1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * PACKET - implements raw packet sockets. 7 * 8 * Version: $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $ 9 * 10 * Authors: Ross Biro 11 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG> 12 * Alan Cox, <gw4pts@gw4pts.ampr.org> 13 * 14 * Fixes: 15 * Alan Cox : verify_area() now used correctly 16 * Alan Cox : new skbuff lists, look ma no backlogs! 17 * Alan Cox : tidied skbuff lists. 18 * Alan Cox : Now uses generic datagram routines I 19 * added. Also fixed the peek/read crash 20 * from all old Linux datagram code. 21 * Alan Cox : Uses the improved datagram code. 22 * Alan Cox : Added NULL's for socket options. 23 * Alan Cox : Re-commented the code. 24 * Alan Cox : Use new kernel side addressing 25 * Rob Janssen : Correct MTU usage. 26 * Dave Platt : Counter leaks caused by incorrect 27 * interrupt locking and some slightly 28 * dubious gcc output. Can you read 29 * compiler: it said _VOLATILE_ 30 * Richard Kooijman : Timestamp fixes. 31 * Alan Cox : New buffers. Use sk->mac.raw. 32 * Alan Cox : sendmsg/recvmsg support. 33 * Alan Cox : Protocol setting support 34 * Alexey Kuznetsov : Untied from IPv4 stack. 35 * Cyrus Durgin : Fixed kerneld for kmod. 36 * Michal Ostrowski : Module initialization cleanup. 37 * Ulises Alonso : Frame number limit removal and 38 * packet_set_ring memory leak. 39 * Eric Biederman : Allow for > 8 byte hardware addresses. 40 * The convention is that longer addresses 41 * will simply extend the hardware address 42 * byte arrays at the end of sockaddr_ll 43 * and packet_mreq. 44 * 45 * This program is free software; you can redistribute it and/or 46 * modify it under the terms of the GNU General Public License 47 * as published by the Free Software Foundation; either version 48 * 2 of the License, or (at your option) any later version. 49 * 50 */ 51 52 #include <linux/config.h> 53 #include <linux/types.h> 54 #include <linux/sched.h> 55 #include <linux/mm.h> 56 #include <linux/fcntl.h> 57 #include <linux/socket.h> 58 #include <linux/in.h> 59 #include <linux/inet.h> 60 #include <linux/netdevice.h> 61 #include <linux/if_packet.h> 62 #include <linux/wireless.h> 63 #include <linux/kmod.h> 64 #include <net/ip.h> 65 #include <net/protocol.h> 66 #include <linux/skbuff.h> 67 #include <net/sock.h> 68 #include <linux/errno.h> 69 #include <linux/timer.h> 70 #include <asm/system.h> 71 #include <asm/uaccess.h> 72 #include <asm/ioctls.h> 73 #include <asm/page.h> 74 #include <asm/io.h> 75 #include <linux/proc_fs.h> 76 #include <linux/seq_file.h> 77 #include <linux/poll.h> 78 #include <linux/module.h> 79 #include <linux/init.h> 80 81 #ifdef CONFIG_INET 82 #include <net/inet_common.h> 83 #endif 84 85 #define CONFIG_SOCK_PACKET 1 86 87 /* 88 Proposed replacement for SIOC{ADD,DEL}MULTI and 89 IFF_PROMISC, IFF_ALLMULTI flags. 90 91 It is more expensive, but I believe, 92 it is really correct solution: reentereble, safe and fault tolerant. 93 94 IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping 95 reference count and global flag, so that real status is 96 (gflag|(count != 0)), so that we can use obsolete faulty interface 97 not harming clever users. 98 */ 99 #define CONFIG_PACKET_MULTICAST 1 100 101 /* 102 Assumptions: 103 - if device has no dev->hard_header routine, it adds and removes ll header 104 inside itself. In this case ll header is invisible outside of device, 105 but higher levels still should reserve dev->hard_header_len. 106 Some devices are enough clever to reallocate skb, when header 107 will not fit to reserved space (tunnel), another ones are silly 108 (PPP). 109 - packet socket receives packets with pulled ll header, 110 so that SOCK_RAW should push it back. 111 112 On receive: 113 ----------- 114 115 Incoming, dev->hard_header!=NULL 116 mac.raw -> ll header 117 data -> data 118 119 Outgoing, dev->hard_header!=NULL 120 mac.raw -> ll header 121 data -> ll header 122 123 Incoming, dev->hard_header==NULL 124 mac.raw -> UNKNOWN position. It is very likely, that it points to ll header. 125 PPP makes it, that is wrong, because introduce assymetry 126 between rx and tx paths. 127 data -> data 128 129 Outgoing, dev->hard_header==NULL 130 mac.raw -> data. ll header is still not built! 131 data -> data 132 133 Resume 134 If dev->hard_header==NULL we are unlikely to restore sensible ll header. 135 136 137 On transmit: 138 ------------ 139 140 dev->hard_header != NULL 141 mac.raw -> ll header 142 data -> ll header 143 144 dev->hard_header == NULL (ll header is added by device, we cannot control it) 145 mac.raw -> data 146 data -> data 147 148 We should set nh.raw on output to correct posistion, 149 packet classifier depends on it. 150 */ 151 152 /* List of all packet sockets. */ 153 static HLIST_HEAD(packet_sklist); 154 static DEFINE_RWLOCK(packet_sklist_lock); 155 156 static atomic_t packet_socks_nr; 157 158 159 /* Private packet socket structures. */ 160 161 #ifdef CONFIG_PACKET_MULTICAST 162 struct packet_mclist 163 { 164 struct packet_mclist *next; 165 int ifindex; 166 int count; 167 unsigned short type; 168 unsigned short alen; 169 unsigned char addr[MAX_ADDR_LEN]; 170 }; 171 /* identical to struct packet_mreq except it has 172 * a longer address field. 173 */ 174 struct packet_mreq_max 175 { 176 int mr_ifindex; 177 unsigned short mr_type; 178 unsigned short mr_alen; 179 unsigned char mr_address[MAX_ADDR_LEN]; 180 }; 181 #endif 182 #ifdef CONFIG_PACKET_MMAP 183 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing); 184 #endif 185 186 static void packet_flush_mclist(struct sock *sk); 187 188 struct packet_sock { 189 /* struct sock has to be the first member of packet_sock */ 190 struct sock sk; 191 struct tpacket_stats stats; 192 #ifdef CONFIG_PACKET_MMAP 193 char * *pg_vec; 194 unsigned int head; 195 unsigned int frames_per_block; 196 unsigned int frame_size; 197 unsigned int frame_max; 198 int copy_thresh; 199 #endif 200 struct packet_type prot_hook; 201 spinlock_t bind_lock; 202 char running; /* prot_hook is attached*/ 203 int ifindex; /* bound device */ 204 unsigned short num; 205 #ifdef CONFIG_PACKET_MULTICAST 206 struct packet_mclist *mclist; 207 #endif 208 #ifdef CONFIG_PACKET_MMAP 209 atomic_t mapped; 210 unsigned int pg_vec_order; 211 unsigned int pg_vec_pages; 212 unsigned int pg_vec_len; 213 #endif 214 }; 215 216 #ifdef CONFIG_PACKET_MMAP 217 218 static inline char *packet_lookup_frame(struct packet_sock *po, unsigned int position) 219 { 220 unsigned int pg_vec_pos, frame_offset; 221 char *frame; 222 223 pg_vec_pos = position / po->frames_per_block; 224 frame_offset = position % po->frames_per_block; 225 226 frame = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size); 227 228 return frame; 229 } 230 #endif 231 232 static inline struct packet_sock *pkt_sk(struct sock *sk) 233 { 234 return (struct packet_sock *)sk; 235 } 236 237 static void packet_sock_destruct(struct sock *sk) 238 { 239 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc)); 240 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 241 242 if (!sock_flag(sk, SOCK_DEAD)) { 243 printk("Attempt to release alive packet socket: %p\n", sk); 244 return; 245 } 246 247 atomic_dec(&packet_socks_nr); 248 #ifdef PACKET_REFCNT_DEBUG 249 printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr)); 250 #endif 251 } 252 253 254 static const struct proto_ops packet_ops; 255 256 #ifdef CONFIG_SOCK_PACKET 257 static const struct proto_ops packet_ops_spkt; 258 259 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 260 { 261 struct sock *sk; 262 struct sockaddr_pkt *spkt; 263 264 /* 265 * When we registered the protocol we saved the socket in the data 266 * field for just this event. 267 */ 268 269 sk = pt->af_packet_priv; 270 271 /* 272 * Yank back the headers [hope the device set this 273 * right or kerboom...] 274 * 275 * Incoming packets have ll header pulled, 276 * push it back. 277 * 278 * For outgoing ones skb->data == skb->mac.raw 279 * so that this procedure is noop. 280 */ 281 282 if (skb->pkt_type == PACKET_LOOPBACK) 283 goto out; 284 285 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) 286 goto oom; 287 288 /* drop any routing info */ 289 dst_release(skb->dst); 290 skb->dst = NULL; 291 292 /* drop conntrack reference */ 293 nf_reset(skb); 294 295 spkt = (struct sockaddr_pkt*)skb->cb; 296 297 skb_push(skb, skb->data-skb->mac.raw); 298 299 /* 300 * The SOCK_PACKET socket receives _all_ frames. 301 */ 302 303 spkt->spkt_family = dev->type; 304 strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); 305 spkt->spkt_protocol = skb->protocol; 306 307 /* 308 * Charge the memory to the socket. This is done specifically 309 * to prevent sockets using all the memory up. 310 */ 311 312 if (sock_queue_rcv_skb(sk,skb) == 0) 313 return 0; 314 315 out: 316 kfree_skb(skb); 317 oom: 318 return 0; 319 } 320 321 322 /* 323 * Output a raw packet to a device layer. This bypasses all the other 324 * protocol layers and you must therefore supply it with a complete frame 325 */ 326 327 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock, 328 struct msghdr *msg, size_t len) 329 { 330 struct sock *sk = sock->sk; 331 struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name; 332 struct sk_buff *skb; 333 struct net_device *dev; 334 unsigned short proto=0; 335 int err; 336 337 /* 338 * Get and verify the address. 339 */ 340 341 if (saddr) 342 { 343 if (msg->msg_namelen < sizeof(struct sockaddr)) 344 return(-EINVAL); 345 if (msg->msg_namelen==sizeof(struct sockaddr_pkt)) 346 proto=saddr->spkt_protocol; 347 } 348 else 349 return(-ENOTCONN); /* SOCK_PACKET must be sent giving an address */ 350 351 /* 352 * Find the device first to size check it 353 */ 354 355 saddr->spkt_device[13] = 0; 356 dev = dev_get_by_name(saddr->spkt_device); 357 err = -ENODEV; 358 if (dev == NULL) 359 goto out_unlock; 360 361 /* 362 * You may not queue a frame bigger than the mtu. This is the lowest level 363 * raw protocol and you must do your own fragmentation at this level. 364 */ 365 366 err = -EMSGSIZE; 367 if(len>dev->mtu+dev->hard_header_len) 368 goto out_unlock; 369 370 err = -ENOBUFS; 371 skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL); 372 373 /* 374 * If the write buffer is full, then tough. At this level the user gets to 375 * deal with the problem - do your own algorithmic backoffs. That's far 376 * more flexible. 377 */ 378 379 if (skb == NULL) 380 goto out_unlock; 381 382 /* 383 * Fill it in 384 */ 385 386 /* FIXME: Save some space for broken drivers that write a 387 * hard header at transmission time by themselves. PPP is the 388 * notable one here. This should really be fixed at the driver level. 389 */ 390 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 391 skb->nh.raw = skb->data; 392 393 /* Try to align data part correctly */ 394 if (dev->hard_header) { 395 skb->data -= dev->hard_header_len; 396 skb->tail -= dev->hard_header_len; 397 if (len < dev->hard_header_len) 398 skb->nh.raw = skb->data; 399 } 400 401 /* Returns -EFAULT on error */ 402 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 403 skb->protocol = proto; 404 skb->dev = dev; 405 skb->priority = sk->sk_priority; 406 if (err) 407 goto out_free; 408 409 err = -ENETDOWN; 410 if (!(dev->flags & IFF_UP)) 411 goto out_free; 412 413 /* 414 * Now send it 415 */ 416 417 dev_queue_xmit(skb); 418 dev_put(dev); 419 return(len); 420 421 out_free: 422 kfree_skb(skb); 423 out_unlock: 424 if (dev) 425 dev_put(dev); 426 return err; 427 } 428 #endif 429 430 static inline unsigned run_filter(struct sk_buff *skb, struct sock *sk, unsigned res) 431 { 432 struct sk_filter *filter; 433 434 bh_lock_sock(sk); 435 filter = sk->sk_filter; 436 /* 437 * Our caller already checked that filter != NULL but we need to 438 * verify that under bh_lock_sock() to be safe 439 */ 440 if (likely(filter != NULL)) 441 res = sk_run_filter(skb, filter->insns, filter->len); 442 bh_unlock_sock(sk); 443 444 return res; 445 } 446 447 /* 448 This function makes lazy skb cloning in hope that most of packets 449 are discarded by BPF. 450 451 Note tricky part: we DO mangle shared skb! skb->data, skb->len 452 and skb->cb are mangled. It works because (and until) packets 453 falling here are owned by current CPU. Output packets are cloned 454 by dev_queue_xmit_nit(), input packets are processed by net_bh 455 sequencially, so that if we return skb to original state on exit, 456 we will not harm anyone. 457 */ 458 459 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 460 { 461 struct sock *sk; 462 struct sockaddr_ll *sll; 463 struct packet_sock *po; 464 u8 * skb_head = skb->data; 465 int skb_len = skb->len; 466 unsigned snaplen; 467 468 if (skb->pkt_type == PACKET_LOOPBACK) 469 goto drop; 470 471 sk = pt->af_packet_priv; 472 po = pkt_sk(sk); 473 474 skb->dev = dev; 475 476 if (dev->hard_header) { 477 /* The device has an explicit notion of ll header, 478 exported to higher levels. 479 480 Otherwise, the device hides datails of it frame 481 structure, so that corresponding packet head 482 never delivered to user. 483 */ 484 if (sk->sk_type != SOCK_DGRAM) 485 skb_push(skb, skb->data - skb->mac.raw); 486 else if (skb->pkt_type == PACKET_OUTGOING) { 487 /* Special case: outgoing packets have ll header at head */ 488 skb_pull(skb, skb->nh.raw - skb->data); 489 } 490 } 491 492 snaplen = skb->len; 493 494 if (sk->sk_filter) { 495 unsigned res = run_filter(skb, sk, snaplen); 496 if (res == 0) 497 goto drop_n_restore; 498 if (snaplen > res) 499 snaplen = res; 500 } 501 502 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >= 503 (unsigned)sk->sk_rcvbuf) 504 goto drop_n_acct; 505 506 if (skb_shared(skb)) { 507 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); 508 if (nskb == NULL) 509 goto drop_n_acct; 510 511 if (skb_head != skb->data) { 512 skb->data = skb_head; 513 skb->len = skb_len; 514 } 515 kfree_skb(skb); 516 skb = nskb; 517 } 518 519 sll = (struct sockaddr_ll*)skb->cb; 520 sll->sll_family = AF_PACKET; 521 sll->sll_hatype = dev->type; 522 sll->sll_protocol = skb->protocol; 523 sll->sll_pkttype = skb->pkt_type; 524 sll->sll_ifindex = dev->ifindex; 525 sll->sll_halen = 0; 526 527 if (dev->hard_header_parse) 528 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr); 529 530 if (pskb_trim(skb, snaplen)) 531 goto drop_n_acct; 532 533 skb_set_owner_r(skb, sk); 534 skb->dev = NULL; 535 dst_release(skb->dst); 536 skb->dst = NULL; 537 538 /* drop conntrack reference */ 539 nf_reset(skb); 540 541 spin_lock(&sk->sk_receive_queue.lock); 542 po->stats.tp_packets++; 543 __skb_queue_tail(&sk->sk_receive_queue, skb); 544 spin_unlock(&sk->sk_receive_queue.lock); 545 sk->sk_data_ready(sk, skb->len); 546 return 0; 547 548 drop_n_acct: 549 spin_lock(&sk->sk_receive_queue.lock); 550 po->stats.tp_drops++; 551 spin_unlock(&sk->sk_receive_queue.lock); 552 553 drop_n_restore: 554 if (skb_head != skb->data && skb_shared(skb)) { 555 skb->data = skb_head; 556 skb->len = skb_len; 557 } 558 drop: 559 kfree_skb(skb); 560 return 0; 561 } 562 563 #ifdef CONFIG_PACKET_MMAP 564 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 565 { 566 struct sock *sk; 567 struct packet_sock *po; 568 struct sockaddr_ll *sll; 569 struct tpacket_hdr *h; 570 u8 * skb_head = skb->data; 571 int skb_len = skb->len; 572 unsigned snaplen; 573 unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER; 574 unsigned short macoff, netoff; 575 struct sk_buff *copy_skb = NULL; 576 577 if (skb->pkt_type == PACKET_LOOPBACK) 578 goto drop; 579 580 sk = pt->af_packet_priv; 581 po = pkt_sk(sk); 582 583 if (dev->hard_header) { 584 if (sk->sk_type != SOCK_DGRAM) 585 skb_push(skb, skb->data - skb->mac.raw); 586 else if (skb->pkt_type == PACKET_OUTGOING) { 587 /* Special case: outgoing packets have ll header at head */ 588 skb_pull(skb, skb->nh.raw - skb->data); 589 if (skb->ip_summed == CHECKSUM_HW) 590 status |= TP_STATUS_CSUMNOTREADY; 591 } 592 } 593 594 snaplen = skb->len; 595 596 if (sk->sk_filter) { 597 unsigned res = run_filter(skb, sk, snaplen); 598 if (res == 0) 599 goto drop_n_restore; 600 if (snaplen > res) 601 snaplen = res; 602 } 603 604 if (sk->sk_type == SOCK_DGRAM) { 605 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16; 606 } else { 607 unsigned maclen = skb->nh.raw - skb->data; 608 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen)); 609 macoff = netoff - maclen; 610 } 611 612 if (macoff + snaplen > po->frame_size) { 613 if (po->copy_thresh && 614 atomic_read(&sk->sk_rmem_alloc) + skb->truesize < 615 (unsigned)sk->sk_rcvbuf) { 616 if (skb_shared(skb)) { 617 copy_skb = skb_clone(skb, GFP_ATOMIC); 618 } else { 619 copy_skb = skb_get(skb); 620 skb_head = skb->data; 621 } 622 if (copy_skb) 623 skb_set_owner_r(copy_skb, sk); 624 } 625 snaplen = po->frame_size - macoff; 626 if ((int)snaplen < 0) 627 snaplen = 0; 628 } 629 if (snaplen > skb->len-skb->data_len) 630 snaplen = skb->len-skb->data_len; 631 632 spin_lock(&sk->sk_receive_queue.lock); 633 h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head); 634 635 if (h->tp_status) 636 goto ring_is_full; 637 po->head = po->head != po->frame_max ? po->head+1 : 0; 638 po->stats.tp_packets++; 639 if (copy_skb) { 640 status |= TP_STATUS_COPY; 641 __skb_queue_tail(&sk->sk_receive_queue, copy_skb); 642 } 643 if (!po->stats.tp_drops) 644 status &= ~TP_STATUS_LOSING; 645 spin_unlock(&sk->sk_receive_queue.lock); 646 647 memcpy((u8*)h + macoff, skb->data, snaplen); 648 649 h->tp_len = skb->len; 650 h->tp_snaplen = snaplen; 651 h->tp_mac = macoff; 652 h->tp_net = netoff; 653 if (skb->tstamp.off_sec == 0) { 654 __net_timestamp(skb); 655 sock_enable_timestamp(sk); 656 } 657 h->tp_sec = skb->tstamp.off_sec; 658 h->tp_usec = skb->tstamp.off_usec; 659 660 sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h))); 661 sll->sll_halen = 0; 662 if (dev->hard_header_parse) 663 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr); 664 sll->sll_family = AF_PACKET; 665 sll->sll_hatype = dev->type; 666 sll->sll_protocol = skb->protocol; 667 sll->sll_pkttype = skb->pkt_type; 668 sll->sll_ifindex = dev->ifindex; 669 670 h->tp_status = status; 671 mb(); 672 673 { 674 struct page *p_start, *p_end; 675 u8 *h_end = (u8 *)h + macoff + snaplen - 1; 676 677 p_start = virt_to_page(h); 678 p_end = virt_to_page(h_end); 679 while (p_start <= p_end) { 680 flush_dcache_page(p_start); 681 p_start++; 682 } 683 } 684 685 sk->sk_data_ready(sk, 0); 686 687 drop_n_restore: 688 if (skb_head != skb->data && skb_shared(skb)) { 689 skb->data = skb_head; 690 skb->len = skb_len; 691 } 692 drop: 693 kfree_skb(skb); 694 return 0; 695 696 ring_is_full: 697 po->stats.tp_drops++; 698 spin_unlock(&sk->sk_receive_queue.lock); 699 700 sk->sk_data_ready(sk, 0); 701 if (copy_skb) 702 kfree_skb(copy_skb); 703 goto drop_n_restore; 704 } 705 706 #endif 707 708 709 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock, 710 struct msghdr *msg, size_t len) 711 { 712 struct sock *sk = sock->sk; 713 struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name; 714 struct sk_buff *skb; 715 struct net_device *dev; 716 unsigned short proto; 717 unsigned char *addr; 718 int ifindex, err, reserve = 0; 719 720 /* 721 * Get and verify the address. 722 */ 723 724 if (saddr == NULL) { 725 struct packet_sock *po = pkt_sk(sk); 726 727 ifindex = po->ifindex; 728 proto = po->num; 729 addr = NULL; 730 } else { 731 err = -EINVAL; 732 if (msg->msg_namelen < sizeof(struct sockaddr_ll)) 733 goto out; 734 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) 735 goto out; 736 ifindex = saddr->sll_ifindex; 737 proto = saddr->sll_protocol; 738 addr = saddr->sll_addr; 739 } 740 741 742 dev = dev_get_by_index(ifindex); 743 err = -ENXIO; 744 if (dev == NULL) 745 goto out_unlock; 746 if (sock->type == SOCK_RAW) 747 reserve = dev->hard_header_len; 748 749 err = -EMSGSIZE; 750 if (len > dev->mtu+reserve) 751 goto out_unlock; 752 753 skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev), 754 msg->msg_flags & MSG_DONTWAIT, &err); 755 if (skb==NULL) 756 goto out_unlock; 757 758 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 759 skb->nh.raw = skb->data; 760 761 if (dev->hard_header) { 762 int res; 763 err = -EINVAL; 764 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len); 765 if (sock->type != SOCK_DGRAM) { 766 skb->tail = skb->data; 767 skb->len = 0; 768 } else if (res < 0) 769 goto out_free; 770 } 771 772 /* Returns -EFAULT on error */ 773 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 774 if (err) 775 goto out_free; 776 777 skb->protocol = proto; 778 skb->dev = dev; 779 skb->priority = sk->sk_priority; 780 781 err = -ENETDOWN; 782 if (!(dev->flags & IFF_UP)) 783 goto out_free; 784 785 /* 786 * Now send it 787 */ 788 789 err = dev_queue_xmit(skb); 790 if (err > 0 && (err = net_xmit_errno(err)) != 0) 791 goto out_unlock; 792 793 dev_put(dev); 794 795 return(len); 796 797 out_free: 798 kfree_skb(skb); 799 out_unlock: 800 if (dev) 801 dev_put(dev); 802 out: 803 return err; 804 } 805 806 /* 807 * Close a PACKET socket. This is fairly simple. We immediately go 808 * to 'closed' state and remove our protocol entry in the device list. 809 */ 810 811 static int packet_release(struct socket *sock) 812 { 813 struct sock *sk = sock->sk; 814 struct packet_sock *po; 815 816 if (!sk) 817 return 0; 818 819 po = pkt_sk(sk); 820 821 write_lock_bh(&packet_sklist_lock); 822 sk_del_node_init(sk); 823 write_unlock_bh(&packet_sklist_lock); 824 825 /* 826 * Unhook packet receive handler. 827 */ 828 829 if (po->running) { 830 /* 831 * Remove the protocol hook 832 */ 833 dev_remove_pack(&po->prot_hook); 834 po->running = 0; 835 po->num = 0; 836 __sock_put(sk); 837 } 838 839 #ifdef CONFIG_PACKET_MULTICAST 840 packet_flush_mclist(sk); 841 #endif 842 843 #ifdef CONFIG_PACKET_MMAP 844 if (po->pg_vec) { 845 struct tpacket_req req; 846 memset(&req, 0, sizeof(req)); 847 packet_set_ring(sk, &req, 1); 848 } 849 #endif 850 851 /* 852 * Now the socket is dead. No more input will appear. 853 */ 854 855 sock_orphan(sk); 856 sock->sk = NULL; 857 858 /* Purge queues */ 859 860 skb_queue_purge(&sk->sk_receive_queue); 861 862 sock_put(sk); 863 return 0; 864 } 865 866 /* 867 * Attach a packet hook. 868 */ 869 870 static int packet_do_bind(struct sock *sk, struct net_device *dev, int protocol) 871 { 872 struct packet_sock *po = pkt_sk(sk); 873 /* 874 * Detach an existing hook if present. 875 */ 876 877 lock_sock(sk); 878 879 spin_lock(&po->bind_lock); 880 if (po->running) { 881 __sock_put(sk); 882 po->running = 0; 883 po->num = 0; 884 spin_unlock(&po->bind_lock); 885 dev_remove_pack(&po->prot_hook); 886 spin_lock(&po->bind_lock); 887 } 888 889 po->num = protocol; 890 po->prot_hook.type = protocol; 891 po->prot_hook.dev = dev; 892 893 po->ifindex = dev ? dev->ifindex : 0; 894 895 if (protocol == 0) 896 goto out_unlock; 897 898 if (dev) { 899 if (dev->flags&IFF_UP) { 900 dev_add_pack(&po->prot_hook); 901 sock_hold(sk); 902 po->running = 1; 903 } else { 904 sk->sk_err = ENETDOWN; 905 if (!sock_flag(sk, SOCK_DEAD)) 906 sk->sk_error_report(sk); 907 } 908 } else { 909 dev_add_pack(&po->prot_hook); 910 sock_hold(sk); 911 po->running = 1; 912 } 913 914 out_unlock: 915 spin_unlock(&po->bind_lock); 916 release_sock(sk); 917 return 0; 918 } 919 920 /* 921 * Bind a packet socket to a device 922 */ 923 924 #ifdef CONFIG_SOCK_PACKET 925 926 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len) 927 { 928 struct sock *sk=sock->sk; 929 char name[15]; 930 struct net_device *dev; 931 int err = -ENODEV; 932 933 /* 934 * Check legality 935 */ 936 937 if(addr_len!=sizeof(struct sockaddr)) 938 return -EINVAL; 939 strlcpy(name,uaddr->sa_data,sizeof(name)); 940 941 dev = dev_get_by_name(name); 942 if (dev) { 943 err = packet_do_bind(sk, dev, pkt_sk(sk)->num); 944 dev_put(dev); 945 } 946 return err; 947 } 948 #endif 949 950 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) 951 { 952 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr; 953 struct sock *sk=sock->sk; 954 struct net_device *dev = NULL; 955 int err; 956 957 958 /* 959 * Check legality 960 */ 961 962 if (addr_len < sizeof(struct sockaddr_ll)) 963 return -EINVAL; 964 if (sll->sll_family != AF_PACKET) 965 return -EINVAL; 966 967 if (sll->sll_ifindex) { 968 err = -ENODEV; 969 dev = dev_get_by_index(sll->sll_ifindex); 970 if (dev == NULL) 971 goto out; 972 } 973 err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); 974 if (dev) 975 dev_put(dev); 976 977 out: 978 return err; 979 } 980 981 static struct proto packet_proto = { 982 .name = "PACKET", 983 .owner = THIS_MODULE, 984 .obj_size = sizeof(struct packet_sock), 985 }; 986 987 /* 988 * Create a packet of type SOCK_PACKET. 989 */ 990 991 static int packet_create(struct socket *sock, int protocol) 992 { 993 struct sock *sk; 994 struct packet_sock *po; 995 int err; 996 997 if (!capable(CAP_NET_RAW)) 998 return -EPERM; 999 if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW 1000 #ifdef CONFIG_SOCK_PACKET 1001 && sock->type != SOCK_PACKET 1002 #endif 1003 ) 1004 return -ESOCKTNOSUPPORT; 1005 1006 sock->state = SS_UNCONNECTED; 1007 1008 err = -ENOBUFS; 1009 sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1); 1010 if (sk == NULL) 1011 goto out; 1012 1013 sock->ops = &packet_ops; 1014 #ifdef CONFIG_SOCK_PACKET 1015 if (sock->type == SOCK_PACKET) 1016 sock->ops = &packet_ops_spkt; 1017 #endif 1018 sock_init_data(sock, sk); 1019 1020 po = pkt_sk(sk); 1021 sk->sk_family = PF_PACKET; 1022 po->num = protocol; 1023 1024 sk->sk_destruct = packet_sock_destruct; 1025 atomic_inc(&packet_socks_nr); 1026 1027 /* 1028 * Attach a protocol block 1029 */ 1030 1031 spin_lock_init(&po->bind_lock); 1032 po->prot_hook.func = packet_rcv; 1033 #ifdef CONFIG_SOCK_PACKET 1034 if (sock->type == SOCK_PACKET) 1035 po->prot_hook.func = packet_rcv_spkt; 1036 #endif 1037 po->prot_hook.af_packet_priv = sk; 1038 1039 if (protocol) { 1040 po->prot_hook.type = protocol; 1041 dev_add_pack(&po->prot_hook); 1042 sock_hold(sk); 1043 po->running = 1; 1044 } 1045 1046 write_lock_bh(&packet_sklist_lock); 1047 sk_add_node(sk, &packet_sklist); 1048 write_unlock_bh(&packet_sklist_lock); 1049 return(0); 1050 out: 1051 return err; 1052 } 1053 1054 /* 1055 * Pull a packet from our receive queue and hand it to the user. 1056 * If necessary we block. 1057 */ 1058 1059 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock, 1060 struct msghdr *msg, size_t len, int flags) 1061 { 1062 struct sock *sk = sock->sk; 1063 struct sk_buff *skb; 1064 int copied, err; 1065 struct sockaddr_ll *sll; 1066 1067 err = -EINVAL; 1068 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) 1069 goto out; 1070 1071 #if 0 1072 /* What error should we return now? EUNATTACH? */ 1073 if (pkt_sk(sk)->ifindex < 0) 1074 return -ENODEV; 1075 #endif 1076 1077 /* 1078 * Call the generic datagram receiver. This handles all sorts 1079 * of horrible races and re-entrancy so we can forget about it 1080 * in the protocol layers. 1081 * 1082 * Now it will return ENETDOWN, if device have just gone down, 1083 * but then it will block. 1084 */ 1085 1086 skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err); 1087 1088 /* 1089 * An error occurred so return it. Because skb_recv_datagram() 1090 * handles the blocking we don't see and worry about blocking 1091 * retries. 1092 */ 1093 1094 if(skb==NULL) 1095 goto out; 1096 1097 /* 1098 * If the address length field is there to be filled in, we fill 1099 * it in now. 1100 */ 1101 1102 sll = (struct sockaddr_ll*)skb->cb; 1103 if (sock->type == SOCK_PACKET) 1104 msg->msg_namelen = sizeof(struct sockaddr_pkt); 1105 else 1106 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr); 1107 1108 /* 1109 * You lose any data beyond the buffer you gave. If it worries a 1110 * user program they can ask the device for its MTU anyway. 1111 */ 1112 1113 copied = skb->len; 1114 if (copied > len) 1115 { 1116 copied=len; 1117 msg->msg_flags|=MSG_TRUNC; 1118 } 1119 1120 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 1121 if (err) 1122 goto out_free; 1123 1124 sock_recv_timestamp(msg, sk, skb); 1125 1126 if (msg->msg_name) 1127 memcpy(msg->msg_name, skb->cb, msg->msg_namelen); 1128 1129 /* 1130 * Free or return the buffer as appropriate. Again this 1131 * hides all the races and re-entrancy issues from us. 1132 */ 1133 err = (flags&MSG_TRUNC) ? skb->len : copied; 1134 1135 out_free: 1136 skb_free_datagram(sk, skb); 1137 out: 1138 return err; 1139 } 1140 1141 #ifdef CONFIG_SOCK_PACKET 1142 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, 1143 int *uaddr_len, int peer) 1144 { 1145 struct net_device *dev; 1146 struct sock *sk = sock->sk; 1147 1148 if (peer) 1149 return -EOPNOTSUPP; 1150 1151 uaddr->sa_family = AF_PACKET; 1152 dev = dev_get_by_index(pkt_sk(sk)->ifindex); 1153 if (dev) { 1154 strlcpy(uaddr->sa_data, dev->name, 15); 1155 dev_put(dev); 1156 } else 1157 memset(uaddr->sa_data, 0, 14); 1158 *uaddr_len = sizeof(*uaddr); 1159 1160 return 0; 1161 } 1162 #endif 1163 1164 static int packet_getname(struct socket *sock, struct sockaddr *uaddr, 1165 int *uaddr_len, int peer) 1166 { 1167 struct net_device *dev; 1168 struct sock *sk = sock->sk; 1169 struct packet_sock *po = pkt_sk(sk); 1170 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr; 1171 1172 if (peer) 1173 return -EOPNOTSUPP; 1174 1175 sll->sll_family = AF_PACKET; 1176 sll->sll_ifindex = po->ifindex; 1177 sll->sll_protocol = po->num; 1178 dev = dev_get_by_index(po->ifindex); 1179 if (dev) { 1180 sll->sll_hatype = dev->type; 1181 sll->sll_halen = dev->addr_len; 1182 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len); 1183 dev_put(dev); 1184 } else { 1185 sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */ 1186 sll->sll_halen = 0; 1187 } 1188 *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen; 1189 1190 return 0; 1191 } 1192 1193 #ifdef CONFIG_PACKET_MULTICAST 1194 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what) 1195 { 1196 switch (i->type) { 1197 case PACKET_MR_MULTICAST: 1198 if (what > 0) 1199 dev_mc_add(dev, i->addr, i->alen, 0); 1200 else 1201 dev_mc_delete(dev, i->addr, i->alen, 0); 1202 break; 1203 case PACKET_MR_PROMISC: 1204 dev_set_promiscuity(dev, what); 1205 break; 1206 case PACKET_MR_ALLMULTI: 1207 dev_set_allmulti(dev, what); 1208 break; 1209 default:; 1210 } 1211 } 1212 1213 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what) 1214 { 1215 for ( ; i; i=i->next) { 1216 if (i->ifindex == dev->ifindex) 1217 packet_dev_mc(dev, i, what); 1218 } 1219 } 1220 1221 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) 1222 { 1223 struct packet_sock *po = pkt_sk(sk); 1224 struct packet_mclist *ml, *i; 1225 struct net_device *dev; 1226 int err; 1227 1228 rtnl_lock(); 1229 1230 err = -ENODEV; 1231 dev = __dev_get_by_index(mreq->mr_ifindex); 1232 if (!dev) 1233 goto done; 1234 1235 err = -EINVAL; 1236 if (mreq->mr_alen > dev->addr_len) 1237 goto done; 1238 1239 err = -ENOBUFS; 1240 i = (struct packet_mclist *)kmalloc(sizeof(*i), GFP_KERNEL); 1241 if (i == NULL) 1242 goto done; 1243 1244 err = 0; 1245 for (ml = po->mclist; ml; ml = ml->next) { 1246 if (ml->ifindex == mreq->mr_ifindex && 1247 ml->type == mreq->mr_type && 1248 ml->alen == mreq->mr_alen && 1249 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) { 1250 ml->count++; 1251 /* Free the new element ... */ 1252 kfree(i); 1253 goto done; 1254 } 1255 } 1256 1257 i->type = mreq->mr_type; 1258 i->ifindex = mreq->mr_ifindex; 1259 i->alen = mreq->mr_alen; 1260 memcpy(i->addr, mreq->mr_address, i->alen); 1261 i->count = 1; 1262 i->next = po->mclist; 1263 po->mclist = i; 1264 packet_dev_mc(dev, i, +1); 1265 1266 done: 1267 rtnl_unlock(); 1268 return err; 1269 } 1270 1271 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq) 1272 { 1273 struct packet_mclist *ml, **mlp; 1274 1275 rtnl_lock(); 1276 1277 for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) { 1278 if (ml->ifindex == mreq->mr_ifindex && 1279 ml->type == mreq->mr_type && 1280 ml->alen == mreq->mr_alen && 1281 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) { 1282 if (--ml->count == 0) { 1283 struct net_device *dev; 1284 *mlp = ml->next; 1285 dev = dev_get_by_index(ml->ifindex); 1286 if (dev) { 1287 packet_dev_mc(dev, ml, -1); 1288 dev_put(dev); 1289 } 1290 kfree(ml); 1291 } 1292 rtnl_unlock(); 1293 return 0; 1294 } 1295 } 1296 rtnl_unlock(); 1297 return -EADDRNOTAVAIL; 1298 } 1299 1300 static void packet_flush_mclist(struct sock *sk) 1301 { 1302 struct packet_sock *po = pkt_sk(sk); 1303 struct packet_mclist *ml; 1304 1305 if (!po->mclist) 1306 return; 1307 1308 rtnl_lock(); 1309 while ((ml = po->mclist) != NULL) { 1310 struct net_device *dev; 1311 1312 po->mclist = ml->next; 1313 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) { 1314 packet_dev_mc(dev, ml, -1); 1315 dev_put(dev); 1316 } 1317 kfree(ml); 1318 } 1319 rtnl_unlock(); 1320 } 1321 #endif 1322 1323 static int 1324 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen) 1325 { 1326 struct sock *sk = sock->sk; 1327 int ret; 1328 1329 if (level != SOL_PACKET) 1330 return -ENOPROTOOPT; 1331 1332 switch(optname) { 1333 #ifdef CONFIG_PACKET_MULTICAST 1334 case PACKET_ADD_MEMBERSHIP: 1335 case PACKET_DROP_MEMBERSHIP: 1336 { 1337 struct packet_mreq_max mreq; 1338 int len = optlen; 1339 memset(&mreq, 0, sizeof(mreq)); 1340 if (len < sizeof(struct packet_mreq)) 1341 return -EINVAL; 1342 if (len > sizeof(mreq)) 1343 len = sizeof(mreq); 1344 if (copy_from_user(&mreq,optval,len)) 1345 return -EFAULT; 1346 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address))) 1347 return -EINVAL; 1348 if (optname == PACKET_ADD_MEMBERSHIP) 1349 ret = packet_mc_add(sk, &mreq); 1350 else 1351 ret = packet_mc_drop(sk, &mreq); 1352 return ret; 1353 } 1354 #endif 1355 #ifdef CONFIG_PACKET_MMAP 1356 case PACKET_RX_RING: 1357 { 1358 struct tpacket_req req; 1359 1360 if (optlen<sizeof(req)) 1361 return -EINVAL; 1362 if (copy_from_user(&req,optval,sizeof(req))) 1363 return -EFAULT; 1364 return packet_set_ring(sk, &req, 0); 1365 } 1366 case PACKET_COPY_THRESH: 1367 { 1368 int val; 1369 1370 if (optlen!=sizeof(val)) 1371 return -EINVAL; 1372 if (copy_from_user(&val,optval,sizeof(val))) 1373 return -EFAULT; 1374 1375 pkt_sk(sk)->copy_thresh = val; 1376 return 0; 1377 } 1378 #endif 1379 default: 1380 return -ENOPROTOOPT; 1381 } 1382 } 1383 1384 static int packet_getsockopt(struct socket *sock, int level, int optname, 1385 char __user *optval, int __user *optlen) 1386 { 1387 int len; 1388 struct sock *sk = sock->sk; 1389 struct packet_sock *po = pkt_sk(sk); 1390 1391 if (level != SOL_PACKET) 1392 return -ENOPROTOOPT; 1393 1394 if (get_user(len,optlen)) 1395 return -EFAULT; 1396 1397 if (len < 0) 1398 return -EINVAL; 1399 1400 switch(optname) { 1401 case PACKET_STATISTICS: 1402 { 1403 struct tpacket_stats st; 1404 1405 if (len > sizeof(struct tpacket_stats)) 1406 len = sizeof(struct tpacket_stats); 1407 spin_lock_bh(&sk->sk_receive_queue.lock); 1408 st = po->stats; 1409 memset(&po->stats, 0, sizeof(st)); 1410 spin_unlock_bh(&sk->sk_receive_queue.lock); 1411 st.tp_packets += st.tp_drops; 1412 1413 if (copy_to_user(optval, &st, len)) 1414 return -EFAULT; 1415 break; 1416 } 1417 default: 1418 return -ENOPROTOOPT; 1419 } 1420 1421 if (put_user(len, optlen)) 1422 return -EFAULT; 1423 return 0; 1424 } 1425 1426 1427 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data) 1428 { 1429 struct sock *sk; 1430 struct hlist_node *node; 1431 struct net_device *dev = (struct net_device*)data; 1432 1433 read_lock(&packet_sklist_lock); 1434 sk_for_each(sk, node, &packet_sklist) { 1435 struct packet_sock *po = pkt_sk(sk); 1436 1437 switch (msg) { 1438 case NETDEV_UNREGISTER: 1439 #ifdef CONFIG_PACKET_MULTICAST 1440 if (po->mclist) 1441 packet_dev_mclist(dev, po->mclist, -1); 1442 // fallthrough 1443 #endif 1444 case NETDEV_DOWN: 1445 if (dev->ifindex == po->ifindex) { 1446 spin_lock(&po->bind_lock); 1447 if (po->running) { 1448 __dev_remove_pack(&po->prot_hook); 1449 __sock_put(sk); 1450 po->running = 0; 1451 sk->sk_err = ENETDOWN; 1452 if (!sock_flag(sk, SOCK_DEAD)) 1453 sk->sk_error_report(sk); 1454 } 1455 if (msg == NETDEV_UNREGISTER) { 1456 po->ifindex = -1; 1457 po->prot_hook.dev = NULL; 1458 } 1459 spin_unlock(&po->bind_lock); 1460 } 1461 break; 1462 case NETDEV_UP: 1463 spin_lock(&po->bind_lock); 1464 if (dev->ifindex == po->ifindex && po->num && 1465 !po->running) { 1466 dev_add_pack(&po->prot_hook); 1467 sock_hold(sk); 1468 po->running = 1; 1469 } 1470 spin_unlock(&po->bind_lock); 1471 break; 1472 } 1473 } 1474 read_unlock(&packet_sklist_lock); 1475 return NOTIFY_DONE; 1476 } 1477 1478 1479 static int packet_ioctl(struct socket *sock, unsigned int cmd, 1480 unsigned long arg) 1481 { 1482 struct sock *sk = sock->sk; 1483 1484 switch(cmd) { 1485 case SIOCOUTQ: 1486 { 1487 int amount = atomic_read(&sk->sk_wmem_alloc); 1488 return put_user(amount, (int __user *)arg); 1489 } 1490 case SIOCINQ: 1491 { 1492 struct sk_buff *skb; 1493 int amount = 0; 1494 1495 spin_lock_bh(&sk->sk_receive_queue.lock); 1496 skb = skb_peek(&sk->sk_receive_queue); 1497 if (skb) 1498 amount = skb->len; 1499 spin_unlock_bh(&sk->sk_receive_queue.lock); 1500 return put_user(amount, (int __user *)arg); 1501 } 1502 case SIOCGSTAMP: 1503 return sock_get_timestamp(sk, (struct timeval __user *)arg); 1504 1505 #ifdef CONFIG_INET 1506 case SIOCADDRT: 1507 case SIOCDELRT: 1508 case SIOCDARP: 1509 case SIOCGARP: 1510 case SIOCSARP: 1511 case SIOCGIFADDR: 1512 case SIOCSIFADDR: 1513 case SIOCGIFBRDADDR: 1514 case SIOCSIFBRDADDR: 1515 case SIOCGIFNETMASK: 1516 case SIOCSIFNETMASK: 1517 case SIOCGIFDSTADDR: 1518 case SIOCSIFDSTADDR: 1519 case SIOCSIFFLAGS: 1520 return inet_dgram_ops.ioctl(sock, cmd, arg); 1521 #endif 1522 1523 default: 1524 return -ENOIOCTLCMD; 1525 } 1526 return 0; 1527 } 1528 1529 #ifndef CONFIG_PACKET_MMAP 1530 #define packet_mmap sock_no_mmap 1531 #define packet_poll datagram_poll 1532 #else 1533 1534 static unsigned int packet_poll(struct file * file, struct socket *sock, 1535 poll_table *wait) 1536 { 1537 struct sock *sk = sock->sk; 1538 struct packet_sock *po = pkt_sk(sk); 1539 unsigned int mask = datagram_poll(file, sock, wait); 1540 1541 spin_lock_bh(&sk->sk_receive_queue.lock); 1542 if (po->pg_vec) { 1543 unsigned last = po->head ? po->head-1 : po->frame_max; 1544 struct tpacket_hdr *h; 1545 1546 h = (struct tpacket_hdr *)packet_lookup_frame(po, last); 1547 1548 if (h->tp_status) 1549 mask |= POLLIN | POLLRDNORM; 1550 } 1551 spin_unlock_bh(&sk->sk_receive_queue.lock); 1552 return mask; 1553 } 1554 1555 1556 /* Dirty? Well, I still did not learn better way to account 1557 * for user mmaps. 1558 */ 1559 1560 static void packet_mm_open(struct vm_area_struct *vma) 1561 { 1562 struct file *file = vma->vm_file; 1563 struct socket * sock = file->private_data; 1564 struct sock *sk = sock->sk; 1565 1566 if (sk) 1567 atomic_inc(&pkt_sk(sk)->mapped); 1568 } 1569 1570 static void packet_mm_close(struct vm_area_struct *vma) 1571 { 1572 struct file *file = vma->vm_file; 1573 struct socket * sock = file->private_data; 1574 struct sock *sk = sock->sk; 1575 1576 if (sk) 1577 atomic_dec(&pkt_sk(sk)->mapped); 1578 } 1579 1580 static struct vm_operations_struct packet_mmap_ops = { 1581 .open = packet_mm_open, 1582 .close =packet_mm_close, 1583 }; 1584 1585 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order) 1586 { 1587 return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1); 1588 } 1589 1590 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len) 1591 { 1592 int i; 1593 1594 for (i = 0; i < len; i++) { 1595 if (likely(pg_vec[i])) 1596 free_pages((unsigned long) pg_vec[i], order); 1597 } 1598 kfree(pg_vec); 1599 } 1600 1601 static inline char *alloc_one_pg_vec_page(unsigned long order) 1602 { 1603 return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO, 1604 order); 1605 } 1606 1607 static char **alloc_pg_vec(struct tpacket_req *req, int order) 1608 { 1609 unsigned int block_nr = req->tp_block_nr; 1610 char **pg_vec; 1611 int i; 1612 1613 pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL); 1614 if (unlikely(!pg_vec)) 1615 goto out; 1616 1617 for (i = 0; i < block_nr; i++) { 1618 pg_vec[i] = alloc_one_pg_vec_page(order); 1619 if (unlikely(!pg_vec[i])) 1620 goto out_free_pgvec; 1621 } 1622 1623 out: 1624 return pg_vec; 1625 1626 out_free_pgvec: 1627 free_pg_vec(pg_vec, order, block_nr); 1628 pg_vec = NULL; 1629 goto out; 1630 } 1631 1632 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing) 1633 { 1634 char **pg_vec = NULL; 1635 struct packet_sock *po = pkt_sk(sk); 1636 int was_running, num, order = 0; 1637 int err = 0; 1638 1639 if (req->tp_block_nr) { 1640 int i, l; 1641 1642 /* Sanity tests and some calculations */ 1643 1644 if (unlikely(po->pg_vec)) 1645 return -EBUSY; 1646 1647 if (unlikely((int)req->tp_block_size <= 0)) 1648 return -EINVAL; 1649 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) 1650 return -EINVAL; 1651 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN)) 1652 return -EINVAL; 1653 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) 1654 return -EINVAL; 1655 1656 po->frames_per_block = req->tp_block_size/req->tp_frame_size; 1657 if (unlikely(po->frames_per_block <= 0)) 1658 return -EINVAL; 1659 if (unlikely((po->frames_per_block * req->tp_block_nr) != 1660 req->tp_frame_nr)) 1661 return -EINVAL; 1662 1663 err = -ENOMEM; 1664 order = get_order(req->tp_block_size); 1665 pg_vec = alloc_pg_vec(req, order); 1666 if (unlikely(!pg_vec)) 1667 goto out; 1668 1669 l = 0; 1670 for (i = 0; i < req->tp_block_nr; i++) { 1671 char *ptr = pg_vec[i]; 1672 struct tpacket_hdr *header; 1673 int k; 1674 1675 for (k = 0; k < po->frames_per_block; k++) { 1676 header = (struct tpacket_hdr *) ptr; 1677 header->tp_status = TP_STATUS_KERNEL; 1678 ptr += req->tp_frame_size; 1679 } 1680 } 1681 /* Done */ 1682 } else { 1683 if (unlikely(req->tp_frame_nr)) 1684 return -EINVAL; 1685 } 1686 1687 lock_sock(sk); 1688 1689 /* Detach socket from network */ 1690 spin_lock(&po->bind_lock); 1691 was_running = po->running; 1692 num = po->num; 1693 if (was_running) { 1694 __dev_remove_pack(&po->prot_hook); 1695 po->num = 0; 1696 po->running = 0; 1697 __sock_put(sk); 1698 } 1699 spin_unlock(&po->bind_lock); 1700 1701 synchronize_net(); 1702 1703 err = -EBUSY; 1704 if (closing || atomic_read(&po->mapped) == 0) { 1705 err = 0; 1706 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; }) 1707 1708 spin_lock_bh(&sk->sk_receive_queue.lock); 1709 pg_vec = XC(po->pg_vec, pg_vec); 1710 po->frame_max = (req->tp_frame_nr - 1); 1711 po->head = 0; 1712 po->frame_size = req->tp_frame_size; 1713 spin_unlock_bh(&sk->sk_receive_queue.lock); 1714 1715 order = XC(po->pg_vec_order, order); 1716 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr); 1717 1718 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE; 1719 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv; 1720 skb_queue_purge(&sk->sk_receive_queue); 1721 #undef XC 1722 if (atomic_read(&po->mapped)) 1723 printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped)); 1724 } 1725 1726 spin_lock(&po->bind_lock); 1727 if (was_running && !po->running) { 1728 sock_hold(sk); 1729 po->running = 1; 1730 po->num = num; 1731 dev_add_pack(&po->prot_hook); 1732 } 1733 spin_unlock(&po->bind_lock); 1734 1735 release_sock(sk); 1736 1737 if (pg_vec) 1738 free_pg_vec(pg_vec, order, req->tp_block_nr); 1739 out: 1740 return err; 1741 } 1742 1743 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma) 1744 { 1745 struct sock *sk = sock->sk; 1746 struct packet_sock *po = pkt_sk(sk); 1747 unsigned long size; 1748 unsigned long start; 1749 int err = -EINVAL; 1750 int i; 1751 1752 if (vma->vm_pgoff) 1753 return -EINVAL; 1754 1755 size = vma->vm_end - vma->vm_start; 1756 1757 lock_sock(sk); 1758 if (po->pg_vec == NULL) 1759 goto out; 1760 if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE) 1761 goto out; 1762 1763 start = vma->vm_start; 1764 for (i = 0; i < po->pg_vec_len; i++) { 1765 struct page *page = virt_to_page(po->pg_vec[i]); 1766 int pg_num; 1767 1768 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) { 1769 err = vm_insert_page(vma, start, page); 1770 if (unlikely(err)) 1771 goto out; 1772 start += PAGE_SIZE; 1773 } 1774 } 1775 atomic_inc(&po->mapped); 1776 vma->vm_ops = &packet_mmap_ops; 1777 err = 0; 1778 1779 out: 1780 release_sock(sk); 1781 return err; 1782 } 1783 #endif 1784 1785 1786 #ifdef CONFIG_SOCK_PACKET 1787 static const struct proto_ops packet_ops_spkt = { 1788 .family = PF_PACKET, 1789 .owner = THIS_MODULE, 1790 .release = packet_release, 1791 .bind = packet_bind_spkt, 1792 .connect = sock_no_connect, 1793 .socketpair = sock_no_socketpair, 1794 .accept = sock_no_accept, 1795 .getname = packet_getname_spkt, 1796 .poll = datagram_poll, 1797 .ioctl = packet_ioctl, 1798 .listen = sock_no_listen, 1799 .shutdown = sock_no_shutdown, 1800 .setsockopt = sock_no_setsockopt, 1801 .getsockopt = sock_no_getsockopt, 1802 .sendmsg = packet_sendmsg_spkt, 1803 .recvmsg = packet_recvmsg, 1804 .mmap = sock_no_mmap, 1805 .sendpage = sock_no_sendpage, 1806 }; 1807 #endif 1808 1809 static const struct proto_ops packet_ops = { 1810 .family = PF_PACKET, 1811 .owner = THIS_MODULE, 1812 .release = packet_release, 1813 .bind = packet_bind, 1814 .connect = sock_no_connect, 1815 .socketpair = sock_no_socketpair, 1816 .accept = sock_no_accept, 1817 .getname = packet_getname, 1818 .poll = packet_poll, 1819 .ioctl = packet_ioctl, 1820 .listen = sock_no_listen, 1821 .shutdown = sock_no_shutdown, 1822 .setsockopt = packet_setsockopt, 1823 .getsockopt = packet_getsockopt, 1824 .sendmsg = packet_sendmsg, 1825 .recvmsg = packet_recvmsg, 1826 .mmap = packet_mmap, 1827 .sendpage = sock_no_sendpage, 1828 }; 1829 1830 static struct net_proto_family packet_family_ops = { 1831 .family = PF_PACKET, 1832 .create = packet_create, 1833 .owner = THIS_MODULE, 1834 }; 1835 1836 static struct notifier_block packet_netdev_notifier = { 1837 .notifier_call =packet_notifier, 1838 }; 1839 1840 #ifdef CONFIG_PROC_FS 1841 static inline struct sock *packet_seq_idx(loff_t off) 1842 { 1843 struct sock *s; 1844 struct hlist_node *node; 1845 1846 sk_for_each(s, node, &packet_sklist) { 1847 if (!off--) 1848 return s; 1849 } 1850 return NULL; 1851 } 1852 1853 static void *packet_seq_start(struct seq_file *seq, loff_t *pos) 1854 { 1855 read_lock(&packet_sklist_lock); 1856 return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN; 1857 } 1858 1859 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1860 { 1861 ++*pos; 1862 return (v == SEQ_START_TOKEN) 1863 ? sk_head(&packet_sklist) 1864 : sk_next((struct sock*)v) ; 1865 } 1866 1867 static void packet_seq_stop(struct seq_file *seq, void *v) 1868 { 1869 read_unlock(&packet_sklist_lock); 1870 } 1871 1872 static int packet_seq_show(struct seq_file *seq, void *v) 1873 { 1874 if (v == SEQ_START_TOKEN) 1875 seq_puts(seq, "sk RefCnt Type Proto Iface R Rmem User Inode\n"); 1876 else { 1877 struct sock *s = v; 1878 const struct packet_sock *po = pkt_sk(s); 1879 1880 seq_printf(seq, 1881 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n", 1882 s, 1883 atomic_read(&s->sk_refcnt), 1884 s->sk_type, 1885 ntohs(po->num), 1886 po->ifindex, 1887 po->running, 1888 atomic_read(&s->sk_rmem_alloc), 1889 sock_i_uid(s), 1890 sock_i_ino(s) ); 1891 } 1892 1893 return 0; 1894 } 1895 1896 static struct seq_operations packet_seq_ops = { 1897 .start = packet_seq_start, 1898 .next = packet_seq_next, 1899 .stop = packet_seq_stop, 1900 .show = packet_seq_show, 1901 }; 1902 1903 static int packet_seq_open(struct inode *inode, struct file *file) 1904 { 1905 return seq_open(file, &packet_seq_ops); 1906 } 1907 1908 static struct file_operations packet_seq_fops = { 1909 .owner = THIS_MODULE, 1910 .open = packet_seq_open, 1911 .read = seq_read, 1912 .llseek = seq_lseek, 1913 .release = seq_release, 1914 }; 1915 1916 #endif 1917 1918 static void __exit packet_exit(void) 1919 { 1920 proc_net_remove("packet"); 1921 unregister_netdevice_notifier(&packet_netdev_notifier); 1922 sock_unregister(PF_PACKET); 1923 proto_unregister(&packet_proto); 1924 } 1925 1926 static int __init packet_init(void) 1927 { 1928 int rc = proto_register(&packet_proto, 0); 1929 1930 if (rc != 0) 1931 goto out; 1932 1933 sock_register(&packet_family_ops); 1934 register_netdevice_notifier(&packet_netdev_notifier); 1935 proc_net_fops_create("packet", 0, &packet_seq_fops); 1936 out: 1937 return rc; 1938 } 1939 1940 module_init(packet_init); 1941 module_exit(packet_exit); 1942 MODULE_LICENSE("GPL"); 1943 MODULE_ALIAS_NETPROTO(PF_PACKET); 1944