goto done;
1254                 }
1255         }
1256
1257         i->type = mreq->mr_type;
1258         i->ifindex = mreq->mr_ifindex;
1259         i->alen = mreq->mr_alen;
1260         memcpy(i->addr, mreq->mr_address, i->alen);
1261         i->count = 1;
1262         i->next = po->mclist;
1263         po->mclist = i;
1264         packet_dev_mc(dev, i, +1);
1265
1266 done:
1267         rtnl_unlock();
1268         return err;
1269 }
1270
1271 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1272 {
1273         struct packet_mclist *ml, **mlp;
1274
1275         rtnl_lock();
1276
1277         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1278                 if (ml->ifindex == mreq->mr_ifindex &&
1279                     ml->type == mreq->mr_type &&
1280                     ml->alen == mreq->mr_alen &&
1281                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1282                         if (--ml->count == 0) {
1283                                 struct net_device *dev;
1284                                 *mlp = ml->next;
1285                                 dev = dev_get_by_index(&init_net, ml->ifindex);
1286                                 if (dev) {
1287                                         packet_dev_mc(dev, ml, -1);
1288                                         dev_put(dev);
1289                                 }
1290                                 kfree(ml);
1291                         }
1292                         rtnl_unlock();
1293                         return 0;
1294                 }
1295         }
1296         rtnl_unlock();
1297         return -EADDRNOTAVAIL;
1298 }
1299
1300 static void packet_flush_mclist(struct sock *sk)
1301 {
1302         struct packet_sock *po = pkt_sk(sk);
1303         struct packet_mclist *ml;
1304
1305         if (!po->mclist)
1306                 return;
1307
1308         rtnl_lock();
1309         while ((ml = po->mclist) != NULL) {
1310                 struct net_device *dev;
1311
1312                 po->mclist = ml->next;
1313                 if ((dev = dev_get_by_index(&init_net, ml->ifindex)) != NULL) {
1314                         packet_dev_mc(dev, ml, -1);
1315                         dev_put(dev);
1316                 }
1317                 kfree(ml);
1318         }
1319         rtnl_unlock();
1320 }
1321
1322 static int
1323 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1324 {
1325         struct sock *sk = sock->sk;
1326         struct packet_sock *po = pkt_sk(sk);
1327         int ret;
1328
1329         if (level != SOL_PACKET)
1330                 return -ENOPROTOOPT;
1331
1332         switch(optname) {
1333         case PACKET_ADD_MEMBERSHIP:
1334         case PACKET_DROP_MEMBERSHIP:
1335         {
1336                 struct packet_mreq_max mreq;
1337                 int len = optlen;
1338                 memset(&mreq, 0, sizeof(mreq));
1339                 if (len < sizeof(struct packet_mreq))
1340                         return -EINVAL;
1341                 if (len > sizeof(mreq))
1342                         len = sizeof(mreq);
1343                 if (copy_from_user(&mreq,optval,len))
1344                         return -EFAULT;
1345                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1346                         return -EINVAL;
1347                 if (optname == PACKET_ADD_MEMBERSHIP)
1348                         ret = packet_mc_add(sk, &mreq);
1349                 else
1350                         ret = packet_mc_drop(sk, &mreq);
1351                 return ret;
1352         }
1353
1354 #ifdef CONFIG_PACKET_MMAP
1355         case PACKET_RX_RING:
1356         {
1357                 struct tpacket_req req;
1358
1359                 if (optlen<sizeof(req))
1360                         return -EINVAL;
1361                 if (copy_from_user(&req,optval,sizeof(req)))
1362                         return -EFAULT;
1363                 return packet_set_ring(sk, &req, 0);
1364         }
1365         case PACKET_COPY_THRESH:
1366         {
1367                 int val;
1368
1369                 if (optlen!=sizeof(val))
1370                         return -EINVAL;
1371                 if (copy_from_user(&val,optval,sizeof(val)))
1372                         return -EFAULT;
1373
1374                 pkt_sk(sk)->copy_thresh = val;
1375                 return 0;
1376         }
1377 #endif
1378         case PACKET_AUXDATA:
1379         {
1380                 int val;
1381
1382                 if (optlen < sizeof(val))
1383                         return -EINVAL;
1384                 if (copy_from_user(&val, optval, sizeof(val)))
1385                         return -EFAULT;
1386
1387                 po->auxdata = !!val;
1388                 return 0;
1389         }
1390         case PACKET_ORIGDEV:
1391         {
1392                 int val;
1393
1394                 if (optlen < sizeof(val))
1395                         return -EINVAL;
1396                 if (copy_from_user(&val, optval, sizeof(val)))
1397                         return -EFAULT;
1398
1399                 po->origdev = !!val;
1400                 return 0;
1401         }
1402         default:
1403                 return -ENOPROTOOPT;
1404         }
1405 }
1406
1407 static int packet_getsockopt(struct socket *sock, int level, int optname,
1408                              char __user *optval, int __user *optlen)
1409 {
1410         int len;
1411         int val;
1412         struct sock *sk = sock->sk;
1413         struct packet_sock *po = pkt_sk(sk);
1414         void *data;
1415         struct tpacket_stats st;
1416
1417         if (level != SOL_PACKET)
1418                 return -ENOPROTOOPT;
1419
1420         if (get_user(len, optlen))
1421                 return -EFAULT;
1422
1423         if (len < 0)
1424                 return -EINVAL;
1425
1426         switch(optname) {
1427         case PACKET_STATISTICS:
1428                 if (len > sizeof(struct tpacket_stats))
1429                         len = sizeof(struct tpacket_stats);
1430                 spin_lock_bh(&sk->sk_receive_queue.lock);
1431                 st = po->stats;
1432                 memset(&po->stats, 0, sizeof(st));
1433                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1434                 st.tp_packets += st.tp_drops;
1435
1436                 data = &st;
1437                 break;
1438         case PACKET_AUXDATA:
1439                 if (len > sizeof(int))
1440                         len = sizeof(int);
1441                 val = po->auxdata;
1442
1443                 data = &val;
1444                 break;
1445         case PACKET_ORIGDEV:
1446                 if (len > sizeof(int))
1447                         len = sizeof(int);
1448                 val = po->origdev;
1449
1450                 data = &val;
1451                 break;
1452         default:
1453                 return -ENOPROTOOPT;
1454         }
1455
1456         if (put_user(len, optlen))
1457                 return -EFAULT;
1458         if (copy_to_user(optval, data, len))
1459                 return -EFAULT;
1460         return 0;
1461 }
1462
1463
1464 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1465 {
1466         struct sock *sk;
1467         struct hlist_node *node;
1468         struct net_device *dev = data;
1469
1470         if (dev->nd_net != &init_net)
1471                 return NOTIFY_DONE;
1472
1473         read_lock(&packet_sklist_lock);
1474         sk_for_each(sk, node, &packet_sklist) {
1475                 struct packet_sock *po = pkt_sk(sk);
1476
1477                 switch (msg) {
1478                 case NETDEV_UNREGISTER:
1479                         if (po->mclist)
1480                                 packet_dev_mclist(dev, po->mclist, -1);
1481                         /* fallthrough */
1482
1483                 case NETDEV_DOWN:
1484                         if (dev->ifindex == po->ifindex) {
1485                                 spin_lock(&po->bind_lock);
1486                                 if (po->running) {
1487                                         __dev_remove_pack(&po->prot_hook);
1488                                         __sock_put(sk);
1489                                         po->running = 0;
1490                                         sk->sk_err = ENETDOWN;
1491                                         if (!sock_flag(sk, SOCK_DEAD))
1492                                                 sk->sk_error_report(sk);
1493                                 }
1494                                 if (msg == NETDEV_UNREGISTER) {
1495                                         po->ifindex = -1;
1496                                         po->prot_hook.dev = NULL;
1497                                 }
1498                                 spin_unlock(&po->bind_lock);
1499                         }
1500                         break;
1501                 case NETDEV_UP:
1502                         spin_lock(&po->bind_lock);
1503                         if (dev->ifindex == po->ifindex && po->num &&
1504                             !po->running) {
1505                                 dev_add_pack(&po->prot_hook);
1506                                 sock_hold(sk);
1507                                 po->running = 1;
1508                         }
1509                         spin_unlock(&po->bind_lock);
1510                         break;
1511                 }
1512         }
1513         read_unlock(&packet_sklist_lock);
1514         return NOTIFY_DONE;
1515 }
1516
1517
1518 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1519                         unsigned long arg)
1520 {
1521         struct sock *sk = sock->sk;
1522
1523         switch(cmd) {
1524                 case SIOCOUTQ:
1525                 {
1526                         int amount = atomic_read(&sk->sk_wmem_alloc);
1527                         return put_user(amount, (int __user *)arg);
1528                 }
1529                 case SIOCINQ:
1530                 {
1531                         struct sk_buff *skb;
1532                         int amount = 0;
1533
1534                         spin_lock_bh(&sk->sk_receive_queue.lock);
1535                         skb = skb_peek(&sk->sk_receive_queue);
1536                         if (skb)
1537                                 amount = skb->len;
1538                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1539                         return put_user(amount, (int __user *)arg);
1540                 }
1541                 case SIOCGSTAMP:
1542                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1543                 case SIOCGSTAMPNS:
1544                         return sock_get_timestampns(sk, (struct timespec __user *)arg);
1545
1546 #ifdef CONFIG_INET
1547                 case SIOCADDRT:
1548                 case SIOCDELRT:
1549                 case SIOCDARP:
1550                 case SIOCGARP:
1551                 case SIOCSARP:
1552                 case SIOCGIFADDR:
1553                 case SIOCSIFADDR:
1554                 case SIOCGIFBRDADDR:
1555                 case SIOCSIFBRDADDR:
1556                 case SIOCGIFNETMASK:
1557                 case SIOCSIFNETMASK:
1558                 case SIOCGIFDSTADDR:
1559                 case SIOCSIFDSTADDR:
1560                 case SIOCSIFFLAGS:
1561                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1562 #endif
1563
1564                 default:
1565                         return -ENOIOCTLCMD;
1566         }
1567         return 0;
1568 }
1569
1570 #ifndef CONFIG_PACKET_MMAP
1571 #define packet_mmap sock_no_mmap
1572 #define packet_poll datagram_poll
1573 #else
1574
1575 static unsigned int packet_poll(struct file * file, struct socket *sock,
1576                                 poll_table *wait)
1577 {
1578         struct sock *sk = sock->sk;
1579         struct packet_sock *po = pkt_sk(sk);
1580         unsigned int mask = datagram_poll(file, sock, wait);
1581
1582         spin_lock_bh(&sk->sk_receive_queue.lock);
1583         if (po->pg_vec) {
1584                 unsigned last = po->head ? po->head-1 : po->frame_max;
1585                 struct tpacket_hdr *h;
1586
1587                 h = packet_lookup_frame(po, last);
1588
1589                 if (h->tp_status)
1590                         mask |= POLLIN | POLLRDNORM;
1591         }
1592         spin_unlock_bh(&sk->sk_receive_queue.lock);
1593         return mask;
1594 }
1595
1596
1597 /* Dirty? Well, I still did not learn better way to account
1598  * for user mmaps.
1599  */
1600
1601 static void packet_mm_open(struct vm_area_struct *vma)
1602 {
1603         struct file *file = vma->vm_file;
1604         struct socket * sock = file->private_data;
1605         struct sock *sk = sock->sk;
1606
1607         if (sk)
1608                 atomic_inc(&pkt_sk(sk)->mapped);
1609 }
1610
1611 static void packet_mm_close(struct vm_area_struct *vma)
1612 {
1613         struct file *file = vma->vm_file;
1614         struct socket * sock = file->private_data;
1615         struct sock *sk = sock->sk;
1616
1617         if (sk)
1618                 atomic_dec(&pkt_sk(sk)->mapped);
1619 }
1620
1621 static struct vm_operations_struct packet_mmap_ops = {
1622         .open = packet_mm_open,
1623         .close =packet_mm_close,
1624 };
1625
1626 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1627 {
1628         int i;
1629
1630         for (i = 0; i < len; i++) {
1631                 if (likely(pg_vec[i]))
1632                         free_pages((unsigned long) pg_vec[i], order);
1633         }
1634         kfree(pg_vec);
1635 }
1636
1637 static inline char *alloc_one_pg_vec_page(unsigned long order)
1638 {
1639         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1640                                          order);
1641 }
1642
1643 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1644 {
1645         unsigned int block_nr = req->tp_block_nr;
1646         char **pg_vec;
1647         int i;
1648
1649         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1650         if (unlikely(!pg_vec))
1651                 goto out;
1652
1653         for (i = 0; i < block_nr; i++) {
1654                 pg_vec[i] = alloc_one_pg_vec_page(order);
1655                 if (unlikely(!pg_vec[i]))
1656                         goto out_free_pgvec;
1657         }
1658
1659 out:
1660         return pg_vec;
1661
1662 out_free_pgvec:
1663         free_pg_vec(pg_vec, order, block_nr);
1664         pg_vec = NULL;
1665         goto out;
1666 }
1667
1668 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1669 {
1670         char **pg_vec = NULL;
1671         struct packet_sock *po = pkt_sk(sk);
1672         int was_running, order = 0;
1673         __be16 num;
1674         int err = 0;
1675
1676         if (req->tp_block_nr) {
1677                 int i, l;
1678
1679                 /* Sanity tests and some calculations */
1680
1681                 if (unlikely(po->pg_vec))
1682                         return -EBUSY;
1683
1684                 if (unlikely((int)req->tp_block_size <= 0))
1685                         return -EINVAL;
1686                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1687                         return -EINVAL;
1688                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1689                         return -EINVAL;
1690                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1691                         return -EINVAL;
1692
1693                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1694                 if (unlikely(po->frames_per_block <= 0))
1695                         return -EINVAL;
1696                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1697                              req->tp_frame_nr))
1698                         return -EINVAL;
1699
1700                 err = -ENOMEM;
1701                 order = get_order(req->tp_block_size);
1702                 pg_vec = alloc_pg_vec(req, order);
1703                 if (unlikely(!pg_vec))
1704                         goto out;
1705
1706                 l = 0;
1707                 for (i = 0; i < req->tp_block_nr; i++) {
1708                         char *ptr = pg_vec[i];
1709                         struct tpacket_hdr *header;
1710                         int k;
1711
1712                         for (k = 0; k < po->frames_per_block; k++) {
1713                                 header = (struct tpacket_hdr *) ptr;
1714                                 header->tp_status = TP_STATUS_KERNEL;
1715                                 ptr += req->tp_frame_size;
1716                         }
1717                 }
1718                 /* Done */
1719         } else {
1720                 if (unlikely(req->tp_frame_nr))
1721                         return -EINVAL;
1722         }
1723
1724         lock_sock(sk);
1725
1726         /* Detach socket from network */
1727         spin_lock(&po->bind_lock);
1728         was_running = po->running;
1729         num = po->num;
1730         if (was_running) {
1731                 __dev_remove_pack(&po->prot_hook);
1732                 po->num = 0;
1733                 po->running = 0;
1734                 __sock_put(sk);
1735         }
1736         spin_unlock(&po->bind_lock);
1737
1738         synchronize_net();
1739
1740         err = -EBUSY;
1741         if (closing || atomic_read(&po->mapped) == 0) {
1742                 err = 0;
1743 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1744
1745                 spin_lock_bh(&sk->sk_receive_queue.lock);
1746                 pg_vec = XC(po->pg_vec, pg_vec);
1747                 po->frame_max = (req->tp_frame_nr - 1);
1748                 po->head = 0;
1749                 po->frame_size = req->tp_frame_size;
1750                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1751
1752                 order = XC(po->pg_vec_order, order);
1753                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1754
1755                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1756                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1757                 skb_queue_purge(&sk->sk_receive_queue);
1758 #undef XC
1759                 if (atomic_read(&po->mapped))
1760                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1761         }
1762
1763         spin_lock(&po->bind_lock);
1764         if (was_running && !po->running) {
1765                 sock_hold(sk);
1766                 po->running = 1;
1767                 po->num = num;
1768                 dev_add_pack(&po->prot_hook);
1769         }
1770         spin_unlock(&po->bind_lock);
1771
1772         release_sock(sk);
1773
1774         if (pg_vec)
1775                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1776 out:
1777         return err;
1778 }
1779
1780 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1781 {
1782         struct sock *sk = sock->sk;
1783         struct packet_sock *po = pkt_sk(sk);
1784         unsigned long size;
1785         unsigned long start;
1786         int err = -EINVAL;
1787         int i;
1788
1789         if (vma->vm_pgoff)
1790                 return -EINVAL;
1791
1792         size = vma->vm_end - vma->vm_start;
1793
1794         lock_sock(sk);
1795         if (po->pg_vec == NULL)
1796                 goto out;
1797         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1798                 goto out;
1799
1800         start = vma->vm_start;
1801         for (i = 0; i < po->pg_vec_len; i++) {
1802                 struct page *page = virt_to_page(po->pg_vec[i]);
1803                 int pg_num;
1804
1805                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1806                         err = vm_insert_page(vma, start, page);
1807                         if (unlikely(err))
1808                                 goto out;
1809                         start += PAGE_SIZE;
1810                 }
1811         }
1812         atomic_inc(&po->mapped);
1813         vma->vm_ops = &packet_mmap_ops;
1814         err = 0;
1815
1816 out:
1817         release_sock(sk);
1818         return err;
1819 }
1820 #endif
1821
1822
1823 static const struct proto_ops packet_ops_spkt = {
1824         .family =       PF_PACKET,
1825         .owner =        THIS_MODULE,
1826         .release =      packet_release,
1827         .bind =         packet_bind_spkt,
1828         .connect =      sock_no_connect,
1829         .socketpair =   sock_no_socketpair,
1830         .accept =       sock_no_accept,
1831         .getname =      packet_getname_spkt,
1832         .poll =         datagram_poll,
1833         .ioctl =        packet_ioctl,
1834         .listen =       sock_no_listen,
1835         .shutdown =     sock_no_shutdown,
1836         .setsockopt =   sock_no_setsockopt,
1837         .getsockopt =   sock_no_getsockopt,
1838         .sendmsg =      packet_sendmsg_spkt,
1839         .recvmsg =      packet_recvmsg,
1840         .mmap =         sock_no_mmap,
1841         .sendpage =     sock_no_sendpage,
1842 };
1843
1844 static const struct proto_ops packet_ops = {
1845         .family =       PF_PACKET,
1846         .owner =        THIS_MODULE,
1847         .release =      packet_release,
1848         .bind =         packet_bind,
1849         .connect =      sock_no_connect,
1850         .socketpair =   sock_no_socketpair,
1851         .accept =       sock_no_accept,
1852         .getname =      packet_getname,
1853         .poll =         packet_poll,
1854         .ioctl =        packet_ioctl,
1855         .listen =       sock_no_listen,
1856         .shutdown =     sock_no_shutdown,
1857         .setsockopt =   packet_setsockopt,
1858         .getsockopt =   packet_getsockopt,
1859         .sendmsg =      packet_sendmsg,
1860         .recvmsg =      packet_recvmsg,
1861         .mmap =         packet_mmap,
1862         .sendpage =     sock_no_sendpage,
1863 };
1864
1865 static struct net_proto_family packet_family_ops = {
1866         .family =       PF_PACKET,
1867         .create =       packet_create,
1868         .owner  =       THIS_MODULE,
1869 };
1870
1871 static struct notifier_block packet_netdev_notifier = {
1872         .notifier_call =packet_notifier,
1873 };
1874
1875 #ifdef CONFIG_PROC_FS
1876 static inline struct sock *packet_seq_idx(loff_t off)
1877 {
1878         struct sock *s;
1879         struct hlist_node *node;
1880
1881         sk_for_each(s, node, &packet_sklist) {
1882                 if (!off--)
1883                         return s;
1884         }
1885         return NULL;
1886 }
1887
1888 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1889 {
1890         read_lock(&packet_sklist_lock);
1891         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1892 }
1893
1894 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1895 {
1896         ++*pos;
1897         return  (v == SEQ_START_TOKEN)
1898                 ? sk_head(&packet_sklist)
1899                 : sk_next((struct sock*)v) ;
1900 }
1901
1902 static void packet_seq_stop(struct seq_file *seq, void *v)
1903 {
1904         read_unlock(&packet_sklist_lock);
1905 }
1906
1907 static int packet_seq_show(struct seq_file *seq, void *v)
1908 {
1909         if (v == SEQ_START_TOKEN)
1910                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1911         else {
1912                 struct sock *s = v;
1913                 const struct packet_sock *po = pkt_sk(s);
1914
1915                 seq_printf(seq,
1916                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1917                            s,
1918                            atomic_read(&s->sk_refcnt),
1919                            s->sk_type,
1920                            ntohs(po->num),
1921                            po->ifindex,
1922                            po->running,
1923                            atomic_read(&s->sk_rmem_alloc),
1924                            sock_i_uid(s),
1925                            sock_i_ino(s) );
1926         }
1927
1928         return 0;
1929 }
1930
1931 static const struct seq_operations packet_seq_ops = {
1932         .start  = packet_seq_start,
1933         .next   = packet_seq_next,
1934         .stop   = packet_seq_stop,
1935         .show   = packet_seq_show,
1936 };
1937
1938 static int packet_seq_open(struct inode *inode, struct file *file)
1939 {
1940         return seq_open(file, &packet_seq_ops);
1941 }
1942
1943 static const struct file_operations packet_seq_fops = {
1944         .owner          = THIS_MODULE,
1945         .open           = packet_seq_open,
1946         .read           = seq_read,
1947         .llseek         = seq_lseek,
1948         .release        = seq_release,
1949 };
1950
1951 #endif
1952
1953 static void __exit packet_exit(void)
1954 {
1955         proc_net_remove(&init_net, "packet");
1956         unregister_netdevice_notifier(&packet_netdev_notifier);
1957         sock_unregister(PF_PACKET);
1958         proto_unregister(&packet_proto);
1959 }
1960
1961 static int __init packet_init(void)
1962 {
1963         int rc = proto_register(&packet_proto, 0);
1964
1965         if (rc != 0)
1966                 goto out;
1967
1968         sock_register(&packet_family_ops);
1969         register_netdevice_notifier(&packet_netdev_notifier);
1970         proc_net_fops_create(&init_net, "packet", 0, &packet_seq_fops);
1971 out:
1972         return rc;
1973 }
1974
1975 module_init(packet_init);
1976 module_exit(packet_exit);
1977 MODULE_LICENSE("GPL");
1978 MODULE_ALIAS_NETPROTO(PF_PACKET);