tun.c 55.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*
 *  TUN - Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *  GNU General Public License for more details.
 *
 *  $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $
 */

/*
 *  Changes:
 *
21 22 23
 *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
 *    Add TUNSETLINK ioctl to set the link encapsulation
 *
L
Linus Torvalds 已提交
24
 *  Mark Smith <markzzzsmith@yahoo.com.au>
J
Joe Perches 已提交
25
 *    Use eth_random_addr() for tap MAC address.
L
Linus Torvalds 已提交
26 27 28 29 30 31 32 33 34 35 36
 *
 *  Harald Roelle <harald.roelle@ifi.lmu.de>  2004/04/20
 *    Fixes in packet dropping, queue length setting and queue wakeup.
 *    Increased default tx queue length.
 *    Added ethtool API.
 *    Minor cleanups
 *
 *  Daniel Podlejski <underley@underley.eu.org>
 *    Modifications for 2.3.99-pre5 kernel.
 */

37 38
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
#define DRV_NAME	"tun"
#define DRV_VERSION	"1.6"
#define DRV_DESCRIPTION	"Universal TUN/TAP device driver"
#define DRV_COPYRIGHT	"(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>"

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/miscdevice.h>
#include <linux/ethtool.h>
#include <linux/rtnetlink.h>
58
#include <linux/compat.h>
L
Linus Torvalds 已提交
59 60 61 62
#include <linux/if.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
J
Jason Wang 已提交
63
#include <linux/if_vlan.h>
L
Linus Torvalds 已提交
64
#include <linux/crc32.h>
65
#include <linux/nsproxy.h>
66
#include <linux/virtio_net.h>
M
Michael S. Tsirkin 已提交
67
#include <linux/rcupdate.h>
68
#include <net/net_namespace.h>
69
#include <net/netns/generic.h>
70
#include <net/rtnetlink.h>
71
#include <net/sock.h>
72
#include <linux/seq_file.h>
H
Herbert Xu 已提交
73
#include <linux/uio.h>
L
Linus Torvalds 已提交
74 75 76

#include <asm/uaccess.h>

77 78 79
/* Uncomment to enable debugging */
/* #define TUN_DEBUG 1 */

L
Linus Torvalds 已提交
80 81
#ifdef TUN_DEBUG
static int debug;
82

83 84 85 86 87 88 89 90 91 92
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (tun->debug)						\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (debug == 2)						\
		printk(level fmt, ##args);			\
} while (0)
93
#else
94 95 96 97 98 99 100 101 102 103
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (0)							\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (0)							\
		printk(level fmt, ##args);			\
} while (0)
104 105
#endif

106 107 108 109 110 111
/* TUN device flags */

/* IFF_ATTACH_QUEUE is never stored in device flags,
 * overload it to mean fasync when stored there.
 */
#define TUN_FASYNC	IFF_ATTACH_QUEUE
M
Michael S. Tsirkin 已提交
112 113
/* High bits in flags field are unused. */
#define TUN_VNET_LE     0x80000000
114 115

#define TUN_FEATURES (IFF_NO_PI | IFF_ONE_QUEUE | IFF_VNET_HDR | \
M
Michael S. Tsirkin 已提交
116
		      IFF_MULTI_QUEUE)
117 118
#define GOODCOPY_LEN 128

119 120 121 122 123 124 125
#define FLT_EXACT_COUNT 8
struct tap_filter {
	unsigned int    count;    /* Number of addrs. Zero means disabled */
	u32             mask[2];  /* Mask of the hashed addrs */
	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
};

S
stephen hemminger 已提交
126
/* DEFAULT_MAX_NUM_RSS_QUEUES were chosen to let the rx/tx queues allocated for
127 128 129
 * the netdevice to be fit in one page. So we can make sure the success of
 * memory allocation. TODO: increase the limit. */
#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
130
#define MAX_TAP_FLOWS  4096
J
Jason Wang 已提交
131

J
Jason Wang 已提交
132 133
#define TUN_FLOW_EXPIRE (3 * HZ)

J
Jason Wang 已提交
134
/* A tun_file connects an open character device to a tuntap netdevice. It
S
stephen hemminger 已提交
135
 * also contains all socket related structures (except sock_fprog and tap_filter)
J
Jason Wang 已提交
136 137
 * to serve as one transmit queue for tuntap device. The sock_fprog and
 * tap_filter were kept in tun_struct since they were used for filtering for the
R
Rami Rosen 已提交
138
 * netdevice not for a specific queue (at least I didn't see the requirement for
J
Jason Wang 已提交
139
 * this).
140 141
 *
 * RCU usage:
R
Rami Rosen 已提交
142
 * The tun_file and tun_struct are loosely coupled, the pointer from one to the
143
 * other can only be read while rcu_read_lock or rtnl_lock is held.
J
Jason Wang 已提交
144
 */
E
Eric W. Biederman 已提交
145
struct tun_file {
J
Jason Wang 已提交
146 147 148
	struct sock sk;
	struct socket socket;
	struct socket_wq wq;
149
	struct tun_struct __rcu *tun;
E
Eric W. Biederman 已提交
150
	struct net *net;
J
Jason Wang 已提交
151 152 153
	struct fasync_struct *fasync;
	/* only used for fasnyc */
	unsigned int flags;
154 155 156 157
	union {
		u16 queue_index;
		unsigned int ifindex;
	};
J
Jason Wang 已提交
158 159
	struct list_head next;
	struct tun_struct *detached;
E
Eric W. Biederman 已提交
160 161
};

J
Jason Wang 已提交
162 163 164 165 166 167
struct tun_flow_entry {
	struct hlist_node hash_link;
	struct rcu_head rcu;
	struct tun_struct *tun;

	u32 rxhash;
168
	u32 rps_rxhash;
J
Jason Wang 已提交
169 170 171 172 173 174
	int queue_index;
	unsigned long updated;
};

#define TUN_NUM_FLOW_ENTRIES 1024

J
Jason Wang 已提交
175
/* Since the socket were moved to tun_file, to preserve the behavior of persist
R
Rami Rosen 已提交
176
 * device, socket filter, sndbuf and vnet header size were restore when the
J
Jason Wang 已提交
177 178
 * file were attached to a persist device.
 */
179
struct tun_struct {
J
Jason Wang 已提交
180 181
	struct tun_file __rcu	*tfiles[MAX_TAP_QUEUES];
	unsigned int            numqueues;
182
	unsigned int 		flags;
183 184
	kuid_t			owner;
	kgid_t			group;
185 186

	struct net_device	*dev;
187
	netdev_features_t	set_features;
188
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
189
			  NETIF_F_TSO6)
190 191

	int			vnet_hdr_sz;
J
Jason Wang 已提交
192 193 194 195 196
	int			sndbuf;
	struct tap_filter	txflt;
	struct sock_fprog	fprog;
	/* protected by rtnl lock */
	bool			filter_attached;
197 198
#ifdef TUN_DEBUG
	int debug;
L
Linus Torvalds 已提交
199
#endif
J
Jason Wang 已提交
200 201 202 203
	spinlock_t lock;
	struct hlist_head flows[TUN_NUM_FLOW_ENTRIES];
	struct timer_list flow_gc_timer;
	unsigned long ageing_time;
J
Jason Wang 已提交
204 205
	unsigned int numdisabled;
	struct list_head disabled;
206
	void *security;
207
	u32 flow_count;
208
};
L
Linus Torvalds 已提交
209

210 211
static inline u16 tun16_to_cpu(struct tun_struct *tun, __virtio16 val)
{
M
Michael S. Tsirkin 已提交
212
	return __virtio16_to_cpu(tun->flags & TUN_VNET_LE, val);
213 214 215 216
}

static inline __virtio16 cpu_to_tun16(struct tun_struct *tun, u16 val)
{
M
Michael S. Tsirkin 已提交
217
	return __cpu_to_virtio16(tun->flags & TUN_VNET_LE, val);
218 219
}

J
Jason Wang 已提交
220 221 222 223 224 225 226 227 228
static inline u32 tun_hashfn(u32 rxhash)
{
	return rxhash & 0x3ff;
}

static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash)
{
	struct tun_flow_entry *e;

229
	hlist_for_each_entry_rcu(e, head, hash_link) {
J
Jason Wang 已提交
230 231 232 233 234 235 236 237 238 239
		if (e->rxhash == rxhash)
			return e;
	}
	return NULL;
}

static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
					      struct hlist_head *head,
					      u32 rxhash, u16 queue_index)
{
240 241
	struct tun_flow_entry *e = kmalloc(sizeof(*e), GFP_ATOMIC);

J
Jason Wang 已提交
242 243 244 245 246
	if (e) {
		tun_debug(KERN_INFO, tun, "create flow: hash %u index %u\n",
			  rxhash, queue_index);
		e->updated = jiffies;
		e->rxhash = rxhash;
247
		e->rps_rxhash = 0;
J
Jason Wang 已提交
248 249 250
		e->queue_index = queue_index;
		e->tun = tun;
		hlist_add_head_rcu(&e->hash_link, head);
251
		++tun->flow_count;
J
Jason Wang 已提交
252 253 254 255 256 257 258 259
	}
	return e;
}

static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
{
	tun_debug(KERN_INFO, tun, "delete flow: hash %u index %u\n",
		  e->rxhash, e->queue_index);
260
	sock_rps_reset_flow_hash(e->rps_rxhash);
J
Jason Wang 已提交
261
	hlist_del_rcu(&e->hash_link);
262
	kfree_rcu(e, rcu);
263
	--tun->flow_count;
J
Jason Wang 已提交
264 265 266 267 268 269 270 271 272
}

static void tun_flow_flush(struct tun_struct *tun)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
273
		struct hlist_node *n;
J
Jason Wang 已提交
274

275
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link)
J
Jason Wang 已提交
276 277 278 279 280 281 282 283 284 285 286 287
			tun_flow_delete(tun, e);
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
288
		struct hlist_node *n;
J
Jason Wang 已提交
289

290
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
J
Jason Wang 已提交
291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310
			if (e->queue_index == queue_index)
				tun_flow_delete(tun, e);
		}
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_cleanup(unsigned long data)
{
	struct tun_struct *tun = (struct tun_struct *)data;
	unsigned long delay = tun->ageing_time;
	unsigned long next_timer = jiffies + delay;
	unsigned long count = 0;
	int i;

	tun_debug(KERN_INFO, tun, "tun_flow_cleanup\n");

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
311
		struct hlist_node *n;
J
Jason Wang 已提交
312

313
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
J
Jason Wang 已提交
314 315 316 317 318 319 320 321 322 323 324 325 326 327 328
			unsigned long this_timer;
			count++;
			this_timer = e->updated + delay;
			if (time_before_eq(this_timer, jiffies))
				tun_flow_delete(tun, e);
			else if (time_before(this_timer, next_timer))
				next_timer = this_timer;
		}
	}

	if (count)
		mod_timer(&tun->flow_gc_timer, round_jiffies_up(next_timer));
	spin_unlock_bh(&tun->lock);
}

329
static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
330
			    struct tun_file *tfile)
J
Jason Wang 已提交
331 332 333 334
{
	struct hlist_head *head;
	struct tun_flow_entry *e;
	unsigned long delay = tun->ageing_time;
335
	u16 queue_index = tfile->queue_index;
J
Jason Wang 已提交
336 337 338 339 340 341 342 343

	if (!rxhash)
		return;
	else
		head = &tun->flows[tun_hashfn(rxhash)];

	rcu_read_lock();

344 345 346
	/* We may get a very small possibility of OOO during switching, not
	 * worth to optimize.*/
	if (tun->numqueues == 1 || tfile->detached)
J
Jason Wang 已提交
347 348 349 350 351 352 353
		goto unlock;

	e = tun_flow_find(head, rxhash);
	if (likely(e)) {
		/* TODO: keep queueing to old queue until it's empty? */
		e->queue_index = queue_index;
		e->updated = jiffies;
354
		sock_rps_record_flow_hash(e->rps_rxhash);
J
Jason Wang 已提交
355 356
	} else {
		spin_lock_bh(&tun->lock);
357 358
		if (!tun_flow_find(head, rxhash) &&
		    tun->flow_count < MAX_TAP_FLOWS)
J
Jason Wang 已提交
359 360 361 362 363 364 365 366 367 368 369 370
			tun_flow_create(tun, head, rxhash, queue_index);

		if (!timer_pending(&tun->flow_gc_timer))
			mod_timer(&tun->flow_gc_timer,
				  round_jiffies_up(jiffies + delay));
		spin_unlock_bh(&tun->lock);
	}

unlock:
	rcu_read_unlock();
}

371 372 373 374 375 376 377 378 379 380 381 382
/**
 * Save the hash received in the stack receive path and update the
 * flow_hash table accordingly.
 */
static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash)
{
	if (unlikely(e->rps_rxhash != hash)) {
		sock_rps_reset_flow_hash(e->rps_rxhash);
		e->rps_rxhash = hash;
	}
}

J
Jason Wang 已提交
383
/* We try to identify a flow through its rxhash first. The reason that
S
stephen hemminger 已提交
384
 * we do not check rxq no. is because some cards(e.g 82599), chooses
J
Jason Wang 已提交
385 386 387 388 389
 * the rxq based on the txq where the last packet of the flow comes. As
 * the userspace application move between processors, we may get a
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
390
static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
391
			    void *accel_priv, select_queue_fallback_t fallback)
J
Jason Wang 已提交
392 393
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
394
	struct tun_flow_entry *e;
J
Jason Wang 已提交
395 396 397 398
	u32 txq = 0;
	u32 numqueues = 0;

	rcu_read_lock();
399
	numqueues = ACCESS_ONCE(tun->numqueues);
J
Jason Wang 已提交
400

401
	txq = skb_get_hash(skb);
J
Jason Wang 已提交
402
	if (txq) {
J
Jason Wang 已提交
403
		e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
404 405
		if (e) {
			tun_flow_save_rps_rxhash(e, txq);
406
			txq = e->queue_index;
407
		} else
J
Jason Wang 已提交
408 409
			/* use multiply and shift instead of expensive divide */
			txq = ((u64)txq * numqueues) >> 32;
J
Jason Wang 已提交
410 411 412 413 414 415 416 417 418 419
	} else if (likely(skb_rx_queue_recorded(skb))) {
		txq = skb_get_rx_queue(skb);
		while (unlikely(txq >= numqueues))
			txq -= numqueues;
	}

	rcu_read_unlock();
	return txq;
}

420 421 422
static inline bool tun_not_capable(struct tun_struct *tun)
{
	const struct cred *cred = current_cred();
423
	struct net *net = dev_net(tun->dev);
424 425 426

	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
		  (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
427
		!ns_capable(net->user_ns, CAP_NET_ADMIN);
428 429
}

J
Jason Wang 已提交
430 431 432 433 434 435
static void tun_set_real_num_queues(struct tun_struct *tun)
{
	netif_set_real_num_tx_queues(tun->dev, tun->numqueues);
	netif_set_real_num_rx_queues(tun->dev, tun->numqueues);
}

J
Jason Wang 已提交
436 437 438 439 440 441 442
static void tun_disable_queue(struct tun_struct *tun, struct tun_file *tfile)
{
	tfile->detached = tun;
	list_add_tail(&tfile->next, &tun->disabled);
	++tun->numdisabled;
}

J
Jason Wang 已提交
443
static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
J
Jason Wang 已提交
444 445 446 447 448 449 450 451 452
{
	struct tun_struct *tun = tfile->detached;

	tfile->detached = NULL;
	list_del_init(&tfile->next);
	--tun->numdisabled;
	return tun;
}

453 454 455 456 457 458
static void tun_queue_purge(struct tun_file *tfile)
{
	skb_queue_purge(&tfile->sk.sk_receive_queue);
	skb_queue_purge(&tfile->sk.sk_error_queue);
}

J
Jason Wang 已提交
459 460 461 462 463
static void __tun_detach(struct tun_file *tfile, bool clean)
{
	struct tun_file *ntfile;
	struct tun_struct *tun;

464 465
	tun = rtnl_dereference(tfile->tun);

466
	if (tun && !tfile->detached) {
J
Jason Wang 已提交
467 468 469 470 471
		u16 index = tfile->queue_index;
		BUG_ON(index >= tun->numqueues);

		rcu_assign_pointer(tun->tfiles[index],
				   tun->tfiles[tun->numqueues - 1]);
472
		ntfile = rtnl_dereference(tun->tfiles[index]);
J
Jason Wang 已提交
473 474 475
		ntfile->queue_index = index;

		--tun->numqueues;
476
		if (clean) {
477
			RCU_INIT_POINTER(tfile->tun, NULL);
J
Jason Wang 已提交
478
			sock_put(&tfile->sk);
479
		} else
J
Jason Wang 已提交
480
			tun_disable_queue(tun, tfile);
J
Jason Wang 已提交
481 482

		synchronize_net();
J
Jason Wang 已提交
483
		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
J
Jason Wang 已提交
484
		/* Drop read queue */
485
		tun_queue_purge(tfile);
J
Jason Wang 已提交
486
		tun_set_real_num_queues(tun);
J
Jason Wang 已提交
487
	} else if (tfile->detached && clean) {
J
Jason Wang 已提交
488
		tun = tun_enable_queue(tfile);
J
Jason Wang 已提交
489 490
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
491 492

	if (clean) {
493 494 495
		if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
			netif_carrier_off(tun->dev);

M
Michael S. Tsirkin 已提交
496
			if (!(tun->flags & IFF_PERSIST) &&
497
			    tun->dev->reg_state == NETREG_REGISTERED)
J
Jason Wang 已提交
498
				unregister_netdevice(tun->dev);
499
		}
J
Jason Wang 已提交
500

J
Jason Wang 已提交
501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516
		BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
				 &tfile->socket.flags));
		sk_release_kernel(&tfile->sk);
	}
}

static void tun_detach(struct tun_file *tfile, bool clean)
{
	rtnl_lock();
	__tun_detach(tfile, clean);
	rtnl_unlock();
}

static void tun_detach_all(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
517
	struct tun_file *tfile, *tmp;
J
Jason Wang 已提交
518 519 520
	int i, n = tun->numqueues;

	for (i = 0; i < n; i++) {
521
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
522
		BUG_ON(!tfile);
523
		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
524
		RCU_INIT_POINTER(tfile->tun, NULL);
J
Jason Wang 已提交
525 526
		--tun->numqueues;
	}
527
	list_for_each_entry(tfile, &tun->disabled, next) {
528
		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
529
		RCU_INIT_POINTER(tfile->tun, NULL);
530
	}
J
Jason Wang 已提交
531 532 533 534
	BUG_ON(tun->numqueues != 0);

	synchronize_net();
	for (i = 0; i < n; i++) {
535
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
536
		/* Drop read queue */
537
		tun_queue_purge(tfile);
J
Jason Wang 已提交
538 539
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
540 541
	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
		tun_enable_queue(tfile);
542
		tun_queue_purge(tfile);
J
Jason Wang 已提交
543 544 545
		sock_put(&tfile->sk);
	}
	BUG_ON(tun->numdisabled != 0);
J
Jason Wang 已提交
546

M
Michael S. Tsirkin 已提交
547
	if (tun->flags & IFF_PERSIST)
J
Jason Wang 已提交
548
		module_put(THIS_MODULE);
J
Jason Wang 已提交
549 550
}

551
static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filter)
552
{
E
Eric W. Biederman 已提交
553
	struct tun_file *tfile = file->private_data;
554
	int err;
555

556 557 558 559
	err = security_tun_dev_attach(tfile->socket.sk, tun->security);
	if (err < 0)
		goto out;

560
	err = -EINVAL;
561
	if (rtnl_dereference(tfile->tun) && !tfile->detached)
562 563 564
		goto out;

	err = -EBUSY;
M
Michael S. Tsirkin 已提交
565
	if (!(tun->flags & IFF_MULTI_QUEUE) && tun->numqueues == 1)
J
Jason Wang 已提交
566 567 568
		goto out;

	err = -E2BIG;
J
Jason Wang 已提交
569 570
	if (!tfile->detached &&
	    tun->numqueues + tun->numdisabled == MAX_TAP_QUEUES)
571 572 573
		goto out;

	err = 0;
J
Jason Wang 已提交
574

S
stephen hemminger 已提交
575
	/* Re-attach the filter to persist device */
576
	if (!skip_filter && (tun->filter_attached == true)) {
J
Jason Wang 已提交
577 578 579 580
		err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (!err)
			goto out;
	}
J
Jason Wang 已提交
581
	tfile->queue_index = tun->numqueues;
582
	rcu_assign_pointer(tfile->tun, tun);
J
Jason Wang 已提交
583 584
	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
	tun->numqueues++;
585

J
Jason Wang 已提交
586 587 588 589 590
	if (tfile->detached)
		tun_enable_queue(tfile);
	else
		sock_hold(&tfile->sk);

J
Jason Wang 已提交
591
	tun_set_real_num_queues(tun);
592

J
Jason Wang 已提交
593 594 595 596 597 598
	/* device is allowed to go away first, so no need to hold extra
	 * refcnt.
	 */

out:
	return err;
E
Eric W. Biederman 已提交
599 600 601 602
}

static struct tun_struct *__tun_get(struct tun_file *tfile)
{
603
	struct tun_struct *tun;
604

605 606 607 608 609
	rcu_read_lock();
	tun = rcu_dereference(tfile->tun);
	if (tun)
		dev_hold(tun->dev);
	rcu_read_unlock();
610 611

	return tun;
E
Eric W. Biederman 已提交
612 613 614 615 616 617 618 619 620
}

static struct tun_struct *tun_get(struct file *file)
{
	return __tun_get(file->private_data);
}

static void tun_put(struct tun_struct *tun)
{
621
	dev_put(tun->dev);
E
Eric W. Biederman 已提交
622 623
}

624
/* TAP filtering */
625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673
static void addr_hash_set(u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	mask[n >> 5] |= (1 << (n & 31));
}

static unsigned int addr_hash_test(const u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	return mask[n >> 5] & (1 << (n & 31));
}

static int update_filter(struct tap_filter *filter, void __user *arg)
{
	struct { u8 u[ETH_ALEN]; } *addr;
	struct tun_filter uf;
	int err, alen, n, nexact;

	if (copy_from_user(&uf, arg, sizeof(uf)))
		return -EFAULT;

	if (!uf.count) {
		/* Disabled */
		filter->count = 0;
		return 0;
	}

	alen = ETH_ALEN * uf.count;
	addr = kmalloc(alen, GFP_KERNEL);
	if (!addr)
		return -ENOMEM;

	if (copy_from_user(addr, arg + sizeof(uf), alen)) {
		err = -EFAULT;
		goto done;
	}

	/* The filter is updated without holding any locks. Which is
	 * perfectly safe. We disable it first and in the worst
	 * case we'll accept a few undesired packets. */
	filter->count = 0;
	wmb();

	/* Use first set of addresses as an exact filter */
	for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++)
		memcpy(filter->addr[n], addr[n].u, ETH_ALEN);

	nexact = n;

674 675
	/* Remaining multicast addresses are hashed,
	 * unicast will leave the filter disabled. */
676
	memset(filter->mask, 0, sizeof(filter->mask));
677 678 679 680 681
	for (; n < uf.count; n++) {
		if (!is_multicast_ether_addr(addr[n].u)) {
			err = 0; /* no filter */
			goto done;
		}
682
		addr_hash_set(filter->mask, addr[n].u);
683
	}
684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711

	/* For ALLMULTI just set the mask to all ones.
	 * This overrides the mask populated above. */
	if ((uf.flags & TUN_FLT_ALLMULTI))
		memset(filter->mask, ~0, sizeof(filter->mask));

	/* Now enable the filter */
	wmb();
	filter->count = nexact;

	/* Return the number of exact filters */
	err = nexact;

done:
	kfree(addr);
	return err;
}

/* Returns: 0 - drop, !=0 - accept */
static int run_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	/* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect
	 * at this point. */
	struct ethhdr *eh = (struct ethhdr *) skb->data;
	int i;

	/* Exact match */
	for (i = 0; i < filter->count; i++)
712
		if (ether_addr_equal(eh->h_dest, filter->addr[i]))
713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733
			return 1;

	/* Inexact match (multicast only) */
	if (is_multicast_ether_addr(eh->h_dest))
		return addr_hash_test(filter->mask, eh->h_dest);

	return 0;
}

/*
 * Checks whether the packet is accepted or not.
 * Returns: 0 - drop, !=0 - accept
 */
static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	if (!filter->count)
		return 1;

	return run_filter(filter, skb);
}

L
Linus Torvalds 已提交
734 735
/* Network device part of the driver */

736
static const struct ethtool_ops tun_ethtool_ops;
L
Linus Torvalds 已提交
737

738 739 740
/* Net device detach from fd. */
static void tun_net_uninit(struct net_device *dev)
{
J
Jason Wang 已提交
741
	tun_detach_all(dev);
742 743
}

L
Linus Torvalds 已提交
744 745 746
/* Net device open. */
static int tun_net_open(struct net_device *dev)
{
J
Jason Wang 已提交
747
	netif_tx_start_all_queues(dev);
L
Linus Torvalds 已提交
748 749 750 751 752 753
	return 0;
}

/* Net device close. */
static int tun_net_close(struct net_device *dev)
{
J
Jason Wang 已提交
754
	netif_tx_stop_all_queues(dev);
L
Linus Torvalds 已提交
755 756 757 758
	return 0;
}

/* Net device start xmit */
759
static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
L
Linus Torvalds 已提交
760 761
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
762
	int txq = skb->queue_mapping;
763
	struct tun_file *tfile;
764
	u32 numqueues = 0;
L
Linus Torvalds 已提交
765

766
	rcu_read_lock();
J
Jason Wang 已提交
767
	tfile = rcu_dereference(tun->tfiles[txq]);
768
	numqueues = ACCESS_ONCE(tun->numqueues);
J
Jason Wang 已提交
769

L
Linus Torvalds 已提交
770
	/* Drop packet if interface is not attached */
771
	if (txq >= numqueues)
L
Linus Torvalds 已提交
772 773
		goto drop;

774
	if (numqueues == 1) {
775 776 777 778 779 780 781 782 783 784 785 786 787 788 789
		/* Select queue was not called for the skbuff, so we extract the
		 * RPS hash and save it into the flow_table here.
		 */
		__u32 rxhash;

		rxhash = skb_get_hash(skb);
		if (rxhash) {
			struct tun_flow_entry *e;
			e = tun_flow_find(&tun->flows[tun_hashfn(rxhash)],
					rxhash);
			if (e)
				tun_flow_save_rps_rxhash(e, rxhash);
		}
	}

790 791
	tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len);

J
Jason Wang 已提交
792 793
	BUG_ON(!tfile);

794 795 796 797 798 799
	/* Drop if the filter does not like it.
	 * This is a noop if the filter is disabled.
	 * Filter can be enabled only for the TAP devices. */
	if (!check_filter(&tun->txflt, skb))
		goto drop;

J
Jason Wang 已提交
800 801
	if (tfile->socket.sk->sk_filter &&
	    sk_filter(tfile->socket.sk, skb))
M
Michael S. Tsirkin 已提交
802 803
		goto drop;

R
Rami Rosen 已提交
804
	/* Limit the number of packets queued by dividing txq length with the
J
Jason Wang 已提交
805 806
	 * number of queues.
	 */
807 808
	if (skb_queue_len(&tfile->socket.sk->sk_receive_queue) * numqueues
			  >= dev->tx_queue_len)
809
		goto drop;
L
Linus Torvalds 已提交
810

811 812 813
	if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
		goto drop;

814 815 816 817 818
	if (skb->sk) {
		sock_tx_timestamp(skb->sk, &skb_shinfo(skb)->tx_flags);
		sw_tx_timestamp(skb);
	}

M
Michael S. Tsirkin 已提交
819
	/* Orphan the skb - required as we might hang on to it
820 821
	 * for indefinite time.
	 */
M
Michael S. Tsirkin 已提交
822 823
	skb_orphan(skb);

824 825
	nf_reset(skb);

826
	/* Enqueue packet */
J
Jason Wang 已提交
827
	skb_queue_tail(&tfile->socket.sk->sk_receive_queue, skb);
L
Linus Torvalds 已提交
828 829

	/* Notify and wake up reader process */
J
Jason Wang 已提交
830 831
	if (tfile->flags & TUN_FASYNC)
		kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
832
	tfile->socket.sk->sk_data_ready(tfile->socket.sk);
833 834

	rcu_read_unlock();
835
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
836 837

drop:
838
	dev->stats.tx_dropped++;
839
	skb_tx_error(skb);
L
Linus Torvalds 已提交
840
	kfree_skb(skb);
841
	rcu_read_unlock();
842
	return NET_XMIT_DROP;
L
Linus Torvalds 已提交
843 844
}

845
static void tun_net_mclist(struct net_device *dev)
L
Linus Torvalds 已提交
846
{
847 848 849 850 851
	/*
	 * This callback is supposed to deal with mc filter in
	 * _rx_ path and has nothing to do with the _tx_ path.
	 * In rx path we always accept everything userspace gives us.
	 */
L
Linus Torvalds 已提交
852 853
}

E
Ed Swierk 已提交
854 855 856 857 858 859 860 861 862 863 864 865
#define MIN_MTU 68
#define MAX_MTU 65535

static int
tun_net_change_mtu(struct net_device *dev, int new_mtu)
{
	if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU)
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

866 867
static netdev_features_t tun_net_fix_features(struct net_device *dev,
	netdev_features_t features)
868 869 870 871 872
{
	struct tun_struct *tun = netdev_priv(dev);

	return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
}
873 874 875 876 877 878 879
#ifdef CONFIG_NET_POLL_CONTROLLER
static void tun_poll_controller(struct net_device *dev)
{
	/*
	 * Tun only receives frames when:
	 * 1) the char device endpoint gets data from user space
	 * 2) the tun socket gets a sendmsg call from user space
S
stephen hemminger 已提交
880
	 * Since both of those are synchronous operations, we are guaranteed
881
	 * never to have pending data when we poll for it
S
stephen hemminger 已提交
882
	 * so there is nothing to do here but return.
883 884 885 886 887 888 889
	 * We need this though so netpoll recognizes us as an interface that
	 * supports polling, which enables bridge devices in virt setups to
	 * still use netconsole
	 */
	return;
}
#endif
S
Stephen Hemminger 已提交
890
static const struct net_device_ops tun_netdev_ops = {
891
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
892 893
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
894
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
895
	.ndo_change_mtu		= tun_net_change_mtu,
896
	.ndo_fix_features	= tun_net_fix_features,
J
Jason Wang 已提交
897
	.ndo_select_queue	= tun_select_queue,
898 899 900
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
901 902 903
};

static const struct net_device_ops tap_netdev_ops = {
904
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
905 906
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
907
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
908
	.ndo_change_mtu		= tun_net_change_mtu,
909
	.ndo_fix_features	= tun_net_fix_features,
910
	.ndo_set_rx_mode	= tun_net_mclist,
S
Stephen Hemminger 已提交
911 912
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
J
Jason Wang 已提交
913
	.ndo_select_queue	= tun_select_queue,
914 915 916
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
917 918
};

919
static void tun_flow_init(struct tun_struct *tun)
J
Jason Wang 已提交
920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937
{
	int i;

	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++)
		INIT_HLIST_HEAD(&tun->flows[i]);

	tun->ageing_time = TUN_FLOW_EXPIRE;
	setup_timer(&tun->flow_gc_timer, tun_flow_cleanup, (unsigned long)tun);
	mod_timer(&tun->flow_gc_timer,
		  round_jiffies_up(jiffies + tun->ageing_time));
}

static void tun_flow_uninit(struct tun_struct *tun)
{
	del_timer_sync(&tun->flow_gc_timer);
	tun_flow_flush(tun);
}

L
Linus Torvalds 已提交
938 939 940 941
/* Initialize net device. */
static void tun_net_init(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
942

L
Linus Torvalds 已提交
943
	switch (tun->flags & TUN_TYPE_MASK) {
M
Michael S. Tsirkin 已提交
944
	case IFF_TUN:
S
Stephen Hemminger 已提交
945 946
		dev->netdev_ops = &tun_netdev_ops;

L
Linus Torvalds 已提交
947 948 949 950 951 952
		/* Point-to-Point TUN Device */
		dev->hard_header_len = 0;
		dev->addr_len = 0;
		dev->mtu = 1500;

		/* Zero header length */
953
		dev->type = ARPHRD_NONE;
L
Linus Torvalds 已提交
954 955 956 957
		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;

M
Michael S. Tsirkin 已提交
958
	case IFF_TAP:
K
Kusanagi Kouichi 已提交
959
		dev->netdev_ops = &tap_netdev_ops;
L
Linus Torvalds 已提交
960 961
		/* Ethernet TAP Device */
		ether_setup(dev);
962
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
963
		dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
964

965
		eth_hw_addr_random(dev);
966

L
Linus Torvalds 已提交
967 968 969 970 971 972 973 974
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;
	}
}

/* Character device part */

/* Poll */
J
Jason Wang 已提交
975
static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
976
{
977 978
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
979
	struct sock *sk;
980
	unsigned int mask = 0;
L
Linus Torvalds 已提交
981 982

	if (!tun)
983
		return POLLERR;
L
Linus Torvalds 已提交
984

J
Jason Wang 已提交
985
	sk = tfile->socket.sk;
986

987
	tun_debug(KERN_INFO, tun, "tun_chr_poll\n");
L
Linus Torvalds 已提交
988

989
	poll_wait(file, sk_sleep(sk), wait);
990

991
	if (!skb_queue_empty(&sk->sk_receive_queue))
L
Linus Torvalds 已提交
992 993
		mask |= POLLIN | POLLRDNORM;

994 995 996 997 998
	if (sock_writeable(sk) ||
	    (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
	     sock_writeable(sk)))
		mask |= POLLOUT | POLLWRNORM;

999 1000 1001
	if (tun->dev->reg_state != NETREG_REGISTERED)
		mask = POLLERR;

E
Eric W. Biederman 已提交
1002
	tun_put(tun);
L
Linus Torvalds 已提交
1003 1004 1005
	return mask;
}

1006 1007
/* prepad is the amount to reserve at front.  len is length after that.
 * linear is a hint as to how much to copy (usually headers). */
J
Jason Wang 已提交
1008
static struct sk_buff *tun_alloc_skb(struct tun_file *tfile,
1009 1010
				     size_t prepad, size_t len,
				     size_t linear, int noblock)
1011
{
J
Jason Wang 已提交
1012
	struct sock *sk = tfile->socket.sk;
1013
	struct sk_buff *skb;
1014
	int err;
1015 1016

	/* Under a page?  Don't bother with paged skb. */
H
Herbert Xu 已提交
1017
	if (prepad + len < PAGE_SIZE || !linear)
1018
		linear = len;
1019

1020
	skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
1021
				   &err, 0);
1022
	if (!skb)
1023
		return ERR_PTR(err);
1024 1025 1026

	skb_reserve(skb, prepad);
	skb_put(skb, linear);
1027 1028
	skb->data_len = len - linear;
	skb->len += len - linear;
1029 1030 1031 1032

	return skb;
}

L
Linus Torvalds 已提交
1033
/* Get packet from user space buffer */
J
Jason Wang 已提交
1034
static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
1035 1036
			    void *msg_control, struct iov_iter *from,
			    int noblock)
L
Linus Torvalds 已提交
1037
{
1038
	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
L
Linus Torvalds 已提交
1039
	struct sk_buff *skb;
1040
	size_t total_len = iov_iter_count(from);
1041
	size_t len = total_len, align = NET_SKB_PAD, linear;
1042
	struct virtio_net_hdr gso = { 0 };
1043
	int good_linear;
1044 1045 1046
	int copylen;
	bool zerocopy = false;
	int err;
1047
	u32 rxhash;
1048
	ssize_t n;
L
Linus Torvalds 已提交
1049

M
Michael S. Tsirkin 已提交
1050
	if (!(tun->flags & IFF_NO_PI)) {
1051
		if (len < sizeof(pi))
L
Linus Torvalds 已提交
1052
			return -EINVAL;
1053
		len -= sizeof(pi);
L
Linus Torvalds 已提交
1054

1055 1056
		n = copy_from_iter(&pi, sizeof(pi), from);
		if (n != sizeof(pi))
L
Linus Torvalds 已提交
1057 1058 1059
			return -EFAULT;
	}

M
Michael S. Tsirkin 已提交
1060
	if (tun->flags & IFF_VNET_HDR) {
1061
		if (len < tun->vnet_hdr_sz)
1062
			return -EINVAL;
1063
		len -= tun->vnet_hdr_sz;
1064

1065 1066
		n = copy_from_iter(&gso, sizeof(gso), from);
		if (n != sizeof(gso))
1067 1068
			return -EFAULT;

1069
		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
1070 1071
		    tun16_to_cpu(tun, gso.csum_start) + tun16_to_cpu(tun, gso.csum_offset) + 2 > tun16_to_cpu(tun, gso.hdr_len))
			gso.hdr_len = cpu_to_tun16(tun, tun16_to_cpu(tun, gso.csum_start) + tun16_to_cpu(tun, gso.csum_offset) + 2);
1072

1073
		if (tun16_to_cpu(tun, gso.hdr_len) > len)
1074
			return -EINVAL;
1075
		iov_iter_advance(from, tun->vnet_hdr_sz - sizeof(gso));
1076 1077
	}

M
Michael S. Tsirkin 已提交
1078
	if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP) {
1079
		align += NET_IP_ALIGN;
H
Herbert Xu 已提交
1080
		if (unlikely(len < ETH_HLEN ||
1081
			     (gso.hdr_len && tun16_to_cpu(tun, gso.hdr_len) < ETH_HLEN)))
1082 1083
			return -EINVAL;
	}
1084

1085 1086
	good_linear = SKB_MAX_HEAD(align);

1087
	if (msg_control) {
1088 1089
		struct iov_iter i = *from;

1090 1091
		/* There are 256 bytes to be copied in skb, so there is
		 * enough room for skb expand head in case it is used.
1092 1093
		 * The rest of the buffer is mapped from userspace.
		 */
1094
		copylen = gso.hdr_len ? tun16_to_cpu(tun, gso.hdr_len) : GOODCOPY_LEN;
1095 1096
		if (copylen > good_linear)
			copylen = good_linear;
1097
		linear = copylen;
1098 1099
		iov_iter_advance(&i, copylen);
		if (iov_iter_npages(&i, INT_MAX) <= MAX_SKB_FRAGS)
1100 1101 1102 1103
			zerocopy = true;
	}

	if (!zerocopy) {
1104
		copylen = len;
1105
		if (tun16_to_cpu(tun, gso.hdr_len) > good_linear)
1106 1107
			linear = good_linear;
		else
1108
			linear = tun16_to_cpu(tun, gso.hdr_len);
1109
	}
1110

1111
	skb = tun_alloc_skb(tfile, align, copylen, linear, noblock);
1112 1113 1114 1115
	if (IS_ERR(skb)) {
		if (PTR_ERR(skb) != -EAGAIN)
			tun->dev->stats.rx_dropped++;
		return PTR_ERR(skb);
L
Linus Torvalds 已提交
1116 1117
	}

1118
	if (zerocopy)
1119
		err = zerocopy_sg_from_iter(skb, from);
1120
	else {
1121
		err = skb_copy_datagram_from_iter(skb, 0, from, len);
1122 1123 1124 1125 1126
		if (!err && msg_control) {
			struct ubuf_info *uarg = msg_control;
			uarg->callback(uarg, false);
		}
	}
1127 1128

	if (err) {
1129
		tun->dev->stats.rx_dropped++;
D
Dave Jones 已提交
1130
		kfree_skb(skb);
L
Linus Torvalds 已提交
1131
		return -EFAULT;
D
Dave Jones 已提交
1132
	}
L
Linus Torvalds 已提交
1133

1134
	if (gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
1135 1136
		if (!skb_partial_csum_set(skb, tun16_to_cpu(tun, gso.csum_start),
					  tun16_to_cpu(tun, gso.csum_offset))) {
1137 1138 1139 1140
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}
1141
	}
1142

L
Linus Torvalds 已提交
1143
	switch (tun->flags & TUN_TYPE_MASK) {
M
Michael S. Tsirkin 已提交
1144 1145
	case IFF_TUN:
		if (tun->flags & IFF_NO_PI) {
1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159
			switch (skb->data[0] & 0xf0) {
			case 0x40:
				pi.proto = htons(ETH_P_IP);
				break;
			case 0x60:
				pi.proto = htons(ETH_P_IPV6);
				break;
			default:
				tun->dev->stats.rx_dropped++;
				kfree_skb(skb);
				return -EINVAL;
			}
		}

1160
		skb_reset_mac_header(skb);
L
Linus Torvalds 已提交
1161
		skb->protocol = pi.proto;
1162
		skb->dev = tun->dev;
L
Linus Torvalds 已提交
1163
		break;
M
Michael S. Tsirkin 已提交
1164
	case IFF_TAP:
L
Linus Torvalds 已提交
1165 1166
		skb->protocol = eth_type_trans(skb, tun->dev);
		break;
1167
	}
L
Linus Torvalds 已提交
1168

1169 1170 1171 1172
	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
		pr_debug("GSO!\n");
		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		case VIRTIO_NET_HDR_GSO_TCPV4:
1173
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
1174 1175
			break;
		case VIRTIO_NET_HDR_GSO_TCPV6:
1176
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
1177
			break;
1178
		case VIRTIO_NET_HDR_GSO_UDP:
1179 1180 1181 1182 1183 1184 1185 1186 1187
		{
			static bool warned;

			if (!warned) {
				warned = true;
				netdev_warn(tun->dev,
					    "%s: using disabled UFO feature; please fix this program\n",
					    current->comm);
			}
1188
			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1189
			break;
1190
		}
1191 1192 1193 1194 1195 1196 1197
		default:
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
1198
			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
1199

1200
		skb_shinfo(skb)->gso_size = tun16_to_cpu(tun, gso.gso_size);
1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
		if (skb_shinfo(skb)->gso_size == 0) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		/* Header must be checked, and gso_segs computed. */
		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
		skb_shinfo(skb)->gso_segs = 0;
	}
1211

1212 1213 1214 1215
	/* copy skb_ubuf_info for callback when skb has no error */
	if (zerocopy) {
		skb_shinfo(skb)->destructor_arg = msg_control;
		skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
1216
		skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
1217 1218
	}

1219
	skb_reset_network_header(skb);
1220
	skb_probe_transport_header(skb, 0);
1221

1222
	rxhash = skb_get_hash(skb);
L
Linus Torvalds 已提交
1223
	netif_rx_ni(skb);
1224

1225 1226
	tun->dev->stats.rx_packets++;
	tun->dev->stats.rx_bytes += len;
L
Linus Torvalds 已提交
1227

1228
	tun_flow_update(tun, rxhash, tfile);
1229
	return total_len;
1230
}
L
Linus Torvalds 已提交
1231

1232
static ssize_t tun_chr_write_iter(struct kiocb *iocb, struct iov_iter *from)
L
Linus Torvalds 已提交
1233
{
1234
	struct file *file = iocb->ki_filp;
H
Herbert Xu 已提交
1235
	struct tun_struct *tun = tun_get(file);
J
Jason Wang 已提交
1236
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1237
	ssize_t result;
L
Linus Torvalds 已提交
1238 1239 1240 1241

	if (!tun)
		return -EBADFD;

1242
	result = tun_get_user(tun, tfile, NULL, from, file->f_flags & O_NONBLOCK);
E
Eric W. Biederman 已提交
1243 1244 1245

	tun_put(tun);
	return result;
L
Linus Torvalds 已提交
1246 1247 1248
}

/* Put packet to the user space buffer */
1249
static ssize_t tun_put_user(struct tun_struct *tun,
J
Jason Wang 已提交
1250
			    struct tun_file *tfile,
1251
			    struct sk_buff *skb,
H
Herbert Xu 已提交
1252
			    struct iov_iter *iter)
L
Linus Torvalds 已提交
1253 1254
{
	struct tun_pi pi = { 0, skb->protocol };
H
Herbert Xu 已提交
1255
	ssize_t total;
1256
	int vlan_offset = 0;
1257
	int vlan_hlen = 0;
H
Herbert Xu 已提交
1258
	int vnet_hdr_sz = 0;
1259 1260 1261

	if (vlan_tx_tag_present(skb))
		vlan_hlen = VLAN_HLEN;
L
Linus Torvalds 已提交
1262

M
Michael S. Tsirkin 已提交
1263
	if (tun->flags & IFF_VNET_HDR)
H
Herbert Xu 已提交
1264
		vnet_hdr_sz = tun->vnet_hdr_sz;
L
Linus Torvalds 已提交
1265

H
Herbert Xu 已提交
1266 1267
	total = skb->len + vlan_hlen + vnet_hdr_sz;

M
Michael S. Tsirkin 已提交
1268
	if (!(tun->flags & IFF_NO_PI)) {
H
Herbert Xu 已提交
1269
		if (iov_iter_count(iter) < sizeof(pi))
L
Linus Torvalds 已提交
1270 1271
			return -EINVAL;

H
Herbert Xu 已提交
1272 1273
		total += sizeof(pi);
		if (iov_iter_count(iter) < total) {
L
Linus Torvalds 已提交
1274 1275 1276
			/* Packet will be striped */
			pi.flags |= TUN_PKT_STRIP;
		}
1277

H
Herbert Xu 已提交
1278
		if (copy_to_iter(&pi, sizeof(pi), iter) != sizeof(pi))
L
Linus Torvalds 已提交
1279
			return -EFAULT;
1280
	}
L
Linus Torvalds 已提交
1281

H
Herbert Xu 已提交
1282
	if (vnet_hdr_sz) {
1283
		struct virtio_net_hdr gso = { 0 }; /* no info leak */
H
Herbert Xu 已提交
1284
		if (iov_iter_count(iter) < vnet_hdr_sz)
1285 1286 1287 1288 1289 1290
			return -EINVAL;

		if (skb_is_gso(skb)) {
			struct skb_shared_info *sinfo = skb_shinfo(skb);

			/* This is a hint as to how much should be linear. */
1291 1292
			gso.hdr_len = cpu_to_tun16(tun, skb_headlen(skb));
			gso.gso_size = cpu_to_tun16(tun, sinfo->gso_size);
1293 1294 1295 1296
			if (sinfo->gso_type & SKB_GSO_TCPV4)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
			else if (sinfo->gso_type & SKB_GSO_TCPV6)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
1297
			else {
1298
				pr_err("unexpected GSO type: "
1299
				       "0x%x, gso_size %d, hdr_len %d\n",
1300 1301
				       sinfo->gso_type, tun16_to_cpu(tun, gso.gso_size),
				       tun16_to_cpu(tun, gso.hdr_len));
1302 1303 1304
				print_hex_dump(KERN_ERR, "tun: ",
					       DUMP_PREFIX_NONE,
					       16, 1, skb->head,
1305
					       min((int)tun16_to_cpu(tun, gso.hdr_len), 64), true);
1306 1307 1308
				WARN_ON_ONCE(1);
				return -EINVAL;
			}
1309 1310 1311 1312 1313 1314 1315
			if (sinfo->gso_type & SKB_GSO_TCP_ECN)
				gso.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
		} else
			gso.gso_type = VIRTIO_NET_HDR_GSO_NONE;

		if (skb->ip_summed == CHECKSUM_PARTIAL) {
			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
1316 1317 1318
			gso.csum_start = cpu_to_tun16(tun, skb_checksum_start_offset(skb) +
						      vlan_hlen);
			gso.csum_offset = cpu_to_tun16(tun, skb->csum_offset);
1319 1320
		} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
			gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
1321 1322
		} /* else everything is zero */

H
Herbert Xu 已提交
1323
		if (copy_to_iter(&gso, sizeof(gso), iter) != sizeof(gso))
1324
			return -EFAULT;
1325 1326

		iov_iter_advance(iter, vnet_hdr_sz - sizeof(gso));
1327 1328
	}

1329
	if (vlan_hlen) {
H
Herbert Xu 已提交
1330
		int ret;
J
Jason Wang 已提交
1331 1332 1333 1334 1335 1336 1337 1338 1339 1340
		struct {
			__be16 h_vlan_proto;
			__be16 h_vlan_TCI;
		} veth;

		veth.h_vlan_proto = skb->vlan_proto;
		veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));

		vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);

H
Herbert Xu 已提交
1341 1342
		ret = skb_copy_datagram_iter(skb, 0, iter, vlan_offset);
		if (ret || !iov_iter_count(iter))
J
Jason Wang 已提交
1343 1344
			goto done;

H
Herbert Xu 已提交
1345 1346
		ret = copy_to_iter(&veth, sizeof(veth), iter);
		if (ret != sizeof(veth) || !iov_iter_count(iter))
J
Jason Wang 已提交
1347 1348
			goto done;
	}
L
Linus Torvalds 已提交
1349

H
Herbert Xu 已提交
1350
	skb_copy_datagram_iter(skb, vlan_offset, iter, skb->len - vlan_offset);
L
Linus Torvalds 已提交
1351

J
Jason Wang 已提交
1352
done:
1353
	tun->dev->stats.tx_packets++;
H
Herbert Xu 已提交
1354
	tun->dev->stats.tx_bytes += skb->len + vlan_hlen;
L
Linus Torvalds 已提交
1355 1356 1357 1358

	return total;
}

J
Jason Wang 已提交
1359
static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
1360 1361
			   struct iov_iter *to,
			   int noblock)
L
Linus Torvalds 已提交
1362 1363
{
	struct sk_buff *skb;
1364
	ssize_t ret;
1365
	int peeked, err, off = 0;
L
Linus Torvalds 已提交
1366

1367
	tun_debug(KERN_INFO, tun, "tun_do_read\n");
L
Linus Torvalds 已提交
1368

1369 1370
	if (!iov_iter_count(to))
		return 0;
L
Linus Torvalds 已提交
1371

1372 1373
	if (tun->dev->reg_state != NETREG_REGISTERED)
		return -EIO;
L
Linus Torvalds 已提交
1374

1375 1376 1377
	/* Read frames from queue */
	skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0,
				  &peeked, &off, &err);
H
Herbert Xu 已提交
1378
	if (!skb)
1379
		return 0;
H
Herbert Xu 已提交
1380

1381
	ret = tun_put_user(tun, tfile, skb, to);
1382
	if (unlikely(ret < 0))
1383
		kfree_skb(skb);
1384 1385
	else
		consume_skb(skb);
L
Linus Torvalds 已提交
1386

1387 1388 1389
	return ret;
}

1390
static ssize_t tun_chr_read_iter(struct kiocb *iocb, struct iov_iter *to)
1391 1392 1393 1394
{
	struct file *file = iocb->ki_filp;
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
1395
	ssize_t len = iov_iter_count(to), ret;
1396 1397 1398

	if (!tun)
		return -EBADFD;
1399
	ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK);
1400
	ret = min_t(ssize_t, ret, len);
Z
Zhi Yong Wu 已提交
1401 1402
	if (ret > 0)
		iocb->ki_pos = ret;
E
Eric W. Biederman 已提交
1403
	tun_put(tun);
L
Linus Torvalds 已提交
1404 1405 1406
	return ret;
}

J
Jason Wang 已提交
1407 1408 1409 1410
static void tun_free_netdev(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

J
Jason Wang 已提交
1411
	BUG_ON(!(list_empty(&tun->disabled)));
J
Jason Wang 已提交
1412
	tun_flow_uninit(tun);
1413
	security_tun_dev_free_security(tun->security);
J
Jason Wang 已提交
1414 1415 1416
	free_netdev(dev);
}

L
Linus Torvalds 已提交
1417 1418 1419 1420
static void tun_setup(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

1421 1422
	tun->owner = INVALID_UID;
	tun->group = INVALID_GID;
L
Linus Torvalds 已提交
1423 1424

	dev->ethtool_ops = &tun_ethtool_ops;
J
Jason Wang 已提交
1425
	dev->destructor = tun_free_netdev;
L
Linus Torvalds 已提交
1426 1427
}

1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442
/* Trivial set of netlink ops to allow deleting tun or tap
 * device with netlink.
 */
static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return -EINVAL;
}

static struct rtnl_link_ops tun_link_ops __read_mostly = {
	.kind		= DRV_NAME,
	.priv_size	= sizeof(struct tun_struct),
	.setup		= tun_setup,
	.validate	= tun_validate,
};

1443 1444
static void tun_sock_write_space(struct sock *sk)
{
J
Jason Wang 已提交
1445
	struct tun_file *tfile;
1446
	wait_queue_head_t *wqueue;
1447 1448 1449 1450 1451 1452 1453

	if (!sock_writeable(sk))
		return;

	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
		return;

1454 1455 1456
	wqueue = sk_sleep(sk);
	if (wqueue && waitqueue_active(wqueue))
		wake_up_interruptible_sync_poll(wqueue, POLLOUT |
1457
						POLLWRNORM | POLLWRBAND);
H
Herbert Xu 已提交
1458

J
Jason Wang 已提交
1459 1460
	tfile = container_of(sk, struct tun_file, sk);
	kill_fasync(&tfile->fasync, SIGIO, POLL_OUT);
1461 1462
}

1463 1464 1465
static int tun_sendmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len)
{
J
Jason Wang 已提交
1466 1467 1468 1469 1470 1471
	int ret;
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);

	if (!tun)
		return -EBADFD;
1472

A
Al Viro 已提交
1473
	ret = tun_get_user(tun, tfile, m->msg_control, &m->msg_iter,
1474
			   m->msg_flags & MSG_DONTWAIT);
J
Jason Wang 已提交
1475 1476
	tun_put(tun);
	return ret;
1477 1478 1479 1480 1481 1482
}

static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len,
		       int flags)
{
J
Jason Wang 已提交
1483 1484
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);
1485
	int ret;
J
Jason Wang 已提交
1486 1487 1488 1489

	if (!tun)
		return -EBADFD;

1490
	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) {
1491 1492 1493
		ret = -EINVAL;
		goto out;
	}
1494 1495 1496 1497 1498
	if (flags & MSG_ERRQUEUE) {
		ret = sock_recv_errqueue(sock->sk, m, total_len,
					 SOL_PACKET, TUN_TX_TIMESTAMP);
		goto out;
	}
A
Al Viro 已提交
1499
	ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT);
1500 1501 1502 1503
	if (ret > total_len) {
		m->msg_flags |= MSG_TRUNC;
		ret = flags & MSG_TRUNC ? ret : total_len;
	}
1504
out:
J
Jason Wang 已提交
1505
	tun_put(tun);
1506 1507 1508
	return ret;
}

1509 1510 1511 1512 1513 1514 1515
static int tun_release(struct socket *sock)
{
	if (sock->sk)
		sock_put(sock->sk);
	return 0;
}

1516 1517 1518 1519
/* Ops structure to mimic raw sockets with tun */
static const struct proto_ops tun_socket_ops = {
	.sendmsg = tun_sendmsg,
	.recvmsg = tun_recvmsg,
1520
	.release = tun_release,
1521 1522
};

1523 1524 1525
static struct proto tun_proto = {
	.name		= "tun",
	.owner		= THIS_MODULE,
J
Jason Wang 已提交
1526
	.obj_size	= sizeof(struct tun_file),
1527
};
1528

1529 1530
static int tun_flags(struct tun_struct *tun)
{
1531
	return tun->flags & (TUN_FEATURES | IFF_PERSIST | IFF_TUN | IFF_TAP);
1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544
}

static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "0x%x\n", tun_flags(tun));
}

static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1545 1546 1547 1548
	return uid_valid(tun->owner)?
		sprintf(buf, "%u\n",
			from_kuid_munged(current_user_ns(), tun->owner)):
		sprintf(buf, "-1\n");
1549 1550 1551 1552 1553 1554
}

static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1555 1556 1557 1558
	return gid_valid(tun->group) ?
		sprintf(buf, "%u\n",
			from_kgid_munged(current_user_ns(), tun->group)):
		sprintf(buf, "-1\n");
1559 1560 1561 1562 1563 1564
}

static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL);
static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL);
static DEVICE_ATTR(group, 0444, tun_show_group, NULL);

1565
static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
L
Linus Torvalds 已提交
1566 1567
{
	struct tun_struct *tun;
J
Jason Wang 已提交
1568
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
1569 1570 1571
	struct net_device *dev;
	int err;

1572 1573 1574
	if (tfile->detached)
		return -EINVAL;

1575 1576
	dev = __dev_get_by_name(net, ifr->ifr_name);
	if (dev) {
1577 1578
		if (ifr->ifr_flags & IFF_TUN_EXCL)
			return -EBUSY;
1579 1580 1581 1582 1583 1584 1585
		if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
			tun = netdev_priv(dev);
		else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops)
			tun = netdev_priv(dev);
		else
			return -EINVAL;

1586
		if (!!(ifr->ifr_flags & IFF_MULTI_QUEUE) !=
M
Michael S. Tsirkin 已提交
1587
		    !!(tun->flags & IFF_MULTI_QUEUE))
1588 1589
			return -EINVAL;

1590
		if (tun_not_capable(tun))
P
Paul Moore 已提交
1591
			return -EPERM;
1592
		err = security_tun_dev_open(tun->security);
P
Paul Moore 已提交
1593 1594 1595
		if (err < 0)
			return err;

1596
		err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER);
1597 1598
		if (err < 0)
			return err;
J
Jason Wang 已提交
1599

M
Michael S. Tsirkin 已提交
1600
		if (tun->flags & IFF_MULTI_QUEUE &&
1601 1602 1603 1604 1605 1606
		    (tun->numqueues + tun->numdisabled > 1)) {
			/* One or more queue has already been attached, no need
			 * to initialize the device again.
			 */
			return 0;
		}
1607
	}
L
Linus Torvalds 已提交
1608 1609 1610
	else {
		char *name;
		unsigned long flags = 0;
1611 1612
		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
			     MAX_TAP_QUEUES : 1;
L
Linus Torvalds 已提交
1613

1614
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1615
			return -EPERM;
P
Paul Moore 已提交
1616 1617 1618
		err = security_tun_dev_create();
		if (err < 0)
			return err;
1619

L
Linus Torvalds 已提交
1620 1621 1622
		/* Set dev type */
		if (ifr->ifr_flags & IFF_TUN) {
			/* TUN device */
M
Michael S. Tsirkin 已提交
1623
			flags |= IFF_TUN;
L
Linus Torvalds 已提交
1624 1625 1626
			name = "tun%d";
		} else if (ifr->ifr_flags & IFF_TAP) {
			/* TAP device */
M
Michael S. Tsirkin 已提交
1627
			flags |= IFF_TAP;
L
Linus Torvalds 已提交
1628
			name = "tap%d";
1629
		} else
1630
			return -EINVAL;
1631

L
Linus Torvalds 已提交
1632 1633 1634
		if (*ifr->ifr_name)
			name = ifr->ifr_name;

J
Jason Wang 已提交
1635
		dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
1636 1637
				       NET_NAME_UNKNOWN, tun_setup, queues,
				       queues);
1638

L
Linus Torvalds 已提交
1639 1640 1641
		if (!dev)
			return -ENOMEM;

1642
		dev_net_set(dev, net);
1643
		dev->rtnl_link_ops = &tun_link_ops;
1644
		dev->ifindex = tfile->ifindex;
S
Stephen Hemminger 已提交
1645

L
Linus Torvalds 已提交
1646 1647 1648
		tun = netdev_priv(dev);
		tun->dev = dev;
		tun->flags = flags;
1649
		tun->txflt.count = 0;
1650
		tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
1651

J
Jason Wang 已提交
1652 1653
		tun->filter_attached = false;
		tun->sndbuf = tfile->socket.sk->sk_sndbuf;
1654

J
Jason Wang 已提交
1655 1656
		spin_lock_init(&tun->lock);

1657 1658 1659
		err = security_tun_dev_alloc_security(&tun->security);
		if (err < 0)
			goto err_free_dev;
P
Paul Moore 已提交
1660

L
Linus Torvalds 已提交
1661
		tun_net_init(dev);
1662
		tun_flow_init(tun);
J
Jason Wang 已提交
1663

1664
		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
J
Jason Wang 已提交
1665 1666
				   TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
				   NETIF_F_HW_VLAN_STAG_TX;
1667
		dev->features = dev->hw_features;
1668 1669 1670
		dev->vlan_features = dev->features &
				     ~(NETIF_F_HW_VLAN_CTAG_TX |
				       NETIF_F_HW_VLAN_STAG_TX);
1671

J
Jason Wang 已提交
1672
		INIT_LIST_HEAD(&tun->disabled);
1673
		err = tun_attach(tun, file, false);
1674
		if (err < 0)
1675
			goto err_free_flow;
1676

L
Linus Torvalds 已提交
1677 1678
		err = register_netdevice(tun->dev);
		if (err < 0)
1679
			goto err_detach;
1680

1681 1682 1683
		if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
		    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
		    device_create_file(&tun->dev->dev, &dev_attr_group))
1684
			pr_err("Failed to create tun sysfs files\n");
L
Linus Torvalds 已提交
1685 1686
	}

1687 1688
	netif_carrier_on(tun->dev);

1689
	tun_debug(KERN_INFO, tun, "tun_set_iff\n");
L
Linus Torvalds 已提交
1690

1691 1692
	tun->flags = (tun->flags & ~TUN_FEATURES) |
		(ifr->ifr_flags & TUN_FEATURES);
J
Jason Wang 已提交
1693

1694 1695 1696 1697
	/* Make sure persistent devices do not get stuck in
	 * xoff state.
	 */
	if (netif_running(tun->dev))
J
Jason Wang 已提交
1698
		netif_tx_wake_all_queues(tun->dev);
1699

L
Linus Torvalds 已提交
1700 1701 1702
	strcpy(ifr->ifr_name, tun->dev->name);
	return 0;

1703 1704 1705 1706 1707 1708
err_detach:
	tun_detach_all(dev);
err_free_flow:
	tun_flow_uninit(tun);
	security_tun_dev_free_security(tun->security);
err_free_dev:
L
Linus Torvalds 已提交
1709 1710 1711 1712
	free_netdev(dev);
	return err;
}

R
Rami Rosen 已提交
1713
static void tun_get_iff(struct net *net, struct tun_struct *tun,
1714
		       struct ifreq *ifr)
1715
{
1716
	tun_debug(KERN_INFO, tun, "tun_get_iff\n");
1717 1718 1719

	strcpy(ifr->ifr_name, tun->dev->name);

1720
	ifr->ifr_flags = tun_flags(tun);
1721 1722 1723

}

1724 1725
/* This is like a cut-down ethtool ops, except done via tun fd so no
 * privs required. */
1726
static int set_offload(struct tun_struct *tun, unsigned long arg)
1727
{
1728
	netdev_features_t features = 0;
1729 1730

	if (arg & TUN_F_CSUM) {
1731
		features |= NETIF_F_HW_CSUM;
1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751
		arg &= ~TUN_F_CSUM;

		if (arg & (TUN_F_TSO4|TUN_F_TSO6)) {
			if (arg & TUN_F_TSO_ECN) {
				features |= NETIF_F_TSO_ECN;
				arg &= ~TUN_F_TSO_ECN;
			}
			if (arg & TUN_F_TSO4)
				features |= NETIF_F_TSO;
			if (arg & TUN_F_TSO6)
				features |= NETIF_F_TSO6;
			arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
		}
	}

	/* This gives the user a way to test for new features in future by
	 * trying to set them. */
	if (arg)
		return -EINVAL;

1752 1753
	tun->set_features = features;
	netdev_update_features(tun->dev);
1754 1755 1756 1757

	return 0;
}

J
Jason Wang 已提交
1758 1759 1760 1761 1762 1763
static void tun_detach_filter(struct tun_struct *tun, int n)
{
	int i;
	struct tun_file *tfile;

	for (i = 0; i < n; i++) {
1764
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776
		sk_detach_filter(tfile->socket.sk);
	}

	tun->filter_attached = false;
}

static int tun_attach_filter(struct tun_struct *tun)
{
	int i, ret = 0;
	struct tun_file *tfile;

	for (i = 0; i < tun->numqueues; i++) {
1777
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794
		ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (ret) {
			tun_detach_filter(tun, i);
			return ret;
		}
	}

	tun->filter_attached = true;
	return ret;
}

static void tun_set_sndbuf(struct tun_struct *tun)
{
	struct tun_file *tfile;
	int i;

	for (i = 0; i < tun->numqueues; i++) {
1795
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1796 1797 1798 1799
		tfile->socket.sk->sk_sndbuf = tun->sndbuf;
	}
}

1800 1801 1802 1803 1804 1805 1806 1807 1808
static int tun_set_queue(struct file *file, struct ifreq *ifr)
{
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun;
	int ret = 0;

	rtnl_lock();

	if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
J
Jason Wang 已提交
1809
		tun = tfile->detached;
1810
		if (!tun) {
1811
			ret = -EINVAL;
1812 1813 1814 1815 1816
			goto unlock;
		}
		ret = security_tun_dev_attach_queue(tun->security);
		if (ret < 0)
			goto unlock;
1817
		ret = tun_attach(tun, file, false);
J
Jason Wang 已提交
1818
	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
1819
		tun = rtnl_dereference(tfile->tun);
M
Michael S. Tsirkin 已提交
1820
		if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached)
J
Jason Wang 已提交
1821 1822 1823 1824
			ret = -EINVAL;
		else
			__tun_detach(tfile, false);
	} else
1825 1826
		ret = -EINVAL;

1827
unlock:
1828 1829 1830 1831
	rtnl_unlock();
	return ret;
}

1832 1833
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg, int ifreq_len)
L
Linus Torvalds 已提交
1834
{
E
Eric W. Biederman 已提交
1835
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1836
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1837 1838
	void __user* argp = (void __user*)arg;
	struct ifreq ifr;
1839 1840
	kuid_t owner;
	kgid_t group;
1841
	int sndbuf;
1842
	int vnet_hdr_sz;
1843
	unsigned int ifindex;
M
Michael S. Tsirkin 已提交
1844
	int le;
1845
	int ret;
L
Linus Torvalds 已提交
1846

1847
	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
1848
		if (copy_from_user(&ifr, argp, ifreq_len))
L
Linus Torvalds 已提交
1849
			return -EFAULT;
D
David S. Miller 已提交
1850
	} else {
1851
		memset(&ifr, 0, sizeof(ifr));
D
David S. Miller 已提交
1852
	}
E
Eric W. Biederman 已提交
1853 1854 1855
	if (cmd == TUNGETFEATURES) {
		/* Currently this just means: "what IFF flags are valid?".
		 * This is needed because we never checked for invalid flags on
1856 1857 1858
		 * TUNSETIFF.
		 */
		return put_user(IFF_TUN | IFF_TAP | TUN_FEATURES,
E
Eric W. Biederman 已提交
1859
				(unsigned int __user*)argp);
1860 1861
	} else if (cmd == TUNSETQUEUE)
		return tun_set_queue(file, &ifr);
E
Eric W. Biederman 已提交
1862

J
Jason Wang 已提交
1863
	ret = 0;
1864 1865
	rtnl_lock();

E
Eric W. Biederman 已提交
1866
	tun = __tun_get(tfile);
L
Linus Torvalds 已提交
1867 1868 1869
	if (cmd == TUNSETIFF && !tun) {
		ifr.ifr_name[IFNAMSIZ-1] = '\0';

1870
		ret = tun_set_iff(tfile->net, file, &ifr);
L
Linus Torvalds 已提交
1871

1872 1873
		if (ret)
			goto unlock;
L
Linus Torvalds 已提交
1874

1875
		if (copy_to_user(argp, &ifr, ifreq_len))
1876 1877
			ret = -EFAULT;
		goto unlock;
L
Linus Torvalds 已提交
1878
	}
1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891
	if (cmd == TUNSETIFINDEX) {
		ret = -EPERM;
		if (tun)
			goto unlock;

		ret = -EFAULT;
		if (copy_from_user(&ifindex, argp, sizeof(ifindex)))
			goto unlock;

		ret = 0;
		tfile->ifindex = ifindex;
		goto unlock;
	}
L
Linus Torvalds 已提交
1892

1893
	ret = -EBADFD;
L
Linus Torvalds 已提交
1894
	if (!tun)
1895
		goto unlock;
L
Linus Torvalds 已提交
1896

1897
	tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %u\n", cmd);
L
Linus Torvalds 已提交
1898

E
Eric W. Biederman 已提交
1899
	ret = 0;
L
Linus Torvalds 已提交
1900
	switch (cmd) {
1901
	case TUNGETIFF:
R
Rami Rosen 已提交
1902
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
1903

1904 1905
		if (tfile->detached)
			ifr.ifr_flags |= IFF_DETACH_QUEUE;
1906 1907
		if (!tfile->socket.sk->sk_filter)
			ifr.ifr_flags |= IFF_NOFILTER;
1908

1909
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1910
			ret = -EFAULT;
1911 1912
		break;

L
Linus Torvalds 已提交
1913 1914 1915
	case TUNSETNOCSUM:
		/* Disable/Enable checksum */

1916 1917
		/* [unimplemented] */
		tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n",
1918
			  arg ? "disabled" : "enabled");
L
Linus Torvalds 已提交
1919 1920 1921
		break;

	case TUNSETPERSIST:
J
Jason Wang 已提交
1922 1923 1924
		/* Disable/Enable persist mode. Keep an extra reference to the
		 * module to prevent the module being unprobed.
		 */
M
Michael S. Tsirkin 已提交
1925 1926
		if (arg && !(tun->flags & IFF_PERSIST)) {
			tun->flags |= IFF_PERSIST;
J
Jason Wang 已提交
1927
			__module_get(THIS_MODULE);
J
Jason Wang 已提交
1928
		}
M
Michael S. Tsirkin 已提交
1929 1930
		if (!arg && (tun->flags & IFF_PERSIST)) {
			tun->flags &= ~IFF_PERSIST;
J
Jason Wang 已提交
1931 1932
			module_put(THIS_MODULE);
		}
L
Linus Torvalds 已提交
1933

1934 1935
		tun_debug(KERN_INFO, tun, "persist %s\n",
			  arg ? "enabled" : "disabled");
L
Linus Torvalds 已提交
1936 1937 1938 1939
		break;

	case TUNSETOWNER:
		/* Set owner of the device */
1940 1941 1942 1943 1944 1945
		owner = make_kuid(current_user_ns(), arg);
		if (!uid_valid(owner)) {
			ret = -EINVAL;
			break;
		}
		tun->owner = owner;
1946
		tun_debug(KERN_INFO, tun, "owner set to %u\n",
1947
			  from_kuid(&init_user_ns, tun->owner));
L
Linus Torvalds 已提交
1948 1949
		break;

1950 1951
	case TUNSETGROUP:
		/* Set group of the device */
1952 1953 1954 1955 1956 1957
		group = make_kgid(current_user_ns(), arg);
		if (!gid_valid(group)) {
			ret = -EINVAL;
			break;
		}
		tun->group = group;
1958
		tun_debug(KERN_INFO, tun, "group set to %u\n",
1959
			  from_kgid(&init_user_ns, tun->group));
1960 1961
		break;

1962 1963 1964
	case TUNSETLINK:
		/* Only allow setting the type when the interface is down */
		if (tun->dev->flags & IFF_UP) {
1965 1966
			tun_debug(KERN_INFO, tun,
				  "Linktype set failed because interface is up\n");
1967
			ret = -EBUSY;
1968 1969
		} else {
			tun->dev->type = (int) arg;
1970 1971
			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
				  tun->dev->type);
1972
			ret = 0;
1973
		}
E
Eric W. Biederman 已提交
1974
		break;
1975

L
Linus Torvalds 已提交
1976 1977 1978 1979 1980
#ifdef TUN_DEBUG
	case TUNSETDEBUG:
		tun->debug = arg;
		break;
#endif
1981
	case TUNSETOFFLOAD:
1982
		ret = set_offload(tun, arg);
E
Eric W. Biederman 已提交
1983
		break;
1984

1985 1986
	case TUNSETTXFILTER:
		/* Can be set only for TAPs */
E
Eric W. Biederman 已提交
1987
		ret = -EINVAL;
M
Michael S. Tsirkin 已提交
1988
		if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP)
E
Eric W. Biederman 已提交
1989
			break;
H
Harvey Harrison 已提交
1990
		ret = update_filter(&tun->txflt, (void __user *)arg);
E
Eric W. Biederman 已提交
1991
		break;
L
Linus Torvalds 已提交
1992 1993

	case SIOCGIFHWADDR:
1994
		/* Get hw address */
1995 1996
		memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
		ifr.ifr_hwaddr.sa_family = tun->dev->type;
1997
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1998 1999
			ret = -EFAULT;
		break;
L
Linus Torvalds 已提交
2000 2001

	case SIOCSIFHWADDR:
2002
		/* Set hw address */
2003 2004
		tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
			  ifr.ifr_hwaddr.sa_data);
2005 2006

		ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
E
Eric W. Biederman 已提交
2007
		break;
2008 2009

	case TUNGETSNDBUF:
J
Jason Wang 已提交
2010
		sndbuf = tfile->socket.sk->sk_sndbuf;
2011 2012 2013 2014 2015 2016 2017 2018 2019 2020
		if (copy_to_user(argp, &sndbuf, sizeof(sndbuf)))
			ret = -EFAULT;
		break;

	case TUNSETSNDBUF:
		if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) {
			ret = -EFAULT;
			break;
		}

J
Jason Wang 已提交
2021 2022
		tun->sndbuf = sndbuf;
		tun_set_sndbuf(tun);
2023 2024
		break;

2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043
	case TUNGETVNETHDRSZ:
		vnet_hdr_sz = tun->vnet_hdr_sz;
		if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
			ret = -EFAULT;
		break;

	case TUNSETVNETHDRSZ:
		if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
			ret = -EFAULT;
			break;
		}
		if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
			ret = -EINVAL;
			break;
		}

		tun->vnet_hdr_sz = vnet_hdr_sz;
		break;

M
Michael S. Tsirkin 已提交
2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060
	case TUNGETVNETLE:
		le = !!(tun->flags & TUN_VNET_LE);
		if (put_user(le, (int __user *)argp))
			ret = -EFAULT;
		break;

	case TUNSETVNETLE:
		if (get_user(le, (int __user *)argp)) {
			ret = -EFAULT;
			break;
		}
		if (le)
			tun->flags |= TUN_VNET_LE;
		else
			tun->flags &= ~TUN_VNET_LE;
		break;

M
Michael S. Tsirkin 已提交
2061 2062 2063
	case TUNATTACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
M
Michael S. Tsirkin 已提交
2064
		if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP)
M
Michael S. Tsirkin 已提交
2065 2066
			break;
		ret = -EFAULT;
J
Jason Wang 已提交
2067
		if (copy_from_user(&tun->fprog, argp, sizeof(tun->fprog)))
M
Michael S. Tsirkin 已提交
2068 2069
			break;

J
Jason Wang 已提交
2070
		ret = tun_attach_filter(tun);
M
Michael S. Tsirkin 已提交
2071 2072 2073 2074 2075
		break;

	case TUNDETACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
M
Michael S. Tsirkin 已提交
2076
		if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP)
M
Michael S. Tsirkin 已提交
2077
			break;
J
Jason Wang 已提交
2078 2079
		ret = 0;
		tun_detach_filter(tun, tun->numqueues);
M
Michael S. Tsirkin 已提交
2080 2081
		break;

P
Pavel Emelyanov 已提交
2082 2083
	case TUNGETFILTER:
		ret = -EINVAL;
M
Michael S. Tsirkin 已提交
2084
		if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP)
P
Pavel Emelyanov 已提交
2085 2086 2087 2088 2089 2090 2091
			break;
		ret = -EFAULT;
		if (copy_to_user(argp, &tun->fprog, sizeof(tun->fprog)))
			break;
		ret = 0;
		break;

L
Linus Torvalds 已提交
2092
	default:
E
Eric W. Biederman 已提交
2093 2094
		ret = -EINVAL;
		break;
2095
	}
L
Linus Torvalds 已提交
2096

2097 2098 2099 2100
unlock:
	rtnl_unlock();
	if (tun)
		tun_put(tun);
E
Eric W. Biederman 已提交
2101
	return ret;
L
Linus Torvalds 已提交
2102 2103
}

2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138
static long tun_chr_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq));
}

#ifdef CONFIG_COMPAT
static long tun_chr_compat_ioctl(struct file *file,
			 unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case TUNSETIFF:
	case TUNGETIFF:
	case TUNSETTXFILTER:
	case TUNGETSNDBUF:
	case TUNSETSNDBUF:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
		arg = (unsigned long)compat_ptr(arg);
		break;
	default:
		arg = (compat_ulong_t)arg;
		break;
	}

	/*
	 * compat_ifreq is shorter than ifreq, so we must not access beyond
	 * the end of that structure. All fields that are used in this
	 * driver are compatible though, we don't need to convert the
	 * contents.
	 */
	return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq));
}
#endif /* CONFIG_COMPAT */

L
Linus Torvalds 已提交
2139 2140
static int tun_chr_fasync(int fd, struct file *file, int on)
{
J
Jason Wang 已提交
2141
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
2142 2143
	int ret;

J
Jason Wang 已提交
2144
	if ((ret = fasync_helper(fd, file, on, &tfile->fasync)) < 0)
J
Jonathan Corbet 已提交
2145
		goto out;
2146

L
Linus Torvalds 已提交
2147
	if (on) {
2148
		__f_setown(file, task_pid(current), PIDTYPE_PID, 0);
J
Jason Wang 已提交
2149
		tfile->flags |= TUN_FASYNC;
2150
	} else
J
Jason Wang 已提交
2151
		tfile->flags &= ~TUN_FASYNC;
J
Jonathan Corbet 已提交
2152 2153 2154
	ret = 0;
out:
	return ret;
L
Linus Torvalds 已提交
2155 2156 2157 2158
}

static int tun_chr_open(struct inode *inode, struct file * file)
{
E
Eric W. Biederman 已提交
2159
	struct tun_file *tfile;
T
Thomas Gleixner 已提交
2160

2161
	DBG1(KERN_INFO, "tunX: tun_chr_open\n");
E
Eric W. Biederman 已提交
2162

J
Jason Wang 已提交
2163 2164
	tfile = (struct tun_file *)sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL,
					    &tun_proto);
E
Eric W. Biederman 已提交
2165 2166
	if (!tfile)
		return -ENOMEM;
2167
	RCU_INIT_POINTER(tfile->tun, NULL);
E
Eric W. Biederman 已提交
2168
	tfile->net = get_net(current->nsproxy->net_ns);
J
Jason Wang 已提交
2169
	tfile->flags = 0;
2170
	tfile->ifindex = 0;
J
Jason Wang 已提交
2171 2172

	init_waitqueue_head(&tfile->wq.wait);
2173
	RCU_INIT_POINTER(tfile->socket.wq, &tfile->wq);
J
Jason Wang 已提交
2174 2175 2176 2177 2178 2179 2180 2181 2182 2183

	tfile->socket.file = file;
	tfile->socket.ops = &tun_socket_ops;

	sock_init_data(&tfile->socket, &tfile->sk);
	sk_change_net(&tfile->sk, tfile->net);

	tfile->sk.sk_write_space = tun_sock_write_space;
	tfile->sk.sk_sndbuf = INT_MAX;

E
Eric W. Biederman 已提交
2184
	file->private_data = tfile;
J
Jason Wang 已提交
2185
	set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);
J
Jason Wang 已提交
2186
	INIT_LIST_HEAD(&tfile->next);
J
Jason Wang 已提交
2187

2188 2189
	sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);

L
Linus Torvalds 已提交
2190 2191 2192 2193 2194
	return 0;
}

static int tun_chr_close(struct inode *inode, struct file *file)
{
E
Eric W. Biederman 已提交
2195
	struct tun_file *tfile = file->private_data;
J
Jason Wang 已提交
2196
	struct net *net = tfile->net;
L
Linus Torvalds 已提交
2197

J
Jason Wang 已提交
2198
	tun_detach(tfile, true);
J
Jason Wang 已提交
2199
	put_net(net);
L
Linus Torvalds 已提交
2200 2201 2202 2203

	return 0;
}

2204
#ifdef CONFIG_PROC_FS
2205
static void tun_chr_show_fdinfo(struct seq_file *m, struct file *f)
2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220
{
	struct tun_struct *tun;
	struct ifreq ifr;

	memset(&ifr, 0, sizeof(ifr));

	rtnl_lock();
	tun = tun_get(f);
	if (tun)
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
	rtnl_unlock();

	if (tun)
		tun_put(tun);

2221
	seq_printf(m, "iff:\t%s\n", ifr.ifr_name);
2222 2223 2224
}
#endif

2225
static const struct file_operations tun_fops = {
2226
	.owner	= THIS_MODULE,
L
Linus Torvalds 已提交
2227
	.llseek = no_llseek,
2228
	.read  = new_sync_read,
2229
	.write = new_sync_write,
2230
	.read_iter  = tun_chr_read_iter,
2231
	.write_iter = tun_chr_write_iter,
L
Linus Torvalds 已提交
2232
	.poll	= tun_chr_poll,
2233 2234 2235 2236
	.unlocked_ioctl	= tun_chr_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl = tun_chr_compat_ioctl,
#endif
L
Linus Torvalds 已提交
2237 2238
	.open	= tun_chr_open,
	.release = tun_chr_close,
2239 2240 2241 2242
	.fasync = tun_chr_fasync,
#ifdef CONFIG_PROC_FS
	.show_fdinfo = tun_chr_show_fdinfo,
#endif
L
Linus Torvalds 已提交
2243 2244 2245 2246 2247
};

static struct miscdevice tun_miscdev = {
	.minor = TUN_MINOR,
	.name = "tun",
2248
	.nodename = "net/tun",
L
Linus Torvalds 已提交
2249 2250 2251 2252 2253 2254 2255 2256 2257
	.fops = &tun_fops,
};

/* ethtool interface */

static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	cmd->supported		= 0;
	cmd->advertising	= 0;
2258
	ethtool_cmd_speed_set(cmd, SPEED_10);
L
Linus Torvalds 已提交
2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272
	cmd->duplex		= DUPLEX_FULL;
	cmd->port		= PORT_TP;
	cmd->phy_address	= 0;
	cmd->transceiver	= XCVR_INTERNAL;
	cmd->autoneg		= AUTONEG_DISABLE;
	cmd->maxtxpkt		= 0;
	cmd->maxrxpkt		= 0;
	return 0;
}

static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
{
	struct tun_struct *tun = netdev_priv(dev);

2273 2274
	strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
	strlcpy(info->version, DRV_VERSION, sizeof(info->version));
L
Linus Torvalds 已提交
2275 2276

	switch (tun->flags & TUN_TYPE_MASK) {
M
Michael S. Tsirkin 已提交
2277
	case IFF_TUN:
2278
		strlcpy(info->bus_info, "tun", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2279
		break;
M
Michael S. Tsirkin 已提交
2280
	case IFF_TAP:
2281
		strlcpy(info->bus_info, "tap", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303
		break;
	}
}

static u32 tun_get_msglevel(struct net_device *dev)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	return tun->debug;
#else
	return -EOPNOTSUPP;
#endif
}

static void tun_set_msglevel(struct net_device *dev, u32 value)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	tun->debug = value;
#endif
}

2304
static const struct ethtool_ops tun_ethtool_ops = {
L
Linus Torvalds 已提交
2305 2306 2307 2308
	.get_settings	= tun_get_settings,
	.get_drvinfo	= tun_get_drvinfo,
	.get_msglevel	= tun_get_msglevel,
	.set_msglevel	= tun_set_msglevel,
2309
	.get_link	= ethtool_op_get_link,
2310
	.get_ts_info	= ethtool_op_get_ts_info,
L
Linus Torvalds 已提交
2311 2312
};

2313

L
Linus Torvalds 已提交
2314 2315 2316 2317
static int __init tun_init(void)
{
	int ret = 0;

2318 2319
	pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
	pr_info("%s\n", DRV_COPYRIGHT);
L
Linus Torvalds 已提交
2320

2321
	ret = rtnl_link_register(&tun_link_ops);
2322
	if (ret) {
2323
		pr_err("Can't register link_ops\n");
2324
		goto err_linkops;
2325 2326
	}

L
Linus Torvalds 已提交
2327
	ret = misc_register(&tun_miscdev);
2328
	if (ret) {
2329
		pr_err("Can't register misc device %d\n", TUN_MINOR);
2330 2331
		goto err_misc;
	}
2332
	return  0;
2333
err_misc:
2334 2335
	rtnl_link_unregister(&tun_link_ops);
err_linkops:
L
Linus Torvalds 已提交
2336 2337 2338 2339 2340
	return ret;
}

static void tun_cleanup(void)
{
2341
	misc_deregister(&tun_miscdev);
2342
	rtnl_link_unregister(&tun_link_ops);
L
Linus Torvalds 已提交
2343 2344
}

2345 2346 2347 2348 2349 2350
/* Get an underlying socket object from tun file.  Returns error unless file is
 * attached to a device.  The returned object works like a packet socket, it
 * can be used for sock_sendmsg/sock_recvmsg.  The caller is responsible for
 * holding a reference to the file for as long as the socket is in use. */
struct socket *tun_get_socket(struct file *file)
{
2351
	struct tun_file *tfile;
2352 2353
	if (file->f_op != &tun_fops)
		return ERR_PTR(-EINVAL);
2354 2355
	tfile = file->private_data;
	if (!tfile)
2356
		return ERR_PTR(-EBADFD);
J
Jason Wang 已提交
2357
	return &tfile->socket;
2358 2359 2360
}
EXPORT_SYMBOL_GPL(tun_get_socket);

L
Linus Torvalds 已提交
2361 2362 2363 2364 2365 2366
module_init(tun_init);
module_exit(tun_cleanup);
MODULE_DESCRIPTION(DRV_DESCRIPTION);
MODULE_AUTHOR(DRV_COPYRIGHT);
MODULE_LICENSE("GPL");
MODULE_ALIAS_MISCDEV(TUN_MINOR);
2367
MODULE_ALIAS("devname:net/tun");