* Re: [PATCH net-next 00/19] Add support for Aquantia AQtion USB to 5/2.5GbE devices
From: Igor Russkikh @ 2018-10-08 7:58 UTC (permalink / raw)
To: Andrew Lunn
Cc: David S . Miller, linux-usb@vger.kernel.org,
netdev@vger.kernel.org, Simon Edelhaus, Nadezhda Krupnina,
Dmitry.Bezrukov
In-Reply-To: <20181006175122.GH6990@lunn.ch>
Hi Andrew,
> Nice patch set, well broken up, easy to review.
>
Thanks a lot for your detailed review, your comments are really useful!
I'll respond to some of your comments separately.
Regards,
Igor
^ permalink raw reply
* Re: [PATCH bpf-next] xsk: proper AF_XDP socket teardown ordering
From: Daniel Borkmann @ 2018-10-08 8:11 UTC (permalink / raw)
To: Björn Töpel, ast, netdev, brouer
Cc: Björn Töpel, magnus.karlsson, magnus.karlsson
In-Reply-To: <20181005112515.3009-1-bjorn.topel@gmail.com>
On 10/05/2018 01:25 PM, Björn Töpel wrote:
> From: Björn Töpel <bjorn.topel@intel.com>
>
> The AF_XDP socket struct can exist in three different, implicit
> states: setup, bound and released. Setup is prior the socket has been
> bound to a device. Bound is when the socket is active for receive and
> send. Released is when the process/userspace side of the socket is
> released, but the sock object is still lingering, e.g. when there is a
> reference to the socket in an XSKMAP after process termination.
>
> The Rx fast-path code uses the "dev" member of struct xdp_sock to
> check whether a socket is bound or relased, and the Tx code uses the
> struct xdp_umem "xsk_list" member in conjunction with "dev" to
> determine the state of a socket.
>
> However, the transition from bound to released did not tear the socket
> down in correct order.
>
> On the Rx side "dev" was cleared after synchronize_net() making the
> synchronization useless. On the Tx side, the internal queues were
> destroyed prior removing them from the "xsk_list".
>
> This commit corrects the cleanup order, and by doing so
> xdp_del_sk_umem() can be simplified and one synchronize_net() can be
> removed.
>
> Fixes: 965a99098443 ("xsk: add support for bind for Rx")
> Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
> Reported-by: Jesper Dangaard Brouer <brouer@redhat.com>
> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Applied to bpf-next, thanks Björn!
^ permalink raw reply
* Re: [PATCH] bpf, doc: Document Jump X addressing mode
From: Daniel Borkmann @ 2018-10-08 8:22 UTC (permalink / raw)
To: Arthur Fabre, Alexei Starovoitov, David S. Miller,
Jonathan Corbet, netdev, linux-doc
In-Reply-To: <20181007084519.27445-1-arthur@arthurfabre.com>
On 10/07/2018 10:45 AM, Arthur Fabre wrote:
> bpf_asm and the other classic BPF tools support jump conditions
> comparing register A to register X, in addition to comparing register A
> with constant K.
> Only the latter was documented in filter.txt, add two new addressing
> modes that describe the former.
>
> Signed-off-by: Arthur Fabre <arthur@arthurfabre.com>
Applied to bpf-next, thanks!
^ permalink raw reply
* Re: [PATCH net] bpf: do not blindly change rlimit in reuseport net selftest
From: Daniel Borkmann @ 2018-10-08 8:34 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller; +Cc: netdev, Eric Dumazet, John Sperbeck
In-Reply-To: <20181006023846.82250-1-edumazet@google.com>
On 10/06/2018 04:38 AM, Eric Dumazet wrote:
> If the current process has unlimited RLIMIT_MEMLOCK,
> we should should leave it as is.
>
> Fixes: 941ff6f11c02 ("bpf: fix rlimit in reuseport net selftest")
> Signed-off-by: John Sperbeck <jsperbeck@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Daniel Borkmann <daniel@iogearbox.net>
Applied to bpf, thanks Eric!
^ permalink raw reply
* Re: [PATCH bpf-next 00/12] nfp: bpf: add support for BPF-to-BPF function calls
From: Daniel Borkmann @ 2018-10-08 8:36 UTC (permalink / raw)
To: Quentin Monnet, Alexei Starovoitov; +Cc: netdev, oss-drivers
In-Reply-To: <1538913418-16039-1-git-send-email-quentin.monnet@netronome.com>
On 10/07/2018 01:56 PM, Quentin Monnet wrote:
> This patch series adds support for hardware offload of programs containing
> BPF-to-BPF function calls. First, a new callback is added to the kernel
> verifier, to collect information after the main part of the verification
> has been performed. Then support for BPF-to-BPF calls is incrementally
> added to the nfp driver, before offloading programs containing such calls
> is eventually allowed by lifting the restriction in the kernel verifier, in
> the last patch. Please refer to individual patches for details.
>
> Many thanks to Jiong and Jakub for their precious help and contribution on
> the main patches for the JIT-compiler, and everything related to stack
> accesses.
>
> Quentin Monnet (12):
> bpf: add verifier callback to get stack usage info for offloaded progs
> nfp: bpf: rename nfp_prog->stack_depth as nfp_prog->stack_frame_depth
> nfp: bpf: copy eBPF subprograms information from kernel verifier
> nfp: bpf: ignore helper-related checks for BPF calls in nfp verifier
> nfp: bpf: account for BPF-to-BPF calls when preparing nfp JIT
> nfp: bpf: add main logics for BPF-to-BPF calls support in nfp driver
> nfp: bpf: account for additional stack usage when checking stack limit
> nfp: bpf: update fixup function for BPF-to-BPF calls support
> nfp: bpf: fix return address from register-saving subroutine to callee
> nfp: bpf: optimise save/restore for R6~R9 based on register usage
> nfp: bpf: support pointers to other stack frames for BPF-to-BPF calls
> bpf: allow offload of programs with BPF-to-BPF function calls
>
> drivers/net/ethernet/netronome/nfp/bpf/jit.c | 381 ++++++++++++++++++++--
> drivers/net/ethernet/netronome/nfp/bpf/main.h | 52 ++-
> drivers/net/ethernet/netronome/nfp/bpf/offload.c | 11 +-
> drivers/net/ethernet/netronome/nfp/bpf/verifier.c | 141 +++++++-
> drivers/net/ethernet/netronome/nfp/nfp_asm.h | 9 +
> drivers/net/netdevsim/bpf.c | 8 +-
> include/linux/bpf.h | 1 +
> include/linux/bpf_verifier.h | 1 +
> kernel/bpf/offload.c | 18 +
> kernel/bpf/verifier.c | 13 +-
> 10 files changed, 589 insertions(+), 46 deletions(-)
>
Applied to bpf-next, thanks Quentin!
^ permalink raw reply
* [PATCH] ethtool: fix a privilege escalation bug
From: Wenwen Wang @ 2018-10-08 15:49 UTC (permalink / raw)
To: Wenwen Wang
Cc: Kangjie Lu, David S. Miller, Florian Fainelli, Kees Cook,
Andrew Lunn, Edward Cree, Ilya Lesokhin, Yury Norov, Alan Brady,
Stephen Hemminger, open list:NETWORKING [GENERAL], open list
In dev_ethtool(), the eth command 'ethcmd' is firstly copied from the
use-space buffer 'useraddr' and checked to see whether it is
ETHTOOL_PERQUEUE. If yes, the sub-command 'sub_cmd' is further copied from
the user space. Otherwise, 'sub_cmd' is the same as 'ethcmd'. Next,
according to 'sub_cmd', a permission check is enforced through the function
ns_capable(). For example, the permission check is required if 'sub_cmd' is
ETHTOOL_SCOALESCE, but it is not necessary if 'sub_cmd' is
ETHTOOL_GCOALESCE, as suggested in the comment "Allow some commands to be
done by anyone". The following execution invokes different handlers
according to 'ethcmd'. Specifically, if 'ethcmd' is ETHTOOL_PERQUEUE,
ethtool_set_per_queue() is called. In ethtool_set_per_queue(), the kernel
object 'per_queue_opt' is copied again from the user-space buffer
'useraddr' and 'per_queue_opt.sub_command' is used to determine which
operation should be performed. Given that the buffer 'useraddr' is in the
user space, a malicious user can race to change the sub-command between the
two copies. In particular, the attacker can supply ETHTOOL_PERQUEUE and
ETHTOOL_GCOALESCE to bypass the permission check in dev_ethtool(). Then
before ethtool_set_per_queue() is called, the attacker changes
ETHTOOL_GCOALESCE to ETHTOOL_SCOALESCE. In this way, the attacker can
bypass the permission check and execute ETHTOOL_SCOALESCE.
This patch enforces a check in ethtool_set_per_queue() after the second
copy from 'useraddr'. If the sub-command is different from the one obtained
in the first copy in dev_ethtool(), an error code EINVAL will be returned.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
net/core/ethtool.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c9993c6..ccb337e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -2462,13 +2462,17 @@ static int ethtool_set_per_queue_coalesce(struct net_device *dev,
return ret;
}
-static int ethtool_set_per_queue(struct net_device *dev, void __user *useraddr)
+static int ethtool_set_per_queue(struct net_device *dev,
+ void __user *useraddr, u32 sub_cmd)
{
struct ethtool_per_queue_op per_queue_opt;
if (copy_from_user(&per_queue_opt, useraddr, sizeof(per_queue_opt)))
return -EFAULT;
+ if (per_queue_opt.sub_command != sub_cmd)
+ return -EINVAL;
+
switch (per_queue_opt.sub_command) {
case ETHTOOL_GCOALESCE:
return ethtool_get_per_queue_coalesce(dev, useraddr, &per_queue_opt);
@@ -2838,7 +2842,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
rc = ethtool_get_phy_stats(dev, useraddr);
break;
case ETHTOOL_PERQUEUE:
- rc = ethtool_set_per_queue(dev, useraddr);
+ rc = ethtool_set_per_queue(dev, useraddr, sub_cmd);
break;
case ETHTOOL_GLINKSETTINGS:
rc = ethtool_get_link_ksettings(dev, useraddr);
--
2.7.4
^ permalink raw reply related
* RE: [PATCH] usbnet: smsc95xx: simplify tx_fixup code
From: David Laight @ 2018-10-08 8:41 UTC (permalink / raw)
To: 'David Miller', ben.dooks@codethink.co.uk
Cc: netdev@vger.kernel.org, oneukum@suse.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kernel@lists.codethink.co.uk
In-Reply-To: <20181005.142412.601607260441380535.davem@davemloft.net>
From: David Miller
> Sent: 05 October 2018 22:24
>
> From: Ben Dooks <ben.dooks@codethink.co.uk>
> Date: Tue, 2 Oct 2018 17:56:02 +0100
>
> > - memcpy(skb->data, &tx_cmd_a, 4);
> > + ptr = skb_push(skb, 8);
> > + tx_cmd_a = cpu_to_le32(tx_cmd_a);
> > + tx_cmd_b = cpu_to_le32(tx_cmd_b);
> > + memcpy(ptr, &tx_cmd_a, 4);
> > + memcpy(ptr+4, &tx_cmd_b, 4);
>
> Even a memcpy() through a void pointer does not guarantee that gcc will
> not emit word sized loads and stores.
True, but only if gcc can 'see' something that would require the
pointer be aligned.
In this case the void pointer comes from an external function
so is fine.
> You must use the get_unaligned()/put_unaligned() facilities to do this
> properly.
>
> I also agree that making a proper type and structure instead of using
> a void pointer would be better.
The structure would need to be marked 'packed' - since its alignment
isn't guaranteed.
Then you don't need to use put_unaligned().
If it wasn't 'packed' then gcc would implement
memcpy(&hdr->tx_cmd_a, &tx_cmd_a, 4) using an aligned write.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
^ permalink raw reply
* Re: [PATCH] rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version
From: Larry Finger @ 2018-10-08 15:53 UTC (permalink / raw)
To: Colin King, Ping-Ke Shih, Kalle Valo, David S . Miller,
linux-wireless, netdev
Cc: kernel-janitors, linux-kernel
In-Reply-To: <20181008085028.23874-1-colin.king@canonical.com>
On 10/8/18 3:50 AM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Function _rtl8821ae_mrate_idx_to_arfr_id is functionally identical to
> the generic version rtl_mrate_idx_to_arfr_id, so remove
> _rtl8821ae_mrate_idx_to_arfr_id and use the generic one instead.
>
> This also fixes a missing break statement found by CoverityScan in
> _rtl8821ae_mrate_idx_to_arfr_id, namely: CID#1167237 ("Missing break
> in switch")
>
> Thanks to Joe Perches for spotting this when I submitted an earlier patch.
>
> Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> .../wireless/realtek/rtlwifi/rtl8821ae/hw.c | 71 +------------------
> 1 file changed, 1 insertion(+), 70 deletions(-)
>
> diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
> index 317c1b3101da..ba258318ee9f 100644
> --- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
> +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
> @@ -3404,75 +3404,6 @@ static void rtl8821ae_update_hal_rate_table(struct ieee80211_hw *hw,
> "%x\n", rtl_read_dword(rtlpriv, REG_ARFR0));
> }
>
> -static u8 _rtl8821ae_mrate_idx_to_arfr_id(
> - struct ieee80211_hw *hw, u8 rate_index,
> - enum wireless_mode wirelessmode)
> -{
> - struct rtl_priv *rtlpriv = rtl_priv(hw);
> - struct rtl_phy *rtlphy = &rtlpriv->phy;
> - u8 ret = 0;
> - switch (rate_index) {
> - case RATR_INX_WIRELESS_NGB:
> - if (rtlphy->rf_type == RF_1T1R)
> - ret = 1;
> - else
> - ret = 0;
> - ; break;
> - case RATR_INX_WIRELESS_N:
> - case RATR_INX_WIRELESS_NG:
> - if (rtlphy->rf_type == RF_1T1R)
> - ret = 5;
> - else
> - ret = 4;
> - ; break;
> - case RATR_INX_WIRELESS_NB:
> - if (rtlphy->rf_type == RF_1T1R)
> - ret = 3;
> - else
> - ret = 2;
> - ; break;
> - case RATR_INX_WIRELESS_GB:
> - ret = 6;
> - break;
> - case RATR_INX_WIRELESS_G:
> - ret = 7;
> - break;
> - case RATR_INX_WIRELESS_B:
> - ret = 8;
> - break;
> - case RATR_INX_WIRELESS_MC:
> - if ((wirelessmode == WIRELESS_MODE_B)
> - || (wirelessmode == WIRELESS_MODE_G)
> - || (wirelessmode == WIRELESS_MODE_N_24G)
> - || (wirelessmode == WIRELESS_MODE_AC_24G))
> - ret = 6;
> - else
> - ret = 7;
> - case RATR_INX_WIRELESS_AC_5N:
> - if (rtlphy->rf_type == RF_1T1R)
> - ret = 10;
> - else
> - ret = 9;
> - break;
> - case RATR_INX_WIRELESS_AC_24N:
> - if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_80) {
> - if (rtlphy->rf_type == RF_1T1R)
> - ret = 10;
> - else
> - ret = 9;
> - } else {
> - if (rtlphy->rf_type == RF_1T1R)
> - ret = 11;
> - else
> - ret = 12;
> - }
> - break;
> - default:
> - ret = 0; break;
> - }
> - return ret;
> -}
> -
> static u32 _rtl8821ae_rate_to_bitmap_2ssvht(__le16 vht_rate)
> {
> u8 i, j, tmp_rate;
> @@ -3761,7 +3692,7 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
> break;
> }
>
> - ratr_index = _rtl8821ae_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
> + ratr_index = rtl_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
> sta_entry->ratr_index = ratr_index;
> ratr_bitmap = _rtl8821ae_set_ra_vht_ratr_bitmap(hw, wirelessmode,
> ratr_bitmap);
>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Thanks,
Larry
^ permalink raw reply
* Re: [PATCH net-next 02/11] net: sched: cls_u32: make sure that divisor is a power of 2
From: Sergei Shtylyov @ 2018-10-08 8:46 UTC (permalink / raw)
To: Jamal Hadi Salim, davem; +Cc: jiri, xiyou.wangcong, viro, netdev
In-Reply-To: <20181007163811.18453-3-jhs@emojatatu.com>
Hello!
On 07.10.2018 19:38, Jamal Hadi Salim wrote:
> From: Al Viro <viro@zeniv.linux.org.uk>
>
> Tested by modifying iproute2 to to allow
One "to" is enough, no? :-)
> sending a divisor > 255
>
> Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
[...]
MBR, Sergei
^ permalink raw reply
* Re: [PATCH] net: wireless: iwlegacy: Add a lock assertion in il4965_send_rxon_assoc()
From: Stanislaw Gruszka @ 2018-10-08 8:54 UTC (permalink / raw)
To: Jia-Ju Bai; +Cc: kvalo, davem, linux-wireless, netdev, linux-kernel
In-Reply-To: <20181005135546.21011-1-baijiaju1990@gmail.com>
On Fri, Oct 05, 2018 at 09:55:46PM +0800, Jia-Ju Bai wrote:
> The variables il->staging.filter_flags, rxon1->filter_flags and
> rxon2->filter_flags need to be protected by the mutex lock il->mutex.
> This patch adds a lock assertion of il->mutex to check whether
> this lock is held.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
^ permalink raw reply
* Re: general protection fault in __handle_mm_fault
From: Willem de Bruijn @ 2018-10-08 16:10 UTC (permalink / raw)
To: syzbot+1577fbe983d20fe2e88f
Cc: David Miller, Eric Dumazet, Alexey Kuznetsov, LKML,
Network Development, syzkaller-bugs, Hideaki YOSHIFUJI
In-Reply-To: <0000000000009d47b2057782bab4@google.com>
On Fri, Oct 5, 2018 at 6:27 PM syzbot
<syzbot+1577fbe983d20fe2e88f@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 25bcda3e8b9f Add linux-next specific files for 20181004
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=130e3bf1400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=603d7f9140c3368a
> dashboard link: https://syzkaller.appspot.com/bug?extid=1577fbe983d20fe2e88f
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127e88d6400000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13cdb67e400000
> RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20
> arch/x86/lib/copy_user_64.S:180
> Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f
> 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 <f3> a4 31 c0 0f
> 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83
> RSP: 0018:ffff8801bbe675b8 EFLAGS: 00010202
> RAX: 0000000000000000 RBX: 0000000000007a50 RCX: 0000000000001b40
> RDX: 0000000000007a50 RSI: 0000000020077000 RDI: ffff8801ce615f10
> RBP: ffff8801bbe675f0 R08: ffffed0039cc2f4a R09: ffffed0039cc2f4a
> R10: ffffed0039cc2f49 R11: ffff8801ce617a4f R12: 0000000020078b40
> R13: 00000000200710f0 R14: ffff8801ce610000 R15: 00007ffffffff000
> _copy_from_iter_full+0x263/0xc20 lib/iov_iter.c:724
> copy_from_iter_full include/linux/uio.h:124 [inline]
> skb_do_copy_data_nocache include/net/sock.h:1951 [inline]
> skb_copy_to_page_nocache include/net/sock.h:1977 [inline]
> tcp_sendmsg_locked+0x159e/0x3f90 net/ipv4/tcp.c:1338
This started on next-20181004. It still happens as of next-20181008.
It does not trigger on next 20181003. It does not occur if
CONFIG_DEBUG_KOBJECT is disabled.
^ permalink raw reply
* [PATCH net-next] netdev: remove useless codes of tun_automq_select_queue
From: Wang Li @ 2018-10-08 8:51 UTC (permalink / raw)
To: netdev
Because the function __skb_get_hash_symmetric always returns non-zero.
Signed-off-by: Zhang Yu <zhangyu31@baidu.com>
Signed-off-by: Wang Li <wangli39@baidu.com>
---
drivers/net/tun.c | 35 +++++++++++++----------------------
1 file changed, 13 insertions(+), 22 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index e2648b5a3861..9647da2c5651 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -562,12 +562,11 @@ static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash)
e->rps_rxhash = hash;
}
-/* We try to identify a flow through its rxhash first. The reason that
+/* We try to identify a flow through its rxhash. The reason that
* we do not check rxq no. is because some cards(e.g 82599), chooses
* the rxq based on the txq where the last packet of the flow comes. As
* the userspace application move between processors, we may get a
- * different rxq no. here. If we could not get rxhash, then we would
- * hope the rxq no. may help here.
+ * different rxq no. here.
*/
static u16 tun_automq_select_queue(struct tun_struct *tun, struct sk_buff *skb)
{
@@ -578,18 +577,13 @@ static u16 tun_automq_select_queue(struct tun_struct *tun, struct sk_buff *skb)
numqueues = READ_ONCE(tun->numqueues);
txq = __skb_get_hash_symmetric(skb);
- if (txq) {
- e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
- if (e) {
- tun_flow_save_rps_rxhash(e, txq);
- txq = e->queue_index;
- } else
- /* use multiply and shift instead of expensive divide */
- txq = ((u64)txq * numqueues) >> 32;
- } else if (likely(skb_rx_queue_recorded(skb))) {
- txq = skb_get_rx_queue(skb);
- while (unlikely(txq >= numqueues))
- txq -= numqueues;
+ e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
+ if (e) {
+ tun_flow_save_rps_rxhash(e, txq);
+ txq = e->queue_index;
+ } else {
+ /* use multiply and shift instead of expensive divide */
+ txq = ((u64)txq * numqueues) >> 32;
}
return txq;
@@ -1045,15 +1039,12 @@ static void tun_automq_xmit(struct tun_struct *tun, struct sk_buff *skb)
* RPS hash and save it into the flow_table here.
*/
__u32 rxhash;
+ struct tun_flow_entry *e;
rxhash = __skb_get_hash_symmetric(skb);
- if (rxhash) {
- struct tun_flow_entry *e;
- e = tun_flow_find(&tun->flows[tun_hashfn(rxhash)],
- rxhash);
- if (e)
- tun_flow_save_rps_rxhash(e, rxhash);
- }
+ e = tun_flow_find(&tun->flows[tun_hashfn(rxhash)], rxhash);
+ if (e)
+ tun_flow_save_rps_rxhash(e, rxhash);
}
#endif
}
--
2.15.2 (Apple Git-101.1)
^ permalink raw reply related
* Re: [PATCH net-next 05/19] net: usb: aqc111: Introduce PHY access
From: Igor Russkikh @ 2018-10-08 9:09 UTC (permalink / raw)
To: Andrew Lunn
Cc: David S . Miller, linux-usb@vger.kernel.org,
netdev@vger.kernel.org, Dmitry Bezrukov
In-Reply-To: <20181005220418.GA29867@lunn.ch>
Hi Andrew,
>>
>> + struct aqc111_data *aqc111_data = (struct aqc111_data *)dev->data[0];
>
> Having to do this cast all the time is quiet ugly. It seems like some
> other usb_net drivers use netdev_priv().
As I see most of usb usbnet based devices use the same theme with accessing
private data via dev->data.
netdev_priv() is used to store struct usbnet itself.
>> + u8 dpa; /*direct PHY access*/
>> + struct aqc111_phy_options phy_ops;
>> +} __packed;
>
> Why pack this? Do you send it to the firmware?
Agreed, no. We have to pack phy_ops and wol_config only.
Regards,
Igor
^ permalink raw reply
* Re: [PATCH net-next 06/19] net: usb: aqc111: Introduce link management
From: Igor Russkikh @ 2018-10-08 9:29 UTC (permalink / raw)
To: Andrew Lunn
Cc: David S . Miller, linux-usb@vger.kernel.org,
netdev@vger.kernel.org, Dmitry Bezrukov
In-Reply-To: <20181006173510.GE6990@lunn.ch>
Hi Andrew,
>> aqc111_read_fw_version(dev, aqc111_data);
>> + aqc111_data->autoneg = AUTONEG_ENABLE;
>> + aqc111_data->advertised_speed = (usb_speed == USB_SPEED_SUPER) ?
>> + SPEED_5000 : SPEED_1000;
>
> USB 3 has a raw bandwidth of 5Gbps. But it is a shared bus. So you
> have no guaranteed you are actually going to get the needed bandwidth
> to support line rate.
>
> USB 2.0 only gives you 480Mbps. So it won't even give you the full
> 1G. So using the same reasoning for USB3, maybe you should limit it to
> 100Mbps?
>
> I personally would not apply restrictions on the PHY depending on what
> USB is being used.
First argument here is to reduce power consumption on USB2.
2.5G/5G uses OCSGMII/XFI serdes which consumes more power.
Of course in normal conditions usb2 is capable to feed that, but
the risk still exists on legacy usb2 hardware.
> This becomes more important when using SFPs. If i have an SFP peer
> which is expecting 2500Base-X, but because the device is plugged into
> USB 2 port it is forced to use 1000Base-X, it is not going to get
> link.
Do you mean here 2500Base-T? This particular device is an integrated
mac+phy, thus we can't easily link it with -X SFP endpoint.
Although its not a common usecase for the consumer dongle to connect to SFP
endpoints, think your comment is quite reasonable.
We'll clarify this internally.
Regards,
Igor
^ permalink raw reply
* Re: [PATCH net-next 08/20] rtnetlink: Update rtnl_dump_ifinfo for strict data checking
From: Christian Brauner @ 2018-10-08 9:47 UTC (permalink / raw)
To: David Ahern; +Cc: David Ahern, netdev, davem, jbenc, stephen
In-Reply-To: <9ef11e8b-87c9-80d4-c3d6-d9028dd506c1@gmail.com>
On Sun, Oct 07, 2018 at 07:29:13PM -0600, David Ahern wrote:
> On 10/7/18 4:29 AM, Christian Brauner wrote:
> >> I thought about that, but there is so much overlap - they are mostly
> >> common. Besides, ifinfomsg is the header for link dumps, and ifinfomsg
> >> is the one that has been (ab)used for other message types, so strict
> >> versus lenient does not really have a differentiator for this message
> >> type - other than checking the elements of the struct.
> >
> > It's mostly about the function being extremely long and convoluted.
> > Having parts moved out into (a) descriptive helper(s) with whatever name
> > might make this way more readable than it is now especially with the new
> > handling we need for strict checking.
> >
>
> understood. In the next version I have pushed most of the checking into
> helpers.
Thank you!
^ permalink raw reply
* Re: [PATCH 1/3] bpf: allow zero-initializing hash map seed
From: Lorenz Bauer @ 2018-10-08 9:48 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Jann Horn, Alexei Starovoitov, Daniel Borkmann, netdev, linux-api
In-Reply-To: <20181005210732.ft77r5qqcoqpiwu7@ast-mbp.dhcp.thefacebook.com>
On Fri, 5 Oct 2018 at 22:07, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Fri, Oct 05, 2018 at 04:27:58PM +0200, Jann Horn wrote:
> >
> > Can you please describe exactly why something that is not a kernel
> > unit test needs deterministic BPF hash map behavior?
>
> my use case for deterministic hashing is performance analysis.
> Both while developing and tuning bpf program and while optimizing
> kernel side implementation.
> Local dos is a valid concern, so requiring root for this flag makes sense.
>
Ok, I'll respin and address the comments.
--
Lorenz Bauer | Systems Engineer
25 Lavington St., London SE1 0NZ
www.cloudflare.com
^ permalink raw reply
* [PATCH v1 0/5] can: add SAE J1939 protocol
From: Oleksij Rempel @ 2018-10-08 9:48 UTC (permalink / raw)
To: dev.kurt, mkl, wg; +Cc: Oleksij Rempel, kernel, linux-can, netdev
This series adds SAE J1939 support to the current kernel v4.19-rc6.
This stack has long history, starting back in 27 Apr 2011, if not
earlier:
https://lists.openwall.net/netdev/2011/04/27/45
After major rework and testing it is a time to send it mainline.
Kurt Van Dijck (2):
mailmap: update email address
can: introduce REQUIRED_SIZE macro
Oleksij Rempel (2):
can: add socket type for CAN_J1939
can: extend sockaddr_can to include j1939 members
The j1939 authors (1):
can: add support of SAE J1939 protocol.
.mailmap | 1 +
Documentation/networking/j1939.txt | 468 ++++++++++
MAINTAINERS | 10 +
include/linux/can/can-ml.h | 3 +
include/linux/can/core.h | 8 +
include/uapi/linux/can.h | 20 +-
include/uapi/linux/can/j1939.h | 83 ++
net/can/Kconfig | 2 +
net/can/Makefile | 2 +
net/can/bcm.c | 4 +-
net/can/j1939/Kconfig | 23 +
net/can/j1939/Makefile | 12 +
net/can/j1939/address-claim.c | 224 +++++
net/can/j1939/bus.c | 309 +++++++
net/can/j1939/j1939-priv.h | 176 ++++
net/can/j1939/main.c | 371 ++++++++
net/can/j1939/socket.c | 781 ++++++++++++++++
net/can/j1939/transport.c | 1333 ++++++++++++++++++++++++++++
net/can/raw.c | 4 +-
19 files changed, 3829 insertions(+), 5 deletions(-)
create mode 100644 Documentation/networking/j1939.txt
create mode 100644 include/uapi/linux/can/j1939.h
create mode 100644 net/can/j1939/Kconfig
create mode 100644 net/can/j1939/Makefile
create mode 100644 net/can/j1939/address-claim.c
create mode 100644 net/can/j1939/bus.c
create mode 100644 net/can/j1939/j1939-priv.h
create mode 100644 net/can/j1939/main.c
create mode 100644 net/can/j1939/socket.c
create mode 100644 net/can/j1939/transport.c
--
2.19.0
^ permalink raw reply
* [PATCH v1 4/5] can: extend sockaddr_can to include j1939 members
From: Oleksij Rempel @ 2018-10-08 9:48 UTC (permalink / raw)
To: dev.kurt, mkl, wg; +Cc: Oleksij Rempel, kernel, linux-can, netdev
In-Reply-To: <20181008094836.14080-1-o.rempel@pengutronix.de>
This patch prepares struct sockaddr_can for SAE J1939.
Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
---
include/uapi/linux/can.h | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
index 06d92d6be6e6..1e988fdeba34 100644
--- a/include/uapi/linux/can.h
+++ b/include/uapi/linux/can.h
@@ -175,6 +175,23 @@ struct sockaddr_can {
/* transport protocol class address information (e.g. ISOTP) */
struct { canid_t rx_id, tx_id; } tp;
+ /* J1939 address information */
+ struct {
+ /* 8 byte name when using dynamic addressing */
+ __u64 name;
+
+ /* pgn:
+ * 8 bit: PS in PDU2 case, else 0
+ * 8 bit: PF
+ * 1 bit: DP
+ * 1 bit: reserved
+ */
+ __u32 pgn;
+
+ /* 1 byte address */
+ __u8 addr;
+ } j1939;
+
/* reserved for future CAN protocols address information */
} can_addr;
};
--
2.19.0
^ permalink raw reply related
* [PATCH v1 3/5] can: add socket type for CAN_J1939
From: Oleksij Rempel @ 2018-10-08 9:48 UTC (permalink / raw)
To: dev.kurt, mkl, wg; +Cc: Oleksij Rempel, kernel, linux-can, netdev
In-Reply-To: <20181008094836.14080-1-o.rempel@pengutronix.de>
This patch is a preparation for SAE J1939 and adds CAN_J1939
socket type.
Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
---
include/uapi/linux/can.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
index 0afb7d8e867f..06d92d6be6e6 100644
--- a/include/uapi/linux/can.h
+++ b/include/uapi/linux/can.h
@@ -157,7 +157,8 @@ struct canfd_frame {
#define CAN_TP20 4 /* VAG Transport Protocol v2.0 */
#define CAN_MCNET 5 /* Bosch MCNet */
#define CAN_ISOTP 6 /* ISO 15765-2 Transport Protocol */
-#define CAN_NPROTO 7
+#define CAN_J1939 7 /* SAE J1939 */
+#define CAN_NPROTO 8
#define SOL_CAN_BASE 100
--
2.19.0
^ permalink raw reply related
* [PATCH v1 1/5] mailmap: update email address
From: Oleksij Rempel @ 2018-10-08 9:48 UTC (permalink / raw)
To: dev.kurt, mkl, wg; +Cc: Oleksij Rempel, kernel, linux-can, netdev
In-Reply-To: <20181008094836.14080-1-o.rempel@pengutronix.de>
From: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
This commit replaces my company's email address with a stable private
address.
Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
---
.mailmap | 1 +
1 file changed, 1 insertion(+)
diff --git a/.mailmap b/.mailmap
index 285e09645b31..3a21065be038 100644
--- a/.mailmap
+++ b/.mailmap
@@ -48,6 +48,7 @@ Damian Hobson-Garcia <dhobsong@igel.co.jp>
David Brownell <david-b@pacbell.net>
David Woodhouse <dwmw2@shinybook.infradead.org>
Deng-Cheng Zhu <dengcheng.zhu@mips.com> <dengcheng.zhu@imgtec.com>
+<dev.kurt@vandijck-laurijssen.be> <kurt.van.dijck@eia.be>
Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Domen Puncer <domen@coderock.org>
Douglas Gilbert <dougg@torque.net>
--
2.19.0
^ permalink raw reply related
* [PATCH v1 2/5] can: introduce REQUIRED_SIZE macro
From: Oleksij Rempel @ 2018-10-08 9:48 UTC (permalink / raw)
To: dev.kurt, mkl, wg
Cc: Kurt Van Dijck, Oleksij Rempel, kernel, linux-can, netdev
In-Reply-To: <20181008094836.14080-1-o.rempel@pengutronix.de>
From: Kurt Van Dijck <kurt.van.dijck@eia.be>
The size of this structure will be increased with J1939 support.
To stay binary compatible, the REQUIRED_SIZE macro is introduced
for existing CAN protocols.
Signed-off-by: Kurt Van Dijck <kurt.van.dijck@eia.be>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
---
include/linux/can/core.h | 8 ++++++++
net/can/bcm.c | 4 ++--
net/can/raw.c | 4 ++--
3 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 6099bc18bd0c..39ea254bb548 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -41,6 +41,14 @@ struct can_proto {
struct proto *prot;
};
+/* required_size
+ * macro to find the minimum size of a struct
+ * that includes a requested member
+ */
+#define REQUIRED_SIZE(struct_type, member) \
+ (offsetof(typeof(struct_type), member) + \
+ sizeof(((typeof(struct_type) *)(NULL))->member))
+
/* function prototypes for the CAN networklayer core (af_can.c) */
extern int can_proto_register(const struct can_proto *cp);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..3c8ab7fe793f 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1318,7 +1318,7 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
/* no bound device as default => check msg_name */
DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
- if (msg->msg_namelen < sizeof(*addr))
+ if (msg->msg_namelen < REQUIRED_SIZE(*addr, can_ifindex))
return -EINVAL;
if (addr->can_family != AF_CAN)
@@ -1560,7 +1560,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
struct net *net = sock_net(sk);
int ret = 0;
- if (len < sizeof(*addr))
+ if (len < REQUIRED_SIZE(*addr, can_ifindex))
return -EINVAL;
lock_sock(sk);
diff --git a/net/can/raw.c b/net/can/raw.c
index 1051eee82581..93f2f7b0f46a 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -399,7 +399,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
int err = 0;
int notify_enetdown = 0;
- if (len < sizeof(*addr))
+ if (len < REQUIRED_SIZE(*addr, can_ifindex))
return -EINVAL;
if (addr->can_family != AF_CAN)
return -EINVAL;
@@ -735,7 +735,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
if (msg->msg_name) {
DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
- if (msg->msg_namelen < sizeof(*addr))
+ if (msg->msg_namelen < REQUIRED_SIZE(*addr, can_ifindex))
return -EINVAL;
if (addr->can_family != AF_CAN)
--
2.19.0
^ permalink raw reply related
* [PATCH v1 5/5] can: add support of SAE J1939 protocol.
From: Oleksij Rempel @ 2018-10-08 9:48 UTC (permalink / raw)
To: dev.kurt, mkl, wg
Cc: The j1939 authors, Bastian Stender, Elenita Hinds, Maxime Jayat,
Robin van der Gracht, Oleksij Rempel, kernel, netdev
In-Reply-To: <20181008094836.14080-1-o.rempel@pengutronix.de>
From: The j1939 authors <linux-can@vger.kernel.org>
SAE J1939 is the vehicle bus recommended practice used for communication
and diagnostics among vehicle components. Originating in the car and
heavy-duty truck industry in the United States, it is now widely used in
other parts of the world.
J1939, ISO 11783 and NMEA 2000 all share the same high level protocol.
SAE J1939 can be considered the replacement for the older SAE J1708 and
SAE J1587 specifications.
Signed-off-by: Bastian Stender <bst@pengutronix.de>
Signed-off-by: Elenita Hinds <ecathinds@gmail.com>
Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
---
Documentation/networking/j1939.txt | 468 ++++++++++
MAINTAINERS | 10 +
include/linux/can/can-ml.h | 3 +
include/uapi/linux/can/j1939.h | 83 ++
net/can/Kconfig | 2 +
net/can/Makefile | 2 +
net/can/j1939/Kconfig | 23 +
net/can/j1939/Makefile | 12 +
net/can/j1939/address-claim.c | 224 +++++
net/can/j1939/bus.c | 309 +++++++
net/can/j1939/j1939-priv.h | 176 ++++
net/can/j1939/main.c | 371 ++++++++
net/can/j1939/socket.c | 781 ++++++++++++++++
net/can/j1939/transport.c | 1333 ++++++++++++++++++++++++++++
14 files changed, 3797 insertions(+)
create mode 100644 Documentation/networking/j1939.txt
create mode 100644 include/uapi/linux/can/j1939.h
create mode 100644 net/can/j1939/Kconfig
create mode 100644 net/can/j1939/Makefile
create mode 100644 net/can/j1939/address-claim.c
create mode 100644 net/can/j1939/bus.c
create mode 100644 net/can/j1939/j1939-priv.h
create mode 100644 net/can/j1939/main.c
create mode 100644 net/can/j1939/socket.c
create mode 100644 net/can/j1939/transport.c
diff --git a/Documentation/networking/j1939.txt b/Documentation/networking/j1939.txt
new file mode 100644
index 000000000000..6d03bc8b2f2c
--- /dev/null
+++ b/Documentation/networking/j1939.txt
@@ -0,0 +1,468 @@
+============================================================================
+
+j1939.txt
+
+Readme file for the J1939 Protocol
+
+This file contains
+
+ 1 Overview / What is j1939
+ 1.1 specifications used
+
+ 2 Motivation
+
+ 3 J1939 concepts
+ 3.1 socket type
+ 3.2 addressing
+ 3.3 priority
+ 3.4 PGN
+ 3.5 filtering
+ 3.6 destinations with dynamic address
+
+ 4 How to use J1939
+ 4.1 API calls
+ 4.1.1 Message flags during sendmsg
+ 4.1.2 SCM_J1939_DEST_ADDR & SCM_J1939_DEST_NAME
+ 4.1.3 SCM_J1939_PRIORITY
+ 4.2 Dynamic addressing
+ 4.3 Send Examples
+ 4.3.1 Static address
+ 4.3.2 Dynamic address
+ 4.3.3 Mixed mode
+
+ 5 socket options
+ 5.1 SO_J1939_FILTER
+ 5.2 SO_J1939_PROMISC
+ 5.3 SO_J1939_RECV_OWN
+ 5.4 SO_J1939_SEND_PRIO
+
+ 6 Credits
+
+============================================================================
+
+1. Introduction
+--------------------------------
+
+ SAE J1939 defines a higher layer protocol on CAN. It implements a more
+ sophisticated addressing scheme and extends the maximum packet size above
+ 8 bytes. Several derived specifications exists, which differ from the
+ original j1939 on the application level, like MilCAN A, NMEA2000 and
+ especially ISO-11783 (ISOBUS). This last one specifies the so-called ETP
+ (Extended Transport Protocol) which is has been included in this
+ implementation. This inclusion results in a maximum packet size of
+ ((2^24)-1)*7 bytes
+
+
+1.1 specifications used
+
+ SAE J1939-21 : data link layer
+ SAE J1939-81 : network management
+ ISO 11783-6 : Virtual Terminal (Extended Transport Protocol)
+
+
+2. Motivation
+--------------------------------
+
+ Given the fact there's something like SocketCAN with an API similar to BSD
+ sockets, we found some reasons to justify a kernel implementation for the
+ addressing and transport methods used by J1939.
+
+ * addressing:
+ When a process on an ECU communicates via j1939, it should not necessarily
+ know its source address. Although at least 1 process per ECU should know
+ the source address. Other processes should be able to reuse that address.
+ This way, address parameters for different processes cooperating for the
+ same ECU, are not duplicated.
+ This way of working is closely related to the unix concept where programs
+ do just 1 thing, and do it well.
+
+ * dynamic addressing:
+ Address Claiming in J1939 is time critical. Furthermore data transport
+ should be handled properly during the address negotiation. Putting these
+ functionality in the kernel eliminates this functionality as a requirement
+ for _every_ userspace process that communicates via J1939. This results in
+ a consistent J1939 bus with proper addressing.
+
+ * transport:
+ Both TP & ETP reuse some PGN's to relay big packets over them. Different
+ processes may thus use the same TP & ETP PGN's without actually knowing it.
+ The individual TP & ETP sessions _must_ be serialized (synchronised)
+ between different processes. The kernel solves this problem properly, and
+ eliminates the serialisation (synchronisation) as a requirement for
+ _every_ userspace process that communicates via J1939.
+
+ J1939 defines some other features (relaying, gateway, Fast Packet transport,
+ ...). In-kernel code for these would not contribute to protocol stability.
+ Therefore, these parts are left to userspace.
+
+ The j1939 sockets operate on CAN network devices (see SocketCAN). Any j1939
+ userspace library operating on CAN raw sockets will still operate properly.
+ Since such library does not communicate with the in-kernel implementation,
+ care must be taken that these 2 do not interfere. In practice, this means
+ they cannot share ECU addresses. A single ECU (or virtual ECU) address is
+ used by the library exclusively, or by the in-kernel system exclusively.
+
+
+3. J1939 concepts
+--------------------------------
+
+3.1 PGN
+
+ The PGN (Parameter Group Number) is a number to identify a packet. The PGN
+ is composed as follows:
+ 1 bit : Reserved Bit
+ 1 bit : Data Page
+ 8 bits : PF (PDU Format)
+ 8 bits : PS (PDU Specific)
+
+ In J1939-21, distinction is made between PDU1 Format (where PF < 240) and
+ PDU2 Format (where PF >= 240). Furthermore, when using PDU2 Format, the
+ PS-field contains a so-called Group Extension, which is part of the PGN.
+ When using PDU2 Format, the Group Extension is set in the PS-field.
+
+ On the other hand, when using PDU1 Format, the PS-field contains a so-called
+ Destination Address, which is _not_ part of the PGN. When communicating a
+ PGN from userspace to kernel (or visa versa) and PDU2 Format is used, the
+ PS-field of the PGN shall be set to zero. The Destination Address shall be
+ set elsewhere.
+
+ Regarding PGN mapping to 29-bit CAN identifier, the Destination Address
+ shall be get/set from/to the appropriate bits of the identifier by the kernel.
+
+
+3.2 addressing
+
+ Both static and dynamic addressing methods can be used.
+
+ For static addresses, no extra checks are made by the kernel, and provided
+ addresses are considered right. This responsibility is for the OEM or system
+ integrator.
+
+ For dynamic addressing, so-called Address Claiming, extra support is forseen
+ in the kernel. In J1939 any ECU is known by it's 64-bit NAME. At the moment
+ of succesfull address claim, the kernel keeps track of both NAME and source
+ address being claimed. This serves as a base for filter schemes. By default,
+ packets with a destination that is not locally, will be rejected soon after
+ reception.
+
+ Mixed mode packets (from a static to a dynamic address or vice versa) are
+ allowed. The BSD sockets define separate API calls for getting/setting the
+ local & remote address and are applicable for J1939 sockets.
+
+
+3.3 Filtering
+
+ Similar to SocketCAN, j1939 defines filters per socket that a user can set
+ in order to receive a subset of the j1939 traffic. Filtering can base on
+ * SA
+ * NAME
+ * PGN
+
+ There is a semantic difference with SocketCAN with regard to filtering.
+ When multiple filters are in place for a single socket, and a packet comes
+ in that matches several of those filters, the packet is only received once
+ for that socket.
+ The rationale behind this difference originates in the filter capabilities.
+ Where SocketCAN filters on only 1 orthogonal (can id), J1939 can filter
+ on 3 orthogonal properties (sa, name, pgn).
+
+ When a filter on the SA is set, j1939 traffic with a matching SA, but with
+ its NAME set (aka having claimed SA successfully) will match, although
+ the filter would not match its NAME.
+
+ Filtering on priority is _not_ supported.
+
+
+4. How to use J1939
+--------------------------------
+
+4.1 API calls
+
+ Like TCP/IP and CAN, you first need to open a socket for communicating over a
+ CAN network. To use j1939, include <include/linux/j1939.h>. From there,
+ <include/linux/can.h> will be included too.
+ To open a socket, you would write
+
+ s = socket(PF_CAN, SOCK_DGRAM, CAN_J1939);
+
+ J1939 does use SOCK_DGRAM sockets. In the j1939 specification, connections are
+ mentioned in the context of transport protocol sessions. These still deliver
+ packets to the other end (using several CAN packets).
+ SOCK_STREAM is never appropriate.
+
+ After the successful creation of the socket, you would normally use the
+ bind(2) and/or connect(2) system call to bind the socket to a CAN interface
+ (which is different from TCP/IP due to different addressing) After binding
+ and/or connecting the socket, you can read(2) and write(2) from/to the socket
+ or use send(2), sendto(2), sendmsg(2) and the recv* counterpart operations on
+ the socket as usual. There are also J1939 specific socket options described
+ below.
+
+ In order to send data, a bind(2) must have succeeded. bind(2) assigns a local
+ address to a socket. For this to succeed, you can only choose addresses
+ that have been assigned earlier (see 4.1). When an empty address is assigned
+ (ie. SA=0xff && name=0), a default is taken for the device that is bound to.
+
+ Different from CAN is that the payload data is just the data that get send,
+ without it's header info. The header info is derived from the sockaddr
+ supplied to bind(2), connect(2), sendto(2) and recvfrom(2). A write(2) with
+ size 4 will result in a packet with 4 bytes.
+
+ The sockaddr structure has extensions for use with j1939 as specified below:
+ struct sockaddr_can {
+ sa_family_t can_family;
+ int can_ifindex;
+ union {
+ struct {
+ __u64 name;
+ __u32 pgn;
+ __u8 addr;
+ } j1939;
+ } can_addr;
+ }
+
+ can_family & can_ifindex serve the same purpose as for other SocketCAN sockets.
+
+ can_addr.j1939.pgn specifies the PGN (max 0x3ffff). Individual bits are
+ specified above.
+
+ can_addr.j1939.name contains the 64-bit J1939 NAME.
+
+ can_addr.j1939.addr contains the source address.
+
+ When sending data, the source address is applied as follows: If
+ can_addr.j1939.name != 0 the NAME is looked up by the kernel and the
+ corresponding Source Address is used. If can_addr.j1939.name == 0,
+ can_addr.j1939.addr is used.
+
+ After a bind(2), the local address is assigned, i.e. the source address.
+ After a connect(2), the remote address is assigned, i.e. the destination
+ address.
+
+ Both write(2) and send(2) will send a packet with local address from bind,
+ remote address from connect(2). When the address was not set, a broadcast is
+ sent. The PGN is used from bind(2) or overruled with sendto(2), which will
+ override the destination address when valid, and the PGN when valid.
+
+ Both read(2) and recv(2) will receive packets matching the sockets filters.
+ recvfrom(2) will receive these packets with originator's address.
+
+ When creating a socket, reasonable defaults have been set. Some options can be
+ modified with setsockopt(2) & getsockopt(2).
+
+4.1.1 Message flags during sendmsg
+
+ send(2), sendto(2) and sendmsg(2) take a 'flags' argument. J1939 interpretes
+ these flags during outgoing traffic:
+
+ * MSG_DONTWAIT determines nonblocking operation. When a packet must wait for
+ any reason, -EAGAIN is returned.
+
+ * MSG_SYN
+ Packets flagged with MSG_SYN will wait for all pending packets on a socket
+ to be sent before trying to send. This means that if a socket just started
+ a Transport Protocol session, a packet with MSG_SYN will wait for that
+ session to complete before proceeding.
+ Traffic without MSG_SYN (on that very same socket) will still continue.
+
+4.1.2 SCM_J1939_DEST_ADDR & SCM_J1939_DEST_NAME
+
+ Different received j1939 packets could have had different destionations:
+ - broadcast packet, i.e. no destination address
+ - destination address that matches the sockets local address
+ - destination address that matches _a_ local address on the system, and the
+ socket had no local address defined.
+ - SO_J1939_PROMISC was set
+
+ The destination address & destination name (if applicable) are attached
+ to the msghdr in the recvmsg(2) call. It can be extracted using cmsg(3) macros,
+ with cmsg_level == SOL_J1939 && cmsg_type == SCM_J1939_DEST_ADDR
+ or SCM_J1939_DEST_NAME. The returned data is a uint8_t/uint64_t.
+
+4.1.3 SCM_J1939_PRIORITY
+
+ Attached to the msghdr is also the packet's priority on the bus. This is a
+ uint8_t, packed as cmsg_type == SCM_J1939_PRIORITY.
+
+4.2 Dynamic Addressing
+
+ Distinction has to be made in and using the claimed address and doing an
+ address claim. To use an already claimed address, one has to fill in the
+ j1939.name member and provide it to bind(2). If the name had claimed an
+ address earlier, all further PGN's being sent will use that address. And the
+ j1939.addr member will be ignored.
+
+ An exception on this is pgn 0x0ee00. This is the "Address Claim/Cannot Claim
+ Address" message and when the kernel will use the j1939.addr member for that
+ pgn if necessary.
+
+ To claim an address, bind(2) with:
+ j1939.pgn set to 0x0ee00
+ j1939.addr set to the desired Source Address.
+ j1939.name set to the NAME you want the Source Address to claim to.
+
+ Afterwards do a write(2) with data set to the NAME (Little Endian). If the
+ NAME provided, does not match the j1939.name provided to bind(2), EPROTO
+ will be returned. One might use sendto(2) also to send the Address Claim. In
+ that case, the j1939.addr member must be set to the broadcast address (255)
+ and the j1939.pgn must be set to 0x0ee00. If This combination is not given,
+ EPROTO is returned.
+
+ If no-one else contest the address claim within 250ms after transmission, the
+ kernel marks the NAME-SA assignment as valid. The valid assignment will be
+ kept, among other valid NAME-SA assignments. From that point, any socket
+ bound to the NAME can send packets.
+
+ If another ECU claims the address, the kernel will mark the NAME-SA expired.
+ No socket bound to the NAME can send packets (other than address claims).
+ To claim another address, some socket bound to NAME, must bind(2) again,
+ but with only j1939.addr changed to the new SA, and must then send a
+ valid address claim packet. This restarts the state machine in the kernel
+ (and any other participant on the bus) for this NAME.
+
+
+4.3 Send Examples
+
+4.3.1 Static addressing
+
+ This example will send a pgn (0x12300) from SA 0x20 to DA 0x30.
+
+ Bind:
+ struct sockaddr_can addr;
+
+ memset(&addr, 0, sizeof(addr));
+ addr.can_ifindex = ifindex("can0"); // ifindex is a substitute.
+ addr.can_addr.j1939.name = J1939_NO_NAME;
+ addr.can_addr.j1939.addr = 0x20;
+ addr.can_addr.j1939.pgn = J1939_NO_PGN;
+
+ bind(sk, (void *)&addr, sizeof(addr));
+
+ Now, the socket 'sk' is bound to the address 0x20. Since no pgn
+ was specified during bound, a pgn will be necessary during sendto() operations.
+ Alternatively, specifying addr.can_addr.j1939.pgn during bind() allows
+ for using send() & write(), since a default pgn (the pgn specified during bind())
+ can be used then.
+
+ Send:
+ struct sockaddr_can addr;
+
+ memset(&addr, 0, sizeof(addr));
+ addr.can_addr.j1939.name = J1939_NO_NAME;
+ addr.can_addr.j1939.addr = 0x30;
+ addr.can_addr.j1939.pgn = 0x12300;
+ // addr.can_ifindex is not necessary here.
+
+ sendto(sk, data, sizeof(data), 0, (void *)&addr, sizeof(addr));
+
+4.3.2 Dynamic addressing
+
+ This example will send a pgn (0x12300) from 12345678 to 9ABCDEF
+
+ Start an address claiming daemon (e.g. jacd)
+ $ jacd -r 0x20-0x30 12345678 can0 &
+
+ Bind:
+ struct sockaddr_can addr;
+
+ memset(&addr, 0, sizeof(addr));
+ addr.can_ifindex = if_nametoindex("can0");
+ addr.can_addr.j1939.name = 0x12345678ULL;
+ addr.can_addr.j1939.addr = J1939_NO_ADDR;
+ addr.can_addr.j1939.pgn = J1939_NO_PGN;
+
+ bind(sk, (void *)&addr, sizeof(addr));
+
+ Send:
+ struct sockaddr_can addr;
+
+ memset(&addr, 0, sizeof(addr));
+ addr.can_addr.j1939.name = 0x9ABCDEFULL;
+ addr.can_addr.j1939. = J1939_NO_ADDR;
+ addr.can_addr.j1939.pgn = 0x12300;
+
+ sendto(sk, data, sizeof(data), 0, (void *)&addr, sizeof(addr));
+
+4.3.3 Mixed mode
+
+ A scenario that sends a packet from a static address to a dynamic address
+ or vice versa is called 'mixed mode' here.
+
+ Combining the setup of the static address with a sendto() to a dynamic
+ address from the above examples is legal, and implements such mixed mode
+ addressing. The same applies for the setup of the dynamic address combined
+ with the sendto() towards a dynamic address.
+
+
+5 Socket Options
+--------------------------------
+
+ j1939 sockets have some options that are configurable via setsockopt(2).
+ Each of those options is initialized with a reasonable default.
+
+
+5.1 SO_J1939_FILTER
+
+ As mentioned above, J1939 supports filtering in both NAME, Source Address
+ and PGN. All members must match.
+
+ struct j1939_filter filter = {
+ .name = ...
+ .name_mask = ...
+ .addr = ...
+ .addr_mask = ...
+ .pgn = ...
+ .pgn_mask = ...
+ }
+
+ setsockopt(s, SOL_CAN_J1939, SO_J1939_FILTER, &filter, sizeof(filter));
+
+
+5.2 SO_J1939_PROMISC
+
+ When set, j1939 will receive all packets, not just those with a destination
+ on the local system.
+ default off.
+
+ int promisc = 1; /* 0 = disabled (default), 1 = enabled */
+
+ setsockopt(s, SOL_CAN_J1939, SO_J1939_PROMISC, &promisc, sizeof(promisc));
+
+
+5.3 SO_J1939_RECV_OWN
+
+ All the sent j1939 packets are looped back in the system.
+ The reception of the j1939 packets on the same socket that was
+ sending the j1939 packet is assumed to be unwanted and therefore
+ disabled by default. This default behaviour may be changed on
+ demand:
+
+ int recv_own_msgs = 1; /* 0 = disabled (default), 1 = enabled */
+
+ setsockopt(s, SOL_CAN_J1939, SO_J1939_RECV_OWN,
+ &recv_own_msgs, sizeof(recv_own_msgs));
+
+
+5.4 SO_J1939_SEND_PRIO
+
+ To set the priority field for outgoing packets, the SO_J1939_SEND_PRIO can
+ be changed. This int field specifies the priority that will be used.
+ j1939 defines a priority between 0 and 7 inclusive,
+ with 7 the lowest priority.
+ Per default, the priority is set to 6 (conforming J1939).
+ This priority socket option operates on the same value that is modified
+ with
+
+ setsockopt(s, SOL_SOCKET, SO_PRIORITY, &pri, sizeof(pri))
+
+ socketoption, with a difference that SOL_SOCKET/SO_PRIORITY is defined with
+ 0 the lowest priority. SOL_CAN_J1939/SO_J1939_SEND_PRIO inverts this value
+ for you.
+
+
+6. Credits
+--------------------------------
+
+ Kurt Van Dijck (j1939 core, transport protocol, API)
+ Pieter Beyens (j1939 core, address claiming)
+
diff --git a/MAINTAINERS b/MAINTAINERS
index 9ad052aeac39..709dfbb9c741 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3307,6 +3307,16 @@ F: include/uapi/linux/can/bcm.h
F: include/uapi/linux/can/raw.h
F: include/uapi/linux/can/gw.h
+CAN-J1939 NETWORK LAYER
+M: Robin van der Gracht <robin@protonic.nl>
+M: Oleksij Rempel <o.rempel@pengutronix.de>
+R: Pengutronix Kernel Team <kernel@pengutronix.de>
+L: linux-can@vger.kernel.org
+S: Maintained
+F: Documentation/networking/j1939.txt
+F: net/can/j1939/
+F: include/uapi/linux/can/j1939.h
+
CAPABILITIES
M: Serge Hallyn <serge@hallyn.com>
L: linux-security-module@vger.kernel.org
diff --git a/include/linux/can/can-ml.h b/include/linux/can/can-ml.h
index 2786b04251ea..9861946fe4ae 100644
--- a/include/linux/can/can-ml.h
+++ b/include/linux/can/can-ml.h
@@ -18,6 +18,9 @@
struct can_ml_priv {
struct can_dev_rcv_lists dev_rcv_lists;
+#ifdef CAN_J1939
+ struct j1939_priv *j1939_priv;
+#endif
};
#endif /* CAN_ML_H */
diff --git a/include/uapi/linux/can/j1939.h b/include/uapi/linux/can/j1939.h
new file mode 100644
index 000000000000..5b2505e36d0e
--- /dev/null
+++ b/include/uapi/linux/can/j1939.h
@@ -0,0 +1,83 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * j1939.h
+ *
+ * Copyright (c) 2010-2011 EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _UAPI_CAN_J1939_H_
+#define _UAPI_CAN_J1939_H_
+
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/can.h>
+
+#define J1939_MAX_UNICAST_ADDR 0xfd
+#define J1939_IDLE_ADDR 0xfe
+#define J1939_NO_ADDR 0xff
+#define J1939_NO_NAME 0
+#define J1939_NO_PGN 0x40000
+
+/* J1939 Parameter Group Number
+ *
+ * bit 0-7 : PDU Specific (PS)
+ * bit 8-15 : PDU Format (PF)
+ * bit 16 : Data Page (DP)
+ * bit 17 : Reserved (R)
+ * bit 19-31 : set to zero
+ */
+typedef __u32 pgn_t;
+
+/* J1939 Priority
+ *
+ * bit 0-2 : Priority (P)
+ * bit 3-7 : set to zero
+ */
+typedef __u8 priority_t;
+
+/* J1939 NAME
+ *
+ * bit 0-20 : Identity Number
+ * bit 21-31 : Manufacturer Code
+ * bit 32-34 : ECU Instance
+ * bit 35-39 : Function Instance
+ * bit 40-47 : Function
+ * bit 48 : Reserved
+ * bit 49-55 : Vehicle System
+ * bit 56-59 : Vehicle System Instance
+ * bit 60-62 : Industry Group
+ * bit 63 : Arbitrary Address Capable
+ */
+typedef __u64 name_t;
+
+/* J1939 socket options */
+#define SOL_CAN_J1939 (SOL_CAN_BASE + CAN_J1939)
+enum {
+ SO_J1939_FILTER = 1, /* set filters */
+ SO_J1939_PROMISC = 2, /* set/clr promiscuous mode */
+ SO_J1939_RECV_OWN = 3,
+ SO_J1939_SEND_PRIO = 4,
+};
+
+enum {
+ SCM_J1939_DEST_ADDR = 1,
+ SCM_J1939_DEST_NAME = 2,
+ SCM_J1939_PRIO = 3,
+};
+
+struct j1939_filter {
+ name_t name;
+ name_t name_mask;
+ __u8 addr;
+ __u8 addr_mask;
+ pgn_t pgn;
+ pgn_t pgn_mask;
+};
+
+#define J1939_FILTER_MAX 512 /* maximum number of j1939_filter set via setsockopt() */
+
+#endif /* !_UAPI_CAN_J1939_H_ */
diff --git a/net/can/Kconfig b/net/can/Kconfig
index a4399be54ff4..8b2199d7027b 100644
--- a/net/can/Kconfig
+++ b/net/can/Kconfig
@@ -51,6 +51,8 @@ config CAN_GW
They can be modified with AND/OR/XOR/SET operations as configured
by the netlink configuration interface known e.g. from iptables.
+source "net/can/j1939/Kconfig"
+
source "drivers/net/can/Kconfig"
endif
diff --git a/net/can/Makefile b/net/can/Makefile
index 1242bbbfe57f..08bd217fc051 100644
--- a/net/can/Makefile
+++ b/net/can/Makefile
@@ -15,3 +15,5 @@ can-bcm-y := bcm.o
obj-$(CONFIG_CAN_GW) += can-gw.o
can-gw-y := gw.o
+
+obj-$(CONFIG_CAN_J1939) += j1939/
diff --git a/net/can/j1939/Kconfig b/net/can/j1939/Kconfig
new file mode 100644
index 000000000000..ff0b08a8af3f
--- /dev/null
+++ b/net/can/j1939/Kconfig
@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# SAE J1939 network layer core configuration
+#
+
+config CAN_J1939
+ tristate "SAE J1939"
+ depends on CAN
+ ---help---
+ SAE J1939
+ Say Y to have in-kernel support for j1939 socket type. This
+ allows communication according to SAE j1939.
+ The relevant parts in kernel are
+ SAE j1939-21 (datalink & transport protocol)
+ & SAE j1939-81 (network management).
+
+config CAN_J1939_DEBUG
+ bool "debug SAE J1939"
+ depends on CAN_J1939
+ default n
+ ---help---
+ Say Y to add extra debug code (via printk) in the j1939 stack
+
diff --git a/net/can/j1939/Makefile b/net/can/j1939/Makefile
new file mode 100644
index 000000000000..46e6c6ed221d
--- /dev/null
+++ b/net/can/j1939/Makefile
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0
+
+cppflags-$(CONFIG_CAN_J1939_DEBUG) += -DDEBUG
+
+obj-$(CONFIG_CAN_J1939) += can-j1939.o
+
+can-j1939-objs := \
+ address-claim.o \
+ bus.o \
+ main.o \
+ socket.o \
+ transport.o
diff --git a/net/can/j1939/address-claim.c b/net/can/j1939/address-claim.c
new file mode 100644
index 000000000000..43082c0aef60
--- /dev/null
+++ b/net/can/j1939/address-claim.c
@@ -0,0 +1,224 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2010-2011 EIA Electronics, Kurt Van Dijck <kurt.van.dijck@eia.be>
+// Copyright (c) 2010-2011 EIA Electronics, Pieter Beyens <pieter.beyens@eia.be>
+// Copyright (c) 2017-2018 Pengutronix, Marc Kleine-Budde <kernel@pengutronix.de>
+// Copyright (c) 2017-2018 Pengutronix, Oleksij Rempel <kernel@pengutronix.de>
+
+/* J1939 Address Claiming.
+ * Address Claiming in the kernel
+ * - keeps track of the AC states of ECU's,
+ * - resolves NAME<=>SA taking into account the AC states of ECU's.
+ *
+ * All Address Claim msgs (including host-originated msg) are processed
+ * at the receive path (a sent msg is always received again via CAN echo).
+ * As such, the processing of AC msgs is done in the order on which msgs
+ * are sent on the bus.
+ *
+ * This module doesn't send msgs itself (e.g. replies on Address Claims),
+ * this is the responsibility of a user space application or daemon.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/skbuff.h>
+
+#include "j1939-priv.h"
+
+static inline name_t j1939_skb_to_name(const struct sk_buff *skb)
+{
+ return le64_to_cpup((__le64 *)skb->data);
+}
+
+static inline bool j1939_ac_msg_is_request(struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ int req_pgn;
+
+ if (skb->len < 3 || skcb->addr.pgn != J1939_PGN_REQUEST)
+ return false;
+
+ req_pgn = skb->data[0] | (skb->data[1] << 8) | (skb->data[2] << 16);
+
+ return req_pgn == J1939_PGN_ADDRESS_CLAIMED;
+}
+
+static int j1939_ac_verify_outgoing(struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+
+ if (skb->len != 8) {
+ pr_notice("tx address claim with dlc %i\n", skb->len);
+ return -EPROTO;
+ }
+
+ if (skcb->addr.src_name != j1939_skb_to_name(skb)) {
+ pr_notice("tx address claim with different name\n");
+ return -EPROTO;
+ }
+
+ if (skcb->addr.sa == J1939_NO_ADDR) {
+ pr_notice("tx address claim with broadcast sa\n");
+ return -EPROTO;
+ }
+
+ /* ac must always be a broadcast */
+ if (skcb->addr.dst_name || skcb->addr.da != J1939_NO_ADDR) {
+ pr_notice("tx address claim with dest, not broadcast\n");
+ return -EPROTO;
+ }
+ return 0;
+}
+
+int j1939_ac_fixup(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ int ret;
+ u8 addr;
+
+ /* network mgmt: address claiming msgs */
+ if (skcb->addr.pgn == J1939_PGN_ADDRESS_CLAIMED) {
+ struct j1939_ecu *ecu;
+
+ ret = j1939_ac_verify_outgoing(skb);
+ /* return both when failure & when successful */
+ if (ret < 0)
+ return ret;
+ ecu = j1939_ecu_get_by_name(priv, skcb->addr.src_name);
+ if (!ecu)
+ return -ENODEV;
+
+ if (ecu->addr != skcb->addr.sa)
+ /* hold further traffic for ecu, remove from parent */
+ j1939_ecu_unmap(ecu);
+ j1939_ecu_put(ecu);
+ } else if (skcb->addr.src_name) {
+ /* assign source address */
+ addr = j1939_name_to_addr(priv, skcb->addr.src_name);
+ if (!j1939_address_is_unicast(addr) &&
+ !j1939_ac_msg_is_request(skb)) {
+ pr_notice("tx drop: invalid sa for name 0x%016llx\n",
+ skcb->addr.src_name);
+ return -EADDRNOTAVAIL;
+ }
+ skcb->addr.sa = addr;
+ }
+
+ /* assign destination address */
+ if (skcb->addr.dst_name) {
+ addr = j1939_name_to_addr(priv, skcb->addr.dst_name);
+ if (!j1939_address_is_unicast(addr)) {
+ pr_notice("tx drop: invalid da for name 0x%016llx\n",
+ skcb->addr.dst_name);
+ return -EADDRNOTAVAIL;
+ }
+ skcb->addr.da = addr;
+ }
+ return 0;
+}
+
+static void j1939_ac_process(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ struct j1939_ecu *ecu, *prev;
+ name_t name;
+
+ if (skb->len != 8) {
+ pr_notice("rx address claim with wrong dlc %i\n", skb->len);
+ return;
+ }
+
+ name = j1939_skb_to_name(skb);
+ skcb->addr.src_name = name;
+ if (!name) {
+ pr_notice("rx address claim without name\n");
+ return;
+ }
+
+ if (!j1939_address_is_valid(skcb->addr.sa)) {
+ pr_notice("rx address claim with broadcast sa\n");
+ return;
+ }
+
+ write_lock_bh(&priv->lock);
+
+ /* Few words on the ECU ref counting:
+ *
+ * First we get an ECU handle, either with
+ * j1939_ecu_get_by_name_locked() (increments the ref counter)
+ * or j1939_ecu_create_locked() (initializes an ECU object
+ * with a ref counter of 1).
+ *
+ * j1939_ecu_unmap_locked() will decrement the ref counter,
+ * but only if the ECU was mapped before. So "ecu" still
+ * belongs to us.
+ *
+ * j1939_ecu_timer_start() will increment the ref counter
+ * before it starts the timer, so we can put the ecu when
+ * leaving this function.
+ */
+ ecu = j1939_ecu_get_by_name_locked(priv, name);
+ if (!ecu && j1939_address_is_unicast(skcb->addr.sa))
+ ecu = j1939_ecu_create_locked(priv, name);
+
+ if (IS_ERR_OR_NULL(ecu))
+ goto out_unlock_bh;
+
+ /* cancel pending (previous) address claim */
+ j1939_ecu_timer_cancel(ecu);
+
+ if (j1939_address_is_idle(skcb->addr.sa)) {
+ j1939_ecu_unmap_locked(ecu);
+ goto out_ecu_put;
+ }
+
+ /* save new addr */
+ if (ecu->addr != skcb->addr.sa)
+ j1939_ecu_unmap_locked(ecu);
+ ecu->addr = skcb->addr.sa;
+
+ prev = j1939_ecu_get_by_addr_locked(priv, skcb->addr.sa);
+ if (prev == ecu) {
+ j1939_ecu_put(prev);
+ } else if (prev) {
+ if (ecu->name > prev->name) {
+ j1939_ecu_unmap_locked(ecu);
+ j1939_ecu_put(prev);
+ goto out_ecu_put;
+ } else {
+ /* kick prev */
+ j1939_ecu_unmap_locked(prev);
+ j1939_ecu_put(prev);
+ }
+ }
+
+ j1939_ecu_timer_start(ecu);
+ out_ecu_put:
+ j1939_ecu_put(ecu);
+ out_unlock_bh:
+ write_unlock_bh(&priv->lock);
+}
+
+void j1939_ac_recv(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ struct j1939_ecu *ecu;
+
+ /* network mgmt */
+ if (skcb->addr.pgn == J1939_PGN_ADDRESS_CLAIMED) {
+ j1939_ac_process(priv, skb);
+ } else if (j1939_address_is_unicast(skcb->addr.sa)) {
+ /* assign source name */
+ ecu = j1939_ecu_get_by_addr(priv, skcb->addr.sa);
+ if (ecu) {
+ skcb->addr.src_name = ecu->name;
+ j1939_ecu_put(ecu);
+ }
+ }
+
+ /* assign destination name */
+ ecu = j1939_ecu_get_by_addr(priv, skcb->addr.da);
+ if (ecu) {
+ skcb->addr.dst_name = ecu->name;
+ j1939_ecu_put(ecu);
+ }
+}
diff --git a/net/can/j1939/bus.c b/net/can/j1939/bus.c
new file mode 100644
index 000000000000..5b6d762f0448
--- /dev/null
+++ b/net/can/j1939/bus.c
@@ -0,0 +1,309 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2010-2011 EIA Electronics, Kurt Van Dijck <kurt.van.dijck@eia.be>
+// Copyright (c) 2017-2018 Pengutronix, Marc Kleine-Budde <kernel@pengutronix.de>
+// Copyright (c) 2017-2018 Pengutronix, Oleksij Rempel <kernel@pengutronix.de>
+
+/* bus for j1939 remote devices
+ * Since rtnetlink, no real bus is used.
+ */
+
+#include <net/sock.h>
+
+#include "j1939-priv.h"
+
+#define ecu_dbg(_ecu, fmt, ...) \
+{ \
+ struct j1939_ecu *ecu = _ecu; \
+ pr_debug("j1939-%i,%016llx,%02x: " fmt, ecu->priv->ndev->ifindex, \
+ ecu->name, ecu->addr, ##__VA_ARGS__); \
+}
+
+static void __j1939_ecu_release(struct kref *kref)
+{
+ struct j1939_ecu *ecu = container_of(kref, struct j1939_ecu, kref);
+ struct j1939_priv *priv = ecu->priv;
+
+ list_del(&ecu->list);
+ kfree(ecu);
+ j1939_priv_put(priv);
+}
+
+void j1939_ecu_put(struct j1939_ecu *ecu)
+{
+ kref_put(&ecu->kref, __j1939_ecu_release);
+}
+
+static void j1939_ecu_get(struct j1939_ecu *ecu)
+{
+ kref_get(&ecu->kref);
+}
+
+static bool j1939_ecu_is_mapped_locked(struct j1939_ecu *ecu)
+{
+ struct j1939_priv *priv = ecu->priv;
+
+ lockdep_assert_held(&priv->lock);
+
+ return j1939_ecu_find_by_addr_locked(priv, ecu->addr) == ecu;
+}
+
+/* ECU device interface */
+/* map ECU to a bus address space */
+static void j1939_ecu_map_locked(struct j1939_ecu *ecu)
+{
+ lockdep_assert_held(&ecu->priv->lock);
+
+ if (!j1939_address_is_unicast(ecu->addr))
+ return;
+
+ j1939_ecu_get(ecu);
+ ecu->priv->ents[ecu->addr].ecu = ecu;
+ ecu->priv->ents[ecu->addr].nusers += ecu->nusers;
+}
+
+/* unmap ECU from a bus address space */
+void j1939_ecu_unmap_locked(struct j1939_ecu *ecu)
+{
+ lockdep_assert_held(&ecu->priv->lock);
+
+ if (!j1939_address_is_unicast(ecu->addr))
+ return;
+
+ if (!j1939_ecu_is_mapped_locked(ecu))
+ return;
+
+ ecu->priv->ents[ecu->addr].ecu = NULL;
+ ecu->priv->ents[ecu->addr].nusers -= ecu->nusers;
+ j1939_ecu_put(ecu);
+}
+
+void j1939_ecu_unmap(struct j1939_ecu *ecu)
+{
+ write_lock_bh(&ecu->priv->lock);
+ j1939_ecu_unmap_locked(ecu);
+ write_unlock_bh(&ecu->priv->lock);
+}
+
+void j1939_ecu_timer_start(struct j1939_ecu *ecu)
+{
+ /* The ECU is held here and released in the
+ * j1939_ecu_timer_handler() or j1939_ecu_timer_cancel().
+ */
+ j1939_ecu_get(ecu);
+
+ /* Schedule timer in 250 msec to commit address change. */
+ hrtimer_start(&ecu->ac_timer, ms_to_ktime(250),
+ HRTIMER_MODE_REL_SOFT);
+}
+
+void j1939_ecu_timer_cancel(struct j1939_ecu *ecu)
+{
+ if (hrtimer_cancel(&ecu->ac_timer))
+ j1939_ecu_put(ecu);
+}
+
+static enum hrtimer_restart j1939_ecu_timer_handler(struct hrtimer *hrtimer)
+{
+ struct j1939_ecu *ecu =
+ container_of(hrtimer, struct j1939_ecu, ac_timer);
+ struct j1939_priv *priv = ecu->priv;
+
+ write_lock_bh(&priv->lock);
+ /* TODO: can we test if ecu->addr is unicast before starting
+ * the timer?
+ */
+ j1939_ecu_map_locked(ecu);
+
+ /* The corresponding j1939_ecu_get() is in
+ * j1939_ecu_timer_start().
+ */
+ j1939_ecu_put(ecu);
+ write_unlock_bh(&priv->lock);
+
+ return HRTIMER_NORESTART;
+}
+
+struct j1939_ecu *j1939_ecu_create_locked(struct j1939_priv *priv, name_t name)
+{
+ struct j1939_ecu *ecu;
+
+ lockdep_assert_held(&priv->lock);
+
+ ecu = kzalloc(sizeof(*ecu), gfp_any());
+ if (!ecu)
+ return ERR_PTR(-ENOMEM);
+ kref_init(&ecu->kref);
+ ecu->addr = J1939_IDLE_ADDR;
+ ecu->name = name;
+
+ hrtimer_init(&ecu->ac_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
+ ecu->ac_timer.function = j1939_ecu_timer_handler;
+ INIT_LIST_HEAD(&ecu->list);
+
+ j1939_priv_get(priv);
+ ecu->priv = priv;
+ list_add_tail(&ecu->list, &priv->ecus);
+
+ ecu_dbg(ecu, "%s\n", __func__);
+ return ecu;
+}
+
+struct j1939_ecu *j1939_ecu_find_by_addr_locked(struct j1939_priv *priv, u8 addr)
+{
+ lockdep_assert_held(&priv->lock);
+
+ return priv->ents[addr].ecu;
+}
+
+struct j1939_ecu *j1939_ecu_get_by_addr_locked(struct j1939_priv *priv, u8 addr)
+{
+ struct j1939_ecu *ecu;
+
+ lockdep_assert_held(&priv->lock);
+
+ if (!j1939_address_is_unicast(addr))
+ return NULL;
+
+ ecu = j1939_ecu_find_by_addr_locked(priv, addr);
+ if (ecu)
+ j1939_ecu_get(ecu);
+
+ return ecu;
+}
+
+struct j1939_ecu *j1939_ecu_get_by_addr(struct j1939_priv *priv, u8 addr)
+{
+ struct j1939_ecu *ecu;
+
+ read_lock_bh(&priv->lock);
+ ecu = j1939_ecu_get_by_addr_locked(priv, addr);
+ read_unlock_bh(&priv->lock);
+
+ return ecu;
+}
+
+/* get pointer to ecu without increasing ref counter */
+static struct j1939_ecu *j1939_ecu_find_by_name_locked(struct j1939_priv *priv, name_t name)
+{
+ struct j1939_ecu *ecu;
+
+ lockdep_assert_held(&priv->lock);
+
+ list_for_each_entry(ecu, &priv->ecus, list) {
+ if (ecu->name == name)
+ return ecu;
+ }
+
+ return NULL;
+}
+
+struct j1939_ecu *j1939_ecu_get_by_name_locked(struct j1939_priv *priv, name_t name)
+{
+ struct j1939_ecu *ecu;
+
+ lockdep_assert_held(&priv->lock);
+
+ if (!name)
+ return NULL;
+
+ ecu = j1939_ecu_find_by_name_locked(priv, name);
+ if (ecu)
+ j1939_ecu_get(ecu);
+
+ return ecu;
+}
+
+struct j1939_ecu *j1939_ecu_get_by_name(struct j1939_priv *priv, name_t name)
+{
+ struct j1939_ecu *ecu;
+
+ read_lock_bh(&priv->lock);
+ ecu = j1939_ecu_get_by_name_locked(priv, name);
+ read_unlock_bh(&priv->lock);
+
+ return ecu;
+}
+
+u8 j1939_name_to_addr(struct j1939_priv *priv, name_t name)
+{
+ struct j1939_ecu *ecu;
+ int addr = J1939_IDLE_ADDR;
+
+ if (!name)
+ return J1939_NO_ADDR;
+
+ read_lock_bh(&priv->lock);
+ ecu = j1939_ecu_find_by_name_locked(priv, name);
+ if (j1939_ecu_is_mapped_locked(ecu))
+ /* ecu's SA is registered */
+ addr = ecu->addr;
+
+ read_unlock_bh(&priv->lock);
+
+ return addr;
+}
+
+/* TX addr/name accounting
+ * Transport protocol needs to know if a SA is local or not
+ * These functions originate from userspace manipulating sockets,
+ * so locking is straigforward
+ */
+
+int j1939_local_ecu_get(struct j1939_priv *priv, name_t name, u8 sa)
+{
+ struct j1939_ecu *ecu;
+ int err = 0;
+
+ write_lock_bh(&priv->lock);
+
+ if (j1939_address_is_unicast(sa))
+ priv->ents[sa].nusers++;
+
+ if (!name)
+ goto done;
+
+ ecu = j1939_ecu_get_by_name_locked(priv, name);
+ if (!ecu)
+ ecu = j1939_ecu_create_locked(priv, name);
+ err = PTR_ERR_OR_ZERO(ecu);
+ if (err)
+ goto done;
+
+ ecu->nusers++;
+ /* TODO: do we care if ecu->addr != sa? */
+ if (j1939_ecu_is_mapped_locked(ecu))
+ /* ecu's sa is active already */
+ priv->ents[ecu->addr].nusers++;
+
+ done:
+ write_unlock_bh(&priv->lock);
+
+ return err;
+}
+
+void j1939_local_ecu_put(struct j1939_priv *priv, name_t name, u8 sa)
+{
+ struct j1939_ecu *ecu;
+
+ write_lock_bh(&priv->lock);
+
+ if (j1939_address_is_unicast(sa))
+ priv->ents[sa].nusers--;
+
+ if (!name)
+ goto done;
+
+ ecu = j1939_ecu_find_by_name_locked(priv, name);
+ if (WARN_ON_ONCE(!ecu))
+ goto done;
+
+ ecu->nusers--;
+ /* TODO: do we care if ecu->addr != sa? */
+ if (j1939_ecu_is_mapped_locked(ecu))
+ /* ecu's sa is active already */
+ priv->ents[ecu->addr].nusers--;
+ j1939_ecu_put(ecu);
+
+ done:
+ write_unlock_bh(&priv->lock);
+}
diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h
new file mode 100644
index 000000000000..9db9077849e7
--- /dev/null
+++ b/net/can/j1939/j1939-priv.h
@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2010-2011 EIA Electronics, Kurt Van Dijck <kurt.van.dijck@eia.be>
+// Copyright (c) 2017-2018 Pengutronix, Marc Kleine-Budde <kernel@pengutronix.de>
+// Copyright (c) 2017-2018 Pengutronix, Oleksij Rempel <kernel@pengutronix.de>
+
+#ifndef _J1939_PRIV_H_
+#define _J1939_PRIV_H_
+
+#include <linux/can/j1939.h>
+
+/* TODO: return ENETRESET on busoff. */
+
+#define J1939_PGN_REQUEST 0x0ea00
+#define J1939_PGN_ADDRESS_CLAIMED 0x0ee00
+#define J1939_PGN_MAX 0x3ffff
+
+/* j1939 devices */
+struct j1939_ecu {
+ struct list_head list;
+ name_t name;
+ u8 addr;
+
+ /* indicates that this ecu successfully claimed @sa as its address */
+ struct hrtimer ac_timer;
+ struct kref kref;
+ struct j1939_priv *priv;
+
+ /* count users, to help transport protocol decide for interaction */
+ int nusers;
+};
+
+struct j1939_priv {
+ struct list_head ecus;
+ /* local list entry in priv
+ * These allow irq (& softirq) context lookups on j1939 devices
+ * This approach (separate lists) is done as the other 2 alternatives
+ * are not easier or even wrong
+ * 1) using the pure kobject methods involves mutexes, which are not
+ * allowed in irq context.
+ * 2) duplicating data structures would require a lot of synchronization
+ * code
+ * usage:
+ */
+
+ /* segments need a lock to protect the above list */
+ rwlock_t lock;
+
+ struct net_device *ndev;
+
+ /* list of 256 ecu ptrs, that cache the claimed addresses.
+ * also protected by the above lock
+ */
+ struct j1939_addr_ent {
+ struct j1939_ecu *ecu;
+ /* count users, to help transport protocol */
+ int nusers;
+ } ents[256];
+
+ struct kref kref;
+
+ spinlock_t tp_session_list_lock;
+ struct list_head tp_sessionq;
+ struct list_head tp_extsessionq;
+ wait_queue_head_t tp_wait;
+};
+
+void j1939_ecu_put(struct j1939_ecu *ecu);
+
+/* keep the cache of what is local */
+int j1939_local_ecu_get(struct j1939_priv *priv, name_t name, u8 sa);
+void j1939_local_ecu_put(struct j1939_priv *priv, name_t name, u8 sa);
+
+static inline bool j1939_address_is_unicast(u8 addr)
+{
+ return addr <= J1939_MAX_UNICAST_ADDR;
+}
+
+static inline bool j1939_address_is_idle(u8 addr)
+{
+ return addr == J1939_IDLE_ADDR;
+}
+
+static inline bool j1939_address_is_valid(u8 addr)
+{
+ return addr != J1939_NO_ADDR;
+}
+
+static inline bool j1939_pgn_is_pdu1(pgn_t pgn)
+{
+ /* ignore dp & res bits for this */
+ return (pgn & 0xff00) < 0xf000;
+}
+
+/* utility to correctly unmap an ECU */
+void j1939_ecu_unmap_locked(struct j1939_ecu *ecu);
+void j1939_ecu_unmap(struct j1939_ecu *ecu);
+
+u8 j1939_name_to_addr(struct j1939_priv *priv, name_t name);
+struct j1939_ecu *j1939_ecu_find_by_addr_locked(struct j1939_priv *priv, u8 addr);
+struct j1939_ecu *j1939_ecu_get_by_addr(struct j1939_priv *priv, u8 addr);
+struct j1939_ecu *j1939_ecu_get_by_addr_locked(struct j1939_priv *priv, u8 addr);
+struct j1939_ecu *j1939_ecu_get_by_name(struct j1939_priv *priv, name_t name);
+struct j1939_ecu *j1939_ecu_get_by_name_locked(struct j1939_priv *priv, name_t name);
+
+struct j1939_addr {
+ name_t src_name;
+ name_t dst_name;
+ pgn_t pgn;
+
+ u8 sa;
+ u8 da;
+};
+
+/* control buffer of the sk_buff */
+struct j1939_sk_buff_cb {
+ struct j1939_addr addr;
+ priority_t priority;
+
+ /* Flags for quick lookups during skb processing
+ * These are set in the receive path only
+ */
+#define J1939_ECU_LOCAL BIT(0)
+ u32 src_flags;
+ u32 dst_flags;
+
+ /* for tx, MSG_SYN will be used to sync on sockets */
+ u32 msg_flags;
+
+ /* j1939 clones incoming skb's.
+ * insock saves the incoming skb->sk
+ * to determine local generated packets
+ */
+ struct sock *insock;
+};
+
+static inline struct j1939_sk_buff_cb *j1939_skb_to_cb(struct sk_buff *skb)
+{
+ BUILD_BUG_ON(sizeof(struct j1939_sk_buff_cb) > sizeof(skb->cb));
+
+ return (struct j1939_sk_buff_cb *)skb->cb;
+}
+
+int j1939_send(struct sk_buff *skb);
+void j1939_sk_recv(struct sk_buff *skb);
+
+/* stack entries */
+int j1939_tp_send(struct j1939_priv *priv, struct sk_buff *skb);
+int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb);
+int j1939_ac_fixup(struct j1939_priv *priv, struct sk_buff *skb);
+void j1939_ac_recv(struct j1939_priv *priv, struct sk_buff *skb);
+
+/* network management */
+struct j1939_ecu *j1939_ecu_create_locked(struct j1939_priv *priv, name_t name);
+
+void j1939_ecu_timer_start(struct j1939_ecu *ecu);
+void j1939_ecu_timer_cancel(struct j1939_ecu *ecu);
+
+int j1939_netdev_start(struct net *net, struct net_device *ndev);
+void j1939_netdev_stop(struct net_device *ndev);
+
+struct j1939_priv *j1939_priv_get_by_ndev(struct net_device *ndev);
+void j1939_priv_put(struct j1939_priv *priv);
+void j1939_priv_get(struct j1939_priv *priv);
+
+/* notify/alert all j1939 sockets bound to ifindex */
+void j1939_sk_netdev_event(struct net_device *ndev, int error_code);
+int j1939_tp_rmdev_notifier(struct j1939_priv *priv);
+void j1939_tp_init(struct j1939_priv *priv);
+
+/* decrement pending skb for a j1939 socket */
+void j1939_sock_pending_del(struct sock *sk);
+
+/* CAN protocol */
+extern const struct can_proto j1939_can_proto;
+
+#endif /* _J1939_PRIV_H_ */
diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
new file mode 100644
index 000000000000..73d3f590adc6
--- /dev/null
+++ b/net/can/j1939/main.c
@@ -0,0 +1,371 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2010-2011 EIA Electronics, Pieter Beyens <pieter.beyens@eia.be>
+// Copyright (c) 2010-2011 EIA Electronics, Kurt Van Dijck <kurt.van.dijck@eia.be>
+// Copyright (c) 2017-2018 Pengutronix, Marc Kleine-Budde <kernel@pengutronix.de>
+// Copyright (c) 2017-2018 Pengutronix, Oleksij Rempel <kernel@pengutronix.de>
+// Copyright (c) 2018 Protonic, Robin van der Gracht <robin@protonic.nl>
+
+/* Core of can-j1939 that links j1939 to CAN. */
+
+#include <linux/can/can-ml.h>
+#include <linux/can/core.h>
+#include <linux/if_arp.h>
+#include <linux/module.h>
+
+#include "j1939-priv.h"
+
+MODULE_DESCRIPTION("PF_CAN SAE J1939");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("EIA Electronics (Kurt Van Dijck & Pieter Beyens)");
+MODULE_ALIAS("can-proto-" __stringify(CAN_J1939));
+
+/* LOWLEVEL CAN interface */
+
+/* CAN_HDR: #bytes before can_frame data part */
+#define J1939_CAN_HDR (offsetof(struct can_frame, data))
+
+/* CAN_FTR: #bytes beyond data part */
+#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \
+ sizeof(((struct can_frame *)0)->data))
+
+/* lowest layer */
+static void j1939_can_recv(struct sk_buff *iskb, void *data)
+{
+ struct j1939_priv *priv = data;
+ struct sk_buff *skb;
+ struct j1939_sk_buff_cb *skcb;
+ struct can_frame *cf;
+
+ /* create a copy of the skb
+ * j1939 only delivers the real data bytes,
+ * the header goes into sockaddr.
+ * j1939 may not touch the incoming skb in such way
+ */
+ skb = skb_clone(iskb, GFP_ATOMIC);
+
+ /* get a pointer to the header of the skb
+ * the skb payload (pointer) is moved, so that the next skb_data
+ * returns the actual payload
+ */
+ cf = (void *)skb->data;
+ skb_pull(skb, J1939_CAN_HDR);
+
+ /* fix length, set to dlc, with 8 maximum */
+ skb_trim(skb, min_t(uint8_t, cf->can_dlc, 8));
+
+ /* set addr */
+ skcb = j1939_skb_to_cb(skb);
+ memset(skcb, 0, sizeof(*skcb));
+
+ /* save incoming socket, without assigning the skb to it */
+ skcb->insock = iskb->sk;
+ skcb->priority = (cf->can_id >> 26) & 0x7;
+ skcb->addr.sa = cf->can_id;
+ skcb->addr.pgn = (cf->can_id >> 8) & J1939_PGN_MAX;
+ if (j1939_pgn_is_pdu1(skcb->addr.pgn)) {
+ /* Type 1: with destination address */
+ skcb->addr.da = skcb->addr.pgn;
+ /* normalize pgn: strip dst address */
+ skcb->addr.pgn &= 0x3ff00;
+ } else {
+ /* set broadcast address */
+ skcb->addr.da = J1939_NO_ADDR;
+ }
+
+ /* update localflags */
+ read_lock_bh(&priv->lock);
+ if (j1939_address_is_unicast(skcb->addr.sa) &&
+ priv->ents[skcb->addr.sa].nusers)
+ skcb->src_flags |= J1939_ECU_LOCAL;
+ if (j1939_address_is_unicast(skcb->addr.da) &&
+ priv->ents[skcb->addr.da].nusers)
+ skcb->dst_flags |= J1939_ECU_LOCAL;
+ read_unlock_bh(&priv->lock);
+
+ /* deliver into the j1939 stack ... */
+ j1939_ac_recv(priv, skb);
+
+ if (j1939_tp_recv(priv, skb))
+ /* this means the transport layer processed the message */
+ goto done;
+ j1939_sk_recv(skb);
+ done:
+ kfree_skb(skb);
+}
+
+/* NETDEV MANAGEMENT */
+
+/* values for can_rx_(un)register */
+#define J1939_CAN_ID CAN_EFF_FLAG
+#define J1939_CAN_MASK (CAN_EFF_FLAG | CAN_RTR_FLAG)
+
+static DEFINE_SPINLOCK(j1939_netdev_lock);
+
+static struct j1939_priv *j1939_priv_create(struct net_device *ndev)
+{
+ struct j1939_priv *priv;
+
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return NULL;
+
+ rwlock_init(&priv->lock);
+ INIT_LIST_HEAD(&priv->ecus);
+ priv->ndev = ndev;
+ kref_init(&priv->kref);
+ dev_hold(ndev);
+
+ return priv;
+}
+
+static inline void j1939_priv_set(struct net_device *ndev, struct j1939_priv *priv)
+{
+ struct can_ml_priv *can_ml_priv = ndev->ml_priv;
+
+ can_ml_priv->j1939_priv = priv;
+}
+
+static void __j1939_priv_release(struct kref *kref)
+{
+ struct j1939_priv *priv = container_of(kref, struct j1939_priv, kref);
+ struct net_device *ndev = priv->ndev;
+
+ can_rx_unregister(dev_net(ndev), ndev, J1939_CAN_ID, J1939_CAN_MASK,
+ j1939_can_recv, priv);
+
+ /* remove pending transport protocol sessions */
+ j1939_tp_rmdev_notifier(priv);
+
+ /* unlink from netdev */
+ j1939_priv_set(ndev, NULL);
+
+ dev_put(ndev);
+ kfree(priv);
+}
+
+void j1939_priv_put(struct j1939_priv *priv)
+{
+ kref_put(&priv->kref, __j1939_priv_release);
+}
+
+void j1939_priv_get(struct j1939_priv *priv)
+{
+ kref_get(&priv->kref);
+}
+
+int j1939_netdev_start(struct net *net, struct net_device *ndev)
+{
+ struct j1939_priv *priv;
+ int ret;
+
+ spin_lock(&j1939_netdev_lock);
+ priv = j1939_priv_get_by_ndev(ndev);
+ spin_unlock(&j1939_netdev_lock);
+ if (priv)
+ return 0;
+
+ priv = j1939_priv_create(ndev);
+ if (!priv)
+ return -ENOMEM;
+
+ j1939_tp_init(priv);
+
+ /* add CAN handler */
+ ret = can_rx_register(net, ndev, J1939_CAN_ID, J1939_CAN_MASK,
+ j1939_can_recv, priv, "j1939", NULL);
+ if (ret < 0)
+ goto out_dev_put;
+
+ spin_lock(&j1939_netdev_lock);
+ if (j1939_priv_get_by_ndev(ndev)) {
+ /* Someone was faster than us, use their priv and roll
+ * back our's.
+ */
+ spin_unlock(&j1939_netdev_lock);
+ goto out_rx_unregister;
+ }
+ j1939_priv_set(ndev, priv);
+ spin_unlock(&j1939_netdev_lock);
+
+ return 0;
+
+ out_rx_unregister:
+ can_rx_unregister(net, ndev, J1939_CAN_ID, J1939_CAN_MASK,
+ j1939_can_recv, priv);
+ out_dev_put:
+ dev_put(ndev);
+ kfree(priv);
+
+ return ret;
+}
+
+/* get pointer to priv without increasing ref counter */
+static inline struct j1939_priv *j1939_ndev_to_priv(struct net_device *ndev)
+{
+ struct can_ml_priv *can_ml_priv = ndev->ml_priv;
+
+ return can_ml_priv->j1939_priv;
+}
+
+void j1939_netdev_stop(struct net_device *ndev)
+{
+ struct j1939_priv *priv;
+
+ spin_lock(&j1939_netdev_lock);
+ priv = j1939_ndev_to_priv(ndev);
+ j1939_priv_put(priv);
+ spin_unlock(&j1939_netdev_lock);
+}
+
+struct j1939_priv *j1939_priv_get_by_ndev(struct net_device *ndev)
+{
+ struct j1939_priv *priv;
+
+ if (ndev->type != ARPHRD_CAN)
+ return NULL;
+
+ priv = j1939_ndev_to_priv(ndev);
+ if (priv)
+ j1939_priv_get(priv);
+
+ return priv;
+}
+
+static int j1939_send_one(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ int ret, dlc;
+ canid_t canid;
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ struct can_frame *cf;
+
+ /* apply sanity checks */
+ if (j1939_pgn_is_pdu1(skcb->addr.pgn))
+ skcb->addr.pgn &= 0x3ff00;
+ else
+ skcb->addr.pgn &= J1939_PGN_MAX;
+
+ if (skcb->priority > 7)
+ skcb->priority = 6;
+
+ ret = j1939_ac_fixup(priv, skb);
+ if (unlikely(ret))
+ goto failed;
+ dlc = skb->len;
+
+ /* re-claim the CAN_HDR from the SKB */
+ cf = skb_push(skb, J1939_CAN_HDR);
+
+ /* make it a full can frame again */
+ skb_put(skb, J1939_CAN_FTR + (8 - dlc));
+
+ canid = CAN_EFF_FLAG |
+ (skcb->priority << 26) |
+ (skcb->addr.pgn << 8) |
+ skcb->addr.sa;
+ if (j1939_pgn_is_pdu1(skcb->addr.pgn))
+ canid |= skcb->addr.da << 8;
+
+ cf->can_id = canid;
+ cf->can_dlc = dlc;
+
+ return can_send(skb, 1);
+
+ failed:
+ consume_skb(skb);
+ return ret;
+}
+
+int j1939_send(struct sk_buff *skb)
+{
+ struct j1939_priv *priv;
+ int ret;
+
+ priv = j1939_priv_get_by_ndev(skb->dev);
+ if (!priv)
+ return -EINVAL;
+
+ if (skb->len > 8)
+ /* re-route via transport protocol */
+ ret = j1939_tp_send(priv, skb);
+ else
+ ret = j1939_send_one(priv, skb);
+
+ j1939_priv_put(priv);
+
+ return ret;
+}
+
+static int j1939_netdev_notify(struct notifier_block *nb,
+ unsigned long msg, void *data)
+{
+ struct net_device *ndev = netdev_notifier_info_to_dev(data);
+ struct j1939_priv *priv;
+
+ spin_lock(&j1939_netdev_lock);
+ priv = j1939_priv_get_by_ndev(ndev);
+ spin_unlock(&j1939_netdev_lock);
+ if (!priv)
+ goto notify_done;
+
+ if (!net_eq(dev_net(ndev), &init_net))
+ goto notify_put;
+
+ if (ndev->type != ARPHRD_CAN)
+ goto notify_put;
+
+ switch (msg) {
+ case NETDEV_UNREGISTER:
+ j1939_tp_rmdev_notifier(priv);
+ j1939_sk_netdev_event(ndev, ENODEV);
+ break;
+
+ case NETDEV_DOWN:
+ j1939_sk_netdev_event(ndev, ENETDOWN);
+ break;
+ }
+
+notify_put:
+ j1939_priv_put(priv);
+
+notify_done:
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block j1939_netdev_notifier = {
+ .notifier_call = j1939_netdev_notify,
+};
+
+/* MODULE interface */
+static __init int j1939_module_init(void)
+{
+ int ret;
+
+ pr_info("can: SAE J1939\n");
+
+ ret = register_netdevice_notifier(&j1939_netdev_notifier);
+ if (ret)
+ goto fail_notifier;
+
+ ret = can_proto_register(&j1939_can_proto);
+ if (ret < 0) {
+ pr_err("can: registration of j1939 protocol failed\n");
+ goto fail_sk;
+ }
+
+ return 0;
+
+ fail_sk:
+ unregister_netdevice_notifier(&j1939_netdev_notifier);
+ fail_notifier:
+ return ret;
+}
+
+static __exit void j1939_module_exit(void)
+{
+ can_proto_unregister(&j1939_can_proto);
+
+ unregister_netdevice_notifier(&j1939_netdev_notifier);
+}
+
+module_init(j1939_module_init);
+module_exit(j1939_module_exit);
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
new file mode 100644
index 000000000000..3a5450a18820
--- /dev/null
+++ b/net/can/j1939/socket.c
@@ -0,0 +1,781 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2010-2011 EIA Electronics, Pieter Beyens <pieter.beyens@eia.be>
+// Copyright (c) 2010-2011 EIA Electronics, Kurt Van Dijck <kurt.van.dijck@eia.be>
+// Copyright (c) 2017-2018 Pengutronix, Marc Kleine-Budde <kernel@pengutronix.de>
+// Copyright (c) 2017-2018 Pengutronix, Oleksij Rempel <kernel@pengutronix.de>
+// Copyright (c) 2018 Protonic, Robin van der Gracht <robin@protonic.nl>
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/can/core.h>
+#include <linux/can/skb.h>
+#include <linux/if_arp.h>
+
+#include "j1939-priv.h"
+
+#define J1939_MIN_NAMELEN REQUIRED_SIZE(struct sockaddr_can, can_addr.j1939)
+
+/* list of sockets */
+static struct list_head j1939_socks = LIST_HEAD_INIT(j1939_socks);
+static DEFINE_SPINLOCK(j1939_socks_lock);
+
+struct j1939_sock {
+ struct sock sk; /* must be first to skip with memset */
+ struct list_head list;
+
+#define J1939_SOCK_BOUND BIT(0)
+#define J1939_SOCK_CONNECTED BIT(1)
+#define J1939_SOCK_PROMISC BIT(2)
+#define J1939_SOCK_RECV_OWN BIT(3)
+ int state;
+
+ int ifindex;
+ struct j1939_addr addr;
+ struct j1939_filter *filters;
+ int nfilters;
+
+ /* j1939 may emit equal PGN (!= equal CAN-id's) out of order
+ * when transport protocol comes in.
+ * To allow emitting in order, keep a 'pending' nr. of packets
+ */
+ atomic_t skb_pending;
+ wait_queue_head_t waitq;
+};
+
+static inline struct j1939_sock *j1939_sk(const struct sock *sk)
+{
+ return container_of(sk, struct j1939_sock, sk);
+}
+
+/* conversion function between struct sock::sk_priority from linux and
+ * j1939 priority field
+ */
+static inline priority_t j1939_prio(u32 sk_priority)
+{
+ sk_priority = min(sk_priority, 7U);
+
+ return 7 - sk_priority;
+}
+
+static inline u32 j1939_to_sk_priority(priority_t prio)
+{
+ return 7 - prio;
+}
+
+/* function to see if pgn is to be evaluated */
+static inline bool j1939_pgn_is_valid(pgn_t pgn)
+{
+ return pgn <= J1939_PGN_MAX;
+}
+
+/* test function to avoid non-zero DA placeholder for pdu1 pgn's */
+static inline bool j1939_pgn_is_clean_pdu(pgn_t pgn)
+{
+ if (j1939_pgn_is_pdu1(pgn))
+ return !(pgn & 0xff);
+ else
+ return true;
+}
+
+/* j1939_sock_pending_add_first
+ * Succeeds when the first pending SKB is scheduled
+ * Fails when SKB are already pending
+ */
+static inline int j1939_sock_pending_add_first(struct sock *sk)
+{
+ struct j1939_sock *jsk = j1939_sk(sk);
+
+ /* atomic_cmpxchg returns the old value
+ * When it was 0, it is exchanged with 1 and this function
+ * succeeded. (return 1)
+ * When it was != 0, it is not exchanged, and this function
+ * fails (returns 0).
+ */
+ return !atomic_cmpxchg(&jsk->skb_pending, 0, 1);
+}
+
+static inline void j1939_sock_pending_add(struct sock *sk)
+{
+ struct j1939_sock *jsk = j1939_sk(sk);
+
+ atomic_inc(&jsk->skb_pending);
+}
+
+void j1939_sock_pending_del(struct sock *sk)
+{
+ struct j1939_sock *jsk = j1939_sk(sk);
+
+ /* atomic_dec_return returns the new value */
+ if (!atomic_dec_return(&jsk->skb_pending))
+ wake_up(&jsk->waitq); /* no pending SKB's */
+}
+
+/* matches skb control buffer (addr) with a j1939 filter */
+static inline bool j1939_packet_match(const struct j1939_sk_buff_cb *skcb,
+ const struct j1939_filter *f, int nfilter)
+{
+ if (!nfilter)
+ /* receive all when no filters are assigned */
+ return true;
+
+ /* Filters relying on the addr for static addressing _should_ get
+ * packets from dynamic addressed ECU's too if they match their SA.
+ * Sockets using dynamic addressing in their filters should not set it.
+ */
+ for (; nfilter; ++f, --nfilter) {
+ if ((skcb->addr.pgn & f->pgn_mask) != (f->pgn & f->pgn_mask))
+ continue;
+ if ((skcb->addr.sa & f->addr_mask) != (f->addr & f->addr_mask))
+ continue;
+ if ((skcb->addr.src_name & f->name_mask) !=
+ (f->name & f->name_mask))
+ continue;
+ return true;
+ }
+ return false;
+}
+
+static void j1939_sk_recv_one(struct j1939_sock *jsk, struct sk_buff *oskb)
+{
+ struct sk_buff *skb;
+ const struct j1939_sk_buff_cb *oskcb = j1939_skb_to_cb(oskb);
+ const struct can_skb_priv *oskb_prv = can_skb_prv(oskb);
+ struct j1939_sk_buff_cb *skcb;
+
+ if (!(jsk->state & (J1939_SOCK_BOUND | J1939_SOCK_CONNECTED)))
+ return;
+ if (jsk->ifindex != oskb_prv->ifindex)
+ /* this socket does not take packets from this iface */
+ return;
+ if (!(jsk->state & J1939_SOCK_PROMISC)) {
+ if (jsk->addr.src_name) {
+ /* reject message for other destinations */
+ if (oskcb->addr.dst_name &&
+ oskcb->addr.dst_name != jsk->addr.src_name)
+ /* the msg is not destined for the name
+ * that the socket is bound to
+ */
+ return;
+ } else {
+ /* reject messages for other destination addresses */
+ if (j1939_address_is_unicast(oskcb->addr.da) &&
+ oskcb->addr.da != jsk->addr.sa)
+ /* the msg is not destined for the name
+ * that the socket is bound to
+ */
+ return;
+ }
+ }
+
+ if (oskcb->insock == &jsk->sk && !(jsk->state & J1939_SOCK_RECV_OWN))
+ /* own message */
+ return;
+
+ if (!j1939_packet_match(oskcb, jsk->filters, jsk->nfilters))
+ return;
+
+ skb = skb_clone(oskb, GFP_ATOMIC);
+ if (!skb) {
+ pr_warn("skb clone failed\n");
+ return;
+ }
+ skcb = j1939_skb_to_cb(skb);
+ skcb->msg_flags &= ~(MSG_DONTROUTE | MSG_CONFIRM);
+ if (skcb->insock)
+ skcb->msg_flags |= MSG_DONTROUTE;
+ if (skcb->insock == &jsk->sk)
+ skcb->msg_flags |= MSG_CONFIRM;
+
+ if (sock_queue_rcv_skb(&jsk->sk, skb) < 0)
+ kfree_skb(skb);
+}
+
+void j1939_sk_recv(struct sk_buff *skb)
+{
+ struct j1939_sock *jsk;
+
+ spin_lock_bh(&j1939_socks_lock);
+ list_for_each_entry(jsk, &j1939_socks, list) {
+ j1939_sk_recv_one(jsk, skb);
+ }
+ spin_unlock_bh(&j1939_socks_lock);
+}
+
+static int j1939_sk_init(struct sock *sk)
+{
+ struct j1939_sock *jsk = j1939_sk(sk);
+
+ INIT_LIST_HEAD(&jsk->list);
+ init_waitqueue_head(&jsk->waitq);
+ jsk->sk.sk_priority = j1939_to_sk_priority(6);
+ jsk->sk.sk_reuse = 1; /* per default */
+ jsk->addr.sa = J1939_NO_ADDR;
+ jsk->addr.da = J1939_NO_ADDR;
+ jsk->addr.pgn = J1939_NO_PGN;
+ atomic_set(&jsk->skb_pending, 0);
+ return 0;
+}
+
+static int j1939_sk_sanity_check(struct sockaddr_can *addr, int len)
+{
+ if (!addr)
+ return -EDESTADDRREQ;
+ if (len < J1939_MIN_NAMELEN)
+ return -EINVAL;
+ if (addr->can_family != AF_CAN)
+ return -EINVAL;
+ if (!addr->can_ifindex)
+ return -ENODEV;
+ if (j1939_pgn_is_valid(addr->can_addr.j1939.pgn) &&
+ !j1939_pgn_is_clean_pdu(addr->can_addr.j1939.pgn))
+ return -EINVAL;
+
+ return 0;
+}
+
+static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+{
+ struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
+ struct j1939_sock *jsk = j1939_sk(sock->sk);
+ struct sock *sk = sock->sk;
+ struct net *net = sock_net(sk);
+ struct net_device *ndev;
+ struct j1939_priv *priv;
+ int ret = 0;
+
+ ret = j1939_sk_sanity_check(addr, len);
+ if (ret)
+ return ret;
+
+ lock_sock(sock->sk);
+
+ ndev = dev_get_by_index(net, addr->can_ifindex);
+ if (!ndev) {
+ ret = -ENODEV;
+ goto out_release_sock;
+ }
+
+ /* Already bound to an interface? */
+ if (jsk->state & J1939_SOCK_BOUND) {
+ /* A re-bind() to a different interface is not
+ * supported.
+ */
+ if (jsk->ifindex != addr->can_ifindex) {
+ ret = -EINVAL;
+ goto out_dev_put;
+ }
+
+ /* drop old references */
+ priv = j1939_priv_get_by_ndev(ndev);
+ j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa);
+ } else {
+ if (ndev->type != ARPHRD_CAN) {
+ ret = -ENODEV;
+ goto out_dev_put;
+ }
+
+ ret = j1939_netdev_start(net, ndev);
+ if (ret < 0)
+ goto out_dev_put;
+
+ jsk->ifindex = addr->can_ifindex;
+ priv = j1939_priv_get_by_ndev(ndev);
+ }
+
+ /* set default transmit pgn */
+ if (j1939_pgn_is_valid(addr->can_addr.j1939.pgn))
+ jsk->addr.pgn = addr->can_addr.j1939.pgn;
+ jsk->addr.src_name = addr->can_addr.j1939.name;
+ jsk->addr.sa = addr->can_addr.j1939.addr;
+
+ /* get new references */
+ ret = j1939_local_ecu_get(priv, jsk->addr.src_name, jsk->addr.sa);
+ j1939_priv_put(priv);
+ if (ret) {
+ j1939_netdev_stop(ndev);
+ goto out_dev_put;
+ }
+
+ if (!(jsk->state & J1939_SOCK_BOUND)) {
+ spin_lock_bh(&j1939_socks_lock);
+ list_add_tail(&jsk->list, &j1939_socks);
+ spin_unlock_bh(&j1939_socks_lock);
+
+ jsk->state |= J1939_SOCK_BOUND;
+ }
+
+ out_dev_put: /* fallthrough */
+ dev_put(ndev);
+ out_release_sock:
+ release_sock(sock->sk);
+
+ return ret;
+}
+
+static int j1939_sk_connect(struct socket *sock, struct sockaddr *uaddr,
+ int len, int flags)
+{
+ struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
+ struct j1939_sock *jsk = j1939_sk(sock->sk);
+ int ret = 0;
+
+ ret = j1939_sk_sanity_check(addr, len);
+ if (ret)
+ return ret;
+
+ lock_sock(sock->sk);
+
+ /* bind() before connect() is mandatory */
+ if (!(jsk->state & J1939_SOCK_BOUND)) {
+ ret = -EINVAL;
+ goto out_release_sock;
+ }
+
+ /* A re-connect() is not supported */
+ if (jsk->state & J1939_SOCK_CONNECTED) {
+ ret = -EBUSY;
+ goto out_release_sock;
+ }
+
+ jsk->addr.dst_name = addr->can_addr.j1939.name;
+ jsk->addr.da = addr->can_addr.j1939.addr;
+
+ if (j1939_pgn_is_valid(addr->can_addr.j1939.pgn))
+ jsk->addr.pgn = addr->can_addr.j1939.pgn;
+
+ jsk->state |= J1939_SOCK_CONNECTED;
+
+ out_release_sock: /* fallthrough */
+ release_sock(sock->sk);
+ return ret;
+}
+
+static void j1939_sk_sock2sockaddr_can(struct sockaddr_can *addr,
+ const struct j1939_sock *jsk, int peer)
+{
+ addr->can_family = AF_CAN;
+ addr->can_ifindex = jsk->ifindex;
+ addr->can_addr.j1939.pgn = jsk->addr.pgn;
+ if (peer) {
+ addr->can_addr.j1939.name = jsk->addr.dst_name;
+ addr->can_addr.j1939.addr = jsk->addr.da;
+ } else {
+ addr->can_addr.j1939.name = jsk->addr.src_name;
+ addr->can_addr.j1939.addr = jsk->addr.sa;
+ }
+}
+
+static int j1939_sk_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
+{
+ struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
+ struct sock *sk = sock->sk;
+ struct j1939_sock *jsk = j1939_sk(sk);
+ int ret = 0;
+
+ lock_sock(sk);
+
+ if (peer && !(jsk->state & J1939_SOCK_CONNECTED)) {
+ ret = -EADDRNOTAVAIL;
+ goto failure;
+ }
+
+ j1939_sk_sock2sockaddr_can(addr, jsk, peer);
+ ret = J1939_MIN_NAMELEN;
+
+ failure:
+ release_sock(sk);
+
+ return ret;
+}
+
+static int j1939_sk_release(struct socket *sock)
+{
+ struct sock *sk = sock->sk;
+ struct j1939_sock *jsk;
+ struct j1939_priv *priv;
+
+ if (!sk)
+ return 0;
+
+ jsk = j1939_sk(sk);
+ lock_sock(sk);
+
+ if (jsk->state & J1939_SOCK_BOUND) {
+ struct net_device *ndev;
+
+ spin_lock_bh(&j1939_socks_lock);
+ list_del_init(&jsk->list);
+ spin_unlock_bh(&j1939_socks_lock);
+
+ ndev = dev_get_by_index(sock_net(sk), jsk->ifindex);
+ if (ndev) {
+ priv = j1939_priv_get_by_ndev(ndev);
+ j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa);
+ j1939_priv_put(priv);
+
+ j1939_netdev_stop(ndev);
+ dev_put(ndev);
+ }
+ }
+
+ sock_orphan(sk);
+ sock->sk = NULL;
+
+ release_sock(sk);
+ sock_put(sk);
+
+ return 0;
+}
+
+static int j1939_sk_setsockopt_flag(struct j1939_sock *jsk, char __user *optval,
+ unsigned int optlen, int flag)
+{
+ int tmp;
+
+ if (optlen != sizeof(tmp))
+ return -EINVAL;
+ if (copy_from_user(&tmp, optval, optlen))
+ return -EFAULT;
+ lock_sock(&jsk->sk);
+ if (tmp)
+ jsk->state |= flag;
+ else
+ jsk->state &= ~flag;
+ release_sock(&jsk->sk);
+ return tmp;
+}
+
+static int j1939_sk_setsockopt(struct socket *sock, int level, int optname,
+ char __user *optval, unsigned int optlen)
+{
+ struct sock *sk = sock->sk;
+ struct j1939_sock *jsk = j1939_sk(sk);
+ int tmp, count = 0;
+ struct j1939_filter *filters = NULL, *ofilters;
+
+ if (level != SOL_CAN_J1939)
+ return -EINVAL;
+
+ switch (optname) {
+ case SO_J1939_FILTER:
+ if (optval) {
+ if (optlen % sizeof(*filters) != 0)
+ return -EINVAL;
+
+ if (optlen > J1939_FILTER_MAX *
+ sizeof(struct j1939_filter))
+ return -EINVAL;
+
+ count = optlen / sizeof(*filters);
+ filters = memdup_user(optval, optlen);
+ if (IS_ERR(filters))
+ return PTR_ERR(filters);
+ }
+
+ spin_lock_bh(&j1939_socks_lock);
+ ofilters = jsk->filters;
+ jsk->filters = filters;
+ jsk->nfilters = count;
+ spin_unlock_bh(&j1939_socks_lock);
+ kfree(ofilters);
+ return 0;
+ case SO_J1939_PROMISC:
+ return j1939_sk_setsockopt_flag(jsk, optval, optlen,
+ J1939_SOCK_PROMISC);
+ case SO_J1939_RECV_OWN:
+ return j1939_sk_setsockopt_flag(jsk, optval, optlen,
+ J1939_SOCK_RECV_OWN);
+ case SO_J1939_SEND_PRIO:
+ if (optlen != sizeof(tmp))
+ return -EINVAL;
+ if (copy_from_user(&tmp, optval, optlen))
+ return -EFAULT;
+ if (tmp < 0 || tmp > 7)
+ return -EDOM;
+ if (tmp < 2 && !capable(CAP_NET_ADMIN))
+ return -EPERM;
+ lock_sock(&jsk->sk);
+ jsk->sk.sk_priority = j1939_to_sk_priority(tmp);
+ release_sock(&jsk->sk);
+ return 0;
+ default:
+ return -ENOPROTOOPT;
+ }
+}
+
+static int j1939_sk_getsockopt(struct socket *sock, int level, int optname,
+ char __user *optval, int __user *optlen)
+{
+ struct sock *sk = sock->sk;
+ struct j1939_sock *jsk = j1939_sk(sk);
+ int ret, ulen;
+ /* set defaults for using 'int' properties */
+ int tmp = 0;
+ int len = sizeof(tmp);
+ void *val = &tmp;
+
+ if (level != SOL_CAN_J1939)
+ return -EINVAL;
+ if (get_user(ulen, optlen))
+ return -EFAULT;
+ if (ulen < 0)
+ return -EINVAL;
+
+ lock_sock(&jsk->sk);
+ switch (optname) {
+ case SO_J1939_PROMISC:
+ tmp = (jsk->state & J1939_SOCK_PROMISC) ? 1 : 0;
+ break;
+ case SO_J1939_RECV_OWN:
+ tmp = (jsk->state & J1939_SOCK_RECV_OWN) ? 1 : 0;
+ break;
+ case SO_J1939_SEND_PRIO:
+ tmp = j1939_prio(jsk->sk.sk_priority);
+ break;
+ default:
+ ret = -ENOPROTOOPT;
+ goto no_copy;
+ }
+
+ /* copy to user, based on 'len' & 'val'
+ * but most sockopt's are 'int' properties, and have 'len' & 'val'
+ * left unchanged, but instead modified 'tmp'
+ */
+ if (len > ulen)
+ ret = -EFAULT;
+ else if (put_user(len, optlen))
+ ret = -EFAULT;
+ else if (copy_to_user(optval, val, len))
+ ret = -EFAULT;
+ else
+ ret = 0;
+ no_copy:
+ release_sock(&jsk->sk);
+ return ret;
+}
+
+static int j1939_sk_recvmsg(struct socket *sock, struct msghdr *msg,
+ size_t size, int flags)
+{
+ struct sock *sk = sock->sk;
+ struct sk_buff *skb;
+ struct j1939_sk_buff_cb *skcb;
+ int ret = 0;
+
+ skb = skb_recv_datagram(sk, flags, 0, &ret);
+ if (!skb)
+ return ret;
+
+ if (size < skb->len)
+ msg->msg_flags |= MSG_TRUNC;
+ else
+ size = skb->len;
+
+ ret = memcpy_to_msg(msg, skb->data, size);
+ if (ret < 0) {
+ skb_free_datagram(sk, skb);
+ return ret;
+ }
+
+ skcb = j1939_skb_to_cb(skb);
+ if (j1939_address_is_valid(skcb->addr.da))
+ put_cmsg(msg, SOL_CAN_J1939, SCM_J1939_DEST_ADDR,
+ sizeof(skcb->addr.da), &skcb->addr.da);
+
+ if (skcb->addr.dst_name)
+ put_cmsg(msg, SOL_CAN_J1939, SCM_J1939_DEST_NAME,
+ sizeof(skcb->addr.dst_name), &skcb->addr.dst_name);
+
+ put_cmsg(msg, SOL_CAN_J1939, SCM_J1939_PRIO,
+ sizeof(skcb->priority), &skcb->priority);
+
+ if (msg->msg_name) {
+ struct sockaddr_can *paddr = msg->msg_name;
+
+ msg->msg_namelen = J1939_MIN_NAMELEN;
+ memset(msg->msg_name, 0, msg->msg_namelen);
+ paddr->can_family = AF_CAN;
+ paddr->can_ifindex = skb->skb_iif;
+ paddr->can_addr.j1939.name = skcb->addr.src_name;
+ paddr->can_addr.j1939.addr = skcb->addr.sa;
+ paddr->can_addr.j1939.pgn = skcb->addr.pgn;
+ }
+
+ sock_recv_ts_and_drops(msg, sk, skb);
+ msg->msg_flags |= skcb->msg_flags;
+ skb_free_datagram(sk, skb);
+
+ return size;
+}
+
+static int j1939_sk_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+{
+ struct sock *sk = sock->sk;
+ struct j1939_sock *jsk = j1939_sk(sk);
+ struct sockaddr_can *addr = msg->msg_name;
+ struct j1939_sk_buff_cb *skcb;
+ struct sk_buff *skb;
+ struct net_device *ndev;
+ int ifindex;
+ int ret;
+
+ /* various socket state tests */
+ if (!(jsk->state & J1939_SOCK_BOUND))
+ return -EBADFD;
+
+ ifindex = jsk->ifindex;
+
+ if (jsk->addr.sa == J1939_NO_ADDR && !jsk->addr.src_name)
+ /* no address assigned yet */
+ return -EBADFD;
+
+ /* deal with provided address info */
+ if (msg->msg_name) {
+ if (msg->msg_namelen < J1939_MIN_NAMELEN)
+ return -EINVAL;
+ if (addr->can_family != AF_CAN)
+ return -EINVAL;
+ if (j1939_pgn_is_valid(addr->can_addr.j1939.pgn) &&
+ !j1939_pgn_is_clean_pdu(addr->can_addr.j1939.pgn))
+ return -EINVAL;
+ /* TODO: always check if ifindex is correct? */
+ if (addr->can_ifindex && ifindex != addr->can_ifindex)
+ return -EBADFD;
+ }
+
+ ndev = dev_get_by_index(sock_net(sk), ifindex);
+ if (!ndev)
+ return -ENXIO;
+
+ skb = sock_alloc_send_skb(sk,
+ size +
+ sizeof(struct can_frame) -
+ sizeof(((struct can_frame *)NULL)->data) +
+ sizeof(struct can_skb_priv),
+ msg->msg_flags & MSG_DONTWAIT, &ret);
+ if (!skb)
+ goto put_dev;
+
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = ndev->ifindex;
+ can_skb_prv(skb)->skbcnt = 0;
+ skb_reserve(skb, offsetof(struct can_frame, data));
+
+ ret = memcpy_from_msg(skb_put(skb, size), msg, size);
+ if (ret < 0)
+ goto free_skb;
+ sock_tx_timestamp(sk, skb->sk->sk_tsflags, &skb_shinfo(skb)->tx_flags);
+
+ skb->dev = ndev;
+
+ skcb = j1939_skb_to_cb(skb);
+ memset(skcb, 0, sizeof(*skcb));
+ skcb->addr = jsk->addr;
+ skcb->priority = j1939_prio(sk->sk_priority);
+ skcb->msg_flags = msg->msg_flags;
+
+ if (msg->msg_name) {
+ struct sockaddr_can *addr = msg->msg_name;
+
+ if (addr->can_addr.j1939.name ||
+ addr->can_addr.j1939.addr != J1939_NO_ADDR) {
+ skcb->addr.dst_name = addr->can_addr.j1939.name;
+ skcb->addr.da = addr->can_addr.j1939.addr;
+ }
+ if (j1939_pgn_is_valid(addr->can_addr.j1939.pgn))
+ skcb->addr.pgn = addr->can_addr.j1939.pgn;
+ }
+ if (!j1939_pgn_is_valid(skcb->addr.pgn)) {
+ ret = -EINVAL;
+ goto free_skb;
+ }
+
+ if (skcb->msg_flags & MSG_SYN) {
+ if (skcb->msg_flags & MSG_DONTWAIT) {
+ ret = j1939_sock_pending_add_first(&jsk->sk);
+ if (ret > 0)
+ ret = -EAGAIN;
+ } else {
+ ret = wait_event_interruptible(jsk->waitq,
+ j1939_sock_pending_add_first(&jsk->sk));
+ }
+ if (ret < 0)
+ goto free_skb;
+ } else {
+ j1939_sock_pending_add(&jsk->sk);
+ }
+
+ ret = j1939_send(skb);
+ if (ret < 0)
+ j1939_sock_pending_del(&jsk->sk);
+
+ dev_put(ndev);
+ return (ret < 0) ? ret : size;
+
+ free_skb:
+ kfree_skb(skb);
+ put_dev:
+ dev_put(ndev);
+ return ret;
+}
+
+void j1939_sk_netdev_event(struct net_device *ndev, int error_code)
+{
+ struct j1939_sock *jsk;
+
+ spin_lock_bh(&j1939_socks_lock);
+ list_for_each_entry(jsk, &j1939_socks, list) {
+ if (jsk->ifindex != ndev->ifindex)
+ continue;
+
+ jsk->sk.sk_err = error_code;
+ if (!sock_flag(&jsk->sk, SOCK_DEAD))
+ jsk->sk.sk_error_report(&jsk->sk);
+
+ if (error_code == ENODEV) {
+ struct j1939_priv *priv;
+
+ priv = j1939_priv_get_by_ndev(ndev);
+ j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa);
+ j1939_priv_put(priv);
+
+ j1939_netdev_stop(ndev);
+ }
+ /* do not remove filters here */
+ }
+ spin_unlock_bh(&j1939_socks_lock);
+}
+
+static const struct proto_ops j1939_ops = {
+ .family = PF_CAN,
+ .release = j1939_sk_release,
+ .bind = j1939_sk_bind,
+ .connect = j1939_sk_connect,
+ .socketpair = sock_no_socketpair,
+ .accept = sock_no_accept,
+ .getname = j1939_sk_getname,
+ .poll = datagram_poll,
+ .ioctl = can_ioctl,
+ .listen = sock_no_listen,
+ .shutdown = sock_no_shutdown,
+ .setsockopt = j1939_sk_setsockopt,
+ .getsockopt = j1939_sk_getsockopt,
+ .sendmsg = j1939_sk_sendmsg,
+ .recvmsg = j1939_sk_recvmsg,
+ .mmap = sock_no_mmap,
+ .sendpage = sock_no_sendpage,
+};
+
+static struct proto j1939_proto __read_mostly = {
+ .name = "CAN_J1939",
+ .owner = THIS_MODULE,
+ .obj_size = sizeof(struct j1939_sock),
+ .init = j1939_sk_init,
+};
+
+const struct can_proto j1939_can_proto = {
+ .type = SOCK_DGRAM,
+ .protocol = CAN_J1939,
+ .ops = &j1939_ops,
+ .prot = &j1939_proto,
+};
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
new file mode 100644
index 000000000000..27cf1738f77a
--- /dev/null
+++ b/net/can/j1939/transport.c
@@ -0,0 +1,1333 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2010-2011 EIA Electronics, Kurt Van Dijck <kurt.van.dijck@eia.be>
+// Copyright (c) 2017-2018 Pengutronix, Marc Kleine-Budde <kernel@pengutronix.de>
+// Copyright (c) 2017-2018 Pengutronix, Oleksij Rempel <kernel@pengutronix.de>
+// Copyright (c) 2018 Protonic, Robin van der Gracht <robin@protonic.nl>
+
+#include <linux/can/skb.h>
+
+#include "j1939-priv.h"
+
+#define J1939_REGULAR 0
+#define J1939_EXTENDED 1
+
+#define J1939_ETP_PGN_CTL 0xc800
+#define J1939_ETP_PGN_DAT 0xc700
+#define J1939_TP_PGN_CTL 0xec00
+#define J1939_TP_PGN_DAT 0xeb00
+
+#define J1939_TP_CMD_RTS 0x10
+#define J1939_TP_CMD_CTS 0x11
+#define J1939_TP_CMD_EOMA 0x13
+#define J1939_TP_CMD_BAM 0x20
+#define J1939_TP_CMD_ABORT 0xff
+
+#define J1939_ETP_CMD_RTS 0x14
+#define J1939_ETP_CMD_CTS 0x15
+#define J1939_ETP_CMD_DPO 0x16
+#define J1939_ETP_CMD_EOMA 0x17
+#define J1939_ETP_CMD_ABORT 0xff
+
+enum j1939_xtp_abort {
+ J1939_XTP_ABORT_NO_ERROR = 0,
+ J1939_XTP_ABORT_BUSY = 1,
+ J1939_XTP_ABORT_RESOURCE = 2,
+ J1939_XTP_ABORT_TIMEOUT = 3,
+ J1939_XTP_ABORT_GENERIC = 4,
+ J1939_XTP_ABORT_FAULT = 5,
+};
+
+#define J1939_MAX_TP_PACKET_SIZE (7 * 0xff)
+#define J1939_MAX_ETP_PACKET_SIZE (7 * 0x00ffffff)
+
+static unsigned int j1939_tp_block = 255;
+static unsigned int j1939_tp_max_packet_size = J1939_MAX_ETP_PACKET_SIZE;
+static unsigned int j1939_tp_retry_ms = 20;
+static unsigned int j1939_tp_packet_delay;
+static unsigned int j1939_tp_padding = 1;
+
+struct j1939_session {
+ struct j1939_priv *priv;
+ struct list_head list;
+ struct kref kref;
+ spinlock_t lock;
+
+ /* ifindex, src, dst, pgn define the session block
+ * the are _never_ modified after insertion in the list
+ * this decreases locking problems a _lot_
+ */
+ struct j1939_sk_buff_cb *skcb;
+ struct sk_buff *skb;
+
+ /* all tx related stuff (last_txcmd, pkt.tx)
+ * is protected (modified only) with the txtimer hrtimer
+ * 'total' & 'block' are never changed,
+ * last_cmd, last & block are protected by ->lock
+ * this means that the tx may run after cts is received that should
+ * have stopped tx, but this time discrepancy is never avoided anyhow
+ */
+ u8 last_cmd, last_txcmd;
+ bool transmission;
+ bool extd;
+ struct {
+ /* these do not require 16 bit, they should fit in u8
+ * but putting in int makes it easier to deal with
+ */
+ unsigned int total, done, last, tx;
+ unsigned int block; /* for TP */
+ unsigned int dpo; /* for ETP */
+ } pkt;
+ struct hrtimer txtimer, rxtimer;
+};
+
+/* helpers */
+static inline void j1939_fix_cb(struct j1939_sk_buff_cb *skcb)
+{
+ skcb->msg_flags &= ~MSG_SYN;
+}
+
+static inline struct list_head *j1939_sessionq(struct j1939_priv *priv, bool extd)
+{
+ if (extd)
+ return &priv->tp_extsessionq;
+ else
+ return &priv->tp_sessionq;
+}
+
+static inline void j1939_session_list_lock(struct j1939_priv *priv)
+{
+ spin_lock_bh(&priv->tp_session_list_lock);
+}
+
+static inline void j1939_session_list_unlock(struct j1939_priv *priv)
+{
+ spin_unlock_bh(&priv->tp_session_list_lock);
+}
+
+static void j1939_session_list_add(struct j1939_session *session, struct list_head *list)
+{
+ list_add_tail(&session->list, list);
+}
+
+static void j1939_session_list_del(struct j1939_session *session)
+{
+ list_del_init(&session->list);
+}
+
+static inline void j1939_session_get(struct j1939_session *session)
+{
+ kref_get(&session->kref);
+}
+
+static void j1939_session_destroy(struct j1939_session *session)
+{
+ j1939_session_list_lock(session->priv);
+ j1939_session_list_del(session);
+ j1939_session_list_unlock(session->priv);
+ kfree_skb(session->skb);
+ j1939_priv_put(session->priv);
+ kfree(session);
+}
+
+static void __j1939_session_release(struct kref *kref)
+{
+ struct j1939_session *session = container_of(kref, struct j1939_session, kref);
+
+ j1939_session_destroy(session);
+}
+
+static inline void j1939_session_put(struct j1939_session *session)
+{
+ kref_put(&session->kref, __j1939_session_release);
+}
+
+static void j1939_session_txtimer_cancel(struct j1939_session *session)
+{
+ if (hrtimer_cancel(&session->txtimer))
+ j1939_session_put(session);
+}
+
+static void j1939_session_rxtimer_cancel(struct j1939_session *session)
+{
+ if (hrtimer_cancel(&session->rxtimer))
+ j1939_session_put(session);
+}
+
+static void j1939_session_timers_cancel(struct j1939_session *session)
+{
+ j1939_session_txtimer_cancel(session);
+ j1939_session_rxtimer_cancel(session);
+}
+
+static inline bool j1939_cb_is_broadcast(const struct j1939_sk_buff_cb *skcb)
+{
+ return (!skcb->addr.dst_name && (skcb->addr.da == 0xff));
+}
+
+/* transport status locking */
+static inline void j1939_session_lock(struct j1939_session *session)
+{
+ spin_lock_bh(&session->lock);
+}
+
+static inline void j1939_session_unlock(struct j1939_session *session)
+{
+ spin_unlock_bh(&session->lock);
+}
+
+/* see if we are receiver
+ * returns 0 for broadcasts, although we will receive them
+ */
+static inline int j1939_tp_im_receiver(struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+
+ return skcb->dst_flags & J1939_ECU_LOCAL;
+}
+
+/* see if we are sender */
+static inline int j1939_tp_im_transmitter(struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+
+ return skcb->src_flags & J1939_ECU_LOCAL;
+}
+
+/* see if we are involved as either receiver or transmitter */
+static int j1939_tp_im_involved(struct sk_buff *skb, bool swap)
+{
+ if (swap)
+ return j1939_tp_im_receiver(skb);
+ else
+ return j1939_tp_im_transmitter(skb);
+}
+
+static int j1939_tp_im_involved_anydir(struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+
+ return (skcb->src_flags | skcb->dst_flags) & J1939_ECU_LOCAL;
+}
+
+/* extract pgn from flow-ctl message */
+static inline pgn_t j1939_xtp_ctl_to_pgn(const u8 *dat)
+{
+ pgn_t pgn;
+
+ pgn = (dat[7] << 16) | (dat[6] << 8) | (dat[5] << 0);
+ if (j1939_pgn_is_pdu1(pgn))
+ pgn &= 0xffff00;
+ return pgn;
+}
+
+static inline unsigned int j1939_tp_ctl_to_size(const u8 *dat)
+{
+ return (dat[2] << 8) + (dat[1] << 0);
+}
+
+static inline unsigned int j1939_etp_ctl_to_packet(const u8 *dat)
+{
+ return (dat[4] << 16) | (dat[3] << 8) | (dat[2] << 0);
+}
+
+static inline unsigned int j1939_etp_ctl_to_size(const u8 *dat)
+{
+ return (dat[4] << 24) | (dat[3] << 16) |
+ (dat[2] << 8) | (dat[1] << 0);
+}
+
+/* find existing session:
+ * reverse: swap cb's src & dst
+ * there is no problem with matching broadcasts, since
+ * broadcasts (no dst, no da) would never call this
+ * with reverse == true
+ */
+static bool j1939_session_match(struct j1939_session *session, struct sk_buff *skb,
+ bool reverse)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+
+ if (can_skb_prv(session->skb)->ifindex != can_skb_prv(skb)->ifindex)
+ return false;
+ if (reverse) {
+ if (session->skcb->addr.src_name) {
+ if (session->skcb->addr.src_name != skcb->addr.dst_name)
+ return false;
+ } else if (session->skcb->addr.sa != skcb->addr.da) {
+ return false;
+ }
+
+ if (session->skcb->addr.dst_name) {
+ if (session->skcb->addr.dst_name != skcb->addr.src_name)
+ return false;
+ } else if (session->skcb->addr.da != skcb->addr.sa) {
+ return false;
+ }
+ } else {
+ if (session->skcb->addr.src_name) {
+ if (session->skcb->addr.src_name != skcb->addr.src_name)
+ return false;
+ } else if (session->skcb->addr.sa != skcb->addr.sa) {
+ return false;
+ }
+
+ if (session->skcb->addr.dst_name) {
+ if (session->skcb->addr.dst_name != skcb->addr.dst_name)
+ return false;
+ } else if (session->skcb->addr.da != skcb->addr.da) {
+ return false;
+ }
+ }
+
+ return true;
+}
+
+static struct j1939_session *j1939_session_get_by_skb_locked(struct j1939_priv *priv, struct list_head *root,
+ struct sk_buff *skb, bool reverse)
+{
+ struct j1939_session *session;
+
+ lockdep_assert_held(&priv->tp_session_list_lock);
+
+ list_for_each_entry(session, root, list) {
+ j1939_session_get(session);
+ if (j1939_session_match(session, skb, reverse))
+ return session;
+ j1939_session_put(session);
+ }
+
+ return NULL;
+}
+
+static struct j1939_session *j1939_session_get_by_skb(struct j1939_priv *priv, struct list_head *root,
+ struct sk_buff *skb, bool reverse)
+{
+ struct j1939_session *session;
+
+ j1939_session_list_lock(priv);
+ session = j1939_session_get_by_skb_locked(priv, root, skb, reverse);
+ j1939_session_list_unlock(priv);
+
+ return session;
+}
+
+static void j1939_skbcb_swap(struct j1939_sk_buff_cb *skcb)
+{
+ swap(skcb->addr.dst_name, skcb->addr.src_name);
+ swap(skcb->addr.da, skcb->addr.sa);
+ swap(skcb->dst_flags, skcb->src_flags);
+}
+
+static struct sk_buff *j1939_tp_tx_dat_new(struct sk_buff *related,
+ bool extd, bool ctl, bool swap_src_dst)
+{
+ struct sk_buff *skb;
+ struct j1939_sk_buff_cb *skcb;
+
+ skb = alloc_skb(sizeof(struct can_frame) + sizeof(struct can_skb_priv),
+ GFP_ATOMIC);
+ if (unlikely(!skb))
+ return ERR_PTR(-ENOMEM);
+
+ skb->dev = related->dev;
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = can_skb_prv(related)->ifindex;
+ /* reserve CAN header */
+ skb_reserve(skb, offsetof(struct can_frame, data));
+ skb->protocol = related->protocol;
+ skb->pkt_type = related->pkt_type;
+ skb->ip_summed = related->ip_summed;
+
+ memcpy(skb->cb, related->cb, sizeof(skb->cb));
+ skcb = j1939_skb_to_cb(skb);
+ j1939_fix_cb(skcb);
+ if (swap_src_dst)
+ j1939_skbcb_swap(skcb);
+
+ if (ctl) {
+ if (extd)
+ skcb->addr.pgn = J1939_ETP_PGN_CTL;
+ else
+ skcb->addr.pgn = J1939_TP_PGN_CTL;
+ } else {
+ if (extd)
+ skcb->addr.pgn = J1939_ETP_PGN_DAT;
+ else
+ skcb->addr.pgn = J1939_TP_PGN_DAT;
+ }
+
+ return skb;
+}
+
+/* TP transmit packet functions */
+static int j1939_tp_tx_dat(struct sk_buff *related, bool extd,
+ const u8 *dat, int len)
+{
+ struct sk_buff *skb;
+
+ skb = j1939_tp_tx_dat_new(related, extd, false, false);
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+ skb_put_data(skb, dat, len);
+ if (j1939_tp_padding && len < 8)
+ memset(skb_put(skb, 8 - len), 0xff, 8 - len);
+
+ return j1939_send(skb);
+}
+
+static int j1939_xtp_do_tx_ctl(struct sk_buff *related, bool extd,
+ bool swap_src_dst, pgn_t pgn, const u8 *dat)
+{
+ struct sk_buff *skb;
+ u8 *skdat;
+
+ if (!j1939_tp_im_involved(related, swap_src_dst))
+ return 0;
+
+ skb = j1939_tp_tx_dat_new(related, extd, true, swap_src_dst);
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+ skdat = skb_put(skb, 8);
+ memcpy(skdat, dat, 5);
+ skdat[5] = (pgn >> 0);
+ skdat[6] = (pgn >> 8);
+ skdat[7] = (pgn >> 16);
+
+ return j1939_send(skb);
+}
+
+static inline int j1939_tp_tx_ctl(struct j1939_session *session,
+ bool swap_src_dst, const u8 *dat)
+{
+ return j1939_xtp_do_tx_ctl(session->skb, session->extd, swap_src_dst,
+ session->skcb->addr.pgn, dat);
+}
+
+static int j1939_xtp_tx_abort(struct sk_buff *related, bool extd,
+ bool swap_src_dst, enum j1939_xtp_abort err, pgn_t pgn)
+{
+ u8 dat[5];
+
+ if (!j1939_tp_im_involved(related, swap_src_dst))
+ return 0;
+
+ memset(dat, 0xff, sizeof(dat));
+ dat[0] = J1939_TP_CMD_ABORT;
+ if (extd)
+ dat[1] = J1939_XTP_ABORT_GENERIC;
+ else
+ dat[1] = err;
+ return j1939_xtp_do_tx_ctl(related, extd, swap_src_dst, pgn, dat);
+}
+
+static inline void j1939_tp_schedule_txtimer(struct j1939_session *session, int msec)
+{
+ j1939_session_get(session);
+ hrtimer_start(&session->txtimer, ms_to_ktime(msec), HRTIMER_MODE_REL_SOFT);
+}
+
+static inline void j1939_tp_set_rxtimeout(struct j1939_session *session, int msec)
+{
+ j1939_session_rxtimer_cancel(session);
+ j1939_session_get(session);
+ hrtimer_start(&session->rxtimer, ms_to_ktime(msec), HRTIMER_MODE_REL_SOFT);
+}
+
+/* transmit function */
+static int j1939_tp_txnext(struct j1939_session *session)
+{
+ u8 dat[8];
+ const u8 *tpdat;
+ int ret, offset, pkt_done, pkt_end;
+ unsigned int pkt, len, pdelay;
+
+ memset(dat, 0xff, sizeof(dat));
+
+ switch (session->last_cmd) {
+ case 0:
+ if (!j1939_tp_im_transmitter(session->skb))
+ break;
+ dat[1] = (session->skb->len >> 0);
+ dat[2] = (session->skb->len >> 8);
+ dat[3] = session->pkt.total;
+ if (session->extd) {
+ dat[0] = J1939_ETP_CMD_RTS;
+ dat[1] = (session->skb->len >> 0);
+ dat[2] = (session->skb->len >> 8);
+ dat[3] = (session->skb->len >> 16);
+ dat[4] = (session->skb->len >> 24);
+ } else if (j1939_cb_is_broadcast(session->skcb)) {
+ dat[0] = J1939_TP_CMD_BAM;
+ /* fake cts for broadcast */
+ session->pkt.tx = 0;
+ } else {
+ dat[0] = J1939_TP_CMD_RTS;
+ dat[4] = dat[3];
+ }
+ if (dat[0] == session->last_txcmd)
+ /* done already */
+ break;
+ ret = j1939_tp_tx_ctl(session, false, dat);
+ if (ret < 0)
+ goto failed;
+ session->last_txcmd = dat[0];
+ /* must lock? */
+ if (dat[0] == J1939_TP_CMD_BAM)
+ j1939_tp_schedule_txtimer(session, 50);
+ j1939_tp_set_rxtimeout(session, 1250);
+ break;
+ case J1939_TP_CMD_RTS:
+ case J1939_ETP_CMD_RTS: /* fallthrough */
+ if (!j1939_tp_im_receiver(session->skb))
+ break;
+tx_cts:
+ ret = 0;
+ len = session->pkt.total - session->pkt.done;
+ len = min3(len, session->pkt.block, j1939_tp_block ?: 255);
+
+ if (session->extd) {
+ pkt = session->pkt.done + 1;
+ dat[0] = J1939_ETP_CMD_CTS;
+ dat[1] = len;
+ dat[2] = (pkt >> 0);
+ dat[3] = (pkt >> 8);
+ dat[4] = (pkt >> 16);
+ } else {
+ dat[0] = J1939_TP_CMD_CTS;
+ dat[1] = len;
+ dat[2] = session->pkt.done + 1;
+ }
+ if (dat[0] == session->last_txcmd)
+ /* done already */
+ break;
+ ret = j1939_tp_tx_ctl(session, true, dat);
+ if (ret < 0)
+ goto failed;
+ if (len)
+ /* only mark cts done when len is set */
+ session->last_txcmd = dat[0];
+ j1939_tp_set_rxtimeout(session, 1250);
+ break;
+ case J1939_ETP_CMD_CTS:
+ if (j1939_tp_im_transmitter(session->skb) && session->extd &&
+ session->last_txcmd != J1939_ETP_CMD_DPO) {
+ /* do dpo */
+ dat[0] = J1939_ETP_CMD_DPO;
+ session->pkt.dpo = session->pkt.done;
+ pkt = session->pkt.dpo;
+ dat[1] = session->pkt.last - session->pkt.done;
+ dat[2] = (pkt >> 0);
+ dat[3] = (pkt >> 8);
+ dat[4] = (pkt >> 16);
+ ret = j1939_tp_tx_ctl(session, false, dat);
+ if (ret < 0)
+ goto failed;
+ session->last_txcmd = dat[0];
+ j1939_tp_set_rxtimeout(session, 1250);
+ session->pkt.tx = session->pkt.done;
+ }
+ /* fallthrough */
+ case J1939_TP_CMD_CTS: /* fallthrough */
+ case 0xff: /* did some data */
+ case J1939_ETP_CMD_DPO: /* fallthrough */
+ if ((session->extd || !j1939_cb_is_broadcast(session->skcb)) &&
+ j1939_tp_im_receiver(session->skb)) {
+ if (session->pkt.done >= session->pkt.total) {
+ if (session->extd) {
+ dat[0] = J1939_ETP_CMD_EOMA;
+ dat[1] = session->skb->len >> 0;
+ dat[2] = session->skb->len >> 8;
+ dat[3] = session->skb->len >> 16;
+ dat[4] = session->skb->len >> 24;
+ } else {
+ dat[0] = J1939_TP_CMD_EOMA;
+ dat[1] = session->skb->len;
+ dat[2] = session->skb->len >> 8;
+ dat[3] = session->pkt.total;
+ }
+ if (dat[0] == session->last_txcmd)
+ /* done already */
+ break;
+ ret = j1939_tp_tx_ctl(session, true, dat);
+ if (ret < 0)
+ goto failed;
+ session->last_txcmd = dat[0];
+ j1939_tp_set_rxtimeout(session, 1250);
+ /* wait for the EOMA packet to come in */
+ break;
+ } else if (session->pkt.done >= session->pkt.last) {
+ session->last_txcmd = 0;
+ goto tx_cts;
+ }
+ }
+ case J1939_TP_CMD_BAM: /* fallthrough */
+ if (!j1939_tp_im_transmitter(session->skb))
+ break;
+ tpdat = session->skb->data;
+ ret = 0;
+ pkt_done = 0;
+ if (!session->extd && j1939_cb_is_broadcast(session->skcb))
+ pkt_end = session->pkt.total;
+ else
+ pkt_end = session->pkt.last;
+
+ while (session->pkt.tx < pkt_end) {
+ dat[0] = session->pkt.tx - session->pkt.dpo + 1;
+ offset = session->pkt.tx * 7;
+ len = session->skb->len - offset;
+ if (len > 7)
+ len = 7;
+ memcpy(&dat[1], &tpdat[offset], len);
+ ret = j1939_tp_tx_dat(session->skb, session->extd,
+ dat, len + 1);
+ if (ret < 0)
+ break;
+ session->last_txcmd = 0xff;
+ ++pkt_done;
+ ++session->pkt.tx;
+ pdelay = j1939_cb_is_broadcast(session->skcb) ? 50 :
+ j1939_tp_packet_delay;
+ if (session->pkt.tx < session->pkt.total && pdelay) {
+ j1939_tp_schedule_txtimer(session, pdelay);
+ break;
+ }
+ }
+ if (pkt_done)
+ j1939_tp_set_rxtimeout(session, 250);
+ if (ret)
+ goto failed;
+ break;
+ }
+
+ return 0;
+
+failed:
+ return ret;
+}
+
+/* timer & scheduler functions */
+static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)
+{
+ struct j1939_session *session =
+ container_of(hrtimer, struct j1939_session, txtimer);
+ int ret;
+
+ ret = j1939_tp_txnext(session);
+ if (ret < 0)
+ j1939_tp_schedule_txtimer(session, j1939_tp_retry_ms ?: 20);
+ j1939_session_put(session);
+
+ return HRTIMER_NORESTART;
+}
+
+/* session completion functions */
+static void __j1939_session_drop(struct j1939_session *session)
+{
+ struct j1939_priv *priv = session->priv;
+
+ if (session->transmission) {
+ if (session->skb && session->skb->sk)
+ j1939_sock_pending_del(session->skb->sk);
+ wake_up_all(&priv->tp_wait);
+ }
+}
+
+static void j1939_session_completed(struct j1939_session *session)
+{
+ /* distribute among j1939 receivers */
+ j1939_sk_recv(session->skb);
+ __j1939_session_drop(session);
+}
+
+static void j1939_session_cancel(struct j1939_session *session, enum j1939_xtp_abort err)
+{
+ if (err && j1939_tp_im_involved_anydir(session->skb)) {
+ if (!j1939_cb_is_broadcast(session->skcb)) {
+ /* do not send aborts on incoming broadcasts */
+ j1939_xtp_tx_abort(session->skb, session->extd,
+ !(session->skcb->src_flags & J1939_ECU_LOCAL),
+ err, session->skcb->addr.pgn);
+ }
+ }
+ __j1939_session_drop(session);
+}
+
+static enum hrtimer_restart j1939_tp_rxtimer(struct hrtimer *hrtimer)
+{
+ struct j1939_session *session = container_of(hrtimer, struct j1939_session,
+ rxtimer);
+
+ pr_alert("%s: timeout on %i\n", __func__,
+ can_skb_prv(session->skb)->ifindex);
+ j1939_session_txtimer_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_TIMEOUT);
+ j1939_session_put(session);
+
+ return HRTIMER_NORESTART;
+}
+
+/* receive packet functions */
+static void j1939_xtp_rx_bad_message_one(struct j1939_priv *priv, struct sk_buff *skb, bool extd, bool reverse)
+{
+ struct j1939_session *session;
+ pgn_t pgn;
+
+ pgn = j1939_xtp_ctl_to_pgn(skb->data);
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, reverse);
+ if (session /*&& (session->skcb->addr.pgn == pgn)*/) {
+ /* do not allow TP control messages on 2 pgn's */
+ j1939_session_cancel(session, J1939_XTP_ABORT_FAULT);
+ goto out_session_put;
+ }
+ j1939_xtp_tx_abort(skb, extd, false, J1939_XTP_ABORT_FAULT, pgn);
+ if (!session)
+ return;
+
+ out_session_put:
+ j1939_session_put(session);
+}
+
+/* abort packets may come in 2 directions */
+static void j1939_xtp_rx_bad_message(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ pr_info("%s, pgn %05x\n", __func__, j1939_xtp_ctl_to_pgn(skb->data));
+
+ j1939_xtp_rx_bad_message_one(priv, skb, extd, false);
+ j1939_xtp_rx_bad_message_one(priv, skb, extd, true);
+}
+
+static void j1939_xtp_rx_abort_one(struct j1939_priv *priv, struct sk_buff *skb, bool extd, bool reverse)
+{
+ struct j1939_session *session;
+ pgn_t pgn;
+
+ pgn = j1939_xtp_ctl_to_pgn(skb->data);
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, reverse);
+ if (!session)
+ return;
+ if (session->transmission && !session->last_txcmd) {
+ /* empty block:
+ * do not drop session when a transmit session did not
+ * start yet
+ */
+ } else if (session->skcb->addr.pgn == pgn) {
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_NO_ERROR);
+ }
+
+ /* TODO: maybe cancel current connection
+ * as another pgn was communicated
+ */
+ j1939_session_put(session);
+}
+
+/* abort packets may come in 2 directions */
+static void j1939_xtp_rx_abort(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ pr_info("%s %i, %05x\n", __func__, can_skb_prv(skb)->ifindex,
+ j1939_xtp_ctl_to_pgn(skb->data));
+
+ j1939_xtp_rx_abort_one(priv, skb, extd, false);
+ j1939_xtp_rx_abort_one(priv, skb, extd, true);
+}
+
+static void j1939_xtp_rx_eoma(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ struct j1939_session *session;
+ pgn_t pgn;
+
+ /* end of tx cycle */
+ pgn = j1939_xtp_ctl_to_pgn(skb->data);
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, true);
+ if (!session) {
+ /* strange, we had EOMA on closed connection
+ * do nothing, as EOMA closes the connection anyway
+ */
+ return;
+ }
+
+ j1939_session_timers_cancel(session);
+ if (session->skcb->addr.pgn != pgn) {
+ j1939_xtp_tx_abort(skb, extd, true, J1939_XTP_ABORT_BUSY, pgn);
+ j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+ } else {
+ /* transmitted without problems */
+ j1939_session_completed(session);
+ }
+
+ j1939_session_put(session);
+}
+
+static void j1939_xtp_rx_cts(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ struct j1939_session *session;
+ pgn_t pgn;
+ unsigned int pkt;
+ const u8 *dat;
+
+ dat = skb->data;
+ pgn = j1939_xtp_ctl_to_pgn(skb->data);
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, true);
+ if (!session) {
+ /* 'CTS shall be ignored' */
+ return;
+ }
+
+ if (session->skcb->addr.pgn != pgn) {
+ /* what to do? */
+ j1939_xtp_tx_abort(skb, extd, true, J1939_XTP_ABORT_BUSY, pgn);
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+ goto out_session_put;
+ }
+
+ j1939_session_lock(session);
+ if (extd)
+ pkt = j1939_etp_ctl_to_packet(dat);
+ else
+ pkt = dat[2];
+ if (!pkt) {
+ goto out_session_unlock;
+ } else if (dat[1] > session->pkt.block /* 0xff for etp */) {
+ goto out_session_unlock;
+ } else {
+ /* set packet counters only when not CTS(0) */
+ session->pkt.done = pkt - 1;
+ session->pkt.last = session->pkt.done + dat[1];
+ if (session->pkt.last > session->pkt.total)
+ /* safety measure */
+ session->pkt.last = session->pkt.total;
+ /* TODO: do not set tx here, do it in txtimer */
+ session->pkt.tx = session->pkt.done;
+ }
+
+ session->last_cmd = dat[0];
+ j1939_session_unlock(session);
+ if (dat[1]) {
+ j1939_tp_set_rxtimeout(session, 1250);
+ if (j1939_tp_im_transmitter(session->skb))
+ j1939_tp_schedule_txtimer(session, 0);
+ } else {
+ /* CTS(0) */
+ j1939_tp_set_rxtimeout(session, 550);
+ }
+ j1939_session_put(session);
+ return;
+
+ out_session_unlock:
+ j1939_session_unlock(session);
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_FAULT);
+ out_session_put:
+ j1939_session_put(session);
+}
+
+static struct j1939_session *j1939_session_new(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ struct j1939_session *session;
+
+ session = kzalloc(sizeof(*session), gfp_any());
+ if (!session)
+ return NULL;
+ INIT_LIST_HEAD(&session->list);
+ spin_lock_init(&session->lock);
+ kref_init(&session->kref);
+
+ j1939_priv_get(priv);
+ session->priv = priv;
+ /* corresponding skb_unref() is in j1939_session_fresh_new */
+ session->skb = skb_get(skb);
+ session->skcb = j1939_skb_to_cb(session->skb);
+
+ hrtimer_init(&session->txtimer, CLOCK_MONOTONIC,
+ HRTIMER_MODE_REL_SOFT);
+ session->txtimer.function = j1939_tp_txtimer;
+ hrtimer_init(&session->rxtimer, CLOCK_MONOTONIC,
+ HRTIMER_MODE_REL_SOFT);
+ session->rxtimer.function = j1939_tp_rxtimer;
+
+ return session;
+}
+
+static struct j1939_session *j1939_session_fresh_new(struct j1939_priv *priv, int size,
+ struct sk_buff *rel_skb,
+ pgn_t pgn)
+{
+ const struct j1939_sk_buff_cb *rel_skcb = j1939_skb_to_cb(rel_skb);
+ struct sk_buff *skb;
+ struct j1939_sk_buff_cb *skcb;
+ struct j1939_session *session;
+
+ skb = alloc_skb(size + sizeof(struct can_skb_priv), GFP_ATOMIC);
+ if (unlikely(!skb))
+ return NULL;
+
+ skb->dev = rel_skb->dev;
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = can_skb_prv(rel_skb)->ifindex;
+ skcb = j1939_skb_to_cb(skb);
+ memcpy(skcb, rel_skcb, sizeof(*skcb));
+ j1939_fix_cb(skcb);
+ skcb->addr.pgn = pgn;
+
+ session = j1939_session_new(priv, skb);
+ if (!session) {
+ kfree_skb(skb);
+ return NULL;
+ }
+
+ /* alloc data area */
+ skb_put(skb, size);
+ /* skb is recounted in j1939_session_new() */
+ WARN_ON_ONCE(skb_unref(skb));
+ return session;
+}
+
+static int j1939_session_insert(struct j1939_session *session)
+{
+ struct j1939_priv *priv = session->priv;
+ struct j1939_session *pending;
+ int ret = 0;
+
+ pending = j1939_session_get_by_skb(priv, j1939_sessionq(priv, session->extd),
+ session->skb, false);
+ if (pending) {
+ j1939_session_put(pending);
+ ret = -EAGAIN;
+ } else {
+ j1939_session_list_lock(priv);
+ j1939_session_list_add(session, j1939_sessionq(priv, session->extd));
+ j1939_session_list_unlock(priv);
+ }
+
+ return ret;
+}
+
+static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ struct j1939_session *session;
+ int len;
+ const u8 *dat;
+ pgn_t pgn;
+
+ dat = skb->data;
+ pgn = j1939_xtp_ctl_to_pgn(dat);
+
+ if (dat[0] == J1939_TP_CMD_RTS && j1939_cb_is_broadcast(skcb)) {
+ pr_alert("%s: rts without destination (%i %02x)\n", __func__,
+ can_skb_prv(skb)->ifindex, skcb->addr.sa);
+ return;
+ }
+
+ /* TODO: abort RTS when a similar
+ * TP is pending in the other direction
+ */
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, false);
+ if (session && !j1939_tp_im_transmitter(skb)) {
+ /* RTS on pending connection */
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+
+ if (pgn != session->skcb->addr.pgn && dat[0] != J1939_TP_CMD_BAM)
+ j1939_xtp_tx_abort(skb, extd, true, J1939_XTP_ABORT_BUSY, pgn);
+
+ goto out_session_put;
+ } else if (!session && j1939_tp_im_transmitter(skb)) {
+ pr_alert("%s: I should tx (%i %02x %02x)\n", __func__,
+ can_skb_prv(skb)->ifindex, skcb->addr.sa, skcb->addr.da);
+
+ return;
+ }
+
+ if (session && session->last_cmd != 0) {
+ /* we received a second rts on the same connection */
+ pr_alert("%s: connection exists (%i %02x %02x)\n", __func__,
+ can_skb_prv(skb)->ifindex, skcb->addr.sa, skcb->addr.da);
+
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+
+ goto out_session_put;
+ }
+
+ if (session) {
+ /* make sure 'sa' & 'da' are correct !
+ * They may be 'not filled in yet' for sending
+ * skb's, since they did not pass the Address Claim ever.
+ */
+ session->skcb->addr.sa = skcb->addr.sa;
+ session->skcb->addr.da = skcb->addr.da;
+ } else {
+ enum j1939_xtp_abort abort = J1939_XTP_ABORT_NO_ERROR;
+
+ if (extd) {
+ len = j1939_etp_ctl_to_size(dat);
+ if (len > J1939_MAX_ETP_PACKET_SIZE)
+ abort = J1939_XTP_ABORT_FAULT;
+ else if (j1939_tp_max_packet_size && (len > j1939_tp_max_packet_size))
+ abort = J1939_XTP_ABORT_RESOURCE;
+ else if (len <= J1939_MAX_TP_PACKET_SIZE)
+ abort = J1939_XTP_ABORT_FAULT;
+ } else {
+ len = j1939_tp_ctl_to_size(dat);
+ if (len > J1939_MAX_TP_PACKET_SIZE)
+ abort = J1939_XTP_ABORT_FAULT;
+ else if (j1939_tp_max_packet_size && (len > j1939_tp_max_packet_size))
+ abort = J1939_XTP_ABORT_RESOURCE;
+ }
+ if (abort) {
+ j1939_xtp_tx_abort(skb, extd, true, abort, pgn);
+ return;
+ }
+
+ session = j1939_session_fresh_new(priv, len, skb, pgn);
+ if (!session) {
+ j1939_xtp_tx_abort(skb, extd, true, J1939_XTP_ABORT_RESOURCE,
+ pgn);
+ return;
+ }
+ session->extd = extd;
+
+ /* initialize the control buffer: plain copy */
+ session->pkt.total = (len + 6) / 7;
+ session->pkt.block = 0xff;
+ if (!extd) {
+ if (dat[3] != session->pkt.total)
+ pr_alert("%s: strange total, %u != %u\n",
+ __func__, session->pkt.total,
+ dat[3]);
+ session->pkt.total = dat[3];
+ session->pkt.block = min(dat[3], dat[4]);
+ }
+
+ session->pkt.done = 0;
+ session->pkt.tx = 0;
+
+ WARN_ON_ONCE(j1939_session_insert(session));
+ }
+ session->last_cmd = dat[0];
+
+ j1939_tp_set_rxtimeout(session, 1250);
+
+ if (j1939_tp_im_receiver(session->skb)) {
+ if (extd || dat[0] != J1939_TP_CMD_BAM)
+ j1939_tp_schedule_txtimer(session, 0);
+ }
+
+ /* as soon as it's inserted, things can go fast
+ * protect against a long delay
+ * between spin_unlock & next statement
+ * so, only release here, at the end
+ */
+ out_session_put:
+ j1939_session_put(session);
+}
+
+static void j1939_xtp_rx_dpo(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ struct j1939_session *session;
+ pgn_t pgn;
+ const u8 *dat = skb->data;
+
+ pgn = j1939_xtp_ctl_to_pgn(dat);
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, false);
+ if (!session) {
+ pr_info("%s: %s\n", __func__, "no connection found");
+ return;
+ }
+
+ if (session->skcb->addr.pgn != pgn) {
+ pr_info("%s: different pgn\n", __func__);
+ j1939_xtp_tx_abort(skb, true, true, J1939_XTP_ABORT_BUSY, pgn);
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+ goto out_session_put;
+ }
+
+ /* transmitted without problems */
+ session->pkt.dpo = j1939_etp_ctl_to_packet(skb->data);
+ session->last_cmd = dat[0];
+ j1939_tp_set_rxtimeout(session, 750);
+ out_session_put:
+ j1939_session_put(session);
+}
+
+static void j1939_xtp_rx_dat(struct j1939_priv *priv, struct sk_buff *skb, bool extd)
+{
+ struct j1939_session *session;
+ const u8 *dat;
+ u8 *tpdat;
+ int offset;
+ int nbytes;
+ bool final = false;
+ bool do_cts_eoma = false;
+ int packet;
+
+ session = j1939_session_get_by_skb(priv, j1939_sessionq(priv, extd), skb, false);
+ if (!session) {
+ pr_info("%s:%s\n", __func__, "no connection found");
+ return;
+ }
+ dat = skb->data;
+ if (skb->len <= 1)
+ /* makes no sense */
+ goto out_session_cancel;
+
+ j1939_session_lock(session);
+
+ switch (session->last_cmd) {
+ case 0xff:
+ break;
+ case J1939_ETP_CMD_DPO:
+ if (extd)
+ break;
+ case J1939_TP_CMD_BAM:
+ case J1939_TP_CMD_CTS:
+ if (!extd)
+ break;
+ default:
+ pr_info("%s: last %02x\n", __func__,
+ session->last_cmd);
+ goto out_session_unlock;
+ }
+
+ packet = (dat[0] - 1 + session->pkt.dpo);
+ offset = packet * 7;
+ if (packet > session->pkt.total ||
+ (session->pkt.done + 1) > session->pkt.total) {
+ pr_info("%s: should have been completed\n", __func__);
+ goto out_session_unlock;
+ }
+ nbytes = session->skb->len - offset;
+ if (nbytes > 7)
+ nbytes = 7;
+ if (nbytes <= 0 || (nbytes + 1) > skb->len) {
+ pr_info("%s: nbytes %i, len %i\n", __func__, nbytes,
+ skb->len);
+ goto out_session_unlock;
+ }
+ tpdat = session->skb->data;
+ memcpy(&tpdat[offset], &dat[1], nbytes);
+ if (packet == session->pkt.done)
+ ++session->pkt.done;
+
+ if (!extd && j1939_cb_is_broadcast(session->skcb)) {
+ if (session->pkt.done >= session->pkt.total)
+ final = true;
+ } else {
+ /* never final, an EOMA must follow */
+ if (session->pkt.done >= session->pkt.last)
+ do_cts_eoma = true;
+ }
+ j1939_session_unlock(session);
+
+ if (final) {
+ j1939_session_completed(session);
+ } else if (do_cts_eoma) {
+ j1939_tp_set_rxtimeout(session, 1250);
+ if (j1939_tp_im_receiver(session->skb))
+ j1939_tp_schedule_txtimer(session, 0);
+ } else {
+ j1939_tp_set_rxtimeout(session, 250);
+ }
+ session->last_cmd = 0xff;
+ j1939_session_put(session);
+
+ return;
+
+ out_session_unlock:
+ /* unlock session (spinlock) before trying to send */
+ j1939_session_unlock(session);
+ out_session_cancel:
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_FAULT);
+ j1939_session_put(session);
+}
+
+static inline int j1939_tp_tx_initial(struct j1939_session *session)
+{
+ int ret;
+
+ ret = j1939_tp_txnext(session);
+ /* set nonblocking for further packets */
+ session->skcb->msg_flags |= MSG_DONTWAIT;
+
+ return ret;
+}
+
+/* j1939 main intf */
+int j1939_tp_send(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ struct j1939_session *session;
+ int ret;
+
+ if (skcb->addr.pgn == J1939_TP_PGN_DAT ||
+ skcb->addr.pgn == J1939_TP_PGN_CTL ||
+ skcb->addr.pgn == J1939_ETP_PGN_DAT ||
+ skcb->addr.pgn == J1939_ETP_PGN_CTL)
+ /* avoid conflict */
+ return -EDOM;
+ if ((skb->len > J1939_MAX_ETP_PACKET_SIZE) ||
+ (j1939_tp_max_packet_size && (skb->len > j1939_tp_max_packet_size)))
+ return -EMSGSIZE;
+ if (skb->len > J1939_MAX_TP_PACKET_SIZE && j1939_cb_is_broadcast(skcb))
+ return -EDESTADDRREQ;
+
+ /* fill in addresses from names */
+ ret = j1939_ac_fixup(priv, skb);
+ if (unlikely(ret))
+ return ret;
+
+ /* fix dst_flags, it may be used there soon */
+ if (j1939_address_is_unicast(skcb->addr.da) &&
+ priv->ents[skcb->addr.da].nusers)
+ skcb->dst_flags |= J1939_ECU_LOCAL;
+
+ /* src is always local, I'm sending ... */
+ skcb->src_flags |= J1939_ECU_LOCAL;
+
+ /* prepare new session */
+ session = j1939_session_new(priv, skb);
+ if (!session)
+ return -ENOMEM;
+
+ if (skb->len > J1939_MAX_TP_PACKET_SIZE)
+ session->extd = J1939_EXTENDED;
+ else
+ session->extd = J1939_REGULAR;
+ session->transmission = true;
+ session->pkt.total = (skb->len + 6) / 7;
+ session->pkt.block = session->extd ? 255 :
+ min(j1939_tp_block ?: 255, session->pkt.total);
+
+ if (j1939_cb_is_broadcast(session->skcb))
+ /* set the end-packet for broadcast */
+ session->pkt.last = session->pkt.total;
+
+ /* insert into queue, but avoid collision with pending session */
+ if (session->skcb->msg_flags & MSG_DONTWAIT)
+ ret = j1939_session_insert(session);
+ else
+ ret = wait_event_interruptible(priv->tp_wait,
+ j1939_session_insert(session) == 0);
+ if (ret < 0)
+ goto failed;
+
+ ret = j1939_tp_tx_initial(session);
+ if (ret)
+ goto failed;
+
+ /* transmission started */
+ j1939_session_put(session);
+ return 0;
+
+ failed:
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_NO_ERROR);
+ j1939_session_put(session);
+ return ret;
+}
+
+int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb)
+{
+ struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ const u8 *dat;
+
+ switch (skcb->addr.pgn) {
+ case J1939_ETP_PGN_DAT:
+ j1939_xtp_rx_dat(priv, skb, J1939_EXTENDED);
+ break;
+ case J1939_ETP_PGN_CTL:
+ if (skb->len < 8) {
+ j1939_xtp_rx_bad_message(priv, skb, J1939_EXTENDED);
+ break;
+ }
+ dat = skb->data;
+ switch (*dat) {
+ case J1939_ETP_CMD_RTS:
+ j1939_xtp_rx_rts(priv, skb, J1939_EXTENDED);
+ break;
+ case J1939_ETP_CMD_CTS:
+ j1939_xtp_rx_cts(priv, skb, J1939_EXTENDED);
+ break;
+ case J1939_ETP_CMD_DPO:
+ j1939_xtp_rx_dpo(priv, skb, J1939_EXTENDED);
+ break;
+ case J1939_ETP_CMD_EOMA:
+ j1939_xtp_rx_eoma(priv, skb, J1939_EXTENDED);
+ break;
+ case J1939_ETP_CMD_ABORT:
+ j1939_xtp_rx_abort(priv, skb, J1939_EXTENDED);
+ break;
+ default:
+ j1939_xtp_rx_bad_message(priv, skb, J1939_EXTENDED);
+ break;
+ }
+ break;
+ case J1939_TP_PGN_DAT:
+ j1939_xtp_rx_dat(priv, skb, J1939_REGULAR);
+ break;
+ case J1939_TP_PGN_CTL:
+ if (skb->len < 8) {
+ j1939_xtp_rx_bad_message(priv, skb, J1939_REGULAR);
+ break;
+ }
+ dat = skb->data;
+ switch (*dat) {
+ case J1939_TP_CMD_BAM:
+ case J1939_TP_CMD_RTS:
+ j1939_xtp_rx_rts(priv, skb, J1939_REGULAR);
+ break;
+ case J1939_TP_CMD_CTS:
+ j1939_xtp_rx_cts(priv, skb, J1939_REGULAR);
+ break;
+ case J1939_TP_CMD_EOMA:
+ j1939_xtp_rx_eoma(priv, skb, J1939_REGULAR);
+ break;
+ case J1939_TP_CMD_ABORT:
+ j1939_xtp_rx_abort(priv, skb, J1939_REGULAR);
+ break;
+ default:
+ j1939_xtp_rx_bad_message(priv, skb, J1939_REGULAR);
+ break;
+ }
+ break;
+ default:
+ return 0; /* no problem */
+ }
+ return 1; /* "I processed the message" */
+}
+
+int j1939_tp_rmdev_notifier(struct j1939_priv *priv)
+{
+ struct j1939_session *session, *saved;
+ struct net_device *ndev = priv->ndev;
+
+ j1939_session_list_lock(priv);
+ list_for_each_entry_safe(session, saved,
+ &priv->tp_sessionq, list) {
+ if (can_skb_prv(session->skb)->ifindex != ndev->ifindex)
+ continue;
+ j1939_session_timers_cancel(session);
+ }
+ list_for_each_entry_safe(session, saved,
+ &priv->tp_extsessionq, list) {
+ if (can_skb_prv(session->skb)->ifindex != ndev->ifindex)
+ continue;
+ j1939_session_timers_cancel(session);
+ }
+ j1939_session_list_unlock(priv);
+ return NOTIFY_DONE;
+}
+
+void j1939_tp_init(struct j1939_priv *priv)
+{
+ spin_lock_init(&priv->tp_session_list_lock);
+ INIT_LIST_HEAD(&priv->tp_sessionq);
+ INIT_LIST_HEAD(&priv->tp_extsessionq);
+ init_waitqueue_head(&priv->tp_wait);
+}
--
2.19.0
^ permalink raw reply related
* Re: [PATCH net-next 00/11] net: sched: cls_u32 Various improvements
From: Jamal Hadi Salim @ 2018-10-08 9:47 UTC (permalink / raw)
To: Al Viro, David Miller; +Cc: jiri, xiyou.wangcong, netdev
In-Reply-To: <20181008061112.GD32577@ZenIV.linux.org.uk>
On 2018-10-08 2:11 a.m., Al Viro wrote:
> On Sun, Oct 07, 2018 at 10:55:52PM -0700, David Miller wrote:
>> From: Al Viro <viro@ZenIV.linux.org.uk>
>> Date: Mon, 8 Oct 2018 06:45:15 +0100
>>
>>> Er... Both are due to missing in the very beginning of the series (well, on
>>> top of "net: sched: cls_u32: fix hnode refcounting") commit
>>
>> All dependencies like this must be explicitly stated.
>>
>> And in such situations you actually should wait for the dependency to
>> get into 'net', eventually get merged into 'net-next', and then you
>> can submit the stuff that depends upon it.
>>
>> Not the way this was done.
>
> Point (and this commit is simply missing - it's not that it went into
> net). FWIW, this was simply "this is what the breakage is caused by",
> not an attempt to amend the submission or anything like that...
>
My bad. I was wondering why it compiled for me. There is no dependency
on the single patch that went to net. I will submit an updated version.
cheers,
jamal
^ permalink raw reply
* Re: [PATCH net-next 02/11] net: sched: cls_u32: make sure that divisor is a power of 2
From: Jamal Hadi Salim @ 2018-10-08 9:49 UTC (permalink / raw)
To: Sergei Shtylyov, davem; +Cc: jiri, xiyou.wangcong, viro, netdev
In-Reply-To: <be3594f9-0640-c12c-e419-48c7da6b4804@cogentembedded.com>
On 2018-10-08 4:46 a.m., Sergei Shtylyov wrote:
> Hello!
>
> On 07.10.2018 19:38, Jamal Hadi Salim wrote:
>
>> From: Al Viro <viro@zeniv.linux.org.uk>
>>
>> Tested by modifying iproute2 to to allow
>
> One "to" is enough, no? :-)
>
Will fix in updated version.
cheers,
jamal
^ permalink raw reply
* Re: [PATCH v2 net-next 04/23] netlink: Add strict version of nlmsg_parse and nla_parse
From: Christian Brauner @ 2018-10-08 9:52 UTC (permalink / raw)
To: David Ahern; +Cc: netdev, davem, jbenc, stephen, David Ahern
In-Reply-To: <20181008031644.15989-5-dsahern@kernel.org>
On Sun, Oct 07, 2018 at 08:16:25PM -0700, David Ahern wrote:
> From: David Ahern <dsahern@gmail.com>
>
> nla_parse is currently lenient on message parsing, allowing type to be 0
> or greater than max expected and only logging a message
>
> "netlink: %d bytes leftover after parsing attributes in process `%s'."
>
> if the netlink message has unknown data at the end after parsing. What this
> could mean is that the header at the front of the attributes is actually
> wrong and the parsing is shifted from what is expected.
>
> Add a new strict version that actually fails with EINVAL if there are any
> bytes remaining after the parsing loop completes, if the atttrbitue type
> is 0 or greater than max expected.
>
> Signed-off-by: David Ahern <dsahern@gmail.com>
+1
Acked-by: Christian Brauner <christian@brauner.io>
> ---
> include/net/netlink.h | 17 +++++++++++++++++
> lib/nlattr.c | 48 ++++++++++++++++++++++++++++++++++++------------
> 2 files changed, 53 insertions(+), 12 deletions(-)
>
> diff --git a/include/net/netlink.h b/include/net/netlink.h
> index 9522a0bf1f3a..f1db8e594847 100644
> --- a/include/net/netlink.h
> +++ b/include/net/netlink.h
> @@ -373,6 +373,9 @@ int nla_validate(const struct nlattr *head, int len, int maxtype,
> int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
> int len, const struct nla_policy *policy,
> struct netlink_ext_ack *extack);
> +int nla_parse_strict(struct nlattr **tb, int maxtype, const struct nlattr *head,
> + int len, const struct nla_policy *policy,
> + struct netlink_ext_ack *extack);
> int nla_policy_len(const struct nla_policy *, int);
> struct nlattr *nla_find(const struct nlattr *head, int len, int attrtype);
> size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize);
> @@ -525,6 +528,20 @@ static inline int nlmsg_parse(const struct nlmsghdr *nlh, int hdrlen,
> nlmsg_attrlen(nlh, hdrlen), policy, extack);
> }
>
> +static inline int nlmsg_parse_strict(const struct nlmsghdr *nlh, int hdrlen,
> + struct nlattr *tb[], int maxtype,
> + const struct nla_policy *policy,
> + struct netlink_ext_ack *extack)
> +{
> + if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen)) {
> + NL_SET_ERR_MSG(extack, "Invalid header length");
> + return -EINVAL;
> + }
> +
> + return nla_parse_strict(tb, maxtype, nlmsg_attrdata(nlh, hdrlen),
> + nlmsg_attrlen(nlh, hdrlen), policy, extack);
> +}
> +
> /**
> * nlmsg_find_attr - find a specific attribute in a netlink message
> * @nlh: netlink message header
> diff --git a/lib/nlattr.c b/lib/nlattr.c
> index 1e900bb414ef..d26de6156b97 100644
> --- a/lib/nlattr.c
> +++ b/lib/nlattr.c
> @@ -391,9 +391,10 @@ EXPORT_SYMBOL(nla_policy_len);
> *
> * Returns 0 on success or a negative error code.
> */
> -int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
> - int len, const struct nla_policy *policy,
> - struct netlink_ext_ack *extack)
> +static int __nla_parse(struct nlattr **tb, int maxtype,
> + const struct nlattr *head, int len,
> + bool strict, const struct nla_policy *policy,
> + struct netlink_ext_ack *extack)
> {
> const struct nlattr *nla;
> int rem;
> @@ -403,27 +404,50 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
> nla_for_each_attr(nla, head, len, rem) {
> u16 type = nla_type(nla);
>
> - if (type > 0 && type <= maxtype) {
> - if (policy) {
> - int err = validate_nla(nla, maxtype, policy,
> - extack);
> -
> - if (err < 0)
> - return err;
> + if (type == 0 || type > maxtype) {
> + if (strict) {
> + NL_SET_ERR_MSG(extack, "Unknown attribute type");
> + return -EINVAL;
> }
> + continue;
> + }
> + if (policy) {
> + int err = validate_nla(nla, maxtype, policy, extack);
>
> - tb[type] = (struct nlattr *)nla;
> + if (err < 0)
> + return err;
> }
> +
> + tb[type] = (struct nlattr *)nla;
> }
>
> - if (unlikely(rem > 0))
> + if (unlikely(rem > 0)) {
> pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
> rem, current->comm);
> + NL_SET_ERR_MSG(extack, "bytes leftover after parsing attributes");
> + if (strict)
> + return -EINVAL;
> + }
>
> return 0;
> }
> +
> +int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
> + int len, const struct nla_policy *policy,
> + struct netlink_ext_ack *extack)
> +{
> + return __nla_parse(tb, maxtype, head, len, false, policy, extack);
> +}
> EXPORT_SYMBOL(nla_parse);
>
> +int nla_parse_strict(struct nlattr **tb, int maxtype, const struct nlattr *head,
> + int len, const struct nla_policy *policy,
> + struct netlink_ext_ack *extack)
> +{
> + return __nla_parse(tb, maxtype, head, len, true, policy, extack);
> +}
> +EXPORT_SYMBOL(nla_parse_strict);
> +
> /**
> * nla_find - Find a specific attribute in a stream of attributes
> * @head: head of attribute stream
> --
> 2.11.0
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox