Merge branch 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git...
[pandora-kernel.git] / net / packet / af_packet.c
1 /*
2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
3  *              operating system.  INET is implemented using the  BSD Socket
4  *              interface as the means of communication with the user level.
5  *
6  *              PACKET - implements raw packet sockets.
7  *
8  * Authors:     Ross Biro
9  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *
12  * Fixes:
13  *              Alan Cox        :       verify_area() now used correctly
14  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
15  *              Alan Cox        :       tidied skbuff lists.
16  *              Alan Cox        :       Now uses generic datagram routines I
17  *                                      added. Also fixed the peek/read crash
18  *                                      from all old Linux datagram code.
19  *              Alan Cox        :       Uses the improved datagram code.
20  *              Alan Cox        :       Added NULL's for socket options.
21  *              Alan Cox        :       Re-commented the code.
22  *              Alan Cox        :       Use new kernel side addressing
23  *              Rob Janssen     :       Correct MTU usage.
24  *              Dave Platt      :       Counter leaks caused by incorrect
25  *                                      interrupt locking and some slightly
26  *                                      dubious gcc output. Can you read
27  *                                      compiler: it said _VOLATILE_
28  *      Richard Kooijman        :       Timestamp fixes.
29  *              Alan Cox        :       New buffers. Use sk->mac.raw.
30  *              Alan Cox        :       sendmsg/recvmsg support.
31  *              Alan Cox        :       Protocol setting support
32  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
33  *      Cyrus Durgin            :       Fixed kerneld for kmod.
34  *      Michal Ostrowski        :       Module initialization cleanup.
35  *         Ulises Alonso        :       Frame number limit removal and
36  *                                      packet_set_ring memory leak.
37  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
38  *                                      The convention is that longer addresses
39  *                                      will simply extend the hardware address
40  *                                      byte arrays at the end of sockaddr_ll
41  *                                      and packet_mreq.
42  *
43  *              This program is free software; you can redistribute it and/or
44  *              modify it under the terms of the GNU General Public License
45  *              as published by the Free Software Foundation; either version
46  *              2 of the License, or (at your option) any later version.
47  *
48  */
49
50 #include <linux/types.h>
51 #include <linux/mm.h>
52 #include <linux/capability.h>
53 #include <linux/fcntl.h>
54 #include <linux/socket.h>
55 #include <linux/in.h>
56 #include <linux/inet.h>
57 #include <linux/netdevice.h>
58 #include <linux/if_packet.h>
59 #include <linux/wireless.h>
60 #include <linux/kernel.h>
61 #include <linux/kmod.h>
62 #include <net/net_namespace.h>
63 #include <net/ip.h>
64 #include <net/protocol.h>
65 #include <linux/skbuff.h>
66 #include <net/sock.h>
67 #include <linux/errno.h>
68 #include <linux/timer.h>
69 #include <asm/system.h>
70 #include <asm/uaccess.h>
71 #include <asm/ioctls.h>
72 #include <asm/page.h>
73 #include <asm/cacheflush.h>
74 #include <asm/io.h>
75 #include <linux/proc_fs.h>
76 #include <linux/seq_file.h>
77 #include <linux/poll.h>
78 #include <linux/module.h>
79 #include <linux/init.h>
80
81 #ifdef CONFIG_INET
82 #include <net/inet_common.h>
83 #endif
84
85 /*
86    Assumptions:
87    - if device has no dev->hard_header routine, it adds and removes ll header
88      inside itself. In this case ll header is invisible outside of device,
89      but higher levels still should reserve dev->hard_header_len.
90      Some devices are enough clever to reallocate skb, when header
91      will not fit to reserved space (tunnel), another ones are silly
92      (PPP).
93    - packet socket receives packets with pulled ll header,
94      so that SOCK_RAW should push it back.
95
96 On receive:
97 -----------
98
99 Incoming, dev->hard_header!=NULL
100    mac_header -> ll header
101    data       -> data
102
103 Outgoing, dev->hard_header!=NULL
104    mac_header -> ll header
105    data       -> ll header
106
107 Incoming, dev->hard_header==NULL
108    mac_header -> UNKNOWN position. It is very likely, that it points to ll
109                  header.  PPP makes it, that is wrong, because introduce
110                  assymetry between rx and tx paths.
111    data       -> data
112
113 Outgoing, dev->hard_header==NULL
114    mac_header -> data. ll header is still not built!
115    data       -> data
116
117 Resume
118   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
119
120
121 On transmit:
122 ------------
123
124 dev->hard_header != NULL
125    mac_header -> ll header
126    data       -> ll header
127
128 dev->hard_header == NULL (ll header is added by device, we cannot control it)
129    mac_header -> data
130    data       -> data
131
132    We should set nh.raw on output to correct posistion,
133    packet classifier depends on it.
134  */
135
136 /* Private packet socket structures. */
137
138 struct packet_mclist
139 {
140         struct packet_mclist    *next;
141         int                     ifindex;
142         int                     count;
143         unsigned short          type;
144         unsigned short          alen;
145         unsigned char           addr[MAX_ADDR_LEN];
146 };
147 /* identical to struct packet_mreq except it has
148  * a longer address field.
149  */
150 struct packet_mreq_max
151 {
152         int             mr_ifindex;
153         unsigned short  mr_type;
154         unsigned short  mr_alen;
155         unsigned char   mr_address[MAX_ADDR_LEN];
156 };
157
158 #ifdef CONFIG_PACKET_MMAP
159 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
160 #endif
161
162 static void packet_flush_mclist(struct sock *sk);
163
164 struct packet_sock {
165         /* struct sock has to be the first member of packet_sock */
166         struct sock             sk;
167         struct tpacket_stats    stats;
168 #ifdef CONFIG_PACKET_MMAP
169         char *                  *pg_vec;
170         unsigned int            head;
171         unsigned int            frames_per_block;
172         unsigned int            frame_size;
173         unsigned int            frame_max;
174         int                     copy_thresh;
175 #endif
176         struct packet_type      prot_hook;
177         spinlock_t              bind_lock;
178         unsigned int            running:1,      /* prot_hook is attached*/
179                                 auxdata:1,
180                                 origdev:1;
181         int                     ifindex;        /* bound device         */
182         __be16                  num;
183         struct packet_mclist    *mclist;
184 #ifdef CONFIG_PACKET_MMAP
185         atomic_t                mapped;
186         unsigned int            pg_vec_order;
187         unsigned int            pg_vec_pages;
188         unsigned int            pg_vec_len;
189         enum tpacket_versions   tp_version;
190         unsigned int            tp_hdrlen;
191         unsigned int            tp_reserve;
192 #endif
193 };
194
195 struct packet_skb_cb {
196         unsigned int origlen;
197         union {
198                 struct sockaddr_pkt pkt;
199                 struct sockaddr_ll ll;
200         } sa;
201 };
202
203 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
204
205 #ifdef CONFIG_PACKET_MMAP
206
207 static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
208                                  int status)
209 {
210         unsigned int pg_vec_pos, frame_offset;
211         union {
212                 struct tpacket_hdr *h1;
213                 struct tpacket2_hdr *h2;
214                 void *raw;
215         } h;
216
217         pg_vec_pos = position / po->frames_per_block;
218         frame_offset = position % po->frames_per_block;
219
220         h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
221         switch (po->tp_version) {
222         case TPACKET_V1:
223                 if (status != h.h1->tp_status ? TP_STATUS_USER :
224                                                 TP_STATUS_KERNEL)
225                         return NULL;
226                 break;
227         case TPACKET_V2:
228                 if (status != h.h2->tp_status ? TP_STATUS_USER :
229                                                 TP_STATUS_KERNEL)
230                         return NULL;
231                 break;
232         }
233         return h.raw;
234 }
235
236 static void __packet_set_status(struct packet_sock *po, void *frame, int status)
237 {
238         union {
239                 struct tpacket_hdr *h1;
240                 struct tpacket2_hdr *h2;
241                 void *raw;
242         } h;
243
244         h.raw = frame;
245         switch (po->tp_version) {
246         case TPACKET_V1:
247                 h.h1->tp_status = status;
248                 break;
249         case TPACKET_V2:
250                 h.h2->tp_status = status;
251                 break;
252         }
253 }
254 #endif
255
256 static inline struct packet_sock *pkt_sk(struct sock *sk)
257 {
258         return (struct packet_sock *)sk;
259 }
260
261 static void packet_sock_destruct(struct sock *sk)
262 {
263         WARN_ON(atomic_read(&sk->sk_rmem_alloc));
264         WARN_ON(atomic_read(&sk->sk_wmem_alloc));
265
266         if (!sock_flag(sk, SOCK_DEAD)) {
267                 printk("Attempt to release alive packet socket: %p\n", sk);
268                 return;
269         }
270
271         sk_refcnt_debug_dec(sk);
272 }
273
274
275 static const struct proto_ops packet_ops;
276
277 static const struct proto_ops packet_ops_spkt;
278
279 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
280 {
281         struct sock *sk;
282         struct sockaddr_pkt *spkt;
283
284         /*
285          *      When we registered the protocol we saved the socket in the data
286          *      field for just this event.
287          */
288
289         sk = pt->af_packet_priv;
290
291         /*
292          *      Yank back the headers [hope the device set this
293          *      right or kerboom...]
294          *
295          *      Incoming packets have ll header pulled,
296          *      push it back.
297          *
298          *      For outgoing ones skb->data == skb_mac_header(skb)
299          *      so that this procedure is noop.
300          */
301
302         if (skb->pkt_type == PACKET_LOOPBACK)
303                 goto out;
304
305         if (dev_net(dev) != sock_net(sk))
306                 goto out;
307
308         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
309                 goto oom;
310
311         /* drop any routing info */
312         dst_release(skb->dst);
313         skb->dst = NULL;
314
315         /* drop conntrack reference */
316         nf_reset(skb);
317
318         spkt = &PACKET_SKB_CB(skb)->sa.pkt;
319
320         skb_push(skb, skb->data - skb_mac_header(skb));
321
322         /*
323          *      The SOCK_PACKET socket receives _all_ frames.
324          */
325
326         spkt->spkt_family = dev->type;
327         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
328         spkt->spkt_protocol = skb->protocol;
329
330         /*
331          *      Charge the memory to the socket. This is done specifically
332          *      to prevent sockets using all the memory up.
333          */
334
335         if (sock_queue_rcv_skb(sk,skb) == 0)
336                 return 0;
337
338 out:
339         kfree_skb(skb);
340 oom:
341         return 0;
342 }
343
344
345 /*
346  *      Output a raw packet to a device layer. This bypasses all the other
347  *      protocol layers and you must therefore supply it with a complete frame
348  */
349
350 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
351                                struct msghdr *msg, size_t len)
352 {
353         struct sock *sk = sock->sk;
354         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
355         struct sk_buff *skb;
356         struct net_device *dev;
357         __be16 proto=0;
358         int err;
359
360         /*
361          *      Get and verify the address.
362          */
363
364         if (saddr)
365         {
366                 if (msg->msg_namelen < sizeof(struct sockaddr))
367                         return(-EINVAL);
368                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
369                         proto=saddr->spkt_protocol;
370         }
371         else
372                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
373
374         /*
375          *      Find the device first to size check it
376          */
377
378         saddr->spkt_device[13] = 0;
379         dev = dev_get_by_name(sock_net(sk), saddr->spkt_device);
380         err = -ENODEV;
381         if (dev == NULL)
382                 goto out_unlock;
383
384         err = -ENETDOWN;
385         if (!(dev->flags & IFF_UP))
386                 goto out_unlock;
387
388         /*
389          *      You may not queue a frame bigger than the mtu. This is the lowest level
390          *      raw protocol and you must do your own fragmentation at this level.
391          */
392
393         err = -EMSGSIZE;
394         if (len > dev->mtu + dev->hard_header_len)
395                 goto out_unlock;
396
397         err = -ENOBUFS;
398         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
399
400         /*
401          *      If the write buffer is full, then tough. At this level the user gets to
402          *      deal with the problem - do your own algorithmic backoffs. That's far
403          *      more flexible.
404          */
405
406         if (skb == NULL)
407                 goto out_unlock;
408
409         /*
410          *      Fill it in
411          */
412
413         /* FIXME: Save some space for broken drivers that write a
414          * hard header at transmission time by themselves. PPP is the
415          * notable one here. This should really be fixed at the driver level.
416          */
417         skb_reserve(skb, LL_RESERVED_SPACE(dev));
418         skb_reset_network_header(skb);
419
420         /* Try to align data part correctly */
421         if (dev->header_ops) {
422                 skb->data -= dev->hard_header_len;
423                 skb->tail -= dev->hard_header_len;
424                 if (len < dev->hard_header_len)
425                         skb_reset_network_header(skb);
426         }
427
428         /* Returns -EFAULT on error */
429         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
430         skb->protocol = proto;
431         skb->dev = dev;
432         skb->priority = sk->sk_priority;
433         if (err)
434                 goto out_free;
435
436         /*
437          *      Now send it
438          */
439
440         dev_queue_xmit(skb);
441         dev_put(dev);
442         return(len);
443
444 out_free:
445         kfree_skb(skb);
446 out_unlock:
447         if (dev)
448                 dev_put(dev);
449         return err;
450 }
451
452 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
453                                       unsigned int res)
454 {
455         struct sk_filter *filter;
456
457         rcu_read_lock_bh();
458         filter = rcu_dereference(sk->sk_filter);
459         if (filter != NULL)
460                 res = sk_run_filter(skb, filter->insns, filter->len);
461         rcu_read_unlock_bh();
462
463         return res;
464 }
465
466 /*
467    This function makes lazy skb cloning in hope that most of packets
468    are discarded by BPF.
469
470    Note tricky part: we DO mangle shared skb! skb->data, skb->len
471    and skb->cb are mangled. It works because (and until) packets
472    falling here are owned by current CPU. Output packets are cloned
473    by dev_queue_xmit_nit(), input packets are processed by net_bh
474    sequencially, so that if we return skb to original state on exit,
475    we will not harm anyone.
476  */
477
478 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
479 {
480         struct sock *sk;
481         struct sockaddr_ll *sll;
482         struct packet_sock *po;
483         u8 * skb_head = skb->data;
484         int skb_len = skb->len;
485         unsigned int snaplen, res;
486
487         if (skb->pkt_type == PACKET_LOOPBACK)
488                 goto drop;
489
490         sk = pt->af_packet_priv;
491         po = pkt_sk(sk);
492
493         if (dev_net(dev) != sock_net(sk))
494                 goto drop;
495
496         skb->dev = dev;
497
498         if (dev->header_ops) {
499                 /* The device has an explicit notion of ll header,
500                    exported to higher levels.
501
502                    Otherwise, the device hides datails of it frame
503                    structure, so that corresponding packet head
504                    never delivered to user.
505                  */
506                 if (sk->sk_type != SOCK_DGRAM)
507                         skb_push(skb, skb->data - skb_mac_header(skb));
508                 else if (skb->pkt_type == PACKET_OUTGOING) {
509                         /* Special case: outgoing packets have ll header at head */
510                         skb_pull(skb, skb_network_offset(skb));
511                 }
512         }
513
514         snaplen = skb->len;
515
516         res = run_filter(skb, sk, snaplen);
517         if (!res)
518                 goto drop_n_restore;
519         if (snaplen > res)
520                 snaplen = res;
521
522         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
523             (unsigned)sk->sk_rcvbuf)
524                 goto drop_n_acct;
525
526         if (skb_shared(skb)) {
527                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
528                 if (nskb == NULL)
529                         goto drop_n_acct;
530
531                 if (skb_head != skb->data) {
532                         skb->data = skb_head;
533                         skb->len = skb_len;
534                 }
535                 kfree_skb(skb);
536                 skb = nskb;
537         }
538
539         BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
540                      sizeof(skb->cb));
541
542         sll = &PACKET_SKB_CB(skb)->sa.ll;
543         sll->sll_family = AF_PACKET;
544         sll->sll_hatype = dev->type;
545         sll->sll_protocol = skb->protocol;
546         sll->sll_pkttype = skb->pkt_type;
547         if (unlikely(po->origdev))
548                 sll->sll_ifindex = orig_dev->ifindex;
549         else
550                 sll->sll_ifindex = dev->ifindex;
551
552         sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
553
554         PACKET_SKB_CB(skb)->origlen = skb->len;
555
556         if (pskb_trim(skb, snaplen))
557                 goto drop_n_acct;
558
559         skb_set_owner_r(skb, sk);
560         skb->dev = NULL;
561         dst_release(skb->dst);
562         skb->dst = NULL;
563
564         /* drop conntrack reference */
565         nf_reset(skb);
566
567         spin_lock(&sk->sk_receive_queue.lock);
568         po->stats.tp_packets++;
569         __skb_queue_tail(&sk->sk_receive_queue, skb);
570         spin_unlock(&sk->sk_receive_queue.lock);
571         sk->sk_data_ready(sk, skb->len);
572         return 0;
573
574 drop_n_acct:
575         spin_lock(&sk->sk_receive_queue.lock);
576         po->stats.tp_drops++;
577         spin_unlock(&sk->sk_receive_queue.lock);
578
579 drop_n_restore:
580         if (skb_head != skb->data && skb_shared(skb)) {
581                 skb->data = skb_head;
582                 skb->len = skb_len;
583         }
584 drop:
585         kfree_skb(skb);
586         return 0;
587 }
588
589 #ifdef CONFIG_PACKET_MMAP
590 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
591 {
592         struct sock *sk;
593         struct packet_sock *po;
594         struct sockaddr_ll *sll;
595         union {
596                 struct tpacket_hdr *h1;
597                 struct tpacket2_hdr *h2;
598                 void *raw;
599         } h;
600         u8 * skb_head = skb->data;
601         int skb_len = skb->len;
602         unsigned int snaplen, res;
603         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
604         unsigned short macoff, netoff, hdrlen;
605         struct sk_buff *copy_skb = NULL;
606         struct timeval tv;
607         struct timespec ts;
608
609         if (skb->pkt_type == PACKET_LOOPBACK)
610                 goto drop;
611
612         sk = pt->af_packet_priv;
613         po = pkt_sk(sk);
614
615         if (dev_net(dev) != sock_net(sk))
616                 goto drop;
617
618         if (dev->header_ops) {
619                 if (sk->sk_type != SOCK_DGRAM)
620                         skb_push(skb, skb->data - skb_mac_header(skb));
621                 else if (skb->pkt_type == PACKET_OUTGOING) {
622                         /* Special case: outgoing packets have ll header at head */
623                         skb_pull(skb, skb_network_offset(skb));
624                 }
625         }
626
627         if (skb->ip_summed == CHECKSUM_PARTIAL)
628                 status |= TP_STATUS_CSUMNOTREADY;
629
630         snaplen = skb->len;
631
632         res = run_filter(skb, sk, snaplen);
633         if (!res)
634                 goto drop_n_restore;
635         if (snaplen > res)
636                 snaplen = res;
637
638         if (sk->sk_type == SOCK_DGRAM) {
639                 macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 +
640                                   po->tp_reserve;
641         } else {
642                 unsigned maclen = skb_network_offset(skb);
643                 netoff = TPACKET_ALIGN(po->tp_hdrlen +
644                                        (maclen < 16 ? 16 : maclen)) +
645                         po->tp_reserve;
646                 macoff = netoff - maclen;
647         }
648
649         if (macoff + snaplen > po->frame_size) {
650                 if (po->copy_thresh &&
651                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
652                     (unsigned)sk->sk_rcvbuf) {
653                         if (skb_shared(skb)) {
654                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
655                         } else {
656                                 copy_skb = skb_get(skb);
657                                 skb_head = skb->data;
658                         }
659                         if (copy_skb)
660                                 skb_set_owner_r(copy_skb, sk);
661                 }
662                 snaplen = po->frame_size - macoff;
663                 if ((int)snaplen < 0)
664                         snaplen = 0;
665         }
666
667         spin_lock(&sk->sk_receive_queue.lock);
668         h.raw = packet_lookup_frame(po, po->head, TP_STATUS_KERNEL);
669         if (!h.raw)
670                 goto ring_is_full;
671         po->head = po->head != po->frame_max ? po->head+1 : 0;
672         po->stats.tp_packets++;
673         if (copy_skb) {
674                 status |= TP_STATUS_COPY;
675                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
676         }
677         if (!po->stats.tp_drops)
678                 status &= ~TP_STATUS_LOSING;
679         spin_unlock(&sk->sk_receive_queue.lock);
680
681         skb_copy_bits(skb, 0, h.raw + macoff, snaplen);
682
683         switch (po->tp_version) {
684         case TPACKET_V1:
685                 h.h1->tp_len = skb->len;
686                 h.h1->tp_snaplen = snaplen;
687                 h.h1->tp_mac = macoff;
688                 h.h1->tp_net = netoff;
689                 if (skb->tstamp.tv64)
690                         tv = ktime_to_timeval(skb->tstamp);
691                 else
692                         do_gettimeofday(&tv);
693                 h.h1->tp_sec = tv.tv_sec;
694                 h.h1->tp_usec = tv.tv_usec;
695                 hdrlen = sizeof(*h.h1);
696                 break;
697         case TPACKET_V2:
698                 h.h2->tp_len = skb->len;
699                 h.h2->tp_snaplen = snaplen;
700                 h.h2->tp_mac = macoff;
701                 h.h2->tp_net = netoff;
702                 if (skb->tstamp.tv64)
703                         ts = ktime_to_timespec(skb->tstamp);
704                 else
705                         getnstimeofday(&ts);
706                 h.h2->tp_sec = ts.tv_sec;
707                 h.h2->tp_nsec = ts.tv_nsec;
708                 h.h2->tp_vlan_tci = skb->vlan_tci;
709                 hdrlen = sizeof(*h.h2);
710                 break;
711         default:
712                 BUG();
713         }
714
715         sll = h.raw + TPACKET_ALIGN(hdrlen);
716         sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
717         sll->sll_family = AF_PACKET;
718         sll->sll_hatype = dev->type;
719         sll->sll_protocol = skb->protocol;
720         sll->sll_pkttype = skb->pkt_type;
721         if (unlikely(po->origdev))
722                 sll->sll_ifindex = orig_dev->ifindex;
723         else
724                 sll->sll_ifindex = dev->ifindex;
725
726         __packet_set_status(po, h.raw, status);
727         smp_mb();
728
729         {
730                 struct page *p_start, *p_end;
731                 u8 *h_end = h.raw + macoff + snaplen - 1;
732
733                 p_start = virt_to_page(h.raw);
734                 p_end = virt_to_page(h_end);
735                 while (p_start <= p_end) {
736                         flush_dcache_page(p_start);
737                         p_start++;
738                 }
739         }
740
741         sk->sk_data_ready(sk, 0);
742
743 drop_n_restore:
744         if (skb_head != skb->data && skb_shared(skb)) {
745                 skb->data = skb_head;
746                 skb->len = skb_len;
747         }
748 drop:
749         kfree_skb(skb);
750         return 0;
751
752 ring_is_full:
753         po->stats.tp_drops++;
754         spin_unlock(&sk->sk_receive_queue.lock);
755
756         sk->sk_data_ready(sk, 0);
757         if (copy_skb)
758                 kfree_skb(copy_skb);
759         goto drop_n_restore;
760 }
761
762 #endif
763
764
765 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
766                           struct msghdr *msg, size_t len)
767 {
768         struct sock *sk = sock->sk;
769         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
770         struct sk_buff *skb;
771         struct net_device *dev;
772         __be16 proto;
773         unsigned char *addr;
774         int ifindex, err, reserve = 0;
775
776         /*
777          *      Get and verify the address.
778          */
779
780         if (saddr == NULL) {
781                 struct packet_sock *po = pkt_sk(sk);
782
783                 ifindex = po->ifindex;
784                 proto   = po->num;
785                 addr    = NULL;
786         } else {
787                 err = -EINVAL;
788                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
789                         goto out;
790                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
791                         goto out;
792                 ifindex = saddr->sll_ifindex;
793                 proto   = saddr->sll_protocol;
794                 addr    = saddr->sll_addr;
795         }
796
797
798         dev = dev_get_by_index(sock_net(sk), ifindex);
799         err = -ENXIO;
800         if (dev == NULL)
801                 goto out_unlock;
802         if (sock->type == SOCK_RAW)
803                 reserve = dev->hard_header_len;
804
805         err = -ENETDOWN;
806         if (!(dev->flags & IFF_UP))
807                 goto out_unlock;
808
809         err = -EMSGSIZE;
810         if (len > dev->mtu+reserve)
811                 goto out_unlock;
812
813         skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
814                                 msg->msg_flags & MSG_DONTWAIT, &err);
815         if (skb==NULL)
816                 goto out_unlock;
817
818         skb_reserve(skb, LL_RESERVED_SPACE(dev));
819         skb_reset_network_header(skb);
820
821         err = -EINVAL;
822         if (sock->type == SOCK_DGRAM &&
823             dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
824                 goto out_free;
825
826         /* Returns -EFAULT on error */
827         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
828         if (err)
829                 goto out_free;
830
831         skb->protocol = proto;
832         skb->dev = dev;
833         skb->priority = sk->sk_priority;
834
835         /*
836          *      Now send it
837          */
838
839         err = dev_queue_xmit(skb);
840         if (err > 0 && (err = net_xmit_errno(err)) != 0)
841                 goto out_unlock;
842
843         dev_put(dev);
844
845         return(len);
846
847 out_free:
848         kfree_skb(skb);
849 out_unlock:
850         if (dev)
851                 dev_put(dev);
852 out:
853         return err;
854 }
855
856 /*
857  *      Close a PACKET socket. This is fairly simple. We immediately go
858  *      to 'closed' state and remove our protocol entry in the device list.
859  */
860
861 static int packet_release(struct socket *sock)
862 {
863         struct sock *sk = sock->sk;
864         struct packet_sock *po;
865         struct net *net;
866
867         if (!sk)
868                 return 0;
869
870         net = sock_net(sk);
871         po = pkt_sk(sk);
872
873         write_lock_bh(&net->packet.sklist_lock);
874         sk_del_node_init(sk);
875         write_unlock_bh(&net->packet.sklist_lock);
876
877         /*
878          *      Unhook packet receive handler.
879          */
880
881         if (po->running) {
882                 /*
883                  *      Remove the protocol hook
884                  */
885                 dev_remove_pack(&po->prot_hook);
886                 po->running = 0;
887                 po->num = 0;
888                 __sock_put(sk);
889         }
890
891         packet_flush_mclist(sk);
892
893 #ifdef CONFIG_PACKET_MMAP
894         if (po->pg_vec) {
895                 struct tpacket_req req;
896                 memset(&req, 0, sizeof(req));
897                 packet_set_ring(sk, &req, 1);
898         }
899 #endif
900
901         /*
902          *      Now the socket is dead. No more input will appear.
903          */
904
905         sock_orphan(sk);
906         sock->sk = NULL;
907
908         /* Purge queues */
909
910         skb_queue_purge(&sk->sk_receive_queue);
911         sk_refcnt_debug_release(sk);
912
913         sock_put(sk);
914         return 0;
915 }
916
917 /*
918  *      Attach a packet hook.
919  */
920
921 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
922 {
923         struct packet_sock *po = pkt_sk(sk);
924         /*
925          *      Detach an existing hook if present.
926          */
927
928         lock_sock(sk);
929
930         spin_lock(&po->bind_lock);
931         if (po->running) {
932                 __sock_put(sk);
933                 po->running = 0;
934                 po->num = 0;
935                 spin_unlock(&po->bind_lock);
936                 dev_remove_pack(&po->prot_hook);
937                 spin_lock(&po->bind_lock);
938         }
939
940         po->num = protocol;
941         po->prot_hook.type = protocol;
942         po->prot_hook.dev = dev;
943
944         po->ifindex = dev ? dev->ifindex : 0;
945
946         if (protocol == 0)
947                 goto out_unlock;
948
949         if (!dev || (dev->flags & IFF_UP)) {
950                 dev_add_pack(&po->prot_hook);
951                 sock_hold(sk);
952                 po->running = 1;
953         } else {
954                 sk->sk_err = ENETDOWN;
955                 if (!sock_flag(sk, SOCK_DEAD))
956                         sk->sk_error_report(sk);
957         }
958
959 out_unlock:
960         spin_unlock(&po->bind_lock);
961         release_sock(sk);
962         return 0;
963 }
964
965 /*
966  *      Bind a packet socket to a device
967  */
968
969 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
970 {
971         struct sock *sk=sock->sk;
972         char name[15];
973         struct net_device *dev;
974         int err = -ENODEV;
975
976         /*
977          *      Check legality
978          */
979
980         if (addr_len != sizeof(struct sockaddr))
981                 return -EINVAL;
982         strlcpy(name,uaddr->sa_data,sizeof(name));
983
984         dev = dev_get_by_name(sock_net(sk), name);
985         if (dev) {
986                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
987                 dev_put(dev);
988         }
989         return err;
990 }
991
992 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
993 {
994         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
995         struct sock *sk=sock->sk;
996         struct net_device *dev = NULL;
997         int err;
998
999
1000         /*
1001          *      Check legality
1002          */
1003
1004         if (addr_len < sizeof(struct sockaddr_ll))
1005                 return -EINVAL;
1006         if (sll->sll_family != AF_PACKET)
1007                 return -EINVAL;
1008
1009         if (sll->sll_ifindex) {
1010                 err = -ENODEV;
1011                 dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex);
1012                 if (dev == NULL)
1013                         goto out;
1014         }
1015         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
1016         if (dev)
1017                 dev_put(dev);
1018
1019 out:
1020         return err;
1021 }
1022
1023 static struct proto packet_proto = {
1024         .name     = "PACKET",
1025         .owner    = THIS_MODULE,
1026         .obj_size = sizeof(struct packet_sock),
1027 };
1028
1029 /*
1030  *      Create a packet of type SOCK_PACKET.
1031  */
1032
1033 static int packet_create(struct net *net, struct socket *sock, int protocol)
1034 {
1035         struct sock *sk;
1036         struct packet_sock *po;
1037         __be16 proto = (__force __be16)protocol; /* weird, but documented */
1038         int err;
1039
1040         if (!capable(CAP_NET_RAW))
1041                 return -EPERM;
1042         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
1043             sock->type != SOCK_PACKET)
1044                 return -ESOCKTNOSUPPORT;
1045
1046         sock->state = SS_UNCONNECTED;
1047
1048         err = -ENOBUFS;
1049         sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto);
1050         if (sk == NULL)
1051                 goto out;
1052
1053         sock->ops = &packet_ops;
1054         if (sock->type == SOCK_PACKET)
1055                 sock->ops = &packet_ops_spkt;
1056
1057         sock_init_data(sock, sk);
1058
1059         po = pkt_sk(sk);
1060         sk->sk_family = PF_PACKET;
1061         po->num = proto;
1062
1063         sk->sk_destruct = packet_sock_destruct;
1064         sk_refcnt_debug_inc(sk);
1065
1066         /*
1067          *      Attach a protocol block
1068          */
1069
1070         spin_lock_init(&po->bind_lock);
1071         po->prot_hook.func = packet_rcv;
1072
1073         if (sock->type == SOCK_PACKET)
1074                 po->prot_hook.func = packet_rcv_spkt;
1075
1076         po->prot_hook.af_packet_priv = sk;
1077
1078         if (proto) {
1079                 po->prot_hook.type = proto;
1080                 dev_add_pack(&po->prot_hook);
1081                 sock_hold(sk);
1082                 po->running = 1;
1083         }
1084
1085         write_lock_bh(&net->packet.sklist_lock);
1086         sk_add_node(sk, &net->packet.sklist);
1087         write_unlock_bh(&net->packet.sklist_lock);
1088         return(0);
1089 out:
1090         return err;
1091 }
1092
1093 /*
1094  *      Pull a packet from our receive queue and hand it to the user.
1095  *      If necessary we block.
1096  */
1097
1098 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1099                           struct msghdr *msg, size_t len, int flags)
1100 {
1101         struct sock *sk = sock->sk;
1102         struct sk_buff *skb;
1103         int copied, err;
1104         struct sockaddr_ll *sll;
1105
1106         err = -EINVAL;
1107         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1108                 goto out;
1109
1110 #if 0
1111         /* What error should we return now? EUNATTACH? */
1112         if (pkt_sk(sk)->ifindex < 0)
1113                 return -ENODEV;
1114 #endif
1115
1116         /*
1117          *      Call the generic datagram receiver. This handles all sorts
1118          *      of horrible races and re-entrancy so we can forget about it
1119          *      in the protocol layers.
1120          *
1121          *      Now it will return ENETDOWN, if device have just gone down,
1122          *      but then it will block.
1123          */
1124
1125         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1126
1127         /*
1128          *      An error occurred so return it. Because skb_recv_datagram()
1129          *      handles the blocking we don't see and worry about blocking
1130          *      retries.
1131          */
1132
1133         if (skb == NULL)
1134                 goto out;
1135
1136         /*
1137          *      If the address length field is there to be filled in, we fill
1138          *      it in now.
1139          */
1140
1141         sll = &PACKET_SKB_CB(skb)->sa.ll;
1142         if (sock->type == SOCK_PACKET)
1143                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1144         else
1145                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1146
1147         /*
1148          *      You lose any data beyond the buffer you gave. If it worries a
1149          *      user program they can ask the device for its MTU anyway.
1150          */
1151
1152         copied = skb->len;
1153         if (copied > len)
1154         {
1155                 copied=len;
1156                 msg->msg_flags|=MSG_TRUNC;
1157         }
1158
1159         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1160         if (err)
1161                 goto out_free;
1162
1163         sock_recv_timestamp(msg, sk, skb);
1164
1165         if (msg->msg_name)
1166                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1167                        msg->msg_namelen);
1168
1169         if (pkt_sk(sk)->auxdata) {
1170                 struct tpacket_auxdata aux;
1171
1172                 aux.tp_status = TP_STATUS_USER;
1173                 if (skb->ip_summed == CHECKSUM_PARTIAL)
1174                         aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1175                 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1176                 aux.tp_snaplen = skb->len;
1177                 aux.tp_mac = 0;
1178                 aux.tp_net = skb_network_offset(skb);
1179                 aux.tp_vlan_tci = skb->vlan_tci;
1180
1181                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1182         }
1183
1184         /*
1185          *      Free or return the buffer as appropriate. Again this
1186          *      hides all the races and re-entrancy issues from us.
1187          */
1188         err = (flags&MSG_TRUNC) ? skb->len : copied;
1189
1190 out_free:
1191         skb_free_datagram(sk, skb);
1192 out:
1193         return err;
1194 }
1195
1196 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1197                                int *uaddr_len, int peer)
1198 {
1199         struct net_device *dev;
1200         struct sock *sk = sock->sk;
1201
1202         if (peer)
1203                 return -EOPNOTSUPP;
1204
1205         uaddr->sa_family = AF_PACKET;
1206         dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
1207         if (dev) {
1208                 strlcpy(uaddr->sa_data, dev->name, 15);
1209                 dev_put(dev);
1210         } else
1211                 memset(uaddr->sa_data, 0, 14);
1212         *uaddr_len = sizeof(*uaddr);
1213
1214         return 0;
1215 }
1216
1217 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1218                           int *uaddr_len, int peer)
1219 {
1220         struct net_device *dev;
1221         struct sock *sk = sock->sk;
1222         struct packet_sock *po = pkt_sk(sk);
1223         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1224
1225         if (peer)
1226                 return -EOPNOTSUPP;
1227
1228         sll->sll_family = AF_PACKET;
1229         sll->sll_ifindex = po->ifindex;
1230         sll->sll_protocol = po->num;
1231         dev = dev_get_by_index(sock_net(sk), po->ifindex);
1232         if (dev) {
1233                 sll->sll_hatype = dev->type;
1234                 sll->sll_halen = dev->addr_len;
1235                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1236                 dev_put(dev);
1237         } else {
1238                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1239                 sll->sll_halen = 0;
1240         }
1241         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1242
1243         return 0;
1244 }
1245
1246 static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
1247                          int what)
1248 {
1249         switch (i->type) {
1250         case PACKET_MR_MULTICAST:
1251                 if (what > 0)
1252                         dev_mc_add(dev, i->addr, i->alen, 0);
1253                 else
1254                         dev_mc_delete(dev, i->addr, i->alen, 0);
1255                 break;
1256         case PACKET_MR_PROMISC:
1257                 return dev_set_promiscuity(dev, what);
1258                 break;
1259         case PACKET_MR_ALLMULTI:
1260                 return dev_set_allmulti(dev, what);
1261                 break;
1262         default:;
1263         }
1264         return 0;
1265 }
1266
1267 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1268 {
1269         for ( ; i; i=i->next) {
1270                 if (i->ifindex == dev->ifindex)
1271                         packet_dev_mc(dev, i, what);
1272         }
1273 }
1274
1275 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1276 {
1277         struct packet_sock *po = pkt_sk(sk);
1278         struct packet_mclist *ml, *i;
1279         struct net_device *dev;
1280         int err;
1281
1282         rtnl_lock();
1283
1284         err = -ENODEV;
1285         dev = __dev_get_by_index(sock_net(sk), mreq->mr_ifindex);
1286         if (!dev)
1287                 goto done;
1288
1289         err = -EINVAL;
1290         if (mreq->mr_alen > dev->addr_len)
1291                 goto done;
1292
1293         err = -ENOBUFS;
1294         i = kmalloc(sizeof(*i), GFP_KERNEL);
1295         if (i == NULL)
1296                 goto done;
1297
1298         err = 0;
1299         for (ml = po->mclist; ml; ml = ml->next) {
1300                 if (ml->ifindex == mreq->mr_ifindex &&
1301                     ml->type == mreq->mr_type &&
1302                     ml->alen == mreq->mr_alen &&
1303                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1304                         ml->count++;
1305                         /* Free the new element ... */
1306                         kfree(i);
1307                         goto done;
1308                 }
1309         }
1310
1311         i->type = mreq->mr_type;
1312         i->ifindex = mreq->mr_ifindex;
1313         i->alen = mreq->mr_alen;
1314         memcpy(i->addr, mreq->mr_address, i->alen);
1315         i->count = 1;
1316         i->next = po->mclist;
1317         po->mclist = i;
1318         err = packet_dev_mc(dev, i, 1);
1319         if (err) {
1320                 po->mclist = i->next;
1321                 kfree(i);
1322         }
1323
1324 done:
1325         rtnl_unlock();
1326         return err;
1327 }
1328
1329 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1330 {
1331         struct packet_mclist *ml, **mlp;
1332
1333         rtnl_lock();
1334
1335         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1336                 if (ml->ifindex == mreq->mr_ifindex &&
1337                     ml->type == mreq->mr_type &&
1338                     ml->alen == mreq->mr_alen &&
1339                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1340                         if (--ml->count == 0) {
1341                                 struct net_device *dev;
1342                                 *mlp = ml->next;
1343                                 dev = dev_get_by_index(sock_net(sk), ml->ifindex);
1344                                 if (dev) {
1345                                         packet_dev_mc(dev, ml, -1);
1346                                         dev_put(dev);
1347                                 }
1348                                 kfree(ml);
1349                         }
1350                         rtnl_unlock();
1351                         return 0;
1352                 }
1353         }
1354         rtnl_unlock();
1355         return -EADDRNOTAVAIL;
1356 }
1357
1358 static void packet_flush_mclist(struct sock *sk)
1359 {
1360         struct packet_sock *po = pkt_sk(sk);
1361         struct packet_mclist *ml;
1362
1363         if (!po->mclist)
1364                 return;
1365
1366         rtnl_lock();
1367         while ((ml = po->mclist) != NULL) {
1368                 struct net_device *dev;
1369
1370                 po->mclist = ml->next;
1371                 if ((dev = dev_get_by_index(sock_net(sk), ml->ifindex)) != NULL) {
1372                         packet_dev_mc(dev, ml, -1);
1373                         dev_put(dev);
1374                 }
1375                 kfree(ml);
1376         }
1377         rtnl_unlock();
1378 }
1379
1380 static int
1381 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1382 {
1383         struct sock *sk = sock->sk;
1384         struct packet_sock *po = pkt_sk(sk);
1385         int ret;
1386
1387         if (level != SOL_PACKET)
1388                 return -ENOPROTOOPT;
1389
1390         switch(optname) {
1391         case PACKET_ADD_MEMBERSHIP:
1392         case PACKET_DROP_MEMBERSHIP:
1393         {
1394                 struct packet_mreq_max mreq;
1395                 int len = optlen;
1396                 memset(&mreq, 0, sizeof(mreq));
1397                 if (len < sizeof(struct packet_mreq))
1398                         return -EINVAL;
1399                 if (len > sizeof(mreq))
1400                         len = sizeof(mreq);
1401                 if (copy_from_user(&mreq,optval,len))
1402                         return -EFAULT;
1403                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1404                         return -EINVAL;
1405                 if (optname == PACKET_ADD_MEMBERSHIP)
1406                         ret = packet_mc_add(sk, &mreq);
1407                 else
1408                         ret = packet_mc_drop(sk, &mreq);
1409                 return ret;
1410         }
1411
1412 #ifdef CONFIG_PACKET_MMAP
1413         case PACKET_RX_RING:
1414         {
1415                 struct tpacket_req req;
1416
1417                 if (optlen<sizeof(req))
1418                         return -EINVAL;
1419                 if (copy_from_user(&req,optval,sizeof(req)))
1420                         return -EFAULT;
1421                 return packet_set_ring(sk, &req, 0);
1422         }
1423         case PACKET_COPY_THRESH:
1424         {
1425                 int val;
1426
1427                 if (optlen!=sizeof(val))
1428                         return -EINVAL;
1429                 if (copy_from_user(&val,optval,sizeof(val)))
1430                         return -EFAULT;
1431
1432                 pkt_sk(sk)->copy_thresh = val;
1433                 return 0;
1434         }
1435         case PACKET_VERSION:
1436         {
1437                 int val;
1438
1439                 if (optlen != sizeof(val))
1440                         return -EINVAL;
1441                 if (po->pg_vec)
1442                         return -EBUSY;
1443                 if (copy_from_user(&val, optval, sizeof(val)))
1444                         return -EFAULT;
1445                 switch (val) {
1446                 case TPACKET_V1:
1447                 case TPACKET_V2:
1448                         po->tp_version = val;
1449                         return 0;
1450                 default:
1451                         return -EINVAL;
1452                 }
1453         }
1454         case PACKET_RESERVE:
1455         {
1456                 unsigned int val;
1457
1458                 if (optlen != sizeof(val))
1459                         return -EINVAL;
1460                 if (po->pg_vec)
1461                         return -EBUSY;
1462                 if (copy_from_user(&val, optval, sizeof(val)))
1463                         return -EFAULT;
1464                 po->tp_reserve = val;
1465                 return 0;
1466         }
1467 #endif
1468         case PACKET_AUXDATA:
1469         {
1470                 int val;
1471
1472                 if (optlen < sizeof(val))
1473                         return -EINVAL;
1474                 if (copy_from_user(&val, optval, sizeof(val)))
1475                         return -EFAULT;
1476
1477                 po->auxdata = !!val;
1478                 return 0;
1479         }
1480         case PACKET_ORIGDEV:
1481         {
1482                 int val;
1483
1484                 if (optlen < sizeof(val))
1485                         return -EINVAL;
1486                 if (copy_from_user(&val, optval, sizeof(val)))
1487                         return -EFAULT;
1488
1489                 po->origdev = !!val;
1490                 return 0;
1491         }
1492         default:
1493                 return -ENOPROTOOPT;
1494         }
1495 }
1496
1497 static int packet_getsockopt(struct socket *sock, int level, int optname,
1498                              char __user *optval, int __user *optlen)
1499 {
1500         int len;
1501         int val;
1502         struct sock *sk = sock->sk;
1503         struct packet_sock *po = pkt_sk(sk);
1504         void *data;
1505         struct tpacket_stats st;
1506
1507         if (level != SOL_PACKET)
1508                 return -ENOPROTOOPT;
1509
1510         if (get_user(len, optlen))
1511                 return -EFAULT;
1512
1513         if (len < 0)
1514                 return -EINVAL;
1515
1516         switch(optname) {
1517         case PACKET_STATISTICS:
1518                 if (len > sizeof(struct tpacket_stats))
1519                         len = sizeof(struct tpacket_stats);
1520                 spin_lock_bh(&sk->sk_receive_queue.lock);
1521                 st = po->stats;
1522                 memset(&po->stats, 0, sizeof(st));
1523                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1524                 st.tp_packets += st.tp_drops;
1525
1526                 data = &st;
1527                 break;
1528         case PACKET_AUXDATA:
1529                 if (len > sizeof(int))
1530                         len = sizeof(int);
1531                 val = po->auxdata;
1532
1533                 data = &val;
1534                 break;
1535         case PACKET_ORIGDEV:
1536                 if (len > sizeof(int))
1537                         len = sizeof(int);
1538                 val = po->origdev;
1539
1540                 data = &val;
1541                 break;
1542 #ifdef CONFIG_PACKET_MMAP
1543         case PACKET_VERSION:
1544                 if (len > sizeof(int))
1545                         len = sizeof(int);
1546                 val = po->tp_version;
1547                 data = &val;
1548                 break;
1549         case PACKET_HDRLEN:
1550                 if (len > sizeof(int))
1551                         len = sizeof(int);
1552                 if (copy_from_user(&val, optval, len))
1553                         return -EFAULT;
1554                 switch (val) {
1555                 case TPACKET_V1:
1556                         val = sizeof(struct tpacket_hdr);
1557                         break;
1558                 case TPACKET_V2:
1559                         val = sizeof(struct tpacket2_hdr);
1560                         break;
1561                 default:
1562                         return -EINVAL;
1563                 }
1564                 data = &val;
1565                 break;
1566         case PACKET_RESERVE:
1567                 if (len > sizeof(unsigned int))
1568                         len = sizeof(unsigned int);
1569                 val = po->tp_reserve;
1570                 data = &val;
1571                 break;
1572 #endif
1573         default:
1574                 return -ENOPROTOOPT;
1575         }
1576
1577         if (put_user(len, optlen))
1578                 return -EFAULT;
1579         if (copy_to_user(optval, data, len))
1580                 return -EFAULT;
1581         return 0;
1582 }
1583
1584
1585 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1586 {
1587         struct sock *sk;
1588         struct hlist_node *node;
1589         struct net_device *dev = data;
1590         struct net *net = dev_net(dev);
1591
1592         read_lock(&net->packet.sklist_lock);
1593         sk_for_each(sk, node, &net->packet.sklist) {
1594                 struct packet_sock *po = pkt_sk(sk);
1595
1596                 switch (msg) {
1597                 case NETDEV_UNREGISTER:
1598                         if (po->mclist)
1599                                 packet_dev_mclist(dev, po->mclist, -1);
1600                         /* fallthrough */
1601
1602                 case NETDEV_DOWN:
1603                         if (dev->ifindex == po->ifindex) {
1604                                 spin_lock(&po->bind_lock);
1605                                 if (po->running) {
1606                                         __dev_remove_pack(&po->prot_hook);
1607                                         __sock_put(sk);
1608                                         po->running = 0;
1609                                         sk->sk_err = ENETDOWN;
1610                                         if (!sock_flag(sk, SOCK_DEAD))
1611                                                 sk->sk_error_report(sk);
1612                                 }
1613                                 if (msg == NETDEV_UNREGISTER) {
1614                                         po->ifindex = -1;
1615                                         po->prot_hook.dev = NULL;
1616                                 }
1617                                 spin_unlock(&po->bind_lock);
1618                         }
1619                         break;
1620                 case NETDEV_UP:
1621                         spin_lock(&po->bind_lock);
1622                         if (dev->ifindex == po->ifindex && po->num &&
1623                             !po->running) {
1624                                 dev_add_pack(&po->prot_hook);
1625                                 sock_hold(sk);
1626                                 po->running = 1;
1627                         }
1628                         spin_unlock(&po->bind_lock);
1629                         break;
1630                 }
1631         }
1632         read_unlock(&net->packet.sklist_lock);
1633         return NOTIFY_DONE;
1634 }
1635
1636
1637 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1638                         unsigned long arg)
1639 {
1640         struct sock *sk = sock->sk;
1641
1642         switch(cmd) {
1643                 case SIOCOUTQ:
1644                 {
1645                         int amount = atomic_read(&sk->sk_wmem_alloc);
1646                         return put_user(amount, (int __user *)arg);
1647                 }
1648                 case SIOCINQ:
1649                 {
1650                         struct sk_buff *skb;
1651                         int amount = 0;
1652
1653                         spin_lock_bh(&sk->sk_receive_queue.lock);
1654                         skb = skb_peek(&sk->sk_receive_queue);
1655                         if (skb)
1656                                 amount = skb->len;
1657                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1658                         return put_user(amount, (int __user *)arg);
1659                 }
1660                 case SIOCGSTAMP:
1661                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1662                 case SIOCGSTAMPNS:
1663                         return sock_get_timestampns(sk, (struct timespec __user *)arg);
1664
1665 #ifdef CONFIG_INET
1666                 case SIOCADDRT:
1667                 case SIOCDELRT:
1668                 case SIOCDARP:
1669                 case SIOCGARP:
1670                 case SIOCSARP:
1671                 case SIOCGIFADDR:
1672                 case SIOCSIFADDR:
1673                 case SIOCGIFBRDADDR:
1674                 case SIOCSIFBRDADDR:
1675                 case SIOCGIFNETMASK:
1676                 case SIOCSIFNETMASK:
1677                 case SIOCGIFDSTADDR:
1678                 case SIOCSIFDSTADDR:
1679                 case SIOCSIFFLAGS:
1680                         if (!net_eq(sock_net(sk), &init_net))
1681                                 return -ENOIOCTLCMD;
1682                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1683 #endif
1684
1685                 default:
1686                         return -ENOIOCTLCMD;
1687         }
1688         return 0;
1689 }
1690
1691 #ifndef CONFIG_PACKET_MMAP
1692 #define packet_mmap sock_no_mmap
1693 #define packet_poll datagram_poll
1694 #else
1695
1696 static unsigned int packet_poll(struct file * file, struct socket *sock,
1697                                 poll_table *wait)
1698 {
1699         struct sock *sk = sock->sk;
1700         struct packet_sock *po = pkt_sk(sk);
1701         unsigned int mask = datagram_poll(file, sock, wait);
1702
1703         spin_lock_bh(&sk->sk_receive_queue.lock);
1704         if (po->pg_vec) {
1705                 unsigned last = po->head ? po->head-1 : po->frame_max;
1706
1707                 if (packet_lookup_frame(po, last, TP_STATUS_USER))
1708                         mask |= POLLIN | POLLRDNORM;
1709         }
1710         spin_unlock_bh(&sk->sk_receive_queue.lock);
1711         return mask;
1712 }
1713
1714
1715 /* Dirty? Well, I still did not learn better way to account
1716  * for user mmaps.
1717  */
1718
1719 static void packet_mm_open(struct vm_area_struct *vma)
1720 {
1721         struct file *file = vma->vm_file;
1722         struct socket * sock = file->private_data;
1723         struct sock *sk = sock->sk;
1724
1725         if (sk)
1726                 atomic_inc(&pkt_sk(sk)->mapped);
1727 }
1728
1729 static void packet_mm_close(struct vm_area_struct *vma)
1730 {
1731         struct file *file = vma->vm_file;
1732         struct socket * sock = file->private_data;
1733         struct sock *sk = sock->sk;
1734
1735         if (sk)
1736                 atomic_dec(&pkt_sk(sk)->mapped);
1737 }
1738
1739 static struct vm_operations_struct packet_mmap_ops = {
1740         .open = packet_mm_open,
1741         .close =packet_mm_close,
1742 };
1743
1744 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1745 {
1746         int i;
1747
1748         for (i = 0; i < len; i++) {
1749                 if (likely(pg_vec[i]))
1750                         free_pages((unsigned long) pg_vec[i], order);
1751         }
1752         kfree(pg_vec);
1753 }
1754
1755 static inline char *alloc_one_pg_vec_page(unsigned long order)
1756 {
1757         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1758                                          order);
1759 }
1760
1761 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1762 {
1763         unsigned int block_nr = req->tp_block_nr;
1764         char **pg_vec;
1765         int i;
1766
1767         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1768         if (unlikely(!pg_vec))
1769                 goto out;
1770
1771         for (i = 0; i < block_nr; i++) {
1772                 pg_vec[i] = alloc_one_pg_vec_page(order);
1773                 if (unlikely(!pg_vec[i]))
1774                         goto out_free_pgvec;
1775         }
1776
1777 out:
1778         return pg_vec;
1779
1780 out_free_pgvec:
1781         free_pg_vec(pg_vec, order, block_nr);
1782         pg_vec = NULL;
1783         goto out;
1784 }
1785
1786 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1787 {
1788         char **pg_vec = NULL;
1789         struct packet_sock *po = pkt_sk(sk);
1790         int was_running, order = 0;
1791         __be16 num;
1792         int err = 0;
1793
1794         if (req->tp_block_nr) {
1795                 int i;
1796
1797                 /* Sanity tests and some calculations */
1798
1799                 if (unlikely(po->pg_vec))
1800                         return -EBUSY;
1801
1802                 switch (po->tp_version) {
1803                 case TPACKET_V1:
1804                         po->tp_hdrlen = TPACKET_HDRLEN;
1805                         break;
1806                 case TPACKET_V2:
1807                         po->tp_hdrlen = TPACKET2_HDRLEN;
1808                         break;
1809                 }
1810
1811                 if (unlikely((int)req->tp_block_size <= 0))
1812                         return -EINVAL;
1813                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1814                         return -EINVAL;
1815                 if (unlikely(req->tp_frame_size < po->tp_hdrlen +
1816                                                   po->tp_reserve))
1817                         return -EINVAL;
1818                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1819                         return -EINVAL;
1820
1821                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1822                 if (unlikely(po->frames_per_block <= 0))
1823                         return -EINVAL;
1824                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1825                              req->tp_frame_nr))
1826                         return -EINVAL;
1827
1828                 err = -ENOMEM;
1829                 order = get_order(req->tp_block_size);
1830                 pg_vec = alloc_pg_vec(req, order);
1831                 if (unlikely(!pg_vec))
1832                         goto out;
1833
1834                 for (i = 0; i < req->tp_block_nr; i++) {
1835                         void *ptr = pg_vec[i];
1836                         int k;
1837
1838                         for (k = 0; k < po->frames_per_block; k++) {
1839                                 __packet_set_status(po, ptr, TP_STATUS_KERNEL);
1840                                 ptr += req->tp_frame_size;
1841                         }
1842                 }
1843                 /* Done */
1844         } else {
1845                 if (unlikely(req->tp_frame_nr))
1846                         return -EINVAL;
1847         }
1848
1849         lock_sock(sk);
1850
1851         /* Detach socket from network */
1852         spin_lock(&po->bind_lock);
1853         was_running = po->running;
1854         num = po->num;
1855         if (was_running) {
1856                 __dev_remove_pack(&po->prot_hook);
1857                 po->num = 0;
1858                 po->running = 0;
1859                 __sock_put(sk);
1860         }
1861         spin_unlock(&po->bind_lock);
1862
1863         synchronize_net();
1864
1865         err = -EBUSY;
1866         if (closing || atomic_read(&po->mapped) == 0) {
1867                 err = 0;
1868 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1869
1870                 spin_lock_bh(&sk->sk_receive_queue.lock);
1871                 pg_vec = XC(po->pg_vec, pg_vec);
1872                 po->frame_max = (req->tp_frame_nr - 1);
1873                 po->head = 0;
1874                 po->frame_size = req->tp_frame_size;
1875                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1876
1877                 order = XC(po->pg_vec_order, order);
1878                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1879
1880                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1881                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1882                 skb_queue_purge(&sk->sk_receive_queue);
1883 #undef XC
1884                 if (atomic_read(&po->mapped))
1885                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1886         }
1887
1888         spin_lock(&po->bind_lock);
1889         if (was_running && !po->running) {
1890                 sock_hold(sk);
1891                 po->running = 1;
1892                 po->num = num;
1893                 dev_add_pack(&po->prot_hook);
1894         }
1895         spin_unlock(&po->bind_lock);
1896
1897         release_sock(sk);
1898
1899         if (pg_vec)
1900                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1901 out:
1902         return err;
1903 }
1904
1905 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1906 {
1907         struct sock *sk = sock->sk;
1908         struct packet_sock *po = pkt_sk(sk);
1909         unsigned long size;
1910         unsigned long start;
1911         int err = -EINVAL;
1912         int i;
1913
1914         if (vma->vm_pgoff)
1915                 return -EINVAL;
1916
1917         size = vma->vm_end - vma->vm_start;
1918
1919         lock_sock(sk);
1920         if (po->pg_vec == NULL)
1921                 goto out;
1922         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1923                 goto out;
1924
1925         start = vma->vm_start;
1926         for (i = 0; i < po->pg_vec_len; i++) {
1927                 struct page *page = virt_to_page(po->pg_vec[i]);
1928                 int pg_num;
1929
1930                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1931                         err = vm_insert_page(vma, start, page);
1932                         if (unlikely(err))
1933                                 goto out;
1934                         start += PAGE_SIZE;
1935                 }
1936         }
1937         atomic_inc(&po->mapped);
1938         vma->vm_ops = &packet_mmap_ops;
1939         err = 0;
1940
1941 out:
1942         release_sock(sk);
1943         return err;
1944 }
1945 #endif
1946
1947
1948 static const struct proto_ops packet_ops_spkt = {
1949         .family =       PF_PACKET,
1950         .owner =        THIS_MODULE,
1951         .release =      packet_release,
1952         .bind =         packet_bind_spkt,
1953         .connect =      sock_no_connect,
1954         .socketpair =   sock_no_socketpair,
1955         .accept =       sock_no_accept,
1956         .getname =      packet_getname_spkt,
1957         .poll =         datagram_poll,
1958         .ioctl =        packet_ioctl,
1959         .listen =       sock_no_listen,
1960         .shutdown =     sock_no_shutdown,
1961         .setsockopt =   sock_no_setsockopt,
1962         .getsockopt =   sock_no_getsockopt,
1963         .sendmsg =      packet_sendmsg_spkt,
1964         .recvmsg =      packet_recvmsg,
1965         .mmap =         sock_no_mmap,
1966         .sendpage =     sock_no_sendpage,
1967 };
1968
1969 static const struct proto_ops packet_ops = {
1970         .family =       PF_PACKET,
1971         .owner =        THIS_MODULE,
1972         .release =      packet_release,
1973         .bind =         packet_bind,
1974         .connect =      sock_no_connect,
1975         .socketpair =   sock_no_socketpair,
1976         .accept =       sock_no_accept,
1977         .getname =      packet_getname,
1978         .poll =         packet_poll,
1979         .ioctl =        packet_ioctl,
1980         .listen =       sock_no_listen,
1981         .shutdown =     sock_no_shutdown,
1982         .setsockopt =   packet_setsockopt,
1983         .getsockopt =   packet_getsockopt,
1984         .sendmsg =      packet_sendmsg,
1985         .recvmsg =      packet_recvmsg,
1986         .mmap =         packet_mmap,
1987         .sendpage =     sock_no_sendpage,
1988 };
1989
1990 static struct net_proto_family packet_family_ops = {
1991         .family =       PF_PACKET,
1992         .create =       packet_create,
1993         .owner  =       THIS_MODULE,
1994 };
1995
1996 static struct notifier_block packet_netdev_notifier = {
1997         .notifier_call =packet_notifier,
1998 };
1999
2000 #ifdef CONFIG_PROC_FS
2001 static inline struct sock *packet_seq_idx(struct net *net, loff_t off)
2002 {
2003         struct sock *s;
2004         struct hlist_node *node;
2005
2006         sk_for_each(s, node, &net->packet.sklist) {
2007                 if (!off--)
2008                         return s;
2009         }
2010         return NULL;
2011 }
2012
2013 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
2014         __acquires(seq_file_net(seq)->packet.sklist_lock)
2015 {
2016         struct net *net = seq_file_net(seq);
2017         read_lock(&net->packet.sklist_lock);
2018         return *pos ? packet_seq_idx(net, *pos - 1) : SEQ_START_TOKEN;
2019 }
2020
2021 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2022 {
2023         struct net *net = seq_file_net(seq);
2024         ++*pos;
2025         return  (v == SEQ_START_TOKEN)
2026                 ? sk_head(&net->packet.sklist)
2027                 : sk_next((struct sock*)v) ;
2028 }
2029
2030 static void packet_seq_stop(struct seq_file *seq, void *v)
2031         __releases(seq_file_net(seq)->packet.sklist_lock)
2032 {
2033         struct net *net = seq_file_net(seq);
2034         read_unlock(&net->packet.sklist_lock);
2035 }
2036
2037 static int packet_seq_show(struct seq_file *seq, void *v)
2038 {
2039         if (v == SEQ_START_TOKEN)
2040                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
2041         else {
2042                 struct sock *s = v;
2043                 const struct packet_sock *po = pkt_sk(s);
2044
2045                 seq_printf(seq,
2046                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
2047                            s,
2048                            atomic_read(&s->sk_refcnt),
2049                            s->sk_type,
2050                            ntohs(po->num),
2051                            po->ifindex,
2052                            po->running,
2053                            atomic_read(&s->sk_rmem_alloc),
2054                            sock_i_uid(s),
2055                            sock_i_ino(s) );
2056         }
2057
2058         return 0;
2059 }
2060
2061 static const struct seq_operations packet_seq_ops = {
2062         .start  = packet_seq_start,
2063         .next   = packet_seq_next,
2064         .stop   = packet_seq_stop,
2065         .show   = packet_seq_show,
2066 };
2067
2068 static int packet_seq_open(struct inode *inode, struct file *file)
2069 {
2070         return seq_open_net(inode, file, &packet_seq_ops,
2071                             sizeof(struct seq_net_private));
2072 }
2073
2074 static const struct file_operations packet_seq_fops = {
2075         .owner          = THIS_MODULE,
2076         .open           = packet_seq_open,
2077         .read           = seq_read,
2078         .llseek         = seq_lseek,
2079         .release        = seq_release_net,
2080 };
2081
2082 #endif
2083
2084 static int packet_net_init(struct net *net)
2085 {
2086         rwlock_init(&net->packet.sklist_lock);
2087         INIT_HLIST_HEAD(&net->packet.sklist);
2088
2089         if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
2090                 return -ENOMEM;
2091
2092         return 0;
2093 }
2094
2095 static void packet_net_exit(struct net *net)
2096 {
2097         proc_net_remove(net, "packet");
2098 }
2099
2100 static struct pernet_operations packet_net_ops = {
2101         .init = packet_net_init,
2102         .exit = packet_net_exit,
2103 };
2104
2105
2106 static void __exit packet_exit(void)
2107 {
2108         unregister_netdevice_notifier(&packet_netdev_notifier);
2109         unregister_pernet_subsys(&packet_net_ops);
2110         sock_unregister(PF_PACKET);
2111         proto_unregister(&packet_proto);
2112 }
2113
2114 static int __init packet_init(void)
2115 {
2116         int rc = proto_register(&packet_proto, 0);
2117
2118         if (rc != 0)
2119                 goto out;
2120
2121         sock_register(&packet_family_ops);
2122         register_pernet_subsys(&packet_net_ops);
2123         register_netdevice_notifier(&packet_netdev_notifier);
2124 out:
2125         return rc;
2126 }
2127
2128 module_init(packet_init);
2129 module_exit(packet_exit);
2130 MODULE_LICENSE("GPL");
2131 MODULE_ALIAS_NETPROTO(PF_PACKET);