xref: /openbmc/linux/net/atm/br2684.c (revision 98ddec80)
1 /*
2  * Ethernet netdevice using ATM AAL5 as underlying carrier
3  * (RFC1483 obsoleted by RFC2684) for Linux
4  *
5  * Authors: Marcell GAL, 2000, XDSL Ltd, Hungary
6  *          Eric Kinzie, 2006-2007, US Naval Research Laboratory
7  */
8 
9 #define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
10 
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/kernel.h>
14 #include <linux/list.h>
15 #include <linux/netdevice.h>
16 #include <linux/skbuff.h>
17 #include <linux/etherdevice.h>
18 #include <linux/rtnetlink.h>
19 #include <linux/ip.h>
20 #include <linux/uaccess.h>
21 #include <linux/slab.h>
22 #include <net/arp.h>
23 #include <linux/atm.h>
24 #include <linux/atmdev.h>
25 #include <linux/capability.h>
26 #include <linux/seq_file.h>
27 
28 #include <linux/atmbr2684.h>
29 
30 #include "common.h"
31 
32 static void skb_debug(const struct sk_buff *skb)
33 {
34 #ifdef SKB_DEBUG
35 #define NUM2PRINT 50
36 	print_hex_dump(KERN_DEBUG, "br2684: skb: ", DUMP_OFFSET,
37 		       16, 1, skb->data, min(NUM2PRINT, skb->len), true);
38 #endif
39 }
40 
41 #define BR2684_ETHERTYPE_LEN	2
42 #define BR2684_PAD_LEN		2
43 
44 #define LLC		0xaa, 0xaa, 0x03
45 #define SNAP_BRIDGED	0x00, 0x80, 0xc2
46 #define SNAP_ROUTED	0x00, 0x00, 0x00
47 #define PID_ETHERNET	0x00, 0x07
48 #define ETHERTYPE_IPV4	0x08, 0x00
49 #define ETHERTYPE_IPV6	0x86, 0xdd
50 #define PAD_BRIDGED	0x00, 0x00
51 
52 static const unsigned char ethertype_ipv4[] = { ETHERTYPE_IPV4 };
53 static const unsigned char ethertype_ipv6[] = { ETHERTYPE_IPV6 };
54 static const unsigned char llc_oui_pid_pad[] =
55 			{ LLC, SNAP_BRIDGED, PID_ETHERNET, PAD_BRIDGED };
56 static const unsigned char pad[] = { PAD_BRIDGED };
57 static const unsigned char llc_oui_ipv4[] = { LLC, SNAP_ROUTED, ETHERTYPE_IPV4 };
58 static const unsigned char llc_oui_ipv6[] = { LLC, SNAP_ROUTED, ETHERTYPE_IPV6 };
59 
60 enum br2684_encaps {
61 	e_vc = BR2684_ENCAPS_VC,
62 	e_llc = BR2684_ENCAPS_LLC,
63 };
64 
65 struct br2684_vcc {
66 	struct atm_vcc *atmvcc;
67 	struct net_device *device;
68 	/* keep old push, pop functions for chaining */
69 	void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb);
70 	void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
71 	void (*old_release_cb)(struct atm_vcc *vcc);
72 	struct module *old_owner;
73 	enum br2684_encaps encaps;
74 	struct list_head brvccs;
75 #ifdef CONFIG_ATM_BR2684_IPFILTER
76 	struct br2684_filter filter;
77 #endif /* CONFIG_ATM_BR2684_IPFILTER */
78 	unsigned int copies_needed, copies_failed;
79 	atomic_t qspace;
80 };
81 
82 struct br2684_dev {
83 	struct net_device *net_dev;
84 	struct list_head br2684_devs;
85 	int number;
86 	struct list_head brvccs;	/* one device <=> one vcc (before xmas) */
87 	int mac_was_set;
88 	enum br2684_payload payload;
89 };
90 
91 /*
92  * This lock should be held for writing any time the list of devices or
93  * their attached vcc's could be altered.  It should be held for reading
94  * any time these are being queried.  Note that we sometimes need to
95  * do read-locking under interrupt context, so write locking must block
96  * the current CPU's interrupts
97  */
98 static DEFINE_RWLOCK(devs_lock);
99 
100 static LIST_HEAD(br2684_devs);
101 
102 static inline struct br2684_dev *BRPRIV(const struct net_device *net_dev)
103 {
104 	return netdev_priv(net_dev);
105 }
106 
107 static inline struct net_device *list_entry_brdev(const struct list_head *le)
108 {
109 	return list_entry(le, struct br2684_dev, br2684_devs)->net_dev;
110 }
111 
112 static inline struct br2684_vcc *BR2684_VCC(const struct atm_vcc *atmvcc)
113 {
114 	return (struct br2684_vcc *)(atmvcc->user_back);
115 }
116 
117 static inline struct br2684_vcc *list_entry_brvcc(const struct list_head *le)
118 {
119 	return list_entry(le, struct br2684_vcc, brvccs);
120 }
121 
122 /* Caller should hold read_lock(&devs_lock) */
123 static struct net_device *br2684_find_dev(const struct br2684_if_spec *s)
124 {
125 	struct list_head *lh;
126 	struct net_device *net_dev;
127 	switch (s->method) {
128 	case BR2684_FIND_BYNUM:
129 		list_for_each(lh, &br2684_devs) {
130 			net_dev = list_entry_brdev(lh);
131 			if (BRPRIV(net_dev)->number == s->spec.devnum)
132 				return net_dev;
133 		}
134 		break;
135 	case BR2684_FIND_BYIFNAME:
136 		list_for_each(lh, &br2684_devs) {
137 			net_dev = list_entry_brdev(lh);
138 			if (!strncmp(net_dev->name, s->spec.ifname, IFNAMSIZ))
139 				return net_dev;
140 		}
141 		break;
142 	}
143 	return NULL;
144 }
145 
146 static int atm_dev_event(struct notifier_block *this, unsigned long event,
147 		 void *arg)
148 {
149 	struct atm_dev *atm_dev = arg;
150 	struct list_head *lh;
151 	struct net_device *net_dev;
152 	struct br2684_vcc *brvcc;
153 	struct atm_vcc *atm_vcc;
154 	unsigned long flags;
155 
156 	pr_debug("event=%ld dev=%p\n", event, atm_dev);
157 
158 	read_lock_irqsave(&devs_lock, flags);
159 	list_for_each(lh, &br2684_devs) {
160 		net_dev = list_entry_brdev(lh);
161 
162 		list_for_each_entry(brvcc, &BRPRIV(net_dev)->brvccs, brvccs) {
163 			atm_vcc = brvcc->atmvcc;
164 			if (atm_vcc && brvcc->atmvcc->dev == atm_dev) {
165 
166 				if (atm_vcc->dev->signal == ATM_PHY_SIG_LOST)
167 					netif_carrier_off(net_dev);
168 				else
169 					netif_carrier_on(net_dev);
170 
171 			}
172 		}
173 	}
174 	read_unlock_irqrestore(&devs_lock, flags);
175 
176 	return NOTIFY_DONE;
177 }
178 
179 static struct notifier_block atm_dev_notifier = {
180 	.notifier_call = atm_dev_event,
181 };
182 
183 /* chained vcc->pop function.  Check if we should wake the netif_queue */
184 static void br2684_pop(struct atm_vcc *vcc, struct sk_buff *skb)
185 {
186 	struct br2684_vcc *brvcc = BR2684_VCC(vcc);
187 
188 	pr_debug("(vcc %p ; net_dev %p )\n", vcc, brvcc->device);
189 	brvcc->old_pop(vcc, skb);
190 
191 	/* If the queue space just went up from zero, wake */
192 	if (atomic_inc_return(&brvcc->qspace) == 1)
193 		netif_wake_queue(brvcc->device);
194 }
195 
196 /*
197  * Send a packet out a particular vcc.  Not to useful right now, but paves
198  * the way for multiple vcc's per itf.  Returns true if we can send,
199  * otherwise false
200  */
201 static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
202 			   struct br2684_vcc *brvcc)
203 {
204 	struct br2684_dev *brdev = BRPRIV(dev);
205 	struct atm_vcc *atmvcc;
206 	int minheadroom = (brvcc->encaps == e_llc) ?
207 		((brdev->payload == p_bridged) ?
208 			sizeof(llc_oui_pid_pad) : sizeof(llc_oui_ipv4)) :
209 		((brdev->payload == p_bridged) ? BR2684_PAD_LEN : 0);
210 
211 	if (skb_headroom(skb) < minheadroom) {
212 		struct sk_buff *skb2 = skb_realloc_headroom(skb, minheadroom);
213 		brvcc->copies_needed++;
214 		dev_kfree_skb(skb);
215 		if (skb2 == NULL) {
216 			brvcc->copies_failed++;
217 			return 0;
218 		}
219 		skb = skb2;
220 	}
221 
222 	if (brvcc->encaps == e_llc) {
223 		if (brdev->payload == p_bridged) {
224 			skb_push(skb, sizeof(llc_oui_pid_pad));
225 			skb_copy_to_linear_data(skb, llc_oui_pid_pad,
226 						sizeof(llc_oui_pid_pad));
227 		} else if (brdev->payload == p_routed) {
228 			unsigned short prot = ntohs(skb->protocol);
229 
230 			skb_push(skb, sizeof(llc_oui_ipv4));
231 			switch (prot) {
232 			case ETH_P_IP:
233 				skb_copy_to_linear_data(skb, llc_oui_ipv4,
234 							sizeof(llc_oui_ipv4));
235 				break;
236 			case ETH_P_IPV6:
237 				skb_copy_to_linear_data(skb, llc_oui_ipv6,
238 							sizeof(llc_oui_ipv6));
239 				break;
240 			default:
241 				dev_kfree_skb(skb);
242 				return 0;
243 			}
244 		}
245 	} else { /* e_vc */
246 		if (brdev->payload == p_bridged) {
247 			skb_push(skb, 2);
248 			memset(skb->data, 0, 2);
249 		}
250 	}
251 	skb_debug(skb);
252 
253 	ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
254 	pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
255 	atm_account_tx(atmvcc, skb);
256 	dev->stats.tx_packets++;
257 	dev->stats.tx_bytes += skb->len;
258 
259 	if (atomic_dec_return(&brvcc->qspace) < 1) {
260 		/* No more please! */
261 		netif_stop_queue(brvcc->device);
262 		/* We might have raced with br2684_pop() */
263 		if (unlikely(atomic_read(&brvcc->qspace) > 0))
264 			netif_wake_queue(brvcc->device);
265 	}
266 
267 	/* If this fails immediately, the skb will be freed and br2684_pop()
268 	   will wake the queue if appropriate. Just return an error so that
269 	   the stats are updated correctly */
270 	return !atmvcc->send(atmvcc, skb);
271 }
272 
273 static void br2684_release_cb(struct atm_vcc *atmvcc)
274 {
275 	struct br2684_vcc *brvcc = BR2684_VCC(atmvcc);
276 
277 	if (atomic_read(&brvcc->qspace) > 0)
278 		netif_wake_queue(brvcc->device);
279 
280 	if (brvcc->old_release_cb)
281 		brvcc->old_release_cb(atmvcc);
282 }
283 
284 static inline struct br2684_vcc *pick_outgoing_vcc(const struct sk_buff *skb,
285 						   const struct br2684_dev *brdev)
286 {
287 	return list_empty(&brdev->brvccs) ? NULL : list_entry_brvcc(brdev->brvccs.next);	/* 1 vcc/dev right now */
288 }
289 
290 static netdev_tx_t br2684_start_xmit(struct sk_buff *skb,
291 				     struct net_device *dev)
292 {
293 	struct br2684_dev *brdev = BRPRIV(dev);
294 	struct br2684_vcc *brvcc;
295 	struct atm_vcc *atmvcc;
296 	netdev_tx_t ret = NETDEV_TX_OK;
297 
298 	pr_debug("skb_dst(skb)=%p\n", skb_dst(skb));
299 	read_lock(&devs_lock);
300 	brvcc = pick_outgoing_vcc(skb, brdev);
301 	if (brvcc == NULL) {
302 		pr_debug("no vcc attached to dev %s\n", dev->name);
303 		dev->stats.tx_errors++;
304 		dev->stats.tx_carrier_errors++;
305 		/* netif_stop_queue(dev); */
306 		dev_kfree_skb(skb);
307 		goto out_devs;
308 	}
309 	atmvcc = brvcc->atmvcc;
310 
311 	bh_lock_sock(sk_atm(atmvcc));
312 
313 	if (test_bit(ATM_VF_RELEASED, &atmvcc->flags) ||
314 	    test_bit(ATM_VF_CLOSE, &atmvcc->flags) ||
315 	    !test_bit(ATM_VF_READY, &atmvcc->flags)) {
316 		dev->stats.tx_dropped++;
317 		dev_kfree_skb(skb);
318 		goto out;
319 	}
320 
321 	if (sock_owned_by_user(sk_atm(atmvcc))) {
322 		netif_stop_queue(brvcc->device);
323 		ret = NETDEV_TX_BUSY;
324 		goto out;
325 	}
326 
327 	if (!br2684_xmit_vcc(skb, dev, brvcc)) {
328 		/*
329 		 * We should probably use netif_*_queue() here, but that
330 		 * involves added complication.  We need to walk before
331 		 * we can run.
332 		 *
333 		 * Don't free here! this pointer might be no longer valid!
334 		 */
335 		dev->stats.tx_errors++;
336 		dev->stats.tx_fifo_errors++;
337 	}
338  out:
339 	bh_unlock_sock(sk_atm(atmvcc));
340  out_devs:
341 	read_unlock(&devs_lock);
342 	return ret;
343 }
344 
345 /*
346  * We remember when the MAC gets set, so we don't override it later with
347  * the ESI of the ATM card of the first VC
348  */
349 static int br2684_mac_addr(struct net_device *dev, void *p)
350 {
351 	int err = eth_mac_addr(dev, p);
352 	if (!err)
353 		BRPRIV(dev)->mac_was_set = 1;
354 	return err;
355 }
356 
357 #ifdef CONFIG_ATM_BR2684_IPFILTER
358 /* this IOCTL is experimental. */
359 static int br2684_setfilt(struct atm_vcc *atmvcc, void __user * arg)
360 {
361 	struct br2684_vcc *brvcc;
362 	struct br2684_filter_set fs;
363 
364 	if (copy_from_user(&fs, arg, sizeof fs))
365 		return -EFAULT;
366 	if (fs.ifspec.method != BR2684_FIND_BYNOTHING) {
367 		/*
368 		 * This is really a per-vcc thing, but we can also search
369 		 * by device.
370 		 */
371 		struct br2684_dev *brdev;
372 		read_lock(&devs_lock);
373 		brdev = BRPRIV(br2684_find_dev(&fs.ifspec));
374 		if (brdev == NULL || list_empty(&brdev->brvccs) ||
375 		    brdev->brvccs.next != brdev->brvccs.prev)	/* >1 VCC */
376 			brvcc = NULL;
377 		else
378 			brvcc = list_entry_brvcc(brdev->brvccs.next);
379 		read_unlock(&devs_lock);
380 		if (brvcc == NULL)
381 			return -ESRCH;
382 	} else
383 		brvcc = BR2684_VCC(atmvcc);
384 	memcpy(&brvcc->filter, &fs.filter, sizeof(brvcc->filter));
385 	return 0;
386 }
387 
388 /* Returns 1 if packet should be dropped */
389 static inline int
390 packet_fails_filter(__be16 type, struct br2684_vcc *brvcc, struct sk_buff *skb)
391 {
392 	if (brvcc->filter.netmask == 0)
393 		return 0;	/* no filter in place */
394 	if (type == htons(ETH_P_IP) &&
395 	    (((struct iphdr *)(skb->data))->daddr & brvcc->filter.
396 	     netmask) == brvcc->filter.prefix)
397 		return 0;
398 	if (type == htons(ETH_P_ARP))
399 		return 0;
400 	/*
401 	 * TODO: we should probably filter ARPs too.. don't want to have
402 	 * them returning values that don't make sense, or is that ok?
403 	 */
404 	return 1;		/* drop */
405 }
406 #endif /* CONFIG_ATM_BR2684_IPFILTER */
407 
408 static void br2684_close_vcc(struct br2684_vcc *brvcc)
409 {
410 	pr_debug("removing VCC %p from dev %p\n", brvcc, brvcc->device);
411 	write_lock_irq(&devs_lock);
412 	list_del(&brvcc->brvccs);
413 	write_unlock_irq(&devs_lock);
414 	brvcc->atmvcc->user_back = NULL;	/* what about vcc->recvq ??? */
415 	brvcc->atmvcc->release_cb = brvcc->old_release_cb;
416 	brvcc->old_push(brvcc->atmvcc, NULL);	/* pass on the bad news */
417 	module_put(brvcc->old_owner);
418 	kfree(brvcc);
419 }
420 
421 /* when AAL5 PDU comes in: */
422 static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
423 {
424 	struct br2684_vcc *brvcc = BR2684_VCC(atmvcc);
425 	struct net_device *net_dev = brvcc->device;
426 	struct br2684_dev *brdev = BRPRIV(net_dev);
427 
428 	pr_debug("\n");
429 
430 	if (unlikely(skb == NULL)) {
431 		/* skb==NULL means VCC is being destroyed */
432 		br2684_close_vcc(brvcc);
433 		if (list_empty(&brdev->brvccs)) {
434 			write_lock_irq(&devs_lock);
435 			list_del(&brdev->br2684_devs);
436 			write_unlock_irq(&devs_lock);
437 			unregister_netdev(net_dev);
438 			free_netdev(net_dev);
439 		}
440 		return;
441 	}
442 
443 	skb_debug(skb);
444 	atm_return(atmvcc, skb->truesize);
445 	pr_debug("skb from brdev %p\n", brdev);
446 	if (brvcc->encaps == e_llc) {
447 
448 		if (skb->len > 7 && skb->data[7] == 0x01)
449 			__skb_trim(skb, skb->len - 4);
450 
451 		/* accept packets that have "ipv[46]" in the snap header */
452 		if ((skb->len >= (sizeof(llc_oui_ipv4))) &&
453 		    (memcmp(skb->data, llc_oui_ipv4,
454 			    sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) {
455 			if (memcmp(skb->data + 6, ethertype_ipv6,
456 				   sizeof(ethertype_ipv6)) == 0)
457 				skb->protocol = htons(ETH_P_IPV6);
458 			else if (memcmp(skb->data + 6, ethertype_ipv4,
459 					sizeof(ethertype_ipv4)) == 0)
460 				skb->protocol = htons(ETH_P_IP);
461 			else
462 				goto error;
463 			skb_pull(skb, sizeof(llc_oui_ipv4));
464 			skb_reset_network_header(skb);
465 			skb->pkt_type = PACKET_HOST;
466 		/*
467 		 * Let us waste some time for checking the encapsulation.
468 		 * Note, that only 7 char is checked so frames with a valid FCS
469 		 * are also accepted (but FCS is not checked of course).
470 		 */
471 		} else if ((skb->len >= sizeof(llc_oui_pid_pad)) &&
472 			   (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) {
473 			skb_pull(skb, sizeof(llc_oui_pid_pad));
474 			skb->protocol = eth_type_trans(skb, net_dev);
475 		} else
476 			goto error;
477 
478 	} else { /* e_vc */
479 		if (brdev->payload == p_routed) {
480 			struct iphdr *iph;
481 
482 			skb_reset_network_header(skb);
483 			iph = ip_hdr(skb);
484 			if (iph->version == 4)
485 				skb->protocol = htons(ETH_P_IP);
486 			else if (iph->version == 6)
487 				skb->protocol = htons(ETH_P_IPV6);
488 			else
489 				goto error;
490 			skb->pkt_type = PACKET_HOST;
491 		} else { /* p_bridged */
492 			/* first 2 chars should be 0 */
493 			if (memcmp(skb->data, pad, BR2684_PAD_LEN) != 0)
494 				goto error;
495 			skb_pull(skb, BR2684_PAD_LEN);
496 			skb->protocol = eth_type_trans(skb, net_dev);
497 		}
498 	}
499 
500 #ifdef CONFIG_ATM_BR2684_IPFILTER
501 	if (unlikely(packet_fails_filter(skb->protocol, brvcc, skb)))
502 		goto dropped;
503 #endif /* CONFIG_ATM_BR2684_IPFILTER */
504 	skb->dev = net_dev;
505 	ATM_SKB(skb)->vcc = atmvcc;	/* needed ? */
506 	pr_debug("received packet's protocol: %x\n", ntohs(skb->protocol));
507 	skb_debug(skb);
508 	/* sigh, interface is down? */
509 	if (unlikely(!(net_dev->flags & IFF_UP)))
510 		goto dropped;
511 	net_dev->stats.rx_packets++;
512 	net_dev->stats.rx_bytes += skb->len;
513 	memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
514 	netif_rx(skb);
515 	return;
516 
517 dropped:
518 	net_dev->stats.rx_dropped++;
519 	goto free_skb;
520 error:
521 	net_dev->stats.rx_errors++;
522 free_skb:
523 	dev_kfree_skb(skb);
524 }
525 
526 /*
527  * Assign a vcc to a dev
528  * Note: we do not have explicit unassign, but look at _push()
529  */
530 static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
531 {
532 	struct br2684_vcc *brvcc;
533 	struct br2684_dev *brdev;
534 	struct net_device *net_dev;
535 	struct atm_backend_br2684 be;
536 	int err;
537 
538 	if (copy_from_user(&be, arg, sizeof be))
539 		return -EFAULT;
540 	brvcc = kzalloc(sizeof(struct br2684_vcc), GFP_KERNEL);
541 	if (!brvcc)
542 		return -ENOMEM;
543 	/*
544 	 * Allow two packets in the ATM queue. One actually being sent, and one
545 	 * for the ATM 'TX done' handler to send. It shouldn't take long to get
546 	 * the next one from the netdev queue, when we need it. More than that
547 	 * would be bufferbloat.
548 	 */
549 	atomic_set(&brvcc->qspace, 2);
550 	write_lock_irq(&devs_lock);
551 	net_dev = br2684_find_dev(&be.ifspec);
552 	if (net_dev == NULL) {
553 		pr_err("tried to attach to non-existent device\n");
554 		err = -ENXIO;
555 		goto error;
556 	}
557 	brdev = BRPRIV(net_dev);
558 	if (atmvcc->push == NULL) {
559 		err = -EBADFD;
560 		goto error;
561 	}
562 	if (!list_empty(&brdev->brvccs)) {
563 		/* Only 1 VCC/dev right now */
564 		err = -EEXIST;
565 		goto error;
566 	}
567 	if (be.fcs_in != BR2684_FCSIN_NO ||
568 	    be.fcs_out != BR2684_FCSOUT_NO ||
569 	    be.fcs_auto || be.has_vpiid || be.send_padding ||
570 	    (be.encaps != BR2684_ENCAPS_VC &&
571 	     be.encaps != BR2684_ENCAPS_LLC) ||
572 	    be.min_size != 0) {
573 		err = -EINVAL;
574 		goto error;
575 	}
576 	pr_debug("vcc=%p, encaps=%d, brvcc=%p\n", atmvcc, be.encaps, brvcc);
577 	if (list_empty(&brdev->brvccs) && !brdev->mac_was_set) {
578 		unsigned char *esi = atmvcc->dev->esi;
579 		if (esi[0] | esi[1] | esi[2] | esi[3] | esi[4] | esi[5])
580 			memcpy(net_dev->dev_addr, esi, net_dev->addr_len);
581 		else
582 			net_dev->dev_addr[2] = 1;
583 	}
584 	list_add(&brvcc->brvccs, &brdev->brvccs);
585 	write_unlock_irq(&devs_lock);
586 	brvcc->device = net_dev;
587 	brvcc->atmvcc = atmvcc;
588 	atmvcc->user_back = brvcc;
589 	brvcc->encaps = (enum br2684_encaps)be.encaps;
590 	brvcc->old_push = atmvcc->push;
591 	brvcc->old_pop = atmvcc->pop;
592 	brvcc->old_release_cb = atmvcc->release_cb;
593 	brvcc->old_owner = atmvcc->owner;
594 	barrier();
595 	atmvcc->push = br2684_push;
596 	atmvcc->pop = br2684_pop;
597 	atmvcc->release_cb = br2684_release_cb;
598 	atmvcc->owner = THIS_MODULE;
599 
600 	/* initialize netdev carrier state */
601 	if (atmvcc->dev->signal == ATM_PHY_SIG_LOST)
602 		netif_carrier_off(net_dev);
603 	else
604 		netif_carrier_on(net_dev);
605 
606 	__module_get(THIS_MODULE);
607 
608 	/* re-process everything received between connection setup and
609 	   backend setup */
610 	vcc_process_recv_queue(atmvcc);
611 	return 0;
612 
613 error:
614 	write_unlock_irq(&devs_lock);
615 	kfree(brvcc);
616 	return err;
617 }
618 
619 static const struct net_device_ops br2684_netdev_ops = {
620 	.ndo_start_xmit 	= br2684_start_xmit,
621 	.ndo_set_mac_address	= br2684_mac_addr,
622 	.ndo_validate_addr	= eth_validate_addr,
623 };
624 
625 static const struct net_device_ops br2684_netdev_ops_routed = {
626 	.ndo_start_xmit 	= br2684_start_xmit,
627 	.ndo_set_mac_address	= br2684_mac_addr,
628 };
629 
630 static void br2684_setup(struct net_device *netdev)
631 {
632 	struct br2684_dev *brdev = BRPRIV(netdev);
633 
634 	ether_setup(netdev);
635 	netdev->hard_header_len += sizeof(llc_oui_pid_pad); /* worst case */
636 	brdev->net_dev = netdev;
637 
638 	netdev->netdev_ops = &br2684_netdev_ops;
639 
640 	INIT_LIST_HEAD(&brdev->brvccs);
641 }
642 
643 static void br2684_setup_routed(struct net_device *netdev)
644 {
645 	struct br2684_dev *brdev = BRPRIV(netdev);
646 
647 	brdev->net_dev = netdev;
648 	netdev->hard_header_len = sizeof(llc_oui_ipv4); /* worst case */
649 	netdev->netdev_ops = &br2684_netdev_ops_routed;
650 	netdev->addr_len = 0;
651 	netdev->mtu = ETH_DATA_LEN;
652 	netdev->min_mtu = 0;
653 	netdev->max_mtu = ETH_MAX_MTU;
654 	netdev->type = ARPHRD_PPP;
655 	netdev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
656 	netdev->tx_queue_len = 100;
657 	INIT_LIST_HEAD(&brdev->brvccs);
658 }
659 
660 static int br2684_create(void __user *arg)
661 {
662 	int err;
663 	struct net_device *netdev;
664 	struct br2684_dev *brdev;
665 	struct atm_newif_br2684 ni;
666 	enum br2684_payload payload;
667 
668 	pr_debug("\n");
669 
670 	if (copy_from_user(&ni, arg, sizeof ni))
671 		return -EFAULT;
672 
673 	if (ni.media & BR2684_FLAG_ROUTED)
674 		payload = p_routed;
675 	else
676 		payload = p_bridged;
677 	ni.media &= 0xffff;	/* strip flags */
678 
679 	if (ni.media != BR2684_MEDIA_ETHERNET || ni.mtu != 1500)
680 		return -EINVAL;
681 
682 	netdev = alloc_netdev(sizeof(struct br2684_dev),
683 			      ni.ifname[0] ? ni.ifname : "nas%d",
684 			      NET_NAME_UNKNOWN,
685 			      (payload == p_routed) ? br2684_setup_routed : br2684_setup);
686 	if (!netdev)
687 		return -ENOMEM;
688 
689 	brdev = BRPRIV(netdev);
690 
691 	pr_debug("registered netdev %s\n", netdev->name);
692 	/* open, stop, do_ioctl ? */
693 	err = register_netdev(netdev);
694 	if (err < 0) {
695 		pr_err("register_netdev failed\n");
696 		free_netdev(netdev);
697 		return err;
698 	}
699 
700 	write_lock_irq(&devs_lock);
701 
702 	brdev->payload = payload;
703 
704 	if (list_empty(&br2684_devs)) {
705 		/* 1st br2684 device */
706 		brdev->number = 1;
707 	} else
708 		brdev->number = BRPRIV(list_entry_brdev(br2684_devs.prev))->number + 1;
709 
710 	list_add_tail(&brdev->br2684_devs, &br2684_devs);
711 	write_unlock_irq(&devs_lock);
712 	return 0;
713 }
714 
715 /*
716  * This handles ioctls actually performed on our vcc - we must return
717  * -ENOIOCTLCMD for any unrecognized ioctl
718  */
719 static int br2684_ioctl(struct socket *sock, unsigned int cmd,
720 			unsigned long arg)
721 {
722 	struct atm_vcc *atmvcc = ATM_SD(sock);
723 	void __user *argp = (void __user *)arg;
724 	atm_backend_t b;
725 
726 	int err;
727 	switch (cmd) {
728 	case ATM_SETBACKEND:
729 	case ATM_NEWBACKENDIF:
730 		err = get_user(b, (atm_backend_t __user *) argp);
731 		if (err)
732 			return -EFAULT;
733 		if (b != ATM_BACKEND_BR2684)
734 			return -ENOIOCTLCMD;
735 		if (!capable(CAP_NET_ADMIN))
736 			return -EPERM;
737 		if (cmd == ATM_SETBACKEND) {
738 			if (sock->state != SS_CONNECTED)
739 				return -EINVAL;
740 			return br2684_regvcc(atmvcc, argp);
741 		} else {
742 			return br2684_create(argp);
743 		}
744 #ifdef CONFIG_ATM_BR2684_IPFILTER
745 	case BR2684_SETFILT:
746 		if (atmvcc->push != br2684_push)
747 			return -ENOIOCTLCMD;
748 		if (!capable(CAP_NET_ADMIN))
749 			return -EPERM;
750 		err = br2684_setfilt(atmvcc, argp);
751 
752 		return err;
753 #endif /* CONFIG_ATM_BR2684_IPFILTER */
754 	}
755 	return -ENOIOCTLCMD;
756 }
757 
758 static struct atm_ioctl br2684_ioctl_ops = {
759 	.owner = THIS_MODULE,
760 	.ioctl = br2684_ioctl,
761 };
762 
763 #ifdef CONFIG_PROC_FS
764 static void *br2684_seq_start(struct seq_file *seq, loff_t * pos)
765 	__acquires(devs_lock)
766 {
767 	read_lock(&devs_lock);
768 	return seq_list_start(&br2684_devs, *pos);
769 }
770 
771 static void *br2684_seq_next(struct seq_file *seq, void *v, loff_t * pos)
772 {
773 	return seq_list_next(v, &br2684_devs, pos);
774 }
775 
776 static void br2684_seq_stop(struct seq_file *seq, void *v)
777 	__releases(devs_lock)
778 {
779 	read_unlock(&devs_lock);
780 }
781 
782 static int br2684_seq_show(struct seq_file *seq, void *v)
783 {
784 	const struct br2684_dev *brdev = list_entry(v, struct br2684_dev,
785 						    br2684_devs);
786 	const struct net_device *net_dev = brdev->net_dev;
787 	const struct br2684_vcc *brvcc;
788 
789 	seq_printf(seq, "dev %.16s: num=%d, mac=%pM (%s)\n",
790 		   net_dev->name,
791 		   brdev->number,
792 		   net_dev->dev_addr,
793 		   brdev->mac_was_set ? "set" : "auto");
794 
795 	list_for_each_entry(brvcc, &brdev->brvccs, brvccs) {
796 		seq_printf(seq, "  vcc %d.%d.%d: encaps=%s payload=%s"
797 			   ", failed copies %u/%u"
798 			   "\n", brvcc->atmvcc->dev->number,
799 			   brvcc->atmvcc->vpi, brvcc->atmvcc->vci,
800 			   (brvcc->encaps == e_llc) ? "LLC" : "VC",
801 			   (brdev->payload == p_bridged) ? "bridged" : "routed",
802 			   brvcc->copies_failed, brvcc->copies_needed);
803 #ifdef CONFIG_ATM_BR2684_IPFILTER
804 		if (brvcc->filter.netmask != 0)
805 			seq_printf(seq, "    filter=%pI4/%pI4\n",
806 				   &brvcc->filter.prefix,
807 				   &brvcc->filter.netmask);
808 #endif /* CONFIG_ATM_BR2684_IPFILTER */
809 	}
810 	return 0;
811 }
812 
813 static const struct seq_operations br2684_seq_ops = {
814 	.start = br2684_seq_start,
815 	.next = br2684_seq_next,
816 	.stop = br2684_seq_stop,
817 	.show = br2684_seq_show,
818 };
819 
820 extern struct proc_dir_entry *atm_proc_root;	/* from proc.c */
821 #endif /* CONFIG_PROC_FS */
822 
823 static int __init br2684_init(void)
824 {
825 #ifdef CONFIG_PROC_FS
826 	struct proc_dir_entry *p;
827 	p = proc_create_seq("br2684", 0, atm_proc_root, &br2684_seq_ops);
828 	if (p == NULL)
829 		return -ENOMEM;
830 #endif
831 	register_atm_ioctl(&br2684_ioctl_ops);
832 	register_atmdevice_notifier(&atm_dev_notifier);
833 	return 0;
834 }
835 
836 static void __exit br2684_exit(void)
837 {
838 	struct net_device *net_dev;
839 	struct br2684_dev *brdev;
840 	struct br2684_vcc *brvcc;
841 	deregister_atm_ioctl(&br2684_ioctl_ops);
842 
843 #ifdef CONFIG_PROC_FS
844 	remove_proc_entry("br2684", atm_proc_root);
845 #endif
846 
847 
848 	unregister_atmdevice_notifier(&atm_dev_notifier);
849 
850 	while (!list_empty(&br2684_devs)) {
851 		net_dev = list_entry_brdev(br2684_devs.next);
852 		brdev = BRPRIV(net_dev);
853 		while (!list_empty(&brdev->brvccs)) {
854 			brvcc = list_entry_brvcc(brdev->brvccs.next);
855 			br2684_close_vcc(brvcc);
856 		}
857 
858 		list_del(&brdev->br2684_devs);
859 		unregister_netdev(net_dev);
860 		free_netdev(net_dev);
861 	}
862 }
863 
864 module_init(br2684_init);
865 module_exit(br2684_exit);
866 
867 MODULE_AUTHOR("Marcell GAL");
868 MODULE_DESCRIPTION("RFC2684 bridged protocols over ATM/AAL5");
869 MODULE_LICENSE("GPL");
870