xref: /linux/net/can/bcm.c (revision f3a8b6645dc2e60d11f20c1c23afd964ff4e55ae)
1 /*
2  * bcm.c - Broadcast Manager to filter/send (cyclic) CAN content
3  *
4  * Copyright (c) 2002-2016 Volkswagen Group Electronic Research
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of Volkswagen nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * Alternatively, provided that this notice is retained in full, this
20  * software may be distributed under the terms of the GNU General
21  * Public License ("GPL") version 2, in which case the provisions of the
22  * GPL apply INSTEAD OF those given above.
23  *
24  * The provided data structures and external interfaces from this code
25  * are not restricted to be used by modules with a GPL compatible license.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
38  * DAMAGE.
39  *
40  */
41 
42 #include <linux/module.h>
43 #include <linux/init.h>
44 #include <linux/interrupt.h>
45 #include <linux/hrtimer.h>
46 #include <linux/list.h>
47 #include <linux/proc_fs.h>
48 #include <linux/seq_file.h>
49 #include <linux/uio.h>
50 #include <linux/net.h>
51 #include <linux/netdevice.h>
52 #include <linux/socket.h>
53 #include <linux/if_arp.h>
54 #include <linux/skbuff.h>
55 #include <linux/can.h>
56 #include <linux/can/core.h>
57 #include <linux/can/skb.h>
58 #include <linux/can/bcm.h>
59 #include <linux/slab.h>
60 #include <net/sock.h>
61 #include <net/net_namespace.h>
62 
63 /*
64  * To send multiple CAN frame content within TX_SETUP or to filter
65  * CAN messages with multiplex index within RX_SETUP, the number of
66  * different filters is limited to 256 due to the one byte index value.
67  */
68 #define MAX_NFRAMES 256
69 
70 /* use of last_frames[index].flags */
71 #define RX_RECV    0x40 /* received data for this element */
72 #define RX_THR     0x80 /* element not been sent due to throttle feature */
73 #define BCM_CAN_FLAGS_MASK 0x3F /* to clean private flags after usage */
74 
75 /* get best masking value for can_rx_register() for a given single can_id */
76 #define REGMASK(id) ((id & CAN_EFF_FLAG) ? \
77 		     (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
78 		     (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
79 
80 #define CAN_BCM_VERSION "20160617"
81 
82 MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
83 MODULE_LICENSE("Dual BSD/GPL");
84 MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
85 MODULE_ALIAS("can-proto-2");
86 
87 /*
88  * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
89  * 64 bit aligned so the offset has to be multiples of 8 which is ensured
90  * by the only callers in bcm_rx_cmp_to_index() bcm_rx_handler().
91  */
92 static inline u64 get_u64(const struct canfd_frame *cp, int offset)
93 {
94 	return *(u64 *)(cp->data + offset);
95 }
96 
97 struct bcm_op {
98 	struct list_head list;
99 	int ifindex;
100 	canid_t can_id;
101 	u32 flags;
102 	unsigned long frames_abs, frames_filtered;
103 	struct bcm_timeval ival1, ival2;
104 	struct hrtimer timer, thrtimer;
105 	struct tasklet_struct tsklet, thrtsklet;
106 	ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
107 	int rx_ifindex;
108 	int cfsiz;
109 	u32 count;
110 	u32 nframes;
111 	u32 currframe;
112 	struct canfd_frame *frames;
113 	struct canfd_frame *last_frames;
114 	struct canfd_frame sframe;
115 	struct canfd_frame last_sframe;
116 	struct sock *sk;
117 	struct net_device *rx_reg_dev;
118 };
119 
120 static struct proc_dir_entry *proc_dir;
121 
122 struct bcm_sock {
123 	struct sock sk;
124 	int bound;
125 	int ifindex;
126 	struct notifier_block notifier;
127 	struct list_head rx_ops;
128 	struct list_head tx_ops;
129 	unsigned long dropped_usr_msgs;
130 	struct proc_dir_entry *bcm_proc_read;
131 	char procname [32]; /* inode number in decimal with \0 */
132 };
133 
134 static inline struct bcm_sock *bcm_sk(const struct sock *sk)
135 {
136 	return (struct bcm_sock *)sk;
137 }
138 
139 static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
140 {
141 	return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
142 }
143 
144 #define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
145 #define OPSIZ sizeof(struct bcm_op)
146 #define MHSIZ sizeof(struct bcm_msg_head)
147 
148 /*
149  * procfs functions
150  */
151 static char *bcm_proc_getifname(char *result, int ifindex)
152 {
153 	struct net_device *dev;
154 
155 	if (!ifindex)
156 		return "any";
157 
158 	rcu_read_lock();
159 	dev = dev_get_by_index_rcu(&init_net, ifindex);
160 	if (dev)
161 		strcpy(result, dev->name);
162 	else
163 		strcpy(result, "???");
164 	rcu_read_unlock();
165 
166 	return result;
167 }
168 
169 static int bcm_proc_show(struct seq_file *m, void *v)
170 {
171 	char ifname[IFNAMSIZ];
172 	struct sock *sk = (struct sock *)m->private;
173 	struct bcm_sock *bo = bcm_sk(sk);
174 	struct bcm_op *op;
175 
176 	seq_printf(m, ">>> socket %pK", sk->sk_socket);
177 	seq_printf(m, " / sk %pK", sk);
178 	seq_printf(m, " / bo %pK", bo);
179 	seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
180 	seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
181 	seq_printf(m, " <<<\n");
182 
183 	list_for_each_entry(op, &bo->rx_ops, list) {
184 
185 		unsigned long reduction;
186 
187 		/* print only active entries & prevent division by zero */
188 		if (!op->frames_abs)
189 			continue;
190 
191 		seq_printf(m, "rx_op: %03X %-5s ", op->can_id,
192 			   bcm_proc_getifname(ifname, op->ifindex));
193 
194 		if (op->flags & CAN_FD_FRAME)
195 			seq_printf(m, "(%u)", op->nframes);
196 		else
197 			seq_printf(m, "[%u]", op->nframes);
198 
199 		seq_printf(m, "%c ", (op->flags & RX_CHECK_DLC) ? 'd' : ' ');
200 
201 		if (op->kt_ival1.tv64)
202 			seq_printf(m, "timeo=%lld ",
203 				   (long long)ktime_to_us(op->kt_ival1));
204 
205 		if (op->kt_ival2.tv64)
206 			seq_printf(m, "thr=%lld ",
207 				   (long long)ktime_to_us(op->kt_ival2));
208 
209 		seq_printf(m, "# recv %ld (%ld) => reduction: ",
210 			   op->frames_filtered, op->frames_abs);
211 
212 		reduction = 100 - (op->frames_filtered * 100) / op->frames_abs;
213 
214 		seq_printf(m, "%s%ld%%\n",
215 			   (reduction == 100) ? "near " : "", reduction);
216 	}
217 
218 	list_for_each_entry(op, &bo->tx_ops, list) {
219 
220 		seq_printf(m, "tx_op: %03X %s ", op->can_id,
221 			   bcm_proc_getifname(ifname, op->ifindex));
222 
223 		if (op->flags & CAN_FD_FRAME)
224 			seq_printf(m, "(%u) ", op->nframes);
225 		else
226 			seq_printf(m, "[%u] ", op->nframes);
227 
228 		if (op->kt_ival1.tv64)
229 			seq_printf(m, "t1=%lld ",
230 				   (long long)ktime_to_us(op->kt_ival1));
231 
232 		if (op->kt_ival2.tv64)
233 			seq_printf(m, "t2=%lld ",
234 				   (long long)ktime_to_us(op->kt_ival2));
235 
236 		seq_printf(m, "# sent %ld\n", op->frames_abs);
237 	}
238 	seq_putc(m, '\n');
239 	return 0;
240 }
241 
242 static int bcm_proc_open(struct inode *inode, struct file *file)
243 {
244 	return single_open(file, bcm_proc_show, PDE_DATA(inode));
245 }
246 
247 static const struct file_operations bcm_proc_fops = {
248 	.owner		= THIS_MODULE,
249 	.open		= bcm_proc_open,
250 	.read		= seq_read,
251 	.llseek		= seq_lseek,
252 	.release	= single_release,
253 };
254 
255 /*
256  * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
257  *              of the given bcm tx op
258  */
259 static void bcm_can_tx(struct bcm_op *op)
260 {
261 	struct sk_buff *skb;
262 	struct net_device *dev;
263 	struct canfd_frame *cf = op->frames + op->cfsiz * op->currframe;
264 
265 	/* no target device? => exit */
266 	if (!op->ifindex)
267 		return;
268 
269 	dev = dev_get_by_index(&init_net, op->ifindex);
270 	if (!dev) {
271 		/* RFC: should this bcm_op remove itself here? */
272 		return;
273 	}
274 
275 	skb = alloc_skb(op->cfsiz + sizeof(struct can_skb_priv), gfp_any());
276 	if (!skb)
277 		goto out;
278 
279 	can_skb_reserve(skb);
280 	can_skb_prv(skb)->ifindex = dev->ifindex;
281 	can_skb_prv(skb)->skbcnt = 0;
282 
283 	memcpy(skb_put(skb, op->cfsiz), cf, op->cfsiz);
284 
285 	/* send with loopback */
286 	skb->dev = dev;
287 	can_skb_set_owner(skb, op->sk);
288 	can_send(skb, 1);
289 
290 	/* update statistics */
291 	op->currframe++;
292 	op->frames_abs++;
293 
294 	/* reached last frame? */
295 	if (op->currframe >= op->nframes)
296 		op->currframe = 0;
297 out:
298 	dev_put(dev);
299 }
300 
301 /*
302  * bcm_send_to_user - send a BCM message to the userspace
303  *                    (consisting of bcm_msg_head + x CAN frames)
304  */
305 static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
306 			     struct canfd_frame *frames, int has_timestamp)
307 {
308 	struct sk_buff *skb;
309 	struct canfd_frame *firstframe;
310 	struct sockaddr_can *addr;
311 	struct sock *sk = op->sk;
312 	unsigned int datalen = head->nframes * op->cfsiz;
313 	int err;
314 
315 	skb = alloc_skb(sizeof(*head) + datalen, gfp_any());
316 	if (!skb)
317 		return;
318 
319 	memcpy(skb_put(skb, sizeof(*head)), head, sizeof(*head));
320 
321 	if (head->nframes) {
322 		/* CAN frames starting here */
323 		firstframe = (struct canfd_frame *)skb_tail_pointer(skb);
324 
325 		memcpy(skb_put(skb, datalen), frames, datalen);
326 
327 		/*
328 		 * the BCM uses the flags-element of the canfd_frame
329 		 * structure for internal purposes. This is only
330 		 * relevant for updates that are generated by the
331 		 * BCM, where nframes is 1
332 		 */
333 		if (head->nframes == 1)
334 			firstframe->flags &= BCM_CAN_FLAGS_MASK;
335 	}
336 
337 	if (has_timestamp) {
338 		/* restore rx timestamp */
339 		skb->tstamp = op->rx_stamp;
340 	}
341 
342 	/*
343 	 *  Put the datagram to the queue so that bcm_recvmsg() can
344 	 *  get it from there.  We need to pass the interface index to
345 	 *  bcm_recvmsg().  We pass a whole struct sockaddr_can in skb->cb
346 	 *  containing the interface index.
347 	 */
348 
349 	sock_skb_cb_check_size(sizeof(struct sockaddr_can));
350 	addr = (struct sockaddr_can *)skb->cb;
351 	memset(addr, 0, sizeof(*addr));
352 	addr->can_family  = AF_CAN;
353 	addr->can_ifindex = op->rx_ifindex;
354 
355 	err = sock_queue_rcv_skb(sk, skb);
356 	if (err < 0) {
357 		struct bcm_sock *bo = bcm_sk(sk);
358 
359 		kfree_skb(skb);
360 		/* don't care about overflows in this statistic */
361 		bo->dropped_usr_msgs++;
362 	}
363 }
364 
365 static void bcm_tx_start_timer(struct bcm_op *op)
366 {
367 	if (op->kt_ival1.tv64 && op->count)
368 		hrtimer_start(&op->timer,
369 			      ktime_add(ktime_get(), op->kt_ival1),
370 			      HRTIMER_MODE_ABS);
371 	else if (op->kt_ival2.tv64)
372 		hrtimer_start(&op->timer,
373 			      ktime_add(ktime_get(), op->kt_ival2),
374 			      HRTIMER_MODE_ABS);
375 }
376 
377 static void bcm_tx_timeout_tsklet(unsigned long data)
378 {
379 	struct bcm_op *op = (struct bcm_op *)data;
380 	struct bcm_msg_head msg_head;
381 
382 	if (op->kt_ival1.tv64 && (op->count > 0)) {
383 
384 		op->count--;
385 		if (!op->count && (op->flags & TX_COUNTEVT)) {
386 
387 			/* create notification to user */
388 			msg_head.opcode  = TX_EXPIRED;
389 			msg_head.flags   = op->flags;
390 			msg_head.count   = op->count;
391 			msg_head.ival1   = op->ival1;
392 			msg_head.ival2   = op->ival2;
393 			msg_head.can_id  = op->can_id;
394 			msg_head.nframes = 0;
395 
396 			bcm_send_to_user(op, &msg_head, NULL, 0);
397 		}
398 		bcm_can_tx(op);
399 
400 	} else if (op->kt_ival2.tv64)
401 		bcm_can_tx(op);
402 
403 	bcm_tx_start_timer(op);
404 }
405 
406 /*
407  * bcm_tx_timeout_handler - performs cyclic CAN frame transmissions
408  */
409 static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
410 {
411 	struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
412 
413 	tasklet_schedule(&op->tsklet);
414 
415 	return HRTIMER_NORESTART;
416 }
417 
418 /*
419  * bcm_rx_changed - create a RX_CHANGED notification due to changed content
420  */
421 static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data)
422 {
423 	struct bcm_msg_head head;
424 
425 	/* update statistics */
426 	op->frames_filtered++;
427 
428 	/* prevent statistics overflow */
429 	if (op->frames_filtered > ULONG_MAX/100)
430 		op->frames_filtered = op->frames_abs = 0;
431 
432 	/* this element is not throttled anymore */
433 	data->flags &= (BCM_CAN_FLAGS_MASK|RX_RECV);
434 
435 	head.opcode  = RX_CHANGED;
436 	head.flags   = op->flags;
437 	head.count   = op->count;
438 	head.ival1   = op->ival1;
439 	head.ival2   = op->ival2;
440 	head.can_id  = op->can_id;
441 	head.nframes = 1;
442 
443 	bcm_send_to_user(op, &head, data, 1);
444 }
445 
446 /*
447  * bcm_rx_update_and_send - process a detected relevant receive content change
448  *                          1. update the last received data
449  *                          2. send a notification to the user (if possible)
450  */
451 static void bcm_rx_update_and_send(struct bcm_op *op,
452 				   struct canfd_frame *lastdata,
453 				   const struct canfd_frame *rxdata)
454 {
455 	memcpy(lastdata, rxdata, op->cfsiz);
456 
457 	/* mark as used and throttled by default */
458 	lastdata->flags |= (RX_RECV|RX_THR);
459 
460 	/* throttling mode inactive ? */
461 	if (!op->kt_ival2.tv64) {
462 		/* send RX_CHANGED to the user immediately */
463 		bcm_rx_changed(op, lastdata);
464 		return;
465 	}
466 
467 	/* with active throttling timer we are just done here */
468 	if (hrtimer_active(&op->thrtimer))
469 		return;
470 
471 	/* first reception with enabled throttling mode */
472 	if (!op->kt_lastmsg.tv64)
473 		goto rx_changed_settime;
474 
475 	/* got a second frame inside a potential throttle period? */
476 	if (ktime_us_delta(ktime_get(), op->kt_lastmsg) <
477 	    ktime_to_us(op->kt_ival2)) {
478 		/* do not send the saved data - only start throttle timer */
479 		hrtimer_start(&op->thrtimer,
480 			      ktime_add(op->kt_lastmsg, op->kt_ival2),
481 			      HRTIMER_MODE_ABS);
482 		return;
483 	}
484 
485 	/* the gap was that big, that throttling was not needed here */
486 rx_changed_settime:
487 	bcm_rx_changed(op, lastdata);
488 	op->kt_lastmsg = ktime_get();
489 }
490 
491 /*
492  * bcm_rx_cmp_to_index - (bit)compares the currently received data to formerly
493  *                       received data stored in op->last_frames[]
494  */
495 static void bcm_rx_cmp_to_index(struct bcm_op *op, unsigned int index,
496 				const struct canfd_frame *rxdata)
497 {
498 	struct canfd_frame *cf = op->frames + op->cfsiz * index;
499 	struct canfd_frame *lcf = op->last_frames + op->cfsiz * index;
500 	int i;
501 
502 	/*
503 	 * no one uses the MSBs of flags for comparison,
504 	 * so we use it here to detect the first time of reception
505 	 */
506 
507 	if (!(lcf->flags & RX_RECV)) {
508 		/* received data for the first time => send update to user */
509 		bcm_rx_update_and_send(op, lcf, rxdata);
510 		return;
511 	}
512 
513 	/* do a real check in CAN frame data section */
514 	for (i = 0; i < rxdata->len; i += 8) {
515 		if ((get_u64(cf, i) & get_u64(rxdata, i)) !=
516 		    (get_u64(cf, i) & get_u64(lcf, i))) {
517 			bcm_rx_update_and_send(op, lcf, rxdata);
518 			return;
519 		}
520 	}
521 
522 	if (op->flags & RX_CHECK_DLC) {
523 		/* do a real check in CAN frame length */
524 		if (rxdata->len != lcf->len) {
525 			bcm_rx_update_and_send(op, lcf, rxdata);
526 			return;
527 		}
528 	}
529 }
530 
531 /*
532  * bcm_rx_starttimer - enable timeout monitoring for CAN frame reception
533  */
534 static void bcm_rx_starttimer(struct bcm_op *op)
535 {
536 	if (op->flags & RX_NO_AUTOTIMER)
537 		return;
538 
539 	if (op->kt_ival1.tv64)
540 		hrtimer_start(&op->timer, op->kt_ival1, HRTIMER_MODE_REL);
541 }
542 
543 static void bcm_rx_timeout_tsklet(unsigned long data)
544 {
545 	struct bcm_op *op = (struct bcm_op *)data;
546 	struct bcm_msg_head msg_head;
547 
548 	/* create notification to user */
549 	msg_head.opcode  = RX_TIMEOUT;
550 	msg_head.flags   = op->flags;
551 	msg_head.count   = op->count;
552 	msg_head.ival1   = op->ival1;
553 	msg_head.ival2   = op->ival2;
554 	msg_head.can_id  = op->can_id;
555 	msg_head.nframes = 0;
556 
557 	bcm_send_to_user(op, &msg_head, NULL, 0);
558 }
559 
560 /*
561  * bcm_rx_timeout_handler - when the (cyclic) CAN frame reception timed out
562  */
563 static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
564 {
565 	struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
566 
567 	/* schedule before NET_RX_SOFTIRQ */
568 	tasklet_hi_schedule(&op->tsklet);
569 
570 	/* no restart of the timer is done here! */
571 
572 	/* if user wants to be informed, when cyclic CAN-Messages come back */
573 	if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) {
574 		/* clear received CAN frames to indicate 'nothing received' */
575 		memset(op->last_frames, 0, op->nframes * op->cfsiz);
576 	}
577 
578 	return HRTIMER_NORESTART;
579 }
580 
581 /*
582  * bcm_rx_do_flush - helper for bcm_rx_thr_flush
583  */
584 static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
585 				  unsigned int index)
586 {
587 	struct canfd_frame *lcf = op->last_frames + op->cfsiz * index;
588 
589 	if ((op->last_frames) && (lcf->flags & RX_THR)) {
590 		if (update)
591 			bcm_rx_changed(op, lcf);
592 		return 1;
593 	}
594 	return 0;
595 }
596 
597 /*
598  * bcm_rx_thr_flush - Check for throttled data and send it to the userspace
599  *
600  * update == 0 : just check if throttled data is available  (any irq context)
601  * update == 1 : check and send throttled data to userspace (soft_irq context)
602  */
603 static int bcm_rx_thr_flush(struct bcm_op *op, int update)
604 {
605 	int updated = 0;
606 
607 	if (op->nframes > 1) {
608 		unsigned int i;
609 
610 		/* for MUX filter we start at index 1 */
611 		for (i = 1; i < op->nframes; i++)
612 			updated += bcm_rx_do_flush(op, update, i);
613 
614 	} else {
615 		/* for RX_FILTER_ID and simple filter */
616 		updated += bcm_rx_do_flush(op, update, 0);
617 	}
618 
619 	return updated;
620 }
621 
622 static void bcm_rx_thr_tsklet(unsigned long data)
623 {
624 	struct bcm_op *op = (struct bcm_op *)data;
625 
626 	/* push the changed data to the userspace */
627 	bcm_rx_thr_flush(op, 1);
628 }
629 
630 /*
631  * bcm_rx_thr_handler - the time for blocked content updates is over now:
632  *                      Check for throttled data and send it to the userspace
633  */
634 static enum hrtimer_restart bcm_rx_thr_handler(struct hrtimer *hrtimer)
635 {
636 	struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer);
637 
638 	tasklet_schedule(&op->thrtsklet);
639 
640 	if (bcm_rx_thr_flush(op, 0)) {
641 		hrtimer_forward(hrtimer, ktime_get(), op->kt_ival2);
642 		return HRTIMER_RESTART;
643 	} else {
644 		/* rearm throttle handling */
645 		op->kt_lastmsg = ktime_set(0, 0);
646 		return HRTIMER_NORESTART;
647 	}
648 }
649 
650 /*
651  * bcm_rx_handler - handle a CAN frame reception
652  */
653 static void bcm_rx_handler(struct sk_buff *skb, void *data)
654 {
655 	struct bcm_op *op = (struct bcm_op *)data;
656 	const struct canfd_frame *rxframe = (struct canfd_frame *)skb->data;
657 	unsigned int i;
658 
659 	if (op->can_id != rxframe->can_id)
660 		return;
661 
662 	/* make sure to handle the correct frame type (CAN / CAN FD) */
663 	if (skb->len != op->cfsiz)
664 		return;
665 
666 	/* disable timeout */
667 	hrtimer_cancel(&op->timer);
668 
669 	/* save rx timestamp */
670 	op->rx_stamp = skb->tstamp;
671 	/* save originator for recvfrom() */
672 	op->rx_ifindex = skb->dev->ifindex;
673 	/* update statistics */
674 	op->frames_abs++;
675 
676 	if (op->flags & RX_RTR_FRAME) {
677 		/* send reply for RTR-request (placed in op->frames[0]) */
678 		bcm_can_tx(op);
679 		return;
680 	}
681 
682 	if (op->flags & RX_FILTER_ID) {
683 		/* the easiest case */
684 		bcm_rx_update_and_send(op, &op->last_frames[0], rxframe);
685 		goto rx_starttimer;
686 	}
687 
688 	if (op->nframes == 1) {
689 		/* simple compare with index 0 */
690 		bcm_rx_cmp_to_index(op, 0, rxframe);
691 		goto rx_starttimer;
692 	}
693 
694 	if (op->nframes > 1) {
695 		/*
696 		 * multiplex compare
697 		 *
698 		 * find the first multiplex mask that fits.
699 		 * Remark: The MUX-mask is stored in index 0 - but only the
700 		 * first 64 bits of the frame data[] are relevant (CAN FD)
701 		 */
702 
703 		for (i = 1; i < op->nframes; i++) {
704 			if ((get_u64(op->frames, 0) & get_u64(rxframe, 0)) ==
705 			    (get_u64(op->frames, 0) &
706 			     get_u64(op->frames + op->cfsiz * i, 0))) {
707 				bcm_rx_cmp_to_index(op, i, rxframe);
708 				break;
709 			}
710 		}
711 	}
712 
713 rx_starttimer:
714 	bcm_rx_starttimer(op);
715 }
716 
717 /*
718  * helpers for bcm_op handling: find & delete bcm [rx|tx] op elements
719  */
720 static struct bcm_op *bcm_find_op(struct list_head *ops,
721 				  struct bcm_msg_head *mh, int ifindex)
722 {
723 	struct bcm_op *op;
724 
725 	list_for_each_entry(op, ops, list) {
726 		if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
727 		    (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME))
728 			return op;
729 	}
730 
731 	return NULL;
732 }
733 
734 static void bcm_remove_op(struct bcm_op *op)
735 {
736 	hrtimer_cancel(&op->timer);
737 	hrtimer_cancel(&op->thrtimer);
738 
739 	if (op->tsklet.func)
740 		tasklet_kill(&op->tsklet);
741 
742 	if (op->thrtsklet.func)
743 		tasklet_kill(&op->thrtsklet);
744 
745 	if ((op->frames) && (op->frames != &op->sframe))
746 		kfree(op->frames);
747 
748 	if ((op->last_frames) && (op->last_frames != &op->last_sframe))
749 		kfree(op->last_frames);
750 
751 	kfree(op);
752 }
753 
754 static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)
755 {
756 	if (op->rx_reg_dev == dev) {
757 		can_rx_unregister(dev, op->can_id, REGMASK(op->can_id),
758 				  bcm_rx_handler, op);
759 
760 		/* mark as removed subscription */
761 		op->rx_reg_dev = NULL;
762 	} else
763 		printk(KERN_ERR "can-bcm: bcm_rx_unreg: registered device "
764 		       "mismatch %p %p\n", op->rx_reg_dev, dev);
765 }
766 
767 /*
768  * bcm_delete_rx_op - find and remove a rx op (returns number of removed ops)
769  */
770 static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
771 			    int ifindex)
772 {
773 	struct bcm_op *op, *n;
774 
775 	list_for_each_entry_safe(op, n, ops, list) {
776 		if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
777 		    (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) {
778 
779 			/*
780 			 * Don't care if we're bound or not (due to netdev
781 			 * problems) can_rx_unregister() is always a save
782 			 * thing to do here.
783 			 */
784 			if (op->ifindex) {
785 				/*
786 				 * Only remove subscriptions that had not
787 				 * been removed due to NETDEV_UNREGISTER
788 				 * in bcm_notifier()
789 				 */
790 				if (op->rx_reg_dev) {
791 					struct net_device *dev;
792 
793 					dev = dev_get_by_index(&init_net,
794 							       op->ifindex);
795 					if (dev) {
796 						bcm_rx_unreg(dev, op);
797 						dev_put(dev);
798 					}
799 				}
800 			} else
801 				can_rx_unregister(NULL, op->can_id,
802 						  REGMASK(op->can_id),
803 						  bcm_rx_handler, op);
804 
805 			list_del(&op->list);
806 			bcm_remove_op(op);
807 			return 1; /* done */
808 		}
809 	}
810 
811 	return 0; /* not found */
812 }
813 
814 /*
815  * bcm_delete_tx_op - find and remove a tx op (returns number of removed ops)
816  */
817 static int bcm_delete_tx_op(struct list_head *ops, struct bcm_msg_head *mh,
818 			    int ifindex)
819 {
820 	struct bcm_op *op, *n;
821 
822 	list_for_each_entry_safe(op, n, ops, list) {
823 		if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
824 		    (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) {
825 			list_del(&op->list);
826 			bcm_remove_op(op);
827 			return 1; /* done */
828 		}
829 	}
830 
831 	return 0; /* not found */
832 }
833 
834 /*
835  * bcm_read_op - read out a bcm_op and send it to the user (for bcm_sendmsg)
836  */
837 static int bcm_read_op(struct list_head *ops, struct bcm_msg_head *msg_head,
838 		       int ifindex)
839 {
840 	struct bcm_op *op = bcm_find_op(ops, msg_head, ifindex);
841 
842 	if (!op)
843 		return -EINVAL;
844 
845 	/* put current values into msg_head */
846 	msg_head->flags   = op->flags;
847 	msg_head->count   = op->count;
848 	msg_head->ival1   = op->ival1;
849 	msg_head->ival2   = op->ival2;
850 	msg_head->nframes = op->nframes;
851 
852 	bcm_send_to_user(op, msg_head, op->frames, 0);
853 
854 	return MHSIZ;
855 }
856 
857 /*
858  * bcm_tx_setup - create or update a bcm tx op (for bcm_sendmsg)
859  */
860 static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
861 			int ifindex, struct sock *sk)
862 {
863 	struct bcm_sock *bo = bcm_sk(sk);
864 	struct bcm_op *op;
865 	struct canfd_frame *cf;
866 	unsigned int i;
867 	int err;
868 
869 	/* we need a real device to send frames */
870 	if (!ifindex)
871 		return -ENODEV;
872 
873 	/* check nframes boundaries - we need at least one CAN frame */
874 	if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
875 		return -EINVAL;
876 
877 	/* check the given can_id */
878 	op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
879 	if (op) {
880 		/* update existing BCM operation */
881 
882 		/*
883 		 * Do we need more space for the CAN frames than currently
884 		 * allocated? -> This is a _really_ unusual use-case and
885 		 * therefore (complexity / locking) it is not supported.
886 		 */
887 		if (msg_head->nframes > op->nframes)
888 			return -E2BIG;
889 
890 		/* update CAN frames content */
891 		for (i = 0; i < msg_head->nframes; i++) {
892 
893 			cf = op->frames + op->cfsiz * i;
894 			err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
895 
896 			if (op->flags & CAN_FD_FRAME) {
897 				if (cf->len > 64)
898 					err = -EINVAL;
899 			} else {
900 				if (cf->len > 8)
901 					err = -EINVAL;
902 			}
903 
904 			if (err < 0)
905 				return err;
906 
907 			if (msg_head->flags & TX_CP_CAN_ID) {
908 				/* copy can_id into frame */
909 				cf->can_id = msg_head->can_id;
910 			}
911 		}
912 		op->flags = msg_head->flags;
913 
914 	} else {
915 		/* insert new BCM operation for the given can_id */
916 
917 		op = kzalloc(OPSIZ, GFP_KERNEL);
918 		if (!op)
919 			return -ENOMEM;
920 
921 		op->can_id = msg_head->can_id;
922 		op->cfsiz = CFSIZ(msg_head->flags);
923 		op->flags = msg_head->flags;
924 
925 		/* create array for CAN frames and copy the data */
926 		if (msg_head->nframes > 1) {
927 			op->frames = kmalloc(msg_head->nframes * op->cfsiz,
928 					     GFP_KERNEL);
929 			if (!op->frames) {
930 				kfree(op);
931 				return -ENOMEM;
932 			}
933 		} else
934 			op->frames = &op->sframe;
935 
936 		for (i = 0; i < msg_head->nframes; i++) {
937 
938 			cf = op->frames + op->cfsiz * i;
939 			err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
940 
941 			if (op->flags & CAN_FD_FRAME) {
942 				if (cf->len > 64)
943 					err = -EINVAL;
944 			} else {
945 				if (cf->len > 8)
946 					err = -EINVAL;
947 			}
948 
949 			if (err < 0) {
950 				if (op->frames != &op->sframe)
951 					kfree(op->frames);
952 				kfree(op);
953 				return err;
954 			}
955 
956 			if (msg_head->flags & TX_CP_CAN_ID) {
957 				/* copy can_id into frame */
958 				cf->can_id = msg_head->can_id;
959 			}
960 		}
961 
962 		/* tx_ops never compare with previous received messages */
963 		op->last_frames = NULL;
964 
965 		/* bcm_can_tx / bcm_tx_timeout_handler needs this */
966 		op->sk = sk;
967 		op->ifindex = ifindex;
968 
969 		/* initialize uninitialized (kzalloc) structure */
970 		hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
971 		op->timer.function = bcm_tx_timeout_handler;
972 
973 		/* initialize tasklet for tx countevent notification */
974 		tasklet_init(&op->tsklet, bcm_tx_timeout_tsklet,
975 			     (unsigned long) op);
976 
977 		/* currently unused in tx_ops */
978 		hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
979 
980 		/* add this bcm_op to the list of the tx_ops */
981 		list_add(&op->list, &bo->tx_ops);
982 
983 	} /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */
984 
985 	if (op->nframes != msg_head->nframes) {
986 		op->nframes   = msg_head->nframes;
987 		/* start multiple frame transmission with index 0 */
988 		op->currframe = 0;
989 	}
990 
991 	/* check flags */
992 
993 	if (op->flags & TX_RESET_MULTI_IDX) {
994 		/* start multiple frame transmission with index 0 */
995 		op->currframe = 0;
996 	}
997 
998 	if (op->flags & SETTIMER) {
999 		/* set timer values */
1000 		op->count = msg_head->count;
1001 		op->ival1 = msg_head->ival1;
1002 		op->ival2 = msg_head->ival2;
1003 		op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
1004 		op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
1005 
1006 		/* disable an active timer due to zero values? */
1007 		if (!op->kt_ival1.tv64 && !op->kt_ival2.tv64)
1008 			hrtimer_cancel(&op->timer);
1009 	}
1010 
1011 	if (op->flags & STARTTIMER) {
1012 		hrtimer_cancel(&op->timer);
1013 		/* spec: send CAN frame when starting timer */
1014 		op->flags |= TX_ANNOUNCE;
1015 	}
1016 
1017 	if (op->flags & TX_ANNOUNCE) {
1018 		bcm_can_tx(op);
1019 		if (op->count)
1020 			op->count--;
1021 	}
1022 
1023 	if (op->flags & STARTTIMER)
1024 		bcm_tx_start_timer(op);
1025 
1026 	return msg_head->nframes * op->cfsiz + MHSIZ;
1027 }
1028 
1029 /*
1030  * bcm_rx_setup - create or update a bcm rx op (for bcm_sendmsg)
1031  */
1032 static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
1033 			int ifindex, struct sock *sk)
1034 {
1035 	struct bcm_sock *bo = bcm_sk(sk);
1036 	struct bcm_op *op;
1037 	int do_rx_register;
1038 	int err = 0;
1039 
1040 	if ((msg_head->flags & RX_FILTER_ID) || (!(msg_head->nframes))) {
1041 		/* be robust against wrong usage ... */
1042 		msg_head->flags |= RX_FILTER_ID;
1043 		/* ignore trailing garbage */
1044 		msg_head->nframes = 0;
1045 	}
1046 
1047 	/* the first element contains the mux-mask => MAX_NFRAMES + 1  */
1048 	if (msg_head->nframes > MAX_NFRAMES + 1)
1049 		return -EINVAL;
1050 
1051 	if ((msg_head->flags & RX_RTR_FRAME) &&
1052 	    ((msg_head->nframes != 1) ||
1053 	     (!(msg_head->can_id & CAN_RTR_FLAG))))
1054 		return -EINVAL;
1055 
1056 	/* check the given can_id */
1057 	op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
1058 	if (op) {
1059 		/* update existing BCM operation */
1060 
1061 		/*
1062 		 * Do we need more space for the CAN frames than currently
1063 		 * allocated? -> This is a _really_ unusual use-case and
1064 		 * therefore (complexity / locking) it is not supported.
1065 		 */
1066 		if (msg_head->nframes > op->nframes)
1067 			return -E2BIG;
1068 
1069 		if (msg_head->nframes) {
1070 			/* update CAN frames content */
1071 			err = memcpy_from_msg((u8 *)op->frames, msg,
1072 					      msg_head->nframes * op->cfsiz);
1073 			if (err < 0)
1074 				return err;
1075 
1076 			/* clear last_frames to indicate 'nothing received' */
1077 			memset(op->last_frames, 0, msg_head->nframes * op->cfsiz);
1078 		}
1079 
1080 		op->nframes = msg_head->nframes;
1081 		op->flags = msg_head->flags;
1082 
1083 		/* Only an update -> do not call can_rx_register() */
1084 		do_rx_register = 0;
1085 
1086 	} else {
1087 		/* insert new BCM operation for the given can_id */
1088 		op = kzalloc(OPSIZ, GFP_KERNEL);
1089 		if (!op)
1090 			return -ENOMEM;
1091 
1092 		op->can_id = msg_head->can_id;
1093 		op->nframes = msg_head->nframes;
1094 		op->cfsiz = CFSIZ(msg_head->flags);
1095 		op->flags = msg_head->flags;
1096 
1097 		if (msg_head->nframes > 1) {
1098 			/* create array for CAN frames and copy the data */
1099 			op->frames = kmalloc(msg_head->nframes * op->cfsiz,
1100 					     GFP_KERNEL);
1101 			if (!op->frames) {
1102 				kfree(op);
1103 				return -ENOMEM;
1104 			}
1105 
1106 			/* create and init array for received CAN frames */
1107 			op->last_frames = kzalloc(msg_head->nframes * op->cfsiz,
1108 						  GFP_KERNEL);
1109 			if (!op->last_frames) {
1110 				kfree(op->frames);
1111 				kfree(op);
1112 				return -ENOMEM;
1113 			}
1114 
1115 		} else {
1116 			op->frames = &op->sframe;
1117 			op->last_frames = &op->last_sframe;
1118 		}
1119 
1120 		if (msg_head->nframes) {
1121 			err = memcpy_from_msg((u8 *)op->frames, msg,
1122 					      msg_head->nframes * op->cfsiz);
1123 			if (err < 0) {
1124 				if (op->frames != &op->sframe)
1125 					kfree(op->frames);
1126 				if (op->last_frames != &op->last_sframe)
1127 					kfree(op->last_frames);
1128 				kfree(op);
1129 				return err;
1130 			}
1131 		}
1132 
1133 		/* bcm_can_tx / bcm_tx_timeout_handler needs this */
1134 		op->sk = sk;
1135 		op->ifindex = ifindex;
1136 
1137 		/* ifindex for timeout events w/o previous frame reception */
1138 		op->rx_ifindex = ifindex;
1139 
1140 		/* initialize uninitialized (kzalloc) structure */
1141 		hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
1142 		op->timer.function = bcm_rx_timeout_handler;
1143 
1144 		/* initialize tasklet for rx timeout notification */
1145 		tasklet_init(&op->tsklet, bcm_rx_timeout_tsklet,
1146 			     (unsigned long) op);
1147 
1148 		hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
1149 		op->thrtimer.function = bcm_rx_thr_handler;
1150 
1151 		/* initialize tasklet for rx throttle handling */
1152 		tasklet_init(&op->thrtsklet, bcm_rx_thr_tsklet,
1153 			     (unsigned long) op);
1154 
1155 		/* add this bcm_op to the list of the rx_ops */
1156 		list_add(&op->list, &bo->rx_ops);
1157 
1158 		/* call can_rx_register() */
1159 		do_rx_register = 1;
1160 
1161 	} /* if ((op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex))) */
1162 
1163 	/* check flags */
1164 
1165 	if (op->flags & RX_RTR_FRAME) {
1166 
1167 		/* no timers in RTR-mode */
1168 		hrtimer_cancel(&op->thrtimer);
1169 		hrtimer_cancel(&op->timer);
1170 
1171 		/*
1172 		 * funny feature in RX(!)_SETUP only for RTR-mode:
1173 		 * copy can_id into frame BUT without RTR-flag to
1174 		 * prevent a full-load-loopback-test ... ;-]
1175 		 */
1176 		if ((op->flags & TX_CP_CAN_ID) ||
1177 		    (op->frames[0].can_id == op->can_id))
1178 			op->frames[0].can_id = op->can_id & ~CAN_RTR_FLAG;
1179 
1180 	} else {
1181 		if (op->flags & SETTIMER) {
1182 
1183 			/* set timer value */
1184 			op->ival1 = msg_head->ival1;
1185 			op->ival2 = msg_head->ival2;
1186 			op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
1187 			op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
1188 
1189 			/* disable an active timer due to zero value? */
1190 			if (!op->kt_ival1.tv64)
1191 				hrtimer_cancel(&op->timer);
1192 
1193 			/*
1194 			 * In any case cancel the throttle timer, flush
1195 			 * potentially blocked msgs and reset throttle handling
1196 			 */
1197 			op->kt_lastmsg = ktime_set(0, 0);
1198 			hrtimer_cancel(&op->thrtimer);
1199 			bcm_rx_thr_flush(op, 1);
1200 		}
1201 
1202 		if ((op->flags & STARTTIMER) && op->kt_ival1.tv64)
1203 			hrtimer_start(&op->timer, op->kt_ival1,
1204 				      HRTIMER_MODE_REL);
1205 	}
1206 
1207 	/* now we can register for can_ids, if we added a new bcm_op */
1208 	if (do_rx_register) {
1209 		if (ifindex) {
1210 			struct net_device *dev;
1211 
1212 			dev = dev_get_by_index(&init_net, ifindex);
1213 			if (dev) {
1214 				err = can_rx_register(dev, op->can_id,
1215 						      REGMASK(op->can_id),
1216 						      bcm_rx_handler, op,
1217 						      "bcm");
1218 
1219 				op->rx_reg_dev = dev;
1220 				dev_put(dev);
1221 			}
1222 
1223 		} else
1224 			err = can_rx_register(NULL, op->can_id,
1225 					      REGMASK(op->can_id),
1226 					      bcm_rx_handler, op, "bcm");
1227 		if (err) {
1228 			/* this bcm rx op is broken -> remove it */
1229 			list_del(&op->list);
1230 			bcm_remove_op(op);
1231 			return err;
1232 		}
1233 	}
1234 
1235 	return msg_head->nframes * op->cfsiz + MHSIZ;
1236 }
1237 
1238 /*
1239  * bcm_tx_send - send a single CAN frame to the CAN interface (for bcm_sendmsg)
1240  */
1241 static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk,
1242 		       int cfsiz)
1243 {
1244 	struct sk_buff *skb;
1245 	struct net_device *dev;
1246 	int err;
1247 
1248 	/* we need a real device to send frames */
1249 	if (!ifindex)
1250 		return -ENODEV;
1251 
1252 	skb = alloc_skb(cfsiz + sizeof(struct can_skb_priv), GFP_KERNEL);
1253 	if (!skb)
1254 		return -ENOMEM;
1255 
1256 	can_skb_reserve(skb);
1257 
1258 	err = memcpy_from_msg(skb_put(skb, cfsiz), msg, cfsiz);
1259 	if (err < 0) {
1260 		kfree_skb(skb);
1261 		return err;
1262 	}
1263 
1264 	dev = dev_get_by_index(&init_net, ifindex);
1265 	if (!dev) {
1266 		kfree_skb(skb);
1267 		return -ENODEV;
1268 	}
1269 
1270 	can_skb_prv(skb)->ifindex = dev->ifindex;
1271 	can_skb_prv(skb)->skbcnt = 0;
1272 	skb->dev = dev;
1273 	can_skb_set_owner(skb, sk);
1274 	err = can_send(skb, 1); /* send with loopback */
1275 	dev_put(dev);
1276 
1277 	if (err)
1278 		return err;
1279 
1280 	return cfsiz + MHSIZ;
1281 }
1282 
1283 /*
1284  * bcm_sendmsg - process BCM commands (opcodes) from the userspace
1285  */
1286 static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
1287 {
1288 	struct sock *sk = sock->sk;
1289 	struct bcm_sock *bo = bcm_sk(sk);
1290 	int ifindex = bo->ifindex; /* default ifindex for this bcm_op */
1291 	struct bcm_msg_head msg_head;
1292 	int cfsiz;
1293 	int ret; /* read bytes or error codes as return value */
1294 
1295 	if (!bo->bound)
1296 		return -ENOTCONN;
1297 
1298 	/* check for valid message length from userspace */
1299 	if (size < MHSIZ)
1300 		return -EINVAL;
1301 
1302 	/* read message head information */
1303 	ret = memcpy_from_msg((u8 *)&msg_head, msg, MHSIZ);
1304 	if (ret < 0)
1305 		return ret;
1306 
1307 	cfsiz = CFSIZ(msg_head.flags);
1308 	if ((size - MHSIZ) % cfsiz)
1309 		return -EINVAL;
1310 
1311 	/* check for alternative ifindex for this bcm_op */
1312 
1313 	if (!ifindex && msg->msg_name) {
1314 		/* no bound device as default => check msg_name */
1315 		DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
1316 
1317 		if (msg->msg_namelen < sizeof(*addr))
1318 			return -EINVAL;
1319 
1320 		if (addr->can_family != AF_CAN)
1321 			return -EINVAL;
1322 
1323 		/* ifindex from sendto() */
1324 		ifindex = addr->can_ifindex;
1325 
1326 		if (ifindex) {
1327 			struct net_device *dev;
1328 
1329 			dev = dev_get_by_index(&init_net, ifindex);
1330 			if (!dev)
1331 				return -ENODEV;
1332 
1333 			if (dev->type != ARPHRD_CAN) {
1334 				dev_put(dev);
1335 				return -ENODEV;
1336 			}
1337 
1338 			dev_put(dev);
1339 		}
1340 	}
1341 
1342 	lock_sock(sk);
1343 
1344 	switch (msg_head.opcode) {
1345 
1346 	case TX_SETUP:
1347 		ret = bcm_tx_setup(&msg_head, msg, ifindex, sk);
1348 		break;
1349 
1350 	case RX_SETUP:
1351 		ret = bcm_rx_setup(&msg_head, msg, ifindex, sk);
1352 		break;
1353 
1354 	case TX_DELETE:
1355 		if (bcm_delete_tx_op(&bo->tx_ops, &msg_head, ifindex))
1356 			ret = MHSIZ;
1357 		else
1358 			ret = -EINVAL;
1359 		break;
1360 
1361 	case RX_DELETE:
1362 		if (bcm_delete_rx_op(&bo->rx_ops, &msg_head, ifindex))
1363 			ret = MHSIZ;
1364 		else
1365 			ret = -EINVAL;
1366 		break;
1367 
1368 	case TX_READ:
1369 		/* reuse msg_head for the reply to TX_READ */
1370 		msg_head.opcode  = TX_STATUS;
1371 		ret = bcm_read_op(&bo->tx_ops, &msg_head, ifindex);
1372 		break;
1373 
1374 	case RX_READ:
1375 		/* reuse msg_head for the reply to RX_READ */
1376 		msg_head.opcode  = RX_STATUS;
1377 		ret = bcm_read_op(&bo->rx_ops, &msg_head, ifindex);
1378 		break;
1379 
1380 	case TX_SEND:
1381 		/* we need exactly one CAN frame behind the msg head */
1382 		if ((msg_head.nframes != 1) || (size != cfsiz + MHSIZ))
1383 			ret = -EINVAL;
1384 		else
1385 			ret = bcm_tx_send(msg, ifindex, sk, cfsiz);
1386 		break;
1387 
1388 	default:
1389 		ret = -EINVAL;
1390 		break;
1391 	}
1392 
1393 	release_sock(sk);
1394 
1395 	return ret;
1396 }
1397 
1398 /*
1399  * notification handler for netdevice status changes
1400  */
1401 static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
1402 			void *ptr)
1403 {
1404 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1405 	struct bcm_sock *bo = container_of(nb, struct bcm_sock, notifier);
1406 	struct sock *sk = &bo->sk;
1407 	struct bcm_op *op;
1408 	int notify_enodev = 0;
1409 
1410 	if (!net_eq(dev_net(dev), &init_net))
1411 		return NOTIFY_DONE;
1412 
1413 	if (dev->type != ARPHRD_CAN)
1414 		return NOTIFY_DONE;
1415 
1416 	switch (msg) {
1417 
1418 	case NETDEV_UNREGISTER:
1419 		lock_sock(sk);
1420 
1421 		/* remove device specific receive entries */
1422 		list_for_each_entry(op, &bo->rx_ops, list)
1423 			if (op->rx_reg_dev == dev)
1424 				bcm_rx_unreg(dev, op);
1425 
1426 		/* remove device reference, if this is our bound device */
1427 		if (bo->bound && bo->ifindex == dev->ifindex) {
1428 			bo->bound   = 0;
1429 			bo->ifindex = 0;
1430 			notify_enodev = 1;
1431 		}
1432 
1433 		release_sock(sk);
1434 
1435 		if (notify_enodev) {
1436 			sk->sk_err = ENODEV;
1437 			if (!sock_flag(sk, SOCK_DEAD))
1438 				sk->sk_error_report(sk);
1439 		}
1440 		break;
1441 
1442 	case NETDEV_DOWN:
1443 		if (bo->bound && bo->ifindex == dev->ifindex) {
1444 			sk->sk_err = ENETDOWN;
1445 			if (!sock_flag(sk, SOCK_DEAD))
1446 				sk->sk_error_report(sk);
1447 		}
1448 	}
1449 
1450 	return NOTIFY_DONE;
1451 }
1452 
1453 /*
1454  * initial settings for all BCM sockets to be set at socket creation time
1455  */
1456 static int bcm_init(struct sock *sk)
1457 {
1458 	struct bcm_sock *bo = bcm_sk(sk);
1459 
1460 	bo->bound            = 0;
1461 	bo->ifindex          = 0;
1462 	bo->dropped_usr_msgs = 0;
1463 	bo->bcm_proc_read    = NULL;
1464 
1465 	INIT_LIST_HEAD(&bo->tx_ops);
1466 	INIT_LIST_HEAD(&bo->rx_ops);
1467 
1468 	/* set notifier */
1469 	bo->notifier.notifier_call = bcm_notifier;
1470 
1471 	register_netdevice_notifier(&bo->notifier);
1472 
1473 	return 0;
1474 }
1475 
1476 /*
1477  * standard socket functions
1478  */
1479 static int bcm_release(struct socket *sock)
1480 {
1481 	struct sock *sk = sock->sk;
1482 	struct bcm_sock *bo;
1483 	struct bcm_op *op, *next;
1484 
1485 	if (sk == NULL)
1486 		return 0;
1487 
1488 	bo = bcm_sk(sk);
1489 
1490 	/* remove bcm_ops, timer, rx_unregister(), etc. */
1491 
1492 	unregister_netdevice_notifier(&bo->notifier);
1493 
1494 	lock_sock(sk);
1495 
1496 	list_for_each_entry_safe(op, next, &bo->tx_ops, list)
1497 		bcm_remove_op(op);
1498 
1499 	list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
1500 		/*
1501 		 * Don't care if we're bound or not (due to netdev problems)
1502 		 * can_rx_unregister() is always a save thing to do here.
1503 		 */
1504 		if (op->ifindex) {
1505 			/*
1506 			 * Only remove subscriptions that had not
1507 			 * been removed due to NETDEV_UNREGISTER
1508 			 * in bcm_notifier()
1509 			 */
1510 			if (op->rx_reg_dev) {
1511 				struct net_device *dev;
1512 
1513 				dev = dev_get_by_index(&init_net, op->ifindex);
1514 				if (dev) {
1515 					bcm_rx_unreg(dev, op);
1516 					dev_put(dev);
1517 				}
1518 			}
1519 		} else
1520 			can_rx_unregister(NULL, op->can_id,
1521 					  REGMASK(op->can_id),
1522 					  bcm_rx_handler, op);
1523 
1524 		bcm_remove_op(op);
1525 	}
1526 
1527 	/* remove procfs entry */
1528 	if (proc_dir && bo->bcm_proc_read)
1529 		remove_proc_entry(bo->procname, proc_dir);
1530 
1531 	/* remove device reference */
1532 	if (bo->bound) {
1533 		bo->bound   = 0;
1534 		bo->ifindex = 0;
1535 	}
1536 
1537 	sock_orphan(sk);
1538 	sock->sk = NULL;
1539 
1540 	release_sock(sk);
1541 	sock_put(sk);
1542 
1543 	return 0;
1544 }
1545 
1546 static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
1547 		       int flags)
1548 {
1549 	struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
1550 	struct sock *sk = sock->sk;
1551 	struct bcm_sock *bo = bcm_sk(sk);
1552 
1553 	if (len < sizeof(*addr))
1554 		return -EINVAL;
1555 
1556 	if (bo->bound)
1557 		return -EISCONN;
1558 
1559 	/* bind a device to this socket */
1560 	if (addr->can_ifindex) {
1561 		struct net_device *dev;
1562 
1563 		dev = dev_get_by_index(&init_net, addr->can_ifindex);
1564 		if (!dev)
1565 			return -ENODEV;
1566 
1567 		if (dev->type != ARPHRD_CAN) {
1568 			dev_put(dev);
1569 			return -ENODEV;
1570 		}
1571 
1572 		bo->ifindex = dev->ifindex;
1573 		dev_put(dev);
1574 
1575 	} else {
1576 		/* no interface reference for ifindex = 0 ('any' CAN device) */
1577 		bo->ifindex = 0;
1578 	}
1579 
1580 	bo->bound = 1;
1581 
1582 	if (proc_dir) {
1583 		/* unique socket address as filename */
1584 		sprintf(bo->procname, "%lu", sock_i_ino(sk));
1585 		bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
1586 						     proc_dir,
1587 						     &bcm_proc_fops, sk);
1588 	}
1589 
1590 	return 0;
1591 }
1592 
1593 static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1594 		       int flags)
1595 {
1596 	struct sock *sk = sock->sk;
1597 	struct sk_buff *skb;
1598 	int error = 0;
1599 	int noblock;
1600 	int err;
1601 
1602 	noblock =  flags & MSG_DONTWAIT;
1603 	flags   &= ~MSG_DONTWAIT;
1604 	skb = skb_recv_datagram(sk, flags, noblock, &error);
1605 	if (!skb)
1606 		return error;
1607 
1608 	if (skb->len < size)
1609 		size = skb->len;
1610 
1611 	err = memcpy_to_msg(msg, skb->data, size);
1612 	if (err < 0) {
1613 		skb_free_datagram(sk, skb);
1614 		return err;
1615 	}
1616 
1617 	sock_recv_ts_and_drops(msg, sk, skb);
1618 
1619 	if (msg->msg_name) {
1620 		__sockaddr_check_size(sizeof(struct sockaddr_can));
1621 		msg->msg_namelen = sizeof(struct sockaddr_can);
1622 		memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
1623 	}
1624 
1625 	skb_free_datagram(sk, skb);
1626 
1627 	return size;
1628 }
1629 
1630 static const struct proto_ops bcm_ops = {
1631 	.family        = PF_CAN,
1632 	.release       = bcm_release,
1633 	.bind          = sock_no_bind,
1634 	.connect       = bcm_connect,
1635 	.socketpair    = sock_no_socketpair,
1636 	.accept        = sock_no_accept,
1637 	.getname       = sock_no_getname,
1638 	.poll          = datagram_poll,
1639 	.ioctl         = can_ioctl,	/* use can_ioctl() from af_can.c */
1640 	.listen        = sock_no_listen,
1641 	.shutdown      = sock_no_shutdown,
1642 	.setsockopt    = sock_no_setsockopt,
1643 	.getsockopt    = sock_no_getsockopt,
1644 	.sendmsg       = bcm_sendmsg,
1645 	.recvmsg       = bcm_recvmsg,
1646 	.mmap          = sock_no_mmap,
1647 	.sendpage      = sock_no_sendpage,
1648 };
1649 
1650 static struct proto bcm_proto __read_mostly = {
1651 	.name       = "CAN_BCM",
1652 	.owner      = THIS_MODULE,
1653 	.obj_size   = sizeof(struct bcm_sock),
1654 	.init       = bcm_init,
1655 };
1656 
1657 static const struct can_proto bcm_can_proto = {
1658 	.type       = SOCK_DGRAM,
1659 	.protocol   = CAN_BCM,
1660 	.ops        = &bcm_ops,
1661 	.prot       = &bcm_proto,
1662 };
1663 
1664 static int __init bcm_module_init(void)
1665 {
1666 	int err;
1667 
1668 	pr_info("can: broadcast manager protocol (rev " CAN_BCM_VERSION " t)\n");
1669 
1670 	err = can_proto_register(&bcm_can_proto);
1671 	if (err < 0) {
1672 		printk(KERN_ERR "can: registration of bcm protocol failed\n");
1673 		return err;
1674 	}
1675 
1676 	/* create /proc/net/can-bcm directory */
1677 	proc_dir = proc_mkdir("can-bcm", init_net.proc_net);
1678 	return 0;
1679 }
1680 
1681 static void __exit bcm_module_exit(void)
1682 {
1683 	can_proto_unregister(&bcm_can_proto);
1684 
1685 	if (proc_dir)
1686 		remove_proc_entry("can-bcm", init_net.proc_net);
1687 }
1688 
1689 module_init(bcm_module_init);
1690 module_exit(bcm_module_exit);
1691