1/*********************************************************************
2 *
3 * Filename:      irlap_frame.c
4 * Version:       1.0
5 * Description:   Build and transmit IrLAP frames
6 * Status:        Stable
7 * Author:        Dag Brattli <dagb@cs.uit.no>
8 * Created at:    Tue Aug 19 10:27:26 1997
9 * Modified at:   Wed Jan  5 08:59:04 2000
10 * Modified by:   Dag Brattli <dagb@cs.uit.no>
11 *
12 *     Copyright (c) 1998-2000 Dag Brattli <dagb@cs.uit.no>,
13 *     All Rights Reserved.
14 *     Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
15 *
16 *     This program is free software; you can redistribute it and/or
17 *     modify it under the terms of the GNU General Public License as
18 *     published by the Free Software Foundation; either version 2 of
19 *     the License, or (at your option) any later version.
20 *
21 *     Neither Dag Brattli nor University of Tromsø admit liability nor
22 *     provide warranty for any of this software. This material is
23 *     provided "AS-IS" and at no charge.
24 *
25 ********************************************************************/
26
27#include <linux/skbuff.h>
28#include <linux/if.h>
29#include <linux/if_ether.h>
30#include <linux/netdevice.h>
31#include <linux/irda.h>
32#include <linux/slab.h>
33
34#include <net/pkt_sched.h>
35#include <net/sock.h>
36
37#include <asm/byteorder.h>
38
39#include <net/irda/irda.h>
40#include <net/irda/irda_device.h>
41#include <net/irda/irlap.h>
42#include <net/irda/wrapper.h>
43#include <net/irda/timer.h>
44#include <net/irda/irlap_frame.h>
45#include <net/irda/qos.h>
46
47static void irlap_send_i_frame(struct irlap_cb *self, struct sk_buff *skb,
48			       int command);
49
50/*
51 * Function irlap_insert_info (self, skb)
52 *
53 *    Insert minimum turnaround time and speed information into the skb. We
54 *    need to do this since it's per packet relevant information. Safe to
55 *    have this function inlined since it's only called from one place
56 */
57static inline void irlap_insert_info(struct irlap_cb *self,
58				     struct sk_buff *skb)
59{
60	struct irda_skb_cb *cb = (struct irda_skb_cb *) skb->cb;
61
62	/*
63	 * Insert MTT (min. turn time) and speed into skb, so that the
64	 * device driver knows which settings to use
65	 */
66	cb->magic = LAP_MAGIC;
67	cb->mtt = self->mtt_required;
68	cb->next_speed = self->speed;
69
70	/* Reset */
71	self->mtt_required = 0;
72
73	/*
74	 * Delay equals negotiated BOFs count, plus the number of BOFs to
75	 * force the negotiated minimum turnaround time
76	 */
77	cb->xbofs = self->bofs_count;
78	cb->next_xbofs = self->next_bofs;
79	cb->xbofs_delay = self->xbofs_delay;
80
81	/* Reset XBOF's delay (used only for getting min turn time) */
82	self->xbofs_delay = 0;
83	/* Put the correct xbofs value for the next packet */
84	self->bofs_count = self->next_bofs;
85}
86
87/*
88 * Function irlap_queue_xmit (self, skb)
89 *
90 *    A little wrapper for dev_queue_xmit, so we can insert some common
91 *    code into it.
92 */
93void irlap_queue_xmit(struct irlap_cb *self, struct sk_buff *skb)
94{
95	/* Some common init stuff */
96	skb->dev = self->netdev;
97	skb_reset_mac_header(skb);
98	skb_reset_network_header(skb);
99	skb_reset_transport_header(skb);
100	skb->protocol = htons(ETH_P_IRDA);
101	skb->priority = TC_PRIO_BESTEFFORT;
102
103	irlap_insert_info(self, skb);
104
105	if (unlikely(self->mode & IRDA_MODE_MONITOR)) {
106		pr_debug("%s(): %s is in monitor mode\n", __func__,
107			 self->netdev->name);
108		dev_kfree_skb(skb);
109		return;
110	}
111
112	dev_queue_xmit(skb);
113}
114
115/*
116 * Function irlap_send_snrm_cmd (void)
117 *
118 *    Transmits a connect SNRM command frame
119 */
120void irlap_send_snrm_frame(struct irlap_cb *self, struct qos_info *qos)
121{
122	struct sk_buff *tx_skb;
123	struct snrm_frame *frame;
124	int ret;
125
126	IRDA_ASSERT(self != NULL, return;);
127	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
128
129	/* Allocate frame */
130	tx_skb = alloc_skb(sizeof(struct snrm_frame) +
131			   IRLAP_NEGOCIATION_PARAMS_LEN,
132			   GFP_ATOMIC);
133	if (!tx_skb)
134		return;
135
136	frame = (struct snrm_frame *) skb_put(tx_skb, 2);
137
138	/* Insert connection address field */
139	if (qos)
140		frame->caddr = CMD_FRAME | CBROADCAST;
141	else
142		frame->caddr = CMD_FRAME | self->caddr;
143
144	/* Insert control field */
145	frame->control = SNRM_CMD | PF_BIT;
146
147	/*
148	 *  If we are establishing a connection then insert QoS parameters
149	 */
150	if (qos) {
151		skb_put(tx_skb, 9); /* 25 left */
152		frame->saddr = cpu_to_le32(self->saddr);
153		frame->daddr = cpu_to_le32(self->daddr);
154
155		frame->ncaddr = self->caddr;
156
157		ret = irlap_insert_qos_negotiation_params(self, tx_skb);
158		if (ret < 0) {
159			dev_kfree_skb(tx_skb);
160			return;
161		}
162	}
163	irlap_queue_xmit(self, tx_skb);
164}
165
166/*
167 * Function irlap_recv_snrm_cmd (skb, info)
168 *
169 *    Received SNRM (Set Normal Response Mode) command frame
170 *
171 */
172static void irlap_recv_snrm_cmd(struct irlap_cb *self, struct sk_buff *skb,
173				struct irlap_info *info)
174{
175	struct snrm_frame *frame;
176
177	if (pskb_may_pull(skb,sizeof(struct snrm_frame))) {
178		frame = (struct snrm_frame *) skb->data;
179
180		/* Copy the new connection address ignoring the C/R bit */
181		info->caddr = frame->ncaddr & 0xFE;
182
183		/* Check if the new connection address is valid */
184		if ((info->caddr == 0x00) || (info->caddr == 0xfe)) {
185			pr_debug("%s(), invalid connection address!\n",
186				 __func__);
187			return;
188		}
189
190		/* Copy peer device address */
191		info->daddr = le32_to_cpu(frame->saddr);
192		info->saddr = le32_to_cpu(frame->daddr);
193
194		/* Only accept if addressed directly to us */
195		if (info->saddr != self->saddr) {
196			pr_debug("%s(), not addressed to us!\n",
197				 __func__);
198			return;
199		}
200		irlap_do_event(self, RECV_SNRM_CMD, skb, info);
201	} else {
202		/* Signal that this SNRM frame does not contain and I-field */
203		irlap_do_event(self, RECV_SNRM_CMD, skb, NULL);
204	}
205}
206
207/*
208 * Function irlap_send_ua_response_frame (qos)
209 *
210 *    Send UA (Unnumbered Acknowledgement) frame
211 *
212 */
213void irlap_send_ua_response_frame(struct irlap_cb *self, struct qos_info *qos)
214{
215	struct sk_buff *tx_skb;
216	struct ua_frame *frame;
217	int ret;
218
219	pr_debug("%s() <%ld>\n", __func__, jiffies);
220
221	IRDA_ASSERT(self != NULL, return;);
222	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
223
224	/* Allocate frame */
225	tx_skb = alloc_skb(sizeof(struct ua_frame) +
226			   IRLAP_NEGOCIATION_PARAMS_LEN,
227			   GFP_ATOMIC);
228	if (!tx_skb)
229		return;
230
231	frame = (struct ua_frame *) skb_put(tx_skb, 10);
232
233	/* Build UA response */
234	frame->caddr = self->caddr;
235	frame->control = UA_RSP | PF_BIT;
236
237	frame->saddr = cpu_to_le32(self->saddr);
238	frame->daddr = cpu_to_le32(self->daddr);
239
240	/* Should we send QoS negotiation parameters? */
241	if (qos) {
242		ret = irlap_insert_qos_negotiation_params(self, tx_skb);
243		if (ret < 0) {
244			dev_kfree_skb(tx_skb);
245			return;
246		}
247	}
248
249	irlap_queue_xmit(self, tx_skb);
250}
251
252
253/*
254 * Function irlap_send_dm_frame (void)
255 *
256 *    Send disconnected mode (DM) frame
257 *
258 */
259void irlap_send_dm_frame( struct irlap_cb *self)
260{
261	struct sk_buff *tx_skb = NULL;
262	struct dm_frame *frame;
263
264	IRDA_ASSERT(self != NULL, return;);
265	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
266
267	tx_skb = alloc_skb(sizeof(struct dm_frame), GFP_ATOMIC);
268	if (!tx_skb)
269		return;
270
271	frame = (struct dm_frame *)skb_put(tx_skb, 2);
272
273	if (self->state == LAP_NDM)
274		frame->caddr = CBROADCAST;
275	else
276		frame->caddr = self->caddr;
277
278	frame->control = DM_RSP | PF_BIT;
279
280	irlap_queue_xmit(self, tx_skb);
281}
282
283/*
284 * Function irlap_send_disc_frame (void)
285 *
286 *    Send disconnect (DISC) frame
287 *
288 */
289void irlap_send_disc_frame(struct irlap_cb *self)
290{
291	struct sk_buff *tx_skb = NULL;
292	struct disc_frame *frame;
293
294	IRDA_ASSERT(self != NULL, return;);
295	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
296
297	tx_skb = alloc_skb(sizeof(struct disc_frame), GFP_ATOMIC);
298	if (!tx_skb)
299		return;
300
301	frame = (struct disc_frame *)skb_put(tx_skb, 2);
302
303	frame->caddr = self->caddr | CMD_FRAME;
304	frame->control = DISC_CMD | PF_BIT;
305
306	irlap_queue_xmit(self, tx_skb);
307}
308
309/*
310 * Function irlap_send_discovery_xid_frame (S, s, command)
311 *
312 *    Build and transmit a XID (eXchange station IDentifier) discovery
313 *    frame.
314 */
315void irlap_send_discovery_xid_frame(struct irlap_cb *self, int S, __u8 s,
316				    __u8 command, discovery_t *discovery)
317{
318	struct sk_buff *tx_skb = NULL;
319	struct xid_frame *frame;
320	__u32 bcast = BROADCAST;
321	__u8 *info;
322
323	pr_debug("%s(), s=%d, S=%d, command=%d\n", __func__,
324		 s, S, command);
325
326	IRDA_ASSERT(self != NULL, return;);
327	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
328	IRDA_ASSERT(discovery != NULL, return;);
329
330	tx_skb = alloc_skb(sizeof(struct xid_frame) + IRLAP_DISCOVERY_INFO_LEN,
331			   GFP_ATOMIC);
332	if (!tx_skb)
333		return;
334
335	skb_put(tx_skb, 14);
336	frame = (struct xid_frame *) tx_skb->data;
337
338	if (command) {
339		frame->caddr = CBROADCAST | CMD_FRAME;
340		frame->control =  XID_CMD | PF_BIT;
341	} else {
342		frame->caddr = CBROADCAST;
343		frame->control =  XID_RSP | PF_BIT;
344	}
345	frame->ident = XID_FORMAT;
346
347	frame->saddr = cpu_to_le32(self->saddr);
348
349	if (command)
350		frame->daddr = cpu_to_le32(bcast);
351	else
352		frame->daddr = cpu_to_le32(discovery->data.daddr);
353
354	switch (S) {
355	case 1:
356		frame->flags = 0x00;
357		break;
358	case 6:
359		frame->flags = 0x01;
360		break;
361	case 8:
362		frame->flags = 0x02;
363		break;
364	case 16:
365		frame->flags = 0x03;
366		break;
367	default:
368		frame->flags = 0x02;
369		break;
370	}
371
372	frame->slotnr = s;
373	frame->version = 0x00;
374
375	/*
376	 *  Provide info for final slot only in commands, and for all
377	 *  responses. Send the second byte of the hint only if the
378	 *  EXTENSION bit is set in the first byte.
379	 */
380	if (!command || (frame->slotnr == 0xff)) {
381		int len;
382
383		if (discovery->data.hints[0] & HINT_EXTENSION) {
384			info = skb_put(tx_skb, 2);
385			info[0] = discovery->data.hints[0];
386			info[1] = discovery->data.hints[1];
387		} else {
388			info = skb_put(tx_skb, 1);
389			info[0] = discovery->data.hints[0];
390		}
391		info = skb_put(tx_skb, 1);
392		info[0] = discovery->data.charset;
393
394		len = IRDA_MIN(discovery->name_len, skb_tailroom(tx_skb));
395		info = skb_put(tx_skb, len);
396		memcpy(info, discovery->data.info, len);
397	}
398	irlap_queue_xmit(self, tx_skb);
399}
400
401/*
402 * Function irlap_recv_discovery_xid_rsp (skb, info)
403 *
404 *    Received a XID discovery response
405 *
406 */
407static void irlap_recv_discovery_xid_rsp(struct irlap_cb *self,
408					 struct sk_buff *skb,
409					 struct irlap_info *info)
410{
411	struct xid_frame *xid;
412	discovery_t *discovery = NULL;
413	__u8 *discovery_info;
414	char *text;
415
416	IRDA_ASSERT(self != NULL, return;);
417	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
418
419	if (!pskb_may_pull(skb, sizeof(struct xid_frame))) {
420		net_err_ratelimited("%s: frame too short!\n", __func__);
421		return;
422	}
423
424	xid = (struct xid_frame *) skb->data;
425
426	info->daddr = le32_to_cpu(xid->saddr);
427	info->saddr = le32_to_cpu(xid->daddr);
428
429	/* Make sure frame is addressed to us */
430	if ((info->saddr != self->saddr) && (info->saddr != BROADCAST)) {
431		pr_debug("%s(), frame is not addressed to us!\n",
432			 __func__);
433		return;
434	}
435
436	if ((discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC)) == NULL) {
437		net_warn_ratelimited("%s: kmalloc failed!\n", __func__);
438		return;
439	}
440
441	discovery->data.daddr = info->daddr;
442	discovery->data.saddr = self->saddr;
443	discovery->timestamp = jiffies;
444
445	pr_debug("%s(), daddr=%08x\n", __func__,
446		 discovery->data.daddr);
447
448	discovery_info = skb_pull(skb, sizeof(struct xid_frame));
449
450	/* Get info returned from peer */
451	discovery->data.hints[0] = discovery_info[0];
452	if (discovery_info[0] & HINT_EXTENSION) {
453		pr_debug("EXTENSION\n");
454		discovery->data.hints[1] = discovery_info[1];
455		discovery->data.charset = discovery_info[2];
456		text = (char *) &discovery_info[3];
457	} else {
458		discovery->data.hints[1] = 0;
459		discovery->data.charset = discovery_info[1];
460		text = (char *) &discovery_info[2];
461	}
462	/*
463	 *  Terminate info string, should be safe since this is where the
464	 *  FCS bytes resides.
465	 */
466	skb->data[skb->len] = '\0';
467	strncpy(discovery->data.info, text, NICKNAME_MAX_LEN);
468	discovery->name_len = strlen(discovery->data.info);
469
470	info->discovery = discovery;
471
472	irlap_do_event(self, RECV_DISCOVERY_XID_RSP, skb, info);
473}
474
475/*
476 * Function irlap_recv_discovery_xid_cmd (skb, info)
477 *
478 *    Received a XID discovery command
479 *
480 */
481static void irlap_recv_discovery_xid_cmd(struct irlap_cb *self,
482					 struct sk_buff *skb,
483					 struct irlap_info *info)
484{
485	struct xid_frame *xid;
486	discovery_t *discovery = NULL;
487	__u8 *discovery_info;
488	char *text;
489
490	if (!pskb_may_pull(skb, sizeof(struct xid_frame))) {
491		net_err_ratelimited("%s: frame too short!\n", __func__);
492		return;
493	}
494
495	xid = (struct xid_frame *) skb->data;
496
497	info->daddr = le32_to_cpu(xid->saddr);
498	info->saddr = le32_to_cpu(xid->daddr);
499
500	/* Make sure frame is addressed to us */
501	if ((info->saddr != self->saddr) && (info->saddr != BROADCAST)) {
502		pr_debug("%s(), frame is not addressed to us!\n",
503			 __func__);
504		return;
505	}
506
507	switch (xid->flags & 0x03) {
508	case 0x00:
509		info->S = 1;
510		break;
511	case 0x01:
512		info->S = 6;
513		break;
514	case 0x02:
515		info->S = 8;
516		break;
517	case 0x03:
518		info->S = 16;
519		break;
520	default:
521		/* Error!! */
522		return;
523	}
524	info->s = xid->slotnr;
525
526	discovery_info = skb_pull(skb, sizeof(struct xid_frame));
527
528	/*
529	 *  Check if last frame
530	 */
531	if (info->s == 0xff) {
532		/* Check if things are sane at this point... */
533		if((discovery_info == NULL) ||
534		   !pskb_may_pull(skb, 3)) {
535			net_err_ratelimited("%s: discovery frame too short!\n",
536					    __func__);
537			return;
538		}
539
540		/*
541		 *  We now have some discovery info to deliver!
542		 */
543		discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC);
544		if (!discovery)
545			return;
546
547		discovery->data.daddr = info->daddr;
548		discovery->data.saddr = self->saddr;
549		discovery->timestamp = jiffies;
550
551		discovery->data.hints[0] = discovery_info[0];
552		if (discovery_info[0] & HINT_EXTENSION) {
553			discovery->data.hints[1] = discovery_info[1];
554			discovery->data.charset = discovery_info[2];
555			text = (char *) &discovery_info[3];
556		} else {
557			discovery->data.hints[1] = 0;
558			discovery->data.charset = discovery_info[1];
559			text = (char *) &discovery_info[2];
560		}
561		/*
562		 *  Terminate string, should be safe since this is where the
563		 *  FCS bytes resides.
564		 */
565		skb->data[skb->len] = '\0';
566		strncpy(discovery->data.info, text, NICKNAME_MAX_LEN);
567		discovery->name_len = strlen(discovery->data.info);
568
569		info->discovery = discovery;
570	} else
571		info->discovery = NULL;
572
573	irlap_do_event(self, RECV_DISCOVERY_XID_CMD, skb, info);
574}
575
576/*
577 * Function irlap_send_rr_frame (self, command)
578 *
579 *    Build and transmit RR (Receive Ready) frame. Notice that it is currently
580 *    only possible to send RR frames with the poll bit set.
581 */
582void irlap_send_rr_frame(struct irlap_cb *self, int command)
583{
584	struct sk_buff *tx_skb;
585	struct rr_frame *frame;
586
587	tx_skb = alloc_skb(sizeof(struct rr_frame), GFP_ATOMIC);
588	if (!tx_skb)
589		return;
590
591	frame = (struct rr_frame *)skb_put(tx_skb, 2);
592
593	frame->caddr = self->caddr;
594	frame->caddr |= (command) ? CMD_FRAME : 0;
595
596	frame->control = RR | PF_BIT | (self->vr << 5);
597
598	irlap_queue_xmit(self, tx_skb);
599}
600
601/*
602 * Function irlap_send_rd_frame (self)
603 *
604 *    Request disconnect. Used by a secondary station to request the
605 *    disconnection of the link.
606 */
607void irlap_send_rd_frame(struct irlap_cb *self)
608{
609	struct sk_buff *tx_skb;
610	struct rd_frame *frame;
611
612	tx_skb = alloc_skb(sizeof(struct rd_frame), GFP_ATOMIC);
613	if (!tx_skb)
614		return;
615
616	frame = (struct rd_frame *)skb_put(tx_skb, 2);
617
618	frame->caddr = self->caddr;
619	frame->control = RD_RSP | PF_BIT;
620
621	irlap_queue_xmit(self, tx_skb);
622}
623
624/*
625 * Function irlap_recv_rr_frame (skb, info)
626 *
627 *    Received RR (Receive Ready) frame from peer station, no harm in
628 *    making it inline since its called only from one single place
629 *    (irlap_driver_rcv).
630 */
631static inline void irlap_recv_rr_frame(struct irlap_cb *self,
632				       struct sk_buff *skb,
633				       struct irlap_info *info, int command)
634{
635	info->nr = skb->data[1] >> 5;
636
637	/* Check if this is a command or a response frame */
638	if (command)
639		irlap_do_event(self, RECV_RR_CMD, skb, info);
640	else
641		irlap_do_event(self, RECV_RR_RSP, skb, info);
642}
643
644/*
645 * Function irlap_recv_rnr_frame (self, skb, info)
646 *
647 *    Received RNR (Receive Not Ready) frame from peer station
648 *
649 */
650static void irlap_recv_rnr_frame(struct irlap_cb *self, struct sk_buff *skb,
651				 struct irlap_info *info, int command)
652{
653	info->nr = skb->data[1] >> 5;
654
655	pr_debug("%s(), nr=%d, %ld\n", __func__, info->nr, jiffies);
656
657	if (command)
658		irlap_do_event(self, RECV_RNR_CMD, skb, info);
659	else
660		irlap_do_event(self, RECV_RNR_RSP, skb, info);
661}
662
663static void irlap_recv_rej_frame(struct irlap_cb *self, struct sk_buff *skb,
664				 struct irlap_info *info, int command)
665{
666	info->nr = skb->data[1] >> 5;
667
668	/* Check if this is a command or a response frame */
669	if (command)
670		irlap_do_event(self, RECV_REJ_CMD, skb, info);
671	else
672		irlap_do_event(self, RECV_REJ_RSP, skb, info);
673}
674
675static void irlap_recv_srej_frame(struct irlap_cb *self, struct sk_buff *skb,
676				  struct irlap_info *info, int command)
677{
678	info->nr = skb->data[1] >> 5;
679
680	/* Check if this is a command or a response frame */
681	if (command)
682		irlap_do_event(self, RECV_SREJ_CMD, skb, info);
683	else
684		irlap_do_event(self, RECV_SREJ_RSP, skb, info);
685}
686
687static void irlap_recv_disc_frame(struct irlap_cb *self, struct sk_buff *skb,
688				  struct irlap_info *info, int command)
689{
690	/* Check if this is a command or a response frame */
691	if (command)
692		irlap_do_event(self, RECV_DISC_CMD, skb, info);
693	else
694		irlap_do_event(self, RECV_RD_RSP, skb, info);
695}
696
697/*
698 * Function irlap_recv_ua_frame (skb, frame)
699 *
700 *    Received UA (Unnumbered Acknowledgement) frame
701 *
702 */
703static inline void irlap_recv_ua_frame(struct irlap_cb *self,
704				       struct sk_buff *skb,
705				       struct irlap_info *info)
706{
707	irlap_do_event(self, RECV_UA_RSP, skb, info);
708}
709
710/*
711 * Function irlap_send_data_primary(self, skb)
712 *
713 *    Send I-frames as the primary station but without the poll bit set
714 *
715 */
716void irlap_send_data_primary(struct irlap_cb *self, struct sk_buff *skb)
717{
718	struct sk_buff *tx_skb;
719
720	if (skb->data[1] == I_FRAME) {
721
722		/*
723		 *  Insert frame sequence number (Vs) in control field before
724		 *  inserting into transmit window queue.
725		 */
726		skb->data[1] = I_FRAME | (self->vs << 1);
727
728		/*
729		 *  Insert frame in store, in case of retransmissions
730		 *  Increase skb reference count, see irlap_do_event()
731		 */
732		skb_get(skb);
733		skb_queue_tail(&self->wx_list, skb);
734
735		/* Copy buffer */
736		tx_skb = skb_clone(skb, GFP_ATOMIC);
737		if (tx_skb == NULL) {
738			return;
739		}
740
741		self->vs = (self->vs + 1) % 8;
742		self->ack_required = FALSE;
743		self->window -= 1;
744
745		irlap_send_i_frame( self, tx_skb, CMD_FRAME);
746	} else {
747		pr_debug("%s(), sending unreliable frame\n", __func__);
748		irlap_send_ui_frame(self, skb_get(skb), self->caddr, CMD_FRAME);
749		self->window -= 1;
750	}
751}
752/*
753 * Function irlap_send_data_primary_poll (self, skb)
754 *
755 *    Send I(nformation) frame as primary with poll bit set
756 */
757void irlap_send_data_primary_poll(struct irlap_cb *self, struct sk_buff *skb)
758{
759	struct sk_buff *tx_skb;
760	int transmission_time;
761
762	/* Stop P timer */
763	del_timer(&self->poll_timer);
764
765	/* Is this reliable or unreliable data? */
766	if (skb->data[1] == I_FRAME) {
767
768		/*
769		 *  Insert frame sequence number (Vs) in control field before
770		 *  inserting into transmit window queue.
771		 */
772		skb->data[1] = I_FRAME | (self->vs << 1);
773
774		/*
775		 *  Insert frame in store, in case of retransmissions
776		 *  Increase skb reference count, see irlap_do_event()
777		 */
778		skb_get(skb);
779		skb_queue_tail(&self->wx_list, skb);
780
781		/* Copy buffer */
782		tx_skb = skb_clone(skb, GFP_ATOMIC);
783		if (tx_skb == NULL) {
784			return;
785		}
786
787		/*
788		 *  Set poll bit if necessary. We do this to the copied
789		 *  skb, since retransmitted need to set or clear the poll
790		 *  bit depending on when they are sent.
791		 */
792		tx_skb->data[1] |= PF_BIT;
793
794		self->vs = (self->vs + 1) % 8;
795		self->ack_required = FALSE;
796
797		irlap_next_state(self, LAP_NRM_P);
798		irlap_send_i_frame(self, tx_skb, CMD_FRAME);
799	} else {
800		pr_debug("%s(), sending unreliable frame\n", __func__);
801
802		if (self->ack_required) {
803			irlap_send_ui_frame(self, skb_get(skb), self->caddr, CMD_FRAME);
804			irlap_next_state(self, LAP_NRM_P);
805			irlap_send_rr_frame(self, CMD_FRAME);
806			self->ack_required = FALSE;
807		} else {
808			skb->data[1] |= PF_BIT;
809			irlap_next_state(self, LAP_NRM_P);
810			irlap_send_ui_frame(self, skb_get(skb), self->caddr, CMD_FRAME);
811		}
812	}
813
814	/* How much time we took for transmission of all frames.
815	 * We don't know, so let assume we used the full window. Jean II */
816	transmission_time = self->final_timeout;
817
818	/* Reset parameter so that we can fill next window */
819	self->window = self->window_size;
820
821#ifdef CONFIG_IRDA_DYNAMIC_WINDOW
822	/* Remove what we have not used. Just do a prorata of the
823	 * bytes left in window to window capacity.
824	 * See max_line_capacities[][] in qos.c for details. Jean II */
825	transmission_time -= (self->final_timeout * self->bytes_left
826			      / self->line_capacity);
827	pr_debug("%s() adjusting transmission_time : ft=%d, bl=%d, lc=%d -> tt=%d\n",
828		 __func__, self->final_timeout, self->bytes_left,
829		 self->line_capacity, transmission_time);
830
831	/* We are allowed to transmit a maximum number of bytes again. */
832	self->bytes_left = self->line_capacity;
833#endif /* CONFIG_IRDA_DYNAMIC_WINDOW */
834
835	/*
836	 * The network layer has a intermediate buffer between IrLAP
837	 * and the IrDA driver which can contain 8 frames. So, even
838	 * though IrLAP is currently sending the *last* frame of the
839	 * tx-window, the driver most likely has only just started
840	 * sending the *first* frame of the same tx-window.
841	 * I.e. we are always at the very beginning of or Tx window.
842	 * Now, we are supposed to set the final timer from the end
843	 * of our tx-window to let the other peer reply. So, we need
844	 * to add extra time to compensate for the fact that we
845	 * are really at the start of tx-window, otherwise the final timer
846	 * might expire before he can answer...
847	 * Jean II
848	 */
849	irlap_start_final_timer(self, self->final_timeout + transmission_time);
850
851	/*
852	 * The clever amongst you might ask why we do this adjustement
853	 * only here, and not in all the other cases in irlap_event.c.
854	 * In all those other case, we only send a very short management
855	 * frame (few bytes), so the adjustement would be lost in the
856	 * noise...
857	 * The exception of course is irlap_resend_rejected_frame().
858	 * Jean II */
859}
860
861/*
862 * Function irlap_send_data_secondary_final (self, skb)
863 *
864 *    Send I(nformation) frame as secondary with final bit set
865 *
866 */
867void irlap_send_data_secondary_final(struct irlap_cb *self,
868				     struct sk_buff *skb)
869{
870	struct sk_buff *tx_skb = NULL;
871
872	IRDA_ASSERT(self != NULL, return;);
873	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
874	IRDA_ASSERT(skb != NULL, return;);
875
876	/* Is this reliable or unreliable data? */
877	if (skb->data[1] == I_FRAME) {
878
879		/*
880		 *  Insert frame sequence number (Vs) in control field before
881		 *  inserting into transmit window queue.
882		 */
883		skb->data[1] = I_FRAME | (self->vs << 1);
884
885		/*
886		 *  Insert frame in store, in case of retransmissions
887		 *  Increase skb reference count, see irlap_do_event()
888		 */
889		skb_get(skb);
890		skb_queue_tail(&self->wx_list, skb);
891
892		tx_skb = skb_clone(skb, GFP_ATOMIC);
893		if (tx_skb == NULL) {
894			return;
895		}
896
897		tx_skb->data[1] |= PF_BIT;
898
899		self->vs = (self->vs + 1) % 8;
900		self->ack_required = FALSE;
901
902		irlap_send_i_frame(self, tx_skb, RSP_FRAME);
903	} else {
904		if (self->ack_required) {
905			irlap_send_ui_frame(self, skb_get(skb), self->caddr, RSP_FRAME);
906			irlap_send_rr_frame(self, RSP_FRAME);
907			self->ack_required = FALSE;
908		} else {
909			skb->data[1] |= PF_BIT;
910			irlap_send_ui_frame(self, skb_get(skb), self->caddr, RSP_FRAME);
911		}
912	}
913
914	self->window = self->window_size;
915#ifdef CONFIG_IRDA_DYNAMIC_WINDOW
916	/* We are allowed to transmit a maximum number of bytes again. */
917	self->bytes_left = self->line_capacity;
918#endif /* CONFIG_IRDA_DYNAMIC_WINDOW */
919
920	irlap_start_wd_timer(self, self->wd_timeout);
921}
922
923/*
924 * Function irlap_send_data_secondary (self, skb)
925 *
926 *    Send I(nformation) frame as secondary without final bit set
927 *
928 */
929void irlap_send_data_secondary(struct irlap_cb *self, struct sk_buff *skb)
930{
931	struct sk_buff *tx_skb = NULL;
932
933	/* Is this reliable or unreliable data? */
934	if (skb->data[1] == I_FRAME) {
935
936		/*
937		 *  Insert frame sequence number (Vs) in control field before
938		 *  inserting into transmit window queue.
939		 */
940		skb->data[1] = I_FRAME | (self->vs << 1);
941
942		/*
943		 *  Insert frame in store, in case of retransmissions
944		 *  Increase skb reference count, see irlap_do_event()
945		 */
946		skb_get(skb);
947		skb_queue_tail(&self->wx_list, skb);
948
949		tx_skb = skb_clone(skb, GFP_ATOMIC);
950		if (tx_skb == NULL) {
951			return;
952		}
953
954		self->vs = (self->vs + 1) % 8;
955		self->ack_required = FALSE;
956		self->window -= 1;
957
958		irlap_send_i_frame(self, tx_skb, RSP_FRAME);
959	} else {
960		irlap_send_ui_frame(self, skb_get(skb), self->caddr, RSP_FRAME);
961		self->window -= 1;
962	}
963}
964
965/*
966 * Function irlap_resend_rejected_frames (nr)
967 *
968 *    Resend frames which has not been acknowledged. Should be safe to
969 *    traverse the list without locking it since this function will only be
970 *    called from interrupt context (BH)
971 */
972void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
973{
974	struct sk_buff *tx_skb;
975	struct sk_buff *skb;
976
977	IRDA_ASSERT(self != NULL, return;);
978	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
979
980	/*  Resend unacknowledged frame(s) */
981	skb_queue_walk(&self->wx_list, skb) {
982		irlap_wait_min_turn_around(self, &self->qos_tx);
983
984		/* We copy the skb to be retransmitted since we will have to
985		 * modify it. Cloning will confuse packet sniffers
986		 */
987		/* tx_skb = skb_clone( skb, GFP_ATOMIC); */
988		tx_skb = skb_copy(skb, GFP_ATOMIC);
989		if (!tx_skb) {
990			pr_debug("%s(), unable to copy\n", __func__);
991			return;
992		}
993
994		/* Clear old Nr field + poll bit */
995		tx_skb->data[1] &= 0x0f;
996
997		/*
998		 *  Set poll bit on the last frame retransmitted
999		 */
1000		if (skb_queue_is_last(&self->wx_list, skb))
1001			tx_skb->data[1] |= PF_BIT; /* Set p/f bit */
1002		else
1003			tx_skb->data[1] &= ~PF_BIT; /* Clear p/f bit */
1004
1005		irlap_send_i_frame(self, tx_skb, command);
1006	}
1007#if 0 /* Not yet */
1008	/*
1009	 *  We can now fill the window with additional data frames
1010	 */
1011	while (!skb_queue_empty(&self->txq)) {
1012
1013		pr_debug("%s(), sending additional frames!\n", __func__);
1014		if (self->window > 0) {
1015			skb = skb_dequeue( &self->txq);
1016			IRDA_ASSERT(skb != NULL, return;);
1017
1018			/*
1019			 *  If send window > 1 then send frame with pf
1020			 *  bit cleared
1021			 */
1022			if ((self->window > 1) &&
1023			    !skb_queue_empty(&self->txq)) {
1024				irlap_send_data_primary(self, skb);
1025			} else {
1026				irlap_send_data_primary_poll(self, skb);
1027			}
1028			kfree_skb(skb);
1029		}
1030	}
1031#endif
1032}
1033
1034void irlap_resend_rejected_frame(struct irlap_cb *self, int command)
1035{
1036	struct sk_buff *tx_skb;
1037	struct sk_buff *skb;
1038
1039	IRDA_ASSERT(self != NULL, return;);
1040	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
1041
1042	/*  Resend unacknowledged frame(s) */
1043	skb = skb_peek(&self->wx_list);
1044	if (skb != NULL) {
1045		irlap_wait_min_turn_around(self, &self->qos_tx);
1046
1047		/* We copy the skb to be retransmitted since we will have to
1048		 * modify it. Cloning will confuse packet sniffers
1049		 */
1050		/* tx_skb = skb_clone( skb, GFP_ATOMIC); */
1051		tx_skb = skb_copy(skb, GFP_ATOMIC);
1052		if (!tx_skb) {
1053			pr_debug("%s(), unable to copy\n", __func__);
1054			return;
1055		}
1056
1057		/* Clear old Nr field + poll bit */
1058		tx_skb->data[1] &= 0x0f;
1059
1060		/*  Set poll/final bit */
1061		tx_skb->data[1] |= PF_BIT; /* Set p/f bit */
1062
1063		irlap_send_i_frame(self, tx_skb, command);
1064	}
1065}
1066
1067/*
1068 * Function irlap_send_ui_frame (self, skb, command)
1069 *
1070 *    Contruct and transmit an Unnumbered Information (UI) frame
1071 *
1072 */
1073void irlap_send_ui_frame(struct irlap_cb *self, struct sk_buff *skb,
1074			 __u8 caddr, int command)
1075{
1076	IRDA_ASSERT(self != NULL, return;);
1077	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
1078	IRDA_ASSERT(skb != NULL, return;);
1079
1080	/* Insert connection address */
1081	skb->data[0] = caddr | ((command) ? CMD_FRAME : 0);
1082
1083	irlap_queue_xmit(self, skb);
1084}
1085
1086/*
1087 * Function irlap_send_i_frame (skb)
1088 *
1089 *    Contruct and transmit Information (I) frame
1090 */
1091static void irlap_send_i_frame(struct irlap_cb *self, struct sk_buff *skb,
1092			       int command)
1093{
1094	/* Insert connection address */
1095	skb->data[0] = self->caddr;
1096	skb->data[0] |= (command) ? CMD_FRAME : 0;
1097
1098	/* Insert next to receive (Vr) */
1099	skb->data[1] |= (self->vr << 5);  /* insert nr */
1100
1101	irlap_queue_xmit(self, skb);
1102}
1103
1104/*
1105 * Function irlap_recv_i_frame (skb, frame)
1106 *
1107 *    Receive and parse an I (Information) frame, no harm in making it inline
1108 *    since it's called only from one single place (irlap_driver_rcv).
1109 */
1110static inline void irlap_recv_i_frame(struct irlap_cb *self,
1111				      struct sk_buff *skb,
1112				      struct irlap_info *info, int command)
1113{
1114	info->nr = skb->data[1] >> 5;          /* Next to receive */
1115	info->pf = skb->data[1] & PF_BIT;      /* Final bit */
1116	info->ns = (skb->data[1] >> 1) & 0x07; /* Next to send */
1117
1118	/* Check if this is a command or a response frame */
1119	if (command)
1120		irlap_do_event(self, RECV_I_CMD, skb, info);
1121	else
1122		irlap_do_event(self, RECV_I_RSP, skb, info);
1123}
1124
1125/*
1126 * Function irlap_recv_ui_frame (self, skb, info)
1127 *
1128 *    Receive and parse an Unnumbered Information (UI) frame
1129 *
1130 */
1131static void irlap_recv_ui_frame(struct irlap_cb *self, struct sk_buff *skb,
1132				struct irlap_info *info)
1133{
1134	info->pf = skb->data[1] & PF_BIT;      /* Final bit */
1135
1136	irlap_do_event(self, RECV_UI_FRAME, skb, info);
1137}
1138
1139/*
1140 * Function irlap_recv_frmr_frame (skb, frame)
1141 *
1142 *    Received Frame Reject response.
1143 *
1144 */
1145static void irlap_recv_frmr_frame(struct irlap_cb *self, struct sk_buff *skb,
1146				  struct irlap_info *info)
1147{
1148	__u8 *frame;
1149	int w, x, y, z;
1150
1151	IRDA_ASSERT(self != NULL, return;);
1152	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
1153	IRDA_ASSERT(skb != NULL, return;);
1154	IRDA_ASSERT(info != NULL, return;);
1155
1156	if (!pskb_may_pull(skb, 4)) {
1157		net_err_ratelimited("%s: frame too short!\n", __func__);
1158		return;
1159	}
1160
1161	frame = skb->data;
1162
1163	info->nr = frame[2] >> 5;          /* Next to receive */
1164	info->pf = frame[2] & PF_BIT;      /* Final bit */
1165	info->ns = (frame[2] >> 1) & 0x07; /* Next to send */
1166
1167	w = frame[3] & 0x01;
1168	x = frame[3] & 0x02;
1169	y = frame[3] & 0x04;
1170	z = frame[3] & 0x08;
1171
1172	if (w) {
1173		pr_debug("Rejected control field is undefined or not implemented\n");
1174	}
1175	if (x) {
1176		pr_debug("Rejected control field was invalid because it contained a non permitted I field\n");
1177	}
1178	if (y) {
1179		pr_debug("Received I field exceeded the maximum negotiated for the existing connection or exceeded the maximum this station supports if no connection exists\n");
1180	}
1181	if (z) {
1182		pr_debug("Rejected control field control field contained an invalid Nr count\n");
1183	}
1184	irlap_do_event(self, RECV_FRMR_RSP, skb, info);
1185}
1186
1187/*
1188 * Function irlap_send_test_frame (self, daddr)
1189 *
1190 *    Send a test frame response
1191 *
1192 */
1193void irlap_send_test_frame(struct irlap_cb *self, __u8 caddr, __u32 daddr,
1194			   struct sk_buff *cmd)
1195{
1196	struct sk_buff *tx_skb;
1197	struct test_frame *frame;
1198	__u8 *info;
1199
1200	tx_skb = alloc_skb(cmd->len + sizeof(struct test_frame), GFP_ATOMIC);
1201	if (!tx_skb)
1202		return;
1203
1204	/* Broadcast frames must include saddr and daddr fields */
1205	if (caddr == CBROADCAST) {
1206		frame = (struct test_frame *)
1207			skb_put(tx_skb, sizeof(struct test_frame));
1208
1209		/* Insert the swapped addresses */
1210		frame->saddr = cpu_to_le32(self->saddr);
1211		frame->daddr = cpu_to_le32(daddr);
1212	} else
1213		frame = (struct test_frame *) skb_put(tx_skb, LAP_ADDR_HEADER + LAP_CTRL_HEADER);
1214
1215	frame->caddr = caddr;
1216	frame->control = TEST_RSP | PF_BIT;
1217
1218	/* Copy info */
1219	info = skb_put(tx_skb, cmd->len);
1220	memcpy(info, cmd->data, cmd->len);
1221
1222	/* Return to sender */
1223	irlap_wait_min_turn_around(self, &self->qos_tx);
1224	irlap_queue_xmit(self, tx_skb);
1225}
1226
1227/*
1228 * Function irlap_recv_test_frame (self, skb)
1229 *
1230 *    Receive a test frame
1231 *
1232 */
1233static void irlap_recv_test_frame(struct irlap_cb *self, struct sk_buff *skb,
1234				  struct irlap_info *info, int command)
1235{
1236	struct test_frame *frame;
1237
1238	if (!pskb_may_pull(skb, sizeof(*frame))) {
1239		net_err_ratelimited("%s: frame too short!\n", __func__);
1240		return;
1241	}
1242	frame = (struct test_frame *) skb->data;
1243
1244	/* Broadcast frames must carry saddr and daddr fields */
1245	if (info->caddr == CBROADCAST) {
1246		if (skb->len < sizeof(struct test_frame)) {
1247			pr_debug("%s() test frame too short!\n",
1248				 __func__);
1249			return;
1250		}
1251
1252		/* Read and swap addresses */
1253		info->daddr = le32_to_cpu(frame->saddr);
1254		info->saddr = le32_to_cpu(frame->daddr);
1255
1256		/* Make sure frame is addressed to us */
1257		if ((info->saddr != self->saddr) &&
1258		    (info->saddr != BROADCAST)) {
1259			return;
1260		}
1261	}
1262
1263	if (command)
1264		irlap_do_event(self, RECV_TEST_CMD, skb, info);
1265	else
1266		irlap_do_event(self, RECV_TEST_RSP, skb, info);
1267}
1268
1269/*
1270 * Function irlap_driver_rcv (skb, netdev, ptype)
1271 *
1272 *    Called when a frame is received. Dispatches the right receive function
1273 *    for processing of the frame.
1274 *
1275 * Note on skb management :
1276 * After calling the higher layers of the IrDA stack, we always
1277 * kfree() the skb, which drop the reference count (and potentially
1278 * destroy it).
1279 * If a higher layer of the stack want to keep the skb around (to put
1280 * in a queue or pass it to the higher layer), it will need to use
1281 * skb_get() to keep a reference on it. This is usually done at the
1282 * LMP level in irlmp.c.
1283 * Jean II
1284 */
1285int irlap_driver_rcv(struct sk_buff *skb, struct net_device *dev,
1286		     struct packet_type *ptype, struct net_device *orig_dev)
1287{
1288	struct irlap_info info;
1289	struct irlap_cb *self;
1290	int command;
1291	__u8 control;
1292	int ret = -1;
1293
1294	if (!net_eq(dev_net(dev), &init_net))
1295		goto out;
1296
1297	/* FIXME: should we get our own field? */
1298	self = (struct irlap_cb *) dev->atalk_ptr;
1299
1300	/* If the net device is down, then IrLAP is gone! */
1301	if (!self || self->magic != LAP_MAGIC)
1302		goto err;
1303
1304	/* We are no longer an "old" protocol, so we need to handle
1305	 * share and non linear skbs. This should never happen, so
1306	 * we don't need to be clever about it. Jean II */
1307	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
1308		net_err_ratelimited("%s: can't clone shared skb!\n", __func__);
1309		goto err;
1310	}
1311
1312	/* Check if frame is large enough for parsing */
1313	if (!pskb_may_pull(skb, 2)) {
1314		net_err_ratelimited("%s: frame too short!\n", __func__);
1315		goto err;
1316	}
1317
1318	command    = skb->data[0] & CMD_FRAME;
1319	info.caddr = skb->data[0] & CBROADCAST;
1320
1321	info.pf      = skb->data[1] &  PF_BIT;
1322	info.control = skb->data[1] & ~PF_BIT; /* Mask away poll/final bit */
1323
1324	control = info.control;
1325
1326	/*  First we check if this frame has a valid connection address */
1327	if ((info.caddr != self->caddr) && (info.caddr != CBROADCAST)) {
1328		pr_debug("%s(), wrong connection address!\n",
1329			 __func__);
1330		goto out;
1331	}
1332	/*
1333	 *  Optimize for the common case and check if the frame is an
1334	 *  I(nformation) frame. Only I-frames have bit 0 set to 0
1335	 */
1336	if (~control & 0x01) {
1337		irlap_recv_i_frame(self, skb, &info, command);
1338		goto out;
1339	}
1340	/*
1341	 *  We now check is the frame is an S(upervisory) frame. Only
1342	 *  S-frames have bit 0 set to 1 and bit 1 set to 0
1343	 */
1344	if (~control & 0x02) {
1345		/*
1346		 *  Received S(upervisory) frame, check which frame type it is
1347		 *  only the first nibble is of interest
1348		 */
1349		switch (control & 0x0f) {
1350		case RR:
1351			irlap_recv_rr_frame(self, skb, &info, command);
1352			break;
1353		case RNR:
1354			irlap_recv_rnr_frame(self, skb, &info, command);
1355			break;
1356		case REJ:
1357			irlap_recv_rej_frame(self, skb, &info, command);
1358			break;
1359		case SREJ:
1360			irlap_recv_srej_frame(self, skb, &info, command);
1361			break;
1362		default:
1363			net_warn_ratelimited("%s: Unknown S-frame %02x received!\n",
1364					     __func__, info.control);
1365			break;
1366		}
1367		goto out;
1368	}
1369	/*
1370	 *  This must be a C(ontrol) frame
1371	 */
1372	switch (control) {
1373	case XID_RSP:
1374		irlap_recv_discovery_xid_rsp(self, skb, &info);
1375		break;
1376	case XID_CMD:
1377		irlap_recv_discovery_xid_cmd(self, skb, &info);
1378		break;
1379	case SNRM_CMD:
1380		irlap_recv_snrm_cmd(self, skb, &info);
1381		break;
1382	case DM_RSP:
1383		irlap_do_event(self, RECV_DM_RSP, skb, &info);
1384		break;
1385	case DISC_CMD: /* And RD_RSP since they have the same value */
1386		irlap_recv_disc_frame(self, skb, &info, command);
1387		break;
1388	case TEST_CMD:
1389		irlap_recv_test_frame(self, skb, &info, command);
1390		break;
1391	case UA_RSP:
1392		irlap_recv_ua_frame(self, skb, &info);
1393		break;
1394	case FRMR_RSP:
1395		irlap_recv_frmr_frame(self, skb, &info);
1396		break;
1397	case UI_FRAME:
1398		irlap_recv_ui_frame(self, skb, &info);
1399		break;
1400	default:
1401		net_warn_ratelimited("%s: Unknown frame %02x received!\n",
1402				     __func__, info.control);
1403		break;
1404	}
1405out:
1406	ret = 0;
1407err:
1408	/* Always drop our reference on the skb */
1409	dev_kfree_skb(skb);
1410	return ret;
1411}
1412