Loading...
1/*
2 * This program is free software; you can distribute it and/or modify it
3 * under the terms of the GNU General Public License (Version 2) as
4 * published by the Free Software Foundation.
5 *
6 * This program is distributed in the hope it will be useful, but WITHOUT
7 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
8 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
9 * for more details.
10 *
11 * You should have received a copy of the GNU General Public License along
12 * with this program; if not, see <http://www.gnu.org/licenses/>.
13 *
14 * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl>
15 * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org>
16 * Copyright (C) 2004, 05 Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de>
17 */
18#include <linux/module.h>
19#include <linux/bitops.h>
20#include <linux/uaccess.h>
21#include <linux/crc16.h>
22#include <linux/string.h>
23#include <linux/mm.h>
24#include <linux/interrupt.h>
25#include <linux/in.h>
26#include <linux/inet.h>
27#include <linux/slab.h>
28#include <linux/tty.h>
29#include <linux/errno.h>
30#include <linux/netdevice.h>
31#include <linux/major.h>
32#include <linux/init.h>
33#include <linux/rtnetlink.h>
34#include <linux/etherdevice.h>
35#include <linux/skbuff.h>
36#include <linux/if_arp.h>
37#include <linux/jiffies.h>
38#include <linux/compat.h>
39
40#include <net/ax25.h>
41
42#define AX_MTU 236
43
44/* SLIP/KISS protocol characters. */
45#define END 0300 /* indicates end of frame */
46#define ESC 0333 /* indicates byte stuffing */
47#define ESC_END 0334 /* ESC ESC_END means END 'data' */
48#define ESC_ESC 0335 /* ESC ESC_ESC means ESC 'data' */
49
50struct mkiss {
51 struct tty_struct *tty; /* ptr to TTY structure */
52 struct net_device *dev; /* easy for intr handling */
53
54 /* These are pointers to the malloc()ed frame buffers. */
55 spinlock_t buflock;/* lock for rbuf and xbuf */
56 unsigned char *rbuff; /* receiver buffer */
57 int rcount; /* received chars counter */
58 unsigned char *xbuff; /* transmitter buffer */
59 unsigned char *xhead; /* pointer to next byte to XMIT */
60 int xleft; /* bytes left in XMIT queue */
61
62 /* Detailed SLIP statistics. */
63 int mtu; /* Our mtu (to spot changes!) */
64 int buffsize; /* Max buffers sizes */
65
66 unsigned long flags; /* Flag values/ mode etc */
67 /* long req'd: used by set_bit --RR */
68#define AXF_INUSE 0 /* Channel in use */
69#define AXF_ESCAPE 1 /* ESC received */
70#define AXF_ERROR 2 /* Parity, etc. error */
71#define AXF_KEEPTEST 3 /* Keepalive test flag */
72#define AXF_OUTWAIT 4 /* is outpacket was flag */
73
74 int mode;
75 int crcmode; /* MW: for FlexNet, SMACK etc. */
76 int crcauto; /* CRC auto mode */
77
78#define CRC_MODE_NONE 0
79#define CRC_MODE_FLEX 1
80#define CRC_MODE_SMACK 2
81#define CRC_MODE_FLEX_TEST 3
82#define CRC_MODE_SMACK_TEST 4
83
84 atomic_t refcnt;
85 struct semaphore dead_sem;
86};
87
88/*---------------------------------------------------------------------------*/
89
90static const unsigned short crc_flex_table[] = {
91 0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
92 0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
93 0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
94 0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
95 0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
96 0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
97 0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
98 0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
99 0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
100 0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
101 0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
102 0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
103 0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
104 0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
105 0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
106 0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
107 0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
108 0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
109 0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
110 0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
111 0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
112 0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
113 0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
114 0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
115 0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
116 0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
117 0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
118 0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
119 0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
120 0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
121 0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
122 0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
123};
124
125static unsigned short calc_crc_flex(unsigned char *cp, int size)
126{
127 unsigned short crc = 0xffff;
128
129 while (size--)
130 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
131
132 return crc;
133}
134
135static int check_crc_flex(unsigned char *cp, int size)
136{
137 unsigned short crc = 0xffff;
138
139 if (size < 3)
140 return -1;
141
142 while (size--)
143 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
144
145 if ((crc & 0xffff) != 0x7070)
146 return -1;
147
148 return 0;
149}
150
151static int check_crc_16(unsigned char *cp, int size)
152{
153 unsigned short crc = 0x0000;
154
155 if (size < 3)
156 return -1;
157
158 crc = crc16(0, cp, size);
159
160 if (crc != 0x0000)
161 return -1;
162
163 return 0;
164}
165
166/*
167 * Standard encapsulation
168 */
169
170static int kiss_esc(unsigned char *s, unsigned char *d, int len)
171{
172 unsigned char *ptr = d;
173 unsigned char c;
174
175 /*
176 * Send an initial END character to flush out any data that may have
177 * accumulated in the receiver due to line noise.
178 */
179
180 *ptr++ = END;
181
182 while (len-- > 0) {
183 switch (c = *s++) {
184 case END:
185 *ptr++ = ESC;
186 *ptr++ = ESC_END;
187 break;
188 case ESC:
189 *ptr++ = ESC;
190 *ptr++ = ESC_ESC;
191 break;
192 default:
193 *ptr++ = c;
194 break;
195 }
196 }
197
198 *ptr++ = END;
199
200 return ptr - d;
201}
202
203/*
204 * MW:
205 * OK its ugly, but tell me a better solution without copying the
206 * packet to a temporary buffer :-)
207 */
208static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
209 int len)
210{
211 unsigned char *ptr = d;
212 unsigned char c=0;
213
214 *ptr++ = END;
215 while (len > 0) {
216 if (len > 2)
217 c = *s++;
218 else if (len > 1)
219 c = crc >> 8;
220 else if (len > 0)
221 c = crc & 0xff;
222
223 len--;
224
225 switch (c) {
226 case END:
227 *ptr++ = ESC;
228 *ptr++ = ESC_END;
229 break;
230 case ESC:
231 *ptr++ = ESC;
232 *ptr++ = ESC_ESC;
233 break;
234 default:
235 *ptr++ = c;
236 break;
237 }
238 }
239 *ptr++ = END;
240
241 return ptr - d;
242}
243
244/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
245static void ax_bump(struct mkiss *ax)
246{
247 struct sk_buff *skb;
248 int count;
249
250 spin_lock_bh(&ax->buflock);
251 if (ax->rbuff[0] > 0x0f) {
252 if (ax->rbuff[0] & 0x80) {
253 if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
254 ax->dev->stats.rx_errors++;
255 spin_unlock_bh(&ax->buflock);
256
257 return;
258 }
259 if (ax->crcmode != CRC_MODE_SMACK && ax->crcauto) {
260 printk(KERN_INFO
261 "mkiss: %s: Switching to crc-smack\n",
262 ax->dev->name);
263 ax->crcmode = CRC_MODE_SMACK;
264 }
265 ax->rcount -= 2;
266 *ax->rbuff &= ~0x80;
267 } else if (ax->rbuff[0] & 0x20) {
268 if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
269 ax->dev->stats.rx_errors++;
270 spin_unlock_bh(&ax->buflock);
271 return;
272 }
273 if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
274 printk(KERN_INFO
275 "mkiss: %s: Switching to crc-flexnet\n",
276 ax->dev->name);
277 ax->crcmode = CRC_MODE_FLEX;
278 }
279 ax->rcount -= 2;
280
281 /*
282 * dl9sau bugfix: the trailling two bytes flexnet crc
283 * will not be passed to the kernel. thus we have to
284 * correct the kissparm signature, because it indicates
285 * a crc but there's none
286 */
287 *ax->rbuff &= ~0x20;
288 }
289 }
290
291 count = ax->rcount;
292
293 if ((skb = dev_alloc_skb(count)) == NULL) {
294 printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
295 ax->dev->name);
296 ax->dev->stats.rx_dropped++;
297 spin_unlock_bh(&ax->buflock);
298 return;
299 }
300
301 memcpy(skb_put(skb,count), ax->rbuff, count);
302 skb->protocol = ax25_type_trans(skb, ax->dev);
303 netif_rx(skb);
304 ax->dev->stats.rx_packets++;
305 ax->dev->stats.rx_bytes += count;
306 spin_unlock_bh(&ax->buflock);
307}
308
309static void kiss_unesc(struct mkiss *ax, unsigned char s)
310{
311 switch (s) {
312 case END:
313 /* drop keeptest bit = VSV */
314 if (test_bit(AXF_KEEPTEST, &ax->flags))
315 clear_bit(AXF_KEEPTEST, &ax->flags);
316
317 if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
318 ax_bump(ax);
319
320 clear_bit(AXF_ESCAPE, &ax->flags);
321 ax->rcount = 0;
322 return;
323
324 case ESC:
325 set_bit(AXF_ESCAPE, &ax->flags);
326 return;
327 case ESC_ESC:
328 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
329 s = ESC;
330 break;
331 case ESC_END:
332 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
333 s = END;
334 break;
335 }
336
337 spin_lock_bh(&ax->buflock);
338 if (!test_bit(AXF_ERROR, &ax->flags)) {
339 if (ax->rcount < ax->buffsize) {
340 ax->rbuff[ax->rcount++] = s;
341 spin_unlock_bh(&ax->buflock);
342 return;
343 }
344
345 ax->dev->stats.rx_over_errors++;
346 set_bit(AXF_ERROR, &ax->flags);
347 }
348 spin_unlock_bh(&ax->buflock);
349}
350
351static int ax_set_mac_address(struct net_device *dev, void *addr)
352{
353 struct sockaddr_ax25 *sa = addr;
354
355 netif_tx_lock_bh(dev);
356 netif_addr_lock(dev);
357 memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
358 netif_addr_unlock(dev);
359 netif_tx_unlock_bh(dev);
360
361 return 0;
362}
363
364/*---------------------------------------------------------------------------*/
365
366static void ax_changedmtu(struct mkiss *ax)
367{
368 struct net_device *dev = ax->dev;
369 unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
370 int len;
371
372 len = dev->mtu * 2;
373
374 /*
375 * allow for arrival of larger UDP packets, even if we say not to
376 * also fixes a bug in which SunOS sends 512-byte packets even with
377 * an MSS of 128
378 */
379 if (len < 576 * 2)
380 len = 576 * 2;
381
382 xbuff = kmalloc(len + 4, GFP_ATOMIC);
383 rbuff = kmalloc(len + 4, GFP_ATOMIC);
384
385 if (xbuff == NULL || rbuff == NULL) {
386 printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, "
387 "MTU change cancelled.\n",
388 ax->dev->name);
389 dev->mtu = ax->mtu;
390 kfree(xbuff);
391 kfree(rbuff);
392 return;
393 }
394
395 spin_lock_bh(&ax->buflock);
396
397 oxbuff = ax->xbuff;
398 ax->xbuff = xbuff;
399 orbuff = ax->rbuff;
400 ax->rbuff = rbuff;
401
402 if (ax->xleft) {
403 if (ax->xleft <= len) {
404 memcpy(ax->xbuff, ax->xhead, ax->xleft);
405 } else {
406 ax->xleft = 0;
407 dev->stats.tx_dropped++;
408 }
409 }
410
411 ax->xhead = ax->xbuff;
412
413 if (ax->rcount) {
414 if (ax->rcount <= len) {
415 memcpy(ax->rbuff, orbuff, ax->rcount);
416 } else {
417 ax->rcount = 0;
418 dev->stats.rx_over_errors++;
419 set_bit(AXF_ERROR, &ax->flags);
420 }
421 }
422
423 ax->mtu = dev->mtu + 73;
424 ax->buffsize = len;
425
426 spin_unlock_bh(&ax->buflock);
427
428 kfree(oxbuff);
429 kfree(orbuff);
430}
431
432/* Encapsulate one AX.25 packet and stuff into a TTY queue. */
433static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
434{
435 struct mkiss *ax = netdev_priv(dev);
436 unsigned char *p;
437 int actual, count;
438
439 if (ax->mtu != ax->dev->mtu + 73) /* Someone has been ifconfigging */
440 ax_changedmtu(ax);
441
442 if (len > ax->mtu) { /* Sigh, shouldn't occur BUT ... */
443 len = ax->mtu;
444 printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name);
445 dev->stats.tx_dropped++;
446 netif_start_queue(dev);
447 return;
448 }
449
450 p = icp;
451
452 spin_lock_bh(&ax->buflock);
453 if ((*p & 0x0f) != 0) {
454 /* Configuration Command (kissparms(1).
455 * Protocol spec says: never append CRC.
456 * This fixes a very old bug in the linux
457 * kiss driver. -- dl9sau */
458 switch (*p & 0xff) {
459 case 0x85:
460 /* command from userspace especially for us,
461 * not for delivery to the tnc */
462 if (len > 1) {
463 int cmd = (p[1] & 0xff);
464 switch(cmd) {
465 case 3:
466 ax->crcmode = CRC_MODE_SMACK;
467 break;
468 case 2:
469 ax->crcmode = CRC_MODE_FLEX;
470 break;
471 case 1:
472 ax->crcmode = CRC_MODE_NONE;
473 break;
474 case 0:
475 default:
476 ax->crcmode = CRC_MODE_SMACK_TEST;
477 cmd = 0;
478 }
479 ax->crcauto = (cmd ? 0 : 1);
480 printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd);
481 }
482 spin_unlock_bh(&ax->buflock);
483 netif_start_queue(dev);
484
485 return;
486 default:
487 count = kiss_esc(p, ax->xbuff, len);
488 }
489 } else {
490 unsigned short crc;
491 switch (ax->crcmode) {
492 case CRC_MODE_SMACK_TEST:
493 ax->crcmode = CRC_MODE_FLEX_TEST;
494 printk(KERN_INFO "mkiss: %s: Trying crc-smack\n", ax->dev->name);
495 // fall through
496 case CRC_MODE_SMACK:
497 *p |= 0x80;
498 crc = swab16(crc16(0, p, len));
499 count = kiss_esc_crc(p, ax->xbuff, crc, len+2);
500 break;
501 case CRC_MODE_FLEX_TEST:
502 ax->crcmode = CRC_MODE_NONE;
503 printk(KERN_INFO "mkiss: %s: Trying crc-flexnet\n", ax->dev->name);
504 // fall through
505 case CRC_MODE_FLEX:
506 *p |= 0x20;
507 crc = calc_crc_flex(p, len);
508 count = kiss_esc_crc(p, ax->xbuff, crc, len+2);
509 break;
510
511 default:
512 count = kiss_esc(p, ax->xbuff, len);
513 }
514 }
515 spin_unlock_bh(&ax->buflock);
516
517 set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
518 actual = ax->tty->ops->write(ax->tty, ax->xbuff, count);
519 dev->stats.tx_packets++;
520 dev->stats.tx_bytes += actual;
521
522 netif_trans_update(ax->dev);
523 ax->xleft = count - actual;
524 ax->xhead = ax->xbuff + actual;
525}
526
527/* Encapsulate an AX.25 packet and kick it into a TTY queue. */
528static netdev_tx_t ax_xmit(struct sk_buff *skb, struct net_device *dev)
529{
530 struct mkiss *ax = netdev_priv(dev);
531
532 if (skb->protocol == htons(ETH_P_IP))
533 return ax25_ip_xmit(skb);
534
535 if (!netif_running(dev)) {
536 printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
537 return NETDEV_TX_BUSY;
538 }
539
540 if (netif_queue_stopped(dev)) {
541 /*
542 * May be we must check transmitter timeout here ?
543 * 14 Oct 1994 Dmitry Gorodchanin.
544 */
545 if (time_before(jiffies, dev_trans_start(dev) + 20 * HZ)) {
546 /* 20 sec timeout not reached */
547 return NETDEV_TX_BUSY;
548 }
549
550 printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name,
551 (tty_chars_in_buffer(ax->tty) || ax->xleft) ?
552 "bad line quality" : "driver error");
553
554 ax->xleft = 0;
555 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
556 netif_start_queue(dev);
557 }
558
559 /* We were not busy, so we are now... :-) */
560 netif_stop_queue(dev);
561 ax_encaps(dev, skb->data, skb->len);
562 kfree_skb(skb);
563
564 return NETDEV_TX_OK;
565}
566
567static int ax_open_dev(struct net_device *dev)
568{
569 struct mkiss *ax = netdev_priv(dev);
570
571 if (ax->tty == NULL)
572 return -ENODEV;
573
574 return 0;
575}
576
577/* Open the low-level part of the AX25 channel. Easy! */
578static int ax_open(struct net_device *dev)
579{
580 struct mkiss *ax = netdev_priv(dev);
581 unsigned long len;
582
583 if (ax->tty == NULL)
584 return -ENODEV;
585
586 /*
587 * Allocate the frame buffers:
588 *
589 * rbuff Receive buffer.
590 * xbuff Transmit buffer.
591 */
592 len = dev->mtu * 2;
593
594 /*
595 * allow for arrival of larger UDP packets, even if we say not to
596 * also fixes a bug in which SunOS sends 512-byte packets even with
597 * an MSS of 128
598 */
599 if (len < 576 * 2)
600 len = 576 * 2;
601
602 if ((ax->rbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
603 goto norbuff;
604
605 if ((ax->xbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
606 goto noxbuff;
607
608 ax->mtu = dev->mtu + 73;
609 ax->buffsize = len;
610 ax->rcount = 0;
611 ax->xleft = 0;
612
613 ax->flags &= (1 << AXF_INUSE); /* Clear ESCAPE & ERROR flags */
614
615 spin_lock_init(&ax->buflock);
616
617 return 0;
618
619noxbuff:
620 kfree(ax->rbuff);
621
622norbuff:
623 return -ENOMEM;
624}
625
626
627/* Close the low-level part of the AX25 channel. Easy! */
628static int ax_close(struct net_device *dev)
629{
630 struct mkiss *ax = netdev_priv(dev);
631
632 if (ax->tty)
633 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
634
635 netif_stop_queue(dev);
636
637 return 0;
638}
639
640static const struct net_device_ops ax_netdev_ops = {
641 .ndo_open = ax_open_dev,
642 .ndo_stop = ax_close,
643 .ndo_start_xmit = ax_xmit,
644 .ndo_set_mac_address = ax_set_mac_address,
645};
646
647static void ax_setup(struct net_device *dev)
648{
649 /* Finish setting up the DEVICE info. */
650 dev->mtu = AX_MTU;
651 dev->hard_header_len = AX25_MAX_HEADER_LEN;
652 dev->addr_len = AX25_ADDR_LEN;
653 dev->type = ARPHRD_AX25;
654 dev->tx_queue_len = 10;
655 dev->header_ops = &ax25_header_ops;
656 dev->netdev_ops = &ax_netdev_ops;
657
658
659 memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
660 memcpy(dev->dev_addr, &ax25_defaddr, AX25_ADDR_LEN);
661
662 dev->flags = IFF_BROADCAST | IFF_MULTICAST;
663}
664
665/*
666 * We have a potential race on dereferencing tty->disc_data, because the tty
667 * layer provides no locking at all - thus one cpu could be running
668 * sixpack_receive_buf while another calls sixpack_close, which zeroes
669 * tty->disc_data and frees the memory that sixpack_receive_buf is using. The
670 * best way to fix this is to use a rwlock in the tty struct, but for now we
671 * use a single global rwlock for all ttys in ppp line discipline.
672 */
673static DEFINE_RWLOCK(disc_data_lock);
674
675static struct mkiss *mkiss_get(struct tty_struct *tty)
676{
677 struct mkiss *ax;
678
679 read_lock(&disc_data_lock);
680 ax = tty->disc_data;
681 if (ax)
682 atomic_inc(&ax->refcnt);
683 read_unlock(&disc_data_lock);
684
685 return ax;
686}
687
688static void mkiss_put(struct mkiss *ax)
689{
690 if (atomic_dec_and_test(&ax->refcnt))
691 up(&ax->dead_sem);
692}
693
694static int crc_force = 0; /* Can be overridden with insmod */
695
696static int mkiss_open(struct tty_struct *tty)
697{
698 struct net_device *dev;
699 struct mkiss *ax;
700 int err;
701
702 if (!capable(CAP_NET_ADMIN))
703 return -EPERM;
704 if (tty->ops->write == NULL)
705 return -EOPNOTSUPP;
706
707 dev = alloc_netdev(sizeof(struct mkiss), "ax%d", NET_NAME_UNKNOWN,
708 ax_setup);
709 if (!dev) {
710 err = -ENOMEM;
711 goto out;
712 }
713
714 ax = netdev_priv(dev);
715 ax->dev = dev;
716
717 spin_lock_init(&ax->buflock);
718 atomic_set(&ax->refcnt, 1);
719 sema_init(&ax->dead_sem, 0);
720
721 ax->tty = tty;
722 tty->disc_data = ax;
723 tty->receive_room = 65535;
724
725 tty_driver_flush_buffer(tty);
726
727 /* Restore default settings */
728 dev->type = ARPHRD_AX25;
729
730 /* Perform the low-level AX25 initialization. */
731 err = ax_open(ax->dev);
732 if (err)
733 goto out_free_netdev;
734
735 err = register_netdev(dev);
736 if (err)
737 goto out_free_buffers;
738
739 /* after register_netdev() - because else printk smashes the kernel */
740 switch (crc_force) {
741 case 3:
742 ax->crcmode = CRC_MODE_SMACK;
743 printk(KERN_INFO "mkiss: %s: crc mode smack forced.\n",
744 ax->dev->name);
745 break;
746 case 2:
747 ax->crcmode = CRC_MODE_FLEX;
748 printk(KERN_INFO "mkiss: %s: crc mode flexnet forced.\n",
749 ax->dev->name);
750 break;
751 case 1:
752 ax->crcmode = CRC_MODE_NONE;
753 printk(KERN_INFO "mkiss: %s: crc mode disabled.\n",
754 ax->dev->name);
755 break;
756 case 0:
757 /* fall through */
758 default:
759 crc_force = 0;
760 printk(KERN_INFO "mkiss: %s: crc mode is auto.\n",
761 ax->dev->name);
762 ax->crcmode = CRC_MODE_SMACK_TEST;
763 }
764 ax->crcauto = (crc_force ? 0 : 1);
765
766 netif_start_queue(dev);
767
768 /* Done. We have linked the TTY line to a channel. */
769 return 0;
770
771out_free_buffers:
772 kfree(ax->rbuff);
773 kfree(ax->xbuff);
774
775out_free_netdev:
776 free_netdev(dev);
777
778out:
779 return err;
780}
781
782static void mkiss_close(struct tty_struct *tty)
783{
784 struct mkiss *ax;
785
786 write_lock_bh(&disc_data_lock);
787 ax = tty->disc_data;
788 tty->disc_data = NULL;
789 write_unlock_bh(&disc_data_lock);
790
791 if (!ax)
792 return;
793
794 /*
795 * We have now ensured that nobody can start using ap from now on, but
796 * we have to wait for all existing users to finish.
797 */
798 if (!atomic_dec_and_test(&ax->refcnt))
799 down(&ax->dead_sem);
800 /*
801 * Halt the transmit queue so that a new transmit cannot scribble
802 * on our buffers
803 */
804 netif_stop_queue(ax->dev);
805
806 /* Free all AX25 frame buffers. */
807 kfree(ax->rbuff);
808 kfree(ax->xbuff);
809
810 ax->tty = NULL;
811
812 unregister_netdev(ax->dev);
813}
814
815/* Perform I/O control on an active ax25 channel. */
816static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
817 unsigned int cmd, unsigned long arg)
818{
819 struct mkiss *ax = mkiss_get(tty);
820 struct net_device *dev;
821 unsigned int tmp, err;
822
823 /* First make sure we're connected. */
824 if (ax == NULL)
825 return -ENXIO;
826 dev = ax->dev;
827
828 switch (cmd) {
829 case SIOCGIFNAME:
830 err = copy_to_user((void __user *) arg, ax->dev->name,
831 strlen(ax->dev->name) + 1) ? -EFAULT : 0;
832 break;
833
834 case SIOCGIFENCAP:
835 err = put_user(4, (int __user *) arg);
836 break;
837
838 case SIOCSIFENCAP:
839 if (get_user(tmp, (int __user *) arg)) {
840 err = -EFAULT;
841 break;
842 }
843
844 ax->mode = tmp;
845 dev->addr_len = AX25_ADDR_LEN;
846 dev->hard_header_len = AX25_KISS_HEADER_LEN +
847 AX25_MAX_HEADER_LEN + 3;
848 dev->type = ARPHRD_AX25;
849
850 err = 0;
851 break;
852
853 case SIOCSIFHWADDR: {
854 char addr[AX25_ADDR_LEN];
855
856 if (copy_from_user(&addr,
857 (void __user *) arg, AX25_ADDR_LEN)) {
858 err = -EFAULT;
859 break;
860 }
861
862 netif_tx_lock_bh(dev);
863 memcpy(dev->dev_addr, addr, AX25_ADDR_LEN);
864 netif_tx_unlock_bh(dev);
865
866 err = 0;
867 break;
868 }
869 default:
870 err = -ENOIOCTLCMD;
871 }
872
873 mkiss_put(ax);
874
875 return err;
876}
877
878#ifdef CONFIG_COMPAT
879static long mkiss_compat_ioctl(struct tty_struct *tty, struct file *file,
880 unsigned int cmd, unsigned long arg)
881{
882 switch (cmd) {
883 case SIOCGIFNAME:
884 case SIOCGIFENCAP:
885 case SIOCSIFENCAP:
886 case SIOCSIFHWADDR:
887 return mkiss_ioctl(tty, file, cmd,
888 (unsigned long)compat_ptr(arg));
889 }
890
891 return -ENOIOCTLCMD;
892}
893#endif
894
895/*
896 * Handle the 'receiver data ready' interrupt.
897 * This function is called by the 'tty_io' module in the kernel when
898 * a block of data has been received, which can now be decapsulated
899 * and sent on to the AX.25 layer for further processing.
900 */
901static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
902 char *fp, int count)
903{
904 struct mkiss *ax = mkiss_get(tty);
905
906 if (!ax)
907 return;
908
909 /*
910 * Argh! mtu change time! - costs us the packet part received
911 * at the change
912 */
913 if (ax->mtu != ax->dev->mtu + 73)
914 ax_changedmtu(ax);
915
916 /* Read the characters out of the buffer */
917 while (count--) {
918 if (fp != NULL && *fp++) {
919 if (!test_and_set_bit(AXF_ERROR, &ax->flags))
920 ax->dev->stats.rx_errors++;
921 cp++;
922 continue;
923 }
924
925 kiss_unesc(ax, *cp++);
926 }
927
928 mkiss_put(ax);
929 tty_unthrottle(tty);
930}
931
932/*
933 * Called by the driver when there's room for more data. If we have
934 * more packets to send, we send them here.
935 */
936static void mkiss_write_wakeup(struct tty_struct *tty)
937{
938 struct mkiss *ax = mkiss_get(tty);
939 int actual;
940
941 if (!ax)
942 return;
943
944 if (ax->xleft <= 0) {
945 /* Now serial buffer is almost free & we can start
946 * transmission of another packet
947 */
948 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
949
950 netif_wake_queue(ax->dev);
951 goto out;
952 }
953
954 actual = tty->ops->write(tty, ax->xhead, ax->xleft);
955 ax->xleft -= actual;
956 ax->xhead += actual;
957
958out:
959 mkiss_put(ax);
960}
961
962static struct tty_ldisc_ops ax_ldisc = {
963 .owner = THIS_MODULE,
964 .magic = TTY_LDISC_MAGIC,
965 .name = "mkiss",
966 .open = mkiss_open,
967 .close = mkiss_close,
968 .ioctl = mkiss_ioctl,
969#ifdef CONFIG_COMPAT
970 .compat_ioctl = mkiss_compat_ioctl,
971#endif
972 .receive_buf = mkiss_receive_buf,
973 .write_wakeup = mkiss_write_wakeup
974};
975
976static const char banner[] __initconst = KERN_INFO \
977 "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
978static const char msg_regfail[] __initconst = KERN_ERR \
979 "mkiss: can't register line discipline (err = %d)\n";
980
981static int __init mkiss_init_driver(void)
982{
983 int status;
984
985 printk(banner);
986
987 status = tty_register_ldisc(N_AX25, &ax_ldisc);
988 if (status != 0)
989 printk(msg_regfail, status);
990
991 return status;
992}
993
994static const char msg_unregfail[] = KERN_ERR \
995 "mkiss: can't unregister line discipline (err = %d)\n";
996
997static void __exit mkiss_exit_driver(void)
998{
999 int ret;
1000
1001 if ((ret = tty_unregister_ldisc(N_AX25)))
1002 printk(msg_unregfail, ret);
1003}
1004
1005MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>");
1006MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs");
1007module_param(crc_force, int, 0);
1008MODULE_PARM_DESC(crc_force, "crc [0 = auto | 1 = none | 2 = flexnet | 3 = smack]");
1009MODULE_LICENSE("GPL");
1010MODULE_ALIAS_LDISC(N_AX25);
1011
1012module_init(mkiss_init_driver);
1013module_exit(mkiss_exit_driver);
1/*
2 * This program is free software; you can distribute it and/or modify it
3 * under the terms of the GNU General Public License (Version 2) as
4 * published by the Free Software Foundation.
5 *
6 * This program is distributed in the hope it will be useful, but WITHOUT
7 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
8 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
9 * for more details.
10 *
11 * You should have received a copy of the GNU General Public License along
12 * with this program; if not, write to the Free Software Foundation, Inc.,
13 * 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
14 *
15 * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl>
16 * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org>
17 * Copyright (C) 2004, 05 Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de>
18 */
19#include <linux/module.h>
20#include <asm/system.h>
21#include <linux/bitops.h>
22#include <asm/uaccess.h>
23#include <linux/crc16.h>
24#include <linux/string.h>
25#include <linux/mm.h>
26#include <linux/interrupt.h>
27#include <linux/in.h>
28#include <linux/inet.h>
29#include <linux/slab.h>
30#include <linux/tty.h>
31#include <linux/errno.h>
32#include <linux/netdevice.h>
33#include <linux/major.h>
34#include <linux/init.h>
35#include <linux/rtnetlink.h>
36#include <linux/etherdevice.h>
37#include <linux/skbuff.h>
38#include <linux/if_arp.h>
39#include <linux/jiffies.h>
40#include <linux/compat.h>
41
42#include <net/ax25.h>
43
44#define AX_MTU 236
45
46/* SLIP/KISS protocol characters. */
47#define END 0300 /* indicates end of frame */
48#define ESC 0333 /* indicates byte stuffing */
49#define ESC_END 0334 /* ESC ESC_END means END 'data' */
50#define ESC_ESC 0335 /* ESC ESC_ESC means ESC 'data' */
51
52struct mkiss {
53 struct tty_struct *tty; /* ptr to TTY structure */
54 struct net_device *dev; /* easy for intr handling */
55
56 /* These are pointers to the malloc()ed frame buffers. */
57 spinlock_t buflock;/* lock for rbuf and xbuf */
58 unsigned char *rbuff; /* receiver buffer */
59 int rcount; /* received chars counter */
60 unsigned char *xbuff; /* transmitter buffer */
61 unsigned char *xhead; /* pointer to next byte to XMIT */
62 int xleft; /* bytes left in XMIT queue */
63
64 /* Detailed SLIP statistics. */
65 int mtu; /* Our mtu (to spot changes!) */
66 int buffsize; /* Max buffers sizes */
67
68 unsigned long flags; /* Flag values/ mode etc */
69 /* long req'd: used by set_bit --RR */
70#define AXF_INUSE 0 /* Channel in use */
71#define AXF_ESCAPE 1 /* ESC received */
72#define AXF_ERROR 2 /* Parity, etc. error */
73#define AXF_KEEPTEST 3 /* Keepalive test flag */
74#define AXF_OUTWAIT 4 /* is outpacket was flag */
75
76 int mode;
77 int crcmode; /* MW: for FlexNet, SMACK etc. */
78 int crcauto; /* CRC auto mode */
79
80#define CRC_MODE_NONE 0
81#define CRC_MODE_FLEX 1
82#define CRC_MODE_SMACK 2
83#define CRC_MODE_FLEX_TEST 3
84#define CRC_MODE_SMACK_TEST 4
85
86 atomic_t refcnt;
87 struct semaphore dead_sem;
88};
89
90/*---------------------------------------------------------------------------*/
91
92static const unsigned short crc_flex_table[] = {
93 0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
94 0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
95 0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
96 0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
97 0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
98 0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
99 0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
100 0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
101 0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
102 0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
103 0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
104 0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
105 0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
106 0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
107 0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
108 0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
109 0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
110 0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
111 0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
112 0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
113 0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
114 0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
115 0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
116 0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
117 0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
118 0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
119 0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
120 0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
121 0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
122 0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
123 0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
124 0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
125};
126
127static unsigned short calc_crc_flex(unsigned char *cp, int size)
128{
129 unsigned short crc = 0xffff;
130
131 while (size--)
132 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
133
134 return crc;
135}
136
137static int check_crc_flex(unsigned char *cp, int size)
138{
139 unsigned short crc = 0xffff;
140
141 if (size < 3)
142 return -1;
143
144 while (size--)
145 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
146
147 if ((crc & 0xffff) != 0x7070)
148 return -1;
149
150 return 0;
151}
152
153static int check_crc_16(unsigned char *cp, int size)
154{
155 unsigned short crc = 0x0000;
156
157 if (size < 3)
158 return -1;
159
160 crc = crc16(0, cp, size);
161
162 if (crc != 0x0000)
163 return -1;
164
165 return 0;
166}
167
168/*
169 * Standard encapsulation
170 */
171
172static int kiss_esc(unsigned char *s, unsigned char *d, int len)
173{
174 unsigned char *ptr = d;
175 unsigned char c;
176
177 /*
178 * Send an initial END character to flush out any data that may have
179 * accumulated in the receiver due to line noise.
180 */
181
182 *ptr++ = END;
183
184 while (len-- > 0) {
185 switch (c = *s++) {
186 case END:
187 *ptr++ = ESC;
188 *ptr++ = ESC_END;
189 break;
190 case ESC:
191 *ptr++ = ESC;
192 *ptr++ = ESC_ESC;
193 break;
194 default:
195 *ptr++ = c;
196 break;
197 }
198 }
199
200 *ptr++ = END;
201
202 return ptr - d;
203}
204
205/*
206 * MW:
207 * OK its ugly, but tell me a better solution without copying the
208 * packet to a temporary buffer :-)
209 */
210static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
211 int len)
212{
213 unsigned char *ptr = d;
214 unsigned char c=0;
215
216 *ptr++ = END;
217 while (len > 0) {
218 if (len > 2)
219 c = *s++;
220 else if (len > 1)
221 c = crc >> 8;
222 else if (len > 0)
223 c = crc & 0xff;
224
225 len--;
226
227 switch (c) {
228 case END:
229 *ptr++ = ESC;
230 *ptr++ = ESC_END;
231 break;
232 case ESC:
233 *ptr++ = ESC;
234 *ptr++ = ESC_ESC;
235 break;
236 default:
237 *ptr++ = c;
238 break;
239 }
240 }
241 *ptr++ = END;
242
243 return ptr - d;
244}
245
246/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
247static void ax_bump(struct mkiss *ax)
248{
249 struct sk_buff *skb;
250 int count;
251
252 spin_lock_bh(&ax->buflock);
253 if (ax->rbuff[0] > 0x0f) {
254 if (ax->rbuff[0] & 0x80) {
255 if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
256 ax->dev->stats.rx_errors++;
257 spin_unlock_bh(&ax->buflock);
258
259 return;
260 }
261 if (ax->crcmode != CRC_MODE_SMACK && ax->crcauto) {
262 printk(KERN_INFO
263 "mkiss: %s: Switching to crc-smack\n",
264 ax->dev->name);
265 ax->crcmode = CRC_MODE_SMACK;
266 }
267 ax->rcount -= 2;
268 *ax->rbuff &= ~0x80;
269 } else if (ax->rbuff[0] & 0x20) {
270 if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
271 ax->dev->stats.rx_errors++;
272 spin_unlock_bh(&ax->buflock);
273 return;
274 }
275 if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
276 printk(KERN_INFO
277 "mkiss: %s: Switching to crc-flexnet\n",
278 ax->dev->name);
279 ax->crcmode = CRC_MODE_FLEX;
280 }
281 ax->rcount -= 2;
282
283 /*
284 * dl9sau bugfix: the trailling two bytes flexnet crc
285 * will not be passed to the kernel. thus we have to
286 * correct the kissparm signature, because it indicates
287 * a crc but there's none
288 */
289 *ax->rbuff &= ~0x20;
290 }
291 }
292
293 count = ax->rcount;
294
295 if ((skb = dev_alloc_skb(count)) == NULL) {
296 printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
297 ax->dev->name);
298 ax->dev->stats.rx_dropped++;
299 spin_unlock_bh(&ax->buflock);
300 return;
301 }
302
303 memcpy(skb_put(skb,count), ax->rbuff, count);
304 skb->protocol = ax25_type_trans(skb, ax->dev);
305 netif_rx(skb);
306 ax->dev->stats.rx_packets++;
307 ax->dev->stats.rx_bytes += count;
308 spin_unlock_bh(&ax->buflock);
309}
310
311static void kiss_unesc(struct mkiss *ax, unsigned char s)
312{
313 switch (s) {
314 case END:
315 /* drop keeptest bit = VSV */
316 if (test_bit(AXF_KEEPTEST, &ax->flags))
317 clear_bit(AXF_KEEPTEST, &ax->flags);
318
319 if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
320 ax_bump(ax);
321
322 clear_bit(AXF_ESCAPE, &ax->flags);
323 ax->rcount = 0;
324 return;
325
326 case ESC:
327 set_bit(AXF_ESCAPE, &ax->flags);
328 return;
329 case ESC_ESC:
330 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
331 s = ESC;
332 break;
333 case ESC_END:
334 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
335 s = END;
336 break;
337 }
338
339 spin_lock_bh(&ax->buflock);
340 if (!test_bit(AXF_ERROR, &ax->flags)) {
341 if (ax->rcount < ax->buffsize) {
342 ax->rbuff[ax->rcount++] = s;
343 spin_unlock_bh(&ax->buflock);
344 return;
345 }
346
347 ax->dev->stats.rx_over_errors++;
348 set_bit(AXF_ERROR, &ax->flags);
349 }
350 spin_unlock_bh(&ax->buflock);
351}
352
353static int ax_set_mac_address(struct net_device *dev, void *addr)
354{
355 struct sockaddr_ax25 *sa = addr;
356
357 netif_tx_lock_bh(dev);
358 netif_addr_lock(dev);
359 memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
360 netif_addr_unlock(dev);
361 netif_tx_unlock_bh(dev);
362
363 return 0;
364}
365
366/*---------------------------------------------------------------------------*/
367
368static void ax_changedmtu(struct mkiss *ax)
369{
370 struct net_device *dev = ax->dev;
371 unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
372 int len;
373
374 len = dev->mtu * 2;
375
376 /*
377 * allow for arrival of larger UDP packets, even if we say not to
378 * also fixes a bug in which SunOS sends 512-byte packets even with
379 * an MSS of 128
380 */
381 if (len < 576 * 2)
382 len = 576 * 2;
383
384 xbuff = kmalloc(len + 4, GFP_ATOMIC);
385 rbuff = kmalloc(len + 4, GFP_ATOMIC);
386
387 if (xbuff == NULL || rbuff == NULL) {
388 printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, "
389 "MTU change cancelled.\n",
390 ax->dev->name);
391 dev->mtu = ax->mtu;
392 kfree(xbuff);
393 kfree(rbuff);
394 return;
395 }
396
397 spin_lock_bh(&ax->buflock);
398
399 oxbuff = ax->xbuff;
400 ax->xbuff = xbuff;
401 orbuff = ax->rbuff;
402 ax->rbuff = rbuff;
403
404 if (ax->xleft) {
405 if (ax->xleft <= len) {
406 memcpy(ax->xbuff, ax->xhead, ax->xleft);
407 } else {
408 ax->xleft = 0;
409 dev->stats.tx_dropped++;
410 }
411 }
412
413 ax->xhead = ax->xbuff;
414
415 if (ax->rcount) {
416 if (ax->rcount <= len) {
417 memcpy(ax->rbuff, orbuff, ax->rcount);
418 } else {
419 ax->rcount = 0;
420 dev->stats.rx_over_errors++;
421 set_bit(AXF_ERROR, &ax->flags);
422 }
423 }
424
425 ax->mtu = dev->mtu + 73;
426 ax->buffsize = len;
427
428 spin_unlock_bh(&ax->buflock);
429
430 kfree(oxbuff);
431 kfree(orbuff);
432}
433
434/* Encapsulate one AX.25 packet and stuff into a TTY queue. */
435static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
436{
437 struct mkiss *ax = netdev_priv(dev);
438 unsigned char *p;
439 int actual, count;
440
441 if (ax->mtu != ax->dev->mtu + 73) /* Someone has been ifconfigging */
442 ax_changedmtu(ax);
443
444 if (len > ax->mtu) { /* Sigh, shouldn't occur BUT ... */
445 len = ax->mtu;
446 printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name);
447 dev->stats.tx_dropped++;
448 netif_start_queue(dev);
449 return;
450 }
451
452 p = icp;
453
454 spin_lock_bh(&ax->buflock);
455 if ((*p & 0x0f) != 0) {
456 /* Configuration Command (kissparms(1).
457 * Protocol spec says: never append CRC.
458 * This fixes a very old bug in the linux
459 * kiss driver. -- dl9sau */
460 switch (*p & 0xff) {
461 case 0x85:
462 /* command from userspace especially for us,
463 * not for delivery to the tnc */
464 if (len > 1) {
465 int cmd = (p[1] & 0xff);
466 switch(cmd) {
467 case 3:
468 ax->crcmode = CRC_MODE_SMACK;
469 break;
470 case 2:
471 ax->crcmode = CRC_MODE_FLEX;
472 break;
473 case 1:
474 ax->crcmode = CRC_MODE_NONE;
475 break;
476 case 0:
477 default:
478 ax->crcmode = CRC_MODE_SMACK_TEST;
479 cmd = 0;
480 }
481 ax->crcauto = (cmd ? 0 : 1);
482 printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd);
483 }
484 spin_unlock_bh(&ax->buflock);
485 netif_start_queue(dev);
486
487 return;
488 default:
489 count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
490 }
491 } else {
492 unsigned short crc;
493 switch (ax->crcmode) {
494 case CRC_MODE_SMACK_TEST:
495 ax->crcmode = CRC_MODE_FLEX_TEST;
496 printk(KERN_INFO "mkiss: %s: Trying crc-smack\n", ax->dev->name);
497 // fall through
498 case CRC_MODE_SMACK:
499 *p |= 0x80;
500 crc = swab16(crc16(0, p, len));
501 count = kiss_esc_crc(p, (unsigned char *)ax->xbuff, crc, len+2);
502 break;
503 case CRC_MODE_FLEX_TEST:
504 ax->crcmode = CRC_MODE_NONE;
505 printk(KERN_INFO "mkiss: %s: Trying crc-flexnet\n", ax->dev->name);
506 // fall through
507 case CRC_MODE_FLEX:
508 *p |= 0x20;
509 crc = calc_crc_flex(p, len);
510 count = kiss_esc_crc(p, (unsigned char *)ax->xbuff, crc, len+2);
511 break;
512
513 default:
514 count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
515 }
516 }
517 spin_unlock_bh(&ax->buflock);
518
519 set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
520 actual = ax->tty->ops->write(ax->tty, ax->xbuff, count);
521 dev->stats.tx_packets++;
522 dev->stats.tx_bytes += actual;
523
524 ax->dev->trans_start = jiffies;
525 ax->xleft = count - actual;
526 ax->xhead = ax->xbuff + actual;
527}
528
529/* Encapsulate an AX.25 packet and kick it into a TTY queue. */
530static netdev_tx_t ax_xmit(struct sk_buff *skb, struct net_device *dev)
531{
532 struct mkiss *ax = netdev_priv(dev);
533
534 if (!netif_running(dev)) {
535 printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
536 return NETDEV_TX_BUSY;
537 }
538
539 if (netif_queue_stopped(dev)) {
540 /*
541 * May be we must check transmitter timeout here ?
542 * 14 Oct 1994 Dmitry Gorodchanin.
543 */
544 if (time_before(jiffies, dev->trans_start + 20 * HZ)) {
545 /* 20 sec timeout not reached */
546 return NETDEV_TX_BUSY;
547 }
548
549 printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name,
550 (tty_chars_in_buffer(ax->tty) || ax->xleft) ?
551 "bad line quality" : "driver error");
552
553 ax->xleft = 0;
554 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
555 netif_start_queue(dev);
556 }
557
558 /* We were not busy, so we are now... :-) */
559 if (skb != NULL) {
560 netif_stop_queue(dev);
561 ax_encaps(dev, skb->data, skb->len);
562 kfree_skb(skb);
563 }
564
565 return NETDEV_TX_OK;
566}
567
568static int ax_open_dev(struct net_device *dev)
569{
570 struct mkiss *ax = netdev_priv(dev);
571
572 if (ax->tty == NULL)
573 return -ENODEV;
574
575 return 0;
576}
577
578#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
579
580/* Return the frame type ID */
581static int ax_header(struct sk_buff *skb, struct net_device *dev,
582 unsigned short type, const void *daddr,
583 const void *saddr, unsigned len)
584{
585#ifdef CONFIG_INET
586 if (type != ETH_P_AX25)
587 return ax25_hard_header(skb, dev, type, daddr, saddr, len);
588#endif
589 return 0;
590}
591
592
593static int ax_rebuild_header(struct sk_buff *skb)
594{
595#ifdef CONFIG_INET
596 return ax25_rebuild_header(skb);
597#else
598 return 0;
599#endif
600}
601
602#endif /* CONFIG_{AX25,AX25_MODULE} */
603
604/* Open the low-level part of the AX25 channel. Easy! */
605static int ax_open(struct net_device *dev)
606{
607 struct mkiss *ax = netdev_priv(dev);
608 unsigned long len;
609
610 if (ax->tty == NULL)
611 return -ENODEV;
612
613 /*
614 * Allocate the frame buffers:
615 *
616 * rbuff Receive buffer.
617 * xbuff Transmit buffer.
618 */
619 len = dev->mtu * 2;
620
621 /*
622 * allow for arrival of larger UDP packets, even if we say not to
623 * also fixes a bug in which SunOS sends 512-byte packets even with
624 * an MSS of 128
625 */
626 if (len < 576 * 2)
627 len = 576 * 2;
628
629 if ((ax->rbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
630 goto norbuff;
631
632 if ((ax->xbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
633 goto noxbuff;
634
635 ax->mtu = dev->mtu + 73;
636 ax->buffsize = len;
637 ax->rcount = 0;
638 ax->xleft = 0;
639
640 ax->flags &= (1 << AXF_INUSE); /* Clear ESCAPE & ERROR flags */
641
642 spin_lock_init(&ax->buflock);
643
644 return 0;
645
646noxbuff:
647 kfree(ax->rbuff);
648
649norbuff:
650 return -ENOMEM;
651}
652
653
654/* Close the low-level part of the AX25 channel. Easy! */
655static int ax_close(struct net_device *dev)
656{
657 struct mkiss *ax = netdev_priv(dev);
658
659 if (ax->tty)
660 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
661
662 netif_stop_queue(dev);
663
664 return 0;
665}
666
667static const struct header_ops ax_header_ops = {
668 .create = ax_header,
669 .rebuild = ax_rebuild_header,
670};
671
672static const struct net_device_ops ax_netdev_ops = {
673 .ndo_open = ax_open_dev,
674 .ndo_stop = ax_close,
675 .ndo_start_xmit = ax_xmit,
676 .ndo_set_mac_address = ax_set_mac_address,
677};
678
679static void ax_setup(struct net_device *dev)
680{
681 /* Finish setting up the DEVICE info. */
682 dev->mtu = AX_MTU;
683 dev->hard_header_len = 0;
684 dev->addr_len = 0;
685 dev->type = ARPHRD_AX25;
686 dev->tx_queue_len = 10;
687 dev->header_ops = &ax_header_ops;
688 dev->netdev_ops = &ax_netdev_ops;
689
690
691 memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
692 memcpy(dev->dev_addr, &ax25_defaddr, AX25_ADDR_LEN);
693
694 dev->flags = IFF_BROADCAST | IFF_MULTICAST;
695}
696
697/*
698 * We have a potential race on dereferencing tty->disc_data, because the tty
699 * layer provides no locking at all - thus one cpu could be running
700 * sixpack_receive_buf while another calls sixpack_close, which zeroes
701 * tty->disc_data and frees the memory that sixpack_receive_buf is using. The
702 * best way to fix this is to use a rwlock in the tty struct, but for now we
703 * use a single global rwlock for all ttys in ppp line discipline.
704 */
705static DEFINE_RWLOCK(disc_data_lock);
706
707static struct mkiss *mkiss_get(struct tty_struct *tty)
708{
709 struct mkiss *ax;
710
711 read_lock(&disc_data_lock);
712 ax = tty->disc_data;
713 if (ax)
714 atomic_inc(&ax->refcnt);
715 read_unlock(&disc_data_lock);
716
717 return ax;
718}
719
720static void mkiss_put(struct mkiss *ax)
721{
722 if (atomic_dec_and_test(&ax->refcnt))
723 up(&ax->dead_sem);
724}
725
726static int crc_force = 0; /* Can be overridden with insmod */
727
728static int mkiss_open(struct tty_struct *tty)
729{
730 struct net_device *dev;
731 struct mkiss *ax;
732 int err;
733
734 if (!capable(CAP_NET_ADMIN))
735 return -EPERM;
736 if (tty->ops->write == NULL)
737 return -EOPNOTSUPP;
738
739 dev = alloc_netdev(sizeof(struct mkiss), "ax%d", ax_setup);
740 if (!dev) {
741 err = -ENOMEM;
742 goto out;
743 }
744
745 ax = netdev_priv(dev);
746 ax->dev = dev;
747
748 spin_lock_init(&ax->buflock);
749 atomic_set(&ax->refcnt, 1);
750 sema_init(&ax->dead_sem, 0);
751
752 ax->tty = tty;
753 tty->disc_data = ax;
754 tty->receive_room = 65535;
755
756 tty_driver_flush_buffer(tty);
757
758 /* Restore default settings */
759 dev->type = ARPHRD_AX25;
760
761 /* Perform the low-level AX25 initialization. */
762 if ((err = ax_open(ax->dev))) {
763 goto out_free_netdev;
764 }
765
766 if (register_netdev(dev))
767 goto out_free_buffers;
768
769 /* after register_netdev() - because else printk smashes the kernel */
770 switch (crc_force) {
771 case 3:
772 ax->crcmode = CRC_MODE_SMACK;
773 printk(KERN_INFO "mkiss: %s: crc mode smack forced.\n",
774 ax->dev->name);
775 break;
776 case 2:
777 ax->crcmode = CRC_MODE_FLEX;
778 printk(KERN_INFO "mkiss: %s: crc mode flexnet forced.\n",
779 ax->dev->name);
780 break;
781 case 1:
782 ax->crcmode = CRC_MODE_NONE;
783 printk(KERN_INFO "mkiss: %s: crc mode disabled.\n",
784 ax->dev->name);
785 break;
786 case 0:
787 /* fall through */
788 default:
789 crc_force = 0;
790 printk(KERN_INFO "mkiss: %s: crc mode is auto.\n",
791 ax->dev->name);
792 ax->crcmode = CRC_MODE_SMACK_TEST;
793 }
794 ax->crcauto = (crc_force ? 0 : 1);
795
796 netif_start_queue(dev);
797
798 /* Done. We have linked the TTY line to a channel. */
799 return 0;
800
801out_free_buffers:
802 kfree(ax->rbuff);
803 kfree(ax->xbuff);
804
805out_free_netdev:
806 free_netdev(dev);
807
808out:
809 return err;
810}
811
812static void mkiss_close(struct tty_struct *tty)
813{
814 struct mkiss *ax;
815
816 write_lock_bh(&disc_data_lock);
817 ax = tty->disc_data;
818 tty->disc_data = NULL;
819 write_unlock_bh(&disc_data_lock);
820
821 if (!ax)
822 return;
823
824 /*
825 * We have now ensured that nobody can start using ap from now on, but
826 * we have to wait for all existing users to finish.
827 */
828 if (!atomic_dec_and_test(&ax->refcnt))
829 down(&ax->dead_sem);
830
831 unregister_netdev(ax->dev);
832
833 /* Free all AX25 frame buffers. */
834 kfree(ax->rbuff);
835 kfree(ax->xbuff);
836
837 ax->tty = NULL;
838}
839
840/* Perform I/O control on an active ax25 channel. */
841static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
842 unsigned int cmd, unsigned long arg)
843{
844 struct mkiss *ax = mkiss_get(tty);
845 struct net_device *dev;
846 unsigned int tmp, err;
847
848 /* First make sure we're connected. */
849 if (ax == NULL)
850 return -ENXIO;
851 dev = ax->dev;
852
853 switch (cmd) {
854 case SIOCGIFNAME:
855 err = copy_to_user((void __user *) arg, ax->dev->name,
856 strlen(ax->dev->name) + 1) ? -EFAULT : 0;
857 break;
858
859 case SIOCGIFENCAP:
860 err = put_user(4, (int __user *) arg);
861 break;
862
863 case SIOCSIFENCAP:
864 if (get_user(tmp, (int __user *) arg)) {
865 err = -EFAULT;
866 break;
867 }
868
869 ax->mode = tmp;
870 dev->addr_len = AX25_ADDR_LEN;
871 dev->hard_header_len = AX25_KISS_HEADER_LEN +
872 AX25_MAX_HEADER_LEN + 3;
873 dev->type = ARPHRD_AX25;
874
875 err = 0;
876 break;
877
878 case SIOCSIFHWADDR: {
879 char addr[AX25_ADDR_LEN];
880
881 if (copy_from_user(&addr,
882 (void __user *) arg, AX25_ADDR_LEN)) {
883 err = -EFAULT;
884 break;
885 }
886
887 netif_tx_lock_bh(dev);
888 memcpy(dev->dev_addr, addr, AX25_ADDR_LEN);
889 netif_tx_unlock_bh(dev);
890
891 err = 0;
892 break;
893 }
894 default:
895 err = -ENOIOCTLCMD;
896 }
897
898 mkiss_put(ax);
899
900 return err;
901}
902
903#ifdef CONFIG_COMPAT
904static long mkiss_compat_ioctl(struct tty_struct *tty, struct file *file,
905 unsigned int cmd, unsigned long arg)
906{
907 switch (cmd) {
908 case SIOCGIFNAME:
909 case SIOCGIFENCAP:
910 case SIOCSIFENCAP:
911 case SIOCSIFHWADDR:
912 return mkiss_ioctl(tty, file, cmd,
913 (unsigned long)compat_ptr(arg));
914 }
915
916 return -ENOIOCTLCMD;
917}
918#endif
919
920/*
921 * Handle the 'receiver data ready' interrupt.
922 * This function is called by the 'tty_io' module in the kernel when
923 * a block of data has been received, which can now be decapsulated
924 * and sent on to the AX.25 layer for further processing.
925 */
926static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
927 char *fp, int count)
928{
929 struct mkiss *ax = mkiss_get(tty);
930
931 if (!ax)
932 return;
933
934 /*
935 * Argh! mtu change time! - costs us the packet part received
936 * at the change
937 */
938 if (ax->mtu != ax->dev->mtu + 73)
939 ax_changedmtu(ax);
940
941 /* Read the characters out of the buffer */
942 while (count--) {
943 if (fp != NULL && *fp++) {
944 if (!test_and_set_bit(AXF_ERROR, &ax->flags))
945 ax->dev->stats.rx_errors++;
946 cp++;
947 continue;
948 }
949
950 kiss_unesc(ax, *cp++);
951 }
952
953 mkiss_put(ax);
954 tty_unthrottle(tty);
955}
956
957/*
958 * Called by the driver when there's room for more data. If we have
959 * more packets to send, we send them here.
960 */
961static void mkiss_write_wakeup(struct tty_struct *tty)
962{
963 struct mkiss *ax = mkiss_get(tty);
964 int actual;
965
966 if (!ax)
967 return;
968
969 if (ax->xleft <= 0) {
970 /* Now serial buffer is almost free & we can start
971 * transmission of another packet
972 */
973 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
974
975 netif_wake_queue(ax->dev);
976 goto out;
977 }
978
979 actual = tty->ops->write(tty, ax->xhead, ax->xleft);
980 ax->xleft -= actual;
981 ax->xhead += actual;
982
983out:
984 mkiss_put(ax);
985}
986
987static struct tty_ldisc_ops ax_ldisc = {
988 .owner = THIS_MODULE,
989 .magic = TTY_LDISC_MAGIC,
990 .name = "mkiss",
991 .open = mkiss_open,
992 .close = mkiss_close,
993 .ioctl = mkiss_ioctl,
994#ifdef CONFIG_COMPAT
995 .compat_ioctl = mkiss_compat_ioctl,
996#endif
997 .receive_buf = mkiss_receive_buf,
998 .write_wakeup = mkiss_write_wakeup
999};
1000
1001static const char banner[] __initdata = KERN_INFO \
1002 "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
1003static const char msg_regfail[] __initdata = KERN_ERR \
1004 "mkiss: can't register line discipline (err = %d)\n";
1005
1006static int __init mkiss_init_driver(void)
1007{
1008 int status;
1009
1010 printk(banner);
1011
1012 status = tty_register_ldisc(N_AX25, &ax_ldisc);
1013 if (status != 0)
1014 printk(msg_regfail, status);
1015
1016 return status;
1017}
1018
1019static const char msg_unregfail[] __exitdata = KERN_ERR \
1020 "mkiss: can't unregister line discipline (err = %d)\n";
1021
1022static void __exit mkiss_exit_driver(void)
1023{
1024 int ret;
1025
1026 if ((ret = tty_unregister_ldisc(N_AX25)))
1027 printk(msg_unregfail, ret);
1028}
1029
1030MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>");
1031MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs");
1032module_param(crc_force, int, 0);
1033MODULE_PARM_DESC(crc_force, "crc [0 = auto | 1 = none | 2 = flexnet | 3 = smack]");
1034MODULE_LICENSE("GPL");
1035MODULE_ALIAS_LDISC(N_AX25);
1036
1037module_init(mkiss_init_driver);
1038module_exit(mkiss_exit_driver);