Root/drivers/net/ppp_async.c

1/*
2 * PPP async serial channel driver for Linux.
3 *
4 * Copyright 1999 Paul Mackerras.
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 * This driver provides the encapsulation and framing for sending
12 * and receiving PPP frames over async serial lines. It relies on
13 * the generic PPP layer to give it frames to send and to process
14 * received frames. It implements the PPP line discipline.
15 *
16 * Part of the code in this driver was inspired by the old async-only
17 * PPP driver, written by Michael Callahan and Al Longyear, and
18 * subsequently hacked by Paul Mackerras.
19 */
20
21#include <linux/module.h>
22#include <linux/kernel.h>
23#include <linux/skbuff.h>
24#include <linux/tty.h>
25#include <linux/netdevice.h>
26#include <linux/poll.h>
27#include <linux/crc-ccitt.h>
28#include <linux/ppp_defs.h>
29#include <linux/if_ppp.h>
30#include <linux/ppp_channel.h>
31#include <linux/spinlock.h>
32#include <linux/init.h>
33#include <linux/jiffies.h>
34#include <asm/uaccess.h>
35#include <asm/string.h>
36
37#define PPP_VERSION "2.4.2"
38
39#define OBUFSIZE 256
40
41/* Structure for storing local state. */
42struct asyncppp {
43    struct tty_struct *tty;
44    unsigned int flags;
45    unsigned int state;
46    unsigned int rbits;
47    int mru;
48    spinlock_t xmit_lock;
49    spinlock_t recv_lock;
50    unsigned long xmit_flags;
51    u32 xaccm[8];
52    u32 raccm;
53    unsigned int bytes_sent;
54    unsigned int bytes_rcvd;
55
56    struct sk_buff *tpkt;
57    int tpkt_pos;
58    u16 tfcs;
59    unsigned char *optr;
60    unsigned char *olim;
61    unsigned long last_xmit;
62
63    struct sk_buff *rpkt;
64    int lcp_fcs;
65    struct sk_buff_head rqueue;
66
67    struct tasklet_struct tsk;
68
69    atomic_t refcnt;
70    struct semaphore dead_sem;
71    struct ppp_channel chan; /* interface to generic ppp layer */
72    unsigned char obuf[OBUFSIZE];
73};
74
75/* Bit numbers in xmit_flags */
76#define XMIT_WAKEUP 0
77#define XMIT_FULL 1
78#define XMIT_BUSY 2
79
80/* State bits */
81#define SC_TOSS 1
82#define SC_ESCAPE 2
83#define SC_PREV_ERROR 4
84
85/* Bits in rbits */
86#define SC_RCV_BITS (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP)
87
88static int flag_time = HZ;
89module_param(flag_time, int, 0);
90MODULE_PARM_DESC(flag_time, "ppp_async: interval between flagged packets (in clock ticks)");
91MODULE_LICENSE("GPL");
92MODULE_ALIAS_LDISC(N_PPP);
93
94/*
95 * Prototypes.
96 */
97static int ppp_async_encode(struct asyncppp *ap);
98static int ppp_async_send(struct ppp_channel *chan, struct sk_buff *skb);
99static int ppp_async_push(struct asyncppp *ap);
100static void ppp_async_flush_output(struct asyncppp *ap);
101static void ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
102                char *flags, int count);
103static int ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd,
104               unsigned long arg);
105static void ppp_async_process(unsigned long arg);
106
107static void async_lcp_peek(struct asyncppp *ap, unsigned char *data,
108               int len, int inbound);
109
110static struct ppp_channel_ops async_ops = {
111    ppp_async_send,
112    ppp_async_ioctl
113};
114
115/*
116 * Routines implementing the PPP line discipline.
117 */
118
119/*
120 * We have a potential race on dereferencing tty->disc_data,
121 * because the tty layer provides no locking at all - thus one
122 * cpu could be running ppp_asynctty_receive while another
123 * calls ppp_asynctty_close, which zeroes tty->disc_data and
124 * frees the memory that ppp_asynctty_receive is using. The best
125 * way to fix this is to use a rwlock in the tty struct, but for now
126 * we use a single global rwlock for all ttys in ppp line discipline.
127 *
128 * FIXME: this is no longer true. The _close path for the ldisc is
129 * now guaranteed to be sane.
130 */
131static DEFINE_RWLOCK(disc_data_lock);
132
133static struct asyncppp *ap_get(struct tty_struct *tty)
134{
135    struct asyncppp *ap;
136
137    read_lock(&disc_data_lock);
138    ap = tty->disc_data;
139    if (ap != NULL)
140        atomic_inc(&ap->refcnt);
141    read_unlock(&disc_data_lock);
142    return ap;
143}
144
145static void ap_put(struct asyncppp *ap)
146{
147    if (atomic_dec_and_test(&ap->refcnt))
148        up(&ap->dead_sem);
149}
150
151/*
152 * Called when a tty is put into PPP line discipline. Called in process
153 * context.
154 */
155static int
156ppp_asynctty_open(struct tty_struct *tty)
157{
158    struct asyncppp *ap;
159    int err;
160    int speed;
161
162    if (tty->ops->write == NULL)
163        return -EOPNOTSUPP;
164
165    err = -ENOMEM;
166    ap = kzalloc(sizeof(*ap), GFP_KERNEL);
167    if (!ap)
168        goto out;
169
170    /* initialize the asyncppp structure */
171    ap->tty = tty;
172    ap->mru = PPP_MRU;
173    spin_lock_init(&ap->xmit_lock);
174    spin_lock_init(&ap->recv_lock);
175    ap->xaccm[0] = ~0U;
176    ap->xaccm[3] = 0x60000000U;
177    ap->raccm = ~0U;
178    ap->optr = ap->obuf;
179    ap->olim = ap->obuf;
180    ap->lcp_fcs = -1;
181
182    skb_queue_head_init(&ap->rqueue);
183    tasklet_init(&ap->tsk, ppp_async_process, (unsigned long) ap);
184
185    atomic_set(&ap->refcnt, 1);
186    init_MUTEX_LOCKED(&ap->dead_sem);
187
188    ap->chan.private = ap;
189    ap->chan.ops = &async_ops;
190    ap->chan.mtu = PPP_MRU;
191    speed = tty_get_baud_rate(tty);
192    ap->chan.speed = speed;
193    err = ppp_register_channel(&ap->chan);
194    if (err)
195        goto out_free;
196
197    tty->disc_data = ap;
198    tty->receive_room = 65536;
199    return 0;
200
201 out_free:
202    kfree(ap);
203 out:
204    return err;
205}
206
207/*
208 * Called when the tty is put into another line discipline
209 * or it hangs up. We have to wait for any cpu currently
210 * executing in any of the other ppp_asynctty_* routines to
211 * finish before we can call ppp_unregister_channel and free
212 * the asyncppp struct. This routine must be called from
213 * process context, not interrupt or softirq context.
214 */
215static void
216ppp_asynctty_close(struct tty_struct *tty)
217{
218    struct asyncppp *ap;
219
220    write_lock_irq(&disc_data_lock);
221    ap = tty->disc_data;
222    tty->disc_data = NULL;
223    write_unlock_irq(&disc_data_lock);
224    if (!ap)
225        return;
226
227    /*
228     * We have now ensured that nobody can start using ap from now
229     * on, but we have to wait for all existing users to finish.
230     * Note that ppp_unregister_channel ensures that no calls to
231     * our channel ops (i.e. ppp_async_send/ioctl) are in progress
232     * by the time it returns.
233     */
234    if (!atomic_dec_and_test(&ap->refcnt))
235        down(&ap->dead_sem);
236    tasklet_kill(&ap->tsk);
237
238    ppp_unregister_channel(&ap->chan);
239    kfree_skb(ap->rpkt);
240    skb_queue_purge(&ap->rqueue);
241    kfree_skb(ap->tpkt);
242    kfree(ap);
243}
244
245/*
246 * Called on tty hangup in process context.
247 *
248 * Wait for I/O to driver to complete and unregister PPP channel.
249 * This is already done by the close routine, so just call that.
250 */
251static int ppp_asynctty_hangup(struct tty_struct *tty)
252{
253    ppp_asynctty_close(tty);
254    return 0;
255}
256
257/*
258 * Read does nothing - no data is ever available this way.
259 * Pppd reads and writes packets via /dev/ppp instead.
260 */
261static ssize_t
262ppp_asynctty_read(struct tty_struct *tty, struct file *file,
263          unsigned char __user *buf, size_t count)
264{
265    return -EAGAIN;
266}
267
268/*
269 * Write on the tty does nothing, the packets all come in
270 * from the ppp generic stuff.
271 */
272static ssize_t
273ppp_asynctty_write(struct tty_struct *tty, struct file *file,
274           const unsigned char *buf, size_t count)
275{
276    return -EAGAIN;
277}
278
279/*
280 * Called in process context only. May be re-entered by multiple
281 * ioctl calling threads.
282 */
283
284static int
285ppp_asynctty_ioctl(struct tty_struct *tty, struct file *file,
286           unsigned int cmd, unsigned long arg)
287{
288    struct asyncppp *ap = ap_get(tty);
289    int err, val;
290    int __user *p = (int __user *)arg;
291
292    if (!ap)
293        return -ENXIO;
294    err = -EFAULT;
295    switch (cmd) {
296    case PPPIOCGCHAN:
297        err = -EFAULT;
298        if (put_user(ppp_channel_index(&ap->chan), p))
299            break;
300        err = 0;
301        break;
302
303    case PPPIOCGUNIT:
304        err = -EFAULT;
305        if (put_user(ppp_unit_number(&ap->chan), p))
306            break;
307        err = 0;
308        break;
309
310    case TCFLSH:
311        /* flush our buffers and the serial port's buffer */
312        if (arg == TCIOFLUSH || arg == TCOFLUSH)
313            ppp_async_flush_output(ap);
314        err = tty_perform_flush(tty, arg);
315        break;
316
317    case FIONREAD:
318        val = 0;
319        if (put_user(val, p))
320            break;
321        err = 0;
322        break;
323
324    default:
325        /* Try the various mode ioctls */
326        err = tty_mode_ioctl(tty, file, cmd, arg);
327    }
328
329    ap_put(ap);
330    return err;
331}
332
333/* No kernel lock - fine */
334static unsigned int
335ppp_asynctty_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
336{
337    return 0;
338}
339
340/*
341 * This can now be called from hard interrupt level as well
342 * as soft interrupt level or mainline.
343 */
344static void
345ppp_asynctty_receive(struct tty_struct *tty, const unsigned char *buf,
346          char *cflags, int count)
347{
348    struct asyncppp *ap = ap_get(tty);
349    unsigned long flags;
350
351    if (!ap)
352        return;
353    spin_lock_irqsave(&ap->recv_lock, flags);
354    ppp_async_input(ap, buf, cflags, count);
355    spin_unlock_irqrestore(&ap->recv_lock, flags);
356    if (!skb_queue_empty(&ap->rqueue))
357        tasklet_schedule(&ap->tsk);
358    ap_put(ap);
359    tty_unthrottle(tty);
360}
361
362static void
363ppp_asynctty_wakeup(struct tty_struct *tty)
364{
365    struct asyncppp *ap = ap_get(tty);
366
367    clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
368    if (!ap)
369        return;
370    set_bit(XMIT_WAKEUP, &ap->xmit_flags);
371    tasklet_schedule(&ap->tsk);
372    ap_put(ap);
373}
374
375
376static struct tty_ldisc_ops ppp_ldisc = {
377    .owner = THIS_MODULE,
378    .magic = TTY_LDISC_MAGIC,
379    .name = "ppp",
380    .open = ppp_asynctty_open,
381    .close = ppp_asynctty_close,
382    .hangup = ppp_asynctty_hangup,
383    .read = ppp_asynctty_read,
384    .write = ppp_asynctty_write,
385    .ioctl = ppp_asynctty_ioctl,
386    .poll = ppp_asynctty_poll,
387    .receive_buf = ppp_asynctty_receive,
388    .write_wakeup = ppp_asynctty_wakeup,
389};
390
391static int __init
392ppp_async_init(void)
393{
394    int err;
395
396    err = tty_register_ldisc(N_PPP, &ppp_ldisc);
397    if (err != 0)
398        printk(KERN_ERR "PPP_async: error %d registering line disc.\n",
399               err);
400    return err;
401}
402
403/*
404 * The following routines provide the PPP channel interface.
405 */
406static int
407ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
408{
409    struct asyncppp *ap = chan->private;
410    void __user *argp = (void __user *)arg;
411    int __user *p = argp;
412    int err, val;
413    u32 accm[8];
414
415    err = -EFAULT;
416    switch (cmd) {
417    case PPPIOCGFLAGS:
418        val = ap->flags | ap->rbits;
419        if (put_user(val, p))
420            break;
421        err = 0;
422        break;
423    case PPPIOCSFLAGS:
424        if (get_user(val, p))
425            break;
426        ap->flags = val & ~SC_RCV_BITS;
427        spin_lock_irq(&ap->recv_lock);
428        ap->rbits = val & SC_RCV_BITS;
429        spin_unlock_irq(&ap->recv_lock);
430        err = 0;
431        break;
432
433    case PPPIOCGASYNCMAP:
434        if (put_user(ap->xaccm[0], (u32 __user *)argp))
435            break;
436        err = 0;
437        break;
438    case PPPIOCSASYNCMAP:
439        if (get_user(ap->xaccm[0], (u32 __user *)argp))
440            break;
441        err = 0;
442        break;
443
444    case PPPIOCGRASYNCMAP:
445        if (put_user(ap->raccm, (u32 __user *)argp))
446            break;
447        err = 0;
448        break;
449    case PPPIOCSRASYNCMAP:
450        if (get_user(ap->raccm, (u32 __user *)argp))
451            break;
452        err = 0;
453        break;
454
455    case PPPIOCGXASYNCMAP:
456        if (copy_to_user(argp, ap->xaccm, sizeof(ap->xaccm)))
457            break;
458        err = 0;
459        break;
460    case PPPIOCSXASYNCMAP:
461        if (copy_from_user(accm, argp, sizeof(accm)))
462            break;
463        accm[2] &= ~0x40000000U; /* can't escape 0x5e */
464        accm[3] |= 0x60000000U; /* must escape 0x7d, 0x7e */
465        memcpy(ap->xaccm, accm, sizeof(ap->xaccm));
466        err = 0;
467        break;
468
469    case PPPIOCGMRU:
470        if (put_user(ap->mru, p))
471            break;
472        err = 0;
473        break;
474    case PPPIOCSMRU:
475        if (get_user(val, p))
476            break;
477        if (val < PPP_MRU)
478            val = PPP_MRU;
479        ap->mru = val;
480        err = 0;
481        break;
482
483    default:
484        err = -ENOTTY;
485    }
486
487    return err;
488}
489
490/*
491 * This is called at softirq level to deliver received packets
492 * to the ppp_generic code, and to tell the ppp_generic code
493 * if we can accept more output now.
494 */
495static void ppp_async_process(unsigned long arg)
496{
497    struct asyncppp *ap = (struct asyncppp *) arg;
498    struct sk_buff *skb;
499
500    /* process received packets */
501    while ((skb = skb_dequeue(&ap->rqueue)) != NULL) {
502        if (skb->cb[0])
503            ppp_input_error(&ap->chan, 0);
504        ppp_input(&ap->chan, skb);
505    }
506
507    /* try to push more stuff out */
508    if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_async_push(ap))
509        ppp_output_wakeup(&ap->chan);
510}
511
512/*
513 * Procedures for encapsulation and framing.
514 */
515
516/*
517 * Procedure to encode the data for async serial transmission.
518 * Does octet stuffing (escaping), puts the address/control bytes
519 * on if A/C compression is disabled, and does protocol compression.
520 * Assumes ap->tpkt != 0 on entry.
521 * Returns 1 if we finished the current frame, 0 otherwise.
522 */
523
524#define PUT_BYTE(ap, buf, c, islcp) do { \
525    if ((islcp && c < 0x20) || (ap->xaccm[c >> 5] & (1 << (c & 0x1f)))) {\
526        *buf++ = PPP_ESCAPE; \
527        *buf++ = c ^ 0x20; \
528    } else \
529        *buf++ = c; \
530} while (0)
531
532static int
533ppp_async_encode(struct asyncppp *ap)
534{
535    int fcs, i, count, c, proto;
536    unsigned char *buf, *buflim;
537    unsigned char *data;
538    int islcp;
539
540    buf = ap->obuf;
541    ap->olim = buf;
542    ap->optr = buf;
543    i = ap->tpkt_pos;
544    data = ap->tpkt->data;
545    count = ap->tpkt->len;
546    fcs = ap->tfcs;
547    proto = (data[0] << 8) + data[1];
548
549    /*
550     * LCP packets with code values between 1 (configure-reqest)
551     * and 7 (code-reject) must be sent as though no options
552     * had been negotiated.
553     */
554    islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7;
555
556    if (i == 0) {
557        if (islcp)
558            async_lcp_peek(ap, data, count, 0);
559
560        /*
561         * Start of a new packet - insert the leading FLAG
562         * character if necessary.
563         */
564        if (islcp || flag_time == 0
565            || time_after_eq(jiffies, ap->last_xmit + flag_time))
566            *buf++ = PPP_FLAG;
567        ap->last_xmit = jiffies;
568        fcs = PPP_INITFCS;
569
570        /*
571         * Put in the address/control bytes if necessary
572         */
573        if ((ap->flags & SC_COMP_AC) == 0 || islcp) {
574            PUT_BYTE(ap, buf, 0xff, islcp);
575            fcs = PPP_FCS(fcs, 0xff);
576            PUT_BYTE(ap, buf, 0x03, islcp);
577            fcs = PPP_FCS(fcs, 0x03);
578        }
579    }
580
581    /*
582     * Once we put in the last byte, we need to put in the FCS
583     * and closing flag, so make sure there is at least 7 bytes
584     * of free space in the output buffer.
585     */
586    buflim = ap->obuf + OBUFSIZE - 6;
587    while (i < count && buf < buflim) {
588        c = data[i++];
589        if (i == 1 && c == 0 && (ap->flags & SC_COMP_PROT))
590            continue; /* compress protocol field */
591        fcs = PPP_FCS(fcs, c);
592        PUT_BYTE(ap, buf, c, islcp);
593    }
594
595    if (i < count) {
596        /*
597         * Remember where we are up to in this packet.
598         */
599        ap->olim = buf;
600        ap->tpkt_pos = i;
601        ap->tfcs = fcs;
602        return 0;
603    }
604
605    /*
606     * We have finished the packet. Add the FCS and flag.
607     */
608    fcs = ~fcs;
609    c = fcs & 0xff;
610    PUT_BYTE(ap, buf, c, islcp);
611    c = (fcs >> 8) & 0xff;
612    PUT_BYTE(ap, buf, c, islcp);
613    *buf++ = PPP_FLAG;
614    ap->olim = buf;
615
616    kfree_skb(ap->tpkt);
617    ap->tpkt = NULL;
618    return 1;
619}
620
621/*
622 * Transmit-side routines.
623 */
624
625/*
626 * Send a packet to the peer over an async tty line.
627 * Returns 1 iff the packet was accepted.
628 * If the packet was not accepted, we will call ppp_output_wakeup
629 * at some later time.
630 */
631static int
632ppp_async_send(struct ppp_channel *chan, struct sk_buff *skb)
633{
634    struct asyncppp *ap = chan->private;
635
636    ppp_async_push(ap);
637
638    if (test_and_set_bit(XMIT_FULL, &ap->xmit_flags))
639        return 0; /* already full */
640    ap->tpkt = skb;
641    ap->tpkt_pos = 0;
642
643    ppp_async_push(ap);
644    return 1;
645}
646
647/*
648 * Push as much data as possible out to the tty.
649 */
650static int
651ppp_async_push(struct asyncppp *ap)
652{
653    int avail, sent, done = 0;
654    struct tty_struct *tty = ap->tty;
655    int tty_stuffed = 0;
656
657    /*
658     * We can get called recursively here if the tty write
659     * function calls our wakeup function. This can happen
660     * for example on a pty with both the master and slave
661     * set to PPP line discipline.
662     * We use the XMIT_BUSY bit to detect this and get out,
663     * leaving the XMIT_WAKEUP bit set to tell the other
664     * instance that it may now be able to write more now.
665     */
666    if (test_and_set_bit(XMIT_BUSY, &ap->xmit_flags))
667        return 0;
668    spin_lock_bh(&ap->xmit_lock);
669    for (;;) {
670        if (test_and_clear_bit(XMIT_WAKEUP, &ap->xmit_flags))
671            tty_stuffed = 0;
672        if (!tty_stuffed && ap->optr < ap->olim) {
673            avail = ap->olim - ap->optr;
674            set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
675            sent = tty->ops->write(tty, ap->optr, avail);
676            if (sent < 0)
677                goto flush; /* error, e.g. loss of CD */
678            ap->optr += sent;
679            if (sent < avail)
680                tty_stuffed = 1;
681            continue;
682        }
683        if (ap->optr >= ap->olim && ap->tpkt) {
684            if (ppp_async_encode(ap)) {
685                /* finished processing ap->tpkt */
686                clear_bit(XMIT_FULL, &ap->xmit_flags);
687                done = 1;
688            }
689            continue;
690        }
691        /*
692         * We haven't made any progress this time around.
693         * Clear XMIT_BUSY to let other callers in, but
694         * after doing so we have to check if anyone set
695         * XMIT_WAKEUP since we last checked it. If they
696         * did, we should try again to set XMIT_BUSY and go
697         * around again in case XMIT_BUSY was still set when
698         * the other caller tried.
699         */
700        clear_bit(XMIT_BUSY, &ap->xmit_flags);
701        /* any more work to do? if not, exit the loop */
702        if (!(test_bit(XMIT_WAKEUP, &ap->xmit_flags)
703              || (!tty_stuffed && ap->tpkt)))
704            break;
705        /* more work to do, see if we can do it now */
706        if (test_and_set_bit(XMIT_BUSY, &ap->xmit_flags))
707            break;
708    }
709    spin_unlock_bh(&ap->xmit_lock);
710    return done;
711
712flush:
713    clear_bit(XMIT_BUSY, &ap->xmit_flags);
714    if (ap->tpkt) {
715        kfree_skb(ap->tpkt);
716        ap->tpkt = NULL;
717        clear_bit(XMIT_FULL, &ap->xmit_flags);
718        done = 1;
719    }
720    ap->optr = ap->olim;
721    spin_unlock_bh(&ap->xmit_lock);
722    return done;
723}
724
725/*
726 * Flush output from our internal buffers.
727 * Called for the TCFLSH ioctl. Can be entered in parallel
728 * but this is covered by the xmit_lock.
729 */
730static void
731ppp_async_flush_output(struct asyncppp *ap)
732{
733    int done = 0;
734
735    spin_lock_bh(&ap->xmit_lock);
736    ap->optr = ap->olim;
737    if (ap->tpkt != NULL) {
738        kfree_skb(ap->tpkt);
739        ap->tpkt = NULL;
740        clear_bit(XMIT_FULL, &ap->xmit_flags);
741        done = 1;
742    }
743    spin_unlock_bh(&ap->xmit_lock);
744    if (done)
745        ppp_output_wakeup(&ap->chan);
746}
747
748/*
749 * Receive-side routines.
750 */
751
752/* see how many ordinary chars there are at the start of buf */
753static inline int
754scan_ordinary(struct asyncppp *ap, const unsigned char *buf, int count)
755{
756    int i, c;
757
758    for (i = 0; i < count; ++i) {
759        c = buf[i];
760        if (c == PPP_ESCAPE || c == PPP_FLAG
761            || (c < 0x20 && (ap->raccm & (1 << c)) != 0))
762            break;
763    }
764    return i;
765}
766
767/* called when a flag is seen - do end-of-packet processing */
768static void
769process_input_packet(struct asyncppp *ap)
770{
771    struct sk_buff *skb;
772    unsigned char *p;
773    unsigned int len, fcs, proto;
774
775    skb = ap->rpkt;
776    if (ap->state & (SC_TOSS | SC_ESCAPE))
777        goto err;
778
779    if (skb == NULL)
780        return; /* 0-length packet */
781
782    /* check the FCS */
783    p = skb->data;
784    len = skb->len;
785    if (len < 3)
786        goto err; /* too short */
787    fcs = PPP_INITFCS;
788    for (; len > 0; --len)
789        fcs = PPP_FCS(fcs, *p++);
790    if (fcs != PPP_GOODFCS)
791        goto err; /* bad FCS */
792    skb_trim(skb, skb->len - 2);
793
794    /* check for address/control and protocol compression */
795    p = skb->data;
796    if (p[0] == PPP_ALLSTATIONS) {
797        /* chop off address/control */
798        if (p[1] != PPP_UI || skb->len < 3)
799            goto err;
800        p = skb_pull(skb, 2);
801    }
802    proto = p[0];
803    if (proto & 1) {
804        /* protocol is compressed */
805        skb_push(skb, 1)[0] = 0;
806    } else {
807        if (skb->len < 2)
808            goto err;
809        proto = (proto << 8) + p[1];
810        if (proto == PPP_LCP)
811            async_lcp_peek(ap, p, skb->len, 1);
812    }
813
814    /* queue the frame to be processed */
815    skb->cb[0] = ap->state;
816    skb_queue_tail(&ap->rqueue, skb);
817    ap->rpkt = NULL;
818    ap->state = 0;
819    return;
820
821 err:
822    /* frame had an error, remember that, reset SC_TOSS & SC_ESCAPE */
823    ap->state = SC_PREV_ERROR;
824    if (skb) {
825        /* make skb appear as freshly allocated */
826        skb_trim(skb, 0);
827        skb_reserve(skb, - skb_headroom(skb));
828    }
829}
830
831/* Called when the tty driver has data for us. Runs parallel with the
832   other ldisc functions but will not be re-entered */
833
834static void
835ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
836        char *flags, int count)
837{
838    struct sk_buff *skb;
839    int c, i, j, n, s, f;
840    unsigned char *sp;
841
842    /* update bits used for 8-bit cleanness detection */
843    if (~ap->rbits & SC_RCV_BITS) {
844        s = 0;
845        for (i = 0; i < count; ++i) {
846            c = buf[i];
847            if (flags && flags[i] != 0)
848                continue;
849            s |= (c & 0x80)? SC_RCV_B7_1: SC_RCV_B7_0;
850            c = ((c >> 4) ^ c) & 0xf;
851            s |= (0x6996 & (1 << c))? SC_RCV_ODDP: SC_RCV_EVNP;
852        }
853        ap->rbits |= s;
854    }
855
856    while (count > 0) {
857        /* scan through and see how many chars we can do in bulk */
858        if ((ap->state & SC_ESCAPE) && buf[0] == PPP_ESCAPE)
859            n = 1;
860        else
861            n = scan_ordinary(ap, buf, count);
862
863        f = 0;
864        if (flags && (ap->state & SC_TOSS) == 0) {
865            /* check the flags to see if any char had an error */
866            for (j = 0; j < n; ++j)
867                if ((f = flags[j]) != 0)
868                    break;
869        }
870        if (f != 0) {
871            /* start tossing */
872            ap->state |= SC_TOSS;
873
874        } else if (n > 0 && (ap->state & SC_TOSS) == 0) {
875            /* stuff the chars in the skb */
876            skb = ap->rpkt;
877            if (!skb) {
878                skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2);
879                if (!skb)
880                    goto nomem;
881                 ap->rpkt = skb;
882             }
883             if (skb->len == 0) {
884                 /* Try to get the payload 4-byte aligned.
885                  * This should match the
886                  * PPP_ALLSTATIONS/PPP_UI/compressed tests in
887                  * process_input_packet, but we do not have
888                  * enough chars here to test buf[1] and buf[2].
889                  */
890                if (buf[0] != PPP_ALLSTATIONS)
891                    skb_reserve(skb, 2 + (buf[0] & 1));
892            }
893            if (n > skb_tailroom(skb)) {
894                /* packet overflowed MRU */
895                ap->state |= SC_TOSS;
896            } else {
897                sp = skb_put(skb, n);
898                memcpy(sp, buf, n);
899                if (ap->state & SC_ESCAPE) {
900                    sp[0] ^= 0x20;
901                    ap->state &= ~SC_ESCAPE;
902                }
903            }
904        }
905
906        if (n >= count)
907            break;
908
909        c = buf[n];
910        if (flags != NULL && flags[n] != 0) {
911            ap->state |= SC_TOSS;
912        } else if (c == PPP_FLAG) {
913            process_input_packet(ap);
914        } else if (c == PPP_ESCAPE) {
915            ap->state |= SC_ESCAPE;
916        } else if (I_IXON(ap->tty)) {
917            if (c == START_CHAR(ap->tty))
918                start_tty(ap->tty);
919            else if (c == STOP_CHAR(ap->tty))
920                stop_tty(ap->tty);
921        }
922        /* otherwise it's a char in the recv ACCM */
923        ++n;
924
925        buf += n;
926        if (flags)
927            flags += n;
928        count -= n;
929    }
930    return;
931
932 nomem:
933    printk(KERN_ERR "PPPasync: no memory (input pkt)\n");
934    ap->state |= SC_TOSS;
935}
936
937/*
938 * We look at LCP frames going past so that we can notice
939 * and react to the LCP configure-ack from the peer.
940 * In the situation where the peer has been sent a configure-ack
941 * already, LCP is up once it has sent its configure-ack
942 * so the immediately following packet can be sent with the
943 * configured LCP options. This allows us to process the following
944 * packet correctly without pppd needing to respond quickly.
945 *
946 * We only respond to the received configure-ack if we have just
947 * sent a configure-request, and the configure-ack contains the
948 * same data (this is checked using a 16-bit crc of the data).
949 */
950#define CONFREQ 1 /* LCP code field values */
951#define CONFACK 2
952#define LCP_MRU 1 /* LCP option numbers */
953#define LCP_ASYNCMAP 2
954
955static void async_lcp_peek(struct asyncppp *ap, unsigned char *data,
956               int len, int inbound)
957{
958    int dlen, fcs, i, code;
959    u32 val;
960
961    data += 2; /* skip protocol bytes */
962    len -= 2;
963    if (len < 4) /* 4 = code, ID, length */
964        return;
965    code = data[0];
966    if (code != CONFACK && code != CONFREQ)
967        return;
968    dlen = (data[2] << 8) + data[3];
969    if (len < dlen)
970        return; /* packet got truncated or length is bogus */
971
972    if (code == (inbound? CONFACK: CONFREQ)) {
973        /*
974         * sent confreq or received confack:
975         * calculate the crc of the data from the ID field on.
976         */
977        fcs = PPP_INITFCS;
978        for (i = 1; i < dlen; ++i)
979            fcs = PPP_FCS(fcs, data[i]);
980
981        if (!inbound) {
982            /* outbound confreq - remember the crc for later */
983            ap->lcp_fcs = fcs;
984            return;
985        }
986
987        /* received confack, check the crc */
988        fcs ^= ap->lcp_fcs;
989        ap->lcp_fcs = -1;
990        if (fcs != 0)
991            return;
992    } else if (inbound)
993        return; /* not interested in received confreq */
994
995    /* process the options in the confack */
996    data += 4;
997    dlen -= 4;
998    /* data[0] is code, data[1] is length */
999    while (dlen >= 2 && dlen >= data[1] && data[1] >= 2) {
1000        switch (data[0]) {
1001        case LCP_MRU:
1002            val = (data[2] << 8) + data[3];
1003            if (inbound)
1004                ap->mru = val;
1005            else
1006                ap->chan.mtu = val;
1007            break;
1008        case LCP_ASYNCMAP:
1009            val = (data[2] << 24) + (data[3] << 16)
1010                + (data[4] << 8) + data[5];
1011            if (inbound)
1012                ap->raccm = val;
1013            else
1014                ap->xaccm[0] = val;
1015            break;
1016        }
1017        dlen -= data[1];
1018        data += data[1];
1019    }
1020}
1021
1022static void __exit ppp_async_cleanup(void)
1023{
1024    if (tty_unregister_ldisc(N_PPP) != 0)
1025        printk(KERN_ERR "failed to unregister PPP line discipline\n");
1026}
1027
1028module_init(ppp_async_init);
1029module_exit(ppp_async_cleanup);
1030

Archive Download this file



interactive