projects/linux·blob master · refs

2215 lines · 55.5 KiB

1// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
2/*
3 * bcm.c - Broadcast Manager to filter/send (cyclic) CAN content
4 *
5 * Copyright (c) 2002-2017 Volkswagen Group Electronic Research
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of Volkswagen nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * Alternatively, provided that this notice is retained in full, this
21 * software may be distributed under the terms of the GNU General
22 * Public License ("GPL") version 2, in which case the provisions of the
23 * GPL apply INSTEAD OF those given above.
24 *
25 * The provided data structures and external interfaces from this code
26 * are not restricted to be used by modules with a GPL compatible license.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
39 * DAMAGE.
40 *
41 */
42
43#include <linux/module.h>
44#include <linux/init.h>
45#include <linux/interrupt.h>
46#include <linux/hrtimer.h>
47#include <linux/list.h>
48#include <linux/proc_fs.h>
49#include <linux/seq_file.h>
50#include <linux/uio.h>
51#include <linux/net.h>
52#include <linux/netdevice.h>
53#include <linux/socket.h>
54#include <linux/if_arp.h>
55#include <linux/skbuff.h>
56#include <linux/can.h>
57#include <linux/can/core.h>
58#include <linux/can/skb.h>
59#include <linux/can/bcm.h>
60#include <linux/slab.h>
61#include <linux/workqueue.h>
62#include <linux/spinlock.h>
63#include <net/can.h>
64#include <net/sock.h>
65#include <net/net_namespace.h>
66
67/*
68 * To send multiple CAN frame content within TX_SETUP or to filter
69 * CAN messages with multiplex index within RX_SETUP, the number of
70 * different filters is limited to 256 due to the one byte index value.
71 */
72#define MAX_NFRAMES 256
73
74/* limit timers to 400 days for sending/timeouts */
75#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60)
76
77/* use of last_frames[index].flags */
78#define RX_LOCAL 0x10 /* frame was created on the local host */
79#define RX_OWN 0x20 /* frame was sent via the socket it was received on */
80#define RX_RECV 0x40 /* received data for this element */
81#define RX_THR 0x80 /* element not been sent due to throttle feature */
82#define BCM_CAN_FLAGS_MASK 0x0F /* to clean private flags after usage */
83
84/* get best masking value for can_rx_register() for a given single can_id */
85#define REGMASK(id) ((id & CAN_EFF_FLAG) ? \
86 (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
87 (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
88
89MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
90MODULE_LICENSE("Dual BSD/GPL");
91MODULE_AUTHOR("Oliver Hartkopp <[email protected]>");
92MODULE_ALIAS("can-proto-2");
93
94#define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
95
96static struct workqueue_struct *bcm_wq;
97
98/*
99 * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
100 * 64 bit aligned so the offset has to be multiples of 8 which is ensured
101 * by the only callers in bcm_rx_cmp_to_index() bcm_rx_handler().
102 */
103static inline u64 get_u64(const struct canfd_frame *cp, int offset)
104{
105 return *(u64 *)(cp->data + offset);
106}
107
108struct bcm_op {
109 struct list_head list;
110 struct rcu_head rcu;
111 struct work_struct work;
112 int ifindex;
113 canid_t can_id;
114 u32 flags;
115 atomic_long_t frames_abs, frames_filtered;
116 struct bcm_timeval ival1, ival2;
117 struct hrtimer timer, thrtimer;
118 ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
119 int rx_ifindex;
120 int if_detected; /* first received ifindex in ANYDEV rx_op mode */
121 int cfsiz;
122 u32 count;
123 u32 nframes;
124 u32 currframe;
125 /* void pointers to arrays of struct can[fd]_frame */
126 void *frames;
127 void *last_frames;
128 struct canfd_frame sframe;
129 struct canfd_frame last_sframe;
130 struct sock *sk;
131 struct net_device *rx_reg_dev;
132 netdevice_tracker rx_reg_dev_tracker;
133 spinlock_t bcm_tx_lock; /* protect tx data and timer updates */
134 spinlock_t bcm_rx_update_lock; /* protect filter/timer data updates */
135};
136
137struct bcm_sock {
138 struct sock sk;
139 int bound;
140 int ifindex;
141 struct list_head notifier;
142 struct list_head rx_ops;
143 struct list_head tx_ops;
144 unsigned long dropped_usr_msgs;
145 struct proc_dir_entry *bcm_proc_read;
146 char procname [32]; /* inode number in decimal with \0 */
147};
148
149static LIST_HEAD(bcm_notifier_list);
150static DEFINE_SPINLOCK(bcm_notifier_lock);
151static struct bcm_sock *bcm_busy_notifier;
152
153/* Return pointer to store the extra msg flags for bcm_recvmsg().
154 * We use the space of one unsigned int beyond the 'struct sockaddr_can'
155 * in skb->cb.
156 */
157static inline unsigned int *bcm_flags(struct sk_buff *skb)
158{
159 /* return pointer after struct sockaddr_can */
160 return (unsigned int *)(&((struct sockaddr_can *)skb->cb)[1]);
161}
162
163static inline struct bcm_sock *bcm_sk(const struct sock *sk)
164{
165 return (struct bcm_sock *)sk;
166}
167
168static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
169{
170 return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
171}
172
173/* check limitations for timeval provided by user */
174static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
175{
176 if ((msg_head->ival1.tv_sec < 0) ||
177 (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
178 (msg_head->ival1.tv_usec < 0) ||
179 (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
180 (msg_head->ival2.tv_sec < 0) ||
181 (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
182 (msg_head->ival2.tv_usec < 0) ||
183 (msg_head->ival2.tv_usec >= USEC_PER_SEC))
184 return true;
185
186 return false;
187}
188
189#define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
190#define OPSIZ sizeof(struct bcm_op)
191#define MHSIZ sizeof(struct bcm_msg_head)
192
193/*
194 * procfs functions
195 */
196#if IS_ENABLED(CONFIG_PROC_FS)
197static char *bcm_proc_getifname(struct net *net, char *result, int ifindex)
198{
199 struct net_device *dev;
200
201 if (!ifindex)
202 return "any";
203
204 rcu_read_lock();
205 dev = dev_get_by_index_rcu(net, ifindex);
206 if (dev)
207 strcpy(result, dev->name);
208 else
209 strcpy(result, "???");
210 rcu_read_unlock();
211
212 return result;
213}
214
215static int bcm_proc_show(struct seq_file *m, void *v)
216{
217 char ifname[IFNAMSIZ];
218 struct net *net = m->private;
219 struct sock *sk = (struct sock *)pde_data(m->file->f_inode);
220 struct bcm_sock *bo = bcm_sk(sk);
221 struct bcm_op *op;
222
223 seq_printf(m, ">>> socket %pK", sk->sk_socket);
224 seq_printf(m, " / sk %pK", sk);
225 seq_printf(m, " / bo %pK", bo);
226 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
227 seq_printf(m, " / bound %s", bcm_proc_getifname(net, ifname, bo->ifindex));
228 seq_printf(m, " <<<\n");
229
230 rcu_read_lock();
231
232 list_for_each_entry_rcu(op, &bo->rx_ops, list) {
233
234 long reduction, frames_filtered, frames_abs;
235
236 frames_filtered = atomic_long_read(&op->frames_filtered);
237 frames_abs = atomic_long_read(&op->frames_abs);
238
239 /* print only active entries & prevent division by zero */
240 if (!frames_abs)
241 continue;
242
243 seq_printf(m, "rx_op: %03X %-5s ", op->can_id,
244 bcm_proc_getifname(net, ifname, op->ifindex));
245
246 if (op->flags & CAN_FD_FRAME)
247 seq_printf(m, "(%u)", op->nframes);
248 else
249 seq_printf(m, "[%u]", op->nframes);
250
251 seq_printf(m, "%c ", (op->flags & RX_CHECK_DLC) ? 'd' : ' ');
252
253 if (op->kt_ival1)
254 seq_printf(m, "timeo=%lld ",
255 (long long)ktime_to_us(op->kt_ival1));
256
257 if (op->kt_ival2)
258 seq_printf(m, "thr=%lld ",
259 (long long)ktime_to_us(op->kt_ival2));
260
261 seq_printf(m, "# recv %ld (%ld) => reduction: ",
262 frames_filtered, frames_abs);
263
264 reduction = 100 - (frames_filtered * 100) / frames_abs;
265
266 seq_printf(m, "%s%ld%%\n",
267 (reduction == 100) ? "near " : "", reduction);
268 }
269
270 list_for_each_entry_rcu(op, &bo->tx_ops, list) {
271
272 seq_printf(m, "tx_op: %03X %s ", op->can_id,
273 bcm_proc_getifname(net, ifname, op->ifindex));
274
275 if (op->flags & CAN_FD_FRAME)
276 seq_printf(m, "(%u) ", op->nframes);
277 else
278 seq_printf(m, "[%u] ", op->nframes);
279
280 if (op->kt_ival1)
281 seq_printf(m, "t1=%lld ",
282 (long long)ktime_to_us(op->kt_ival1));
283
284 if (op->kt_ival2)
285 seq_printf(m, "t2=%lld ",
286 (long long)ktime_to_us(op->kt_ival2));
287
288 seq_printf(m, "# sent %ld\n",
289 atomic_long_read(&op->frames_abs));
290 }
291 seq_putc(m, '\n');
292
293 rcu_read_unlock();
294
295 return 0;
296}
297#endif /* CONFIG_PROC_FS */
298
299static void bcm_update_rx_stats(struct bcm_op *op)
300{
301 /* prevent overflow of the reduction% calculation in bcm_proc_show() */
302 if (atomic_long_inc_return(&op->frames_abs) > LONG_MAX / 100) {
303 atomic_long_set(&op->frames_filtered, 0);
304 atomic_long_set(&op->frames_abs, 0);
305 }
306}
307
308static void bcm_update_tx_stats(struct bcm_op *op)
309{
310 /* tx_op has no reduction% calculation - use the full range and
311 * just keep the displayed counter non-negative on overflow
312 */
313 if (atomic_long_inc_return(&op->frames_abs) == LONG_MAX)
314 atomic_long_set(&op->frames_abs, 0);
315}
316
317/*
318 * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
319 * of the given bcm tx op
320 */
321static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)
322{
323 struct sk_buff *skb;
324 struct can_skb_ext *csx;
325 struct net_device *dev;
326 struct canfd_frame cframe;
327 bool cyclic = !cf;
328 unsigned int idx = 0;
329 int err;
330
331 /* no target device? => exit */
332 if (!op->ifindex)
333 return;
334
335 if (cyclic) {
336 /* read currframe under lock protection */
337 spin_lock_bh(&op->bcm_tx_lock);
338 idx = op->currframe;
339 memcpy(&cframe, op->frames + op->cfsiz * idx, op->cfsiz);
340 cf = &cframe;
341 spin_unlock_bh(&op->bcm_tx_lock);
342 }
343
344 dev = dev_get_by_index(sock_net(op->sk), op->ifindex);
345 if (!dev) {
346 /* RFC: should this bcm_op remove itself here? */
347 return;
348 }
349
350 skb = alloc_skb(op->cfsiz, gfp_any());
351 if (!skb)
352 goto out;
353
354 csx = can_skb_ext_add(skb);
355 if (!csx) {
356 kfree_skb(skb);
357 goto out;
358 }
359
360 csx->can_iif = dev->ifindex;
361
362 skb_put_data(skb, cf, op->cfsiz);
363
364 /* send with loopback */
365 skb->dev = dev;
366 can_skb_set_owner(skb, op->sk);
367 err = can_send(skb, 1);
368
369 /* update currframe and count under lock protection */
370 spin_lock_bh(&op->bcm_tx_lock);
371
372 if (!err)
373 bcm_update_tx_stats(op);
374
375 /* only advance the cyclic sequence if nothing reset currframe while
376 * we were sending - a concurrent TX_RESET_MULTI_IDX means this
377 * frame's bookkeeping belongs to a sequence that no longer exists
378 */
379 if (!cyclic || op->currframe == idx) {
380 op->currframe++;
381
382 /* reached last frame? */
383 if (op->currframe >= op->nframes)
384 op->currframe = 0;
385
386 if (op->count > 0)
387 op->count--;
388 }
389
390 spin_unlock_bh(&op->bcm_tx_lock);
391out:
392 dev_put(dev);
393}
394
395/*
396 * bcm_send_to_user - send a BCM message to the userspace
397 * (consisting of bcm_msg_head + x CAN frames)
398 */
399static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
400 struct canfd_frame *frames, int has_timestamp)
401{
402 struct sk_buff *skb;
403 struct canfd_frame *firstframe;
404 struct sockaddr_can *addr;
405 struct sock *sk = op->sk;
406 unsigned int datalen = head->nframes * op->cfsiz;
407 unsigned int *pflags;
408 enum skb_drop_reason reason;
409
410 skb = alloc_skb(sizeof(*head) + datalen, gfp_any());
411 if (!skb)
412 return;
413
414 skb_put_data(skb, head, sizeof(*head));
415
416 /* ensure space for sockaddr_can and msg flags */
417 sock_skb_cb_check_size(sizeof(struct sockaddr_can) +
418 sizeof(unsigned int));
419
420 /* initialize msg flags */
421 pflags = bcm_flags(skb);
422 *pflags = 0;
423
424 if (head->nframes) {
425 /* CAN frames starting here */
426 firstframe = (struct canfd_frame *)skb_tail_pointer(skb);
427
428 skb_put_data(skb, frames, datalen);
429
430 /*
431 * the BCM uses the flags-element of the canfd_frame
432 * structure for internal purposes. This is only
433 * relevant for updates that are generated by the
434 * BCM, where nframes is 1
435 */
436 if (head->nframes == 1) {
437 if (firstframe->flags & RX_LOCAL)
438 *pflags |= MSG_DONTROUTE;
439 if (firstframe->flags & RX_OWN)
440 *pflags |= MSG_CONFIRM;
441
442 firstframe->flags &= BCM_CAN_FLAGS_MASK;
443 }
444 }
445
446 if (has_timestamp) {
447 /* restore rx timestamp */
448 skb->tstamp = op->rx_stamp;
449 }
450
451 /*
452 * Put the datagram to the queue so that bcm_recvmsg() can
453 * get it from there. We need to pass the interface index to
454 * bcm_recvmsg(). We pass a whole struct sockaddr_can in skb->cb
455 * containing the interface index.
456 */
457
458 addr = (struct sockaddr_can *)skb->cb;
459 memset(addr, 0, sizeof(*addr));
460 addr->can_family = AF_CAN;
461 addr->can_ifindex = op->rx_ifindex;
462
463 reason = sock_queue_rcv_skb_reason(sk, skb);
464 if (reason) {
465 struct bcm_sock *bo = bcm_sk(sk);
466
467 sk_skb_reason_drop(sk, skb, reason);
468 /* don't care about overflows in this statistic */
469 bo->dropped_usr_msgs++;
470 }
471}
472
473static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt)
474{
475 ktime_t ival;
476
477 spin_lock_bh(&op->bcm_tx_lock);
478
479 if (op->kt_ival1 && op->count)
480 ival = op->kt_ival1;
481 else if (op->kt_ival2) {
482 ival = op->kt_ival2;
483 } else {
484 spin_unlock_bh(&op->bcm_tx_lock);
485 return false;
486 }
487
488 spin_unlock_bh(&op->bcm_tx_lock);
489
490 hrtimer_set_expires(hrt, ktime_add(ktime_get(), ival));
491 return true;
492}
493
494static void bcm_tx_start_timer(struct bcm_op *op)
495{
496 if (bcm_tx_set_expiry(op, &op->timer))
497 hrtimer_start_expires(&op->timer, HRTIMER_MODE_ABS_SOFT);
498}
499
500/* bcm_tx_timeout_handler - performs cyclic CAN frame transmissions */
501static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
502{
503 struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
504 struct bcm_msg_head msg_head;
505 bool tx_ival1, tx_ival2;
506
507 /* snapshot kt_ival1/kt_ival2/count under lock to avoid torn
508 * ktime_t reads racing with concurrent bcm_tx_setup() updates
509 */
510 spin_lock_bh(&op->bcm_tx_lock);
511 tx_ival1 = op->kt_ival1 && (op->count > 0);
512 tx_ival2 = !!op->kt_ival2;
513 spin_unlock_bh(&op->bcm_tx_lock);
514
515 if (tx_ival1) {
516 u32 flags, count;
517 struct bcm_timeval ival1, ival2;
518
519 bcm_can_tx(op, NULL);
520
521 /* snapshot variables under lock to avoid torn reads racing
522 * with concurrent bcm_tx_setup() updates
523 */
524 spin_lock_bh(&op->bcm_tx_lock);
525 flags = op->flags;
526 count = op->count;
527 ival1 = op->ival1;
528 ival2 = op->ival2;
529 spin_unlock_bh(&op->bcm_tx_lock);
530
531 if (!count && (flags & TX_COUNTEVT)) {
532 /* create notification to user */
533 memset(&msg_head, 0, sizeof(msg_head));
534 msg_head.opcode = TX_EXPIRED;
535 msg_head.flags = flags;
536 msg_head.count = count;
537 msg_head.ival1 = ival1;
538 msg_head.ival2 = ival2;
539 msg_head.can_id = op->can_id;
540 msg_head.nframes = 0;
541
542 bcm_send_to_user(op, &msg_head, NULL, 0);
543 }
544
545 } else if (tx_ival2) {
546 bcm_can_tx(op, NULL);
547 }
548
549 return bcm_tx_set_expiry(op, &op->timer) ?
550 HRTIMER_RESTART : HRTIMER_NORESTART;
551}
552
553/*
554 * bcm_rx_changed - create a RX_CHANGED notification due to changed content
555 */
556static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data)
557{
558 struct bcm_msg_head head;
559
560 /* update statistics (frames_filtered <= frames_abs) */
561 if (atomic_long_read(&op->frames_abs))
562 atomic_long_inc(&op->frames_filtered);
563
564 /* this element is not throttled anymore */
565 data->flags &= ~RX_THR;
566
567 memset(&head, 0, sizeof(head));
568 head.opcode = RX_CHANGED;
569 head.flags = op->flags;
570 head.count = op->count;
571 head.ival1 = op->ival1;
572 head.ival2 = op->ival2;
573 head.can_id = op->can_id;
574 head.nframes = 1;
575
576 bcm_send_to_user(op, &head, data, 1);
577}
578
579/*
580 * bcm_rx_update_and_send - process a detected relevant receive content change
581 * 1. update the last received data
582 * 2. send a notification to the user (if possible)
583 */
584static void bcm_rx_update_and_send(struct bcm_op *op,
585 struct canfd_frame *lastdata,
586 const struct canfd_frame *rxdata,
587 unsigned char traffic_flags)
588{
589 memcpy(lastdata, rxdata, op->cfsiz);
590
591 /* mark as used and throttled by default */
592 lastdata->flags |= (RX_RECV|RX_THR);
593
594 /* add own/local/remote traffic flags */
595 lastdata->flags |= traffic_flags;
596
597 /* throttling mode inactive ? */
598 if (!op->kt_ival2) {
599 /* send RX_CHANGED to the user immediately */
600 bcm_rx_changed(op, lastdata);
601 return;
602 }
603
604 /* with active throttling timer we are just done here */
605 if (hrtimer_active(&op->thrtimer))
606 return;
607
608 /* first reception with enabled throttling mode */
609 if (!op->kt_lastmsg)
610 goto rx_changed_settime;
611
612 /* got a second frame inside a potential throttle period? */
613 if (ktime_us_delta(ktime_get(), op->kt_lastmsg) <
614 ktime_to_us(op->kt_ival2)) {
615 /* do not send the saved data - only start throttle timer */
616 hrtimer_start(&op->thrtimer,
617 ktime_add(op->kt_lastmsg, op->kt_ival2),
618 HRTIMER_MODE_ABS_SOFT);
619 return;
620 }
621
622 /* the gap was that big, that throttling was not needed here */
623rx_changed_settime:
624 bcm_rx_changed(op, lastdata);
625 op->kt_lastmsg = ktime_get();
626}
627
628/*
629 * bcm_rx_cmp_to_index - (bit)compares the currently received data to formerly
630 * received data stored in op->last_frames[]
631 */
632static void bcm_rx_cmp_to_index(struct bcm_op *op, unsigned int index,
633 const struct canfd_frame *rxdata,
634 unsigned char traffic_flags)
635{
636 struct canfd_frame *cf = op->frames + op->cfsiz * index;
637 struct canfd_frame *lcf = op->last_frames + op->cfsiz * index;
638 int i;
639
640 /*
641 * no one uses the MSBs of flags for comparison,
642 * so we use it here to detect the first time of reception
643 */
644
645 if (!(lcf->flags & RX_RECV)) {
646 /* received data for the first time => send update to user */
647 bcm_rx_update_and_send(op, lcf, rxdata, traffic_flags);
648 return;
649 }
650
651 /* do a real check in CAN frame data section */
652 for (i = 0; i < rxdata->len; i += 8) {
653 if ((get_u64(cf, i) & get_u64(rxdata, i)) !=
654 (get_u64(cf, i) & get_u64(lcf, i))) {
655 bcm_rx_update_and_send(op, lcf, rxdata, traffic_flags);
656 return;
657 }
658 }
659
660 if (op->flags & RX_CHECK_DLC) {
661 /* do a real check in CAN frame length */
662 if (rxdata->len != lcf->len) {
663 bcm_rx_update_and_send(op, lcf, rxdata, traffic_flags);
664 return;
665 }
666 }
667}
668
669/*
670 * bcm_rx_starttimer - enable timeout monitoring for CAN frame reception
671 */
672static void bcm_rx_starttimer(struct bcm_op *op)
673{
674 if (op->flags & RX_NO_AUTOTIMER)
675 return;
676
677 if (op->kt_ival1)
678 hrtimer_start(&op->timer, op->kt_ival1, HRTIMER_MODE_REL_SOFT);
679}
680
681/* bcm_rx_timeout_handler - when the (cyclic) CAN frame reception timed out */
682static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
683{
684 struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
685 struct bcm_msg_head msg_head;
686
687 spin_lock_bh(&op->bcm_rx_update_lock);
688
689 /* if user wants to be informed, when cyclic CAN-Messages come back */
690 if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) {
691 /* clear received CAN frames to indicate 'nothing received' */
692 memset(op->last_frames, 0, op->nframes * op->cfsiz);
693 }
694
695 /* create notification to user */
696 memset(&msg_head, 0, sizeof(msg_head));
697 msg_head.opcode = RX_TIMEOUT;
698 msg_head.flags = op->flags;
699 msg_head.count = op->count;
700 msg_head.ival1 = op->ival1;
701 msg_head.ival2 = op->ival2;
702 msg_head.can_id = op->can_id;
703 msg_head.nframes = 0;
704
705 spin_unlock_bh(&op->bcm_rx_update_lock);
706
707 bcm_send_to_user(op, &msg_head, NULL, 0);
708
709 return HRTIMER_NORESTART;
710}
711
712/*
713 * bcm_rx_do_flush - helper for bcm_rx_thr_flush
714 */
715static inline int bcm_rx_do_flush(struct bcm_op *op, unsigned int index)
716{
717 struct canfd_frame *lcf = op->last_frames + op->cfsiz * index;
718
719 if ((op->last_frames) && (lcf->flags & RX_THR)) {
720 bcm_rx_changed(op, lcf);
721 return 1;
722 }
723 return 0;
724}
725
726/*
727 * bcm_rx_thr_flush - Check for throttled data and send it to the userspace
728 */
729static int bcm_rx_thr_flush(struct bcm_op *op)
730{
731 int updated = 0;
732
733 if (op->nframes > 1) {
734 unsigned int i;
735
736 /* for MUX filter we start at index 1 */
737 for (i = 1; i < op->nframes; i++)
738 updated += bcm_rx_do_flush(op, i);
739
740 } else {
741 /* for RX_FILTER_ID and simple filter */
742 updated += bcm_rx_do_flush(op, 0);
743 }
744
745 return updated;
746}
747
748/*
749 * bcm_rx_thr_handler - the time for blocked content updates is over now:
750 * Check for throttled data and send it to the userspace
751 */
752static enum hrtimer_restart bcm_rx_thr_handler(struct hrtimer *hrtimer)
753{
754 struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer);
755 enum hrtimer_restart ret;
756
757 spin_lock_bh(&op->bcm_rx_update_lock);
758
759 /* kt_ival2 may have been concurrently cleared by bcm_rx_setup()
760 * before it cancels this timer - never forward with a zero
761 * interval in that case.
762 */
763 if (bcm_rx_thr_flush(op) && op->kt_ival2) {
764 hrtimer_forward_now(hrtimer, op->kt_ival2);
765 ret = HRTIMER_RESTART;
766 } else {
767 /* rearm throttle handling */
768 op->kt_lastmsg = 0;
769 ret = HRTIMER_NORESTART;
770 }
771
772 spin_unlock_bh(&op->bcm_rx_update_lock);
773
774 return ret;
775}
776
777/*
778 * bcm_rx_handler - handle a CAN frame reception
779 */
780static void bcm_rx_handler(struct sk_buff *skb, void *data)
781{
782 struct bcm_op *op = (struct bcm_op *)data;
783 const struct canfd_frame *rxframe = (struct canfd_frame *)skb->data;
784 struct canfd_frame rtrframe;
785 unsigned int i;
786 unsigned char traffic_flags;
787 bool rtr_frame;
788
789 if (op->can_id != rxframe->can_id)
790 return;
791
792 /* make sure to handle the correct frame type (CAN / CAN FD) */
793 if (op->flags & CAN_FD_FRAME) {
794 if (!can_is_canfd_skb(skb))
795 return;
796 } else {
797 if (!can_is_can_skb(skb))
798 return;
799 }
800
801 /* An ANYDEV op with an active RX timeout and/or throttle timer
802 * tracks a single source interface: claim the first interface that
803 * delivers a matching frame and reject frames from any other one,
804 * before hrtimer_cancel() below can touch op->timer - this avoids
805 * racing bcm_rx_timeout_handler() across concurrent interfaces.
806 * RX_RTR_FRAME ops are excluded, as kt_ival1/kt_ival2 may briefly
807 * hold a stale value from an earlier non-RTR configuration.
808 */
809 if (!op->ifindex) {
810 spin_lock_bh(&op->bcm_rx_update_lock);
811
812 if (!(op->flags & RX_RTR_FRAME) &&
813 (op->kt_ival1 || op->kt_ival2)) {
814 /* don't claim to vanishing interface */
815 if (!op->if_detected &&
816 READ_ONCE(skb->dev->reg_state) == NETREG_REGISTERED)
817 op->if_detected = skb->dev->ifindex;
818
819 if (op->if_detected != skb->dev->ifindex) {
820 spin_unlock_bh(&op->bcm_rx_update_lock);
821 return;
822 }
823 }
824
825 spin_unlock_bh(&op->bcm_rx_update_lock);
826 }
827
828 /* disable timeout */
829 hrtimer_cancel(&op->timer);
830
831 /* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */
832 spin_lock_bh(&op->bcm_rx_update_lock);
833
834 rtr_frame = op->flags & RX_RTR_FRAME;
835 if (rtr_frame) {
836 bcm_update_rx_stats(op);
837 /* snapshot RTR content under lock */
838 memcpy(&rtrframe, op->frames, op->cfsiz);
839 spin_unlock_bh(&op->bcm_rx_update_lock);
840
841 /* send reply for RTR-request (placed in op->frames[0]) */
842 bcm_can_tx(op, &rtrframe);
843 return;
844 }
845
846 /* update statistics in the same critical section as bcm_rx_changed()
847 * below: frames_filtered must never be checked/incremented against a
848 * frames_abs snapshot from a concurrent bcm_rx_handler() call on
849 * another CPU for the same (wildcard) op, or frames_filtered can end
850 * up larger than frames_abs.
851 */
852 bcm_update_rx_stats(op);
853
854 /* compute flags to distinguish between own/local/remote CAN traffic */
855 traffic_flags = 0;
856 if (skb->sk) {
857 traffic_flags |= RX_LOCAL;
858 if (skb->sk == op->sk)
859 traffic_flags |= RX_OWN;
860 }
861
862 /* save rx timestamp and originator for recvfrom() under lock: an
863 * ANYDEV op without an active timer can still run concurrently on
864 * different CPUs, so content and meta data must be bundled here.
865 */
866 op->rx_stamp = skb->tstamp;
867 op->rx_ifindex = skb->dev->ifindex;
868
869 if (op->flags & RX_FILTER_ID) {
870 /* the easiest case */
871 bcm_rx_update_and_send(op, op->last_frames, rxframe,
872 traffic_flags);
873 goto rx_starttimer;
874 }
875
876 if (op->nframes == 1) {
877 /* simple compare with index 0 */
878 bcm_rx_cmp_to_index(op, 0, rxframe, traffic_flags);
879 goto rx_starttimer;
880 }
881
882 if (op->nframes > 1) {
883 /*
884 * multiplex compare
885 *
886 * find the first multiplex mask that fits.
887 * Remark: The MUX-mask is stored in index 0 - but only the
888 * first 64 bits of the frame data[] are relevant (CAN FD)
889 */
890
891 for (i = 1; i < op->nframes; i++) {
892 if ((get_u64(op->frames, 0) & get_u64(rxframe, 0)) ==
893 (get_u64(op->frames, 0) &
894 get_u64(op->frames + op->cfsiz * i, 0))) {
895 bcm_rx_cmp_to_index(op, i, rxframe,
896 traffic_flags);
897 break;
898 }
899 }
900 }
901
902rx_starttimer:
903 bcm_rx_starttimer(op);
904
905 spin_unlock_bh(&op->bcm_rx_update_lock);
906}
907
908/*
909 * helpers for bcm_op handling: find & delete bcm [rx|tx] op elements
910 */
911static struct bcm_op *bcm_find_op(struct list_head *ops,
912 struct bcm_msg_head *mh, int ifindex)
913{
914 struct bcm_op *op;
915
916 list_for_each_entry(op, ops, list) {
917 if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
918 (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME))
919 return op;
920 }
921
922 return NULL;
923}
924
925static void bcm_free_op_work(struct work_struct *work)
926{
927 struct bcm_op *op = container_of(work, struct bcm_op, work);
928
929 hrtimer_cancel(&op->timer);
930 hrtimer_cancel(&op->thrtimer);
931
932 if ((op->frames) && (op->frames != &op->sframe))
933 kfree(op->frames);
934
935 if ((op->last_frames) && (op->last_frames != &op->last_sframe))
936 kfree(op->last_frames);
937
938 /* the last possible access to op->timer/op->thrtimer has now
939 * happened above via hrtimer_cancel() - op->sk is no longer
940 * needed by any pending timer callback, so drop our reference
941 */
942 sock_put(op->sk);
943
944 kfree(op);
945}
946
947static void bcm_free_op_rcu(struct rcu_head *rcu_head)
948{
949 struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
950
951 INIT_WORK(&op->work, bcm_free_op_work);
952 queue_work(bcm_wq, &op->work);
953}
954
955static void bcm_remove_op(struct bcm_op *op)
956{
957 hrtimer_cancel(&op->timer);
958 hrtimer_cancel(&op->thrtimer);
959
960 call_rcu(&op->rcu, bcm_free_op_rcu);
961}
962
963static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)
964{
965 if (op->rx_reg_dev == dev) {
966 can_rx_unregister(dev_net(dev), dev, op->can_id,
967 REGMASK(op->can_id), bcm_rx_handler, op);
968
969 /* mark as removed subscription */
970 op->rx_reg_dev = NULL;
971 netdev_put(dev, &op->rx_reg_dev_tracker);
972 } else
973 printk(KERN_ERR "can-bcm: bcm_rx_unreg: registered device "
974 "mismatch %p %p\n", op->rx_reg_dev, dev);
975}
976
977/*
978 * bcm_delete_rx_op - find and remove a rx op (returns number of removed ops)
979 */
980static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
981 int ifindex)
982{
983 struct bcm_op *op, *n;
984
985 list_for_each_entry_safe(op, n, ops, list) {
986 if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
987 (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) {
988
989 /* disable automatic timer on frame reception */
990 op->flags |= RX_NO_AUTOTIMER;
991
992 /*
993 * Don't care if we're bound or not (due to netdev
994 * problems) can_rx_unregister() is always a save
995 * thing to do here.
996 */
997 if (op->ifindex) {
998 /*
999 * Only remove subscriptions that had not
1000 * been removed due to NETDEV_UNREGISTER
1001 * in bcm_notifier()
1002 *
1003 * op->rx_reg_dev is a tracked reference taken
1004 * when the subscription was registered, so it
1005 * stays valid here even if a concurrent
1006 * NETDEV_UNREGISTER already unlisted the dev.
1007 */
1008 if (op->rx_reg_dev)
1009 bcm_rx_unreg(op->rx_reg_dev, op);
1010 } else
1011 can_rx_unregister(sock_net(op->sk), NULL,
1012 op->can_id,
1013 REGMASK(op->can_id),
1014 bcm_rx_handler, op);
1015
1016 list_del_rcu(&op->list);
1017 bcm_remove_op(op);
1018 return 1; /* done */
1019 }
1020 }
1021
1022 return 0; /* not found */
1023}
1024
1025/*
1026 * bcm_delete_tx_op - find and remove a tx op (returns number of removed ops)
1027 */
1028static int bcm_delete_tx_op(struct list_head *ops, struct bcm_msg_head *mh,
1029 int ifindex)
1030{
1031 struct bcm_op *op, *n;
1032
1033 list_for_each_entry_safe(op, n, ops, list) {
1034 if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
1035 (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) {
1036 list_del_rcu(&op->list);
1037 bcm_remove_op(op);
1038 return 1; /* done */
1039 }
1040 }
1041
1042 return 0; /* not found */
1043}
1044
1045/*
1046 * bcm_read_op - read out a bcm_op and send it to the user (for bcm_sendmsg)
1047 */
1048static int bcm_read_op(struct list_head *ops, struct bcm_msg_head *msg_head,
1049 int ifindex)
1050{
1051 struct bcm_op *op = bcm_find_op(ops, msg_head, ifindex);
1052
1053 if (!op)
1054 return -EINVAL;
1055
1056 /* put current values into msg_head */
1057 msg_head->flags = op->flags;
1058 msg_head->count = op->count;
1059 msg_head->ival1 = op->ival1;
1060 msg_head->ival2 = op->ival2;
1061 msg_head->nframes = op->nframes;
1062
1063 bcm_send_to_user(op, msg_head, op->frames, 0);
1064
1065 return MHSIZ;
1066}
1067
1068/*
1069 * bcm_tx_setup - create or update a bcm tx op (for bcm_sendmsg)
1070 */
1071static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
1072 int ifindex, struct sock *sk)
1073{
1074 struct bcm_sock *bo = bcm_sk(sk);
1075 struct bcm_op *op;
1076 struct canfd_frame *cf;
1077 bool add_op_to_list = false;
1078 unsigned int i;
1079 int err;
1080
1081 /* we need a real device to send frames */
1082 if (!ifindex)
1083 return -ENODEV;
1084
1085 /* check nframes boundaries - we need at least one CAN frame */
1086 if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
1087 return -EINVAL;
1088
1089 /* check timeval limitations */
1090 if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
1091 return -EINVAL;
1092
1093 /* check the given can_id */
1094 op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
1095 if (op) {
1096 void *new_frames;
1097
1098 /* update existing BCM operation */
1099
1100 /*
1101 * Do we need more space for the CAN frames than currently
1102 * allocated? -> This is a _really_ unusual use-case and
1103 * therefore (complexity / locking) it is not supported.
1104 */
1105 if (msg_head->nframes > op->nframes)
1106 return -E2BIG;
1107
1108 /* get new CAN frames content into a staging buffer before
1109 * locking: validate and normalize the frames there so that
1110 * bcm_can_tx() / bcm_tx_timeout_handler() never observe a
1111 * partially updated or unvalidated frame in op->frames
1112 */
1113 new_frames = kmalloc(msg_head->nframes * op->cfsiz, GFP_KERNEL);
1114 if (!new_frames)
1115 return -ENOMEM;
1116
1117 for (i = 0; i < msg_head->nframes; i++) {
1118
1119 cf = new_frames + op->cfsiz * i;
1120 err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
1121 if (err < 0) {
1122 kfree(new_frames);
1123 return err;
1124 }
1125
1126 if (op->flags & CAN_FD_FRAME) {
1127 if (cf->len > 64)
1128 err = -EINVAL;
1129 } else {
1130 if (cf->len > 8)
1131 err = -EINVAL;
1132 }
1133
1134 if (err < 0) {
1135 kfree(new_frames);
1136 return err;
1137 }
1138
1139 if (msg_head->flags & TX_CP_CAN_ID) {
1140 /* copy can_id into frame */
1141 cf->can_id = msg_head->can_id;
1142 }
1143 }
1144
1145 spin_lock_bh(&op->bcm_tx_lock);
1146
1147 /* update CAN frames content */
1148 memcpy(op->frames, new_frames, msg_head->nframes * op->cfsiz);
1149
1150 op->flags = msg_head->flags;
1151
1152 if (op->nframes != msg_head->nframes ||
1153 op->flags & TX_RESET_MULTI_IDX) {
1154 /* potentially update changed nframes */
1155 op->nframes = msg_head->nframes;
1156 /* restart multiple frame transmission */
1157 op->currframe = 0;
1158 }
1159
1160 if (op->flags & SETTIMER)
1161 op->count = msg_head->count;
1162
1163 spin_unlock_bh(&op->bcm_tx_lock);
1164
1165 kfree(new_frames);
1166
1167 } else {
1168 /* insert new BCM operation for the given can_id */
1169
1170 op = kzalloc(OPSIZ, GFP_KERNEL);
1171 if (!op)
1172 return -ENOMEM;
1173
1174 spin_lock_init(&op->bcm_tx_lock);
1175 op->can_id = msg_head->can_id;
1176 op->cfsiz = CFSIZ(msg_head->flags);
1177 op->flags = msg_head->flags;
1178 op->nframes = msg_head->nframes;
1179
1180 if (op->flags & SETTIMER)
1181 op->count = msg_head->count;
1182
1183 /* create array for CAN frames and copy the data */
1184 if (msg_head->nframes > 1) {
1185 op->frames = kmalloc_array(msg_head->nframes,
1186 op->cfsiz,
1187 GFP_KERNEL);
1188 if (!op->frames) {
1189 kfree(op);
1190 return -ENOMEM;
1191 }
1192 } else
1193 op->frames = &op->sframe;
1194
1195 for (i = 0; i < msg_head->nframes; i++) {
1196
1197 cf = op->frames + op->cfsiz * i;
1198 err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
1199 if (err < 0)
1200 goto free_op;
1201
1202 if (op->flags & CAN_FD_FRAME) {
1203 if (cf->len > 64)
1204 err = -EINVAL;
1205 } else {
1206 if (cf->len > 8)
1207 err = -EINVAL;
1208 }
1209
1210 if (err < 0)
1211 goto free_op;
1212
1213 if (msg_head->flags & TX_CP_CAN_ID) {
1214 /* copy can_id into frame */
1215 cf->can_id = msg_head->can_id;
1216 }
1217 }
1218
1219 /* tx_ops never compare with previous received messages */
1220 op->last_frames = NULL;
1221
1222 /* bcm_can_tx / bcm_tx_timeout_handler needs this */
1223 op->sk = sk;
1224 sock_hold(sk);
1225 op->ifindex = ifindex;
1226
1227 /* initialize uninitialized (kzalloc) structure */
1228 hrtimer_setup(&op->timer, bcm_tx_timeout_handler, CLOCK_MONOTONIC,
1229 HRTIMER_MODE_REL_SOFT);
1230
1231 /* currently unused in tx_ops */
1232 hrtimer_setup(&op->thrtimer, hrtimer_dummy_timeout, CLOCK_MONOTONIC,
1233 HRTIMER_MODE_REL_SOFT);
1234
1235 add_op_to_list = true;
1236
1237 } /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */
1238
1239 if (op->flags & SETTIMER) {
1240 /* set timer values */
1241 spin_lock_bh(&op->bcm_tx_lock);
1242 op->ival1 = msg_head->ival1;
1243 op->ival2 = msg_head->ival2;
1244 op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
1245 op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
1246 spin_unlock_bh(&op->bcm_tx_lock);
1247
1248 /* disable an active timer due to zero values? */
1249 if (!op->kt_ival1 && !op->kt_ival2)
1250 hrtimer_cancel(&op->timer);
1251 }
1252
1253 if (op->flags & STARTTIMER) {
1254 hrtimer_cancel(&op->timer);
1255 /* spec: send CAN frame when starting timer */
1256 op->flags |= TX_ANNOUNCE;
1257 }
1258
1259 /* add this bcm_op to the list of the tx_ops? */
1260 if (add_op_to_list)
1261 list_add_rcu(&op->list, &bo->tx_ops);
1262
1263 if (op->flags & TX_ANNOUNCE)
1264 bcm_can_tx(op, NULL);
1265
1266 if (op->flags & STARTTIMER)
1267 bcm_tx_start_timer(op);
1268
1269 return msg_head->nframes * op->cfsiz + MHSIZ;
1270
1271free_op:
1272 if (op->frames != &op->sframe)
1273 kfree(op->frames);
1274 kfree(op);
1275 return err;
1276}
1277
1278static int bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
1279 struct bcm_op *op, void *new_frames)
1280{
1281 struct canfd_frame *frame0 = new_frames;
1282
1283 if (!(msg_head->flags & RX_RTR_FRAME))
1284 return 0;
1285
1286 /* this frame is sent out as-is by bcm_can_tx() whenever a matching
1287 * remote request is received, so validate its length the same way
1288 * bcm_tx_setup() validates TX_SETUP frames before installing it
1289 */
1290 if (msg_head->flags & CAN_FD_FRAME) {
1291 if (frame0->len > 64)
1292 return -EINVAL;
1293 } else {
1294 if (frame0->len > 8)
1295 return -EINVAL;
1296 }
1297
1298 /* funny feature in RX(!)_SETUP only for RTR-mode:
1299 * copy can_id into frame BUT without RTR-flag to
1300 * prevent a full-load-loopback-test ... ;-]
1301 * normalize this on the staged buffer, before it is
1302 * ever installed into op->frames.
1303 */
1304 if ((msg_head->flags & TX_CP_CAN_ID) ||
1305 frame0->can_id == op->can_id)
1306 frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
1307
1308 return 0;
1309}
1310
1311/*
1312 * bcm_rx_setup - create or update a bcm rx op (for bcm_sendmsg)
1313 */
1314static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
1315 int ifindex, struct sock *sk)
1316{
1317 struct bcm_sock *bo = bcm_sk(sk);
1318 struct bcm_op *op;
1319 int do_rx_register;
1320 int new_op = 0;
1321 int err = 0;
1322
1323 if ((msg_head->flags & RX_FILTER_ID) || (!(msg_head->nframes))) {
1324 /* be robust against wrong usage ... */
1325 msg_head->flags |= RX_FILTER_ID;
1326 /* ignore trailing garbage */
1327 msg_head->nframes = 0;
1328 }
1329
1330 /* the first element contains the mux-mask => MAX_NFRAMES + 1 */
1331 if (msg_head->nframes > MAX_NFRAMES + 1)
1332 return -EINVAL;
1333
1334 if ((msg_head->flags & RX_RTR_FRAME) &&
1335 ((msg_head->nframes != 1) ||
1336 (!(msg_head->can_id & CAN_RTR_FLAG))))
1337 return -EINVAL;
1338
1339 /* check timeval limitations */
1340 if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
1341 return -EINVAL;
1342
1343 /* check the given can_id */
1344 op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
1345 if (op) {
1346 void *new_frames = NULL;
1347
1348 /* update existing BCM operation */
1349
1350 /*
1351 * Do we need more space for the CAN frames than currently
1352 * allocated? -> This is a _really_ unusual use-case and
1353 * therefore (complexity / locking) it is not supported.
1354 */
1355 if (msg_head->nframes > op->nframes)
1356 return -E2BIG;
1357
1358 if (msg_head->nframes) {
1359 /* get new CAN frames content before locking */
1360 new_frames = kmalloc(msg_head->nframes * op->cfsiz,
1361 GFP_KERNEL);
1362 if (!new_frames)
1363 return -ENOMEM;
1364
1365 err = memcpy_from_msg(new_frames, msg,
1366 msg_head->nframes * op->cfsiz);
1367 if (err < 0) {
1368 kfree(new_frames);
1369 return err;
1370 }
1371
1372 err = bcm_rx_setup_rtr_check(msg_head, op, new_frames);
1373 if (err < 0) {
1374 kfree(new_frames);
1375 return err;
1376 }
1377 }
1378
1379 spin_lock_bh(&op->bcm_rx_update_lock);
1380 op->nframes = msg_head->nframes;
1381 op->flags = msg_head->flags;
1382
1383 if (msg_head->nframes) {
1384 /* update CAN frames content */
1385 memcpy(op->frames, new_frames,
1386 msg_head->nframes * op->cfsiz);
1387
1388 /* clear last_frames to indicate 'nothing received' */
1389 memset(op->last_frames, 0,
1390 msg_head->nframes * op->cfsiz);
1391 }
1392
1393 if (msg_head->flags & SETTIMER) {
1394 op->ival1 = msg_head->ival1;
1395 op->ival2 = msg_head->ival2;
1396 op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
1397 op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
1398 op->kt_lastmsg = 0;
1399 op->if_detected = 0; /* reclaim ifindex in ANYDEV mode */
1400 }
1401 spin_unlock_bh(&op->bcm_rx_update_lock);
1402
1403 /* free temporary frames / kfree(NULL) is safe */
1404 kfree(new_frames);
1405
1406 /* Don't register a new CAN filter for the rx_op update unless
1407 * a concurrent NETDEV_UNREGISTER notifier already tore down
1408 * the previous registration. In this case the receiver needs
1409 * to be re-registered here so that this update doesn't
1410 * silently stop delivering frames for the given ifindex.
1411 * Ops with ifindex = 0 (all CAN interfaces) never carry a
1412 * tracked rx_reg_dev and stay registered as-is.
1413 */
1414 do_rx_register = (ifindex && !op->rx_reg_dev) ? 1 : 0;
1415
1416 } else {
1417 /* insert new BCM operation for the given can_id */
1418 op = kzalloc(OPSIZ, GFP_KERNEL);
1419 if (!op)
1420 return -ENOMEM;
1421
1422 spin_lock_init(&op->bcm_tx_lock);
1423 spin_lock_init(&op->bcm_rx_update_lock);
1424 op->can_id = msg_head->can_id;
1425 op->nframes = msg_head->nframes;
1426 op->cfsiz = CFSIZ(msg_head->flags);
1427 op->flags = msg_head->flags;
1428
1429 if (msg_head->nframes > 1) {
1430 /* create array for CAN frames and copy the data */
1431 op->frames = kmalloc_array(msg_head->nframes,
1432 op->cfsiz,
1433 GFP_KERNEL);
1434 if (!op->frames) {
1435 kfree(op);
1436 return -ENOMEM;
1437 }
1438
1439 /* create and init array for received CAN frames */
1440 op->last_frames = kcalloc(msg_head->nframes,
1441 op->cfsiz,
1442 GFP_KERNEL);
1443 if (!op->last_frames) {
1444 kfree(op->frames);
1445 kfree(op);
1446 return -ENOMEM;
1447 }
1448
1449 } else {
1450 op->frames = &op->sframe;
1451 op->last_frames = &op->last_sframe;
1452 }
1453
1454 if (msg_head->nframes) {
1455 err = memcpy_from_msg(op->frames, msg,
1456 msg_head->nframes * op->cfsiz);
1457 if (err < 0)
1458 goto free_op;
1459
1460 err = bcm_rx_setup_rtr_check(msg_head, op, op->frames);
1461 if (err < 0)
1462 goto free_op;
1463 }
1464
1465 /* bcm_can_tx / bcm_tx_timeout_handler needs this */
1466 op->sk = sk;
1467 sock_hold(sk);
1468 op->ifindex = ifindex;
1469
1470 /* ifindex for timeout events w/o previous frame reception */
1471 op->rx_ifindex = ifindex;
1472
1473 /* initialize uninitialized (kzalloc) structure */
1474 hrtimer_setup(&op->timer, bcm_rx_timeout_handler, CLOCK_MONOTONIC,
1475 HRTIMER_MODE_REL_SOFT);
1476 hrtimer_setup(&op->thrtimer, bcm_rx_thr_handler, CLOCK_MONOTONIC,
1477 HRTIMER_MODE_REL_SOFT);
1478
1479 /* call can_rx_register() */
1480 do_rx_register = 1;
1481 new_op = 1;
1482
1483 } /* if ((op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex))) */
1484
1485 /* check flags */
1486
1487 if (op->flags & RX_RTR_FRAME) {
1488 /* no timers in RTR-mode */
1489 hrtimer_cancel(&op->thrtimer);
1490 hrtimer_cancel(&op->timer);
1491 } else {
1492 if (op->flags & SETTIMER) {
1493
1494 /* set timers (locked) for newly created op */
1495 if (new_op) {
1496 spin_lock_bh(&op->bcm_rx_update_lock);
1497 op->ival1 = msg_head->ival1;
1498 op->ival2 = msg_head->ival2;
1499 op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
1500 op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
1501 op->kt_lastmsg = 0;
1502 spin_unlock_bh(&op->bcm_rx_update_lock);
1503 }
1504
1505 /* disable an active timer due to zero value? */
1506 if (!op->kt_ival1)
1507 hrtimer_cancel(&op->timer);
1508
1509 /*
1510 * In any case cancel the throttle timer, flush
1511 * potentially blocked msgs and reset throttle handling
1512 */
1513 hrtimer_cancel(&op->thrtimer);
1514
1515 spin_lock_bh(&op->bcm_rx_update_lock);
1516 bcm_rx_thr_flush(op);
1517 spin_unlock_bh(&op->bcm_rx_update_lock);
1518 }
1519
1520 if ((op->flags & STARTTIMER) && op->kt_ival1)
1521 hrtimer_start(&op->timer, op->kt_ival1,
1522 HRTIMER_MODE_REL_SOFT);
1523 }
1524
1525 /* now we can register for can_ids, if we added a new bcm_op
1526 * or need to re-register after a NETDEV_UNREGISTER tore down
1527 * the previous registration of an existing op
1528 */
1529 if (do_rx_register) {
1530 if (ifindex) {
1531 struct net_device *dev;
1532
1533 dev = dev_get_by_index(sock_net(sk), ifindex);
1534 if (dev) {
1535 err = can_rx_register(sock_net(sk), dev,
1536 op->can_id,
1537 REGMASK(op->can_id),
1538 bcm_rx_handler, op,
1539 "bcm", sk);
1540
1541 /* keep a tracked reference so that a later
1542 * unregister can safely reach the device even
1543 * if a concurrent NETDEV_UNREGISTER has
1544 * already unlisted it by ifindex
1545 */
1546 if (!err) {
1547 op->rx_reg_dev = dev;
1548 netdev_hold(dev,
1549 &op->rx_reg_dev_tracker,
1550 GFP_KERNEL);
1551 }
1552 dev_put(dev);
1553 } else {
1554 /* the requested device is gone - do not
1555 * silently succeed without registering
1556 */
1557 err = -ENODEV;
1558 }
1559
1560 } else {
1561 err = can_rx_register(sock_net(sk), NULL, op->can_id,
1562 REGMASK(op->can_id),
1563 bcm_rx_handler, op, "bcm", sk);
1564 }
1565
1566 if (err) {
1567 /* newly created bcm rx op is broken -> remove it */
1568 if (new_op) {
1569 bcm_remove_op(op);
1570 return err;
1571 }
1572
1573 /* an existing op just stays unregistered.
1574 * Cancel op->timer and (defensively) op->thrtimer.
1575 * Other settings can't be reached until the next
1576 * successful RX_SETUP.
1577 */
1578 hrtimer_cancel(&op->timer);
1579 hrtimer_cancel(&op->thrtimer);
1580 return err;
1581 }
1582
1583 /* add a new bcm_op to the list of the rx_ops */
1584 if (new_op)
1585 list_add_rcu(&op->list, &bo->rx_ops);
1586 }
1587
1588 return msg_head->nframes * op->cfsiz + MHSIZ;
1589
1590free_op:
1591 if (op->frames != &op->sframe)
1592 kfree(op->frames);
1593 if (op->last_frames != &op->last_sframe)
1594 kfree(op->last_frames);
1595 kfree(op);
1596 return err;
1597}
1598
1599/*
1600 * bcm_tx_send - send a single CAN frame to the CAN interface (for bcm_sendmsg)
1601 */
1602static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk,
1603 int cfsiz)
1604{
1605 struct sk_buff *skb;
1606 struct can_skb_ext *csx;
1607 struct net_device *dev;
1608 int err;
1609
1610 /* we need a real device to send frames */
1611 if (!ifindex)
1612 return -ENODEV;
1613
1614 skb = alloc_skb(cfsiz, GFP_KERNEL);
1615 if (!skb)
1616 return -ENOMEM;
1617
1618 csx = can_skb_ext_add(skb);
1619 if (!csx) {
1620 kfree_skb(skb);
1621 return -ENOMEM;
1622 }
1623
1624 err = memcpy_from_msg(skb_put(skb, cfsiz), msg, cfsiz);
1625 if (err < 0) {
1626 kfree_skb(skb);
1627 return err;
1628 }
1629
1630 dev = dev_get_by_index(sock_net(sk), ifindex);
1631 if (!dev) {
1632 kfree_skb(skb);
1633 return -ENODEV;
1634 }
1635
1636 csx->can_iif = dev->ifindex;
1637 skb->dev = dev;
1638 can_skb_set_owner(skb, sk);
1639 err = can_send(skb, 1); /* send with loopback */
1640 dev_put(dev);
1641
1642 if (err)
1643 return err;
1644
1645 return cfsiz + MHSIZ;
1646}
1647
1648/*
1649 * bcm_sendmsg - process BCM commands (opcodes) from the userspace
1650 */
1651static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
1652{
1653 struct sock *sk = sock->sk;
1654 struct bcm_sock *bo = bcm_sk(sk);
1655 int ifindex;
1656 struct bcm_msg_head msg_head;
1657 int cfsiz;
1658 int ret; /* read bytes or error codes as return value */
1659
1660 /* Lockless fast-path check for bound socket */
1661 if (!READ_ONCE(bo->bound))
1662 return -ENOTCONN;
1663
1664 /* check for valid message length from userspace */
1665 if (size < MHSIZ)
1666 return -EINVAL;
1667
1668 /* read message head information */
1669 ret = memcpy_from_msg((u8 *)&msg_head, msg, MHSIZ);
1670 if (ret < 0)
1671 return ret;
1672
1673 cfsiz = CFSIZ(msg_head.flags);
1674 if ((size - MHSIZ) % cfsiz)
1675 return -EINVAL;
1676
1677 lock_sock(sk);
1678
1679 /* Re-validate under the socket lock: a concurrent bcm_notify()
1680 * may have unbound this socket (device removal) after the
1681 * lockless fast-path check above. bo->ifindex is only ever
1682 * mutated under lock_sock(), so reading it here - instead of
1683 * before taking the lock - guarantees it can't be observed
1684 * torn against bo->bound.
1685 */
1686 if (!bo->bound) {
1687 ret = -ENOTCONN;
1688 goto out_release;
1689 }
1690
1691 /* default ifindex for this bcm_op */
1692 ifindex = bo->ifindex;
1693
1694 /* check for alternative ifindex for this bcm_op */
1695
1696 if (!ifindex && msg->msg_name) {
1697 /* no bound device as default => check msg_name */
1698 DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
1699
1700 if (msg->msg_namelen < BCM_MIN_NAMELEN) {
1701 ret = -EINVAL;
1702 goto out_release;
1703 }
1704
1705 if (addr->can_family != AF_CAN) {
1706 ret = -EINVAL;
1707 goto out_release;
1708 }
1709
1710 /* ifindex from sendto() */
1711 ifindex = addr->can_ifindex;
1712
1713 if (ifindex) {
1714 struct net_device *dev;
1715
1716 dev = dev_get_by_index(sock_net(sk), ifindex);
1717 if (!dev) {
1718 ret = -ENODEV;
1719 goto out_release;
1720 }
1721
1722 if (dev->type != ARPHRD_CAN) {
1723 dev_put(dev);
1724 ret = -ENODEV;
1725 goto out_release;
1726 }
1727
1728 dev_put(dev);
1729 }
1730 }
1731
1732 switch (msg_head.opcode) {
1733
1734 case TX_SETUP:
1735 ret = bcm_tx_setup(&msg_head, msg, ifindex, sk);
1736 break;
1737
1738 case RX_SETUP:
1739 ret = bcm_rx_setup(&msg_head, msg, ifindex, sk);
1740 break;
1741
1742 case TX_DELETE:
1743 if (bcm_delete_tx_op(&bo->tx_ops, &msg_head, ifindex))
1744 ret = MHSIZ;
1745 else
1746 ret = -EINVAL;
1747 break;
1748
1749 case RX_DELETE:
1750 if (bcm_delete_rx_op(&bo->rx_ops, &msg_head, ifindex))
1751 ret = MHSIZ;
1752 else
1753 ret = -EINVAL;
1754 break;
1755
1756 case TX_READ:
1757 /* reuse msg_head for the reply to TX_READ */
1758 msg_head.opcode = TX_STATUS;
1759 ret = bcm_read_op(&bo->tx_ops, &msg_head, ifindex);
1760 break;
1761
1762 case RX_READ:
1763 /* reuse msg_head for the reply to RX_READ */
1764 msg_head.opcode = RX_STATUS;
1765 ret = bcm_read_op(&bo->rx_ops, &msg_head, ifindex);
1766 break;
1767
1768 case TX_SEND:
1769 /* we need exactly one CAN frame behind the msg head */
1770 if ((msg_head.nframes != 1) || (size != cfsiz + MHSIZ))
1771 ret = -EINVAL;
1772 else
1773 ret = bcm_tx_send(msg, ifindex, sk, cfsiz);
1774 break;
1775
1776 default:
1777 ret = -EINVAL;
1778 break;
1779 }
1780
1781out_release:
1782 release_sock(sk);
1783
1784 return ret;
1785}
1786
1787/*
1788 * notification handler for netdevice status changes
1789 */
1790static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
1791 struct net_device *dev)
1792{
1793 struct sock *sk = &bo->sk;
1794 struct bcm_op *op;
1795 int notify_enodev = 0;
1796
1797 if (!net_eq(dev_net(dev), sock_net(sk)))
1798 return;
1799
1800 switch (msg) {
1801
1802 case NETDEV_UNREGISTER:
1803 lock_sock(sk);
1804
1805 /* rx_ops: remove device specific receive entries */
1806 list_for_each_entry(op, &bo->rx_ops, list) {
1807 if (op->rx_reg_dev == dev)
1808 bcm_rx_unreg(dev, op);
1809
1810 /* release an ANYDEV op's claim (see bcm_rx_handler())
1811 * on this now confirmed-gone interface.
1812 */
1813 if (!op->ifindex) {
1814 spin_lock_bh(&op->bcm_rx_update_lock);
1815 if (op->if_detected == dev->ifindex)
1816 op->if_detected = 0;
1817 spin_unlock_bh(&op->bcm_rx_update_lock);
1818 }
1819 }
1820
1821 /* tx_ops: stop device specific cyclic transmissions on the
1822 * vanishing ifindex. Cancelling the timer is enough to stop
1823 * cyclic bcm_can_tx() calls as there is no re-arming.
1824 */
1825 list_for_each_entry(op, &bo->tx_ops, list)
1826 if (op->ifindex == dev->ifindex)
1827 hrtimer_cancel(&op->timer);
1828
1829 /* remove device reference, if this is our bound device */
1830 if (bo->bound && bo->ifindex == dev->ifindex) {
1831#if IS_ENABLED(CONFIG_PROC_FS)
1832 if (sock_net(sk)->can.bcmproc_dir && bo->bcm_proc_read) {
1833 remove_proc_entry(bo->procname, sock_net(sk)->can.bcmproc_dir);
1834 bo->bcm_proc_read = NULL;
1835 }
1836#endif
1837 /* Paired with the lockless fast-path check in
1838 * bcm_sendmsg(); bo->ifindex itself is only ever
1839 * accessed under lock_sock() so it needs no
1840 * annotation.
1841 */
1842 WRITE_ONCE(bo->bound, 0);
1843 bo->ifindex = 0;
1844 notify_enodev = 1;
1845 }
1846
1847 release_sock(sk);
1848
1849 if (notify_enodev) {
1850 sk->sk_err = ENODEV;
1851 if (!sock_flag(sk, SOCK_DEAD))
1852 sk_error_report(sk);
1853 }
1854 break;
1855
1856 case NETDEV_DOWN:
1857 if (bo->bound && bo->ifindex == dev->ifindex) {
1858 sk->sk_err = ENETDOWN;
1859 if (!sock_flag(sk, SOCK_DEAD))
1860 sk_error_report(sk);
1861 }
1862 }
1863}
1864
1865static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
1866 void *ptr)
1867{
1868 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1869
1870 if (dev->type != ARPHRD_CAN)
1871 return NOTIFY_DONE;
1872 if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
1873 return NOTIFY_DONE;
1874 if (unlikely(bcm_busy_notifier)) /* Check for reentrant bug. */
1875 return NOTIFY_DONE;
1876
1877 spin_lock(&bcm_notifier_lock);
1878 list_for_each_entry(bcm_busy_notifier, &bcm_notifier_list, notifier) {
1879 spin_unlock(&bcm_notifier_lock);
1880 bcm_notify(bcm_busy_notifier, msg, dev);
1881 spin_lock(&bcm_notifier_lock);
1882 }
1883 bcm_busy_notifier = NULL;
1884 spin_unlock(&bcm_notifier_lock);
1885 return NOTIFY_DONE;
1886}
1887
1888/*
1889 * initial settings for all BCM sockets to be set at socket creation time
1890 */
1891static int bcm_init(struct sock *sk)
1892{
1893 struct bcm_sock *bo = bcm_sk(sk);
1894
1895 bo->bound = 0;
1896 bo->ifindex = 0;
1897 bo->dropped_usr_msgs = 0;
1898 bo->bcm_proc_read = NULL;
1899
1900 INIT_LIST_HEAD(&bo->tx_ops);
1901 INIT_LIST_HEAD(&bo->rx_ops);
1902
1903 /* set notifier */
1904 spin_lock(&bcm_notifier_lock);
1905 list_add_tail(&bo->notifier, &bcm_notifier_list);
1906 spin_unlock(&bcm_notifier_lock);
1907
1908 return 0;
1909}
1910
1911/*
1912 * standard socket functions
1913 */
1914static int bcm_release(struct socket *sock)
1915{
1916 struct sock *sk = sock->sk;
1917 struct net *net;
1918 struct bcm_sock *bo;
1919 struct bcm_op *op, *next;
1920
1921 if (!sk)
1922 return 0;
1923
1924 net = sock_net(sk);
1925 bo = bcm_sk(sk);
1926
1927 /* remove bcm_ops, timer, rx_unregister(), etc. */
1928
1929 spin_lock(&bcm_notifier_lock);
1930 while (bcm_busy_notifier == bo) {
1931 spin_unlock(&bcm_notifier_lock);
1932 schedule_timeout_uninterruptible(1);
1933 spin_lock(&bcm_notifier_lock);
1934 }
1935 list_del(&bo->notifier);
1936 spin_unlock(&bcm_notifier_lock);
1937
1938 lock_sock(sk);
1939
1940#if IS_ENABLED(CONFIG_PROC_FS)
1941 /* remove procfs entry */
1942 if (net->can.bcmproc_dir && bo->bcm_proc_read)
1943 remove_proc_entry(bo->procname, net->can.bcmproc_dir);
1944#endif /* CONFIG_PROC_FS */
1945
1946 list_for_each_entry_safe(op, next, &bo->tx_ops, list) {
1947 list_del_rcu(&op->list);
1948 bcm_remove_op(op);
1949 }
1950
1951 list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
1952 /*
1953 * Don't care if we're bound or not (due to netdev problems)
1954 * can_rx_unregister() is always a save thing to do here.
1955 */
1956 if (op->ifindex) {
1957 /*
1958 * Only remove subscriptions that had not
1959 * been removed due to NETDEV_UNREGISTER
1960 * in bcm_notifier()
1961 *
1962 * op->rx_reg_dev is a tracked reference taken
1963 * when the subscription was registered, so it
1964 * stays valid here even if a concurrent
1965 * NETDEV_UNREGISTER already unlisted the device.
1966 */
1967 if (op->rx_reg_dev)
1968 bcm_rx_unreg(op->rx_reg_dev, op);
1969 } else
1970 can_rx_unregister(net, NULL, op->can_id,
1971 REGMASK(op->can_id),
1972 bcm_rx_handler, op);
1973
1974 }
1975
1976 synchronize_rcu();
1977
1978 list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
1979 list_del_rcu(&op->list);
1980 bcm_remove_op(op);
1981 }
1982
1983 /* remove device reference */
1984 if (bo->bound) {
1985 WRITE_ONCE(bo->bound, 0);
1986 bo->ifindex = 0;
1987 }
1988
1989 sock_orphan(sk);
1990 sock->sk = NULL;
1991
1992 release_sock(sk);
1993 sock_prot_inuse_add(net, sk->sk_prot, -1);
1994 sock_put(sk);
1995
1996 return 0;
1997}
1998
1999static int bcm_connect(struct socket *sock, struct sockaddr_unsized *uaddr, int len,
2000 int flags)
2001{
2002 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
2003 struct sock *sk = sock->sk;
2004 struct bcm_sock *bo = bcm_sk(sk);
2005 struct net *net = sock_net(sk);
2006 int ret = 0;
2007
2008 if (len < BCM_MIN_NAMELEN)
2009 return -EINVAL;
2010
2011 lock_sock(sk);
2012
2013 if (bo->bound) {
2014 ret = -EISCONN;
2015 goto fail;
2016 }
2017
2018 /* bind a device to this socket */
2019 if (addr->can_ifindex) {
2020 struct net_device *dev;
2021
2022 dev = dev_get_by_index(net, addr->can_ifindex);
2023 if (!dev) {
2024 ret = -ENODEV;
2025 goto fail;
2026 }
2027 if (dev->type != ARPHRD_CAN) {
2028 dev_put(dev);
2029 ret = -ENODEV;
2030 goto fail;
2031 }
2032
2033 bo->ifindex = dev->ifindex;
2034 dev_put(dev);
2035
2036 } else {
2037 /* no interface reference for ifindex = 0 ('any' CAN device) */
2038 bo->ifindex = 0;
2039 }
2040
2041#if IS_ENABLED(CONFIG_PROC_FS)
2042 if (net->can.bcmproc_dir) {
2043 /* unique socket address as filename */
2044 sprintf(bo->procname, "%llu", sock_i_ino(sk));
2045 bo->bcm_proc_read = proc_create_net_single(bo->procname, 0644,
2046 net->can.bcmproc_dir,
2047 bcm_proc_show, sk);
2048 if (!bo->bcm_proc_read) {
2049 ret = -ENOMEM;
2050 goto fail;
2051 }
2052 }
2053#endif /* CONFIG_PROC_FS */
2054
2055 /* bo->ifindex above is fully assigned before this point; pairs
2056 * with the lockless fast-path check in bcm_sendmsg()
2057 */
2058 WRITE_ONCE(bo->bound, 1);
2059
2060fail:
2061 release_sock(sk);
2062
2063 return ret;
2064}
2065
2066static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
2067 int flags)
2068{
2069 struct sock *sk = sock->sk;
2070 struct sk_buff *skb;
2071 int error = 0;
2072 int err;
2073
2074 skb = skb_recv_datagram(sk, flags, &error);
2075 if (!skb)
2076 return error;
2077
2078 if (skb->len < size)
2079 size = skb->len;
2080
2081 err = memcpy_to_msg(msg, skb->data, size);
2082 if (err < 0) {
2083 skb_free_datagram(sk, skb);
2084 return err;
2085 }
2086
2087 sock_recv_cmsgs(msg, sk, skb);
2088
2089 if (msg->msg_name) {
2090 __sockaddr_check_size(BCM_MIN_NAMELEN);
2091 msg->msg_namelen = BCM_MIN_NAMELEN;
2092 memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
2093 }
2094
2095 /* assign the flags that have been recorded in bcm_send_to_user() */
2096 msg->msg_flags |= *(bcm_flags(skb));
2097
2098 skb_free_datagram(sk, skb);
2099
2100 return size;
2101}
2102
2103static int bcm_sock_no_ioctlcmd(struct socket *sock, unsigned int cmd,
2104 unsigned long arg)
2105{
2106 /* no ioctls for socket layer -> hand it down to NIC layer */
2107 return -ENOIOCTLCMD;
2108}
2109
2110static const struct proto_ops bcm_ops = {
2111 .family = PF_CAN,
2112 .release = bcm_release,
2113 .bind = sock_no_bind,
2114 .connect = bcm_connect,
2115 .socketpair = sock_no_socketpair,
2116 .accept = sock_no_accept,
2117 .getname = sock_no_getname,
2118 .poll = datagram_poll,
2119 .ioctl = bcm_sock_no_ioctlcmd,
2120 .gettstamp = sock_gettstamp,
2121 .listen = sock_no_listen,
2122 .shutdown = sock_no_shutdown,
2123 .sendmsg = bcm_sendmsg,
2124 .recvmsg = bcm_recvmsg,
2125 .mmap = sock_no_mmap,
2126};
2127
2128static struct proto bcm_proto __read_mostly = {
2129 .name = "CAN_BCM",
2130 .owner = THIS_MODULE,
2131 .obj_size = sizeof(struct bcm_sock),
2132 .init = bcm_init,
2133};
2134
2135static const struct can_proto bcm_can_proto = {
2136 .type = SOCK_DGRAM,
2137 .protocol = CAN_BCM,
2138 .ops = &bcm_ops,
2139 .prot = &bcm_proto,
2140};
2141
2142static int canbcm_pernet_init(struct net *net)
2143{
2144#if IS_ENABLED(CONFIG_PROC_FS)
2145 /* create /proc/net/can-bcm directory */
2146 net->can.bcmproc_dir = proc_net_mkdir(net, "can-bcm", net->proc_net);
2147#endif /* CONFIG_PROC_FS */
2148
2149 return 0;
2150}
2151
2152static void canbcm_pernet_exit(struct net *net)
2153{
2154#if IS_ENABLED(CONFIG_PROC_FS)
2155 /* remove /proc/net/can-bcm directory */
2156 if (net->can.bcmproc_dir)
2157 remove_proc_entry("can-bcm", net->proc_net);
2158#endif /* CONFIG_PROC_FS */
2159}
2160
2161static struct pernet_operations canbcm_pernet_ops __read_mostly = {
2162 .init = canbcm_pernet_init,
2163 .exit = canbcm_pernet_exit,
2164};
2165
2166static struct notifier_block canbcm_notifier = {
2167 .notifier_call = bcm_notifier
2168};
2169
2170static int __init bcm_module_init(void)
2171{
2172 int err;
2173
2174 bcm_wq = alloc_workqueue("can-bcm-wq", WQ_UNBOUND, 0);
2175 if (!bcm_wq)
2176 return -ENOMEM;
2177
2178 pr_info("can: broadcast manager protocol\n");
2179
2180 err = register_pernet_subsys(&canbcm_pernet_ops);
2181 if (err)
2182 goto register_pernet_failed;
2183
2184 err = register_netdevice_notifier(&canbcm_notifier);
2185 if (err)
2186 goto register_notifier_failed;
2187
2188 err = can_proto_register(&bcm_can_proto);
2189 if (err < 0) {
2190 printk(KERN_ERR "can: registration of bcm protocol failed\n");
2191 goto register_proto_failed;
2192 }
2193
2194 return 0;
2195
2196register_proto_failed:
2197 unregister_netdevice_notifier(&canbcm_notifier);
2198register_notifier_failed:
2199 unregister_pernet_subsys(&canbcm_pernet_ops);
2200register_pernet_failed:
2201 destroy_workqueue(bcm_wq);
2202 return err;
2203}
2204
2205static void __exit bcm_module_exit(void)
2206{
2207 can_proto_unregister(&bcm_can_proto);
2208 unregister_netdevice_notifier(&canbcm_notifier);
2209 unregister_pernet_subsys(&canbcm_pernet_ops);
2210 rcu_barrier();
2211 destroy_workqueue(bcm_wq);
2212}
2213
2214module_init(bcm_module_init);
2215module_exit(bcm_module_exit);