Merge nuts.ninka.net:/home/davem/src/BK/network-2.5

into nuts.ninka.net:/home/davem/src/BK/net-2.5

Documentation/networking/tuntap.txt

@@ -7,43 +7,71 @@ Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com>
   FreeBSD TAP driver 
   Copyright (c) 1999-2000 Maksim Yevmenkin <m_evmenkin@yahoo.com>
 
+  Revision of this document 2002 by Florian Thiel <florian.thiel@gmx.net>
+
 1. Description
   TUN/TAP provides packet reception and transmission for user space programs. 
-  It can be viewed as a simple Point-to-Point or Ethernet device, which 
-  instead of receiving packets from a physical media, receives them from 
+  It can be seen as a simple Point-to-Point or Ethernet device, which,
+  instead of receiving packets from physical media, receives them from 
   user space program and instead of sending packets via physical media 
   writes them to the user space program. 
 
-  When a program opens /dev/net/tun, driver creates and registers corresponding
-  net device tunX or tapX. After a program closed above devices, driver will 
-  automatically delete tunXX or tapXX device and all routes corresponding to it.
+  In order to use the driver a program has to open /dev/net/tun and issue a
+  corresponding ioctl() to register a network device with the kernel. A network
+  device will appear as tunXX or tapXX, depending on the options chosen. When
+  the program closes the file descriptor, the network device and all
+  corresponding routes will disappear.
+
+  Depending on the type of device chosen the userspace program has to read/write
+  IP packets (with tun) or ethernet frames (with tap). Which one is being used
+  depends on the flags given with the ioctl().
 
-  This package(http://vtun.sourceforge.net/tun) contains two simple example 
-  programs how to use tun and tap devices. Both programs works like 
-  bridge between two network interfaces.
+  The package from http://vtun.sourceforge.net/tun contains two simple examples
+  for how to use tun and tap devices. Both programs work like a bridge between
+  two network interfaces.
   br_select.c - bridge based on select system call.
   br_sigio.c  - bridge based on async io and SIGIO signal.
-  However the best example is VTun http://vtun.sourceforge.net :))  
+  However, the best example is VTun http://vtun.sourceforge.net :))
 
 2. Configuration 
   Create device node:
+     mkdir /dev/net (if it doesn't exist already)
      mknod /dev/net/tun c 10 200
+  
+  Set permissions:
+     e.g. chmod 0700 /dev/net/tun
+     if you want the device only accesible by root. Giving regular users the
+     right to assign network devices is NOT a good idea. Users could assign
+     bogus network interfaces to trick firewalls or administrators.
 
   Driver module autoloading
      Make sure that "Kernel module loader" - module auto-loading support is enabled 
      in your kernel. 
 
-     Add following line to the /etc/modules.conf:
+     Add the following line to the /etc/modules.conf:
 	alias char-major-10-200 tun
-     
-     Run:
+     and run
         depmod -a 
+  
+  Manual loading 
+     insert the module by hand:
+        modprobe tun
 
-     Driver will be automatically loaded when application access /dev/net/tun.
+  If you do it the latter way, you have to load the module every time you
+  need it, if you do it the other way it will be automatically loaded when
+  /dev/net/tun is being opened.
 
 3. Program interface 
   3.1 Network device allocation:
 
+  char *dev should be the name of the device with a format string (e.g.
+  "tun%d"), but (as far as I can see) this can be any valid network device name.
+  Note that the character pointer becomes overwritten with the real device name
+  (e.g. "tun0")
+
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+
   int tun_alloc(char *dev)
   {
       struct ifreq ifr;
@@ -79,65 +107,44 @@ Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com>
 
 Universal TUN/TAP device driver Frequently Asked Question.
    
-1. What is the TUN ?
-The TUN is Virtual Point-to-Point network device.
-TUN driver was designed as low level kernel support for
-IP tunneling. It provides to userland application
-two interfaces:
-  - /dev/tunX	- character device;
-  - tunX	- virtual Point-to-Point interface.
-
-Userland application can write IP frame to /dev/tunX
-and kernel will receive this frame from tunX interface. 
-In the same time every frame that kernel writes to tunX 
-interface can be read by userland application from /dev/tunX
-device.
-
-2. What is the TAP ?
-The TAP is a Virtual Ethernet network device.
-TAP driver was designed as low level kernel support for
-Ethernet tunneling. It provides to userland application
-two interfaces:
-  - /dev/tapX	- character device;
-  - tapX	- virtual Ethernet interface.
-
-Userland application can write Ethernet frame to /dev/tapX
-and kernel will receive this frame from tapX interface. 
-In the same time every frame that kernel writes to tapX 
-interface can be read by userland application from /dev/tapX
-device.
-
-3. What platforms are supported by TUN/TAP driver ?
+1. What platforms are supported by TUN/TAP driver ?
 Currently driver has been written for 3 Unices:
    Linux kernels 2.2.x, 2.4.x 
    FreeBSD 3.x, 4.x, 5.x
    Solaris 2.6, 7.0, 8.0
 
-4. What is TUN/TAP driver used for?
+2. What is TUN/TAP driver used for?
 As mentioned above, main purpose of TUN/TAP driver is tunneling. 
 It is used by VTun (http://vtun.sourceforge.net).
 
-5. How does Virtual network device actually work ? 
+Another interesting application using TUN/TAP is pipsecd
+(http://perso.enst.fr/~beyssac/pipsec/), an userspace IPSec
+implementation that can use complete kernel routing (unlike FreeS/WAN).
+
+3. How does Virtual network device actually work ? 
 Virtual network device can be viewed as a simple Point-to-Point or
 Ethernet device, which instead of receiving packets from a physical 
 media, receives them from user space program and instead of sending 
 packets via physical media sends them to the user space program. 
 
 Let's say that you configured IPX on the tap0, then whenever 
-kernel sends any IPX packet to tap0, it is passed to the application
-(VTun for example). Application encrypts, compresses and sends it to 
-the other side over TCP or UDP. Application on other side decompress 
-and decrypts them and write packet to the TAP device, kernel handles 
-the packet like it came from real physical device.
+the kernel sends an IPX packet to tap0, it is passed to the application
+(VTun for example). The application encrypts, compresses and sends it to 
+the other side over TCP or UDP. The application on the other side decompresses
+and decrypts the data received and writes the packet to the TAP device, 
+the kernel handles the packet like it came from real physical device.
 
-6. What is the difference between TUN driver and TAP driver?
+4. What is the difference between TUN driver and TAP driver?
 TUN works with IP frames. TAP works with Ethernet frames.
 
-7. What is the difference between BPF and TUN/TAP driver?
-BFP is a advanced packet filter. It can be attached to existing
-network interface. It does not provide virtual network interface.
-TUN/TAP driver does provide virtual network interface and it is possible
+This means that you have to read/write IP packets when you are using tun and
+ethernet frames when using tap.
+
+5. What is the difference between BPF and TUN/TAP driver?
+BFP is an advanced packet filter. It can be attached to existing
+network interface. It does not provide a virtual network interface.
+A TUN/TAP driver does provide a virtual network interface and it is possible
 to attach BPF to this interface.
 
-8. Does TAP driver support kernel Ethernet bridging?
+6. Does TAP driver support kernel Ethernet bridging?
 Yes. Linux and FreeBSD drivers support Ethernet bridging. 

drivers/net/hamachi.c

@@ -1470,64 +1470,6 @@ static void hamachi_interrupt(int irq, void *dev_instance, struct pt_regs *rgs)
 	spin_unlock(&hmp->lock);
 }
 
-#ifdef TX_CHECKSUM
-/*
- * Copied from eth_type_trans(), with reduced header, since we don't
- * get it on RX, only on TX.
- */
-static unsigned short hamachi_eth_type_trans(struct sk_buff *skb,
-  struct net_device *dev)
-{
-	struct ethhdr *eth;
-	unsigned char *rawp;
-	
-	skb->mac.raw=skb->data;
-	skb_pull(skb,dev->hard_header_len-8);  /* artificially enlarged on tx */
-	eth= skb->mac.ethernet;
-	
-	if(*eth->h_dest&1)
-	{
-		if(memcmp(eth->h_dest,dev->broadcast, ETH_ALEN)==0)
-			skb->pkt_type=PACKET_BROADCAST;
-		else
-			skb->pkt_type=PACKET_MULTICAST;
-	}
-	
-	/*
-	 *	This ALLMULTI check should be redundant by 1.4
-	 *	so don't forget to remove it.
-	 *
-	 *	Seems, you forgot to remove it. All silly devices
-	 *	seems to set IFF_PROMISC.
-	 */
-	 
-	else if(dev->flags&(IFF_PROMISC/*|IFF_ALLMULTI*/))
-	{
-		if(memcmp(eth->h_dest,dev->dev_addr, ETH_ALEN))
-			skb->pkt_type=PACKET_OTHERHOST;
-	}
-	
-	if (ntohs(eth->h_proto) >= 1536)
-		return eth->h_proto;
-		
-	rawp = skb->data;
-	
-	/*
-	 *	This is a magic hack to spot IPX packets. Older Novell breaks
-	 *	the protocol design and runs IPX over 802.3 without an 802.2 LLC
-	 *	layer. We look for FFFF which isn't a used 802.2 SSAP/DSAP. This
-	 *	won't work for fault tolerant netware but does for the rest.
-	 */
-	if (*(unsigned short *)rawp == 0xFFFF)
-		return htons(ETH_P_802_3);
-		
-	/*
-	 *	Real 802.2 LLC
-	 */
-	return htons(ETH_P_802_2);
-}
-#endif  /* TX_CHECKSUM */
-
 /* This routine is logically part of the interrupt handler, but seperated
    for clarity and better register allocation. */
 static int hamachi_rx(struct net_device *dev)
@@ -1632,12 +1574,7 @@ static int hamachi_rx(struct net_device *dev)
 				skb_put(skb = hmp->rx_skbuff[entry], pkt_len);
 				hmp->rx_skbuff[entry] = NULL;
 			}
-#ifdef TX_CHECKSUM
-			/* account for extra TX hard_header bytes */
-			skb->protocol = hamachi_eth_type_trans(skb, dev);
-#else
 			skb->protocol = eth_type_trans(skb, dev);
-#endif
 
 
 #ifdef RX_CHECKSUM

include/net/llc_conn.h

@@ -79,7 +79,6 @@ extern int llc_sk_init(struct sock *sk);
 extern int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
 extern void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
 extern void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
-extern void llc_conn_free_ev(struct sk_buff *skb);
 extern void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr,
 					 u8 first_p_bit);
 extern void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr,

include/net/llc_mac.h

@@ -13,8 +13,6 @@
  */
 extern int llc_rcv(struct sk_buff *skb, struct net_device *dev,
 		   struct packet_type *pt);
-extern struct net_device *mac_dev_peer(struct net_device *current_dev,
-				       int type, u8 *mac);
 extern u16 lan_hdrs_init(struct sk_buff *skb, u8 *sa, u8 *da);
 extern int llc_conn_rcv(struct sock *sk, struct sk_buff *skb);
 

net/ethernet/eth.c

@@ -103,16 +103,16 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
 	if (dev->flags & (IFF_LOOPBACK|IFF_NOARP)) 
 	{
 		memset(eth->h_dest, 0, dev->addr_len);
-		return(dev->hard_header_len);
+		return ETH_HLEN;
 	}
 	
 	if(daddr)
 	{
 		memcpy(eth->h_dest,daddr,dev->addr_len);
-		return dev->hard_header_len;
+		return ETH_HLEN;
 	}
 	
-	return -dev->hard_header_len;
+	return -ETH_HLEN;
 }
 
 
@@ -161,7 +161,7 @@ unsigned short eth_type_trans(struct sk_buff *skb, struct net_device *dev)
 	unsigned char *rawp;
 	
 	skb->mac.raw=skb->data;
-	skb_pull(skb,dev->hard_header_len);
+	skb_pull(skb,ETH_HLEN);
 	eth= skb->mac.ethernet;
 	
 	if(*eth->h_dest&1)

net/ipv6/mcast.c

@@ -141,14 +141,14 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
 
 	write_lock_bh(&ipv6_sk_mc_lock);
 	for (lnk = &np->ipv6_mc_list; (mc_lst = *lnk) !=NULL ; lnk = &mc_lst->next) {
-		if (mc_lst->ifindex == ifindex &&
+		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
 		    ipv6_addr_cmp(&mc_lst->addr, addr) == 0) {
 			struct net_device *dev;
 
 			*lnk = mc_lst->next;
 			write_unlock_bh(&ipv6_sk_mc_lock);
 
-			if ((dev = dev_get_by_index(ifindex)) != NULL) {
+			if ((dev = dev_get_by_index(mc_lst->ifindex)) != NULL) {
 				ipv6_dev_mc_dec(dev, &mc_lst->addr);
 				dev_put(dev);
 			}

net/ipv6/route.c

@@ -13,6 +13,17 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+/*	Changes:
+ *
+ *	YOSHIFUJI Hideaki @USAGI
+ *		reworked default router selection.
+ *		- respect outgoing interface
+ *		- select from (probably) reachable routers (i.e.
+ *		routers in REACHABLE, STALE, DELAY or PROBE states).
+ *		- always select the same router if it is (probably)
+ *		reachable.  otherwise, round-robin the list.
+ */
+
 #include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -168,6 +179,7 @@ static __inline__ struct rt6_info *rt6_device_match(struct rt6_info *rt,
 static struct rt6_info *rt6_dflt_pointer = NULL;
 static spinlock_t rt6_dflt_lock = SPIN_LOCK_UNLOCKED;
 
+/* Default Router Selection (RFC 2461 6.3.6) */
 static struct rt6_info *rt6_best_dflt(struct rt6_info *rt, int oif)
 {
 	struct rt6_info *match = NULL;
@@ -176,63 +188,117 @@ static struct rt6_info *rt6_best_dflt(struct rt6_info *rt, int oif)
 
 	for (sprt = rt; sprt; sprt = sprt->u.next) {
 		struct neighbour *neigh;
+		int m = 0;
 
-		if ((neigh = sprt->rt6i_nexthop) != NULL) {
-			int m = -1;
+		if (!oif ||
+		    (sprt->rt6i_dev &&
+		     sprt->rt6i_dev->ifindex == oif))
+			m += 8;
+
+		if (sprt == rt6_dflt_pointer)
+			m += 4;
 
+		if ((neigh = sprt->rt6i_nexthop) != NULL) {
+			read_lock_bh(&neigh->lock);
 			switch (neigh->nud_state) {
 			case NUD_REACHABLE:
-				if (sprt != rt6_dflt_pointer) {
-					rt = sprt;
-					goto out;
-				}
-				m = 2;
+				m += 3;
 				break;
 
+			case NUD_STALE:
 			case NUD_DELAY:
-				m = 1;
+			case NUD_PROBE:
+				m += 2;
 				break;
 
-			case NUD_STALE:
-				m = 1;
+			case NUD_NOARP:
+			case NUD_PERMANENT:
+				m += 1;
 				break;
-			};
 
-			if (oif && sprt->rt6i_dev->ifindex == oif) {
-				m += 2;
+			case NUD_INCOMPLETE:
+			default:
+				read_unlock_bh(&neigh->lock);
+				continue;
 			}
+			read_unlock_bh(&neigh->lock);
+		} else {
+			continue;
+		}
 
-			if (m >= mpri) {
-				mpri = m;
-				match = sprt;
+		if (m > mpri || m >= 12) {
+			match = sprt;
+			mpri = m;
+			if (m >= 12) {
+				/* we choose the lastest default router if it
+				 * is in (probably) reachable state.
+				 * If route changed, we should do pmtu
+				 * discovery. --yoshfuji
+				 */
+				break;
 			}
 		}
 	}
 
-	if (match) {
-		rt = match;
-	} else {
+	spin_lock(&rt6_dflt_lock);
+	if (!match) {
 		/*
 		 *	No default routers are known to be reachable.
 		 *	SHOULD round robin
 		 */
-		spin_lock(&rt6_dflt_lock);
 		if (rt6_dflt_pointer) {
-			struct rt6_info *next;
-
-			if ((next = rt6_dflt_pointer->u.next) != NULL &&
-			    next->u.dst.obsolete <= 0 &&
-			    next->u.dst.error == 0)
-				rt = next;
+			for (sprt = rt6_dflt_pointer->u.next;
+			     sprt; sprt = sprt->u.next) {
+				if (sprt->u.dst.obsolete <= 0 &&
+				    sprt->u.dst.error == 0) {
+					match = sprt;
+					break;
+				}
+			}
+			for (sprt = rt;
+			     !match && sprt && sprt != rt6_dflt_pointer; 
+			     sprt = sprt->u.next) {
+				if (sprt->u.dst.obsolete <= 0 &&
+				    sprt->u.dst.error == 0) {
+					match = sprt;
+					break;
+				}
+			}
 		}
-		spin_unlock(&rt6_dflt_lock);
 	}
 
-out:
-	spin_lock(&rt6_dflt_lock);
-	rt6_dflt_pointer = rt;
+	if (match) {
+		if (rt6_dflt_pointer != match)
+			RT6_TRACE1(KERN_INFO 
+					"changed default router: %p->%p\n",
+					rt6_dflt_pointer, match);
+		rt6_dflt_pointer = match;
+	}
 	spin_unlock(&rt6_dflt_lock);
-	return rt;
+
+	if (!match) {
+		/*
+		 * Last Resort: if no default routers found, 
+		 * use addrconf default route.
+		 * We don't record this route.
+		 */
+		for (sprt = ip6_routing_table.leaf;
+		     sprt; sprt = sprt->u.next) {
+			if ((sprt->rt6i_flags & RTF_DEFAULT) &&
+			    (!oif ||
+			     (sprt->rt6i_dev &&
+			      sprt->rt6i_dev->ifindex == oif))) {
+				match = sprt;
+				break;
+			}
+		}
+		if (!match) {
+			/* no default route.  give up. */
+			match = &ip6_null_entry;
+		}
+	}
+
+	return match;
 }
 
 struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,

net/llc/af_llc.c

@@ -569,6 +569,13 @@ static int llc_ui_wait_for_data(struct sock *sk, int timeout)
 		rc = -EAGAIN;
 		if (!timeout)
 			break;
+		/*
+		 * Well, if we have backlog, try to process it now.
+		 */
+                if (sk->backlog.tail) {
+			release_sock(sk);
+			lock_sock(sk);
+		}
 		rc = 0;
 		if (skb_queue_empty(&sk->receive_queue)) {
 			release_sock(sk);

net/llc/llc_c_ac.c

@@ -1487,7 +1487,7 @@ static void llc_process_tmr_ev(struct sock *sk, struct sk_buff *skb)
 	if (llc_sk(sk)->state == LLC_CONN_OUT_OF_SVC) {
 		printk(KERN_WARNING "%s: timer called on closed connection\n",
 		       __FUNCTION__);
-		llc_conn_free_ev(skb);
+		kfree_skb(skb);
 	} else {
 		if (!sk->lock.users)
 			llc_conn_state_process(sk, skb);

net/llc/llc_conn.c

@@ -71,6 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	struct llc_opt *llc = llc_sk(sk);
 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
+	/*
+	 * We have to hold the skb, because llc_conn_service will kfree it in
+	 * the sending path and we need to look at the skb->cb, where we encode
+	 * llc_conn_state_ev.
+	 */
+	skb_get(skb);
 	ev->ind_prim = ev->cfm_prim = 0;
 	rc = llc_conn_service(sk, skb); /* sending event to state machine */
 	if (rc) {
@@ -81,10 +87,10 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	if (!ev->ind_prim && !ev->cfm_prim) {   /* indicate or confirm not required */
 		if (!skb->list)
 			goto out_kfree_skb;
-		goto out;
+		goto out_skb_put;
 	}
 
-	if (ev->ind_prim && ev->cfm_prim)
+	if (ev->ind_prim && ev->cfm_prim) /* Paranoia */
 		skb_get(skb);
 
 	switch (ev->ind_prim) {
@@ -180,11 +186,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 					__FUNCTION__, ev->cfm_prim);
 			break;
 		}
-		goto out; /* No confirmation */
+		goto out_skb_put; /* No confirmation */
 	}
 out_kfree_skb:
 	kfree_skb(skb);
-out:
+out_skb_put:
+	kfree_skb(skb);
 	return rc;
 }
 
@@ -226,25 +233,29 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
 	struct sk_buff *skb;
 	struct llc_pdu_sn *pdu;
 	u16 nbr_unack_pdus;
+	struct llc_opt *llc;
 	u8 howmany_resend = 0;
 
 	llc_conn_remove_acked_pdus(sk, nr, &nbr_unack_pdus);
 	if (!nbr_unack_pdus)
 		goto out;
-	/* process unack PDUs only if unack queue is not empty; remove
+	/*
+	 * Process unack PDUs only if unack queue is not empty; remove
 	 * appropriate PDUs, fix them up, and put them on mac_pdu_q.
 	 */
-	while ((skb = skb_dequeue(&llc_sk(sk)->pdu_unack_q)) != NULL) {
-		pdu = (struct llc_pdu_sn *)skb->nh.raw;
+	llc = llc_sk(sk);
+
+	while ((skb = skb_dequeue(&llc->pdu_unack_q)) != NULL) {
+		pdu = llc_pdu_sn_hdr(skb);
 		llc_pdu_set_cmd_rsp(skb, LLC_PDU_CMD);
 		llc_pdu_set_pf_bit(skb, first_p_bit);
 		skb_queue_tail(&sk->write_queue, skb);
 		first_p_bit = 0;
-		llc_sk(sk)->vS = LLC_I_GET_NS(pdu);
+		llc->vS = LLC_I_GET_NS(pdu);
 		howmany_resend++;
 	}
 	if (howmany_resend > 0)
-		llc_sk(sk)->vS = (llc_sk(sk)->vS + 1) % LLC_2_SEQ_NBR_MODULO;
+		llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
 	/* any PDUs to re-send are queued up; start sending to MAC */
 	llc_conn_send_pdus(sk);
 out:;
@@ -263,27 +274,29 @@ out:;
 void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
 {
 	struct sk_buff *skb;
-	struct llc_pdu_sn *pdu;
 	u16 nbr_unack_pdus;
+	struct llc_opt *llc = llc_sk(sk);
 	u8 howmany_resend = 0;
 
 	llc_conn_remove_acked_pdus(sk, nr, &nbr_unack_pdus);
 	if (!nbr_unack_pdus)
 		goto out;
-	/* process unack PDUs only if unack queue is not empty; remove
+	/*
+	 * Process unack PDUs only if unack queue is not empty; remove
 	 * appropriate PDUs, fix them up, and put them on mac_pdu_q
 	 */
-	while ((skb = skb_dequeue(&llc_sk(sk)->pdu_unack_q)) != NULL) {
-		pdu = (struct llc_pdu_sn *)skb->nh.raw;
+	while ((skb = skb_dequeue(&llc->pdu_unack_q)) != NULL) {
+		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+
 		llc_pdu_set_cmd_rsp(skb, LLC_PDU_RSP);
 		llc_pdu_set_pf_bit(skb, first_f_bit);
 		skb_queue_tail(&sk->write_queue, skb);
 		first_f_bit = 0;
-		llc_sk(sk)->vS = LLC_I_GET_NS(pdu);
+		llc->vS = LLC_I_GET_NS(pdu);
 		howmany_resend++;
 	}
 	if (howmany_resend > 0)
-		llc_sk(sk)->vS = (llc_sk(sk)->vS + 1) % LLC_2_SEQ_NBR_MODULO;
+		llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
 	/* any PDUs to re-send are queued up; start sending to MAC */
 	llc_conn_send_pdus(sk);
 out:;
@@ -304,25 +317,26 @@ int llc_conn_remove_acked_pdus(struct sock *sk, u8 nr, u16 *how_many_unacked)
 	struct sk_buff *skb;
 	struct llc_pdu_sn *pdu;
 	int nbr_acked = 0;
-	int q_len = skb_queue_len(&llc_sk(sk)->pdu_unack_q);
+	struct llc_opt *llc = llc_sk(sk);
+	int q_len = skb_queue_len(&llc->pdu_unack_q);
 
 	if (!q_len)
 		goto out;
-	skb = skb_peek(&llc_sk(sk)->pdu_unack_q);
-	pdu = (struct llc_pdu_sn *)skb->nh.raw;
+	skb = skb_peek(&llc->pdu_unack_q);
+	pdu = llc_pdu_sn_hdr(skb);
 
 	/* finding position of last acked pdu in queue */
 	pdu_pos = ((int)LLC_2_SEQ_NBR_MODULO + (int)nr -
 			(int)LLC_I_GET_NS(pdu)) % LLC_2_SEQ_NBR_MODULO;
 
 	for (i = 0; i < pdu_pos && i < q_len; i++) {
-		skb = skb_dequeue(&llc_sk(sk)->pdu_unack_q);
+		skb = skb_dequeue(&llc->pdu_unack_q);
 		if (skb)
 			kfree_skb(skb);
 		nbr_acked++;
 	}
 out:
-	*how_many_unacked = skb_queue_len(&llc_sk(sk)->pdu_unack_q);
+	*how_many_unacked = skb_queue_len(&llc->pdu_unack_q);
 	return nbr_acked;
 }
 
@@ -337,7 +351,7 @@ static void llc_conn_send_pdus(struct sock *sk)
 	struct sk_buff *skb;
 
 	while ((skb = skb_dequeue(&sk->write_queue)) != NULL) {
-		struct llc_pdu_sn *pdu = (struct llc_pdu_sn *)skb->nh.raw;
+		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
 		if (!LLC_PDU_TYPE_IS_I(pdu) &&
 		    !(skb->dev->flags & IFF_LOOPBACK)) {
@@ -352,31 +366,6 @@ static void llc_conn_send_pdus(struct sock *sk)
 	}
 }
 
-/**
- *	llc_conn_free_ev - free event
- *	@skb: event to free
- *
- *	Free allocated event.
- */
-void llc_conn_free_ev(struct sk_buff *skb)
-{
-	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
-
-	if (ev->type == LLC_CONN_EV_TYPE_PDU) {
-		/* free the frame that is bound to this event */
-		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-
-		if (LLC_PDU_TYPE_IS_I(pdu) || !ev->ind_prim)
-			kfree_skb(skb);
-	} else if (ev->type == LLC_CONN_EV_TYPE_PRIM &&
-		   ev->prim != LLC_DATA_PRIM)
-		kfree_skb(skb);
-	else if (ev->type == LLC_CONN_EV_TYPE_P_TMR ||
-		 ev->type == LLC_CONN_EV_TYPE_BUSY_TMR ||
-		 ev->type == LLC_CONN_EV_TYPE_REJ_TMR)
-		kfree_skb(skb);
-}
-
 /**
  *	llc_conn_service - finds transition and changes state of connection
  *	@sk: connection

net/llc/llc_if.c

@@ -26,7 +26,6 @@
 #include <net/llc_c_ac.h>
 #include <net/llc_c_st.h>
 #include <net/llc_main.h>
-#include <net/llc_mac.h>
 
 /**
  *	llc_sap_open - open interface to the upper layers.

net/llc/llc_mac.c

@@ -294,27 +294,3 @@ u16 lan_hdrs_init(struct sk_buff *skb, u8 *sa, u8 *da)
 	}
 	return rc;
 }
-
-/**
- *	mac_dev_peer - search the appropriate dev to send packets to peer
- *	@current_dev - Current device suggested by upper layer
- *	@type - hardware type
- *	@mac - mac address
- *
- *	Check if the we should use loopback to send packets, i.e., if the
- *	dmac belongs to one of the local interfaces, returning the pointer
- *	to the loopback &net_device struct or the current_dev if it is not
- *	local.
- */
-struct net_device *mac_dev_peer(struct net_device *current_dev, int type,
-				u8 *mac)
-{
-	struct net_device *dev;
-
-        rtnl_lock();
-        dev = dev_getbyhwaddr(type, mac);
-        if (dev)
-                dev = __dev_get_by_name("lo");
-        rtnl_unlock();
-	return dev ? : current_dev;
-}

net/llc/llc_main.c

@@ -147,20 +147,22 @@ static int llc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 		if (llc->state > 1) /* not closed */
 			rc = llc_conn_rcv(sk, skb);
 		else
-			kfree_skb(skb);
+			goto out_kfree_skb;
 	} else if (llc_backlog_type(skb) == LLC_EVENT) {
 		/* timer expiration event */
 		if (llc->state > 1)  /* not closed */
 			rc = llc_conn_state_process(sk, skb);
 		else
-			llc_conn_free_ev(skb);
-		kfree_skb(skb);
+			goto out_kfree_skb;
 	} else {
 		printk(KERN_ERR "%s: invalid skb in backlog\n", __FUNCTION__);
-		kfree_skb(skb);
+		goto out_kfree_skb;
 	}
-
+out:
 	return rc;
+out_kfree_skb:
+	kfree_skb(skb);
+	goto out;
 }
 
 /**

net/llc/llc_pdu.c

@@ -15,7 +15,6 @@
 #include <linux/if_tr.h>
 #include <net/llc_pdu.h>
 #include <net/llc_if.h>
-#include <net/llc_mac.h>
 #include <net/llc_main.h>
 
 static void llc_pdu_decode_pdu_type(struct sk_buff *skb, u8 *type);

net/llc/llc_sap.c

@@ -20,17 +20,9 @@
 #include <net/sock.h>
 #include <linux/tcp.h>
 #include <net/llc_main.h>
-#include <net/llc_mac.h>
 #include <net/llc_pdu.h>
 #include <linux/if_tr.h>
 
-static int llc_sap_next_state(struct llc_sap *sap, struct sk_buff *skb);
-static int llc_exec_sap_trans_actions(struct llc_sap *sap,
-				      struct llc_sap_state_trans *trans,
-				      struct sk_buff *skb);
-static struct llc_sap_state_trans *llc_find_sap_trans(struct llc_sap *sap,
-						      struct sk_buff *skb);
-
 /**
  *	llc_sap_assign_sock - adds a connection to a SAP
  *	@sap: pointer to SAP.
@@ -75,41 +67,6 @@ void llc_sap_unassign_sock(struct llc_sap *sap, struct sock *sk)
 	write_unlock_bh(&sap->sk_list.lock);
 }
 
-/**
- *	llc_sap_state_process - sends event to SAP state machine
- *	@sap: sap to use
- *	@skb: pointer to occurred event
- *
- *	After executing actions of the event, upper layer will be indicated
- *	if needed(on receiving an UI frame). sk can be null for the
- *	datalink_proto case.
- */
-void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
-{
-	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
-
-	/*
-	 * We have to hold the skb, because llc_sap_next_state
-	 * will kfree it in the sending path and we need to
-	 * look at the skb->cb, where we encode llc_sap_state_ev.
-	 */
-	skb_get(skb);
-	ev->ind_cfm_flag = 0;
-	llc_sap_next_state(sap, skb);
-	if (ev->ind_cfm_flag == LLC_IND) {
-		if (skb->sk->state == TCP_LISTEN)
-			kfree_skb(skb);
-		else {
-			llc_save_primitive(skb, ev->prim);
-
-			/* queue skb to the user. */
-			if (sock_queue_rcv_skb(skb->sk, skb))
-				kfree_skb(skb);
-		}
-	} 
-	kfree_skb(skb);
-}
-
 /**
  *	llc_sap_rtn_pdu - Informs upper layer on rx of an UI, XID or TEST pdu.
  *	@sap: pointer to SAP
@@ -117,10 +74,9 @@ void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
  */
 void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb)
 {
-	struct llc_pdu_un *pdu;
 	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+	struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
-	pdu = llc_pdu_un_hdr(skb);
 	switch (LLC_U_PDU_RSP(pdu)) {
 	case LLC_1_PDU_CMD_TEST:
 		ev->prim = LLC_TEST_PRIM;	break;
@@ -132,38 +88,6 @@ void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb)
 	ev->ind_cfm_flag = LLC_IND;
 }
 
-/**
- *	llc_sap_next_state - finds transition, execs actions & change SAP state
- *	@sap: pointer to SAP
- *	@skb: happened event
- *
- *	This function finds transition that matches with happened event, then
- *	executes related actions and finally changes state of SAP. It returns
- *	0 on success and 1 for failure.
- */
-static int llc_sap_next_state(struct llc_sap *sap, struct sk_buff *skb)
-{
-	int rc = 1;
-	struct llc_sap_state_trans *trans;
-
-	if (sap->state <= LLC_NR_SAP_STATES) {
-		trans = llc_find_sap_trans(sap, skb);
-		if (trans) {
-			/* got the state to which we next transition; perform
-			 * the actions associated with this transition before
-			 * actually transitioning to the next state
-			 */
-			rc = llc_exec_sap_trans_actions(sap, trans, skb);
-			if (!rc)
-				/* transition SAP to next state if all actions
-				 * execute successfully
-				 */
-				sap->state = trans->next_state;
-		}
-	}
-	return rc;
-}
-
 /**
  *	llc_find_sap_trans - finds transition for event
  *	@sap: pointer to SAP
@@ -180,13 +104,13 @@ static struct llc_sap_state_trans *llc_find_sap_trans(struct llc_sap *sap,
 	struct llc_sap_state_trans *rc = NULL;
 	struct llc_sap_state_trans **next_trans;
 	struct llc_sap_state *curr_state = &llc_sap_state_table[sap->state - 1];
-	/* search thru events for this state until list exhausted or until
+	/*
+	 * Search thru events for this state until list exhausted or until
 	 * its obvious the event is not valid for the current state
 	 */
 	for (next_trans = curr_state->transitions; next_trans[i]->ev; i++)
 		if (!next_trans[i]->ev(sap, skb)) {
-			/* got event match; return it */
-			rc = next_trans[i];
+			rc = next_trans[i]; /* got event match; return it */
 			break;
 		}
 	return rc;
@@ -213,3 +137,73 @@ static int llc_exec_sap_trans_actions(struct llc_sap *sap,
 			rc = 1;
 	return rc;
 }
+
+/**
+ *	llc_sap_next_state - finds transition, execs actions & change SAP state
+ *	@sap: pointer to SAP
+ *	@skb: happened event
+ *
+ *	This function finds transition that matches with happened event, then
+ *	executes related actions and finally changes state of SAP. It returns
+ *	0 on success and 1 for failure.
+ */
+static int llc_sap_next_state(struct llc_sap *sap, struct sk_buff *skb)
+{
+	int rc = 1;
+	struct llc_sap_state_trans *trans;
+
+	if (sap->state > LLC_NR_SAP_STATES)
+		goto out;
+	trans = llc_find_sap_trans(sap, skb);
+	if (!trans)
+		goto out;
+	/*
+	 * Got the state to which we next transition; perform the actions
+	 * associated with this transition before actually transitioning to the
+	 * next state
+	 */
+	rc = llc_exec_sap_trans_actions(sap, trans, skb);
+	if (rc)
+		goto out;
+	/*
+	 * Transition SAP to next state if all actions execute successfully
+	 */
+	sap->state = trans->next_state;
+out:
+	return rc;
+}
+
+/**
+ *	llc_sap_state_process - sends event to SAP state machine
+ *	@sap: sap to use
+ *	@skb: pointer to occurred event
+ *
+ *	After executing actions of the event, upper layer will be indicated
+ *	if needed(on receiving an UI frame). sk can be null for the
+ *	datalink_proto case.
+ */
+void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
+{
+	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+
+	/*
+	 * We have to hold the skb, because llc_sap_next_state
+	 * will kfree it in the sending path and we need to
+	 * look at the skb->cb, where we encode llc_sap_state_ev.
+	 */
+	skb_get(skb);
+	ev->ind_cfm_flag = 0;
+	llc_sap_next_state(sap, skb);
+	if (ev->ind_cfm_flag == LLC_IND) {
+		if (skb->sk->state == TCP_LISTEN)
+			kfree_skb(skb);
+		else {
+			llc_save_primitive(skb, ev->prim);
+
+			/* queue skb to the user. */
+			if (sock_queue_rcv_skb(skb->sk, skb))
+				kfree_skb(skb);
+		}
+	} 
+	kfree_skb(skb);
+}

net/sctp/protocol.c

@@ -119,8 +119,7 @@ static inline void sctp_v4_get_local_addr_list(sctp_protocol_t *proto,
 
 	for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
 		/* Add the address to the local list.  */
-		/* XXX BUG: sleeping allocation with lock held -DaveM */
-		addr = t_new(struct sockaddr_storage_list, GFP_KERNEL);
+		addr = t_new(struct sockaddr_storage_list, GFP_ATOMIC);
 		if (addr) {
 			INIT_LIST_HEAD(&addr->list);
 			addr->a.v4.sin_family = AF_INET;
@@ -157,8 +156,7 @@ static inline void sctp_v6_get_local_addr_list(sctp_protocol_t *proto,
 	read_lock_bh(&in6_dev->lock);
 	for (ifp = in6_dev->addr_list; ifp; ifp = ifp->if_next) {
 		/* Add the address to the local list.  */
-		/* XXX BUG: sleeping allocation with lock held -DaveM */
-		addr = t_new(struct sockaddr_storage_list, GFP_KERNEL);
+		addr = t_new(struct sockaddr_storage_list, GFP_ATOMIC);
 		if (addr) {
 			addr->a.v6.sin6_family = AF_INET6;
 			addr->a.v6.sin6_port = 0;