18c2ecf20Sopenharmony_ci// SPDX-License-Identifier: GPL-2.0-or-later
28c2ecf20Sopenharmony_ci/*
38c2ecf20Sopenharmony_ci *
48c2ecf20Sopenharmony_ci * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
58c2ecf20Sopenharmony_ci * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
68c2ecf20Sopenharmony_ci */
78c2ecf20Sopenharmony_ci#include <linux/errno.h>
88c2ecf20Sopenharmony_ci#include <linux/types.h>
98c2ecf20Sopenharmony_ci#include <linux/socket.h>
108c2ecf20Sopenharmony_ci#include <linux/spinlock.h>
118c2ecf20Sopenharmony_ci#include <linux/in.h>
128c2ecf20Sopenharmony_ci#include <linux/kernel.h>
138c2ecf20Sopenharmony_ci#include <linux/jiffies.h>
148c2ecf20Sopenharmony_ci#include <linux/timer.h>
158c2ecf20Sopenharmony_ci#include <linux/string.h>
168c2ecf20Sopenharmony_ci#include <linux/sockios.h>
178c2ecf20Sopenharmony_ci#include <linux/net.h>
188c2ecf20Sopenharmony_ci#include <net/tcp_states.h>
198c2ecf20Sopenharmony_ci#include <net/ax25.h>
208c2ecf20Sopenharmony_ci#include <linux/inet.h>
218c2ecf20Sopenharmony_ci#include <linux/netdevice.h>
228c2ecf20Sopenharmony_ci#include <linux/skbuff.h>
238c2ecf20Sopenharmony_ci#include <net/sock.h>
248c2ecf20Sopenharmony_ci#include <linux/uaccess.h>
258c2ecf20Sopenharmony_ci#include <linux/fcntl.h>
268c2ecf20Sopenharmony_ci#include <linux/mm.h>
278c2ecf20Sopenharmony_ci#include <linux/interrupt.h>
288c2ecf20Sopenharmony_ci
298c2ecf20Sopenharmony_cistatic void ax25_ds_timeout(struct timer_list *);
308c2ecf20Sopenharmony_ci
318c2ecf20Sopenharmony_ci/*
328c2ecf20Sopenharmony_ci *	Add DAMA slave timeout timer to timer list.
338c2ecf20Sopenharmony_ci *	Unlike the connection based timers the timeout function gets
348c2ecf20Sopenharmony_ci *	triggered every second. Please note that NET_AX25_DAMA_SLAVE_TIMEOUT
358c2ecf20Sopenharmony_ci *	(aka /proc/sys/net/ax25/{dev}/dama_slave_timeout) is still in
368c2ecf20Sopenharmony_ci *	1/10th of a second.
378c2ecf20Sopenharmony_ci */
388c2ecf20Sopenharmony_ci
398c2ecf20Sopenharmony_civoid ax25_ds_setup_timer(ax25_dev *ax25_dev)
408c2ecf20Sopenharmony_ci{
418c2ecf20Sopenharmony_ci	timer_setup(&ax25_dev->dama.slave_timer, ax25_ds_timeout, 0);
428c2ecf20Sopenharmony_ci}
438c2ecf20Sopenharmony_ci
448c2ecf20Sopenharmony_civoid ax25_ds_del_timer(ax25_dev *ax25_dev)
458c2ecf20Sopenharmony_ci{
468c2ecf20Sopenharmony_ci	if (ax25_dev)
478c2ecf20Sopenharmony_ci		del_timer(&ax25_dev->dama.slave_timer);
488c2ecf20Sopenharmony_ci}
498c2ecf20Sopenharmony_ci
508c2ecf20Sopenharmony_civoid ax25_ds_set_timer(ax25_dev *ax25_dev)
518c2ecf20Sopenharmony_ci{
528c2ecf20Sopenharmony_ci	if (ax25_dev == NULL)		/* paranoia */
538c2ecf20Sopenharmony_ci		return;
548c2ecf20Sopenharmony_ci
558c2ecf20Sopenharmony_ci	ax25_dev->dama.slave_timeout =
568c2ecf20Sopenharmony_ci		msecs_to_jiffies(ax25_dev->values[AX25_VALUES_DS_TIMEOUT]) / 10;
578c2ecf20Sopenharmony_ci	mod_timer(&ax25_dev->dama.slave_timer, jiffies + HZ);
588c2ecf20Sopenharmony_ci}
598c2ecf20Sopenharmony_ci
608c2ecf20Sopenharmony_ci/*
618c2ecf20Sopenharmony_ci *	DAMA Slave Timeout
628c2ecf20Sopenharmony_ci *	Silently discard all (slave) connections in case our master forgot us...
638c2ecf20Sopenharmony_ci */
648c2ecf20Sopenharmony_ci
658c2ecf20Sopenharmony_cistatic void ax25_ds_timeout(struct timer_list *t)
668c2ecf20Sopenharmony_ci{
678c2ecf20Sopenharmony_ci	ax25_dev *ax25_dev = from_timer(ax25_dev, t, dama.slave_timer);
688c2ecf20Sopenharmony_ci	ax25_cb *ax25;
698c2ecf20Sopenharmony_ci
708c2ecf20Sopenharmony_ci	if (ax25_dev == NULL || !ax25_dev->dama.slave)
718c2ecf20Sopenharmony_ci		return;			/* Yikes! */
728c2ecf20Sopenharmony_ci
738c2ecf20Sopenharmony_ci	if (!ax25_dev->dama.slave_timeout || --ax25_dev->dama.slave_timeout) {
748c2ecf20Sopenharmony_ci		ax25_ds_set_timer(ax25_dev);
758c2ecf20Sopenharmony_ci		return;
768c2ecf20Sopenharmony_ci	}
778c2ecf20Sopenharmony_ci
788c2ecf20Sopenharmony_ci	spin_lock(&ax25_list_lock);
798c2ecf20Sopenharmony_ci	ax25_for_each(ax25, &ax25_list) {
808c2ecf20Sopenharmony_ci		if (ax25->ax25_dev != ax25_dev || !(ax25->condition & AX25_COND_DAMA_MODE))
818c2ecf20Sopenharmony_ci			continue;
828c2ecf20Sopenharmony_ci
838c2ecf20Sopenharmony_ci		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
848c2ecf20Sopenharmony_ci		ax25_disconnect(ax25, ETIMEDOUT);
858c2ecf20Sopenharmony_ci	}
868c2ecf20Sopenharmony_ci	spin_unlock(&ax25_list_lock);
878c2ecf20Sopenharmony_ci
888c2ecf20Sopenharmony_ci	ax25_dev_dama_off(ax25_dev);
898c2ecf20Sopenharmony_ci}
908c2ecf20Sopenharmony_ci
918c2ecf20Sopenharmony_civoid ax25_ds_heartbeat_expiry(ax25_cb *ax25)
928c2ecf20Sopenharmony_ci{
938c2ecf20Sopenharmony_ci	struct sock *sk=ax25->sk;
948c2ecf20Sopenharmony_ci
958c2ecf20Sopenharmony_ci	if (sk)
968c2ecf20Sopenharmony_ci		bh_lock_sock(sk);
978c2ecf20Sopenharmony_ci
988c2ecf20Sopenharmony_ci	switch (ax25->state) {
998c2ecf20Sopenharmony_ci
1008c2ecf20Sopenharmony_ci	case AX25_STATE_0:
1018c2ecf20Sopenharmony_ci	case AX25_STATE_2:
1028c2ecf20Sopenharmony_ci		/* Magic here: If we listen() and a new link dies before it
1038c2ecf20Sopenharmony_ci		   is accepted() it isn't 'dead' so doesn't get removed. */
1048c2ecf20Sopenharmony_ci		if (!sk || sock_flag(sk, SOCK_DESTROY) ||
1058c2ecf20Sopenharmony_ci		    (sk->sk_state == TCP_LISTEN &&
1068c2ecf20Sopenharmony_ci		     sock_flag(sk, SOCK_DEAD))) {
1078c2ecf20Sopenharmony_ci			if (sk) {
1088c2ecf20Sopenharmony_ci				sock_hold(sk);
1098c2ecf20Sopenharmony_ci				ax25_destroy_socket(ax25);
1108c2ecf20Sopenharmony_ci				bh_unlock_sock(sk);
1118c2ecf20Sopenharmony_ci				/* Ungrab socket and destroy it */
1128c2ecf20Sopenharmony_ci				sock_put(sk);
1138c2ecf20Sopenharmony_ci			} else
1148c2ecf20Sopenharmony_ci				ax25_destroy_socket(ax25);
1158c2ecf20Sopenharmony_ci			return;
1168c2ecf20Sopenharmony_ci		}
1178c2ecf20Sopenharmony_ci		break;
1188c2ecf20Sopenharmony_ci
1198c2ecf20Sopenharmony_ci	case AX25_STATE_3:
1208c2ecf20Sopenharmony_ci		/*
1218c2ecf20Sopenharmony_ci		 * Check the state of the receive buffer.
1228c2ecf20Sopenharmony_ci		 */
1238c2ecf20Sopenharmony_ci		if (sk != NULL) {
1248c2ecf20Sopenharmony_ci			if (atomic_read(&sk->sk_rmem_alloc) <
1258c2ecf20Sopenharmony_ci			    (sk->sk_rcvbuf >> 1) &&
1268c2ecf20Sopenharmony_ci			    (ax25->condition & AX25_COND_OWN_RX_BUSY)) {
1278c2ecf20Sopenharmony_ci				ax25->condition &= ~AX25_COND_OWN_RX_BUSY;
1288c2ecf20Sopenharmony_ci				ax25->condition &= ~AX25_COND_ACK_PENDING;
1298c2ecf20Sopenharmony_ci				break;
1308c2ecf20Sopenharmony_ci			}
1318c2ecf20Sopenharmony_ci		}
1328c2ecf20Sopenharmony_ci		break;
1338c2ecf20Sopenharmony_ci	}
1348c2ecf20Sopenharmony_ci
1358c2ecf20Sopenharmony_ci	if (sk)
1368c2ecf20Sopenharmony_ci		bh_unlock_sock(sk);
1378c2ecf20Sopenharmony_ci
1388c2ecf20Sopenharmony_ci	ax25_start_heartbeat(ax25);
1398c2ecf20Sopenharmony_ci}
1408c2ecf20Sopenharmony_ci
1418c2ecf20Sopenharmony_ci/* dl1bke 960114: T3 works much like the IDLE timeout, but
1428c2ecf20Sopenharmony_ci *                gets reloaded with every frame for this
1438c2ecf20Sopenharmony_ci *		  connection.
1448c2ecf20Sopenharmony_ci */
1458c2ecf20Sopenharmony_civoid ax25_ds_t3timer_expiry(ax25_cb *ax25)
1468c2ecf20Sopenharmony_ci{
1478c2ecf20Sopenharmony_ci	ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
1488c2ecf20Sopenharmony_ci	ax25_dama_off(ax25);
1498c2ecf20Sopenharmony_ci	ax25_disconnect(ax25, ETIMEDOUT);
1508c2ecf20Sopenharmony_ci}
1518c2ecf20Sopenharmony_ci
1528c2ecf20Sopenharmony_ci/* dl1bke 960228: close the connection when IDLE expires.
1538c2ecf20Sopenharmony_ci *		  unlike T3 this timer gets reloaded only on
1548c2ecf20Sopenharmony_ci *		  I frames.
1558c2ecf20Sopenharmony_ci */
1568c2ecf20Sopenharmony_civoid ax25_ds_idletimer_expiry(ax25_cb *ax25)
1578c2ecf20Sopenharmony_ci{
1588c2ecf20Sopenharmony_ci	ax25_clear_queues(ax25);
1598c2ecf20Sopenharmony_ci
1608c2ecf20Sopenharmony_ci	ax25->n2count = 0;
1618c2ecf20Sopenharmony_ci	ax25->state = AX25_STATE_2;
1628c2ecf20Sopenharmony_ci
1638c2ecf20Sopenharmony_ci	ax25_calculate_t1(ax25);
1648c2ecf20Sopenharmony_ci	ax25_start_t1timer(ax25);
1658c2ecf20Sopenharmony_ci	ax25_stop_t3timer(ax25);
1668c2ecf20Sopenharmony_ci
1678c2ecf20Sopenharmony_ci	if (ax25->sk != NULL) {
1688c2ecf20Sopenharmony_ci		bh_lock_sock(ax25->sk);
1698c2ecf20Sopenharmony_ci		ax25->sk->sk_state     = TCP_CLOSE;
1708c2ecf20Sopenharmony_ci		ax25->sk->sk_err       = 0;
1718c2ecf20Sopenharmony_ci		ax25->sk->sk_shutdown |= SEND_SHUTDOWN;
1728c2ecf20Sopenharmony_ci		if (!sock_flag(ax25->sk, SOCK_DEAD)) {
1738c2ecf20Sopenharmony_ci			ax25->sk->sk_state_change(ax25->sk);
1748c2ecf20Sopenharmony_ci			sock_set_flag(ax25->sk, SOCK_DEAD);
1758c2ecf20Sopenharmony_ci		}
1768c2ecf20Sopenharmony_ci		bh_unlock_sock(ax25->sk);
1778c2ecf20Sopenharmony_ci	}
1788c2ecf20Sopenharmony_ci}
1798c2ecf20Sopenharmony_ci
1808c2ecf20Sopenharmony_ci/* dl1bke 960114: The DAMA protocol requires to send data and SABM/DISC
1818c2ecf20Sopenharmony_ci *                within the poll of any connected channel. Remember
1828c2ecf20Sopenharmony_ci *                that we are not allowed to send anything unless we
1838c2ecf20Sopenharmony_ci *                get polled by the Master.
1848c2ecf20Sopenharmony_ci *
1858c2ecf20Sopenharmony_ci *                Thus we'll have to do parts of our T1 handling in
1868c2ecf20Sopenharmony_ci *                ax25_enquiry_response().
1878c2ecf20Sopenharmony_ci */
1888c2ecf20Sopenharmony_civoid ax25_ds_t1_timeout(ax25_cb *ax25)
1898c2ecf20Sopenharmony_ci{
1908c2ecf20Sopenharmony_ci	switch (ax25->state) {
1918c2ecf20Sopenharmony_ci	case AX25_STATE_1:
1928c2ecf20Sopenharmony_ci		if (ax25->n2count == ax25->n2) {
1938c2ecf20Sopenharmony_ci			if (ax25->modulus == AX25_MODULUS) {
1948c2ecf20Sopenharmony_ci				ax25_disconnect(ax25, ETIMEDOUT);
1958c2ecf20Sopenharmony_ci				return;
1968c2ecf20Sopenharmony_ci			} else {
1978c2ecf20Sopenharmony_ci				ax25->modulus = AX25_MODULUS;
1988c2ecf20Sopenharmony_ci				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
1998c2ecf20Sopenharmony_ci				ax25->n2count = 0;
2008c2ecf20Sopenharmony_ci				ax25_send_control(ax25, AX25_SABM, AX25_POLLOFF, AX25_COMMAND);
2018c2ecf20Sopenharmony_ci			}
2028c2ecf20Sopenharmony_ci		} else {
2038c2ecf20Sopenharmony_ci			ax25->n2count++;
2048c2ecf20Sopenharmony_ci			if (ax25->modulus == AX25_MODULUS)
2058c2ecf20Sopenharmony_ci				ax25_send_control(ax25, AX25_SABM, AX25_POLLOFF, AX25_COMMAND);
2068c2ecf20Sopenharmony_ci			else
2078c2ecf20Sopenharmony_ci				ax25_send_control(ax25, AX25_SABME, AX25_POLLOFF, AX25_COMMAND);
2088c2ecf20Sopenharmony_ci		}
2098c2ecf20Sopenharmony_ci		break;
2108c2ecf20Sopenharmony_ci
2118c2ecf20Sopenharmony_ci	case AX25_STATE_2:
2128c2ecf20Sopenharmony_ci		if (ax25->n2count == ax25->n2) {
2138c2ecf20Sopenharmony_ci			ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
2148c2ecf20Sopenharmony_ci			if (!sock_flag(ax25->sk, SOCK_DESTROY))
2158c2ecf20Sopenharmony_ci				ax25_disconnect(ax25, ETIMEDOUT);
2168c2ecf20Sopenharmony_ci			return;
2178c2ecf20Sopenharmony_ci		} else {
2188c2ecf20Sopenharmony_ci			ax25->n2count++;
2198c2ecf20Sopenharmony_ci		}
2208c2ecf20Sopenharmony_ci		break;
2218c2ecf20Sopenharmony_ci
2228c2ecf20Sopenharmony_ci	case AX25_STATE_3:
2238c2ecf20Sopenharmony_ci		if (ax25->n2count == ax25->n2) {
2248c2ecf20Sopenharmony_ci			ax25_send_control(ax25, AX25_DM, AX25_POLLON, AX25_RESPONSE);
2258c2ecf20Sopenharmony_ci			ax25_disconnect(ax25, ETIMEDOUT);
2268c2ecf20Sopenharmony_ci			return;
2278c2ecf20Sopenharmony_ci		} else {
2288c2ecf20Sopenharmony_ci			ax25->n2count++;
2298c2ecf20Sopenharmony_ci		}
2308c2ecf20Sopenharmony_ci		break;
2318c2ecf20Sopenharmony_ci	}
2328c2ecf20Sopenharmony_ci
2338c2ecf20Sopenharmony_ci	ax25_calculate_t1(ax25);
2348c2ecf20Sopenharmony_ci	ax25_start_t1timer(ax25);
2358c2ecf20Sopenharmony_ci}
236