1 // SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) 2 /* isotp.c - ISO 15765-2 CAN transport protocol for protocol family CAN 3 * 4 * This implementation does not provide ISO-TP specific return values to the 5 * userspace. 6 * 7 * - RX path timeout of data reception leads to -ETIMEDOUT 8 * - RX path SN mismatch leads to -EILSEQ 9 * - RX path data reception with wrong padding leads to -EBADMSG 10 * - TX path flowcontrol reception timeout leads to -ECOMM 11 * - TX path flowcontrol reception overflow leads to -EMSGSIZE 12 * - TX path flowcontrol reception with wrong layout/padding leads to -EBADMSG 13 * - when a transfer (tx) is on the run the next write() blocks until it's done 14 * - use CAN_ISOTP_WAIT_TX_DONE flag to block the caller until the PDU is sent 15 * - as we have static buffers the check whether the PDU fits into the buffer 16 * is done at FF reception time (no support for sending 'wait frames') 17 * 18 * Copyright (c) 2020 Volkswagen Group Electronic Research 19 * All rights reserved. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 3. Neither the name of Volkswagen nor the names of its contributors 30 * may be used to endorse or promote products derived from this software 31 * without specific prior written permission. 32 * 33 * Alternatively, provided that this notice is retained in full, this 34 * software may be distributed under the terms of the GNU General 35 * Public License ("GPL") version 2, in which case the provisions of the 36 * GPL apply INSTEAD OF those given above. 37 * 38 * The provided data structures and external interfaces from this code 39 * are not restricted to be used by modules with a GPL compatible license. 40 * 41 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 42 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 43 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 44 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 45 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 46 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 47 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 48 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 49 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 50 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 51 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 52 * DAMAGE. 53 */ 54 55 #include <linux/module.h> 56 #include <linux/init.h> 57 #include <linux/interrupt.h> 58 #include <linux/spinlock.h> 59 #include <linux/hrtimer.h> 60 #include <linux/wait.h> 61 #include <linux/uio.h> 62 #include <linux/net.h> 63 #include <linux/netdevice.h> 64 #include <linux/socket.h> 65 #include <linux/if_arp.h> 66 #include <linux/skbuff.h> 67 #include <linux/can.h> 68 #include <linux/can/core.h> 69 #include <linux/can/skb.h> 70 #include <linux/can/isotp.h> 71 #include <linux/slab.h> 72 #include <net/sock.h> 73 #include <net/net_namespace.h> 74 75 MODULE_DESCRIPTION("PF_CAN isotp 15765-2:2016 protocol"); 76 MODULE_LICENSE("Dual BSD/GPL"); 77 MODULE_AUTHOR("Oliver Hartkopp <socketcan@hartkopp.net>"); 78 MODULE_ALIAS("can-proto-6"); 79 80 #define ISOTP_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp) 81 82 #define SINGLE_MASK(id) (((id) & CAN_EFF_FLAG) ? \ 83 (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \ 84 (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG)) 85 86 /* ISO 15765-2:2016 supports more than 4095 byte per ISO PDU as the FF_DL can 87 * take full 32 bit values (4 Gbyte). We would need some good concept to handle 88 * this between user space and kernel space. For now increase the static buffer 89 * to something about 64 kbyte to be able to test this new functionality. 90 */ 91 #define MAX_MSG_LENGTH 66000 92 93 /* N_PCI type values in bits 7-4 of N_PCI bytes */ 94 #define N_PCI_SF 0x00 /* single frame */ 95 #define N_PCI_FF 0x10 /* first frame */ 96 #define N_PCI_CF 0x20 /* consecutive frame */ 97 #define N_PCI_FC 0x30 /* flow control */ 98 99 #define N_PCI_SZ 1 /* size of the PCI byte #1 */ 100 #define SF_PCI_SZ4 1 /* size of SingleFrame PCI including 4 bit SF_DL */ 101 #define SF_PCI_SZ8 2 /* size of SingleFrame PCI including 8 bit SF_DL */ 102 #define FF_PCI_SZ12 2 /* size of FirstFrame PCI including 12 bit FF_DL */ 103 #define FF_PCI_SZ32 6 /* size of FirstFrame PCI including 32 bit FF_DL */ 104 #define FC_CONTENT_SZ 3 /* flow control content size in byte (FS/BS/STmin) */ 105 106 #define ISOTP_CHECK_PADDING (CAN_ISOTP_CHK_PAD_LEN | CAN_ISOTP_CHK_PAD_DATA) 107 108 /* Flow Status given in FC frame */ 109 #define ISOTP_FC_CTS 0 /* clear to send */ 110 #define ISOTP_FC_WT 1 /* wait */ 111 #define ISOTP_FC_OVFLW 2 /* overflow */ 112 113 enum { 114 ISOTP_IDLE = 0, 115 ISOTP_WAIT_FIRST_FC, 116 ISOTP_WAIT_FC, 117 ISOTP_WAIT_DATA, 118 ISOTP_SENDING 119 }; 120 121 struct tpcon { 122 unsigned int idx; 123 unsigned int len; 124 u32 state; 125 u8 bs; 126 u8 sn; 127 u8 ll_dl; 128 u8 buf[MAX_MSG_LENGTH + 1]; 129 }; 130 131 struct isotp_sock { 132 struct sock sk; 133 int bound; 134 int ifindex; 135 canid_t txid; 136 canid_t rxid; 137 ktime_t tx_gap; 138 ktime_t lastrxcf_tstamp; 139 struct hrtimer rxtimer, txtimer; 140 struct can_isotp_options opt; 141 struct can_isotp_fc_options rxfc, txfc; 142 struct can_isotp_ll_options ll; 143 u32 frame_txtime; 144 u32 force_tx_stmin; 145 u32 force_rx_stmin; 146 u32 cfecho; /* consecutive frame echo tag */ 147 struct tpcon rx, tx; 148 struct list_head notifier; 149 wait_queue_head_t wait; 150 spinlock_t rx_lock; /* protect single thread state machine */ 151 }; 152 153 static LIST_HEAD(isotp_notifier_list); 154 static DEFINE_SPINLOCK(isotp_notifier_lock); 155 static struct isotp_sock *isotp_busy_notifier; 156 157 static inline struct isotp_sock *isotp_sk(const struct sock *sk) 158 { 159 return (struct isotp_sock *)sk; 160 } 161 162 static enum hrtimer_restart isotp_rx_timer_handler(struct hrtimer *hrtimer) 163 { 164 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 165 rxtimer); 166 struct sock *sk = &so->sk; 167 168 if (so->rx.state == ISOTP_WAIT_DATA) { 169 /* we did not get new data frames in time */ 170 171 /* report 'connection timed out' */ 172 sk->sk_err = ETIMEDOUT; 173 if (!sock_flag(sk, SOCK_DEAD)) 174 sk_error_report(sk); 175 176 /* reset rx state */ 177 so->rx.state = ISOTP_IDLE; 178 } 179 180 return HRTIMER_NORESTART; 181 } 182 183 static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) 184 { 185 struct net_device *dev; 186 struct sk_buff *nskb; 187 struct canfd_frame *ncf; 188 struct isotp_sock *so = isotp_sk(sk); 189 int can_send_ret; 190 191 nskb = alloc_skb(so->ll.mtu + sizeof(struct can_skb_priv), gfp_any()); 192 if (!nskb) 193 return 1; 194 195 dev = dev_get_by_index(sock_net(sk), so->ifindex); 196 if (!dev) { 197 kfree_skb(nskb); 198 return 1; 199 } 200 201 can_skb_reserve(nskb); 202 can_skb_prv(nskb)->ifindex = dev->ifindex; 203 can_skb_prv(nskb)->skbcnt = 0; 204 205 nskb->dev = dev; 206 can_skb_set_owner(nskb, sk); 207 ncf = (struct canfd_frame *)nskb->data; 208 skb_put_zero(nskb, so->ll.mtu); 209 210 /* create & send flow control reply */ 211 ncf->can_id = so->txid; 212 213 if (so->opt.flags & CAN_ISOTP_TX_PADDING) { 214 memset(ncf->data, so->opt.txpad_content, CAN_MAX_DLEN); 215 ncf->len = CAN_MAX_DLEN; 216 } else { 217 ncf->len = ae + FC_CONTENT_SZ; 218 } 219 220 ncf->data[ae] = N_PCI_FC | flowstatus; 221 ncf->data[ae + 1] = so->rxfc.bs; 222 ncf->data[ae + 2] = so->rxfc.stmin; 223 224 if (ae) 225 ncf->data[0] = so->opt.ext_address; 226 227 ncf->flags = so->ll.tx_flags; 228 229 can_send_ret = can_send(nskb, 1); 230 if (can_send_ret) 231 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 232 __func__, ERR_PTR(can_send_ret)); 233 234 dev_put(dev); 235 236 /* reset blocksize counter */ 237 so->rx.bs = 0; 238 239 /* reset last CF frame rx timestamp for rx stmin enforcement */ 240 so->lastrxcf_tstamp = ktime_set(0, 0); 241 242 /* start rx timeout watchdog */ 243 hrtimer_start(&so->rxtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT); 244 return 0; 245 } 246 247 static void isotp_rcv_skb(struct sk_buff *skb, struct sock *sk) 248 { 249 struct sockaddr_can *addr = (struct sockaddr_can *)skb->cb; 250 251 BUILD_BUG_ON(sizeof(skb->cb) < sizeof(struct sockaddr_can)); 252 253 memset(addr, 0, sizeof(*addr)); 254 addr->can_family = AF_CAN; 255 addr->can_ifindex = skb->dev->ifindex; 256 257 if (sock_queue_rcv_skb(sk, skb) < 0) 258 kfree_skb(skb); 259 } 260 261 static u8 padlen(u8 datalen) 262 { 263 static const u8 plen[] = { 264 8, 8, 8, 8, 8, 8, 8, 8, 8, /* 0 - 8 */ 265 12, 12, 12, 12, /* 9 - 12 */ 266 16, 16, 16, 16, /* 13 - 16 */ 267 20, 20, 20, 20, /* 17 - 20 */ 268 24, 24, 24, 24, /* 21 - 24 */ 269 32, 32, 32, 32, 32, 32, 32, 32, /* 25 - 32 */ 270 48, 48, 48, 48, 48, 48, 48, 48, /* 33 - 40 */ 271 48, 48, 48, 48, 48, 48, 48, 48 /* 41 - 48 */ 272 }; 273 274 if (datalen > 48) 275 return 64; 276 277 return plen[datalen]; 278 } 279 280 /* check for length optimization and return 1/true when the check fails */ 281 static int check_optimized(struct canfd_frame *cf, int start_index) 282 { 283 /* for CAN_DL <= 8 the start_index is equal to the CAN_DL as the 284 * padding would start at this point. E.g. if the padding would 285 * start at cf.data[7] cf->len has to be 7 to be optimal. 286 * Note: The data[] index starts with zero. 287 */ 288 if (cf->len <= CAN_MAX_DLEN) 289 return (cf->len != start_index); 290 291 /* This relation is also valid in the non-linear DLC range, where 292 * we need to take care of the minimal next possible CAN_DL. 293 * The correct check would be (padlen(cf->len) != padlen(start_index)). 294 * But as cf->len can only take discrete values from 12, .., 64 at this 295 * point the padlen(cf->len) is always equal to cf->len. 296 */ 297 return (cf->len != padlen(start_index)); 298 } 299 300 /* check padding and return 1/true when the check fails */ 301 static int check_pad(struct isotp_sock *so, struct canfd_frame *cf, 302 int start_index, u8 content) 303 { 304 int i; 305 306 /* no RX_PADDING value => check length of optimized frame length */ 307 if (!(so->opt.flags & CAN_ISOTP_RX_PADDING)) { 308 if (so->opt.flags & CAN_ISOTP_CHK_PAD_LEN) 309 return check_optimized(cf, start_index); 310 311 /* no valid test against empty value => ignore frame */ 312 return 1; 313 } 314 315 /* check datalength of correctly padded CAN frame */ 316 if ((so->opt.flags & CAN_ISOTP_CHK_PAD_LEN) && 317 cf->len != padlen(cf->len)) 318 return 1; 319 320 /* check padding content */ 321 if (so->opt.flags & CAN_ISOTP_CHK_PAD_DATA) { 322 for (i = start_index; i < cf->len; i++) 323 if (cf->data[i] != content) 324 return 1; 325 } 326 return 0; 327 } 328 329 static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) 330 { 331 struct sock *sk = &so->sk; 332 333 if (so->tx.state != ISOTP_WAIT_FC && 334 so->tx.state != ISOTP_WAIT_FIRST_FC) 335 return 0; 336 337 hrtimer_cancel(&so->txtimer); 338 339 if ((cf->len < ae + FC_CONTENT_SZ) || 340 ((so->opt.flags & ISOTP_CHECK_PADDING) && 341 check_pad(so, cf, ae + FC_CONTENT_SZ, so->opt.rxpad_content))) { 342 /* malformed PDU - report 'not a data message' */ 343 sk->sk_err = EBADMSG; 344 if (!sock_flag(sk, SOCK_DEAD)) 345 sk_error_report(sk); 346 347 so->tx.state = ISOTP_IDLE; 348 wake_up_interruptible(&so->wait); 349 return 1; 350 } 351 352 /* get communication parameters only from the first FC frame */ 353 if (so->tx.state == ISOTP_WAIT_FIRST_FC) { 354 so->txfc.bs = cf->data[ae + 1]; 355 so->txfc.stmin = cf->data[ae + 2]; 356 357 /* fix wrong STmin values according spec */ 358 if (so->txfc.stmin > 0x7F && 359 (so->txfc.stmin < 0xF1 || so->txfc.stmin > 0xF9)) 360 so->txfc.stmin = 0x7F; 361 362 so->tx_gap = ktime_set(0, 0); 363 /* add transmission time for CAN frame N_As */ 364 so->tx_gap = ktime_add_ns(so->tx_gap, so->frame_txtime); 365 /* add waiting time for consecutive frames N_Cs */ 366 if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) 367 so->tx_gap = ktime_add_ns(so->tx_gap, 368 so->force_tx_stmin); 369 else if (so->txfc.stmin < 0x80) 370 so->tx_gap = ktime_add_ns(so->tx_gap, 371 so->txfc.stmin * 1000000); 372 else 373 so->tx_gap = ktime_add_ns(so->tx_gap, 374 (so->txfc.stmin - 0xF0) 375 * 100000); 376 so->tx.state = ISOTP_WAIT_FC; 377 } 378 379 switch (cf->data[ae] & 0x0F) { 380 case ISOTP_FC_CTS: 381 so->tx.bs = 0; 382 so->tx.state = ISOTP_SENDING; 383 /* start cyclic timer for sending CF frame */ 384 hrtimer_start(&so->txtimer, so->tx_gap, 385 HRTIMER_MODE_REL_SOFT); 386 break; 387 388 case ISOTP_FC_WT: 389 /* start timer to wait for next FC frame */ 390 hrtimer_start(&so->txtimer, ktime_set(1, 0), 391 HRTIMER_MODE_REL_SOFT); 392 break; 393 394 case ISOTP_FC_OVFLW: 395 /* overflow on receiver side - report 'message too long' */ 396 sk->sk_err = EMSGSIZE; 397 if (!sock_flag(sk, SOCK_DEAD)) 398 sk_error_report(sk); 399 fallthrough; 400 401 default: 402 /* stop this tx job */ 403 so->tx.state = ISOTP_IDLE; 404 wake_up_interruptible(&so->wait); 405 } 406 return 0; 407 } 408 409 static int isotp_rcv_sf(struct sock *sk, struct canfd_frame *cf, int pcilen, 410 struct sk_buff *skb, int len) 411 { 412 struct isotp_sock *so = isotp_sk(sk); 413 struct sk_buff *nskb; 414 415 hrtimer_cancel(&so->rxtimer); 416 so->rx.state = ISOTP_IDLE; 417 418 if (!len || len > cf->len - pcilen) 419 return 1; 420 421 if ((so->opt.flags & ISOTP_CHECK_PADDING) && 422 check_pad(so, cf, pcilen + len, so->opt.rxpad_content)) { 423 /* malformed PDU - report 'not a data message' */ 424 sk->sk_err = EBADMSG; 425 if (!sock_flag(sk, SOCK_DEAD)) 426 sk_error_report(sk); 427 return 1; 428 } 429 430 nskb = alloc_skb(len, gfp_any()); 431 if (!nskb) 432 return 1; 433 434 memcpy(skb_put(nskb, len), &cf->data[pcilen], len); 435 436 nskb->tstamp = skb->tstamp; 437 nskb->dev = skb->dev; 438 isotp_rcv_skb(nskb, sk); 439 return 0; 440 } 441 442 static int isotp_rcv_ff(struct sock *sk, struct canfd_frame *cf, int ae) 443 { 444 struct isotp_sock *so = isotp_sk(sk); 445 int i; 446 int off; 447 int ff_pci_sz; 448 449 hrtimer_cancel(&so->rxtimer); 450 so->rx.state = ISOTP_IDLE; 451 452 /* get the used sender LL_DL from the (first) CAN frame data length */ 453 so->rx.ll_dl = padlen(cf->len); 454 455 /* the first frame has to use the entire frame up to LL_DL length */ 456 if (cf->len != so->rx.ll_dl) 457 return 1; 458 459 /* get the FF_DL */ 460 so->rx.len = (cf->data[ae] & 0x0F) << 8; 461 so->rx.len += cf->data[ae + 1]; 462 463 /* Check for FF_DL escape sequence supporting 32 bit PDU length */ 464 if (so->rx.len) { 465 ff_pci_sz = FF_PCI_SZ12; 466 } else { 467 /* FF_DL = 0 => get real length from next 4 bytes */ 468 so->rx.len = cf->data[ae + 2] << 24; 469 so->rx.len += cf->data[ae + 3] << 16; 470 so->rx.len += cf->data[ae + 4] << 8; 471 so->rx.len += cf->data[ae + 5]; 472 ff_pci_sz = FF_PCI_SZ32; 473 } 474 475 /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ 476 off = (so->rx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; 477 478 if (so->rx.len + ae + off + ff_pci_sz < so->rx.ll_dl) 479 return 1; 480 481 if (so->rx.len > MAX_MSG_LENGTH) { 482 /* send FC frame with overflow status */ 483 isotp_send_fc(sk, ae, ISOTP_FC_OVFLW); 484 return 1; 485 } 486 487 /* copy the first received data bytes */ 488 so->rx.idx = 0; 489 for (i = ae + ff_pci_sz; i < so->rx.ll_dl; i++) 490 so->rx.buf[so->rx.idx++] = cf->data[i]; 491 492 /* initial setup for this pdu reception */ 493 so->rx.sn = 1; 494 so->rx.state = ISOTP_WAIT_DATA; 495 496 /* no creation of flow control frames */ 497 if (so->opt.flags & CAN_ISOTP_LISTEN_MODE) 498 return 0; 499 500 /* send our first FC frame */ 501 isotp_send_fc(sk, ae, ISOTP_FC_CTS); 502 return 0; 503 } 504 505 static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae, 506 struct sk_buff *skb) 507 { 508 struct isotp_sock *so = isotp_sk(sk); 509 struct sk_buff *nskb; 510 int i; 511 512 if (so->rx.state != ISOTP_WAIT_DATA) 513 return 0; 514 515 /* drop if timestamp gap is less than force_rx_stmin nano secs */ 516 if (so->opt.flags & CAN_ISOTP_FORCE_RXSTMIN) { 517 if (ktime_to_ns(ktime_sub(skb->tstamp, so->lastrxcf_tstamp)) < 518 so->force_rx_stmin) 519 return 0; 520 521 so->lastrxcf_tstamp = skb->tstamp; 522 } 523 524 hrtimer_cancel(&so->rxtimer); 525 526 /* CFs are never longer than the FF */ 527 if (cf->len > so->rx.ll_dl) 528 return 1; 529 530 /* CFs have usually the LL_DL length */ 531 if (cf->len < so->rx.ll_dl) { 532 /* this is only allowed for the last CF */ 533 if (so->rx.len - so->rx.idx > so->rx.ll_dl - ae - N_PCI_SZ) 534 return 1; 535 } 536 537 if ((cf->data[ae] & 0x0F) != so->rx.sn) { 538 /* wrong sn detected - report 'illegal byte sequence' */ 539 sk->sk_err = EILSEQ; 540 if (!sock_flag(sk, SOCK_DEAD)) 541 sk_error_report(sk); 542 543 /* reset rx state */ 544 so->rx.state = ISOTP_IDLE; 545 return 1; 546 } 547 so->rx.sn++; 548 so->rx.sn %= 16; 549 550 for (i = ae + N_PCI_SZ; i < cf->len; i++) { 551 so->rx.buf[so->rx.idx++] = cf->data[i]; 552 if (so->rx.idx >= so->rx.len) 553 break; 554 } 555 556 if (so->rx.idx >= so->rx.len) { 557 /* we are done */ 558 so->rx.state = ISOTP_IDLE; 559 560 if ((so->opt.flags & ISOTP_CHECK_PADDING) && 561 check_pad(so, cf, i + 1, so->opt.rxpad_content)) { 562 /* malformed PDU - report 'not a data message' */ 563 sk->sk_err = EBADMSG; 564 if (!sock_flag(sk, SOCK_DEAD)) 565 sk_error_report(sk); 566 return 1; 567 } 568 569 nskb = alloc_skb(so->rx.len, gfp_any()); 570 if (!nskb) 571 return 1; 572 573 memcpy(skb_put(nskb, so->rx.len), so->rx.buf, 574 so->rx.len); 575 576 nskb->tstamp = skb->tstamp; 577 nskb->dev = skb->dev; 578 isotp_rcv_skb(nskb, sk); 579 return 0; 580 } 581 582 /* perform blocksize handling, if enabled */ 583 if (!so->rxfc.bs || ++so->rx.bs < so->rxfc.bs) { 584 /* start rx timeout watchdog */ 585 hrtimer_start(&so->rxtimer, ktime_set(1, 0), 586 HRTIMER_MODE_REL_SOFT); 587 return 0; 588 } 589 590 /* no creation of flow control frames */ 591 if (so->opt.flags & CAN_ISOTP_LISTEN_MODE) 592 return 0; 593 594 /* we reached the specified blocksize so->rxfc.bs */ 595 isotp_send_fc(sk, ae, ISOTP_FC_CTS); 596 return 0; 597 } 598 599 static void isotp_rcv(struct sk_buff *skb, void *data) 600 { 601 struct sock *sk = (struct sock *)data; 602 struct isotp_sock *so = isotp_sk(sk); 603 struct canfd_frame *cf; 604 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 605 u8 n_pci_type, sf_dl; 606 607 /* Strictly receive only frames with the configured MTU size 608 * => clear separation of CAN2.0 / CAN FD transport channels 609 */ 610 if (skb->len != so->ll.mtu) 611 return; 612 613 cf = (struct canfd_frame *)skb->data; 614 615 /* if enabled: check reception of my configured extended address */ 616 if (ae && cf->data[0] != so->opt.rx_ext_address) 617 return; 618 619 n_pci_type = cf->data[ae] & 0xF0; 620 621 /* Make sure the state changes and data structures stay consistent at 622 * CAN frame reception time. This locking is not needed in real world 623 * use cases but the inconsistency can be triggered with syzkaller. 624 */ 625 spin_lock(&so->rx_lock); 626 627 if (so->opt.flags & CAN_ISOTP_HALF_DUPLEX) { 628 /* check rx/tx path half duplex expectations */ 629 if ((so->tx.state != ISOTP_IDLE && n_pci_type != N_PCI_FC) || 630 (so->rx.state != ISOTP_IDLE && n_pci_type == N_PCI_FC)) 631 goto out_unlock; 632 } 633 634 switch (n_pci_type) { 635 case N_PCI_FC: 636 /* tx path: flow control frame containing the FC parameters */ 637 isotp_rcv_fc(so, cf, ae); 638 break; 639 640 case N_PCI_SF: 641 /* rx path: single frame 642 * 643 * As we do not have a rx.ll_dl configuration, we can only test 644 * if the CAN frames payload length matches the LL_DL == 8 645 * requirements - no matter if it's CAN 2.0 or CAN FD 646 */ 647 648 /* get the SF_DL from the N_PCI byte */ 649 sf_dl = cf->data[ae] & 0x0F; 650 651 if (cf->len <= CAN_MAX_DLEN) { 652 isotp_rcv_sf(sk, cf, SF_PCI_SZ4 + ae, skb, sf_dl); 653 } else { 654 if (skb->len == CANFD_MTU) { 655 /* We have a CAN FD frame and CAN_DL is greater than 8: 656 * Only frames with the SF_DL == 0 ESC value are valid. 657 * 658 * If so take care of the increased SF PCI size 659 * (SF_PCI_SZ8) to point to the message content behind 660 * the extended SF PCI info and get the real SF_DL 661 * length value from the formerly first data byte. 662 */ 663 if (sf_dl == 0) 664 isotp_rcv_sf(sk, cf, SF_PCI_SZ8 + ae, skb, 665 cf->data[SF_PCI_SZ4 + ae]); 666 } 667 } 668 break; 669 670 case N_PCI_FF: 671 /* rx path: first frame */ 672 isotp_rcv_ff(sk, cf, ae); 673 break; 674 675 case N_PCI_CF: 676 /* rx path: consecutive frame */ 677 isotp_rcv_cf(sk, cf, ae, skb); 678 break; 679 } 680 681 out_unlock: 682 spin_unlock(&so->rx_lock); 683 } 684 685 static void isotp_fill_dataframe(struct canfd_frame *cf, struct isotp_sock *so, 686 int ae, int off) 687 { 688 int pcilen = N_PCI_SZ + ae + off; 689 int space = so->tx.ll_dl - pcilen; 690 int num = min_t(int, so->tx.len - so->tx.idx, space); 691 int i; 692 693 cf->can_id = so->txid; 694 cf->len = num + pcilen; 695 696 if (num < space) { 697 if (so->opt.flags & CAN_ISOTP_TX_PADDING) { 698 /* user requested padding */ 699 cf->len = padlen(cf->len); 700 memset(cf->data, so->opt.txpad_content, cf->len); 701 } else if (cf->len > CAN_MAX_DLEN) { 702 /* mandatory padding for CAN FD frames */ 703 cf->len = padlen(cf->len); 704 memset(cf->data, CAN_ISOTP_DEFAULT_PAD_CONTENT, 705 cf->len); 706 } 707 } 708 709 for (i = 0; i < num; i++) 710 cf->data[pcilen + i] = so->tx.buf[so->tx.idx++]; 711 712 if (ae) 713 cf->data[0] = so->opt.ext_address; 714 } 715 716 static void isotp_send_cframe(struct isotp_sock *so) 717 { 718 struct sock *sk = &so->sk; 719 struct sk_buff *skb; 720 struct net_device *dev; 721 struct canfd_frame *cf; 722 int can_send_ret; 723 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 724 725 dev = dev_get_by_index(sock_net(sk), so->ifindex); 726 if (!dev) 727 return; 728 729 skb = alloc_skb(so->ll.mtu + sizeof(struct can_skb_priv), GFP_ATOMIC); 730 if (!skb) { 731 dev_put(dev); 732 return; 733 } 734 735 can_skb_reserve(skb); 736 can_skb_prv(skb)->ifindex = dev->ifindex; 737 can_skb_prv(skb)->skbcnt = 0; 738 739 cf = (struct canfd_frame *)skb->data; 740 skb_put_zero(skb, so->ll.mtu); 741 742 /* create consecutive frame */ 743 isotp_fill_dataframe(cf, so, ae, 0); 744 745 /* place consecutive frame N_PCI in appropriate index */ 746 cf->data[ae] = N_PCI_CF | so->tx.sn++; 747 so->tx.sn %= 16; 748 so->tx.bs++; 749 750 cf->flags = so->ll.tx_flags; 751 752 skb->dev = dev; 753 can_skb_set_owner(skb, sk); 754 755 /* cfecho should have been zero'ed by init/isotp_rcv_echo() */ 756 if (so->cfecho) 757 pr_notice_once("can-isotp: cfecho is %08X != 0\n", so->cfecho); 758 759 /* set consecutive frame echo tag */ 760 so->cfecho = *(u32 *)cf->data; 761 762 /* send frame with local echo enabled */ 763 can_send_ret = can_send(skb, 1); 764 if (can_send_ret) { 765 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 766 __func__, ERR_PTR(can_send_ret)); 767 if (can_send_ret == -ENOBUFS) 768 pr_notice_once("can-isotp: tx queue is full\n"); 769 } 770 dev_put(dev); 771 } 772 773 static void isotp_create_fframe(struct canfd_frame *cf, struct isotp_sock *so, 774 int ae) 775 { 776 int i; 777 int ff_pci_sz; 778 779 cf->can_id = so->txid; 780 cf->len = so->tx.ll_dl; 781 if (ae) 782 cf->data[0] = so->opt.ext_address; 783 784 /* create N_PCI bytes with 12/32 bit FF_DL data length */ 785 if (so->tx.len > 4095) { 786 /* use 32 bit FF_DL notation */ 787 cf->data[ae] = N_PCI_FF; 788 cf->data[ae + 1] = 0; 789 cf->data[ae + 2] = (u8)(so->tx.len >> 24) & 0xFFU; 790 cf->data[ae + 3] = (u8)(so->tx.len >> 16) & 0xFFU; 791 cf->data[ae + 4] = (u8)(so->tx.len >> 8) & 0xFFU; 792 cf->data[ae + 5] = (u8)so->tx.len & 0xFFU; 793 ff_pci_sz = FF_PCI_SZ32; 794 } else { 795 /* use 12 bit FF_DL notation */ 796 cf->data[ae] = (u8)(so->tx.len >> 8) | N_PCI_FF; 797 cf->data[ae + 1] = (u8)so->tx.len & 0xFFU; 798 ff_pci_sz = FF_PCI_SZ12; 799 } 800 801 /* add first data bytes depending on ae */ 802 for (i = ae + ff_pci_sz; i < so->tx.ll_dl; i++) 803 cf->data[i] = so->tx.buf[so->tx.idx++]; 804 805 so->tx.sn = 1; 806 so->tx.state = ISOTP_WAIT_FIRST_FC; 807 } 808 809 static void isotp_rcv_echo(struct sk_buff *skb, void *data) 810 { 811 struct sock *sk = (struct sock *)data; 812 struct isotp_sock *so = isotp_sk(sk); 813 struct canfd_frame *cf = (struct canfd_frame *)skb->data; 814 815 /* only handle my own local echo skb's */ 816 if (skb->sk != sk || so->cfecho != *(u32 *)cf->data) 817 return; 818 819 /* cancel local echo timeout */ 820 hrtimer_cancel(&so->txtimer); 821 822 /* local echo skb with consecutive frame has been consumed */ 823 so->cfecho = 0; 824 825 if (so->tx.idx >= so->tx.len) { 826 /* we are done */ 827 so->tx.state = ISOTP_IDLE; 828 wake_up_interruptible(&so->wait); 829 return; 830 } 831 832 if (so->txfc.bs && so->tx.bs >= so->txfc.bs) { 833 /* stop and wait for FC with timeout */ 834 so->tx.state = ISOTP_WAIT_FC; 835 hrtimer_start(&so->txtimer, ktime_set(1, 0), 836 HRTIMER_MODE_REL_SOFT); 837 return; 838 } 839 840 /* no gap between data frames needed => use burst mode */ 841 if (!so->tx_gap) { 842 isotp_send_cframe(so); 843 return; 844 } 845 846 /* start timer to send next consecutive frame with correct delay */ 847 hrtimer_start(&so->txtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT); 848 } 849 850 static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer) 851 { 852 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 853 txtimer); 854 struct sock *sk = &so->sk; 855 enum hrtimer_restart restart = HRTIMER_NORESTART; 856 857 switch (so->tx.state) { 858 case ISOTP_SENDING: 859 860 /* cfecho should be consumed by isotp_rcv_echo() here */ 861 if (!so->cfecho) { 862 /* start timeout for unlikely lost echo skb */ 863 hrtimer_set_expires(&so->txtimer, 864 ktime_add(ktime_get(), 865 ktime_set(2, 0))); 866 restart = HRTIMER_RESTART; 867 868 /* push out the next consecutive frame */ 869 isotp_send_cframe(so); 870 break; 871 } 872 873 /* cfecho has not been cleared in isotp_rcv_echo() */ 874 pr_notice_once("can-isotp: cfecho %08X timeout\n", so->cfecho); 875 fallthrough; 876 877 case ISOTP_WAIT_FC: 878 case ISOTP_WAIT_FIRST_FC: 879 880 /* we did not get any flow control frame in time */ 881 882 /* report 'communication error on send' */ 883 sk->sk_err = ECOMM; 884 if (!sock_flag(sk, SOCK_DEAD)) 885 sk_error_report(sk); 886 887 /* reset tx state */ 888 so->tx.state = ISOTP_IDLE; 889 wake_up_interruptible(&so->wait); 890 break; 891 892 default: 893 WARN_ON_ONCE(1); 894 } 895 896 return restart; 897 } 898 899 static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 900 { 901 struct sock *sk = sock->sk; 902 struct isotp_sock *so = isotp_sk(sk); 903 u32 old_state = so->tx.state; 904 struct sk_buff *skb; 905 struct net_device *dev; 906 struct canfd_frame *cf; 907 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 908 int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0; 909 s64 hrtimer_sec = 0; 910 int off; 911 int err; 912 913 if (!so->bound) 914 return -EADDRNOTAVAIL; 915 916 /* we do not support multiple buffers - for now */ 917 if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE || 918 wq_has_sleeper(&so->wait)) { 919 if (msg->msg_flags & MSG_DONTWAIT) { 920 err = -EAGAIN; 921 goto err_out; 922 } 923 924 /* wait for complete transmission of current pdu */ 925 err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); 926 if (err) 927 goto err_out; 928 } 929 930 if (!size || size > MAX_MSG_LENGTH) { 931 err = -EINVAL; 932 goto err_out_drop; 933 } 934 935 /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ 936 off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; 937 938 /* does the given data fit into a single frame for SF_BROADCAST? */ 939 if ((so->opt.flags & CAN_ISOTP_SF_BROADCAST) && 940 (size > so->tx.ll_dl - SF_PCI_SZ4 - ae - off)) { 941 err = -EINVAL; 942 goto err_out_drop; 943 } 944 945 err = memcpy_from_msg(so->tx.buf, msg, size); 946 if (err < 0) 947 goto err_out_drop; 948 949 dev = dev_get_by_index(sock_net(sk), so->ifindex); 950 if (!dev) { 951 err = -ENXIO; 952 goto err_out_drop; 953 } 954 955 skb = sock_alloc_send_skb(sk, so->ll.mtu + sizeof(struct can_skb_priv), 956 msg->msg_flags & MSG_DONTWAIT, &err); 957 if (!skb) { 958 dev_put(dev); 959 goto err_out_drop; 960 } 961 962 can_skb_reserve(skb); 963 can_skb_prv(skb)->ifindex = dev->ifindex; 964 can_skb_prv(skb)->skbcnt = 0; 965 966 so->tx.len = size; 967 so->tx.idx = 0; 968 969 cf = (struct canfd_frame *)skb->data; 970 skb_put_zero(skb, so->ll.mtu); 971 972 /* check for single frame transmission depending on TX_DL */ 973 if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) { 974 /* The message size generally fits into a SingleFrame - good. 975 * 976 * SF_DL ESC offset optimization: 977 * 978 * When TX_DL is greater 8 but the message would still fit 979 * into a 8 byte CAN frame, we can omit the offset. 980 * This prevents a protocol caused length extension from 981 * CAN_DL = 8 to CAN_DL = 12 due to the SF_SL ESC handling. 982 */ 983 if (size <= CAN_MAX_DLEN - SF_PCI_SZ4 - ae) 984 off = 0; 985 986 isotp_fill_dataframe(cf, so, ae, off); 987 988 /* place single frame N_PCI w/o length in appropriate index */ 989 cf->data[ae] = N_PCI_SF; 990 991 /* place SF_DL size value depending on the SF_DL ESC offset */ 992 if (off) 993 cf->data[SF_PCI_SZ4 + ae] = size; 994 else 995 cf->data[ae] |= size; 996 997 so->tx.state = ISOTP_IDLE; 998 wake_up_interruptible(&so->wait); 999 1000 /* don't enable wait queue for a single frame transmission */ 1001 wait_tx_done = 0; 1002 } else { 1003 /* send first frame and wait for FC */ 1004 1005 isotp_create_fframe(cf, so, ae); 1006 1007 /* start timeout for FC */ 1008 hrtimer_sec = 1; 1009 hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0), 1010 HRTIMER_MODE_REL_SOFT); 1011 } 1012 1013 /* send the first or only CAN frame */ 1014 cf->flags = so->ll.tx_flags; 1015 1016 skb->dev = dev; 1017 skb->sk = sk; 1018 err = can_send(skb, 1); 1019 dev_put(dev); 1020 if (err) { 1021 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 1022 __func__, ERR_PTR(err)); 1023 1024 /* no transmission -> no timeout monitoring */ 1025 if (hrtimer_sec) 1026 hrtimer_cancel(&so->txtimer); 1027 1028 goto err_out_drop; 1029 } 1030 1031 if (wait_tx_done) { 1032 /* wait for complete transmission of current pdu */ 1033 wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); 1034 1035 if (sk->sk_err) 1036 return -sk->sk_err; 1037 } 1038 1039 return size; 1040 1041 err_out_drop: 1042 /* drop this PDU and unlock a potential wait queue */ 1043 old_state = ISOTP_IDLE; 1044 err_out: 1045 so->tx.state = old_state; 1046 if (so->tx.state == ISOTP_IDLE) 1047 wake_up_interruptible(&so->wait); 1048 1049 return err; 1050 } 1051 1052 static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 1053 int flags) 1054 { 1055 struct sock *sk = sock->sk; 1056 struct sk_buff *skb; 1057 struct isotp_sock *so = isotp_sk(sk); 1058 int noblock = flags & MSG_DONTWAIT; 1059 int ret = 0; 1060 1061 if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK)) 1062 return -EINVAL; 1063 1064 if (!so->bound) 1065 return -EADDRNOTAVAIL; 1066 1067 flags &= ~MSG_DONTWAIT; 1068 skb = skb_recv_datagram(sk, flags, noblock, &ret); 1069 if (!skb) 1070 return ret; 1071 1072 if (size < skb->len) 1073 msg->msg_flags |= MSG_TRUNC; 1074 else 1075 size = skb->len; 1076 1077 ret = memcpy_to_msg(msg, skb->data, size); 1078 if (ret < 0) 1079 goto out_err; 1080 1081 sock_recv_timestamp(msg, sk, skb); 1082 1083 if (msg->msg_name) { 1084 __sockaddr_check_size(ISOTP_MIN_NAMELEN); 1085 msg->msg_namelen = ISOTP_MIN_NAMELEN; 1086 memcpy(msg->msg_name, skb->cb, msg->msg_namelen); 1087 } 1088 1089 /* set length of return value */ 1090 ret = (flags & MSG_TRUNC) ? skb->len : size; 1091 1092 out_err: 1093 skb_free_datagram(sk, skb); 1094 1095 return ret; 1096 } 1097 1098 static int isotp_release(struct socket *sock) 1099 { 1100 struct sock *sk = sock->sk; 1101 struct isotp_sock *so; 1102 struct net *net; 1103 1104 if (!sk) 1105 return 0; 1106 1107 so = isotp_sk(sk); 1108 net = sock_net(sk); 1109 1110 /* wait for complete transmission of current pdu */ 1111 wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); 1112 1113 spin_lock(&isotp_notifier_lock); 1114 while (isotp_busy_notifier == so) { 1115 spin_unlock(&isotp_notifier_lock); 1116 schedule_timeout_uninterruptible(1); 1117 spin_lock(&isotp_notifier_lock); 1118 } 1119 list_del(&so->notifier); 1120 spin_unlock(&isotp_notifier_lock); 1121 1122 lock_sock(sk); 1123 1124 /* remove current filters & unregister */ 1125 if (so->bound && (!(so->opt.flags & CAN_ISOTP_SF_BROADCAST))) { 1126 if (so->ifindex) { 1127 struct net_device *dev; 1128 1129 dev = dev_get_by_index(net, so->ifindex); 1130 if (dev) { 1131 can_rx_unregister(net, dev, so->rxid, 1132 SINGLE_MASK(so->rxid), 1133 isotp_rcv, sk); 1134 can_rx_unregister(net, dev, so->txid, 1135 SINGLE_MASK(so->txid), 1136 isotp_rcv_echo, sk); 1137 dev_put(dev); 1138 synchronize_rcu(); 1139 } 1140 } 1141 } 1142 1143 hrtimer_cancel(&so->txtimer); 1144 hrtimer_cancel(&so->rxtimer); 1145 1146 so->ifindex = 0; 1147 so->bound = 0; 1148 1149 sock_orphan(sk); 1150 sock->sk = NULL; 1151 1152 release_sock(sk); 1153 sock_put(sk); 1154 1155 return 0; 1156 } 1157 1158 static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) 1159 { 1160 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 1161 struct sock *sk = sock->sk; 1162 struct isotp_sock *so = isotp_sk(sk); 1163 struct net *net = sock_net(sk); 1164 int ifindex; 1165 struct net_device *dev; 1166 canid_t tx_id, rx_id; 1167 int err = 0; 1168 int notify_enetdown = 0; 1169 int do_rx_reg = 1; 1170 1171 if (len < ISOTP_MIN_NAMELEN) 1172 return -EINVAL; 1173 1174 /* sanitize tx/rx CAN identifiers */ 1175 tx_id = addr->can_addr.tp.tx_id; 1176 if (tx_id & CAN_EFF_FLAG) 1177 tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); 1178 else 1179 tx_id &= CAN_SFF_MASK; 1180 1181 rx_id = addr->can_addr.tp.rx_id; 1182 if (rx_id & CAN_EFF_FLAG) 1183 rx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); 1184 else 1185 rx_id &= CAN_SFF_MASK; 1186 1187 if (!addr->can_ifindex) 1188 return -ENODEV; 1189 1190 lock_sock(sk); 1191 1192 /* do not register frame reception for functional addressing */ 1193 if (so->opt.flags & CAN_ISOTP_SF_BROADCAST) 1194 do_rx_reg = 0; 1195 1196 /* do not validate rx address for functional addressing */ 1197 if (do_rx_reg && rx_id == tx_id) { 1198 err = -EADDRNOTAVAIL; 1199 goto out; 1200 } 1201 1202 if (so->bound && addr->can_ifindex == so->ifindex && 1203 rx_id == so->rxid && tx_id == so->txid) 1204 goto out; 1205 1206 dev = dev_get_by_index(net, addr->can_ifindex); 1207 if (!dev) { 1208 err = -ENODEV; 1209 goto out; 1210 } 1211 if (dev->type != ARPHRD_CAN) { 1212 dev_put(dev); 1213 err = -ENODEV; 1214 goto out; 1215 } 1216 if (dev->mtu < so->ll.mtu) { 1217 dev_put(dev); 1218 err = -EINVAL; 1219 goto out; 1220 } 1221 if (!(dev->flags & IFF_UP)) 1222 notify_enetdown = 1; 1223 1224 ifindex = dev->ifindex; 1225 1226 if (do_rx_reg) { 1227 can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id), 1228 isotp_rcv, sk, "isotp", sk); 1229 1230 /* no consecutive frame echo skb in flight */ 1231 so->cfecho = 0; 1232 1233 /* register for echo skb's */ 1234 can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id), 1235 isotp_rcv_echo, sk, "isotpe", sk); 1236 } 1237 1238 dev_put(dev); 1239 1240 if (so->bound && do_rx_reg) { 1241 /* unregister old filter */ 1242 if (so->ifindex) { 1243 dev = dev_get_by_index(net, so->ifindex); 1244 if (dev) { 1245 can_rx_unregister(net, dev, so->rxid, 1246 SINGLE_MASK(so->rxid), 1247 isotp_rcv, sk); 1248 can_rx_unregister(net, dev, so->txid, 1249 SINGLE_MASK(so->txid), 1250 isotp_rcv_echo, sk); 1251 dev_put(dev); 1252 } 1253 } 1254 } 1255 1256 /* switch to new settings */ 1257 so->ifindex = ifindex; 1258 so->rxid = rx_id; 1259 so->txid = tx_id; 1260 so->bound = 1; 1261 1262 out: 1263 release_sock(sk); 1264 1265 if (notify_enetdown) { 1266 sk->sk_err = ENETDOWN; 1267 if (!sock_flag(sk, SOCK_DEAD)) 1268 sk_error_report(sk); 1269 } 1270 1271 return err; 1272 } 1273 1274 static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer) 1275 { 1276 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 1277 struct sock *sk = sock->sk; 1278 struct isotp_sock *so = isotp_sk(sk); 1279 1280 if (peer) 1281 return -EOPNOTSUPP; 1282 1283 memset(addr, 0, ISOTP_MIN_NAMELEN); 1284 addr->can_family = AF_CAN; 1285 addr->can_ifindex = so->ifindex; 1286 addr->can_addr.tp.rx_id = so->rxid; 1287 addr->can_addr.tp.tx_id = so->txid; 1288 1289 return ISOTP_MIN_NAMELEN; 1290 } 1291 1292 static int isotp_setsockopt_locked(struct socket *sock, int level, int optname, 1293 sockptr_t optval, unsigned int optlen) 1294 { 1295 struct sock *sk = sock->sk; 1296 struct isotp_sock *so = isotp_sk(sk); 1297 int ret = 0; 1298 1299 if (so->bound) 1300 return -EISCONN; 1301 1302 switch (optname) { 1303 case CAN_ISOTP_OPTS: 1304 if (optlen != sizeof(struct can_isotp_options)) 1305 return -EINVAL; 1306 1307 if (copy_from_sockptr(&so->opt, optval, optlen)) 1308 return -EFAULT; 1309 1310 /* no separate rx_ext_address is given => use ext_address */ 1311 if (!(so->opt.flags & CAN_ISOTP_RX_EXT_ADDR)) 1312 so->opt.rx_ext_address = so->opt.ext_address; 1313 1314 /* check for frame_txtime changes (0 => no changes) */ 1315 if (so->opt.frame_txtime) { 1316 if (so->opt.frame_txtime == CAN_ISOTP_FRAME_TXTIME_ZERO) 1317 so->frame_txtime = 0; 1318 else 1319 so->frame_txtime = so->opt.frame_txtime; 1320 } 1321 break; 1322 1323 case CAN_ISOTP_RECV_FC: 1324 if (optlen != sizeof(struct can_isotp_fc_options)) 1325 return -EINVAL; 1326 1327 if (copy_from_sockptr(&so->rxfc, optval, optlen)) 1328 return -EFAULT; 1329 break; 1330 1331 case CAN_ISOTP_TX_STMIN: 1332 if (optlen != sizeof(u32)) 1333 return -EINVAL; 1334 1335 if (copy_from_sockptr(&so->force_tx_stmin, optval, optlen)) 1336 return -EFAULT; 1337 break; 1338 1339 case CAN_ISOTP_RX_STMIN: 1340 if (optlen != sizeof(u32)) 1341 return -EINVAL; 1342 1343 if (copy_from_sockptr(&so->force_rx_stmin, optval, optlen)) 1344 return -EFAULT; 1345 break; 1346 1347 case CAN_ISOTP_LL_OPTS: 1348 if (optlen == sizeof(struct can_isotp_ll_options)) { 1349 struct can_isotp_ll_options ll; 1350 1351 if (copy_from_sockptr(&ll, optval, optlen)) 1352 return -EFAULT; 1353 1354 /* check for correct ISO 11898-1 DLC data length */ 1355 if (ll.tx_dl != padlen(ll.tx_dl)) 1356 return -EINVAL; 1357 1358 if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU) 1359 return -EINVAL; 1360 1361 if (ll.mtu == CAN_MTU && 1362 (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0)) 1363 return -EINVAL; 1364 1365 memcpy(&so->ll, &ll, sizeof(ll)); 1366 1367 /* set ll_dl for tx path to similar place as for rx */ 1368 so->tx.ll_dl = ll.tx_dl; 1369 } else { 1370 return -EINVAL; 1371 } 1372 break; 1373 1374 default: 1375 ret = -ENOPROTOOPT; 1376 } 1377 1378 return ret; 1379 } 1380 1381 static int isotp_setsockopt(struct socket *sock, int level, int optname, 1382 sockptr_t optval, unsigned int optlen) 1383 1384 { 1385 struct sock *sk = sock->sk; 1386 int ret; 1387 1388 if (level != SOL_CAN_ISOTP) 1389 return -EINVAL; 1390 1391 lock_sock(sk); 1392 ret = isotp_setsockopt_locked(sock, level, optname, optval, optlen); 1393 release_sock(sk); 1394 return ret; 1395 } 1396 1397 static int isotp_getsockopt(struct socket *sock, int level, int optname, 1398 char __user *optval, int __user *optlen) 1399 { 1400 struct sock *sk = sock->sk; 1401 struct isotp_sock *so = isotp_sk(sk); 1402 int len; 1403 void *val; 1404 1405 if (level != SOL_CAN_ISOTP) 1406 return -EINVAL; 1407 if (get_user(len, optlen)) 1408 return -EFAULT; 1409 if (len < 0) 1410 return -EINVAL; 1411 1412 switch (optname) { 1413 case CAN_ISOTP_OPTS: 1414 len = min_t(int, len, sizeof(struct can_isotp_options)); 1415 val = &so->opt; 1416 break; 1417 1418 case CAN_ISOTP_RECV_FC: 1419 len = min_t(int, len, sizeof(struct can_isotp_fc_options)); 1420 val = &so->rxfc; 1421 break; 1422 1423 case CAN_ISOTP_TX_STMIN: 1424 len = min_t(int, len, sizeof(u32)); 1425 val = &so->force_tx_stmin; 1426 break; 1427 1428 case CAN_ISOTP_RX_STMIN: 1429 len = min_t(int, len, sizeof(u32)); 1430 val = &so->force_rx_stmin; 1431 break; 1432 1433 case CAN_ISOTP_LL_OPTS: 1434 len = min_t(int, len, sizeof(struct can_isotp_ll_options)); 1435 val = &so->ll; 1436 break; 1437 1438 default: 1439 return -ENOPROTOOPT; 1440 } 1441 1442 if (put_user(len, optlen)) 1443 return -EFAULT; 1444 if (copy_to_user(optval, val, len)) 1445 return -EFAULT; 1446 return 0; 1447 } 1448 1449 static void isotp_notify(struct isotp_sock *so, unsigned long msg, 1450 struct net_device *dev) 1451 { 1452 struct sock *sk = &so->sk; 1453 1454 if (!net_eq(dev_net(dev), sock_net(sk))) 1455 return; 1456 1457 if (so->ifindex != dev->ifindex) 1458 return; 1459 1460 switch (msg) { 1461 case NETDEV_UNREGISTER: 1462 lock_sock(sk); 1463 /* remove current filters & unregister */ 1464 if (so->bound && (!(so->opt.flags & CAN_ISOTP_SF_BROADCAST))) { 1465 can_rx_unregister(dev_net(dev), dev, so->rxid, 1466 SINGLE_MASK(so->rxid), 1467 isotp_rcv, sk); 1468 can_rx_unregister(dev_net(dev), dev, so->txid, 1469 SINGLE_MASK(so->txid), 1470 isotp_rcv_echo, sk); 1471 } 1472 1473 so->ifindex = 0; 1474 so->bound = 0; 1475 release_sock(sk); 1476 1477 sk->sk_err = ENODEV; 1478 if (!sock_flag(sk, SOCK_DEAD)) 1479 sk_error_report(sk); 1480 break; 1481 1482 case NETDEV_DOWN: 1483 sk->sk_err = ENETDOWN; 1484 if (!sock_flag(sk, SOCK_DEAD)) 1485 sk_error_report(sk); 1486 break; 1487 } 1488 } 1489 1490 static int isotp_notifier(struct notifier_block *nb, unsigned long msg, 1491 void *ptr) 1492 { 1493 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1494 1495 if (dev->type != ARPHRD_CAN) 1496 return NOTIFY_DONE; 1497 if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) 1498 return NOTIFY_DONE; 1499 if (unlikely(isotp_busy_notifier)) /* Check for reentrant bug. */ 1500 return NOTIFY_DONE; 1501 1502 spin_lock(&isotp_notifier_lock); 1503 list_for_each_entry(isotp_busy_notifier, &isotp_notifier_list, notifier) { 1504 spin_unlock(&isotp_notifier_lock); 1505 isotp_notify(isotp_busy_notifier, msg, dev); 1506 spin_lock(&isotp_notifier_lock); 1507 } 1508 isotp_busy_notifier = NULL; 1509 spin_unlock(&isotp_notifier_lock); 1510 return NOTIFY_DONE; 1511 } 1512 1513 static int isotp_init(struct sock *sk) 1514 { 1515 struct isotp_sock *so = isotp_sk(sk); 1516 1517 so->ifindex = 0; 1518 so->bound = 0; 1519 1520 so->opt.flags = CAN_ISOTP_DEFAULT_FLAGS; 1521 so->opt.ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS; 1522 so->opt.rx_ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS; 1523 so->opt.rxpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; 1524 so->opt.txpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; 1525 so->opt.frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; 1526 so->frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; 1527 so->rxfc.bs = CAN_ISOTP_DEFAULT_RECV_BS; 1528 so->rxfc.stmin = CAN_ISOTP_DEFAULT_RECV_STMIN; 1529 so->rxfc.wftmax = CAN_ISOTP_DEFAULT_RECV_WFTMAX; 1530 so->ll.mtu = CAN_ISOTP_DEFAULT_LL_MTU; 1531 so->ll.tx_dl = CAN_ISOTP_DEFAULT_LL_TX_DL; 1532 so->ll.tx_flags = CAN_ISOTP_DEFAULT_LL_TX_FLAGS; 1533 1534 /* set ll_dl for tx path to similar place as for rx */ 1535 so->tx.ll_dl = so->ll.tx_dl; 1536 1537 so->rx.state = ISOTP_IDLE; 1538 so->tx.state = ISOTP_IDLE; 1539 1540 hrtimer_init(&so->rxtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1541 so->rxtimer.function = isotp_rx_timer_handler; 1542 hrtimer_init(&so->txtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1543 so->txtimer.function = isotp_tx_timer_handler; 1544 1545 init_waitqueue_head(&so->wait); 1546 spin_lock_init(&so->rx_lock); 1547 1548 spin_lock(&isotp_notifier_lock); 1549 list_add_tail(&so->notifier, &isotp_notifier_list); 1550 spin_unlock(&isotp_notifier_lock); 1551 1552 return 0; 1553 } 1554 1555 static int isotp_sock_no_ioctlcmd(struct socket *sock, unsigned int cmd, 1556 unsigned long arg) 1557 { 1558 /* no ioctls for socket layer -> hand it down to NIC layer */ 1559 return -ENOIOCTLCMD; 1560 } 1561 1562 static const struct proto_ops isotp_ops = { 1563 .family = PF_CAN, 1564 .release = isotp_release, 1565 .bind = isotp_bind, 1566 .connect = sock_no_connect, 1567 .socketpair = sock_no_socketpair, 1568 .accept = sock_no_accept, 1569 .getname = isotp_getname, 1570 .poll = datagram_poll, 1571 .ioctl = isotp_sock_no_ioctlcmd, 1572 .gettstamp = sock_gettstamp, 1573 .listen = sock_no_listen, 1574 .shutdown = sock_no_shutdown, 1575 .setsockopt = isotp_setsockopt, 1576 .getsockopt = isotp_getsockopt, 1577 .sendmsg = isotp_sendmsg, 1578 .recvmsg = isotp_recvmsg, 1579 .mmap = sock_no_mmap, 1580 .sendpage = sock_no_sendpage, 1581 }; 1582 1583 static struct proto isotp_proto __read_mostly = { 1584 .name = "CAN_ISOTP", 1585 .owner = THIS_MODULE, 1586 .obj_size = sizeof(struct isotp_sock), 1587 .init = isotp_init, 1588 }; 1589 1590 static const struct can_proto isotp_can_proto = { 1591 .type = SOCK_DGRAM, 1592 .protocol = CAN_ISOTP, 1593 .ops = &isotp_ops, 1594 .prot = &isotp_proto, 1595 }; 1596 1597 static struct notifier_block canisotp_notifier = { 1598 .notifier_call = isotp_notifier 1599 }; 1600 1601 static __init int isotp_module_init(void) 1602 { 1603 int err; 1604 1605 pr_info("can: isotp protocol\n"); 1606 1607 err = can_proto_register(&isotp_can_proto); 1608 if (err < 0) 1609 pr_err("can: registration of isotp protocol failed %pe\n", ERR_PTR(err)); 1610 else 1611 register_netdevice_notifier(&canisotp_notifier); 1612 1613 return err; 1614 } 1615 1616 static __exit void isotp_module_exit(void) 1617 { 1618 can_proto_unregister(&isotp_can_proto); 1619 unregister_netdevice_notifier(&canisotp_notifier); 1620 } 1621 1622 module_init(isotp_module_init); 1623 module_exit(isotp_module_exit); 1624