net/packet/af_packet.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              PACKET - implements raw packet sockets.
   7  *
   8  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
   9  *
  10  * Authors:     Ross Biro
  11  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  12  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       verify_area() now used correctly
  16  *              Alan Cox        :       new skbuff lists, look ma no backlogs!
  17  *              Alan Cox        :       tidied skbuff lists.
  18  *              Alan Cox        :       Now uses generic datagram routines I
  19  *                                      added. Also fixed the peek/read crash
  20  *                                      from all old Linux datagram code.
  21  *              Alan Cox        :       Uses the improved datagram code.
  22  *              Alan Cox        :       Added NULL's for socket options.
  23  *              Alan Cox        :       Re-commented the code.
  24  *              Alan Cox        :       Use new kernel side addressing
  25  *              Rob Janssen     :       Correct MTU usage.
  26  *              Dave Platt      :       Counter leaks caused by incorrect
  27  *                                      interrupt locking and some slightly
  28  *                                      dubious gcc output. Can you read
  29  *                                      compiler: it said _VOLATILE_
  30  *      Richard Kooijman        :       Timestamp fixes.
  31  *              Alan Cox        :       New buffers. Use sk->mac.raw.
  32  *              Alan Cox        :       sendmsg/recvmsg support.
  33  *              Alan Cox        :       Protocol setting support
  34  *      Alexey Kuznetsov        :       Untied from IPv4 stack.
  35  *      Cyrus Durgin            :       Fixed kerneld for kmod.
  36  *      Michal Ostrowski        :       Module initialization cleanup.
  37  *         Ulises Alonso        :       Frame number limit removal and
  38  *                                      packet_set_ring memory leak.
  39  *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
  40  *                                      The convention is that longer addresses
  41  *                                      will simply extend the hardware address
  42  *                                      byte arrays at the end of sockaddr_ll
  43  *                                      and packet_mreq.
  44  *
  45  *              This program is free software; you can redistribute it and/or
  46  *              modify it under the terms of the GNU General Public License
  47  *              as published by the Free Software Foundation; either version
  48  *              2 of the License, or (at your option) any later version.
  49  *
  50  */
  51
  52 #include <linux/types.h>
  53 #include <linux/sched.h>
  54 #include <linux/mm.h>
  55 #include <linux/capability.h>
  56 #include <linux/fcntl.h>
  57 #include <linux/socket.h>
  58 #include <linux/in.h>
  59 #include <linux/inet.h>
  60 #include <linux/netdevice.h>
  61 #include <linux/if_packet.h>
  62 #include <linux/wireless.h>
  63 #include <linux/kmod.h>
  64 #include <net/ip.h>
  65 #include <net/protocol.h>
  66 #include <linux/skbuff.h>
  67 #include <net/sock.h>
  68 #include <linux/errno.h>
  69 #include <linux/timer.h>
  70 #include <asm/system.h>
  71 #include <asm/uaccess.h>
  72 #include <asm/ioctls.h>
  73 #include <asm/page.h>
  74 #include <asm/io.h>
  75 #include <linux/proc_fs.h>
  76 #include <linux/seq_file.h>
  77 #include <linux/poll.h>
  78 #include <linux/module.h>
  79 #include <linux/init.h>
  80
  81 #ifdef CONFIG_INET
  82 #include <net/inet_common.h>
  83 #endif
  84
  85 #define CONFIG_SOCK_PACKET      1
  86
  87 /*
  88    Proposed replacement for SIOC{ADD,DEL}MULTI and
  89    IFF_PROMISC, IFF_ALLMULTI flags.
  90
  91    It is more expensive, but I believe,
  92    it is really correct solution: reentereble, safe and fault tolerant.
  93
  94    IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping
  95    reference count and global flag, so that real status is
  96    (gflag|(count != 0)), so that we can use obsolete faulty interface
  97    not harming clever users.
  98  */
  99 #define CONFIG_PACKET_MULTICAST 1
 100
 101 /*
 102    Assumptions:
 103    - if device has no dev->hard_header routine, it adds and removes ll header
 104      inside itself. In this case ll header is invisible outside of device,
 105      but higher levels still should reserve dev->hard_header_len.
 106      Some devices are enough clever to reallocate skb, when header
 107      will not fit to reserved space (tunnel), another ones are silly
 108      (PPP).
 109    - packet socket receives packets with pulled ll header,
 110      so that SOCK_RAW should push it back.
 111
 112 On receive:
 113 -----------
 114
 115 Incoming, dev->hard_header!=NULL
 116    mac.raw -> ll header
 117    data    -> data
 118
 119 Outgoing, dev->hard_header!=NULL
 120    mac.raw -> ll header
 121    data    -> ll header
 122
 123 Incoming, dev->hard_header==NULL
 124    mac.raw -> UNKNOWN position. It is very likely, that it points to ll header.
 125               PPP makes it, that is wrong, because introduce assymetry
 126               between rx and tx paths.
 127    data    -> data
 128
 129 Outgoing, dev->hard_header==NULL
 130    mac.raw -> data. ll header is still not built!
 131    data    -> data
 132
 133 Resume
 134   If dev->hard_header==NULL we are unlikely to restore sensible ll header.
 135
 136
 137 On transmit:
 138 ------------
 139
 140 dev->hard_header != NULL
 141    mac.raw -> ll header
 142    data    -> ll header
 143
 144 dev->hard_header == NULL (ll header is added by device, we cannot control it)
 145    mac.raw -> data
 146    data -> data
 147
 148    We should set nh.raw on output to correct posistion,
 149    packet classifier depends on it.
 150  */
 151
 152 /* List of all packet sockets. */
 153 static HLIST_HEAD(packet_sklist);
 154 static DEFINE_RWLOCK(packet_sklist_lock);
 155
 156 static atomic_t packet_socks_nr;
 157
 158
 159 /* Private packet socket structures. */
 160
 161 #ifdef CONFIG_PACKET_MULTICAST
 162 struct packet_mclist
 163 {
 164         struct packet_mclist    *next;
 165         int                     ifindex;
 166         int                     count;
 167         unsigned short          type;
 168         unsigned short          alen;
 169         unsigned char           addr[MAX_ADDR_LEN];
 170 };
 171 /* identical to struct packet_mreq except it has
 172  * a longer address field.
 173  */
 174 struct packet_mreq_max
 175 {
 176         int             mr_ifindex;
 177         unsigned short  mr_type;
 178         unsigned short  mr_alen;
 179         unsigned char   mr_address[MAX_ADDR_LEN];
 180 };
 181 #endif
 182 #ifdef CONFIG_PACKET_MMAP
 183 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 184 #endif
 185
 186 static void packet_flush_mclist(struct sock *sk);
 187
 188 struct packet_sock {
 189         /* struct sock has to be the first member of packet_sock */
 190         struct sock             sk;
 191         struct tpacket_stats    stats;
 192 #ifdef CONFIG_PACKET_MMAP
 193         char *                  *pg_vec;
 194         unsigned int            head;
 195         unsigned int            frames_per_block;
 196         unsigned int            frame_size;
 197         unsigned int            frame_max;
 198         int                     copy_thresh;
 199 #endif
 200         struct packet_type      prot_hook;
 201         spinlock_t              bind_lock;
 202         char                    running;        /* prot_hook is attached*/
 203         int                     ifindex;        /* bound device         */
 204         __be16                  num;
 205 #ifdef CONFIG_PACKET_MULTICAST
 206         struct packet_mclist    *mclist;
 207 #endif
 208 #ifdef CONFIG_PACKET_MMAP
 209         atomic_t                mapped;
 210         unsigned int            pg_vec_order;
 211         unsigned int            pg_vec_pages;
 212         unsigned int            pg_vec_len;
 213 #endif
 214 };
 215
 216 #ifdef CONFIG_PACKET_MMAP
 217
 218 static inline char *packet_lookup_frame(struct packet_sock *po, unsigned int position)
 219 {
 220         unsigned int pg_vec_pos, frame_offset;
 221         char *frame;
 222
 223         pg_vec_pos = position / po->frames_per_block;
 224         frame_offset = position % po->frames_per_block;
 225
 226         frame = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
 227
 228         return frame;
 229 }
 230 #endif
 231
 232 static inline struct packet_sock *pkt_sk(struct sock *sk)
 233 {
 234         return (struct packet_sock *)sk;
 235 }
 236
 237 static void packet_sock_destruct(struct sock *sk)
 238 {
 239         BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 240         BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 241
 242         if (!sock_flag(sk, SOCK_DEAD)) {
 243                 printk("Attempt to release alive packet socket: %p\n", sk);
 244                 return;
 245         }
 246
 247         atomic_dec(&packet_socks_nr);
 248 #ifdef PACKET_REFCNT_DEBUG
 249         printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
 250 #endif
 251 }
 252
 253
 254 static const struct proto_ops packet_ops;
 255
 256 #ifdef CONFIG_SOCK_PACKET
 257 static const struct proto_ops packet_ops_spkt;
 258
 259 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
 260 {
 261         struct sock *sk;
 262         struct sockaddr_pkt *spkt;
 263
 264         /*
 265          *      When we registered the protocol we saved the socket in the data
 266          *      field for just this event.
 267          */
 268
 269         sk = pt->af_packet_priv;
 270
 271         /*
 272          *      Yank back the headers [hope the device set this
 273          *      right or kerboom...]
 274          *
 275          *      Incoming packets have ll header pulled,
 276          *      push it back.
 277          *
 278          *      For outgoing ones skb->data == skb->mac.raw
 279          *      so that this procedure is noop.
 280          */
 281
 282         if (skb->pkt_type == PACKET_LOOPBACK)
 283                 goto out;
 284
 285         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 286                 goto oom;
 287
 288         /* drop any routing info */
 289         dst_release(skb->dst);
 290         skb->dst = NULL;
 291
 292         /* drop conntrack reference */
 293         nf_reset(skb);
 294
 295         spkt = (struct sockaddr_pkt*)skb->cb;
 296
 297         skb_push(skb, skb->data-skb->mac.raw);
 298
 299         /*
 300          *      The SOCK_PACKET socket receives _all_ frames.
 301          */
 302
 303         spkt->spkt_family = dev->type;
 304         strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
 305         spkt->spkt_protocol = skb->protocol;
 306
 307         /*
 308          *      Charge the memory to the socket. This is done specifically
 309          *      to prevent sockets using all the memory up.
 310          */
 311
 312         if (sock_queue_rcv_skb(sk,skb) == 0)
 313                 return 0;
 314
 315 out:
 316         kfree_skb(skb);
 317 oom:
 318         return 0;
 319 }
 320
 321
 322 /*
 323  *      Output a raw packet to a device layer. This bypasses all the other
 324  *      protocol layers and you must therefore supply it with a complete frame
 325  */
 326
 327 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 328                                struct msghdr *msg, size_t len)
 329 {
 330         struct sock *sk = sock->sk;
 331         struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
 332         struct sk_buff *skb;
 333         struct net_device *dev;
 334         __be16 proto=0;
 335         int err;
 336
 337         /*
 338          *      Get and verify the address.
 339          */
 340
 341         if (saddr)
 342         {
 343                 if (msg->msg_namelen < sizeof(struct sockaddr))
 344                         return(-EINVAL);
 345                 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
 346                         proto=saddr->spkt_protocol;
 347         }
 348         else
 349                 return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
 350
 351         /*
 352          *      Find the device first to size check it
 353          */
 354
 355         saddr->spkt_device[13] = 0;
 356         dev = dev_get_by_name(saddr->spkt_device);
 357         err = -ENODEV;
 358         if (dev == NULL)
 359                 goto out_unlock;
 360
 361         /*
 362          *      You may not queue a frame bigger than the mtu. This is the lowest level
 363          *      raw protocol and you must do your own fragmentation at this level.
 364          */
 365
 366         err = -EMSGSIZE;
 367         if (len > dev->mtu + dev->hard_header_len)
 368                 goto out_unlock;
 369
 370         err = -ENOBUFS;
 371         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 372
 373         /*
 374          *      If the write buffer is full, then tough. At this level the user gets to
 375          *      deal with the problem - do your own algorithmic backoffs. That's far
 376          *      more flexible.
 377          */
 378
 379         if (skb == NULL)
 380                 goto out_unlock;
 381
 382         /*
 383          *      Fill it in
 384          */
 385
 386         /* FIXME: Save some space for broken drivers that write a
 387          * hard header at transmission time by themselves. PPP is the
 388          * notable one here. This should really be fixed at the driver level.
 389          */
 390         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 391         skb->nh.raw = skb->data;
 392
 393         /* Try to align data part correctly */
 394         if (dev->hard_header) {
 395                 skb->data -= dev->hard_header_len;
 396                 skb->tail -= dev->hard_header_len;
 397                 if (len < dev->hard_header_len)
 398                         skb->nh.raw = skb->data;
 399         }
 400
 401         /* Returns -EFAULT on error */
 402         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 403         skb->protocol = proto;
 404         skb->dev = dev;
 405         skb->priority = sk->sk_priority;
 406         if (err)
 407                 goto out_free;
 408
 409         err = -ENETDOWN;
 410         if (!(dev->flags & IFF_UP))
 411                 goto out_free;
 412
 413         /*
 414          *      Now send it
 415          */
 416
 417         dev_queue_xmit(skb);
 418         dev_put(dev);
 419         return(len);
 420
 421 out_free:
 422         kfree_skb(skb);
 423 out_unlock:
 424         if (dev)
 425                 dev_put(dev);
 426         return err;
 427 }
 428 #endif
 429
 430 static inline int run_filter(struct sk_buff *skb, struct sock *sk,
 431                                                         unsigned *snaplen)
 432 {
 433         struct sk_filter *filter;
 434         int err = 0;
 435
 436         rcu_read_lock_bh();
 437         filter = rcu_dereference(sk->sk_filter);
 438         if (filter != NULL) {
 439                 err = sk_run_filter(skb, filter->insns, filter->len);
 440                 if (!err)
 441                         err = -EPERM;
 442                 else if (*snaplen > err)
 443                         *snaplen = err;
 444         }
 445         rcu_read_unlock_bh();
 446
 447         return err;
 448 }
 449
 450 /*
 451    This function makes lazy skb cloning in hope that most of packets
 452    are discarded by BPF.
 453
 454    Note tricky part: we DO mangle shared skb! skb->data, skb->len
 455    and skb->cb are mangled. It works because (and until) packets
 456    falling here are owned by current CPU. Output packets are cloned
 457    by dev_queue_xmit_nit(), input packets are processed by net_bh
 458    sequencially, so that if we return skb to original state on exit,
 459    we will not harm anyone.
 460  */
 461
 462 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 463 {
 464         struct sock *sk;
 465         struct sockaddr_ll *sll;
 466         struct packet_sock *po;
 467         u8 * skb_head = skb->data;
 468         int skb_len = skb->len;
 469         unsigned snaplen;
 470
 471         if (skb->pkt_type == PACKET_LOOPBACK)
 472                 goto drop;
 473
 474         sk = pt->af_packet_priv;
 475         po = pkt_sk(sk);
 476
 477         skb->dev = dev;
 478
 479         if (dev->hard_header) {
 480                 /* The device has an explicit notion of ll header,
 481                    exported to higher levels.
 482
 483                    Otherwise, the device hides datails of it frame
 484                    structure, so that corresponding packet head
 485                    never delivered to user.
 486                  */
 487                 if (sk->sk_type != SOCK_DGRAM)
 488                         skb_push(skb, skb->data - skb->mac.raw);
 489                 else if (skb->pkt_type == PACKET_OUTGOING) {
 490                         /* Special case: outgoing packets have ll header at head */
 491                         skb_pull(skb, skb->nh.raw - skb->data);
 492                 }
 493         }
 494
 495         snaplen = skb->len;
 496
 497         if (run_filter(skb, sk, &snaplen) < 0)
 498                 goto drop_n_restore;
 499
 500         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
 501             (unsigned)sk->sk_rcvbuf)
 502                 goto drop_n_acct;
 503
 504         if (skb_shared(skb)) {
 505                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 506                 if (nskb == NULL)
 507                         goto drop_n_acct;
 508
 509                 if (skb_head != skb->data) {
 510                         skb->data = skb_head;
 511                         skb->len = skb_len;
 512                 }
 513                 kfree_skb(skb);
 514                 skb = nskb;
 515         }
 516
 517         sll = (struct sockaddr_ll*)skb->cb;
 518         sll->sll_family = AF_PACKET;
 519         sll->sll_hatype = dev->type;
 520         sll->sll_protocol = skb->protocol;
 521         sll->sll_pkttype = skb->pkt_type;
 522         sll->sll_ifindex = dev->ifindex;
 523         sll->sll_halen = 0;
 524
 525         if (dev->hard_header_parse)
 526                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 527
 528         if (pskb_trim(skb, snaplen))
 529                 goto drop_n_acct;
 530
 531         skb_set_owner_r(skb, sk);
 532         skb->dev = NULL;
 533         dst_release(skb->dst);
 534         skb->dst = NULL;
 535
 536         /* drop conntrack reference */
 537         nf_reset(skb);
 538
 539         spin_lock(&sk->sk_receive_queue.lock);
 540         po->stats.tp_packets++;
 541         __skb_queue_tail(&sk->sk_receive_queue, skb);
 542         spin_unlock(&sk->sk_receive_queue.lock);
 543         sk->sk_data_ready(sk, skb->len);
 544         return 0;
 545
 546 drop_n_acct:
 547         spin_lock(&sk->sk_receive_queue.lock);
 548         po->stats.tp_drops++;
 549         spin_unlock(&sk->sk_receive_queue.lock);
 550
 551 drop_n_restore:
 552         if (skb_head != skb->data && skb_shared(skb)) {
 553                 skb->data = skb_head;
 554                 skb->len = skb_len;
 555         }
 556 drop:
 557         kfree_skb(skb);
 558         return 0;
 559 }
 560
 561 #ifdef CONFIG_PACKET_MMAP
 562 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 563 {
 564         struct sock *sk;
 565         struct packet_sock *po;
 566         struct sockaddr_ll *sll;
 567         struct tpacket_hdr *h;
 568         u8 * skb_head = skb->data;
 569         int skb_len = skb->len;
 570         unsigned snaplen;
 571         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
 572         unsigned short macoff, netoff;
 573         struct sk_buff *copy_skb = NULL;
 574
 575         if (skb->pkt_type == PACKET_LOOPBACK)
 576                 goto drop;
 577
 578         sk = pt->af_packet_priv;
 579         po = pkt_sk(sk);
 580
 581         if (dev->hard_header) {
 582                 if (sk->sk_type != SOCK_DGRAM)
 583                         skb_push(skb, skb->data - skb->mac.raw);
 584                 else if (skb->pkt_type == PACKET_OUTGOING) {
 585                         /* Special case: outgoing packets have ll header at head */
 586                         skb_pull(skb, skb->nh.raw - skb->data);
 587                         if (skb->ip_summed == CHECKSUM_PARTIAL)
 588                                 status |= TP_STATUS_CSUMNOTREADY;
 589                 }
 590         }
 591
 592         snaplen = skb->len;
 593
 594         if (run_filter(skb, sk, &snaplen) < 0)
 595                 goto drop_n_restore;
 596
 597         if (sk->sk_type == SOCK_DGRAM) {
 598                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
 599         } else {
 600                 unsigned maclen = skb->nh.raw - skb->data;
 601                 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
 602                 macoff = netoff - maclen;
 603         }
 604
 605         if (macoff + snaplen > po->frame_size) {
 606                 if (po->copy_thresh &&
 607                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
 608                     (unsigned)sk->sk_rcvbuf) {
 609                         if (skb_shared(skb)) {
 610                                 copy_skb = skb_clone(skb, GFP_ATOMIC);
 611                         } else {
 612                                 copy_skb = skb_get(skb);
 613                                 skb_head = skb->data;
 614                         }
 615                         if (copy_skb)
 616                                 skb_set_owner_r(copy_skb, sk);
 617                 }
 618                 snaplen = po->frame_size - macoff;
 619                 if ((int)snaplen < 0)
 620                         snaplen = 0;
 621         }
 622
 623         spin_lock(&sk->sk_receive_queue.lock);
 624         h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
 625
 626         if (h->tp_status)
 627                 goto ring_is_full;
 628         po->head = po->head != po->frame_max ? po->head+1 : 0;
 629         po->stats.tp_packets++;
 630         if (copy_skb) {
 631                 status |= TP_STATUS_COPY;
 632                 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
 633         }
 634         if (!po->stats.tp_drops)
 635                 status &= ~TP_STATUS_LOSING;
 636         spin_unlock(&sk->sk_receive_queue.lock);
 637
 638         skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 639
 640         h->tp_len = skb->len;
 641         h->tp_snaplen = snaplen;
 642         h->tp_mac = macoff;
 643         h->tp_net = netoff;
 644         if (skb->tstamp.off_sec == 0) {
 645                 __net_timestamp(skb);
 646                 sock_enable_timestamp(sk);
 647         }
 648         h->tp_sec = skb->tstamp.off_sec;
 649         h->tp_usec = skb->tstamp.off_usec;
 650
 651         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 652         sll->sll_halen = 0;
 653         if (dev->hard_header_parse)
 654                 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
 655         sll->sll_family = AF_PACKET;
 656         sll->sll_hatype = dev->type;
 657         sll->sll_protocol = skb->protocol;
 658         sll->sll_pkttype = skb->pkt_type;
 659         sll->sll_ifindex = dev->ifindex;
 660
 661         h->tp_status = status;
 662         mb();
 663
 664         {
 665                 struct page *p_start, *p_end;
 666                 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
 667
 668                 p_start = virt_to_page(h);
 669                 p_end = virt_to_page(h_end);
 670                 while (p_start <= p_end) {
 671                         flush_dcache_page(p_start);
 672                         p_start++;
 673                 }
 674         }
 675
 676         sk->sk_data_ready(sk, 0);
 677
 678 drop_n_restore:
 679         if (skb_head != skb->data && skb_shared(skb)) {
 680                 skb->data = skb_head;
 681                 skb->len = skb_len;
 682         }
 683 drop:
 684         kfree_skb(skb);
 685         return 0;
 686
 687 ring_is_full:
 688         po->stats.tp_drops++;
 689         spin_unlock(&sk->sk_receive_queue.lock);
 690
 691         sk->sk_data_ready(sk, 0);
 692         if (copy_skb)
 693                 kfree_skb(copy_skb);
 694         goto drop_n_restore;
 695 }
 696
 697 #endif
 698
 699
 700 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 701                           struct msghdr *msg, size_t len)
 702 {
 703         struct sock *sk = sock->sk;
 704         struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
 705         struct sk_buff *skb;
 706         struct net_device *dev;
 707         __be16 proto;
 708         unsigned char *addr;
 709         int ifindex, err, reserve = 0;
 710
 711         /*
 712          *      Get and verify the address.
 713          */
 714
 715         if (saddr == NULL) {
 716                 struct packet_sock *po = pkt_sk(sk);
 717
 718                 ifindex = po->ifindex;
 719                 proto   = po->num;
 720                 addr    = NULL;
 721         } else {
 722                 err = -EINVAL;
 723                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
 724                         goto out;
 725                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
 726                         goto out;
 727                 ifindex = saddr->sll_ifindex;
 728                 proto   = saddr->sll_protocol;
 729                 addr    = saddr->sll_addr;
 730         }
 731
 732
 733         dev = dev_get_by_index(ifindex);
 734         err = -ENXIO;
 735         if (dev == NULL)
 736                 goto out_unlock;
 737         if (sock->type == SOCK_RAW)
 738                 reserve = dev->hard_header_len;
 739
 740         err = -EMSGSIZE;
 741         if (len > dev->mtu+reserve)
 742                 goto out_unlock;
 743
 744         skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
 745                                 msg->msg_flags & MSG_DONTWAIT, &err);
 746         if (skb==NULL)
 747                 goto out_unlock;
 748
 749         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 750         skb->nh.raw = skb->data;
 751
 752         if (dev->hard_header) {
 753                 int res;
 754                 err = -EINVAL;
 755                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 756                 if (sock->type != SOCK_DGRAM) {
 757                         skb->tail = skb->data;
 758                         skb->len = 0;
 759                 } else if (res < 0)
 760                         goto out_free;
 761         }
 762
 763         /* Returns -EFAULT on error */
 764         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
 765         if (err)
 766                 goto out_free;
 767
 768         skb->protocol = proto;
 769         skb->dev = dev;
 770         skb->priority = sk->sk_priority;
 771
 772         err = -ENETDOWN;
 773         if (!(dev->flags & IFF_UP))
 774                 goto out_free;
 775
 776         /*
 777          *      Now send it
 778          */
 779
 780         err = dev_queue_xmit(skb);
 781         if (err > 0 && (err = net_xmit_errno(err)) != 0)
 782                 goto out_unlock;
 783
 784         dev_put(dev);
 785
 786         return(len);
 787
 788 out_free:
 789         kfree_skb(skb);
 790 out_unlock:
 791         if (dev)
 792                 dev_put(dev);
 793 out:
 794         return err;
 795 }
 796
 797 /*
 798  *      Close a PACKET socket. This is fairly simple. We immediately go
 799  *      to 'closed' state and remove our protocol entry in the device list.
 800  */
 801
 802 static int packet_release(struct socket *sock)
 803 {
 804         struct sock *sk = sock->sk;
 805         struct packet_sock *po;
 806
 807         if (!sk)
 808                 return 0;
 809
 810         po = pkt_sk(sk);
 811
 812         write_lock_bh(&packet_sklist_lock);
 813         sk_del_node_init(sk);
 814         write_unlock_bh(&packet_sklist_lock);
 815
 816         /*
 817          *      Unhook packet receive handler.
 818          */
 819
 820         if (po->running) {
 821                 /*
 822                  *      Remove the protocol hook
 823                  */
 824                 dev_remove_pack(&po->prot_hook);
 825                 po->running = 0;
 826                 po->num = 0;
 827                 __sock_put(sk);
 828         }
 829
 830 #ifdef CONFIG_PACKET_MULTICAST
 831         packet_flush_mclist(sk);
 832 #endif
 833
 834 #ifdef CONFIG_PACKET_MMAP
 835         if (po->pg_vec) {
 836                 struct tpacket_req req;
 837                 memset(&req, 0, sizeof(req));
 838                 packet_set_ring(sk, &req, 1);
 839         }
 840 #endif
 841
 842         /*
 843          *      Now the socket is dead. No more input will appear.
 844          */
 845
 846         sock_orphan(sk);
 847         sock->sk = NULL;
 848
 849         /* Purge queues */
 850
 851         skb_queue_purge(&sk->sk_receive_queue);
 852
 853         sock_put(sk);
 854         return 0;
 855 }
 856
 857 /*
 858  *      Attach a packet hook.
 859  */
 860
 861 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 862 {
 863         struct packet_sock *po = pkt_sk(sk);
 864         /*
 865          *      Detach an existing hook if present.
 866          */
 867
 868         lock_sock(sk);
 869
 870         spin_lock(&po->bind_lock);
 871         if (po->running) {
 872                 __sock_put(sk);
 873                 po->running = 0;
 874                 po->num = 0;
 875                 spin_unlock(&po->bind_lock);
 876                 dev_remove_pack(&po->prot_hook);
 877                 spin_lock(&po->bind_lock);
 878         }
 879
 880         po->num = protocol;
 881         po->prot_hook.type = protocol;
 882         po->prot_hook.dev = dev;
 883
 884         po->ifindex = dev ? dev->ifindex : 0;
 885
 886         if (protocol == 0)
 887                 goto out_unlock;
 888
 889         if (dev) {
 890                 if (dev->flags&IFF_UP) {
 891                         dev_add_pack(&po->prot_hook);
 892                         sock_hold(sk);
 893                         po->running = 1;
 894                 } else {
 895                         sk->sk_err = ENETDOWN;
 896                         if (!sock_flag(sk, SOCK_DEAD))
 897                                 sk->sk_error_report(sk);
 898                 }
 899         } else {
 900                 dev_add_pack(&po->prot_hook);
 901                 sock_hold(sk);
 902                 po->running = 1;
 903         }
 904
 905 out_unlock:
 906         spin_unlock(&po->bind_lock);
 907         release_sock(sk);
 908         return 0;
 909 }
 910
 911 /*
 912  *      Bind a packet socket to a device
 913  */
 914
 915 #ifdef CONFIG_SOCK_PACKET
 916
 917 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 918 {
 919         struct sock *sk=sock->sk;
 920         char name[15];
 921         struct net_device *dev;
 922         int err = -ENODEV;
 923
 924         /*
 925          *      Check legality
 926          */
 927
 928         if (addr_len != sizeof(struct sockaddr))
 929                 return -EINVAL;
 930         strlcpy(name,uaddr->sa_data,sizeof(name));
 931
 932         dev = dev_get_by_name(name);
 933         if (dev) {
 934                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
 935                 dev_put(dev);
 936         }
 937         return err;
 938 }
 939 #endif
 940
 941 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 942 {
 943         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
 944         struct sock *sk=sock->sk;
 945         struct net_device *dev = NULL;
 946         int err;
 947
 948
 949         /*
 950          *      Check legality
 951          */
 952
 953         if (addr_len < sizeof(struct sockaddr_ll))
 954                 return -EINVAL;
 955         if (sll->sll_family != AF_PACKET)
 956                 return -EINVAL;
 957
 958         if (sll->sll_ifindex) {
 959                 err = -ENODEV;
 960                 dev = dev_get_by_index(sll->sll_ifindex);
 961                 if (dev == NULL)
 962                         goto out;
 963         }
 964         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
 965         if (dev)
 966                 dev_put(dev);
 967
 968 out:
 969         return err;
 970 }
 971
 972 static struct proto packet_proto = {
 973         .name     = "PACKET",
 974         .owner    = THIS_MODULE,
 975         .obj_size = sizeof(struct packet_sock),
 976 };
 977
 978 /*
 979  *      Create a packet of type SOCK_PACKET.
 980  */
 981
 982 static int packet_create(struct socket *sock, int protocol)
 983 {
 984         struct sock *sk;
 985         struct packet_sock *po;
 986         __be16 proto = (__force __be16)protocol; /* weird, but documented */
 987         int err;
 988
 989         if (!capable(CAP_NET_RAW))
 990                 return -EPERM;
 991         if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
 992 #ifdef CONFIG_SOCK_PACKET
 993             && sock->type != SOCK_PACKET
 994 #endif
 995             )
 996                 return -ESOCKTNOSUPPORT;
 997
 998         sock->state = SS_UNCONNECTED;
 999
1000         err = -ENOBUFS;
1001         sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1002         if (sk == NULL)
1003                 goto out;
1004
1005         sock->ops = &packet_ops;
1006 #ifdef CONFIG_SOCK_PACKET
1007         if (sock->type == SOCK_PACKET)
1008                 sock->ops = &packet_ops_spkt;
1009 #endif
1010         sock_init_data(sock, sk);
1011
1012         po = pkt_sk(sk);
1013         sk->sk_family = PF_PACKET;
1014         po->num = proto;
1015
1016         sk->sk_destruct = packet_sock_destruct;
1017         atomic_inc(&packet_socks_nr);
1018
1019         /*
1020          *      Attach a protocol block
1021          */
1022
1023         spin_lock_init(&po->bind_lock);
1024         po->prot_hook.func = packet_rcv;
1025 #ifdef CONFIG_SOCK_PACKET
1026         if (sock->type == SOCK_PACKET)
1027                 po->prot_hook.func = packet_rcv_spkt;
1028 #endif
1029         po->prot_hook.af_packet_priv = sk;
1030
1031         if (proto) {
1032                 po->prot_hook.type = proto;
1033                 dev_add_pack(&po->prot_hook);
1034                 sock_hold(sk);
1035                 po->running = 1;
1036         }
1037
1038         write_lock_bh(&packet_sklist_lock);
1039         sk_add_node(sk, &packet_sklist);
1040         write_unlock_bh(&packet_sklist_lock);
1041         return(0);
1042 out:
1043         return err;
1044 }
1045
1046 /*
1047  *      Pull a packet from our receive queue and hand it to the user.
1048  *      If necessary we block.
1049  */
1050
1051 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1052                           struct msghdr *msg, size_t len, int flags)
1053 {
1054         struct sock *sk = sock->sk;
1055         struct sk_buff *skb;
1056         int copied, err;
1057         struct sockaddr_ll *sll;
1058
1059         err = -EINVAL;
1060         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1061                 goto out;
1062
1063 #if 0
1064         /* What error should we return now? EUNATTACH? */
1065         if (pkt_sk(sk)->ifindex < 0)
1066                 return -ENODEV;
1067 #endif
1068
1069         /*
1070          *      Call the generic datagram receiver. This handles all sorts
1071          *      of horrible races and re-entrancy so we can forget about it
1072          *      in the protocol layers.
1073          *
1074          *      Now it will return ENETDOWN, if device have just gone down,
1075          *      but then it will block.
1076          */
1077
1078         skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1079
1080         /*
1081          *      An error occurred so return it. Because skb_recv_datagram()
1082          *      handles the blocking we don't see and worry about blocking
1083          *      retries.
1084          */
1085
1086         if (skb == NULL)
1087                 goto out;
1088
1089         /*
1090          *      If the address length field is there to be filled in, we fill
1091          *      it in now.
1092          */
1093
1094         sll = (struct sockaddr_ll*)skb->cb;
1095         if (sock->type == SOCK_PACKET)
1096                 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1097         else
1098                 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1099
1100         /*
1101          *      You lose any data beyond the buffer you gave. If it worries a
1102          *      user program they can ask the device for its MTU anyway.
1103          */
1104
1105         copied = skb->len;
1106         if (copied > len)
1107         {
1108                 copied=len;
1109                 msg->msg_flags|=MSG_TRUNC;
1110         }
1111
1112         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1113         if (err)
1114                 goto out_free;
1115
1116         sock_recv_timestamp(msg, sk, skb);
1117
1118         if (msg->msg_name)
1119                 memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
1120
1121         /*
1122          *      Free or return the buffer as appropriate. Again this
1123          *      hides all the races and re-entrancy issues from us.
1124          */
1125         err = (flags&MSG_TRUNC) ? skb->len : copied;
1126
1127 out_free:
1128         skb_free_datagram(sk, skb);
1129 out:
1130         return err;
1131 }
1132
1133 #ifdef CONFIG_SOCK_PACKET
1134 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1135                                int *uaddr_len, int peer)
1136 {
1137         struct net_device *dev;
1138         struct sock *sk = sock->sk;
1139
1140         if (peer)
1141                 return -EOPNOTSUPP;
1142
1143         uaddr->sa_family = AF_PACKET;
1144         dev = dev_get_by_index(pkt_sk(sk)->ifindex);
1145         if (dev) {
1146                 strlcpy(uaddr->sa_data, dev->name, 15);
1147                 dev_put(dev);
1148         } else
1149                 memset(uaddr->sa_data, 0, 14);
1150         *uaddr_len = sizeof(*uaddr);
1151
1152         return 0;
1153 }
1154 #endif
1155
1156 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1157                           int *uaddr_len, int peer)
1158 {
1159         struct net_device *dev;
1160         struct sock *sk = sock->sk;
1161         struct packet_sock *po = pkt_sk(sk);
1162         struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1163
1164         if (peer)
1165                 return -EOPNOTSUPP;
1166
1167         sll->sll_family = AF_PACKET;
1168         sll->sll_ifindex = po->ifindex;
1169         sll->sll_protocol = po->num;
1170         dev = dev_get_by_index(po->ifindex);
1171         if (dev) {
1172                 sll->sll_hatype = dev->type;
1173                 sll->sll_halen = dev->addr_len;
1174                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1175                 dev_put(dev);
1176         } else {
1177                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
1178                 sll->sll_halen = 0;
1179         }
1180         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1181
1182         return 0;
1183 }
1184
1185 #ifdef CONFIG_PACKET_MULTICAST
1186 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1187 {
1188         switch (i->type) {
1189         case PACKET_MR_MULTICAST:
1190                 if (what > 0)
1191                         dev_mc_add(dev, i->addr, i->alen, 0);
1192                 else
1193                         dev_mc_delete(dev, i->addr, i->alen, 0);
1194                 break;
1195         case PACKET_MR_PROMISC:
1196                 dev_set_promiscuity(dev, what);
1197                 break;
1198         case PACKET_MR_ALLMULTI:
1199                 dev_set_allmulti(dev, what);
1200                 break;
1201         default:;
1202         }
1203 }
1204
1205 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1206 {
1207         for ( ; i; i=i->next) {
1208                 if (i->ifindex == dev->ifindex)
1209                         packet_dev_mc(dev, i, what);
1210         }
1211 }
1212
1213 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1214 {
1215         struct packet_sock *po = pkt_sk(sk);
1216         struct packet_mclist *ml, *i;
1217         struct net_device *dev;
1218         int err;
1219
1220         rtnl_lock();
1221
1222         err = -ENODEV;
1223         dev = __dev_get_by_index(mreq->mr_ifindex);
1224         if (!dev)
1225                 goto done;
1226
1227         err = -EINVAL;
1228         if (mreq->mr_alen > dev->addr_len)
1229                 goto done;
1230
1231         err = -ENOBUFS;
1232         i = kmalloc(sizeof(*i), GFP_KERNEL);
1233         if (i == NULL)
1234                 goto done;
1235
1236         err = 0;
1237         for (ml = po->mclist; ml; ml = ml->next) {
1238                 if (ml->ifindex == mreq->mr_ifindex &&
1239                     ml->type == mreq->mr_type &&
1240                     ml->alen == mreq->mr_alen &&
1241                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1242                         ml->count++;
1243                         /* Free the new element ... */
1244                         kfree(i);
1245                         goto done;
1246                 }
1247         }
1248
1249         i->type = mreq->mr_type;
1250         i->ifindex = mreq->mr_ifindex;
1251         i->alen = mreq->mr_alen;
1252         memcpy(i->addr, mreq->mr_address, i->alen);
1253         i->count = 1;
1254         i->next = po->mclist;
1255         po->mclist = i;
1256         packet_dev_mc(dev, i, +1);
1257
1258 done:
1259         rtnl_unlock();
1260         return err;
1261 }
1262
1263 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1264 {
1265         struct packet_mclist *ml, **mlp;
1266
1267         rtnl_lock();
1268
1269         for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1270                 if (ml->ifindex == mreq->mr_ifindex &&
1271                     ml->type == mreq->mr_type &&
1272                     ml->alen == mreq->mr_alen &&
1273                     memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1274                         if (--ml->count == 0) {
1275                                 struct net_device *dev;
1276                                 *mlp = ml->next;
1277                                 dev = dev_get_by_index(ml->ifindex);
1278                                 if (dev) {
1279                                         packet_dev_mc(dev, ml, -1);
1280                                         dev_put(dev);
1281                                 }
1282                                 kfree(ml);
1283                         }
1284                         rtnl_unlock();
1285                         return 0;
1286                 }
1287         }
1288         rtnl_unlock();
1289         return -EADDRNOTAVAIL;
1290 }
1291
1292 static void packet_flush_mclist(struct sock *sk)
1293 {
1294         struct packet_sock *po = pkt_sk(sk);
1295         struct packet_mclist *ml;
1296
1297         if (!po->mclist)
1298                 return;
1299
1300         rtnl_lock();
1301         while ((ml = po->mclist) != NULL) {
1302                 struct net_device *dev;
1303
1304                 po->mclist = ml->next;
1305                 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) {
1306                         packet_dev_mc(dev, ml, -1);
1307                         dev_put(dev);
1308                 }
1309                 kfree(ml);
1310         }
1311         rtnl_unlock();
1312 }
1313 #endif
1314
1315 static int
1316 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1317 {
1318         struct sock *sk = sock->sk;
1319         int ret;
1320
1321         if (level != SOL_PACKET)
1322                 return -ENOPROTOOPT;
1323
1324         switch(optname) {
1325 #ifdef CONFIG_PACKET_MULTICAST
1326         case PACKET_ADD_MEMBERSHIP:
1327         case PACKET_DROP_MEMBERSHIP:
1328         {
1329                 struct packet_mreq_max mreq;
1330                 int len = optlen;
1331                 memset(&mreq, 0, sizeof(mreq));
1332                 if (len < sizeof(struct packet_mreq))
1333                         return -EINVAL;
1334                 if (len > sizeof(mreq))
1335                         len = sizeof(mreq);
1336                 if (copy_from_user(&mreq,optval,len))
1337                         return -EFAULT;
1338                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1339                         return -EINVAL;
1340                 if (optname == PACKET_ADD_MEMBERSHIP)
1341                         ret = packet_mc_add(sk, &mreq);
1342                 else
1343                         ret = packet_mc_drop(sk, &mreq);
1344                 return ret;
1345         }
1346 #endif
1347 #ifdef CONFIG_PACKET_MMAP
1348         case PACKET_RX_RING:
1349         {
1350                 struct tpacket_req req;
1351
1352                 if (optlen<sizeof(req))
1353                         return -EINVAL;
1354                 if (copy_from_user(&req,optval,sizeof(req)))
1355                         return -EFAULT;
1356                 return packet_set_ring(sk, &req, 0);
1357         }
1358         case PACKET_COPY_THRESH:
1359         {
1360                 int val;
1361
1362                 if (optlen!=sizeof(val))
1363                         return -EINVAL;
1364                 if (copy_from_user(&val,optval,sizeof(val)))
1365                         return -EFAULT;
1366
1367                 pkt_sk(sk)->copy_thresh = val;
1368                 return 0;
1369         }
1370 #endif
1371         default:
1372                 return -ENOPROTOOPT;
1373         }
1374 }
1375
1376 static int packet_getsockopt(struct socket *sock, int level, int optname,
1377                              char __user *optval, int __user *optlen)
1378 {
1379         int len;
1380         struct sock *sk = sock->sk;
1381         struct packet_sock *po = pkt_sk(sk);
1382
1383         if (level != SOL_PACKET)
1384                 return -ENOPROTOOPT;
1385
1386         if (get_user(len, optlen))
1387                 return -EFAULT;
1388
1389         if (len < 0)
1390                 return -EINVAL;
1391
1392         switch(optname) {
1393         case PACKET_STATISTICS:
1394         {
1395                 struct tpacket_stats st;
1396
1397                 if (len > sizeof(struct tpacket_stats))
1398                         len = sizeof(struct tpacket_stats);
1399                 spin_lock_bh(&sk->sk_receive_queue.lock);
1400                 st = po->stats;
1401                 memset(&po->stats, 0, sizeof(st));
1402                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1403                 st.tp_packets += st.tp_drops;
1404
1405                 if (copy_to_user(optval, &st, len))
1406                         return -EFAULT;
1407                 break;
1408         }
1409         default:
1410                 return -ENOPROTOOPT;
1411         }
1412
1413         if (put_user(len, optlen))
1414                 return -EFAULT;
1415         return 0;
1416 }
1417
1418
1419 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1420 {
1421         struct sock *sk;
1422         struct hlist_node *node;
1423         struct net_device *dev = (struct net_device*)data;
1424
1425         read_lock(&packet_sklist_lock);
1426         sk_for_each(sk, node, &packet_sklist) {
1427                 struct packet_sock *po = pkt_sk(sk);
1428
1429                 switch (msg) {
1430                 case NETDEV_UNREGISTER:
1431 #ifdef CONFIG_PACKET_MULTICAST
1432                         if (po->mclist)
1433                                 packet_dev_mclist(dev, po->mclist, -1);
1434                         // fallthrough
1435 #endif
1436                 case NETDEV_DOWN:
1437                         if (dev->ifindex == po->ifindex) {
1438                                 spin_lock(&po->bind_lock);
1439                                 if (po->running) {
1440                                         __dev_remove_pack(&po->prot_hook);
1441                                         __sock_put(sk);
1442                                         po->running = 0;
1443                                         sk->sk_err = ENETDOWN;
1444                                         if (!sock_flag(sk, SOCK_DEAD))
1445                                                 sk->sk_error_report(sk);
1446                                 }
1447                                 if (msg == NETDEV_UNREGISTER) {
1448                                         po->ifindex = -1;
1449                                         po->prot_hook.dev = NULL;
1450                                 }
1451                                 spin_unlock(&po->bind_lock);
1452                         }
1453                         break;
1454                 case NETDEV_UP:
1455                         spin_lock(&po->bind_lock);
1456                         if (dev->ifindex == po->ifindex && po->num &&
1457                             !po->running) {
1458                                 dev_add_pack(&po->prot_hook);
1459                                 sock_hold(sk);
1460                                 po->running = 1;
1461                         }
1462                         spin_unlock(&po->bind_lock);
1463                         break;
1464                 }
1465         }
1466         read_unlock(&packet_sklist_lock);
1467         return NOTIFY_DONE;
1468 }
1469
1470
1471 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1472                         unsigned long arg)
1473 {
1474         struct sock *sk = sock->sk;
1475
1476         switch(cmd) {
1477                 case SIOCOUTQ:
1478                 {
1479                         int amount = atomic_read(&sk->sk_wmem_alloc);
1480                         return put_user(amount, (int __user *)arg);
1481                 }
1482                 case SIOCINQ:
1483                 {
1484                         struct sk_buff *skb;
1485                         int amount = 0;
1486
1487                         spin_lock_bh(&sk->sk_receive_queue.lock);
1488                         skb = skb_peek(&sk->sk_receive_queue);
1489                         if (skb)
1490                                 amount = skb->len;
1491                         spin_unlock_bh(&sk->sk_receive_queue.lock);
1492                         return put_user(amount, (int __user *)arg);
1493                 }
1494                 case SIOCGSTAMP:
1495                         return sock_get_timestamp(sk, (struct timeval __user *)arg);
1496
1497 #ifdef CONFIG_INET
1498                 case SIOCADDRT:
1499                 case SIOCDELRT:
1500                 case SIOCDARP:
1501                 case SIOCGARP:
1502                 case SIOCSARP:
1503                 case SIOCGIFADDR:
1504                 case SIOCSIFADDR:
1505                 case SIOCGIFBRDADDR:
1506                 case SIOCSIFBRDADDR:
1507                 case SIOCGIFNETMASK:
1508                 case SIOCSIFNETMASK:
1509                 case SIOCGIFDSTADDR:
1510                 case SIOCSIFDSTADDR:
1511                 case SIOCSIFFLAGS:
1512                         return inet_dgram_ops.ioctl(sock, cmd, arg);
1513 #endif
1514
1515                 default:
1516                         return -ENOIOCTLCMD;
1517         }
1518         return 0;
1519 }
1520
1521 #ifndef CONFIG_PACKET_MMAP
1522 #define packet_mmap sock_no_mmap
1523 #define packet_poll datagram_poll
1524 #else
1525
1526 static unsigned int packet_poll(struct file * file, struct socket *sock,
1527                                 poll_table *wait)
1528 {
1529         struct sock *sk = sock->sk;
1530         struct packet_sock *po = pkt_sk(sk);
1531         unsigned int mask = datagram_poll(file, sock, wait);
1532
1533         spin_lock_bh(&sk->sk_receive_queue.lock);
1534         if (po->pg_vec) {
1535                 unsigned last = po->head ? po->head-1 : po->frame_max;
1536                 struct tpacket_hdr *h;
1537
1538                 h = (struct tpacket_hdr *)packet_lookup_frame(po, last);
1539
1540                 if (h->tp_status)
1541                         mask |= POLLIN | POLLRDNORM;
1542         }
1543         spin_unlock_bh(&sk->sk_receive_queue.lock);
1544         return mask;
1545 }
1546
1547
1548 /* Dirty? Well, I still did not learn better way to account
1549  * for user mmaps.
1550  */
1551
1552 static void packet_mm_open(struct vm_area_struct *vma)
1553 {
1554         struct file *file = vma->vm_file;
1555         struct socket * sock = file->private_data;
1556         struct sock *sk = sock->sk;
1557
1558         if (sk)
1559                 atomic_inc(&pkt_sk(sk)->mapped);
1560 }
1561
1562 static void packet_mm_close(struct vm_area_struct *vma)
1563 {
1564         struct file *file = vma->vm_file;
1565         struct socket * sock = file->private_data;
1566         struct sock *sk = sock->sk;
1567
1568         if (sk)
1569                 atomic_dec(&pkt_sk(sk)->mapped);
1570 }
1571
1572 static struct vm_operations_struct packet_mmap_ops = {
1573         .open = packet_mm_open,
1574         .close =packet_mm_close,
1575 };
1576
1577 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1578 {
1579         return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1580 }
1581
1582 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1583 {
1584         int i;
1585
1586         for (i = 0; i < len; i++) {
1587                 if (likely(pg_vec[i]))
1588                         free_pages((unsigned long) pg_vec[i], order);
1589         }
1590         kfree(pg_vec);
1591 }
1592
1593 static inline char *alloc_one_pg_vec_page(unsigned long order)
1594 {
1595         return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1596                                          order);
1597 }
1598
1599 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1600 {
1601         unsigned int block_nr = req->tp_block_nr;
1602         char **pg_vec;
1603         int i;
1604
1605         pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1606         if (unlikely(!pg_vec))
1607                 goto out;
1608
1609         for (i = 0; i < block_nr; i++) {
1610                 pg_vec[i] = alloc_one_pg_vec_page(order);
1611                 if (unlikely(!pg_vec[i]))
1612                         goto out_free_pgvec;
1613         }
1614
1615 out:
1616         return pg_vec;
1617
1618 out_free_pgvec:
1619         free_pg_vec(pg_vec, order, block_nr);
1620         pg_vec = NULL;
1621         goto out;
1622 }
1623
1624 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1625 {
1626         char **pg_vec = NULL;
1627         struct packet_sock *po = pkt_sk(sk);
1628         int was_running, order = 0;
1629         __be16 num;
1630         int err = 0;
1631
1632         if (req->tp_block_nr) {
1633                 int i, l;
1634
1635                 /* Sanity tests and some calculations */
1636
1637                 if (unlikely(po->pg_vec))
1638                         return -EBUSY;
1639
1640                 if (unlikely((int)req->tp_block_size <= 0))
1641                         return -EINVAL;
1642                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1643                         return -EINVAL;
1644                 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1645                         return -EINVAL;
1646                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1647                         return -EINVAL;
1648
1649                 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1650                 if (unlikely(po->frames_per_block <= 0))
1651                         return -EINVAL;
1652                 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1653                              req->tp_frame_nr))
1654                         return -EINVAL;
1655
1656                 err = -ENOMEM;
1657                 order = get_order(req->tp_block_size);
1658                 pg_vec = alloc_pg_vec(req, order);
1659                 if (unlikely(!pg_vec))
1660                         goto out;
1661
1662                 l = 0;
1663                 for (i = 0; i < req->tp_block_nr; i++) {
1664                         char *ptr = pg_vec[i];
1665                         struct tpacket_hdr *header;
1666                         int k;
1667
1668                         for (k = 0; k < po->frames_per_block; k++) {
1669                                 header = (struct tpacket_hdr *) ptr;
1670                                 header->tp_status = TP_STATUS_KERNEL;
1671                                 ptr += req->tp_frame_size;
1672                         }
1673                 }
1674                 /* Done */
1675         } else {
1676                 if (unlikely(req->tp_frame_nr))
1677                         return -EINVAL;
1678         }
1679
1680         lock_sock(sk);
1681
1682         /* Detach socket from network */
1683         spin_lock(&po->bind_lock);
1684         was_running = po->running;
1685         num = po->num;
1686         if (was_running) {
1687                 __dev_remove_pack(&po->prot_hook);
1688                 po->num = 0;
1689                 po->running = 0;
1690                 __sock_put(sk);
1691         }
1692         spin_unlock(&po->bind_lock);
1693
1694         synchronize_net();
1695
1696         err = -EBUSY;
1697         if (closing || atomic_read(&po->mapped) == 0) {
1698                 err = 0;
1699 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1700
1701                 spin_lock_bh(&sk->sk_receive_queue.lock);
1702                 pg_vec = XC(po->pg_vec, pg_vec);
1703                 po->frame_max = (req->tp_frame_nr - 1);
1704                 po->head = 0;
1705                 po->frame_size = req->tp_frame_size;
1706                 spin_unlock_bh(&sk->sk_receive_queue.lock);
1707
1708                 order = XC(po->pg_vec_order, order);
1709                 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1710
1711                 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1712                 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1713                 skb_queue_purge(&sk->sk_receive_queue);
1714 #undef XC
1715                 if (atomic_read(&po->mapped))
1716                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1717         }
1718
1719         spin_lock(&po->bind_lock);
1720         if (was_running && !po->running) {
1721                 sock_hold(sk);
1722                 po->running = 1;
1723                 po->num = num;
1724                 dev_add_pack(&po->prot_hook);
1725         }
1726         spin_unlock(&po->bind_lock);
1727
1728         release_sock(sk);
1729
1730         if (pg_vec)
1731                 free_pg_vec(pg_vec, order, req->tp_block_nr);
1732 out:
1733         return err;
1734 }
1735
1736 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1737 {
1738         struct sock *sk = sock->sk;
1739         struct packet_sock *po = pkt_sk(sk);
1740         unsigned long size;
1741         unsigned long start;
1742         int err = -EINVAL;
1743         int i;
1744
1745         if (vma->vm_pgoff)
1746                 return -EINVAL;
1747
1748         size = vma->vm_end - vma->vm_start;
1749
1750         lock_sock(sk);
1751         if (po->pg_vec == NULL)
1752                 goto out;
1753         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1754                 goto out;
1755
1756         start = vma->vm_start;
1757         for (i = 0; i < po->pg_vec_len; i++) {
1758                 struct page *page = virt_to_page(po->pg_vec[i]);
1759                 int pg_num;
1760
1761                 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1762                         err = vm_insert_page(vma, start, page);
1763                         if (unlikely(err))
1764                                 goto out;
1765                         start += PAGE_SIZE;
1766                 }
1767         }
1768         atomic_inc(&po->mapped);
1769         vma->vm_ops = &packet_mmap_ops;
1770         err = 0;
1771
1772 out:
1773         release_sock(sk);
1774         return err;
1775 }
1776 #endif
1777
1778
1779 #ifdef CONFIG_SOCK_PACKET
1780 static const struct proto_ops packet_ops_spkt = {
1781         .family =       PF_PACKET,
1782         .owner =        THIS_MODULE,
1783         .release =      packet_release,
1784         .bind =         packet_bind_spkt,
1785         .connect =      sock_no_connect,
1786         .socketpair =   sock_no_socketpair,
1787         .accept =       sock_no_accept,
1788         .getname =      packet_getname_spkt,
1789         .poll =         datagram_poll,
1790         .ioctl =        packet_ioctl,
1791         .listen =       sock_no_listen,
1792         .shutdown =     sock_no_shutdown,
1793         .setsockopt =   sock_no_setsockopt,
1794         .getsockopt =   sock_no_getsockopt,
1795         .sendmsg =      packet_sendmsg_spkt,
1796         .recvmsg =      packet_recvmsg,
1797         .mmap =         sock_no_mmap,
1798         .sendpage =     sock_no_sendpage,
1799 };
1800 #endif
1801
1802 static const struct proto_ops packet_ops = {
1803         .family =       PF_PACKET,
1804         .owner =        THIS_MODULE,
1805         .release =      packet_release,
1806         .bind =         packet_bind,
1807         .connect =      sock_no_connect,
1808         .socketpair =   sock_no_socketpair,
1809         .accept =       sock_no_accept,
1810         .getname =      packet_getname,
1811         .poll =         packet_poll,
1812         .ioctl =        packet_ioctl,
1813         .listen =       sock_no_listen,
1814         .shutdown =     sock_no_shutdown,
1815         .setsockopt =   packet_setsockopt,
1816         .getsockopt =   packet_getsockopt,
1817         .sendmsg =      packet_sendmsg,
1818         .recvmsg =      packet_recvmsg,
1819         .mmap =         packet_mmap,
1820         .sendpage =     sock_no_sendpage,
1821 };
1822
1823 static struct net_proto_family packet_family_ops = {
1824         .family =       PF_PACKET,
1825         .create =       packet_create,
1826         .owner  =       THIS_MODULE,
1827 };
1828
1829 static struct notifier_block packet_netdev_notifier = {
1830         .notifier_call =packet_notifier,
1831 };
1832
1833 #ifdef CONFIG_PROC_FS
1834 static inline struct sock *packet_seq_idx(loff_t off)
1835 {
1836         struct sock *s;
1837         struct hlist_node *node;
1838
1839         sk_for_each(s, node, &packet_sklist) {
1840                 if (!off--)
1841                         return s;
1842         }
1843         return NULL;
1844 }
1845
1846 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1847 {
1848         read_lock(&packet_sklist_lock);
1849         return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1850 }
1851
1852 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1853 {
1854         ++*pos;
1855         return  (v == SEQ_START_TOKEN)
1856                 ? sk_head(&packet_sklist)
1857                 : sk_next((struct sock*)v) ;
1858 }
1859
1860 static void packet_seq_stop(struct seq_file *seq, void *v)
1861 {
1862         read_unlock(&packet_sklist_lock);
1863 }
1864
1865 static int packet_seq_show(struct seq_file *seq, void *v)
1866 {
1867         if (v == SEQ_START_TOKEN)
1868                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
1869         else {
1870                 struct sock *s = v;
1871                 const struct packet_sock *po = pkt_sk(s);
1872
1873                 seq_printf(seq,
1874                            "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
1875                            s,
1876                            atomic_read(&s->sk_refcnt),
1877                            s->sk_type,
1878                            ntohs(po->num),
1879                            po->ifindex,
1880                            po->running,
1881                            atomic_read(&s->sk_rmem_alloc),
1882                            sock_i_uid(s),
1883                            sock_i_ino(s) );
1884         }
1885
1886         return 0;
1887 }
1888
1889 static struct seq_operations packet_seq_ops = {
1890         .start  = packet_seq_start,
1891         .next   = packet_seq_next,
1892         .stop   = packet_seq_stop,
1893         .show   = packet_seq_show,
1894 };
1895
1896 static int packet_seq_open(struct inode *inode, struct file *file)
1897 {
1898         return seq_open(file, &packet_seq_ops);
1899 }
1900
1901 static struct file_operations packet_seq_fops = {
1902         .owner          = THIS_MODULE,
1903         .open           = packet_seq_open,
1904         .read           = seq_read,
1905         .llseek         = seq_lseek,
1906         .release        = seq_release,
1907 };
1908
1909 #endif
1910
1911 static void __exit packet_exit(void)
1912 {
1913         proc_net_remove("packet");
1914         unregister_netdevice_notifier(&packet_netdev_notifier);
1915         sock_unregister(PF_PACKET);
1916         proto_unregister(&packet_proto);
1917 }
1918
1919 static int __init packet_init(void)
1920 {
1921         int rc = proto_register(&packet_proto, 0);
1922
1923         if (rc != 0)
1924                 goto out;
1925
1926         sock_register(&packet_family_ops);
1927         register_netdevice_notifier(&packet_netdev_notifier);
1928         proc_net_fops_create("packet", 0, &packet_seq_fops);
1929 out:
1930         return rc;
1931 }
1932
1933 module_init(packet_init);
1934 module_exit(packet_exit);
1935 MODULE_LICENSE("GPL");
1936 MODULE_ALIAS_NETPROTO(PF_PACKET);