net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/mm.h>
  54 #include <linux/capability.h>
  55 #include <linux/fcntl.h>
  56 #include <linux/socket.h>
  57 #include <linux/in.h>
  58 #include <linux/inet.h>
  59 #include <linux/netdevice.h>
  60 #include <linux/if_packet.h>
  61 #include <linux/wireless.h>
  62 #include <linux/kernel.h>
  63 #include <linux/kmod.h>
  64 #include <net/net_namespace.h>
  65 #include <net/ip.h>
  66 #include <net/protocol.h>
  67 #include <linux/skbuff.h>
  68 #include <net/sock.h>
  69 #include <linux/errno.h>
  70 #include <linux/timer.h>
  71 #include <asm/system.h>
  72 #include <asm/uaccess.h>
  73 #include <asm/ioctls.h>
  74 #include <asm/page.h>
  75 #include <asm/cacheflush.h>
  76 #include <asm/io.h>
  77 #include <linux/proc_fs.h>
  78 #include <linux/seq_file.h>
  79 #include <linux/poll.h>
  80 #include <linux/module.h>
  81 #include <linux/init.h>
  82
  83 #ifdef CONFIG_INET
  84 #include <net/inet_common.h>
  85 #endif
  86
  87 /*
  88    Assumptions:
  89    - if device has no dev->hard_header routine, it adds and removes ll header
  90      inside itself. In this case ll header is invisible outside of device,
  91      but higher levels still should reserve dev->hard_header_len.
  92      Some devices are enough clever to reallocate skb, when header
  93      will not fit to reserved space (tunnel), another ones are silly
  94      (PPP).
  95    - packet socket receives packets with pulled ll header,
  96      so that SOCK_RAW should push it back.
  97
  98 On receive:
  99 -----------
 100
 101 Incoming, dev->hard_header!=NULL
 102    mac_header -> ll header
 103    data       -> data
 104
 105 Outgoing, dev->hard_header!=NULL
 106    mac_header -> ll header
 107    data       -> ll header
 108
 109 Incoming, dev->hard_header==NULL
 110    mac_header -> UNKNOWN position. It is very likely, that it points to ll
 111                  header.  PPP makes it, that is wrong, because introduce
 112                  assymetry between rx and tx paths.
 113    data       -> data
 114
 115 Outgoing, dev->hard_header==NULL
 116    mac_header -> data. ll header is still not built!
 117    data       -> data
 118
 119 Resume
 120   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 121
 122
 123 On transmit:
 124 ------------
 125
 126 dev->hard_header != NULL
 127    mac_header -> ll header
 128    data       -> ll header
 129
 130 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 131    mac_header -> data
 132    data       -> data
 133
 134    We should set nh.raw on output to correct posistion,
 135    packet classifier depends on it.
 136  */
 137
 138 /* Private packet socket structures. */
 139
 140 struct packet_mclist
 141 {
 142         struct packet_mclist    *next;
 143         int                     ifindex;
 144         int                     count;
 145         unsigned short          type;
 146         unsigned short          alen;
 147         unsigned char           addr[MAX_ADDR_LEN];
 148 };
 149 /* identical to struct packet_mreq except it has
 150  * a longer address field.
 151  */
 152 struct packet_mreq_max
 153 {
 154         int             mr_ifindex;
 155         unsigned short  mr_type;
 156         unsigned short  mr_alen;
 157         unsigned char   mr_address[MAX_ADDR_LEN];
 158 };
 159
 160 #ifdef CONFIG_PACKET_MMAP
 161 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 162 #endif
 163
 164 static void packet_flush_mclist(struct sock *sk);
 165
 166 struct packet_sock {
 167         /* struct sock has to be the first member of packet_sock */
 168         struct sock             sk;
 169         struct tpacket_stats    stats;
 170 #ifdef CONFIG_PACKET_MMAP
 171         char *                  *pg_vec;
 172         unsigned int            head;
 173         unsigned int            frames_per_block;
 174         unsigned int            frame_size;
 175         unsigned int            frame_max;
 176         int                     copy_thresh;
 177 #endif
 178         struct packet_type      prot_hook;
 179         spinlock_t              bind_lock;
 180         unsigned int            running:1,      /* prot_hook is attached*/
 181                                 auxdata:1,
 182                                 origdev:1;
 183         int                     ifindex;        /* bound device         */
 184         __be16                  num;
 185         struct packet_mclist    *mclist;
 186 #ifdef CONFIG_PACKET_MMAP
 187         atomic_t                mapped;
 188         unsigned int            pg_vec_order;
 189         unsigned int            pg_vec_pages;
 190         unsigned int            pg_vec_len;
 191 #endif
 192 };
 193
 194 struct packet_skb_cb {
 195         unsigned int origlen;
 196         union {
 197                 struct sockaddr_pkt pkt;
 198                 struct sockaddr_ll ll;
 199         } sa;
 200 };
 201
 202 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 203
 204 #ifdef CONFIG_PACKET_MMAP
 205
 206 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 207 {
 208         unsigned int pg_vec_pos, frame_offset;
 209
 210         pg_vec_pos = position / po->frames_per_block;
 211         frame_offset = position % po->frames_per_block;
 212
 213         return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
 214 }
 215 #endif
 216
 217 static inline struct packet_sock *pkt_sk(struct sock *sk)
 218 {
 219         return (struct packet_sock *)sk;
 220 }
 221
 222 static void packet_sock_destruct(struct sock *sk)
 223 {
 224         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 225         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 226
 227         if (!sock_flag(sk, SOCK_DEAD)) {
 228                 printk("Attempt to release alive packet socket: %p\n", sk);
 229                 return;
 230         }
 231
 232         sk_refcnt_debug_dec(sk);
 233 }
 234
 235
 236 static const struct proto_ops packet_ops;
 237
 238 static const struct proto_ops packet_ops_spkt;
 239
 240 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 241 {
 242         struct sock *sk;
 243         struct sockaddr_pkt *spkt;
 244
 245         /*
 246          *      When we registered the protocol we saved the socket in the data
 247          *      field for just this event.
 248          */
 249
 250         sk = pt->af_packet_priv;
 251
 252         /*
 253          *      Yank back the headers [hope the device set this
 254          *      right or kerboom...]
 255          *
 256          *      Incoming packets have ll header pulled,
 257          *      push it back.
 258          *
 259          *      For outgoing ones skb->data == skb_mac_header(skb)
 260          *      so that this procedure is noop.
 261          */
 262
 263         if (skb->pkt_type == PACKET_LOOPBACK)
 264                 goto out;
 265
 266         if (dev_net(dev) != sock_net(sk))
 267                 goto out;
 268
 269         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 270                 goto oom;
 271
 272         /* drop any routing info */
 273         dst_release(skb->dst);
 274         skb->dst = NULL;
 275
 276         /* drop conntrack reference */
 277         nf_reset(skb);
 278
 279         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
 280
 281         skb_push(skb, skb->data - skb_mac_header(skb));
 282
 283         /*
 284          *      The SOCK_PACKET socket receives _all_ frames.
 285          */
 286
 287         spkt->spkt_family = dev->type;
 288         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 289         spkt->spkt_protocol = skb->protocol;
 290
 291         /*
 292          *      Charge the memory to the socket. This is done specifically
 293          *      to prevent sockets using all the memory up.
 294          */
 295
 296         if (sock_queue_rcv_skb(sk,skb) == 0)
 297                 return 0;
 298
 299 out:
 300         kfree_skb(skb);
 301 oom:
 302         return 0;
 303 }
 304
 305
 306 /*
 307  *      Output a raw packet to a device layer. This bypasses all the other
 308  *      protocol layers and you must therefore supply it with a complete frame
 309  */
 310
 311 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 312                                struct msghdr *msg, size_t len)
 313 {
 314         struct sock *sk = sock->sk;
 315         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 316         struct sk_buff *skb;
 317         struct net_device *dev;
 318         __be16 proto=0;
 319         int err;
 320
 321         /*
 322          *      Get and verify the address.
 323          */
 324
 325         if (saddr)
 326         {
 327                 if (msg->msg_namelen < sizeof(struct sockaddr))
 328                         return(-EINVAL);
 329                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 330                         proto=saddr->spkt_protocol;
 331         }
 332         else
 333                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 334
 335         /*
 336          *      Find the device first to size check it
 337          */
 338
 339         saddr->spkt_device[13] = 0;
 340         dev = dev_get_by_name(sock_net(sk), saddr->spkt_device);
 341         err = -ENODEV;
 342         if (dev == NULL)
 343                 goto out_unlock;
 344
 345         err = -ENETDOWN;
 346         if (!(dev->flags & IFF_UP))
 347                 goto out_unlock;
 348
 349         /*
 350          *      You may not queue a frame bigger than the mtu. This is the lowest level
 351          *      raw protocol and you must do your own fragmentation at this level.
 352          */
 353
 354         err = -EMSGSIZE;
 355         if (len > dev->mtu + dev->hard_header_len)
 356                 goto out_unlock;
 357
 358         err = -ENOBUFS;
 359         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 360
 361         /*
 362          *      If the write buffer is full, then tough. At this level the user gets to
 363          *      deal with the problem - do your own algorithmic backoffs. That's far
 364          *      more flexible.
 365          */
 366
 367         if (skb == NULL)
 368                 goto out_unlock;
 369
 370         /*
 371          *      Fill it in
 372          */
 373
 374         /* FIXME: Save some space for broken drivers that write a
 375          * hard header at transmission time by themselves. PPP is the
 376          * notable one here. This should really be fixed at the driver level.
 377          */
 378         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 379         skb_reset_network_header(skb);
 380
 381         /* Try to align data part correctly */
 382         if (dev->header_ops) {
 383                 skb->data -= dev->hard_header_len;
 384                 skb->tail -= dev->hard_header_len;
 385                 if (len < dev->hard_header_len)
 386                         skb_reset_network_header(skb);
 387         }
 388
 389         /* Returns -EFAULT on error */
 390         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 391         skb->protocol = proto;
 392         skb->dev = dev;
 393         skb->priority = sk->sk_priority;
 394         if (err)
 395                 goto out_free;
 396
 397         /*
 398          *      Now send it
 399          */
 400
 401         dev_queue_xmit(skb);
 402         dev_put(dev);
 403         return(len);
 404
 405 out_free:
 406         kfree_skb(skb);
 407 out_unlock:
 408         if (dev)
 409                 dev_put(dev);
 410         return err;
 411 }
 412
 413 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
 414                                       unsigned int res)
 415 {
 416         struct sk_filter *filter;
 417
 418         rcu_read_lock_bh();
 419         filter = rcu_dereference(sk->sk_filter);
 420         if (filter != NULL)
 421                 res = sk_run_filter(skb, filter->insns, filter->len);
 422         rcu_read_unlock_bh();
 423
 424         return res;
 425 }
 426
 427 /*
 428    This function makes lazy skb cloning in hope that most of packets
 429    are discarded by BPF.
 430
 431    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 432    and skb->cb are mangled. It works because (and until) packets
 433    falling here are owned by current CPU. Output packets are cloned
 434    by dev_queue_xmit_nit(), input packets are processed by net_bh
 435    sequencially, so that if we return skb to original state on exit,
 436    we will not harm anyone.
 437  */
 438
 439 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 440 {
 441         struct sock *sk;
 442         struct sockaddr_ll *sll;
 443         struct packet_sock *po;
 444         u8 * skb_head = skb->data;
 445         int skb_len = skb->len;
 446         unsigned int snaplen, res;
 447
 448         if (skb->pkt_type == PACKET_LOOPBACK)
 449                 goto drop;
 450
 451         sk = pt->af_packet_priv;
 452         po = pkt_sk(sk);
 453
 454         if (dev_net(dev) != sock_net(sk))
 455                 goto drop;
 456
 457         skb->dev = dev;
 458
 459         if (dev->header_ops) {
 460                 /* The device has an explicit notion of ll header,
 461                    exported to higher levels.
 462
 463                    Otherwise, the device hides datails of it frame
 464                    structure, so that corresponding packet head
 465                    never delivered to user.
 466                  */
 467                 if (sk->sk_type != SOCK_DGRAM)
 468                         skb_push(skb, skb->data - skb_mac_header(skb));
 469                 else if (skb->pkt_type == PACKET_OUTGOING) {
 470                         /* Special case: outgoing packets have ll header at head */
 471                         skb_pull(skb, skb_network_offset(skb));
 472                 }
 473         }
 474
 475         snaplen = skb->len;
 476
 477         res = run_filter(skb, sk, snaplen);
 478         if (!res)
 479                 goto drop_n_restore;
 480         if (snaplen > res)
 481                 snaplen = res;
 482
 483         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 484             (unsigned)sk->sk_rcvbuf)
 485                 goto drop_n_acct;
 486
 487         if (skb_shared(skb)) {
 488                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 489                 if (nskb == NULL)
 490                         goto drop_n_acct;
 491
 492                 if (skb_head != skb->data) {
 493                         skb->data = skb_head;
 494                         skb->len = skb_len;
 495                 }
 496                 kfree_skb(skb);
 497                 skb = nskb;
 498         }
 499
 500         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
 501                      sizeof(skb->cb));
 502
 503         sll = &PACKET_SKB_CB(skb)->sa.ll;
 504         sll->sll_family = AF_PACKET;
 505         sll->sll_hatype = dev->type;
 506         sll->sll_protocol = skb->protocol;
 507         sll->sll_pkttype = skb->pkt_type;
 508         if (unlikely(po->origdev))
 509                 sll->sll_ifindex = orig_dev->ifindex;
 510         else
 511                 sll->sll_ifindex = dev->ifindex;
 512
 513         sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
 514
 515         PACKET_SKB_CB(skb)->origlen = skb->len;
 516
 517         if (pskb_trim(skb, snaplen))
 518                 goto drop_n_acct;
 519
 520         skb_set_owner_r(skb, sk);
 521         skb->dev = NULL;
 522         dst_release(skb->dst);
 523         skb->dst = NULL;
 524
 525         /* drop conntrack reference */
 526         nf_reset(skb);
 527
 528         spin_lock(&sk->sk_receive_queue.lock);
 529         po->stats.tp_packets++;
 530         __skb_queue_tail(&sk->sk_receive_queue, skb);
 531         spin_unlock(&sk->sk_receive_queue.lock);
 532         sk->sk_data_ready(sk, skb->len);
 533         return 0;
 534
 535 drop_n_acct:
 536         spin_lock(&sk->sk_receive_queue.lock);
 537         po->stats.tp_drops++;
 538         spin_unlock(&sk->sk_receive_queue.lock);
 539
 540 drop_n_restore:
 541         if (skb_head != skb->data && skb_shared(skb)) {
 542                 skb->data = skb_head;
 543                 skb->len = skb_len;
 544         }
 545 drop:
 546         kfree_skb(skb);
 547         return 0;
 548 }
 549
 550 #ifdef CONFIG_PACKET_MMAP
 551 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 552 {
 553         struct sock *sk;
 554         struct packet_sock *po;
 555         struct sockaddr_ll *sll;
 556         struct tpacket_hdr *h;
 557         u8 * skb_head = skb->data;
 558         int skb_len = skb->len;
 559         unsigned int snaplen, res;
 560         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 561         unsigned short macoff, netoff;
 562         struct sk_buff *copy_skb = NULL;
 563         struct timeval tv;
 564
 565         if (skb->pkt_type == PACKET_LOOPBACK)
 566                 goto drop;
 567
 568         sk = pt->af_packet_priv;
 569         po = pkt_sk(sk);
 570
 571         if (dev_net(dev) != sock_net(sk))
 572                 goto drop;
 573
 574         if (dev->header_ops) {
 575                 if (sk->sk_type != SOCK_DGRAM)
 576                         skb_push(skb, skb->data - skb_mac_header(skb));
 577                 else if (skb->pkt_type == PACKET_OUTGOING) {
 578                         /* Special case: outgoing packets have ll header at head */
 579                         skb_pull(skb, skb_network_offset(skb));
 580                 }
 581         }
 582
 583         if (skb->ip_summed == CHECKSUM_PARTIAL)
 584                 status |= TP_STATUS_CSUMNOTREADY;
 585
 586         snaplen = skb->len;
 587
 588         res = run_filter(skb, sk, snaplen);
 589         if (!res)
 590                 goto drop_n_restore;
 591         if (snaplen > res)
 592                 snaplen = res;
 593
 594         if (sk->sk_type == SOCK_DGRAM) {
 595                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 596         } else {
 597                 unsigned maclen = skb_network_offset(skb);
 598                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 599                 macoff = netoff - maclen;
 600         }
 601
 602         if (macoff + snaplen > po->frame_size) {
 603                 if (po->copy_thresh &&
 604                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 605                     (unsigned)sk->sk_rcvbuf) {
 606                         if (skb_shared(skb)) {
 607                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 608                         } else {
 609                                 copy_skb = skb_get(skb);
 610                                 skb_head = skb->data;
 611                         }
 612                         if (copy_skb)
 613                                 skb_set_owner_r(copy_skb, sk);
 614                 }
 615                 snaplen = po->frame_size - macoff;
 616                 if ((int)snaplen < 0)
 617                         snaplen = 0;
 618         }
 619
 620         spin_lock(&sk->sk_receive_queue.lock);
 621         h = packet_lookup_frame(po, po->head);
 622
 623         if (h->tp_status)
 624                 goto ring_is_full;
 625         po->head = po->head != po->frame_max ? po->head+1 : 0;
 626         po->stats.tp_packets++;
 627         if (copy_skb) {
 628                 status |= TP_STATUS_COPY;
 629                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 630         }
 631         if (!po->stats.tp_drops)
 632                 status &= ~TP_STATUS_LOSING;
 633         spin_unlock(&sk->sk_receive_queue.lock);
 634
 635         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 636
 637         h->tp_len = skb->len;
 638         h->tp_snaplen = snaplen;
 639         h->tp_mac = macoff;
 640         h->tp_net = netoff;
 641         if (skb->tstamp.tv64)
 642                 tv = ktime_to_timeval(skb->tstamp);
 643         else
 644                 do_gettimeofday(&tv);
 645         h->tp_sec = tv.tv_sec;
 646         h->tp_usec = tv.tv_usec;
 647
 648         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 649         sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
 650         sll->sll_family = AF_PACKET;
 651         sll->sll_hatype = dev->type;
 652         sll->sll_protocol = skb->protocol;
 653         sll->sll_pkttype = skb->pkt_type;
 654         if (unlikely(po->origdev))
 655                 sll->sll_ifindex = orig_dev->ifindex;
 656         else
 657                 sll->sll_ifindex = dev->ifindex;
 658
 659         h->tp_status = status;
 660         smp_mb();
 661
 662         {
 663                 struct page *p_start, *p_end;
 664                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 665
 666                 p_start = virt_to_page(h);
 667                 p_end = virt_to_page(h_end);
 668                 while (p_start <= p_end) {
 669                         flush_dcache_page(p_start);
 670                         p_start++;
 671                 }
 672         }
 673
 674         sk->sk_data_ready(sk, 0);
 675
 676 drop_n_restore:
 677         if (skb_head != skb->data && skb_shared(skb)) {
 678                 skb->data = skb_head;
 679                 skb->len = skb_len;
 680         }
 681 drop:
 682         kfree_skb(skb);
 683         return 0;
 684
 685 ring_is_full:
 686         po->stats.tp_drops++;
 687         spin_unlock(&sk->sk_receive_queue.lock);
 688
 689         sk->sk_data_ready(sk, 0);
 690         if (copy_skb)
 691                 kfree_skb(copy_skb);
 692         goto drop_n_restore;
 693 }
 694
 695 #endif
 696
 697
 698 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 699                           struct msghdr *msg, size_t len)
 700 {
 701         struct sock *sk = sock->sk;
 702         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 703         struct sk_buff *skb;
 704         struct net_device *dev;
 705         __be16 proto;
 706         unsigned char *addr;
 707         int ifindex, err, reserve = 0;
 708
 709         /*
 710          *      Get and verify the address.
 711          */
 712
 713         if (saddr == NULL) {
 714                 struct packet_sock *po = pkt_sk(sk);
 715
 716                 ifindex = po->ifindex;
 717                 proto   = po->num;
 718                 addr    = NULL;
 719         } else {
 720                 err = -EINVAL;
 721                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 722                         goto out;
 723                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 724                         goto out;
 725                 ifindex = saddr->sll_ifindex;
 726                 proto   = saddr->sll_protocol;
 727                 addr    = saddr->sll_addr;
 728         }
 729
 730
 731         dev = dev_get_by_index(sock_net(sk), ifindex);
 732         err = -ENXIO;
 733         if (dev == NULL)
 734                 goto out_unlock;
 735         if (sock->type == SOCK_RAW)
 736                 reserve = dev->hard_header_len;
 737
 738         err = -ENETDOWN;
 739         if (!(dev->flags & IFF_UP))
 740                 goto out_unlock;
 741
 742         err = -EMSGSIZE;
 743         if (len > dev->mtu+reserve)
 744                 goto out_unlock;
 745
 746         skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
 747                                 msg->msg_flags & MSG_DONTWAIT, &err);
 748         if (skb==NULL)
 749                 goto out_unlock;
 750
 751         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 752         skb_reset_network_header(skb);
 753
 754         err = -EINVAL;
 755         if (sock->type == SOCK_DGRAM &&
 756             dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
 757                 goto out_free;
 758
 759         /* Returns -EFAULT on error */
 760         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 761         if (err)
 762                 goto out_free;
 763
 764         skb->protocol = proto;
 765         skb->dev = dev;
 766         skb->priority = sk->sk_priority;
 767
 768         /*
 769          *      Now send it
 770          */
 771
 772         err = dev_queue_xmit(skb);
 773         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 774                 goto out_unlock;
 775
 776         dev_put(dev);
 777
 778         return(len);
 779
 780 out_free:
 781         kfree_skb(skb);
 782 out_unlock:
 783         if (dev)
 784                 dev_put(dev);
 785 out:
 786         return err;
 787 }
 788
 789 /*
 790  *      Close a PACKET socket. This is fairly simple. We immediately go
 791  *      to 'closed' state and remove our protocol entry in the device list.
 792  */
 793
 794 static int packet_release(struct socket *sock)
 795 {
 796         struct sock *sk = sock->sk;
 797         struct packet_sock *po;
 798         struct net *net;
 799
 800         if (!sk)
 801                 return 0;
 802
 803         net = sock_net(sk);
 804         po = pkt_sk(sk);
 805
 806         write_lock_bh(&net->packet.sklist_lock);
 807         sk_del_node_init(sk);
 808         write_unlock_bh(&net->packet.sklist_lock);
 809
 810         /*
 811          *      Unhook packet receive handler.
 812          */
 813
 814         if (po->running) {
 815                 /*
 816                  *      Remove the protocol hook
 817                  */
 818                 dev_remove_pack(&po->prot_hook);
 819                 po->running = 0;
 820                 po->num = 0;
 821                 __sock_put(sk);
 822         }
 823
 824         packet_flush_mclist(sk);
 825
 826 #ifdef CONFIG_PACKET_MMAP
 827         if (po->pg_vec) {
 828                 struct tpacket_req req;
 829                 memset(&req, 0, sizeof(req));
 830                 packet_set_ring(sk, &req, 1);
 831         }
 832 #endif
 833
 834         /*
 835          *      Now the socket is dead. No more input will appear.
 836          */
 837
 838         sock_orphan(sk);
 839         sock->sk = NULL;
 840
 841         /* Purge queues */
 842
 843         skb_queue_purge(&sk->sk_receive_queue);
 844         sk_refcnt_debug_release(sk);
 845
 846         sock_put(sk);
 847         return 0;
 848 }
 849
 850 /*
 851  *      Attach a packet hook.
 852  */
 853
 854 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 855 {
 856         struct packet_sock *po = pkt_sk(sk);
 857         /*
 858          *      Detach an existing hook if present.
 859          */
 860
 861         lock_sock(sk);
 862
 863         spin_lock(&po->bind_lock);
 864         if (po->running) {
 865                 __sock_put(sk);
 866                 po->running = 0;
 867                 po->num = 0;
 868                 spin_unlock(&po->bind_lock);
 869                 dev_remove_pack(&po->prot_hook);
 870                 spin_lock(&po->bind_lock);
 871         }
 872
 873         po->num = protocol;
 874         po->prot_hook.type = protocol;
 875         po->prot_hook.dev = dev;
 876
 877         po->ifindex = dev ? dev->ifindex : 0;
 878
 879         if (protocol == 0)
 880                 goto out_unlock;
 881
 882         if (!dev || (dev->flags & IFF_UP)) {
 883                 dev_add_pack(&po->prot_hook);
 884                 sock_hold(sk);
 885                 po->running = 1;
 886         } else {
 887                 sk->sk_err = ENETDOWN;
 888                 if (!sock_flag(sk, SOCK_DEAD))
 889                         sk->sk_error_report(sk);
 890         }
 891
 892 out_unlock:
 893         spin_unlock(&po->bind_lock);
 894         release_sock(sk);
 895         return 0;
 896 }
 897
 898 /*
 899  *      Bind a packet socket to a device
 900  */
 901
 902 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 903 {
 904         struct sock *sk=sock->sk;
 905         char name[15];
 906         struct net_device *dev;
 907         int err = -ENODEV;
 908
 909         /*
 910          *      Check legality
 911          */
 912
 913         if (addr_len != sizeof(struct sockaddr))
 914                 return -EINVAL;
 915         strlcpy(name,uaddr->sa_data,sizeof(name));
 916
 917         dev = dev_get_by_name(sock_net(sk), name);
 918         if (dev) {
 919                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 920                 dev_put(dev);
 921         }
 922         return err;
 923 }
 924
 925 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 926 {
 927         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 928         struct sock *sk=sock->sk;
 929         struct net_device *dev = NULL;
 930         int err;
 931
 932
 933         /*
 934          *      Check legality
 935          */
 936
 937         if (addr_len < sizeof(struct sockaddr_ll))
 938                 return -EINVAL;
 939         if (sll->sll_family != AF_PACKET)
 940                 return -EINVAL;
 941
 942         if (sll->sll_ifindex) {
 943                 err = -ENODEV;
 944                 dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex);
 945                 if (dev == NULL)
 946                         goto out;
 947         }
 948         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 949         if (dev)
 950                 dev_put(dev);
 951
 952 out:
 953         return err;
 954 }
 955
 956 static struct proto packet_proto = {
 957         .name     = "PACKET",
 958         .owner    = THIS_MODULE,
 959         .obj_size = sizeof(struct packet_sock),
 960 };
 961
 962 /*
 963  *      Create a packet of type SOCK_PACKET.
 964  */
 965
 966 static int packet_create(struct net *net, struct socket *sock, int protocol)
 967 {
 968         struct sock *sk;
 969         struct packet_sock *po;
 970         __be16 proto = (__force __be16)protocol; /* weird, but documented */
 971         int err;
 972
 973         if (!capable(CAP_NET_RAW))
 974                 return -EPERM;
 975         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
 976             sock->type != SOCK_PACKET)
 977                 return -ESOCKTNOSUPPORT;
 978
 979         sock->state = SS_UNCONNECTED;
 980
 981         err = -ENOBUFS;
 982         sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto);
 983         if (sk == NULL)
 984                 goto out;
 985
 986         sock->ops = &packet_ops;
 987         if (sock->type == SOCK_PACKET)
 988                 sock->ops = &packet_ops_spkt;
 989
 990         sock_init_data(sock, sk);
 991
 992         po = pkt_sk(sk);
 993         sk->sk_family = PF_PACKET;
 994         po->num = proto;
 995
 996         sk->sk_destruct = packet_sock_destruct;
 997         sk_refcnt_debug_inc(sk);
 998
 999         /*
1000          *      Attach a protocol block
1001          */
1002
1003         spin_lock_init(&po->bind_lock);
1004         po->prot_hook.func = packet_rcv;
1005
1006         if (sock->type == SOCK_PACKET)
1007                 po->prot_hook.func = packet_rcv_spkt;
1008
1009         po->prot_hook.af_packet_priv = sk;
1010
1011         if (proto) {
1012                 po->prot_hook.type = proto;
1013                 dev_add_pack(&po->prot_hook);
1014                 sock_hold(sk);
1015                 po->running = 1;
1016         }
1017
1018         write_lock_bh(&net->packet.sklist_lock);
1019         sk_add_node(sk, &net->packet.sklist);
1020         write_unlock_bh(&net->packet.sklist_lock);
1021         return(0);
1022 out:
1023         return err;
1024 }
1025
1026 /*
1027  *      Pull a packet from our receive queue and hand it to the user.
1028  *      If necessary we block.
1029  */
1030
1031 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1032                           struct msghdr *msg, size_t len, int flags)
1033 {
1034         struct sock *sk = sock->sk;
1035         struct sk_buff *skb;
1036         int copied, err;
1037         struct sockaddr_ll *sll;
1038
1039         err = -EINVAL;
1040         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1041                 goto out;
1042
1043 #if 0
1044         /* What error should we return now? EUNATTACH? */
1045         if (pkt_sk(sk)->ifindex < 0)
1046                 return -ENODEV;
1047 #endif
1048
1049         /*
1050          *      Call the generic datagram receiver. This handles all sorts
1051          *      of horrible races and re-entrancy so we can forget about it
1052          *      in the protocol layers.
1053          *
1054          *      Now it will return ENETDOWN, if device have just gone down,
1055          *      but then it will block.
1056          */
1057
1058         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1059
1060         /*
1061          *      An error occurred so return it. Because skb_recv_datagram()
1062          *      handles the blocking we don't see and worry about blocking
1063          *      retries.
1064          */
1065
1066         if (skb == NULL)
1067                 goto out;
1068
1069         /*
1070          *      If the address length field is there to be filled in, we fill
1071          *      it in now.
1072          */
1073
1074         sll = &PACKET_SKB_CB(skb)->sa.ll;
1075         if (sock->type == SOCK_PACKET)
1076                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1077         else
1078                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1079
1080         /*
1081          *      You lose any data beyond the buffer you gave. If it worries a
1082          *      user program they can ask the device for its MTU anyway.
1083          */
1084
1085         copied = skb->len;
1086         if (copied > len)
1087         {
1088                 copied=len;
1089                 msg->msg_flags|=MSG_TRUNC;
1090         }
1091
1092         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1093         if (err)
1094                 goto out_free;
1095
1096         sock_recv_timestamp(msg, sk, skb);
1097
1098         if (msg->msg_name)
1099                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1100                        msg->msg_namelen);
1101
1102         if (pkt_sk(sk)->auxdata) {
1103                 struct tpacket_auxdata aux;
1104
1105                 aux.tp_status = TP_STATUS_USER;
1106                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1107                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1108                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1109                 aux.tp_snaplen = skb->len;
1110                 aux.tp_mac = 0;
1111                 aux.tp_net = skb_network_offset(skb);
1112
1113                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1114         }
1115
1116         /*
1117          *      Free or return the buffer as appropriate. Again this
1118          *      hides all the races and re-entrancy issues from us.
1119          */
1120         err = (flags&MSG_TRUNC) ? skb->len : copied;
1121
1122 out_free:
1123         skb_free_datagram(sk, skb);
1124 out:
1125         return err;
1126 }
1127
1128 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1129                                int *uaddr_len, int peer)
1130 {
1131         struct net_device *dev;
1132         struct sock *sk = sock->sk;
1133
1134         if (peer)
1135                 return -EOPNOTSUPP;
1136
1137         uaddr->sa_family = AF_PACKET;
1138         dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
1139         if (dev) {
1140                 strlcpy(uaddr->sa_data, dev->name, 15);
1141                 dev_put(dev);
1142         } else
1143                 memset(uaddr->sa_data, 0, 14);
1144         *uaddr_len = sizeof(*uaddr);
1145
1146         return 0;
1147 }
1148
1149 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1150                           int *uaddr_len, int peer)
1151 {
1152         struct net_device *dev;
1153         struct sock *sk = sock->sk;
1154         struct packet_sock *po = pkt_sk(sk);
1155         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1156
1157         if (peer)
1158                 return -EOPNOTSUPP;
1159
1160         sll->sll_family = AF_PACKET;
1161         sll->sll_ifindex = po->ifindex;
1162         sll->sll_protocol = po->num;
1163         dev = dev_get_by_index(sock_net(sk), po->ifindex);
1164         if (dev) {
1165                 sll->sll_hatype = dev->type;
1166                 sll->sll_halen = dev->addr_len;
1167                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1168                 dev_put(dev);
1169         } else {
1170                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1171                 sll->sll_halen = 0;
1172         }
1173         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1174
1175         return 0;
1176 }
1177
1178 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1179 {
1180         switch (i->type) {
1181         case PACKET_MR_MULTICAST:
1182                 if (what > 0)
1183                         dev_mc_add(dev, i->addr, i->alen, 0);
1184                 else
1185                         dev_mc_delete(dev, i->addr, i->alen, 0);
1186                 break;
1187         case PACKET_MR_PROMISC:
1188                 dev_set_promiscuity(dev, what);
1189                 break;
1190         case PACKET_MR_ALLMULTI:
1191                 dev_set_allmulti(dev, what);
1192                 break;
1193         default:;
1194         }
1195 }
1196
1197 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1198 {
1199         for ( ; i; i=i->next) {
1200                 if (i->ifindex == dev->ifindex)
1201                         packet_dev_mc(dev, i, what);
1202         }
1203 }
1204
1205 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1206 {
1207         struct packet_sock *po = pkt_sk(sk);
1208         struct packet_mclist *ml, *i;
1209         struct net_device *dev;
1210         int err;
1211
1212         rtnl_lock();
1213
1214         err = -ENODEV;
1215         dev = __dev_get_by_index(sock_net(sk), mreq->mr_ifindex);
1216         if (!dev)
1217                 goto done;
1218
1219         err = -EINVAL;
1220         if (mreq->mr_alen > dev->addr_len)
1221                 goto done;
1222
1223         err = -ENOBUFS;
1224         i = kmalloc(sizeof(*i), GFP_KERNEL);
1225         if (i == NULL)
1226                 goto done;
1227
1228         err = 0;
1229         for (ml = po->mclist; ml; ml = ml->next) {
1230                 if (ml->ifindex == mreq->mr_ifindex &&
1231                     ml->type == mreq->mr_type &&
1232                     ml->alen == mreq->mr_alen &&
1233                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1234                         ml->count++;
1235                         /* Free the new element ... */
1236                         kfree(i);
1237                         goto done;
1238                 }
1239         }
1240
1241         i->type = mreq->mr_type;
1242         i->ifindex = mreq->mr_ifindex;
1243         i->alen = mreq->mr_alen;
1244         memcpy(i->addr, mreq->mr_address, i->alen);
1245         i->count = 1;
1246         i->next = po->mclist;
1247         po->mclist = i;
1248         packet_dev_mc(dev, i, +1);
1249
1250 done:
1251         rtnl_unlock();
1252         return err;
1253 }
1254
1255 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1256 {
1257         struct packet_mclist *ml, **mlp;
1258
1259         rtnl_lock();
1260
1261         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1262                 if (ml->ifindex == mreq->mr_ifindex &&
1263                     ml->type == mreq->mr_type &&
1264                     ml->alen == mreq->mr_alen &&
1265                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1266                         if (--ml->count == 0) {
1267                                 struct net_device *dev;
1268                                 *mlp = ml->next;
1269                                 dev = dev_get_by_index(sock_net(sk), ml->ifindex);
1270                                 if (dev) {
1271                                         packet_dev_mc(dev, ml, -1);
1272                                         dev_put(dev);
1273                                 }
1274                                 kfree(ml);
1275                         }
1276                         rtnl_unlock();
1277                         return 0;
1278                 }
1279         }
1280         rtnl_unlock();
1281         return -EADDRNOTAVAIL;
1282 }
1283
1284 static void packet_flush_mclist(struct sock *sk)
1285 {
1286         struct packet_sock *po = pkt_sk(sk);
1287         struct packet_mclist *ml;
1288
1289         if (!po->mclist)
1290                 return;
1291
1292         rtnl_lock();
1293         while ((ml = po->mclist) != NULL) {
1294                 struct net_device *dev;
1295
1296                 po->mclist = ml->next;
1297                 if ((dev = dev_get_by_index(sock_net(sk), ml->ifindex)) != NULL) {
1298                         packet_dev_mc(dev, ml, -1);
1299                         dev_put(dev);
1300                 }
1301                 kfree(ml);
1302         }
1303         rtnl_unlock();
1304 }
1305
1306 static int
1307 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1308 {
1309         struct sock *sk = sock->sk;
1310         struct packet_sock *po = pkt_sk(sk);
1311         int ret;
1312
1313         if (level != SOL_PACKET)
1314                 return -ENOPROTOOPT;
1315
1316         switch(optname) {
1317         case PACKET_ADD_MEMBERSHIP:
1318         case PACKET_DROP_MEMBERSHIP:
1319         {
1320                 struct packet_mreq_max mreq;
1321                 int len = optlen;
1322                 memset(&mreq, 0, sizeof(mreq));
1323                 if (len < sizeof(struct packet_mreq))
1324                         return -EINVAL;
1325                 if (len > sizeof(mreq))
1326                         len = sizeof(mreq);
1327                 if (copy_from_user(&mreq,optval,len))
1328                         return -EFAULT;
1329                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1330                         return -EINVAL;
1331                 if (optname == PACKET_ADD_MEMBERSHIP)
1332                         ret = packet_mc_add(sk, &mreq);
1333                 else
1334                         ret = packet_mc_drop(sk, &mreq);
1335                 return ret;
1336         }
1337
1338 #ifdef CONFIG_PACKET_MMAP
1339         case PACKET_RX_RING:
1340         {
1341                 struct tpacket_req req;
1342
1343                 if (optlen<sizeof(req))
1344                         return -EINVAL;
1345                 if (copy_from_user(&req,optval,sizeof(req)))
1346                         return -EFAULT;
1347                 return packet_set_ring(sk, &req, 0);
1348         }
1349         case PACKET_COPY_THRESH:
1350         {
1351                 int val;
1352
1353                 if (optlen!=sizeof(val))
1354                         return -EINVAL;
1355                 if (copy_from_user(&val,optval,sizeof(val)))
1356                         return -EFAULT;
1357
1358                 pkt_sk(sk)->copy_thresh = val;
1359                 return 0;
1360         }
1361 #endif
1362         case PACKET_AUXDATA:
1363         {
1364                 int val;
1365
1366                 if (optlen < sizeof(val))
1367                         return -EINVAL;
1368                 if (copy_from_user(&val, optval, sizeof(val)))
1369                         return -EFAULT;
1370
1371                 po->auxdata = !!val;
1372                 return 0;
1373         }
1374         case PACKET_ORIGDEV:
1375         {
1376                 int val;
1377
1378                 if (optlen < sizeof(val))
1379                         return -EINVAL;
1380                 if (copy_from_user(&val, optval, sizeof(val)))
1381                         return -EFAULT;
1382
1383                 po->origdev = !!val;
1384                 return 0;
1385         }
1386         default:
1387                 return -ENOPROTOOPT;
1388         }
1389 }
1390
1391 static int packet_getsockopt(struct socket *sock, int level, int optname,
1392                              char __user *optval, int __user *optlen)
1393 {
1394         int len;
1395         int val;
1396         struct sock *sk = sock->sk;
1397         struct packet_sock *po = pkt_sk(sk);
1398         void *data;
1399         struct tpacket_stats st;
1400
1401         if (level != SOL_PACKET)
1402                 return -ENOPROTOOPT;
1403
1404         if (get_user(len, optlen))
1405                 return -EFAULT;
1406
1407         if (len < 0)
1408                 return -EINVAL;
1409
1410         switch(optname) {
1411         case PACKET_STATISTICS:
1412                 if (len > sizeof(struct tpacket_stats))
1413                         len = sizeof(struct tpacket_stats);
1414                 spin_lock_bh(&sk->sk_receive_queue.lock);
1415                 st = po->stats;
1416                 memset(&po->stats, 0, sizeof(st));
1417                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1418                 st.tp_packets += st.tp_drops;
1419
1420                 data = &st;
1421                 break;
1422         case PACKET_AUXDATA:
1423                 if (len > sizeof(int))
1424                         len = sizeof(int);
1425                 val = po->auxdata;
1426
1427                 data = &val;
1428                 break;
1429         case PACKET_ORIGDEV:
1430                 if (len > sizeof(int))
1431                         len = sizeof(int);
1432                 val = po->origdev;
1433
1434                 data = &val;
1435                 break;
1436         default:
1437                 return -ENOPROTOOPT;
1438         }
1439
1440         if (put_user(len, optlen))
1441                 return -EFAULT;
1442         if (copy_to_user(optval, data, len))
1443                 return -EFAULT;
1444         return 0;
1445 }
1446
1447
1448 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1449 {
1450         struct sock *sk;
1451         struct hlist_node *node;
1452         struct net_device *dev = data;
1453         struct net *net = dev_net(dev);
1454
1455         read_lock(&net->packet.sklist_lock);
1456         sk_for_each(sk, node, &net->packet.sklist) {
1457                 struct packet_sock *po = pkt_sk(sk);
1458
1459                 switch (msg) {
1460                 case NETDEV_UNREGISTER:
1461                         if (po->mclist)
1462                                 packet_dev_mclist(dev, po->mclist, -1);
1463                         /* fallthrough */
1464
1465                 case NETDEV_DOWN:
1466                         if (dev->ifindex == po->ifindex) {
1467                                 spin_lock(&po->bind_lock);
1468                                 if (po->running) {
1469                                         __dev_remove_pack(&po->prot_hook);
1470                                         __sock_put(sk);
1471                                         po->running = 0;
1472                                         sk->sk_err = ENETDOWN;
1473                                         if (!sock_flag(sk, SOCK_DEAD))
1474                                                 sk->sk_error_report(sk);
1475                                 }
1476                                 if (msg == NETDEV_UNREGISTER) {
1477                                         po->ifindex = -1;
1478                                         po->prot_hook.dev = NULL;
1479                                 }
1480                                 spin_unlock(&po->bind_lock);
1481                         }
1482                         break;
1483                 case NETDEV_UP:
1484                         spin_lock(&po->bind_lock);
1485                         if (dev->ifindex == po->ifindex && po->num &&
1486                             !po->running) {
1487                                 dev_add_pack(&po->prot_hook);
1488                                 sock_hold(sk);
1489                                 po->running = 1;
1490                         }
1491                         spin_unlock(&po->bind_lock);
1492                         break;
1493                 }
1494         }
1495         read_unlock(&net->packet.sklist_lock);
1496         return NOTIFY_DONE;
1497 }
1498
1499
1500 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1501                         unsigned long arg)
1502 {
1503         struct sock *sk = sock->sk;
1504
1505         switch(cmd) {
1506                 case SIOCOUTQ:
1507                 {
1508                         int amount = atomic_read(&sk->sk_wmem_alloc);
1509                         return put_user(amount, (int __user *)arg);
1510                 }
1511                 case SIOCINQ:
1512                 {
1513                         struct sk_buff *skb;
1514                         int amount = 0;
1515
1516                         spin_lock_bh(&sk->sk_receive_queue.lock);
1517                         skb = skb_peek(&sk->sk_receive_queue);
1518                         if (skb)
1519                                 amount = skb->len;
1520                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1521                         return put_user(amount, (int __user *)arg);
1522                 }
1523                 case SIOCGSTAMP:
1524                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1525                 case SIOCGSTAMPNS:
1526                         return sock_get_timestampns(sk, (struct timespec __user *)arg);
1527
1528 #ifdef CONFIG_INET
1529                 case SIOCADDRT:
1530                 case SIOCDELRT:
1531                 case SIOCDARP:
1532                 case SIOCGARP:
1533                 case SIOCSARP:
1534                 case SIOCGIFADDR:
1535                 case SIOCSIFADDR:
1536                 case SIOCGIFBRDADDR:
1537                 case SIOCSIFBRDADDR:
1538                 case SIOCGIFNETMASK:
1539                 case SIOCSIFNETMASK:
1540                 case SIOCGIFDSTADDR:
1541                 case SIOCSIFDSTADDR:
1542                 case SIOCSIFFLAGS:
1543                         if (sock_net(sk) != &init_net)
1544                                 return -ENOIOCTLCMD;
1545                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1546 #endif
1547
1548                 default:
1549                         return -ENOIOCTLCMD;
1550         }
1551         return 0;
1552 }
1553
1554 #ifndef CONFIG_PACKET_MMAP
1555 #define packet_mmap sock_no_mmap
1556 #define packet_poll datagram_poll
1557 #else
1558
1559 static unsigned int packet_poll(struct file * file, struct socket *sock,
1560                                 poll_table *wait)
1561 {
1562         struct sock *sk = sock->sk;
1563         struct packet_sock *po = pkt_sk(sk);
1564         unsigned int mask = datagram_poll(file, sock, wait);
1565
1566         spin_lock_bh(&sk->sk_receive_queue.lock);
1567         if (po->pg_vec) {
1568                 unsigned last = po->head ? po->head-1 : po->frame_max;
1569                 struct tpacket_hdr *h;
1570
1571                 h = packet_lookup_frame(po, last);
1572
1573                 if (h->tp_status)
1574                         mask |= POLLIN | POLLRDNORM;
1575         }
1576         spin_unlock_bh(&sk->sk_receive_queue.lock);
1577         return mask;
1578 }
1579
1580
1581 /* Dirty? Well, I still did not learn better way to account
1582  * for user mmaps.
1583  */
1584
1585 static void packet_mm_open(struct vm_area_struct *vma)
1586 {
1587         struct file *file = vma->vm_file;
1588         struct socket * sock = file->private_data;
1589         struct sock *sk = sock->sk;
1590
1591         if (sk)
1592                 atomic_inc(&pkt_sk(sk)->mapped);
1593 }
1594
1595 static void packet_mm_close(struct vm_area_struct *vma)
1596 {
1597         struct file *file = vma->vm_file;
1598         struct socket * sock = file->private_data;
1599         struct sock *sk = sock->sk;
1600
1601         if (sk)
1602                 atomic_dec(&pkt_sk(sk)->mapped);
1603 }
1604
1605 static struct vm_operations_struct packet_mmap_ops = {
1606         .open = packet_mm_open,
1607         .close =packet_mm_close,
1608 };
1609
1610 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1611 {
1612         int i;
1613
1614         for (i = 0; i < len; i++) {
1615                 if (likely(pg_vec[i]))
1616                         free_pages((unsigned long) pg_vec[i], order);
1617         }
1618         kfree(pg_vec);
1619 }
1620
1621 static inline char *alloc_one_pg_vec_page(unsigned long order)
1622 {
1623         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1624                                          order);
1625 }
1626
1627 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1628 {
1629         unsigned int block_nr = req->tp_block_nr;
1630         char **pg_vec;
1631         int i;
1632
1633         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1634         if (unlikely(!pg_vec))
1635                 goto out;
1636
1637         for (i = 0; i < block_nr; i++) {
1638                 pg_vec[i] = alloc_one_pg_vec_page(order);
1639                 if (unlikely(!pg_vec[i]))
1640                         goto out_free_pgvec;
1641         }
1642
1643 out:
1644         return pg_vec;
1645
1646 out_free_pgvec:
1647         free_pg_vec(pg_vec, order, block_nr);
1648         pg_vec = NULL;
1649         goto out;
1650 }
1651
1652 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1653 {
1654         char **pg_vec = NULL;
1655         struct packet_sock *po = pkt_sk(sk);
1656         int was_running, order = 0;
1657         __be16 num;
1658         int err = 0;
1659
1660         if (req->tp_block_nr) {
1661                 int i;
1662
1663                 /* Sanity tests and some calculations */
1664
1665                 if (unlikely(po->pg_vec))
1666                         return -EBUSY;
1667
1668                 if (unlikely((int)req->tp_block_size <= 0))
1669                         return -EINVAL;
1670                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1671                         return -EINVAL;
1672                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1673                         return -EINVAL;
1674                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1675                         return -EINVAL;
1676
1677                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1678                 if (unlikely(po->frames_per_block <= 0))
1679                         return -EINVAL;
1680                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1681                              req->tp_frame_nr))
1682                         return -EINVAL;
1683
1684                 err = -ENOMEM;
1685                 order = get_order(req->tp_block_size);
1686                 pg_vec = alloc_pg_vec(req, order);
1687                 if (unlikely(!pg_vec))
1688                         goto out;
1689
1690                 for (i = 0; i < req->tp_block_nr; i++) {
1691                         char *ptr = pg_vec[i];
1692                         struct tpacket_hdr *header;
1693                         int k;
1694
1695                         for (k = 0; k < po->frames_per_block; k++) {
1696                                 header = (struct tpacket_hdr *) ptr;
1697                                 header->tp_status = TP_STATUS_KERNEL;
1698                                 ptr += req->tp_frame_size;
1699                         }
1700                 }
1701                 /* Done */
1702         } else {
1703                 if (unlikely(req->tp_frame_nr))
1704                         return -EINVAL;
1705         }
1706
1707         lock_sock(sk);
1708
1709         /* Detach socket from network */
1710         spin_lock(&po->bind_lock);
1711         was_running = po->running;
1712         num = po->num;
1713         if (was_running) {
1714                 __dev_remove_pack(&po->prot_hook);
1715                 po->num = 0;
1716                 po->running = 0;
1717                 __sock_put(sk);
1718         }
1719         spin_unlock(&po->bind_lock);
1720
1721         synchronize_net();
1722
1723         err = -EBUSY;
1724         if (closing || atomic_read(&po->mapped) == 0) {
1725                 err = 0;
1726 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1727
1728                 spin_lock_bh(&sk->sk_receive_queue.lock);
1729                 pg_vec = XC(po->pg_vec, pg_vec);
1730                 po->frame_max = (req->tp_frame_nr - 1);
1731                 po->head = 0;
1732                 po->frame_size = req->tp_frame_size;
1733                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1734
1735                 order = XC(po->pg_vec_order, order);
1736                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1737
1738                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1739                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1740                 skb_queue_purge(&sk->sk_receive_queue);
1741 #undef XC
1742                 if (atomic_read(&po->mapped))
1743                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1744         }
1745
1746         spin_lock(&po->bind_lock);
1747         if (was_running && !po->running) {
1748                 sock_hold(sk);
1749                 po->running = 1;
1750                 po->num = num;
1751                 dev_add_pack(&po->prot_hook);
1752         }
1753         spin_unlock(&po->bind_lock);
1754
1755         release_sock(sk);
1756
1757         if (pg_vec)
1758                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1759 out:
1760         return err;
1761 }
1762
1763 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1764 {
1765         struct sock *sk = sock->sk;
1766         struct packet_sock *po = pkt_sk(sk);
1767         unsigned long size;
1768         unsigned long start;
1769         int err = -EINVAL;
1770         int i;
1771
1772         if (vma->vm_pgoff)
1773                 return -EINVAL;
1774
1775         size = vma->vm_end - vma->vm_start;
1776
1777         lock_sock(sk);
1778         if (po->pg_vec == NULL)
1779                 goto out;
1780         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1781                 goto out;
1782
1783         start = vma->vm_start;
1784         for (i = 0; i < po->pg_vec_len; i++) {
1785                 struct page *page = virt_to_page(po->pg_vec[i]);
1786                 int pg_num;
1787
1788                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1789                         err = vm_insert_page(vma, start, page);
1790                         if (unlikely(err))
1791                                 goto out;
1792                         start += PAGE_SIZE;
1793                 }
1794         }
1795         atomic_inc(&po->mapped);
1796         vma->vm_ops = &packet_mmap_ops;
1797         err = 0;
1798
1799 out:
1800         release_sock(sk);
1801         return err;
1802 }
1803 #endif
1804
1805
1806 static const struct proto_ops packet_ops_spkt = {
1807         .family =       PF_PACKET,
1808         .owner =        THIS_MODULE,
1809         .release =      packet_release,
1810         .bind =         packet_bind_spkt,
1811         .connect =      sock_no_connect,
1812         .socketpair =   sock_no_socketpair,
1813         .accept =       sock_no_accept,
1814         .getname =      packet_getname_spkt,
1815         .poll =         datagram_poll,
1816         .ioctl =        packet_ioctl,
1817         .listen =       sock_no_listen,
1818         .shutdown =     sock_no_shutdown,
1819         .setsockopt =   sock_no_setsockopt,
1820         .getsockopt =   sock_no_getsockopt,
1821         .sendmsg =      packet_sendmsg_spkt,
1822         .recvmsg =      packet_recvmsg,
1823         .mmap =         sock_no_mmap,
1824         .sendpage =     sock_no_sendpage,
1825 };
1826
1827 static const struct proto_ops packet_ops = {
1828         .family =       PF_PACKET,
1829         .owner =        THIS_MODULE,
1830         .release =      packet_release,
1831         .bind =         packet_bind,
1832         .connect =      sock_no_connect,
1833         .socketpair =   sock_no_socketpair,
1834         .accept =       sock_no_accept,
1835         .getname =      packet_getname,
1836         .poll =         packet_poll,
1837         .ioctl =        packet_ioctl,
1838         .listen =       sock_no_listen,
1839         .shutdown =     sock_no_shutdown,
1840         .setsockopt =   packet_setsockopt,
1841         .getsockopt =   packet_getsockopt,
1842         .sendmsg =      packet_sendmsg,
1843         .recvmsg =      packet_recvmsg,
1844         .mmap =         packet_mmap,
1845         .sendpage =     sock_no_sendpage,
1846 };
1847
1848 static struct net_proto_family packet_family_ops = {
1849         .family =       PF_PACKET,
1850         .create =       packet_create,
1851         .owner  =       THIS_MODULE,
1852 };
1853
1854 static struct notifier_block packet_netdev_notifier = {
1855         .notifier_call =packet_notifier,
1856 };
1857
1858 #ifdef CONFIG_PROC_FS
1859 static inline struct sock *packet_seq_idx(struct net *net, loff_t off)
1860 {
1861         struct sock *s;
1862         struct hlist_node *node;
1863
1864         sk_for_each(s, node, &net->packet.sklist) {
1865                 if (!off--)
1866                         return s;
1867         }
1868         return NULL;
1869 }
1870
1871 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1872         __acquires(seq_file_net(seq)->packet.sklist_lock)
1873 {
1874         struct net *net = seq_file_net(seq);
1875         read_lock(&net->packet.sklist_lock);
1876         return *pos ? packet_seq_idx(net, *pos - 1) : SEQ_START_TOKEN;
1877 }
1878
1879 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1880 {
1881         struct net *net = seq_file_net(seq);
1882         ++*pos;
1883         return  (v == SEQ_START_TOKEN)
1884                 ? sk_head(&net->packet.sklist)
1885                 : sk_next((struct sock*)v) ;
1886 }
1887
1888 static void packet_seq_stop(struct seq_file *seq, void *v)
1889         __releases(seq_file_net(seq)->packet.sklist_lock)
1890 {
1891         struct net *net = seq_file_net(seq);
1892         read_unlock(&net->packet.sklist_lock);
1893 }
1894
1895 static int packet_seq_show(struct seq_file *seq, void *v)
1896 {
1897         if (v == SEQ_START_TOKEN)
1898                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1899         else {
1900                 struct sock *s = v;
1901                 const struct packet_sock *po = pkt_sk(s);
1902
1903                 seq_printf(seq,
1904                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1905                            s,
1906                            atomic_read(&s->sk_refcnt),
1907                            s->sk_type,
1908                            ntohs(po->num),
1909                            po->ifindex,
1910                            po->running,
1911                            atomic_read(&s->sk_rmem_alloc),
1912                            sock_i_uid(s),
1913                            sock_i_ino(s) );
1914         }
1915
1916         return 0;
1917 }
1918
1919 static const struct seq_operations packet_seq_ops = {
1920         .start  = packet_seq_start,
1921         .next   = packet_seq_next,
1922         .stop   = packet_seq_stop,
1923         .show   = packet_seq_show,
1924 };
1925
1926 static int packet_seq_open(struct inode *inode, struct file *file)
1927 {
1928         return seq_open_net(inode, file, &packet_seq_ops,
1929                             sizeof(struct seq_net_private));
1930 }
1931
1932 static const struct file_operations packet_seq_fops = {
1933         .owner          = THIS_MODULE,
1934         .open           = packet_seq_open,
1935         .read           = seq_read,
1936         .llseek         = seq_lseek,
1937         .release        = seq_release_net,
1938 };
1939
1940 #endif
1941
1942 static int packet_net_init(struct net *net)
1943 {
1944         rwlock_init(&net->packet.sklist_lock);
1945         INIT_HLIST_HEAD(&net->packet.sklist);
1946
1947         if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
1948                 return -ENOMEM;
1949
1950         return 0;
1951 }
1952
1953 static void packet_net_exit(struct net *net)
1954 {
1955         proc_net_remove(net, "packet");
1956 }
1957
1958 static struct pernet_operations packet_net_ops = {
1959         .init = packet_net_init,
1960         .exit = packet_net_exit,
1961 };
1962
1963
1964 static void __exit packet_exit(void)
1965 {
1966         unregister_netdevice_notifier(&packet_netdev_notifier);
1967         unregister_pernet_subsys(&packet_net_ops);
1968         sock_unregister(PF_PACKET);
1969         proto_unregister(&packet_proto);
1970 }
1971
1972 static int __init packet_init(void)
1973 {
1974         int rc = proto_register(&packet_proto, 0);
1975
1976         if (rc != 0)
1977                 goto out;
1978
1979         sock_register(&packet_family_ops);
1980         register_pernet_subsys(&packet_net_ops);
1981         register_netdevice_notifier(&packet_netdev_notifier);
1982 out:
1983         return rc;
1984 }
1985
1986 module_init(packet_init);
1987 module_exit(packet_exit);
1988 MODULE_LICENSE("GPL");
1989 MODULE_ALIAS_NETPROTO(PF_PACKET);