net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/sched.h>
  54 #include <linux/mm.h>
  55 #include <linux/capability.h>
  56 #include <linux/fcntl.h>
  57 #include <linux/socket.h>
  58 #include <linux/in.h>
  59 #include <linux/inet.h>
  60 #include <linux/netdevice.h>
  61 #include <linux/if_packet.h>
  62 #include <linux/wireless.h>
  63 #include <linux/kernel.h>
  64 #include <linux/kmod.h>
  65 #include <net/ip.h>
  66 #include <net/protocol.h>
  67 #include <linux/skbuff.h>
  68 #include <net/sock.h>
  69 #include <linux/errno.h>
  70 #include <linux/timer.h>
  71 #include <asm/system.h>
  72 #include <asm/uaccess.h>
  73 #include <asm/ioctls.h>
  74 #include <asm/page.h>
  75 #include <asm/cacheflush.h>
  76 #include <asm/io.h>
  77 #include <linux/proc_fs.h>
  78 #include <linux/seq_file.h>
  79 #include <linux/poll.h>
  80 #include <linux/module.h>
  81 #include <linux/init.h>
  82
  83 #ifdef CONFIG_INET
  84 #include <net/inet_common.h>
  85 #endif
  86
  87 #define CONFIG_SOCK_PACKET      1
  88
  89 /*
  90    Proposed replacement for SIOC{ADD,DEL}MULTI and
  91    IFF_PROMISC, IFF_ALLMULTI flags.
  92
  93    It is more expensive, but I believe,
  94    it is really correct solution: reentereble, safe and fault tolerant.
  95
  96    IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping
  97    reference count and global flag, so that real status is
  98    (gflag|(count != 0)), so that we can use obsolete faulty interface
  99    not harming clever users.
 100  */
 101 #define CONFIG_PACKET_MULTICAST 1
 102
 103 /*
 104    Assumptions:
 105    - if device has no dev->hard_header routine, it adds and removes ll header
 106      inside itself. In this case ll header is invisible outside of device,
 107      but higher levels still should reserve dev->hard_header_len.
 108      Some devices are enough clever to reallocate skb, when header
 109      will not fit to reserved space (tunnel), another ones are silly
 110      (PPP).
 111    - packet socket receives packets with pulled ll header,
 112      so that SOCK_RAW should push it back.
 113
 114 On receive:
 115 -----------
 116
 117 Incoming, dev->hard_header!=NULL
 118    mac.raw -> ll header
 119    data    -> data
 120
 121 Outgoing, dev->hard_header!=NULL
 122    mac.raw -> ll header
 123    data    -> ll header
 124
 125 Incoming, dev->hard_header==NULL
 126    mac.raw -> UNKNOWN position. It is very likely, that it points to ll header.
 127               PPP makes it, that is wrong, because introduce assymetry
 128               between rx and tx paths.
 129    data    -> data
 130
 131 Outgoing, dev->hard_header==NULL
 132    mac.raw -> data. ll header is still not built!
 133    data    -> data
 134
 135 Resume
 136   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 137
 138
 139 On transmit:
 140 ------------
 141
 142 dev->hard_header != NULL
 143    mac.raw -> ll header
 144    data    -> ll header
 145
 146 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 147    mac.raw -> data
 148    data -> data
 149
 150    We should set nh.raw on output to correct posistion,
 151    packet classifier depends on it.
 152  */
 153
 154 /* List of all packet sockets. */
 155 static HLIST_HEAD(packet_sklist);
 156 static DEFINE_RWLOCK(packet_sklist_lock);
 157
 158 static atomic_t packet_socks_nr;
 159
 160
 161 /* Private packet socket structures. */
 162
 163 #ifdef CONFIG_PACKET_MULTICAST
 164 struct packet_mclist
 165 {
 166         struct packet_mclist    *next;
 167         int                     ifindex;
 168         int                     count;
 169         unsigned short          type;
 170         unsigned short          alen;
 171         unsigned char           addr[MAX_ADDR_LEN];
 172 };
 173 /* identical to struct packet_mreq except it has
 174  * a longer address field.
 175  */
 176 struct packet_mreq_max
 177 {
 178         int             mr_ifindex;
 179         unsigned short  mr_type;
 180         unsigned short  mr_alen;
 181         unsigned char   mr_address[MAX_ADDR_LEN];
 182 };
 183 #endif
 184 #ifdef CONFIG_PACKET_MMAP
 185 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 186 #endif
 187
 188 static void packet_flush_mclist(struct sock *sk);
 189
 190 struct packet_sock {
 191         /* struct sock has to be the first member of packet_sock */
 192         struct sock             sk;
 193         struct tpacket_stats    stats;
 194 #ifdef CONFIG_PACKET_MMAP
 195         char *                  *pg_vec;
 196         unsigned int            head;
 197         unsigned int            frames_per_block;
 198         unsigned int            frame_size;
 199         unsigned int            frame_max;
 200         int                     copy_thresh;
 201 #endif
 202         struct packet_type      prot_hook;
 203         spinlock_t              bind_lock;
 204         unsigned int            running:1,      /* prot_hook is attached*/
 205                                 auxdata:1;
 206         int                     ifindex;        /* bound device         */
 207         __be16                  num;
 208 #ifdef CONFIG_PACKET_MULTICAST
 209         struct packet_mclist    *mclist;
 210 #endif
 211 #ifdef CONFIG_PACKET_MMAP
 212         atomic_t                mapped;
 213         unsigned int            pg_vec_order;
 214         unsigned int            pg_vec_pages;
 215         unsigned int            pg_vec_len;
 216 #endif
 217 };
 218
 219 struct packet_skb_cb {
 220         unsigned int origlen;
 221         union {
 222                 struct sockaddr_pkt pkt;
 223                 struct sockaddr_ll ll;
 224         } sa;
 225 };
 226
 227 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 228
 229 #ifdef CONFIG_PACKET_MMAP
 230
 231 static inline char *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 232 {
 233         unsigned int pg_vec_pos, frame_offset;
 234         char *frame;
 235
 236         pg_vec_pos = position / po->frames_per_block;
 237         frame_offset = position % po->frames_per_block;
 238
 239         frame = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
 240
 241         return frame;
 242 }
 243 #endif
 244
 245 static inline struct packet_sock *pkt_sk(struct sock *sk)
 246 {
 247         return (struct packet_sock *)sk;
 248 }
 249
 250 static void packet_sock_destruct(struct sock *sk)
 251 {
 252         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 253         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 254
 255         if (!sock_flag(sk, SOCK_DEAD)) {
 256                 printk("Attempt to release alive packet socket: %p\n", sk);
 257                 return;
 258         }
 259
 260         atomic_dec(&packet_socks_nr);
 261 #ifdef PACKET_REFCNT_DEBUG
 262         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 263 #endif
 264 }
 265
 266
 267 static const
 268 struct proto_ops packet_ops;
 269
 270 #ifdef CONFIG_SOCK_PACKET
 271 static const struct proto_ops packet_ops_spkt;
 272
 273 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 274 {
 275         struct sock *sk;
 276         struct sockaddr_pkt *spkt;
 277
 278         /*
 279          *      When we registered the protocol we saved the socket in the data
 280          *      field for just this event.
 281          */
 282
 283         sk = pt->af_packet_priv;
 284
 285         /*
 286          *      Yank back the headers [hope the device set this
 287          *      right or kerboom...]
 288          *
 289          *      Incoming packets have ll header pulled,
 290          *      push it back.
 291          *
 292          *      For outgoing ones skb->data == skb->mac.raw
 293          *      so that this procedure is noop.
 294          */
 295
 296         if (skb->pkt_type == PACKET_LOOPBACK)
 297                 goto out;
 298
 299         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 300                 goto oom;
 301
 302         /* drop any routing info */
 303         dst_release(skb->dst);
 304         skb->dst = NULL;
 305
 306         /* drop conntrack reference */
 307         nf_reset(skb);
 308
 309         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 310
 311         skb_push(skb, skb->data-skb->mac.raw);
 312
 313         /*
 314          *      The SOCK_PACKET socket receives _all_ frames.
 315          */
 316
 317         spkt->spkt_family = dev->type;
 318         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 319         spkt->spkt_protocol = skb->protocol;
 320
 321         /*
 322          *      Charge the memory to the socket. This is done specifically
 323          *      to prevent sockets using all the memory up.
 324          */
 325
 326         if (sock_queue_rcv_skb(sk,skb) == 0)
 327                 return 0;
 328
 329 out:
 330         kfree_skb(skb);
 331 oom:
 332         return 0;
 333 }
 334
 335
 336 /*
 337  *      Output a raw packet to a device layer. This bypasses all the other
 338  *      protocol layers and you must therefore supply it with a complete frame
 339  */
 340
 341 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 342                                struct msghdr *msg, size_t len)
 343 {
 344         struct sock *sk = sock->sk;
 345         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 346         struct sk_buff *skb;
 347         struct net_device *dev;
 348         __be16 proto=0;
 349         int err;
 350
 351         /*
 352          *      Get and verify the address.
 353          */
 354
 355         if (saddr)
 356         {
 357                 if (msg->msg_namelen < sizeof(struct sockaddr))
 358                         return(-EINVAL);
 359                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 360                         proto=saddr->spkt_protocol;
 361         }
 362         else
 363                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 364
 365         /*
 366          *      Find the device first to size check it
 367          */
 368
 369         saddr->spkt_device[13] = 0;
 370         dev = dev_get_by_name(saddr->spkt_device);
 371         err = -ENODEV;
 372         if (dev == NULL)
 373                 goto out_unlock;
 374
 375         err = -ENETDOWN;
 376         if (!(dev->flags & IFF_UP))
 377                 goto out_unlock;
 378
 379         /*
 380          *      You may not queue a frame bigger than the mtu. This is the lowest level
 381          *      raw protocol and you must do your own fragmentation at this level.
 382          */
 383
 384         err = -EMSGSIZE;
 385         if (len > dev->mtu + dev->hard_header_len)
 386                 goto out_unlock;
 387
 388         err = -ENOBUFS;
 389         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 390
 391         /*
 392          *      If the write buffer is full, then tough. At this level the user gets to
 393          *      deal with the problem - do your own algorithmic backoffs. That's far
 394          *      more flexible.
 395          */
 396
 397         if (skb == NULL)
 398                 goto out_unlock;
 399
 400         /*
 401          *      Fill it in
 402          */
 403
 404         /* FIXME: Save some space for broken drivers that write a
 405          * hard header at transmission time by themselves. PPP is the
 406          * notable one here. This should really be fixed at the driver level.
 407          */
 408         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 409         skb->nh.raw = skb->data;
 410
 411         /* Try to align data part correctly */
 412         if (dev->hard_header) {
 413                 skb->data -= dev->hard_header_len;
 414                 skb->tail -= dev->hard_header_len;
 415                 if (len < dev->hard_header_len)
 416                         skb->nh.raw = skb->data;
 417         }
 418
 419         /* Returns -EFAULT on error */
 420         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 421         skb->protocol = proto;
 422         skb->dev = dev;
 423         skb->priority = sk->sk_priority;
 424         if (err)
 425                 goto out_free;
 426
 427         /*
 428          *      Now send it
 429          */
 430
 431         dev_queue_xmit(skb);
 432         dev_put(dev);
 433         return(len);
 434
 435 out_free:
 436         kfree_skb(skb);
 437 out_unlock:
 438         if (dev)
 439                 dev_put(dev);
 440         return err;
 441 }
 442 #endif
 443
 444 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 445                                       unsigned int res)
 446 {
 447         struct sk_filter *filter;
 448
 449         rcu_read_lock_bh();
 450         filter = rcu_dereference(sk->sk_filter);
 451         if (filter != NULL)
 452                 res = sk_run_filter(skb, filter->insns, filter->len);
 453         rcu_read_unlock_bh();
 454
 455         return res;
 456 }
 457
 458 /*
 459    This function makes lazy skb cloning in hope that most of packets
 460    are discarded by BPF.
 461
 462    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 463    and skb->cb are mangled. It works because (and until) packets
 464    falling here are owned by current CPU. Output packets are cloned
 465    by dev_queue_xmit_nit(), input packets are processed by net_bh
 466    sequencially, so that if we return skb to original state on exit,
 467    we will not harm anyone.
 468  */
 469
 470 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 471 {
 472         struct sock *sk;
 473         struct sockaddr_ll *sll;
 474         struct packet_sock *po;
 475         u8 * skb_head = skb->data;
 476         int skb_len = skb->len;
 477         unsigned int snaplen, res;
 478
 479         if (skb->pkt_type == PACKET_LOOPBACK)
 480                 goto drop;
 481
 482         sk = pt->af_packet_priv;
 483         po = pkt_sk(sk);
 484
 485         skb->dev = dev;
 486
 487         if (dev->hard_header) {
 488                 /* The device has an explicit notion of ll header,
 489                    exported to higher levels.
 490
 491                    Otherwise, the device hides datails of it frame
 492                    structure, so that corresponding packet head
 493                    never delivered to user.
 494                  */
 495                 if (sk->sk_type != SOCK_DGRAM)
 496                         skb_push(skb, skb->data - skb->mac.raw);
 497                 else if (skb->pkt_type == PACKET_OUTGOING) {
 498                         /* Special case: outgoing packets have ll header at head */
 499                         skb_pull(skb, skb->nh.raw - skb->data);
 500                 }
 501         }
 502
 503         snaplen = skb->len;
 504
 505         res = run_filter(skb, sk, snaplen);
 506         if (!res)
 507                 goto drop_n_restore;
 508         if (snaplen > res)
 509                 snaplen = res;
 510
 511         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 512             (unsigned)sk->sk_rcvbuf)
 513                 goto drop_n_acct;
 514
 515         if (skb_shared(skb)) {
 516                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 517                 if (nskb == NULL)
 518                         goto drop_n_acct;
 519
 520                 if (skb_head != skb->data) {
 521                         skb->data = skb_head;
 522                         skb->len = skb_len;
 523                 }
 524                 kfree_skb(skb);
 525                 skb = nskb;
 526         }
 527
 528         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 529                      sizeof(skb->cb));
 530
 531         sll = &PACKET_SKB_CB(skb)->sa.ll;
 532         sll->sll_family = AF_PACKET;
 533         sll->sll_hatype = dev->type;
 534         sll->sll_protocol = skb->protocol;
 535         sll->sll_pkttype = skb->pkt_type;
 536         sll->sll_ifindex = dev->ifindex;
 537         sll->sll_halen = 0;
 538
 539         if (dev->hard_header_parse)
 540                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 541
 542         PACKET_SKB_CB(skb)->origlen = skb->len;
 543
 544         if (pskb_trim(skb, snaplen))
 545                 goto drop_n_acct;
 546
 547         skb_set_owner_r(skb, sk);
 548         skb->dev = NULL;
 549         dst_release(skb->dst);
 550         skb->dst = NULL;
 551
 552         /* drop conntrack reference */
 553         nf_reset(skb);
 554
 555         spin_lock(&sk->sk_receive_queue.lock);
 556         po->stats.tp_packets++;
 557         __skb_queue_tail(&sk->sk_receive_queue, skb);
 558         spin_unlock(&sk->sk_receive_queue.lock);
 559         sk->sk_data_ready(sk, skb->len);
 560         return 0;
 561
 562 drop_n_acct:
 563         spin_lock(&sk->sk_receive_queue.lock);
 564         po->stats.tp_drops++;
 565         spin_unlock(&sk->sk_receive_queue.lock);
 566
 567 drop_n_restore:
 568         if (skb_head != skb->data && skb_shared(skb)) {
 569                 skb->data = skb_head;
 570                 skb->len = skb_len;
 571         }
 572 drop:
 573         kfree_skb(skb);
 574         return 0;
 575 }
 576
 577 #ifdef CONFIG_PACKET_MMAP
 578 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 579 {
 580         struct sock *sk;
 581         struct packet_sock *po;
 582         struct sockaddr_ll *sll;
 583         struct tpacket_hdr *h;
 584         u8 * skb_head = skb->data;
 585         int skb_len = skb->len;
 586         unsigned int snaplen, res;
 587         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 588         unsigned short macoff, netoff;
 589         struct sk_buff *copy_skb = NULL;
 590
 591         if (skb->pkt_type == PACKET_LOOPBACK)
 592                 goto drop;
 593
 594         sk = pt->af_packet_priv;
 595         po = pkt_sk(sk);
 596
 597         if (dev->hard_header) {
 598                 if (sk->sk_type != SOCK_DGRAM)
 599                         skb_push(skb, skb->data - skb->mac.raw);
 600                 else if (skb->pkt_type == PACKET_OUTGOING) {
 601                         /* Special case: outgoing packets have ll header at head */
 602                         skb_pull(skb, skb->nh.raw - skb->data);
 603                 }
 604         }
 605
 606         if (skb->ip_summed == CHECKSUM_PARTIAL)
 607                 status |= TP_STATUS_CSUMNOTREADY;
 608
 609         snaplen = skb->len;
 610
 611         res = run_filter(skb, sk, snaplen);
 612         if (!res)
 613                 goto drop_n_restore;
 614         if (snaplen > res)
 615                 snaplen = res;
 616
 617         if (sk->sk_type == SOCK_DGRAM) {
 618                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 619         } else {
 620                 unsigned maclen = skb->nh.raw - skb->data;
 621                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 622                 macoff = netoff - maclen;
 623         }
 624
 625         if (macoff + snaplen > po->frame_size) {
 626                 if (po->copy_thresh &&
 627                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 628                     (unsigned)sk->sk_rcvbuf) {
 629                         if (skb_shared(skb)) {
 630                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 631                         } else {
 632                                 copy_skb = skb_get(skb);
 633                                 skb_head = skb->data;
 634                         }
 635                         if (copy_skb)
 636                                 skb_set_owner_r(copy_skb, sk);
 637                 }
 638                 snaplen = po->frame_size - macoff;
 639                 if ((int)snaplen < 0)
 640                         snaplen = 0;
 641         }
 642
 643         spin_lock(&sk->sk_receive_queue.lock);
 644         h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
 645
 646         if (h->tp_status)
 647                 goto ring_is_full;
 648         po->head = po->head != po->frame_max ? po->head+1 : 0;
 649         po->stats.tp_packets++;
 650         if (copy_skb) {
 651                 status |= TP_STATUS_COPY;
 652                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 653         }
 654         if (!po->stats.tp_drops)
 655                 status &= ~TP_STATUS_LOSING;
 656         spin_unlock(&sk->sk_receive_queue.lock);
 657
 658         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 659
 660         h->tp_len = skb->len;
 661         h->tp_snaplen = snaplen;
 662         h->tp_mac = macoff;
 663         h->tp_net = netoff;
 664         if (skb->tstamp.off_sec == 0) {
 665                 __net_timestamp(skb);
 666                 sock_enable_timestamp(sk);
 667         }
 668         h->tp_sec = skb->tstamp.off_sec;
 669         h->tp_usec = skb->tstamp.off_usec;
 670
 671         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 672         sll->sll_halen = 0;
 673         if (dev->hard_header_parse)
 674                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 675         sll->sll_family = AF_PACKET;
 676         sll->sll_hatype = dev->type;
 677         sll->sll_protocol = skb->protocol;
 678         sll->sll_pkttype = skb->pkt_type;
 679         sll->sll_ifindex = dev->ifindex;
 680
 681         h->tp_status = status;
 682         smp_mb();
 683
 684         {
 685                 struct page *p_start, *p_end;
 686                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 687
 688                 p_start = virt_to_page(h);
 689                 p_end = virt_to_page(h_end);
 690                 while (p_start <= p_end) {
 691                         flush_dcache_page(p_start);
 692                         p_start++;
 693                 }
 694         }
 695
 696         sk->sk_data_ready(sk, 0);
 697
 698 drop_n_restore:
 699         if (skb_head != skb->data && skb_shared(skb)) {
 700                 skb->data = skb_head;
 701                 skb->len = skb_len;
 702         }
 703 drop:
 704         kfree_skb(skb);
 705         return 0;
 706
 707 ring_is_full:
 708         po->stats.tp_drops++;
 709         spin_unlock(&sk->sk_receive_queue.lock);
 710
 711         sk->sk_data_ready(sk, 0);
 712         if (copy_skb)
 713                 kfree_skb(copy_skb);
 714         goto drop_n_restore;
 715 }
 716
 717 #endif
 718
 719
 720 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 721                           struct msghdr *msg, size_t len)
 722 {
 723         struct sock *sk = sock->sk;
 724         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 725         struct sk_buff *skb;
 726         struct net_device *dev;
 727         __be16 proto;
 728         unsigned char *addr;
 729         int ifindex, err, reserve = 0;
 730
 731         /*
 732          *      Get and verify the address.
 733          */
 734
 735         if (saddr == NULL) {
 736                 struct packet_sock *po = pkt_sk(sk);
 737
 738                 ifindex = po->ifindex;
 739                 proto   = po->num;
 740                 addr    = NULL;
 741         } else {
 742                 err = -EINVAL;
 743                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 744                         goto out;
 745                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 746                         goto out;
 747                 ifindex = saddr->sll_ifindex;
 748                 proto   = saddr->sll_protocol;
 749                 addr    = saddr->sll_addr;
 750         }
 751
 752
 753         dev = dev_get_by_index(ifindex);
 754         err = -ENXIO;
 755         if (dev == NULL)
 756                 goto out_unlock;
 757         if (sock->type == SOCK_RAW)
 758                 reserve = dev->hard_header_len;
 759
 760         err = -ENETDOWN;
 761         if (!(dev->flags & IFF_UP))
 762                 goto out_unlock;
 763
 764         err = -EMSGSIZE;
 765         if (len > dev->mtu+reserve)
 766                 goto out_unlock;
 767
 768         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 769                                 msg->msg_flags & MSG_DONTWAIT, &err);
 770         if (skb==NULL)
 771                 goto out_unlock;
 772
 773         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 774         skb->nh.raw = skb->data;
 775
 776         if (dev->hard_header) {
 777                 int res;
 778                 err = -EINVAL;
 779                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 780                 if (sock->type != SOCK_DGRAM) {
 781                         skb->tail = skb->data;
 782                         skb->len = 0;
 783                 } else if (res < 0)
 784                         goto out_free;
 785         }
 786
 787         /* Returns -EFAULT on error */
 788         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 789         if (err)
 790                 goto out_free;
 791
 792         skb->protocol = proto;
 793         skb->dev = dev;
 794         skb->priority = sk->sk_priority;
 795
 796         /*
 797          *      Now send it
 798          */
 799
 800         err = dev_queue_xmit(skb);
 801         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 802                 goto out_unlock;
 803
 804         dev_put(dev);
 805
 806         return(len);
 807
 808 out_free:
 809         kfree_skb(skb);
 810 out_unlock:
 811         if (dev)
 812                 dev_put(dev);
 813 out:
 814         return err;
 815 }
 816
 817 /*
 818  *      Close a PACKET socket. This is fairly simple. We immediately go
 819  *      to 'closed' state and remove our protocol entry in the device list.
 820  */
 821
 822 static int packet_release(struct socket *sock)
 823 {
 824         struct sock *sk = sock->sk;
 825         struct packet_sock *po;
 826
 827         if (!sk)
 828                 return 0;
 829
 830         po = pkt_sk(sk);
 831
 832         write_lock_bh(&packet_sklist_lock);
 833         sk_del_node_init(sk);
 834         write_unlock_bh(&packet_sklist_lock);
 835
 836         /*
 837          *      Unhook packet receive handler.
 838          */
 839
 840         if (po->running) {
 841                 /*
 842                  *      Remove the protocol hook
 843                  */
 844                 dev_remove_pack(&po->prot_hook);
 845                 po->running = 0;
 846                 po->num = 0;
 847                 __sock_put(sk);
 848         }
 849
 850 #ifdef CONFIG_PACKET_MULTICAST
 851         packet_flush_mclist(sk);
 852 #endif
 853
 854 #ifdef CONFIG_PACKET_MMAP
 855         if (po->pg_vec) {
 856                 struct tpacket_req req;
 857                 memset(&req, 0, sizeof(req));
 858                 packet_set_ring(sk, &req, 1);
 859         }
 860 #endif
 861
 862         /*
 863          *      Now the socket is dead. No more input will appear.
 864          */
 865
 866         sock_orphan(sk);
 867         sock->sk = NULL;
 868
 869         /* Purge queues */
 870
 871         skb_queue_purge(&sk->sk_receive_queue);
 872
 873         sock_put(sk);
 874         return 0;
 875 }
 876
 877 /*
 878  *      Attach a packet hook.
 879  */
 880
 881 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 882 {
 883         struct packet_sock *po = pkt_sk(sk);
 884         /*
 885          *      Detach an existing hook if present.
 886          */
 887
 888         lock_sock(sk);
 889
 890         spin_lock(&po->bind_lock);
 891         if (po->running) {
 892                 __sock_put(sk);
 893                 po->running = 0;
 894                 po->num = 0;
 895                 spin_unlock(&po->bind_lock);
 896                 dev_remove_pack(&po->prot_hook);
 897                 spin_lock(&po->bind_lock);
 898         }
 899
 900         po->num = protocol;
 901         po->prot_hook.type = protocol;
 902         po->prot_hook.dev = dev;
 903
 904         po->ifindex = dev ? dev->ifindex : 0;
 905
 906         if (protocol == 0)
 907                 goto out_unlock;
 908
 909         if (dev) {
 910                 if (dev->flags&IFF_UP) {
 911                         dev_add_pack(&po->prot_hook);
 912                         sock_hold(sk);
 913                         po->running = 1;
 914                 } else {
 915                         sk->sk_err = ENETDOWN;
 916                         if (!sock_flag(sk, SOCK_DEAD))
 917                                 sk->sk_error_report(sk);
 918                 }
 919         } else {
 920                 dev_add_pack(&po->prot_hook);
 921                 sock_hold(sk);
 922                 po->running = 1;
 923         }
 924
 925 out_unlock:
 926         spin_unlock(&po->bind_lock);
 927         release_sock(sk);
 928         return 0;
 929 }
 930
 931 /*
 932  *      Bind a packet socket to a device
 933  */
 934
 935 #ifdef CONFIG_SOCK_PACKET
 936
 937 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 938 {
 939         struct sock *sk=sock->sk;
 940         char name[15];
 941         struct net_device *dev;
 942         int err = -ENODEV;
 943
 944         /*
 945          *      Check legality
 946          */
 947
 948         if (addr_len != sizeof(struct sockaddr))
 949                 return -EINVAL;
 950         strlcpy(name,uaddr->sa_data,sizeof(name));
 951
 952         dev = dev_get_by_name(name);
 953         if (dev) {
 954                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 955                 dev_put(dev);
 956         }
 957         return err;
 958 }
 959 #endif
 960
 961 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 962 {
 963         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 964         struct sock *sk=sock->sk;
 965         struct net_device *dev = NULL;
 966         int err;
 967
 968
 969         /*
 970          *      Check legality
 971          */
 972
 973         if (addr_len < sizeof(struct sockaddr_ll))
 974                 return -EINVAL;
 975         if (sll->sll_family != AF_PACKET)
 976                 return -EINVAL;
 977
 978         if (sll->sll_ifindex) {
 979                 err = -ENODEV;
 980                 dev = dev_get_by_index(sll->sll_ifindex);
 981                 if (dev == NULL)
 982                         goto out;
 983         }
 984         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 985         if (dev)
 986                 dev_put(dev);
 987
 988 out:
 989         return err;
 990 }
 991
 992 static struct proto packet_proto = {
 993         .name     = "PACKET",
 994         .owner    = THIS_MODULE,
 995         .obj_size = sizeof(struct packet_sock),
 996 };
 997
 998 /*
 999  *      Create a packet of type SOCK_PACKET.
1000  */
1001
1002 static int packet_create(struct socket *sock, int protocol)
1003 {
1004         struct sock *sk;
1005         struct packet_sock *po;
1006         __be16 proto = (__force __be16)protocol; /* weird, but documented */
1007         int err;
1008
1009         if (!capable(CAP_NET_RAW))
1010                 return -EPERM;
1011         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
1012 #ifdef CONFIG_SOCK_PACKET
1013             && sock->type != SOCK_PACKET
1014 #endif
1015             )
1016                 return -ESOCKTNOSUPPORT;
1017
1018         sock->state = SS_UNCONNECTED;
1019
1020         err = -ENOBUFS;
1021         sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1022         if (sk == NULL)
1023                 goto out;
1024
1025         sock->ops = &packet_ops;
1026 #ifdef CONFIG_SOCK_PACKET
1027         if (sock->type == SOCK_PACKET)
1028                 sock->ops = &packet_ops_spkt;
1029 #endif
1030         sock_init_data(sock, sk);
1031
1032         po = pkt_sk(sk);
1033         sk->sk_family = PF_PACKET;
1034         po->num = proto;
1035
1036         sk->sk_destruct = packet_sock_destruct;
1037         atomic_inc(&packet_socks_nr);
1038
1039         /*
1040          *      Attach a protocol block
1041          */
1042
1043         spin_lock_init(&po->bind_lock);
1044         po->prot_hook.func = packet_rcv;
1045 #ifdef CONFIG_SOCK_PACKET
1046         if (sock->type == SOCK_PACKET)
1047                 po->prot_hook.func = packet_rcv_spkt;
1048 #endif
1049         po->prot_hook.af_packet_priv = sk;
1050
1051         if (proto) {
1052                 po->prot_hook.type = proto;
1053                 dev_add_pack(&po->prot_hook);
1054                 sock_hold(sk);
1055                 po->running = 1;
1056         }
1057
1058         write_lock_bh(&packet_sklist_lock);
1059         sk_add_node(sk, &packet_sklist);
1060         write_unlock_bh(&packet_sklist_lock);
1061         return(0);
1062 out:
1063         return err;
1064 }
1065
1066 /*
1067  *      Pull a packet from our receive queue and hand it to the user.
1068  *      If necessary we block.
1069  */
1070
1071 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1072                           struct msghdr *msg, size_t len, int flags)
1073 {
1074         struct sock *sk = sock->sk;
1075         struct sk_buff *skb;
1076         int copied, err;
1077         struct sockaddr_ll *sll;
1078
1079         err = -EINVAL;
1080         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1081                 goto out;
1082
1083 #if 0
1084         /* What error should we return now? EUNATTACH? */
1085         if (pkt_sk(sk)->ifindex < 0)
1086                 return -ENODEV;
1087 #endif
1088
1089         /*
1090          *      Call the generic datagram receiver. This handles all sorts
1091          *      of horrible races and re-entrancy so we can forget about it
1092          *      in the protocol layers.
1093          *
1094          *      Now it will return ENETDOWN, if device have just gone down,
1095          *      but then it will block.
1096          */
1097
1098         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1099
1100         /*
1101          *      An error occurred so return it. Because skb_recv_datagram()
1102          *      handles the blocking we don't see and worry about blocking
1103          *      retries.
1104          */
1105
1106         if (skb == NULL)
1107                 goto out;
1108
1109         /*
1110          *      If the address length field is there to be filled in, we fill
1111          *      it in now.
1112          */
1113
1114         sll = &PACKET_SKB_CB(skb)->sa.ll;
1115         if (sock->type == SOCK_PACKET)
1116                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1117         else
1118                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1119
1120         /*
1121          *      You lose any data beyond the buffer you gave. If it worries a
1122          *      user program they can ask the device for its MTU anyway.
1123          */
1124
1125         copied = skb->len;
1126         if (copied > len)
1127         {
1128                 copied=len;
1129                 msg->msg_flags|=MSG_TRUNC;
1130         }
1131
1132         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1133         if (err)
1134                 goto out_free;
1135
1136         sock_recv_timestamp(msg, sk, skb);
1137
1138         if (msg->msg_name)
1139                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1140                        msg->msg_namelen);
1141
1142         if (pkt_sk(sk)->auxdata) {
1143                 struct tpacket_auxdata aux;
1144
1145                 aux.tp_status = TP_STATUS_USER;
1146                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1147                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1148                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1149                 aux.tp_snaplen = skb->len;
1150                 aux.tp_mac = 0;
1151                 aux.tp_net = skb->nh.raw - skb->data;
1152
1153                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1154         }
1155
1156         /*
1157          *      Free or return the buffer as appropriate. Again this
1158          *      hides all the races and re-entrancy issues from us.
1159          */
1160         err = (flags&MSG_TRUNC) ? skb->len : copied;
1161
1162 out_free:
1163         skb_free_datagram(sk, skb);
1164 out:
1165         return err;
1166 }
1167
1168 #ifdef CONFIG_SOCK_PACKET
1169 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1170                                int *uaddr_len, int peer)
1171 {
1172         struct net_device *dev;
1173         struct sock *sk = sock->sk;
1174
1175         if (peer)
1176                 return -EOPNOTSUPP;
1177
1178         uaddr->sa_family = AF_PACKET;
1179         dev = dev_get_by_index(pkt_sk(sk)->ifindex);
1180         if (dev) {
1181                 strlcpy(uaddr->sa_data, dev->name, 15);
1182                 dev_put(dev);
1183         } else
1184                 memset(uaddr->sa_data, 0, 14);
1185         *uaddr_len = sizeof(*uaddr);
1186
1187         return 0;
1188 }
1189 #endif
1190
1191 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1192                           int *uaddr_len, int peer)
1193 {
1194         struct net_device *dev;
1195         struct sock *sk = sock->sk;
1196         struct packet_sock *po = pkt_sk(sk);
1197         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1198
1199         if (peer)
1200                 return -EOPNOTSUPP;
1201
1202         sll->sll_family = AF_PACKET;
1203         sll->sll_ifindex = po->ifindex;
1204         sll->sll_protocol = po->num;
1205         dev = dev_get_by_index(po->ifindex);
1206         if (dev) {
1207                 sll->sll_hatype = dev->type;
1208                 sll->sll_halen = dev->addr_len;
1209                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1210                 dev_put(dev);
1211         } else {
1212                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1213                 sll->sll_halen = 0;
1214         }
1215         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1216
1217         return 0;
1218 }
1219
1220 #ifdef CONFIG_PACKET_MULTICAST
1221 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1222 {
1223         switch (i->type) {
1224         case PACKET_MR_MULTICAST:
1225                 if (what > 0)
1226                         dev_mc_add(dev, i->addr, i->alen, 0);
1227                 else
1228                         dev_mc_delete(dev, i->addr, i->alen, 0);
1229                 break;
1230         case PACKET_MR_PROMISC:
1231                 dev_set_promiscuity(dev, what);
1232                 break;
1233         case PACKET_MR_ALLMULTI:
1234                 dev_set_allmulti(dev, what);
1235                 break;
1236         default:;
1237         }
1238 }
1239
1240 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1241 {
1242         for ( ; i; i=i->next) {
1243                 if (i->ifindex == dev->ifindex)
1244                         packet_dev_mc(dev, i, what);
1245         }
1246 }
1247
1248 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1249 {
1250         struct packet_sock *po = pkt_sk(sk);
1251         struct packet_mclist *ml, *i;
1252         struct net_device *dev;
1253         int err;
1254
1255         rtnl_lock();
1256
1257         err = -ENODEV;
1258         dev = __dev_get_by_index(mreq->mr_ifindex);
1259         if (!dev)
1260                 goto done;
1261
1262         err = -EINVAL;
1263         if (mreq->mr_alen > dev->addr_len)
1264                 goto done;
1265
1266         err = -ENOBUFS;
1267         i = kmalloc(sizeof(*i), GFP_KERNEL);
1268         if (i == NULL)
1269                 goto done;
1270
1271         err = 0;
1272         for (ml = po->mclist; ml; ml = ml->next) {
1273                 if (ml->ifindex == mreq->mr_ifindex &&
1274                     ml->type == mreq->mr_type &&
1275                     ml->alen == mreq->mr_alen &&
1276                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1277                         ml->count++;
1278                         /* Free the new element ... */
1279                         kfree(i);
1280                         goto done;
1281                 }
1282         }
1283
1284         i->type = mreq->mr_type;
1285         i->ifindex = mreq->mr_ifindex;
1286         i->alen = mreq->mr_alen;
1287         memcpy(i->addr, mreq->mr_address, i->alen);
1288         i->count = 1;
1289         i->next = po->mclist;
1290         po->mclist = i;
1291         packet_dev_mc(dev, i, +1);
1292
1293 done:
1294         rtnl_unlock();
1295         return err;
1296 }
1297
1298 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1299 {
1300         struct packet_mclist *ml, **mlp;
1301
1302         rtnl_lock();
1303
1304         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1305                 if (ml->ifindex == mreq->mr_ifindex &&
1306                     ml->type == mreq->mr_type &&
1307                     ml->alen == mreq->mr_alen &&
1308                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1309                         if (--ml->count == 0) {
1310                                 struct net_device *dev;
1311                                 *mlp = ml->next;
1312                                 dev = dev_get_by_index(ml->ifindex);
1313                                 if (dev) {
1314                                         packet_dev_mc(dev, ml, -1);
1315                                         dev_put(dev);
1316                                 }
1317                                 kfree(ml);
1318                         }
1319                         rtnl_unlock();
1320                         return 0;
1321                 }
1322         }
1323         rtnl_unlock();
1324         return -EADDRNOTAVAIL;
1325 }
1326
1327 static void packet_flush_mclist(struct sock *sk)
1328 {
1329         struct packet_sock *po = pkt_sk(sk);
1330         struct packet_mclist *ml;
1331
1332         if (!po->mclist)
1333                 return;
1334
1335         rtnl_lock();
1336         while ((ml = po->mclist) != NULL) {
1337                 struct net_device *dev;
1338
1339                 po->mclist = ml->next;
1340                 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) {
1341                         packet_dev_mc(dev, ml, -1);
1342                         dev_put(dev);
1343                 }
1344                 kfree(ml);
1345         }
1346         rtnl_unlock();
1347 }
1348 #endif
1349
1350 static int
1351 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1352 {
1353         struct sock *sk = sock->sk;
1354         struct packet_sock *po = pkt_sk(sk);
1355         int ret;
1356
1357         if (level != SOL_PACKET)
1358                 return -ENOPROTOOPT;
1359
1360         switch(optname) {
1361 #ifdef CONFIG_PACKET_MULTICAST
1362         case PACKET_ADD_MEMBERSHIP:
1363         case PACKET_DROP_MEMBERSHIP:
1364         {
1365                 struct packet_mreq_max mreq;
1366                 int len = optlen;
1367                 memset(&mreq, 0, sizeof(mreq));
1368                 if (len < sizeof(struct packet_mreq))
1369                         return -EINVAL;
1370                 if (len > sizeof(mreq))
1371                         len = sizeof(mreq);
1372                 if (copy_from_user(&mreq,optval,len))
1373                         return -EFAULT;
1374                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1375                         return -EINVAL;
1376                 if (optname == PACKET_ADD_MEMBERSHIP)
1377                         ret = packet_mc_add(sk, &mreq);
1378                 else
1379                         ret = packet_mc_drop(sk, &mreq);
1380                 return ret;
1381         }
1382 #endif
1383 #ifdef CONFIG_PACKET_MMAP
1384         case PACKET_RX_RING:
1385         {
1386                 struct tpacket_req req;
1387
1388                 if (optlen<sizeof(req))
1389                         return -EINVAL;
1390                 if (copy_from_user(&req,optval,sizeof(req)))
1391                         return -EFAULT;
1392                 return packet_set_ring(sk, &req, 0);
1393         }
1394         case PACKET_COPY_THRESH:
1395         {
1396                 int val;
1397
1398                 if (optlen!=sizeof(val))
1399                         return -EINVAL;
1400                 if (copy_from_user(&val,optval,sizeof(val)))
1401                         return -EFAULT;
1402
1403                 pkt_sk(sk)->copy_thresh = val;
1404                 return 0;
1405         }
1406 #endif
1407         case PACKET_AUXDATA:
1408         {
1409                 int val;
1410
1411                 if (optlen < sizeof(val))
1412                         return -EINVAL;
1413                 if (copy_from_user(&val, optval, sizeof(val)))
1414                         return -EFAULT;
1415
1416                 po->auxdata = !!val;
1417                 return 0;
1418         }
1419         default:
1420                 return -ENOPROTOOPT;
1421         }
1422 }
1423
1424 static int packet_getsockopt(struct socket *sock, int level, int optname,
1425                              char __user *optval, int __user *optlen)
1426 {
1427         int len;
1428         int val;
1429         struct sock *sk = sock->sk;
1430         struct packet_sock *po = pkt_sk(sk);
1431         void *data;
1432         struct tpacket_stats st;
1433
1434         if (level != SOL_PACKET)
1435                 return -ENOPROTOOPT;
1436
1437         if (get_user(len, optlen))
1438                 return -EFAULT;
1439
1440         if (len < 0)
1441                 return -EINVAL;
1442
1443         switch(optname) {
1444         case PACKET_STATISTICS:
1445                 if (len > sizeof(struct tpacket_stats))
1446                         len = sizeof(struct tpacket_stats);
1447                 spin_lock_bh(&sk->sk_receive_queue.lock);
1448                 st = po->stats;
1449                 memset(&po->stats, 0, sizeof(st));
1450                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1451                 st.tp_packets += st.tp_drops;
1452
1453                 data = &st;
1454                 break;
1455         case PACKET_AUXDATA:
1456                 if (len > sizeof(int))
1457                         len = sizeof(int);
1458                 val = po->auxdata;
1459
1460                 data = &val;
1461                 break;
1462         default:
1463                 return -ENOPROTOOPT;
1464         }
1465
1466         if (put_user(len, optlen))
1467                 return -EFAULT;
1468         if (copy_to_user(optval, data, len))
1469                 return -EFAULT;
1470         return 0;
1471 }
1472
1473
1474 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1475 {
1476         struct sock *sk;
1477         struct hlist_node *node;
1478         struct net_device *dev = (struct net_device*)data;
1479
1480         read_lock(&packet_sklist_lock);
1481         sk_for_each(sk, node, &packet_sklist) {
1482                 struct packet_sock *po = pkt_sk(sk);
1483
1484                 switch (msg) {
1485                 case NETDEV_UNREGISTER:
1486 #ifdef CONFIG_PACKET_MULTICAST
1487                         if (po->mclist)
1488                                 packet_dev_mclist(dev, po->mclist, -1);
1489                         // fallthrough
1490 #endif
1491                 case NETDEV_DOWN:
1492                         if (dev->ifindex == po->ifindex) {
1493                                 spin_lock(&po->bind_lock);
1494                                 if (po->running) {
1495                                         __dev_remove_pack(&po->prot_hook);
1496                                         __sock_put(sk);
1497                                         po->running = 0;
1498                                         sk->sk_err = ENETDOWN;
1499                                         if (!sock_flag(sk, SOCK_DEAD))
1500                                                 sk->sk_error_report(sk);
1501                                 }
1502                                 if (msg == NETDEV_UNREGISTER) {
1503                                         po->ifindex = -1;
1504                                         po->prot_hook.dev = NULL;
1505                                 }
1506                                 spin_unlock(&po->bind_lock);
1507                         }
1508                         break;
1509                 case NETDEV_UP:
1510                         spin_lock(&po->bind_lock);
1511                         if (dev->ifindex == po->ifindex && po->num &&
1512                             !po->running) {
1513                                 dev_add_pack(&po->prot_hook);
1514                                 sock_hold(sk);
1515                                 po->running = 1;
1516                         }
1517                         spin_unlock(&po->bind_lock);
1518                         break;
1519                 }
1520         }
1521         read_unlock(&packet_sklist_lock);
1522         return NOTIFY_DONE;
1523 }
1524
1525
1526 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1527                         unsigned long arg)
1528 {
1529         struct sock *sk = sock->sk;
1530
1531         switch(cmd) {
1532                 case SIOCOUTQ:
1533                 {
1534                         int amount = atomic_read(&sk->sk_wmem_alloc);
1535                         return put_user(amount, (int __user *)arg);
1536                 }
1537                 case SIOCINQ:
1538                 {
1539                         struct sk_buff *skb;
1540                         int amount = 0;
1541
1542                         spin_lock_bh(&sk->sk_receive_queue.lock);
1543                         skb = skb_peek(&sk->sk_receive_queue);
1544                         if (skb)
1545                                 amount = skb->len;
1546                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1547                         return put_user(amount, (int __user *)arg);
1548                 }
1549                 case SIOCGSTAMP:
1550                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1551
1552 #ifdef CONFIG_INET
1553                 case SIOCADDRT:
1554                 case SIOCDELRT:
1555                 case SIOCDARP:
1556                 case SIOCGARP:
1557                 case SIOCSARP:
1558                 case SIOCGIFADDR:
1559                 case SIOCSIFADDR:
1560                 case SIOCGIFBRDADDR:
1561                 case SIOCSIFBRDADDR:
1562                 case SIOCGIFNETMASK:
1563                 case SIOCSIFNETMASK:
1564                 case SIOCGIFDSTADDR:
1565                 case SIOCSIFDSTADDR:
1566                 case SIOCSIFFLAGS:
1567                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1568 #endif
1569
1570                 default:
1571                         return -ENOIOCTLCMD;
1572         }
1573         return 0;
1574 }
1575
1576 #ifndef CONFIG_PACKET_MMAP
1577 #define packet_mmap sock_no_mmap
1578 #define packet_poll datagram_poll
1579 #else
1580
1581 static unsigned int packet_poll(struct file * file, struct socket *sock,
1582                                 poll_table *wait)
1583 {
1584         struct sock *sk = sock->sk;
1585         struct packet_sock *po = pkt_sk(sk);
1586         unsigned int mask = datagram_poll(file, sock, wait);
1587
1588         spin_lock_bh(&sk->sk_receive_queue.lock);
1589         if (po->pg_vec) {
1590                 unsigned last = po->head ? po->head-1 : po->frame_max;
1591                 struct tpacket_hdr *h;
1592
1593                 h = (struct tpacket_hdr *)packet_lookup_frame(po, last);
1594
1595                 if (h->tp_status)
1596                         mask |= POLLIN | POLLRDNORM;
1597         }
1598         spin_unlock_bh(&sk->sk_receive_queue.lock);
1599         return mask;
1600 }
1601
1602
1603 /* Dirty? Well, I still did not learn better way to account
1604  * for user mmaps.
1605  */
1606
1607 static void packet_mm_open(struct vm_area_struct *vma)
1608 {
1609         struct file *file = vma->vm_file;
1610         struct socket * sock = file->private_data;
1611         struct sock *sk = sock->sk;
1612
1613         if (sk)
1614                 atomic_inc(&pkt_sk(sk)->mapped);
1615 }
1616
1617 static void packet_mm_close(struct vm_area_struct *vma)
1618 {
1619         struct file *file = vma->vm_file;
1620         struct socket * sock = file->private_data;
1621         struct sock *sk = sock->sk;
1622
1623         if (sk)
1624                 atomic_dec(&pkt_sk(sk)->mapped);
1625 }
1626
1627 static struct vm_operations_struct packet_mmap_ops = {
1628         .open = packet_mm_open,
1629         .close =packet_mm_close,
1630 };
1631
1632 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1633 {
1634         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1635 }
1636
1637 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1638 {
1639         int i;
1640
1641         for (i = 0; i < len; i++) {
1642                 if (likely(pg_vec[i]))
1643                         free_pages((unsigned long) pg_vec[i], order);
1644         }
1645         kfree(pg_vec);
1646 }
1647
1648 static inline char *alloc_one_pg_vec_page(unsigned long order)
1649 {
1650         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1651                                          order);
1652 }
1653
1654 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1655 {
1656         unsigned int block_nr = req->tp_block_nr;
1657         char **pg_vec;
1658         int i;
1659
1660         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1661         if (unlikely(!pg_vec))
1662                 goto out;
1663
1664         for (i = 0; i < block_nr; i++) {
1665                 pg_vec[i] = alloc_one_pg_vec_page(order);
1666                 if (unlikely(!pg_vec[i]))
1667                         goto out_free_pgvec;
1668         }
1669
1670 out:
1671         return pg_vec;
1672
1673 out_free_pgvec:
1674         free_pg_vec(pg_vec, order, block_nr);
1675         pg_vec = NULL;
1676         goto out;
1677 }
1678
1679 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1680 {
1681         char **pg_vec = NULL;
1682         struct packet_sock *po = pkt_sk(sk);
1683         int was_running, order = 0;
1684         __be16 num;
1685         int err = 0;
1686
1687         if (req->tp_block_nr) {
1688                 int i, l;
1689
1690                 /* Sanity tests and some calculations */
1691
1692                 if (unlikely(po->pg_vec))
1693                         return -EBUSY;
1694
1695                 if (unlikely((int)req->tp_block_size <= 0))
1696                         return -EINVAL;
1697                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1698                         return -EINVAL;
1699                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1700                         return -EINVAL;
1701                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1702                         return -EINVAL;
1703
1704                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1705                 if (unlikely(po->frames_per_block <= 0))
1706                         return -EINVAL;
1707                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1708                              req->tp_frame_nr))
1709                         return -EINVAL;
1710
1711                 err = -ENOMEM;
1712                 order = get_order(req->tp_block_size);
1713                 pg_vec = alloc_pg_vec(req, order);
1714                 if (unlikely(!pg_vec))
1715                         goto out;
1716
1717                 l = 0;
1718                 for (i = 0; i < req->tp_block_nr; i++) {
1719                         char *ptr = pg_vec[i];
1720                         struct tpacket_hdr *header;
1721                         int k;
1722
1723                         for (k = 0; k < po->frames_per_block; k++) {
1724                                 header = (struct tpacket_hdr *) ptr;
1725                                 header->tp_status = TP_STATUS_KERNEL;
1726                                 ptr += req->tp_frame_size;
1727                         }
1728                 }
1729                 /* Done */
1730         } else {
1731                 if (unlikely(req->tp_frame_nr))
1732                         return -EINVAL;
1733         }
1734
1735         lock_sock(sk);
1736
1737         /* Detach socket from network */
1738         spin_lock(&po->bind_lock);
1739         was_running = po->running;
1740         num = po->num;
1741         if (was_running) {
1742                 __dev_remove_pack(&po->prot_hook);
1743                 po->num = 0;
1744                 po->running = 0;
1745                 __sock_put(sk);
1746         }
1747         spin_unlock(&po->bind_lock);
1748
1749         synchronize_net();
1750
1751         err = -EBUSY;
1752         if (closing || atomic_read(&po->mapped) == 0) {
1753                 err = 0;
1754 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1755
1756                 spin_lock_bh(&sk->sk_receive_queue.lock);
1757                 pg_vec = XC(po->pg_vec, pg_vec);
1758                 po->frame_max = (req->tp_frame_nr - 1);
1759                 po->head = 0;
1760                 po->frame_size = req->tp_frame_size;
1761                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1762
1763                 order = XC(po->pg_vec_order, order);
1764                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1765
1766                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1767                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1768                 skb_queue_purge(&sk->sk_receive_queue);
1769 #undef XC
1770                 if (atomic_read(&po->mapped))
1771                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1772         }
1773
1774         spin_lock(&po->bind_lock);
1775         if (was_running && !po->running) {
1776                 sock_hold(sk);
1777                 po->running = 1;
1778                 po->num = num;
1779                 dev_add_pack(&po->prot_hook);
1780         }
1781         spin_unlock(&po->bind_lock);
1782
1783         release_sock(sk);
1784
1785         if (pg_vec)
1786                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1787 out:
1788         return err;
1789 }
1790
1791 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1792 {
1793         struct sock *sk = sock->sk;
1794         struct packet_sock *po = pkt_sk(sk);
1795         unsigned long size;
1796         unsigned long start;
1797         int err = -EINVAL;
1798         int i;
1799
1800         if (vma->vm_pgoff)
1801                 return -EINVAL;
1802
1803         size = vma->vm_end - vma->vm_start;
1804
1805         lock_sock(sk);
1806         if (po->pg_vec == NULL)
1807                 goto out;
1808         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1809                 goto out;
1810
1811         start = vma->vm_start;
1812         for (i = 0; i < po->pg_vec_len; i++) {
1813                 struct page *page = virt_to_page(po->pg_vec[i]);
1814                 int pg_num;
1815
1816                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1817                         err = vm_insert_page(vma, start, page);
1818                         if (unlikely(err))
1819                                 goto out;
1820                         start += PAGE_SIZE;
1821                 }
1822         }
1823         atomic_inc(&po->mapped);
1824         vma->vm_ops = &packet_mmap_ops;
1825         err = 0;
1826
1827 out:
1828         release_sock(sk);
1829         return err;
1830 }
1831 #endif
1832
1833
1834 #ifdef CONFIG_SOCK_PACKET
1835 static const struct proto_ops packet_ops_spkt = {
1836         .family =       PF_PACKET,
1837         .owner =        THIS_MODULE,
1838         .release =      packet_release,
1839         .bind =         packet_bind_spkt,
1840         .connect =      sock_no_connect,
1841         .socketpair =   sock_no_socketpair,
1842         .accept =       sock_no_accept,
1843         .getname =      packet_getname_spkt,
1844         .poll =         datagram_poll,
1845         .ioctl =        packet_ioctl,
1846         .listen =       sock_no_listen,
1847         .shutdown =     sock_no_shutdown,
1848         .setsockopt =   sock_no_setsockopt,
1849         .getsockopt =   sock_no_getsockopt,
1850         .sendmsg =      packet_sendmsg_spkt,
1851         .recvmsg =      packet_recvmsg,
1852         .mmap =         sock_no_mmap,
1853         .sendpage =     sock_no_sendpage,
1854 };
1855 #endif
1856
1857 static const
1858 struct proto_ops packet_ops = {
1859         .family =       PF_PACKET,
1860         .owner =        THIS_MODULE,
1861         .release =      packet_release,
1862         .bind =         packet_bind,
1863         .connect =      sock_no_connect,
1864         .socketpair =   sock_no_socketpair,
1865         .accept =       sock_no_accept,
1866         .getname =      packet_getname,
1867         .poll =         packet_poll,
1868         .ioctl =        packet_ioctl,
1869         .listen =       sock_no_listen,
1870         .shutdown =     sock_no_shutdown,
1871         .setsockopt =   packet_setsockopt,
1872         .getsockopt =   packet_getsockopt,
1873         .sendmsg =      packet_sendmsg,
1874         .recvmsg =      packet_recvmsg,
1875         .mmap =         packet_mmap,
1876         .sendpage =     sock_no_sendpage,
1877 };
1878
1879 static
1880 struct net_proto_family packet_family_ops = {
1881         .family =       PF_PACKET,
1882         .create =       packet_create,
1883         .owner  =       THIS_MODULE,
1884 };
1885
1886 static struct notifier_block packet_netdev_notifier = {
1887         .notifier_call =packet_notifier,
1888 };
1889
1890 #ifdef CONFIG_PROC_FS
1891 static inline struct sock *packet_seq_idx(loff_t off)
1892 {
1893         struct sock *s;
1894         struct hlist_node *node;
1895
1896         sk_for_each(s, node, &packet_sklist) {
1897                 if (!off--)
1898                         return s;
1899         }
1900         return NULL;
1901 }
1902
1903 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1904 {
1905         read_lock(&packet_sklist_lock);
1906         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1907 }
1908
1909 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1910 {
1911         ++*pos;
1912         return  (v == SEQ_START_TOKEN)
1913                 ? sk_head(&packet_sklist)
1914                 : sk_next((struct sock*)v) ;
1915 }
1916
1917 static void packet_seq_stop(struct seq_file *seq, void *v)
1918 {
1919         read_unlock(&packet_sklist_lock);
1920 }
1921
1922 static int packet_seq_show(struct seq_file *seq, void *v)
1923 {
1924         if (v == SEQ_START_TOKEN)
1925                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1926         else {
1927                 struct sock *s = v;
1928                 const struct packet_sock *po = pkt_sk(s);
1929
1930                 seq_printf(seq,
1931                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1932                            s,
1933                            atomic_read(&s->sk_refcnt),
1934                            s->sk_type,
1935                            ntohs(po->num),
1936                            po->ifindex,
1937                            po->running,
1938                            atomic_read(&s->sk_rmem_alloc),
1939                            sock_i_uid(s),
1940                            sock_i_ino(s) );
1941         }
1942
1943         return 0;
1944 }
1945
1946 static struct seq_operations packet_seq_ops = {
1947         .start  = packet_seq_start,
1948         .next   = packet_seq_next,
1949         .stop   = packet_seq_stop,
1950         .show   = packet_seq_show,
1951 };
1952
1953 static int packet_seq_open(struct inode *inode, struct file *file)
1954 {
1955         return seq_open(file, &packet_seq_ops);
1956 }
1957
1958 static struct file_operations packet_seq_fops = {
1959         .owner          = THIS_MODULE,
1960         .open           = packet_seq_open,
1961         .read           = seq_read,
1962         .llseek         = seq_lseek,
1963         .release        = seq_release,
1964 };
1965
1966 #endif
1967
1968 static void __exit packet_exit(void)
1969 {
1970         proc_net_remove("packet");
1971         unregister_netdevice_notifier(&packet_netdev_notifier);
1972         sock_unregister(PF_PACKET);
1973         proto_unregister(&packet_proto);
1974 }
1975
1976 static int __init packet_init(void)
1977 {
1978         int rc = proto_register(&packet_proto, 0);
1979
1980         if (rc != 0)
1981                 goto out;
1982
1983         sock_register(&packet_family_ops);
1984         register_netdevice_notifier(&packet_netdev_notifier);
1985         proc_net_fops_create("packet", 0, &packet_seq_fops);
1986 out:
1987         return rc;
1988 }
1989
1990 module_init(packet_init);
1991 module_exit(packet_exit);
1992 MODULE_LICENSE("GPL");
1993 MODULE_ALIAS_NETPROTO(PF_PACKET);