1 /*
2  * llc_conn.c - Driver routines for connection component.
3  *
4  * Copyright (c) 1997 by Procom Technology, Inc.
5  *		 2001-2003 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
6  *
7  * This program can be redistributed or modified under the terms of the
8  * GNU General Public License as published by the Free Software Foundation.
9  * This program is distributed without any warranty or implied warranty
10  * of merchantability or fitness for a particular purpose.
11  *
12  * See the GNU General Public License for more details.
13  */
14 
15 #include <linux/init.h>
16 #include <linux/slab.h>
17 #include <net/llc_sap.h>
18 #include <net/llc_conn.h>
19 #include <net/sock.h>
20 #include <net/tcp_states.h>
21 #include <net/llc_c_ev.h>
22 #include <net/llc_c_ac.h>
23 #include <net/llc_c_st.h>
24 #include <net/llc_pdu.h>
25 
26 #if 0
27 #define dprintk(args...) printk(KERN_DEBUG args)
28 #else
29 #define dprintk(args...)
30 #endif
31 
32 static int llc_find_offset(int state, int ev_type);
33 static void llc_conn_send_pdus(struct sock *sk);
34 static int llc_conn_service(struct sock *sk, struct sk_buff *skb);
35 static int llc_exec_conn_trans_actions(struct sock *sk,
36 				       struct llc_conn_state_trans *trans,
37 				       struct sk_buff *ev);
38 static struct llc_conn_state_trans *llc_qualify_conn_ev(struct sock *sk,
39 							struct sk_buff *skb);
40 
41 /* Offset table on connection states transition diagram */
42 static int llc_offset_table[NBR_CONN_STATES][NBR_CONN_EV];
43 
44 int sysctl_llc2_ack_timeout = LLC2_ACK_TIME * HZ;
45 int sysctl_llc2_p_timeout = LLC2_P_TIME * HZ;
46 int sysctl_llc2_rej_timeout = LLC2_REJ_TIME * HZ;
47 int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
48 
49 /**
50  *	llc_conn_state_process - sends event to connection state machine
51  *	@sk: connection
52  *	@skb: occurred event
53  *
54  *	Sends an event to connection state machine. After processing event
55  *	(executing it's actions and changing state), upper layer will be
56  *	indicated or confirmed, if needed. Returns 0 for success, 1 for
57  *	failure. The socket lock has to be held before calling this function.
58  *
59  *	This function always consumes a reference to the skb.
60  */
llc_conn_state_process(struct sock * sk,struct sk_buff * skb)61 int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
62 {
63 	int rc;
64 	struct llc_sock *llc = llc_sk(skb->sk);
65 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
66 
67 	ev->ind_prim = ev->cfm_prim = 0;
68 	/*
69 	 * Send event to state machine
70 	 */
71 	rc = llc_conn_service(skb->sk, skb);
72 	if (unlikely(rc != 0)) {
73 		printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
74 		goto out_skb_put;
75 	}
76 
77 	switch (ev->ind_prim) {
78 	case LLC_DATA_PRIM:
79 		skb_get(skb);
80 		llc_save_primitive(sk, skb, LLC_DATA_PRIM);
81 		if (unlikely(sock_queue_rcv_skb(sk, skb))) {
82 			/*
83 			 * shouldn't happen
84 			 */
85 			printk(KERN_ERR "%s: sock_queue_rcv_skb failed!\n",
86 			       __func__);
87 			kfree_skb(skb);
88 		}
89 		break;
90 	case LLC_CONN_PRIM:
91 		/*
92 		 * Can't be sock_queue_rcv_skb, because we have to leave the
93 		 * skb->sk pointing to the newly created struct sock in
94 		 * llc_conn_handler. -acme
95 		 */
96 		skb_get(skb);
97 		skb_queue_tail(&sk->sk_receive_queue, skb);
98 		sk->sk_state_change(sk);
99 		break;
100 	case LLC_DISC_PRIM:
101 		sock_hold(sk);
102 		if (sk->sk_type == SOCK_STREAM &&
103 		    sk->sk_state == TCP_ESTABLISHED) {
104 			sk->sk_shutdown       = SHUTDOWN_MASK;
105 			sk->sk_socket->state  = SS_UNCONNECTED;
106 			sk->sk_state          = TCP_CLOSE;
107 			if (!sock_flag(sk, SOCK_DEAD)) {
108 				sock_set_flag(sk, SOCK_DEAD);
109 				sk->sk_state_change(sk);
110 			}
111 		}
112 		sock_put(sk);
113 		break;
114 	case LLC_RESET_PRIM:
115 		/*
116 		 * FIXME:
117 		 * RESET is not being notified to upper layers for now
118 		 */
119 		printk(KERN_INFO "%s: received a reset ind!\n", __func__);
120 		break;
121 	default:
122 		if (ev->ind_prim)
123 			printk(KERN_INFO "%s: received unknown %d prim!\n",
124 				__func__, ev->ind_prim);
125 		/* No indication */
126 		break;
127 	}
128 
129 	switch (ev->cfm_prim) {
130 	case LLC_DATA_PRIM:
131 		if (!llc_data_accept_state(llc->state))
132 			sk->sk_write_space(sk);
133 		else
134 			rc = llc->failed_data_req = 1;
135 		break;
136 	case LLC_CONN_PRIM:
137 		if (sk->sk_type == SOCK_STREAM &&
138 		    sk->sk_state == TCP_SYN_SENT) {
139 			if (ev->status) {
140 				sk->sk_socket->state = SS_UNCONNECTED;
141 				sk->sk_state         = TCP_CLOSE;
142 			} else {
143 				sk->sk_socket->state = SS_CONNECTED;
144 				sk->sk_state         = TCP_ESTABLISHED;
145 			}
146 			sk->sk_state_change(sk);
147 		}
148 		break;
149 	case LLC_DISC_PRIM:
150 		sock_hold(sk);
151 		if (sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_CLOSING) {
152 			sk->sk_socket->state = SS_UNCONNECTED;
153 			sk->sk_state         = TCP_CLOSE;
154 			sk->sk_state_change(sk);
155 		}
156 		sock_put(sk);
157 		break;
158 	case LLC_RESET_PRIM:
159 		/*
160 		 * FIXME:
161 		 * RESET is not being notified to upper layers for now
162 		 */
163 		printk(KERN_INFO "%s: received a reset conf!\n", __func__);
164 		break;
165 	default:
166 		if (ev->cfm_prim)
167 			printk(KERN_INFO "%s: received unknown %d prim!\n",
168 					__func__, ev->cfm_prim);
169 		/* No confirmation */
170 		break;
171 	}
172 out_skb_put:
173 	kfree_skb(skb);
174 	return rc;
175 }
176 
llc_conn_send_pdu(struct sock * sk,struct sk_buff * skb)177 void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
178 {
179 	/* queue PDU to send to MAC layer */
180 	skb_queue_tail(&sk->sk_write_queue, skb);
181 	llc_conn_send_pdus(sk);
182 }
183 
184 /**
185  *	llc_conn_rtn_pdu - sends received data pdu to upper layer
186  *	@sk: Active connection
187  *	@skb: Received data frame
188  *
189  *	Sends received data pdu to upper layer (by using indicate function).
190  *	Prepares service parameters (prim and prim_data). calling indication
191  *	function will be done in llc_conn_state_process.
192  */
llc_conn_rtn_pdu(struct sock * sk,struct sk_buff * skb)193 void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb)
194 {
195 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
196 
197 	ev->ind_prim = LLC_DATA_PRIM;
198 }
199 
200 /**
201  *	llc_conn_resend_i_pdu_as_cmd - resend all all unacknowledged I PDUs
202  *	@sk: active connection
203  *	@nr: NR
204  *	@first_p_bit: p_bit value of first pdu
205  *
206  *	Resend all unacknowledged I PDUs, starting with the NR; send first as
207  *	command PDU with P bit equal first_p_bit; if more than one send
208  *	subsequent as command PDUs with P bit equal zero (0).
209  */
llc_conn_resend_i_pdu_as_cmd(struct sock * sk,u8 nr,u8 first_p_bit)210 void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
211 {
212 	struct sk_buff *skb;
213 	struct llc_pdu_sn *pdu;
214 	u16 nbr_unack_pdus;
215 	struct llc_sock *llc;
216 	u8 howmany_resend = 0;
217 
218 	llc_conn_remove_acked_pdus(sk, nr, &nbr_unack_pdus);
219 	if (!nbr_unack_pdus)
220 		goto out;
221 	/*
222 	 * Process unack PDUs only if unack queue is not empty; remove
223 	 * appropriate PDUs, fix them up, and put them on mac_pdu_q.
224 	 */
225 	llc = llc_sk(sk);
226 
227 	while ((skb = skb_dequeue(&llc->pdu_unack_q)) != NULL) {
228 		pdu = llc_pdu_sn_hdr(skb);
229 		llc_pdu_set_cmd_rsp(skb, LLC_PDU_CMD);
230 		llc_pdu_set_pf_bit(skb, first_p_bit);
231 		skb_queue_tail(&sk->sk_write_queue, skb);
232 		first_p_bit = 0;
233 		llc->vS = LLC_I_GET_NS(pdu);
234 		howmany_resend++;
235 	}
236 	if (howmany_resend > 0)
237 		llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
238 	/* any PDUs to re-send are queued up; start sending to MAC */
239 	llc_conn_send_pdus(sk);
240 out:;
241 }
242 
243 /**
244  *	llc_conn_resend_i_pdu_as_rsp - Resend all unacknowledged I PDUs
245  *	@sk: active connection.
246  *	@nr: NR
247  *	@first_f_bit: f_bit value of first pdu.
248  *
249  *	Resend all unacknowledged I PDUs, starting with the NR; send first as
250  *	response PDU with F bit equal first_f_bit; if more than one send
251  *	subsequent as response PDUs with F bit equal zero (0).
252  */
llc_conn_resend_i_pdu_as_rsp(struct sock * sk,u8 nr,u8 first_f_bit)253 void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
254 {
255 	struct sk_buff *skb;
256 	u16 nbr_unack_pdus;
257 	struct llc_sock *llc = llc_sk(sk);
258 	u8 howmany_resend = 0;
259 
260 	llc_conn_remove_acked_pdus(sk, nr, &nbr_unack_pdus);
261 	if (!nbr_unack_pdus)
262 		goto out;
263 	/*
264 	 * Process unack PDUs only if unack queue is not empty; remove
265 	 * appropriate PDUs, fix them up, and put them on mac_pdu_q
266 	 */
267 	while ((skb = skb_dequeue(&llc->pdu_unack_q)) != NULL) {
268 		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
269 
270 		llc_pdu_set_cmd_rsp(skb, LLC_PDU_RSP);
271 		llc_pdu_set_pf_bit(skb, first_f_bit);
272 		skb_queue_tail(&sk->sk_write_queue, skb);
273 		first_f_bit = 0;
274 		llc->vS = LLC_I_GET_NS(pdu);
275 		howmany_resend++;
276 	}
277 	if (howmany_resend > 0)
278 		llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
279 	/* any PDUs to re-send are queued up; start sending to MAC */
280 	llc_conn_send_pdus(sk);
281 out:;
282 }
283 
284 /**
285  *	llc_conn_remove_acked_pdus - Removes acknowledged pdus from tx queue
286  *	@sk: active connection
287  *	@nr: NR
288  *	@how_many_unacked: size of pdu_unack_q after removing acked pdus
289  *
290  *	Removes acknowledged pdus from transmit queue (pdu_unack_q). Returns
291  *	the number of pdus that removed from queue.
292  */
llc_conn_remove_acked_pdus(struct sock * sk,u8 nr,u16 * how_many_unacked)293 int llc_conn_remove_acked_pdus(struct sock *sk, u8 nr, u16 *how_many_unacked)
294 {
295 	int pdu_pos, i;
296 	struct sk_buff *skb;
297 	struct llc_pdu_sn *pdu;
298 	int nbr_acked = 0;
299 	struct llc_sock *llc = llc_sk(sk);
300 	int q_len = skb_queue_len(&llc->pdu_unack_q);
301 
302 	if (!q_len)
303 		goto out;
304 	skb = skb_peek(&llc->pdu_unack_q);
305 	pdu = llc_pdu_sn_hdr(skb);
306 
307 	/* finding position of last acked pdu in queue */
308 	pdu_pos = ((int)LLC_2_SEQ_NBR_MODULO + (int)nr -
309 			(int)LLC_I_GET_NS(pdu)) % LLC_2_SEQ_NBR_MODULO;
310 
311 	for (i = 0; i < pdu_pos && i < q_len; i++) {
312 		skb = skb_dequeue(&llc->pdu_unack_q);
313 		kfree_skb(skb);
314 		nbr_acked++;
315 	}
316 out:
317 	*how_many_unacked = skb_queue_len(&llc->pdu_unack_q);
318 	return nbr_acked;
319 }
320 
321 /**
322  *	llc_conn_send_pdus - Sends queued PDUs
323  *	@sk: active connection
324  *
325  *	Sends queued pdus to MAC layer for transmission.
326  */
llc_conn_send_pdus(struct sock * sk)327 static void llc_conn_send_pdus(struct sock *sk)
328 {
329 	struct sk_buff *skb;
330 
331 	while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) {
332 		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
333 
334 		if (LLC_PDU_TYPE_IS_I(pdu) &&
335 		    !(skb->dev->flags & IFF_LOOPBACK)) {
336 			struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
337 
338 			skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb);
339 			if (!skb2)
340 				break;
341 			skb = skb2;
342 		}
343 		dev_queue_xmit(skb);
344 	}
345 }
346 
347 /**
348  *	llc_conn_service - finds transition and changes state of connection
349  *	@sk: connection
350  *	@skb: happened event
351  *
352  *	This function finds transition that matches with happened event, then
353  *	executes related actions and finally changes state of connection.
354  *	Returns 0 for success, 1 for failure.
355  */
llc_conn_service(struct sock * sk,struct sk_buff * skb)356 static int llc_conn_service(struct sock *sk, struct sk_buff *skb)
357 {
358 	int rc = 1;
359 	struct llc_sock *llc = llc_sk(sk);
360 	struct llc_conn_state_trans *trans;
361 
362 	if (llc->state > NBR_CONN_STATES)
363 		goto out;
364 	rc = 0;
365 	trans = llc_qualify_conn_ev(sk, skb);
366 	if (trans) {
367 		rc = llc_exec_conn_trans_actions(sk, trans, skb);
368 		if (!rc && trans->next_state != NO_STATE_CHANGE) {
369 			llc->state = trans->next_state;
370 			if (!llc_data_accept_state(llc->state))
371 				sk->sk_state_change(sk);
372 		}
373 	}
374 out:
375 	return rc;
376 }
377 
378 /**
379  *	llc_qualify_conn_ev - finds transition for event
380  *	@sk: connection
381  *	@skb: happened event
382  *
383  *	This function finds transition that matches with happened event.
384  *	Returns pointer to found transition on success, %NULL otherwise.
385  */
llc_qualify_conn_ev(struct sock * sk,struct sk_buff * skb)386 static struct llc_conn_state_trans *llc_qualify_conn_ev(struct sock *sk,
387 							struct sk_buff *skb)
388 {
389 	struct llc_conn_state_trans **next_trans;
390 	const llc_conn_ev_qfyr_t *next_qualifier;
391 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
392 	struct llc_sock *llc = llc_sk(sk);
393 	struct llc_conn_state *curr_state =
394 					&llc_conn_state_table[llc->state - 1];
395 
396 	/* search thru events for this state until
397 	 * list exhausted or until no more
398 	 */
399 	for (next_trans = curr_state->transitions +
400 		llc_find_offset(llc->state - 1, ev->type);
401 	     (*next_trans)->ev; next_trans++) {
402 		if (!((*next_trans)->ev)(sk, skb)) {
403 			/* got POSSIBLE event match; the event may require
404 			 * qualification based on the values of a number of
405 			 * state flags; if all qualifications are met (i.e.,
406 			 * if all qualifying functions return success, or 0,
407 			 * then this is THE event we're looking for
408 			 */
409 			for (next_qualifier = (*next_trans)->ev_qualifiers;
410 			     next_qualifier && *next_qualifier &&
411 			     !(*next_qualifier)(sk, skb); next_qualifier++)
412 				/* nothing */;
413 			if (!next_qualifier || !*next_qualifier)
414 				/* all qualifiers executed successfully; this is
415 				 * our transition; return it so we can perform
416 				 * the associated actions & change the state
417 				 */
418 				return *next_trans;
419 		}
420 	}
421 	return NULL;
422 }
423 
424 /**
425  *	llc_exec_conn_trans_actions - executes related actions
426  *	@sk: connection
427  *	@trans: transition that it's actions must be performed
428  *	@skb: event
429  *
430  *	Executes actions that is related to happened event. Returns 0 for
431  *	success, 1 to indicate failure of at least one action.
432  */
llc_exec_conn_trans_actions(struct sock * sk,struct llc_conn_state_trans * trans,struct sk_buff * skb)433 static int llc_exec_conn_trans_actions(struct sock *sk,
434 				       struct llc_conn_state_trans *trans,
435 				       struct sk_buff *skb)
436 {
437 	int rc = 0;
438 	const llc_conn_action_t *next_action;
439 
440 	for (next_action = trans->ev_actions;
441 	     next_action && *next_action; next_action++) {
442 		int rc2 = (*next_action)(sk, skb);
443 
444 		if (rc2 == 2) {
445 			rc = rc2;
446 			break;
447 		} else if (rc2)
448 			rc = 1;
449 	}
450 	return rc;
451 }
452 
llc_estab_match(const struct llc_sap * sap,const struct llc_addr * daddr,const struct llc_addr * laddr,const struct sock * sk)453 static inline bool llc_estab_match(const struct llc_sap *sap,
454 				   const struct llc_addr *daddr,
455 				   const struct llc_addr *laddr,
456 				   const struct sock *sk)
457 {
458 	struct llc_sock *llc = llc_sk(sk);
459 
460 	return llc->laddr.lsap == laddr->lsap &&
461 		llc->daddr.lsap == daddr->lsap &&
462 		ether_addr_equal(llc->laddr.mac, laddr->mac) &&
463 		ether_addr_equal(llc->daddr.mac, daddr->mac);
464 }
465 
466 /**
467  *	__llc_lookup_established - Finds connection for the remote/local sap/mac
468  *	@sap: SAP
469  *	@daddr: address of remote LLC (MAC + SAP)
470  *	@laddr: address of local LLC (MAC + SAP)
471  *
472  *	Search connection list of the SAP and finds connection using the remote
473  *	mac, remote sap, local mac, and local sap. Returns pointer for
474  *	connection found, %NULL otherwise.
475  *	Caller has to make sure local_bh is disabled.
476  */
__llc_lookup_established(struct llc_sap * sap,struct llc_addr * daddr,struct llc_addr * laddr)477 static struct sock *__llc_lookup_established(struct llc_sap *sap,
478 					     struct llc_addr *daddr,
479 					     struct llc_addr *laddr)
480 {
481 	struct sock *rc;
482 	struct hlist_nulls_node *node;
483 	int slot = llc_sk_laddr_hashfn(sap, laddr);
484 	struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
485 
486 	rcu_read_lock();
487 again:
488 	sk_nulls_for_each_rcu(rc, node, laddr_hb) {
489 		if (llc_estab_match(sap, daddr, laddr, rc)) {
490 			/* Extra checks required by SLAB_TYPESAFE_BY_RCU */
491 			if (unlikely(!refcount_inc_not_zero(&rc->sk_refcnt)))
492 				goto again;
493 			if (unlikely(llc_sk(rc)->sap != sap ||
494 				     !llc_estab_match(sap, daddr, laddr, rc))) {
495 				sock_put(rc);
496 				continue;
497 			}
498 			goto found;
499 		}
500 	}
501 	rc = NULL;
502 	/*
503 	 * if the nulls value we got at the end of this lookup is
504 	 * not the expected one, we must restart lookup.
505 	 * We probably met an item that was moved to another chain.
506 	 */
507 	if (unlikely(get_nulls_value(node) != slot))
508 		goto again;
509 found:
510 	rcu_read_unlock();
511 	return rc;
512 }
513 
llc_lookup_established(struct llc_sap * sap,struct llc_addr * daddr,struct llc_addr * laddr)514 struct sock *llc_lookup_established(struct llc_sap *sap,
515 				    struct llc_addr *daddr,
516 				    struct llc_addr *laddr)
517 {
518 	struct sock *sk;
519 
520 	local_bh_disable();
521 	sk = __llc_lookup_established(sap, daddr, laddr);
522 	local_bh_enable();
523 	return sk;
524 }
525 
llc_listener_match(const struct llc_sap * sap,const struct llc_addr * laddr,const struct sock * sk)526 static inline bool llc_listener_match(const struct llc_sap *sap,
527 				      const struct llc_addr *laddr,
528 				      const struct sock *sk)
529 {
530 	struct llc_sock *llc = llc_sk(sk);
531 
532 	return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
533 		llc->laddr.lsap == laddr->lsap &&
534 		ether_addr_equal(llc->laddr.mac, laddr->mac);
535 }
536 
__llc_lookup_listener(struct llc_sap * sap,struct llc_addr * laddr)537 static struct sock *__llc_lookup_listener(struct llc_sap *sap,
538 					  struct llc_addr *laddr)
539 {
540 	struct sock *rc;
541 	struct hlist_nulls_node *node;
542 	int slot = llc_sk_laddr_hashfn(sap, laddr);
543 	struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
544 
545 	rcu_read_lock();
546 again:
547 	sk_nulls_for_each_rcu(rc, node, laddr_hb) {
548 		if (llc_listener_match(sap, laddr, rc)) {
549 			/* Extra checks required by SLAB_TYPESAFE_BY_RCU */
550 			if (unlikely(!refcount_inc_not_zero(&rc->sk_refcnt)))
551 				goto again;
552 			if (unlikely(llc_sk(rc)->sap != sap ||
553 				     !llc_listener_match(sap, laddr, rc))) {
554 				sock_put(rc);
555 				continue;
556 			}
557 			goto found;
558 		}
559 	}
560 	rc = NULL;
561 	/*
562 	 * if the nulls value we got at the end of this lookup is
563 	 * not the expected one, we must restart lookup.
564 	 * We probably met an item that was moved to another chain.
565 	 */
566 	if (unlikely(get_nulls_value(node) != slot))
567 		goto again;
568 found:
569 	rcu_read_unlock();
570 	return rc;
571 }
572 
573 /**
574  *	llc_lookup_listener - Finds listener for local MAC + SAP
575  *	@sap: SAP
576  *	@laddr: address of local LLC (MAC + SAP)
577  *
578  *	Search connection list of the SAP and finds connection listening on
579  *	local mac, and local sap. Returns pointer for parent socket found,
580  *	%NULL otherwise.
581  *	Caller has to make sure local_bh is disabled.
582  */
llc_lookup_listener(struct llc_sap * sap,struct llc_addr * laddr)583 static struct sock *llc_lookup_listener(struct llc_sap *sap,
584 					struct llc_addr *laddr)
585 {
586 	static struct llc_addr null_addr;
587 	struct sock *rc = __llc_lookup_listener(sap, laddr);
588 
589 	if (!rc)
590 		rc = __llc_lookup_listener(sap, &null_addr);
591 
592 	return rc;
593 }
594 
__llc_lookup(struct llc_sap * sap,struct llc_addr * daddr,struct llc_addr * laddr)595 static struct sock *__llc_lookup(struct llc_sap *sap,
596 				 struct llc_addr *daddr,
597 				 struct llc_addr *laddr)
598 {
599 	struct sock *sk = __llc_lookup_established(sap, daddr, laddr);
600 
601 	return sk ? : llc_lookup_listener(sap, laddr);
602 }
603 
604 /**
605  *	llc_data_accept_state - designates if in this state data can be sent.
606  *	@state: state of connection.
607  *
608  *	Returns 0 if data can be sent, 1 otherwise.
609  */
llc_data_accept_state(u8 state)610 u8 llc_data_accept_state(u8 state)
611 {
612 	return state != LLC_CONN_STATE_NORMAL && state != LLC_CONN_STATE_BUSY &&
613 	       state != LLC_CONN_STATE_REJ;
614 }
615 
616 /**
617  *	llc_find_next_offset - finds offset for next category of transitions
618  *	@state: state table.
619  *	@offset: start offset.
620  *
621  *	Finds offset of next category of transitions in transition table.
622  *	Returns the start index of next category.
623  */
llc_find_next_offset(struct llc_conn_state * state,u16 offset)624 static u16 __init llc_find_next_offset(struct llc_conn_state *state, u16 offset)
625 {
626 	u16 cnt = 0;
627 	struct llc_conn_state_trans **next_trans;
628 
629 	for (next_trans = state->transitions + offset;
630 	     (*next_trans)->ev; next_trans++)
631 		++cnt;
632 	return cnt;
633 }
634 
635 /**
636  *	llc_build_offset_table - builds offset table of connection
637  *
638  *	Fills offset table of connection state transition table
639  *	(llc_offset_table).
640  */
llc_build_offset_table(void)641 void __init llc_build_offset_table(void)
642 {
643 	struct llc_conn_state *curr_state;
644 	int state, ev_type, next_offset;
645 
646 	for (state = 0; state < NBR_CONN_STATES; state++) {
647 		curr_state = &llc_conn_state_table[state];
648 		next_offset = 0;
649 		for (ev_type = 0; ev_type < NBR_CONN_EV; ev_type++) {
650 			llc_offset_table[state][ev_type] = next_offset;
651 			next_offset += llc_find_next_offset(curr_state,
652 							    next_offset) + 1;
653 		}
654 	}
655 }
656 
657 /**
658  *	llc_find_offset - finds start offset of category of transitions
659  *	@state: state of connection
660  *	@ev_type: type of happened event
661  *
662  *	Finds start offset of desired category of transitions. Returns the
663  *	desired start offset.
664  */
llc_find_offset(int state,int ev_type)665 static int llc_find_offset(int state, int ev_type)
666 {
667 	int rc = 0;
668 	/* at this stage, llc_offset_table[..][2] is not important. it is for
669 	 * init_pf_cycle and I don't know what is it.
670 	 */
671 	switch (ev_type) {
672 	case LLC_CONN_EV_TYPE_PRIM:
673 		rc = llc_offset_table[state][0]; break;
674 	case LLC_CONN_EV_TYPE_PDU:
675 		rc = llc_offset_table[state][4]; break;
676 	case LLC_CONN_EV_TYPE_SIMPLE:
677 		rc = llc_offset_table[state][1]; break;
678 	case LLC_CONN_EV_TYPE_P_TMR:
679 	case LLC_CONN_EV_TYPE_ACK_TMR:
680 	case LLC_CONN_EV_TYPE_REJ_TMR:
681 	case LLC_CONN_EV_TYPE_BUSY_TMR:
682 		rc = llc_offset_table[state][3]; break;
683 	}
684 	return rc;
685 }
686 
687 /**
688  *	llc_sap_add_socket - adds a socket to a SAP
689  *	@sap: SAP
690  *	@sk: socket
691  *
692  *	This function adds a socket to the hash tables of a SAP.
693  */
llc_sap_add_socket(struct llc_sap * sap,struct sock * sk)694 void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
695 {
696 	struct llc_sock *llc = llc_sk(sk);
697 	struct hlist_head *dev_hb = llc_sk_dev_hash(sap, llc->dev->ifindex);
698 	struct hlist_nulls_head *laddr_hb = llc_sk_laddr_hash(sap, &llc->laddr);
699 
700 	llc_sap_hold(sap);
701 	llc_sk(sk)->sap = sap;
702 
703 	spin_lock_bh(&sap->sk_lock);
704 	sock_set_flag(sk, SOCK_RCU_FREE);
705 	sap->sk_count++;
706 	sk_nulls_add_node_rcu(sk, laddr_hb);
707 	hlist_add_head(&llc->dev_hash_node, dev_hb);
708 	spin_unlock_bh(&sap->sk_lock);
709 }
710 
711 /**
712  *	llc_sap_remove_socket - removes a socket from SAP
713  *	@sap: SAP
714  *	@sk: socket
715  *
716  *	This function removes a connection from the hash tables of a SAP if
717  *	the connection was in this list.
718  */
llc_sap_remove_socket(struct llc_sap * sap,struct sock * sk)719 void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
720 {
721 	struct llc_sock *llc = llc_sk(sk);
722 
723 	spin_lock_bh(&sap->sk_lock);
724 	sk_nulls_del_node_init_rcu(sk);
725 	hlist_del(&llc->dev_hash_node);
726 	sap->sk_count--;
727 	spin_unlock_bh(&sap->sk_lock);
728 	llc_sap_put(sap);
729 }
730 
731 /**
732  *	llc_conn_rcv - sends received pdus to the connection state machine
733  *	@sk: current connection structure.
734  *	@skb: received frame.
735  *
736  *	Sends received pdus to the connection state machine.
737  */
llc_conn_rcv(struct sock * sk,struct sk_buff * skb)738 static int llc_conn_rcv(struct sock *sk, struct sk_buff *skb)
739 {
740 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
741 
742 	ev->type   = LLC_CONN_EV_TYPE_PDU;
743 	ev->reason = 0;
744 	return llc_conn_state_process(sk, skb);
745 }
746 
llc_create_incoming_sock(struct sock * sk,struct net_device * dev,struct llc_addr * saddr,struct llc_addr * daddr)747 static struct sock *llc_create_incoming_sock(struct sock *sk,
748 					     struct net_device *dev,
749 					     struct llc_addr *saddr,
750 					     struct llc_addr *daddr)
751 {
752 	struct sock *newsk = llc_sk_alloc(sock_net(sk), sk->sk_family, GFP_ATOMIC,
753 					  sk->sk_prot, 0);
754 	struct llc_sock *newllc, *llc = llc_sk(sk);
755 
756 	if (!newsk)
757 		goto out;
758 	newllc = llc_sk(newsk);
759 	memcpy(&newllc->laddr, daddr, sizeof(newllc->laddr));
760 	memcpy(&newllc->daddr, saddr, sizeof(newllc->daddr));
761 	newllc->dev = dev;
762 	dev_hold(dev);
763 	llc_sap_add_socket(llc->sap, newsk);
764 	llc_sap_hold(llc->sap);
765 out:
766 	return newsk;
767 }
768 
llc_conn_handler(struct llc_sap * sap,struct sk_buff * skb)769 void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
770 {
771 	struct llc_addr saddr, daddr;
772 	struct sock *sk;
773 
774 	llc_pdu_decode_sa(skb, saddr.mac);
775 	llc_pdu_decode_ssap(skb, &saddr.lsap);
776 	llc_pdu_decode_da(skb, daddr.mac);
777 	llc_pdu_decode_dsap(skb, &daddr.lsap);
778 
779 	sk = __llc_lookup(sap, &saddr, &daddr);
780 	if (!sk)
781 		goto drop;
782 
783 	bh_lock_sock(sk);
784 	/*
785 	 * This has to be done here and not at the upper layer ->accept
786 	 * method because of the way the PROCOM state machine works:
787 	 * it needs to set several state variables (see, for instance,
788 	 * llc_adm_actions_2 in net/llc/llc_c_st.c) and send a packet to
789 	 * the originator of the new connection, and this state has to be
790 	 * in the newly created struct sock private area. -acme
791 	 */
792 	if (unlikely(sk->sk_state == TCP_LISTEN)) {
793 		struct sock *newsk = llc_create_incoming_sock(sk, skb->dev,
794 							      &saddr, &daddr);
795 		if (!newsk)
796 			goto drop_unlock;
797 		skb_set_owner_r(skb, newsk);
798 	} else {
799 		/*
800 		 * Can't be skb_set_owner_r, this will be done at the
801 		 * llc_conn_state_process function, later on, when we will use
802 		 * skb_queue_rcv_skb to send it to upper layers, this is
803 		 * another trick required to cope with how the PROCOM state
804 		 * machine works. -acme
805 		 */
806 		skb_orphan(skb);
807 		sock_hold(sk);
808 		skb->sk = sk;
809 		skb->destructor = sock_efree;
810 	}
811 	if (!sock_owned_by_user(sk))
812 		llc_conn_rcv(sk, skb);
813 	else {
814 		dprintk("%s: adding to backlog...\n", __func__);
815 		llc_set_backlog_type(skb, LLC_PACKET);
816 		if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
817 			goto drop_unlock;
818 	}
819 out:
820 	bh_unlock_sock(sk);
821 	sock_put(sk);
822 	return;
823 drop:
824 	kfree_skb(skb);
825 	return;
826 drop_unlock:
827 	kfree_skb(skb);
828 	goto out;
829 }
830 
831 #undef LLC_REFCNT_DEBUG
832 #ifdef LLC_REFCNT_DEBUG
833 static atomic_t llc_sock_nr;
834 #endif
835 
836 /**
837  *	llc_backlog_rcv - Processes rx frames and expired timers.
838  *	@sk: LLC sock (p8022 connection)
839  *	@skb: queued rx frame or event
840  *
841  *	This function processes frames that has received and timers that has
842  *	expired during sending an I pdu (refer to data_req_handler).  frames
843  *	queue by llc_rcv function (llc_mac.c) and timers queue by timer
844  *	callback functions(llc_c_ac.c).
845  */
llc_backlog_rcv(struct sock * sk,struct sk_buff * skb)846 static int llc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
847 {
848 	int rc = 0;
849 	struct llc_sock *llc = llc_sk(sk);
850 
851 	if (likely(llc_backlog_type(skb) == LLC_PACKET)) {
852 		if (likely(llc->state > 1)) /* not closed */
853 			rc = llc_conn_rcv(sk, skb);
854 		else
855 			goto out_kfree_skb;
856 	} else if (llc_backlog_type(skb) == LLC_EVENT) {
857 		/* timer expiration event */
858 		if (likely(llc->state > 1))  /* not closed */
859 			rc = llc_conn_state_process(sk, skb);
860 		else
861 			goto out_kfree_skb;
862 	} else {
863 		printk(KERN_ERR "%s: invalid skb in backlog\n", __func__);
864 		goto out_kfree_skb;
865 	}
866 out:
867 	return rc;
868 out_kfree_skb:
869 	kfree_skb(skb);
870 	goto out;
871 }
872 
873 /**
874  *     llc_sk_init - Initializes a socket with default llc values.
875  *     @sk: socket to initialize.
876  *
877  *     Initializes a socket with default llc values.
878  */
llc_sk_init(struct sock * sk)879 static void llc_sk_init(struct sock *sk)
880 {
881 	struct llc_sock *llc = llc_sk(sk);
882 
883 	llc->state    = LLC_CONN_STATE_ADM;
884 	llc->inc_cntr = llc->dec_cntr = 2;
885 	llc->dec_step = llc->connect_step = 1;
886 
887 	timer_setup(&llc->ack_timer.timer, llc_conn_ack_tmr_cb, 0);
888 	llc->ack_timer.expire	      = sysctl_llc2_ack_timeout;
889 
890 	timer_setup(&llc->pf_cycle_timer.timer, llc_conn_pf_cycle_tmr_cb, 0);
891 	llc->pf_cycle_timer.expire	   = sysctl_llc2_p_timeout;
892 
893 	timer_setup(&llc->rej_sent_timer.timer, llc_conn_rej_tmr_cb, 0);
894 	llc->rej_sent_timer.expire	   = sysctl_llc2_rej_timeout;
895 
896 	timer_setup(&llc->busy_state_timer.timer, llc_conn_busy_tmr_cb, 0);
897 	llc->busy_state_timer.expire	     = sysctl_llc2_busy_timeout;
898 
899 	llc->n2 = 2;   /* max retransmit */
900 	llc->k  = 2;   /* tx win size, will adjust dynam */
901 	llc->rw = 128; /* rx win size (opt and equal to
902 			* tx_win of remote LLC) */
903 	skb_queue_head_init(&llc->pdu_unack_q);
904 	sk->sk_backlog_rcv = llc_backlog_rcv;
905 }
906 
907 /**
908  *	llc_sk_alloc - Allocates LLC sock
909  *	@net: network namespace
910  *	@family: upper layer protocol family
911  *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
912  *	@prot: struct proto associated with this new sock instance
913  *	@kern: is this to be a kernel socket?
914  *
915  *	Allocates a LLC sock and initializes it. Returns the new LLC sock
916  *	or %NULL if there's no memory available for one
917  */
llc_sk_alloc(struct net * net,int family,gfp_t priority,struct proto * prot,int kern)918 struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, struct proto *prot, int kern)
919 {
920 	struct sock *sk = sk_alloc(net, family, priority, prot, kern);
921 
922 	if (!sk)
923 		goto out;
924 	llc_sk_init(sk);
925 	sock_init_data(NULL, sk);
926 #ifdef LLC_REFCNT_DEBUG
927 	atomic_inc(&llc_sock_nr);
928 	printk(KERN_DEBUG "LLC socket %p created in %s, now we have %d alive\n", sk,
929 		__func__, atomic_read(&llc_sock_nr));
930 #endif
931 out:
932 	return sk;
933 }
934 
llc_sk_stop_all_timers(struct sock * sk,bool sync)935 void llc_sk_stop_all_timers(struct sock *sk, bool sync)
936 {
937 	struct llc_sock *llc = llc_sk(sk);
938 
939 	if (sync) {
940 		del_timer_sync(&llc->pf_cycle_timer.timer);
941 		del_timer_sync(&llc->ack_timer.timer);
942 		del_timer_sync(&llc->rej_sent_timer.timer);
943 		del_timer_sync(&llc->busy_state_timer.timer);
944 	} else {
945 		del_timer(&llc->pf_cycle_timer.timer);
946 		del_timer(&llc->ack_timer.timer);
947 		del_timer(&llc->rej_sent_timer.timer);
948 		del_timer(&llc->busy_state_timer.timer);
949 	}
950 
951 	llc->ack_must_be_send = 0;
952 	llc->ack_pf = 0;
953 }
954 
955 /**
956  *	llc_sk_free - Frees a LLC socket
957  *	@sk: - socket to free
958  *
959  *	Frees a LLC socket
960  */
llc_sk_free(struct sock * sk)961 void llc_sk_free(struct sock *sk)
962 {
963 	struct llc_sock *llc = llc_sk(sk);
964 
965 	llc->state = LLC_CONN_OUT_OF_SVC;
966 	/* Stop all (possibly) running timers */
967 	llc_sk_stop_all_timers(sk, true);
968 #ifdef DEBUG_LLC_CONN_ALLOC
969 	printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__,
970 		skb_queue_len(&llc->pdu_unack_q),
971 		skb_queue_len(&sk->sk_write_queue));
972 #endif
973 	skb_queue_purge(&sk->sk_receive_queue);
974 	skb_queue_purge(&sk->sk_write_queue);
975 	skb_queue_purge(&llc->pdu_unack_q);
976 #ifdef LLC_REFCNT_DEBUG
977 	if (refcount_read(&sk->sk_refcnt) != 1) {
978 		printk(KERN_DEBUG "Destruction of LLC sock %p delayed in %s, cnt=%d\n",
979 			sk, __func__, refcount_read(&sk->sk_refcnt));
980 		printk(KERN_DEBUG "%d LLC sockets are still alive\n",
981 			atomic_read(&llc_sock_nr));
982 	} else {
983 		atomic_dec(&llc_sock_nr);
984 		printk(KERN_DEBUG "LLC socket %p released in %s, %d are still alive\n", sk,
985 			__func__, atomic_read(&llc_sock_nr));
986 	}
987 #endif
988 	sock_put(sk);
989 }
990 
991 /**
992  *	llc_sk_reset - resets a connection
993  *	@sk: LLC socket to reset
994  *
995  *	Resets a connection to the out of service state. Stops its timers
996  *	and frees any frames in the queues of the connection.
997  */
llc_sk_reset(struct sock * sk)998 void llc_sk_reset(struct sock *sk)
999 {
1000 	struct llc_sock *llc = llc_sk(sk);
1001 
1002 	llc_conn_ac_stop_all_timers(sk, NULL);
1003 	skb_queue_purge(&sk->sk_write_queue);
1004 	skb_queue_purge(&llc->pdu_unack_q);
1005 	llc->remote_busy_flag	= 0;
1006 	llc->cause_flag		= 0;
1007 	llc->retry_count	= 0;
1008 	llc_conn_set_p_flag(sk, 0);
1009 	llc->f_flag		= 0;
1010 	llc->s_flag		= 0;
1011 	llc->ack_pf		= 0;
1012 	llc->first_pdu_Ns	= 0;
1013 	llc->ack_must_be_send	= 0;
1014 	llc->dec_step		= 1;
1015 	llc->inc_cntr		= 2;
1016 	llc->dec_cntr		= 2;
1017 	llc->X			= 0;
1018 	llc->failed_data_req	= 0 ;
1019 	llc->last_nr		= 0;
1020 }
1021