Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 *
4 * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl>
5 * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org>
6 * Copyright (C) 2004, 05 Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de>
7 */
8#include <linux/module.h>
9#include <linux/bitops.h>
10#include <linux/uaccess.h>
11#include <linux/crc16.h>
12#include <linux/string.h>
13#include <linux/mm.h>
14#include <linux/interrupt.h>
15#include <linux/in.h>
16#include <linux/inet.h>
17#include <linux/slab.h>
18#include <linux/tty.h>
19#include <linux/errno.h>
20#include <linux/netdevice.h>
21#include <linux/major.h>
22#include <linux/init.h>
23#include <linux/rtnetlink.h>
24#include <linux/etherdevice.h>
25#include <linux/skbuff.h>
26#include <linux/if_arp.h>
27#include <linux/jiffies.h>
28#include <linux/refcount.h>
29
30#include <net/ax25.h>
31
32#define AX_MTU 236
33
34/* SLIP/KISS protocol characters. */
35#define END 0300 /* indicates end of frame */
36#define ESC 0333 /* indicates byte stuffing */
37#define ESC_END 0334 /* ESC ESC_END means END 'data' */
38#define ESC_ESC 0335 /* ESC ESC_ESC means ESC 'data' */
39
40struct mkiss {
41 struct tty_struct *tty; /* ptr to TTY structure */
42 struct net_device *dev; /* easy for intr handling */
43
44 /* These are pointers to the malloc()ed frame buffers. */
45 spinlock_t buflock;/* lock for rbuf and xbuf */
46 unsigned char *rbuff; /* receiver buffer */
47 int rcount; /* received chars counter */
48 unsigned char *xbuff; /* transmitter buffer */
49 unsigned char *xhead; /* pointer to next byte to XMIT */
50 int xleft; /* bytes left in XMIT queue */
51
52 /* Detailed SLIP statistics. */
53 int mtu; /* Our mtu (to spot changes!) */
54 int buffsize; /* Max buffers sizes */
55
56 unsigned long flags; /* Flag values/ mode etc */
57 /* long req'd: used by set_bit --RR */
58#define AXF_INUSE 0 /* Channel in use */
59#define AXF_ESCAPE 1 /* ESC received */
60#define AXF_ERROR 2 /* Parity, etc. error */
61#define AXF_KEEPTEST 3 /* Keepalive test flag */
62#define AXF_OUTWAIT 4 /* is outpacket was flag */
63
64 int mode;
65 int crcmode; /* MW: for FlexNet, SMACK etc. */
66 int crcauto; /* CRC auto mode */
67
68#define CRC_MODE_NONE 0
69#define CRC_MODE_FLEX 1
70#define CRC_MODE_SMACK 2
71#define CRC_MODE_FLEX_TEST 3
72#define CRC_MODE_SMACK_TEST 4
73
74 refcount_t refcnt;
75 struct completion dead;
76};
77
78/*---------------------------------------------------------------------------*/
79
80static const unsigned short crc_flex_table[] = {
81 0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
82 0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
83 0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
84 0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
85 0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
86 0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
87 0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
88 0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
89 0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
90 0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
91 0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
92 0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
93 0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
94 0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
95 0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
96 0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
97 0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
98 0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
99 0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
100 0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
101 0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
102 0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
103 0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
104 0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
105 0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
106 0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
107 0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
108 0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
109 0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
110 0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
111 0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
112 0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
113};
114
115static unsigned short calc_crc_flex(unsigned char *cp, int size)
116{
117 unsigned short crc = 0xffff;
118
119 while (size--)
120 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
121
122 return crc;
123}
124
125static int check_crc_flex(unsigned char *cp, int size)
126{
127 unsigned short crc = 0xffff;
128
129 if (size < 3)
130 return -1;
131
132 while (size--)
133 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
134
135 if ((crc & 0xffff) != 0x7070)
136 return -1;
137
138 return 0;
139}
140
141static int check_crc_16(unsigned char *cp, int size)
142{
143 unsigned short crc = 0x0000;
144
145 if (size < 3)
146 return -1;
147
148 crc = crc16(0, cp, size);
149
150 if (crc != 0x0000)
151 return -1;
152
153 return 0;
154}
155
156/*
157 * Standard encapsulation
158 */
159
160static int kiss_esc(unsigned char *s, unsigned char *d, int len)
161{
162 unsigned char *ptr = d;
163 unsigned char c;
164
165 /*
166 * Send an initial END character to flush out any data that may have
167 * accumulated in the receiver due to line noise.
168 */
169
170 *ptr++ = END;
171
172 while (len-- > 0) {
173 switch (c = *s++) {
174 case END:
175 *ptr++ = ESC;
176 *ptr++ = ESC_END;
177 break;
178 case ESC:
179 *ptr++ = ESC;
180 *ptr++ = ESC_ESC;
181 break;
182 default:
183 *ptr++ = c;
184 break;
185 }
186 }
187
188 *ptr++ = END;
189
190 return ptr - d;
191}
192
193/*
194 * MW:
195 * OK its ugly, but tell me a better solution without copying the
196 * packet to a temporary buffer :-)
197 */
198static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
199 int len)
200{
201 unsigned char *ptr = d;
202 unsigned char c=0;
203
204 *ptr++ = END;
205 while (len > 0) {
206 if (len > 2)
207 c = *s++;
208 else if (len > 1)
209 c = crc >> 8;
210 else
211 c = crc & 0xff;
212
213 len--;
214
215 switch (c) {
216 case END:
217 *ptr++ = ESC;
218 *ptr++ = ESC_END;
219 break;
220 case ESC:
221 *ptr++ = ESC;
222 *ptr++ = ESC_ESC;
223 break;
224 default:
225 *ptr++ = c;
226 break;
227 }
228 }
229 *ptr++ = END;
230
231 return ptr - d;
232}
233
234/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
235static void ax_bump(struct mkiss *ax)
236{
237 struct sk_buff *skb;
238 int count;
239
240 spin_lock_bh(&ax->buflock);
241 if (ax->rbuff[0] > 0x0f) {
242 if (ax->rbuff[0] & 0x80) {
243 if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
244 ax->dev->stats.rx_errors++;
245 spin_unlock_bh(&ax->buflock);
246
247 return;
248 }
249 if (ax->crcmode != CRC_MODE_SMACK && ax->crcauto) {
250 printk(KERN_INFO
251 "mkiss: %s: Switching to crc-smack\n",
252 ax->dev->name);
253 ax->crcmode = CRC_MODE_SMACK;
254 }
255 ax->rcount -= 2;
256 *ax->rbuff &= ~0x80;
257 } else if (ax->rbuff[0] & 0x20) {
258 if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
259 ax->dev->stats.rx_errors++;
260 spin_unlock_bh(&ax->buflock);
261 return;
262 }
263 if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
264 printk(KERN_INFO
265 "mkiss: %s: Switching to crc-flexnet\n",
266 ax->dev->name);
267 ax->crcmode = CRC_MODE_FLEX;
268 }
269 ax->rcount -= 2;
270
271 /*
272 * dl9sau bugfix: the trailling two bytes flexnet crc
273 * will not be passed to the kernel. thus we have to
274 * correct the kissparm signature, because it indicates
275 * a crc but there's none
276 */
277 *ax->rbuff &= ~0x20;
278 }
279 }
280
281 count = ax->rcount;
282
283 if ((skb = dev_alloc_skb(count)) == NULL) {
284 printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
285 ax->dev->name);
286 ax->dev->stats.rx_dropped++;
287 spin_unlock_bh(&ax->buflock);
288 return;
289 }
290
291 skb_put_data(skb, ax->rbuff, count);
292 skb->protocol = ax25_type_trans(skb, ax->dev);
293 netif_rx(skb);
294 ax->dev->stats.rx_packets++;
295 ax->dev->stats.rx_bytes += count;
296 spin_unlock_bh(&ax->buflock);
297}
298
299static void kiss_unesc(struct mkiss *ax, unsigned char s)
300{
301 switch (s) {
302 case END:
303 /* drop keeptest bit = VSV */
304 if (test_bit(AXF_KEEPTEST, &ax->flags))
305 clear_bit(AXF_KEEPTEST, &ax->flags);
306
307 if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
308 ax_bump(ax);
309
310 clear_bit(AXF_ESCAPE, &ax->flags);
311 ax->rcount = 0;
312 return;
313
314 case ESC:
315 set_bit(AXF_ESCAPE, &ax->flags);
316 return;
317 case ESC_ESC:
318 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
319 s = ESC;
320 break;
321 case ESC_END:
322 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
323 s = END;
324 break;
325 }
326
327 spin_lock_bh(&ax->buflock);
328 if (!test_bit(AXF_ERROR, &ax->flags)) {
329 if (ax->rcount < ax->buffsize) {
330 ax->rbuff[ax->rcount++] = s;
331 spin_unlock_bh(&ax->buflock);
332 return;
333 }
334
335 ax->dev->stats.rx_over_errors++;
336 set_bit(AXF_ERROR, &ax->flags);
337 }
338 spin_unlock_bh(&ax->buflock);
339}
340
341static int ax_set_mac_address(struct net_device *dev, void *addr)
342{
343 struct sockaddr_ax25 *sa = addr;
344
345 netif_tx_lock_bh(dev);
346 netif_addr_lock(dev);
347 memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
348 netif_addr_unlock(dev);
349 netif_tx_unlock_bh(dev);
350
351 return 0;
352}
353
354/*---------------------------------------------------------------------------*/
355
356static void ax_changedmtu(struct mkiss *ax)
357{
358 struct net_device *dev = ax->dev;
359 unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
360 int len;
361
362 len = dev->mtu * 2;
363
364 /*
365 * allow for arrival of larger UDP packets, even if we say not to
366 * also fixes a bug in which SunOS sends 512-byte packets even with
367 * an MSS of 128
368 */
369 if (len < 576 * 2)
370 len = 576 * 2;
371
372 xbuff = kmalloc(len + 4, GFP_ATOMIC);
373 rbuff = kmalloc(len + 4, GFP_ATOMIC);
374
375 if (xbuff == NULL || rbuff == NULL) {
376 printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, "
377 "MTU change cancelled.\n",
378 ax->dev->name);
379 dev->mtu = ax->mtu;
380 kfree(xbuff);
381 kfree(rbuff);
382 return;
383 }
384
385 spin_lock_bh(&ax->buflock);
386
387 oxbuff = ax->xbuff;
388 ax->xbuff = xbuff;
389 orbuff = ax->rbuff;
390 ax->rbuff = rbuff;
391
392 if (ax->xleft) {
393 if (ax->xleft <= len) {
394 memcpy(ax->xbuff, ax->xhead, ax->xleft);
395 } else {
396 ax->xleft = 0;
397 dev->stats.tx_dropped++;
398 }
399 }
400
401 ax->xhead = ax->xbuff;
402
403 if (ax->rcount) {
404 if (ax->rcount <= len) {
405 memcpy(ax->rbuff, orbuff, ax->rcount);
406 } else {
407 ax->rcount = 0;
408 dev->stats.rx_over_errors++;
409 set_bit(AXF_ERROR, &ax->flags);
410 }
411 }
412
413 ax->mtu = dev->mtu + 73;
414 ax->buffsize = len;
415
416 spin_unlock_bh(&ax->buflock);
417
418 kfree(oxbuff);
419 kfree(orbuff);
420}
421
422/* Encapsulate one AX.25 packet and stuff into a TTY queue. */
423static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
424{
425 struct mkiss *ax = netdev_priv(dev);
426 unsigned char *p;
427 int actual, count;
428
429 if (ax->mtu != ax->dev->mtu + 73) /* Someone has been ifconfigging */
430 ax_changedmtu(ax);
431
432 if (len > ax->mtu) { /* Sigh, shouldn't occur BUT ... */
433 printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name);
434 dev->stats.tx_dropped++;
435 netif_start_queue(dev);
436 return;
437 }
438
439 p = icp;
440
441 spin_lock_bh(&ax->buflock);
442 if ((*p & 0x0f) != 0) {
443 /* Configuration Command (kissparms(1).
444 * Protocol spec says: never append CRC.
445 * This fixes a very old bug in the linux
446 * kiss driver. -- dl9sau */
447 switch (*p & 0xff) {
448 case 0x85:
449 /* command from userspace especially for us,
450 * not for delivery to the tnc */
451 if (len > 1) {
452 int cmd = (p[1] & 0xff);
453 switch(cmd) {
454 case 3:
455 ax->crcmode = CRC_MODE_SMACK;
456 break;
457 case 2:
458 ax->crcmode = CRC_MODE_FLEX;
459 break;
460 case 1:
461 ax->crcmode = CRC_MODE_NONE;
462 break;
463 case 0:
464 default:
465 ax->crcmode = CRC_MODE_SMACK_TEST;
466 cmd = 0;
467 }
468 ax->crcauto = (cmd ? 0 : 1);
469 printk(KERN_INFO "mkiss: %s: crc mode set to %d\n",
470 ax->dev->name, cmd);
471 }
472 spin_unlock_bh(&ax->buflock);
473 netif_start_queue(dev);
474
475 return;
476 default:
477 count = kiss_esc(p, ax->xbuff, len);
478 }
479 } else {
480 unsigned short crc;
481 switch (ax->crcmode) {
482 case CRC_MODE_SMACK_TEST:
483 ax->crcmode = CRC_MODE_FLEX_TEST;
484 printk(KERN_INFO "mkiss: %s: Trying crc-smack\n", ax->dev->name);
485 fallthrough;
486 case CRC_MODE_SMACK:
487 *p |= 0x80;
488 crc = swab16(crc16(0, p, len));
489 count = kiss_esc_crc(p, ax->xbuff, crc, len+2);
490 break;
491 case CRC_MODE_FLEX_TEST:
492 ax->crcmode = CRC_MODE_NONE;
493 printk(KERN_INFO "mkiss: %s: Trying crc-flexnet\n", ax->dev->name);
494 fallthrough;
495 case CRC_MODE_FLEX:
496 *p |= 0x20;
497 crc = calc_crc_flex(p, len);
498 count = kiss_esc_crc(p, ax->xbuff, crc, len+2);
499 break;
500
501 default:
502 count = kiss_esc(p, ax->xbuff, len);
503 }
504 }
505 spin_unlock_bh(&ax->buflock);
506
507 set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
508 actual = ax->tty->ops->write(ax->tty, ax->xbuff, count);
509 dev->stats.tx_packets++;
510 dev->stats.tx_bytes += actual;
511
512 netif_trans_update(ax->dev);
513 ax->xleft = count - actual;
514 ax->xhead = ax->xbuff + actual;
515}
516
517/* Encapsulate an AX.25 packet and kick it into a TTY queue. */
518static netdev_tx_t ax_xmit(struct sk_buff *skb, struct net_device *dev)
519{
520 struct mkiss *ax = netdev_priv(dev);
521
522 if (skb->protocol == htons(ETH_P_IP))
523 return ax25_ip_xmit(skb);
524
525 if (!netif_running(dev)) {
526 printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
527 return NETDEV_TX_BUSY;
528 }
529
530 if (netif_queue_stopped(dev)) {
531 /*
532 * May be we must check transmitter timeout here ?
533 * 14 Oct 1994 Dmitry Gorodchanin.
534 */
535 if (time_before(jiffies, dev_trans_start(dev) + 20 * HZ)) {
536 /* 20 sec timeout not reached */
537 return NETDEV_TX_BUSY;
538 }
539
540 printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name,
541 (tty_chars_in_buffer(ax->tty) || ax->xleft) ?
542 "bad line quality" : "driver error");
543
544 ax->xleft = 0;
545 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
546 netif_start_queue(dev);
547 }
548
549 /* We were not busy, so we are now... :-) */
550 netif_stop_queue(dev);
551 ax_encaps(dev, skb->data, skb->len);
552 kfree_skb(skb);
553
554 return NETDEV_TX_OK;
555}
556
557static int ax_open_dev(struct net_device *dev)
558{
559 struct mkiss *ax = netdev_priv(dev);
560
561 if (ax->tty == NULL)
562 return -ENODEV;
563
564 return 0;
565}
566
567/* Open the low-level part of the AX25 channel. Easy! */
568static int ax_open(struct net_device *dev)
569{
570 struct mkiss *ax = netdev_priv(dev);
571 unsigned long len;
572
573 if (ax->tty == NULL)
574 return -ENODEV;
575
576 /*
577 * Allocate the frame buffers:
578 *
579 * rbuff Receive buffer.
580 * xbuff Transmit buffer.
581 */
582 len = dev->mtu * 2;
583
584 /*
585 * allow for arrival of larger UDP packets, even if we say not to
586 * also fixes a bug in which SunOS sends 512-byte packets even with
587 * an MSS of 128
588 */
589 if (len < 576 * 2)
590 len = 576 * 2;
591
592 if ((ax->rbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
593 goto norbuff;
594
595 if ((ax->xbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
596 goto noxbuff;
597
598 ax->mtu = dev->mtu + 73;
599 ax->buffsize = len;
600 ax->rcount = 0;
601 ax->xleft = 0;
602
603 ax->flags &= (1 << AXF_INUSE); /* Clear ESCAPE & ERROR flags */
604
605 spin_lock_init(&ax->buflock);
606
607 return 0;
608
609noxbuff:
610 kfree(ax->rbuff);
611
612norbuff:
613 return -ENOMEM;
614}
615
616
617/* Close the low-level part of the AX25 channel. Easy! */
618static int ax_close(struct net_device *dev)
619{
620 struct mkiss *ax = netdev_priv(dev);
621
622 if (ax->tty)
623 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
624
625 netif_stop_queue(dev);
626
627 return 0;
628}
629
630static const struct net_device_ops ax_netdev_ops = {
631 .ndo_open = ax_open_dev,
632 .ndo_stop = ax_close,
633 .ndo_start_xmit = ax_xmit,
634 .ndo_set_mac_address = ax_set_mac_address,
635};
636
637static void ax_setup(struct net_device *dev)
638{
639 /* Finish setting up the DEVICE info. */
640 dev->mtu = AX_MTU;
641 dev->hard_header_len = AX25_MAX_HEADER_LEN;
642 dev->addr_len = AX25_ADDR_LEN;
643 dev->type = ARPHRD_AX25;
644 dev->tx_queue_len = 10;
645 dev->header_ops = &ax25_header_ops;
646 dev->netdev_ops = &ax_netdev_ops;
647
648
649 memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
650 memcpy(dev->dev_addr, &ax25_defaddr, AX25_ADDR_LEN);
651
652 dev->flags = IFF_BROADCAST | IFF_MULTICAST;
653}
654
655/*
656 * We have a potential race on dereferencing tty->disc_data, because the tty
657 * layer provides no locking at all - thus one cpu could be running
658 * sixpack_receive_buf while another calls sixpack_close, which zeroes
659 * tty->disc_data and frees the memory that sixpack_receive_buf is using. The
660 * best way to fix this is to use a rwlock in the tty struct, but for now we
661 * use a single global rwlock for all ttys in ppp line discipline.
662 */
663static DEFINE_RWLOCK(disc_data_lock);
664
665static struct mkiss *mkiss_get(struct tty_struct *tty)
666{
667 struct mkiss *ax;
668
669 read_lock(&disc_data_lock);
670 ax = tty->disc_data;
671 if (ax)
672 refcount_inc(&ax->refcnt);
673 read_unlock(&disc_data_lock);
674
675 return ax;
676}
677
678static void mkiss_put(struct mkiss *ax)
679{
680 if (refcount_dec_and_test(&ax->refcnt))
681 complete(&ax->dead);
682}
683
684static int crc_force = 0; /* Can be overridden with insmod */
685
686static int mkiss_open(struct tty_struct *tty)
687{
688 struct net_device *dev;
689 struct mkiss *ax;
690 int err;
691
692 if (!capable(CAP_NET_ADMIN))
693 return -EPERM;
694 if (tty->ops->write == NULL)
695 return -EOPNOTSUPP;
696
697 dev = alloc_netdev(sizeof(struct mkiss), "ax%d", NET_NAME_UNKNOWN,
698 ax_setup);
699 if (!dev) {
700 err = -ENOMEM;
701 goto out;
702 }
703
704 ax = netdev_priv(dev);
705 ax->dev = dev;
706
707 spin_lock_init(&ax->buflock);
708 refcount_set(&ax->refcnt, 1);
709 init_completion(&ax->dead);
710
711 ax->tty = tty;
712 tty->disc_data = ax;
713 tty->receive_room = 65535;
714
715 tty_driver_flush_buffer(tty);
716
717 /* Restore default settings */
718 dev->type = ARPHRD_AX25;
719
720 /* Perform the low-level AX25 initialization. */
721 err = ax_open(ax->dev);
722 if (err)
723 goto out_free_netdev;
724
725 err = register_netdev(dev);
726 if (err)
727 goto out_free_buffers;
728
729 /* after register_netdev() - because else printk smashes the kernel */
730 switch (crc_force) {
731 case 3:
732 ax->crcmode = CRC_MODE_SMACK;
733 printk(KERN_INFO "mkiss: %s: crc mode smack forced.\n",
734 ax->dev->name);
735 break;
736 case 2:
737 ax->crcmode = CRC_MODE_FLEX;
738 printk(KERN_INFO "mkiss: %s: crc mode flexnet forced.\n",
739 ax->dev->name);
740 break;
741 case 1:
742 ax->crcmode = CRC_MODE_NONE;
743 printk(KERN_INFO "mkiss: %s: crc mode disabled.\n",
744 ax->dev->name);
745 break;
746 case 0:
747 default:
748 crc_force = 0;
749 printk(KERN_INFO "mkiss: %s: crc mode is auto.\n",
750 ax->dev->name);
751 ax->crcmode = CRC_MODE_SMACK_TEST;
752 }
753 ax->crcauto = (crc_force ? 0 : 1);
754
755 netif_start_queue(dev);
756
757 /* Done. We have linked the TTY line to a channel. */
758 return 0;
759
760out_free_buffers:
761 kfree(ax->rbuff);
762 kfree(ax->xbuff);
763
764out_free_netdev:
765 free_netdev(dev);
766
767out:
768 return err;
769}
770
771static void mkiss_close(struct tty_struct *tty)
772{
773 struct mkiss *ax;
774
775 write_lock_irq(&disc_data_lock);
776 ax = tty->disc_data;
777 tty->disc_data = NULL;
778 write_unlock_irq(&disc_data_lock);
779
780 if (!ax)
781 return;
782
783 /*
784 * We have now ensured that nobody can start using ap from now on, but
785 * we have to wait for all existing users to finish.
786 */
787 if (!refcount_dec_and_test(&ax->refcnt))
788 wait_for_completion(&ax->dead);
789 /*
790 * Halt the transmit queue so that a new transmit cannot scribble
791 * on our buffers
792 */
793 netif_stop_queue(ax->dev);
794
795 /* Free all AX25 frame buffers. */
796 kfree(ax->rbuff);
797 kfree(ax->xbuff);
798
799 ax->tty = NULL;
800
801 unregister_netdev(ax->dev);
802 free_netdev(ax->dev);
803}
804
805/* Perform I/O control on an active ax25 channel. */
806static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
807 unsigned int cmd, unsigned long arg)
808{
809 struct mkiss *ax = mkiss_get(tty);
810 struct net_device *dev;
811 unsigned int tmp, err;
812
813 /* First make sure we're connected. */
814 if (ax == NULL)
815 return -ENXIO;
816 dev = ax->dev;
817
818 switch (cmd) {
819 case SIOCGIFNAME:
820 err = copy_to_user((void __user *) arg, ax->dev->name,
821 strlen(ax->dev->name) + 1) ? -EFAULT : 0;
822 break;
823
824 case SIOCGIFENCAP:
825 err = put_user(4, (int __user *) arg);
826 break;
827
828 case SIOCSIFENCAP:
829 if (get_user(tmp, (int __user *) arg)) {
830 err = -EFAULT;
831 break;
832 }
833
834 ax->mode = tmp;
835 dev->addr_len = AX25_ADDR_LEN;
836 dev->hard_header_len = AX25_KISS_HEADER_LEN +
837 AX25_MAX_HEADER_LEN + 3;
838 dev->type = ARPHRD_AX25;
839
840 err = 0;
841 break;
842
843 case SIOCSIFHWADDR: {
844 char addr[AX25_ADDR_LEN];
845
846 if (copy_from_user(&addr,
847 (void __user *) arg, AX25_ADDR_LEN)) {
848 err = -EFAULT;
849 break;
850 }
851
852 netif_tx_lock_bh(dev);
853 memcpy(dev->dev_addr, addr, AX25_ADDR_LEN);
854 netif_tx_unlock_bh(dev);
855
856 err = 0;
857 break;
858 }
859 default:
860 err = -ENOIOCTLCMD;
861 }
862
863 mkiss_put(ax);
864
865 return err;
866}
867
868/*
869 * Handle the 'receiver data ready' interrupt.
870 * This function is called by the 'tty_io' module in the kernel when
871 * a block of data has been received, which can now be decapsulated
872 * and sent on to the AX.25 layer for further processing.
873 */
874static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
875 const char *fp, int count)
876{
877 struct mkiss *ax = mkiss_get(tty);
878
879 if (!ax)
880 return;
881
882 /*
883 * Argh! mtu change time! - costs us the packet part received
884 * at the change
885 */
886 if (ax->mtu != ax->dev->mtu + 73)
887 ax_changedmtu(ax);
888
889 /* Read the characters out of the buffer */
890 while (count--) {
891 if (fp != NULL && *fp++) {
892 if (!test_and_set_bit(AXF_ERROR, &ax->flags))
893 ax->dev->stats.rx_errors++;
894 cp++;
895 continue;
896 }
897
898 kiss_unesc(ax, *cp++);
899 }
900
901 mkiss_put(ax);
902 tty_unthrottle(tty);
903}
904
905/*
906 * Called by the driver when there's room for more data. If we have
907 * more packets to send, we send them here.
908 */
909static void mkiss_write_wakeup(struct tty_struct *tty)
910{
911 struct mkiss *ax = mkiss_get(tty);
912 int actual;
913
914 if (!ax)
915 return;
916
917 if (ax->xleft <= 0) {
918 /* Now serial buffer is almost free & we can start
919 * transmission of another packet
920 */
921 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
922
923 netif_wake_queue(ax->dev);
924 goto out;
925 }
926
927 actual = tty->ops->write(tty, ax->xhead, ax->xleft);
928 ax->xleft -= actual;
929 ax->xhead += actual;
930
931out:
932 mkiss_put(ax);
933}
934
935static struct tty_ldisc_ops ax_ldisc = {
936 .owner = THIS_MODULE,
937 .num = N_AX25,
938 .name = "mkiss",
939 .open = mkiss_open,
940 .close = mkiss_close,
941 .ioctl = mkiss_ioctl,
942 .receive_buf = mkiss_receive_buf,
943 .write_wakeup = mkiss_write_wakeup
944};
945
946static const char banner[] __initconst = KERN_INFO \
947 "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
948static const char msg_regfail[] __initconst = KERN_ERR \
949 "mkiss: can't register line discipline (err = %d)\n";
950
951static int __init mkiss_init_driver(void)
952{
953 int status;
954
955 printk(banner);
956
957 status = tty_register_ldisc(&ax_ldisc);
958 if (status != 0)
959 printk(msg_regfail, status);
960
961 return status;
962}
963
964static void __exit mkiss_exit_driver(void)
965{
966 tty_unregister_ldisc(&ax_ldisc);
967}
968
969MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>");
970MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs");
971module_param(crc_force, int, 0);
972MODULE_PARM_DESC(crc_force, "crc [0 = auto | 1 = none | 2 = flexnet | 3 = smack]");
973MODULE_LICENSE("GPL");
974MODULE_ALIAS_LDISC(N_AX25);
975
976module_init(mkiss_init_driver);
977module_exit(mkiss_exit_driver);
1/*
2 * This program is free software; you can distribute it and/or modify it
3 * under the terms of the GNU General Public License (Version 2) as
4 * published by the Free Software Foundation.
5 *
6 * This program is distributed in the hope it will be useful, but WITHOUT
7 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
8 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
9 * for more details.
10 *
11 * You should have received a copy of the GNU General Public License along
12 * with this program; if not, write to the Free Software Foundation, Inc.,
13 * 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
14 *
15 * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl>
16 * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org>
17 * Copyright (C) 2004, 05 Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de>
18 */
19#include <linux/module.h>
20#include <linux/bitops.h>
21#include <asm/uaccess.h>
22#include <linux/crc16.h>
23#include <linux/string.h>
24#include <linux/mm.h>
25#include <linux/interrupt.h>
26#include <linux/in.h>
27#include <linux/inet.h>
28#include <linux/slab.h>
29#include <linux/tty.h>
30#include <linux/errno.h>
31#include <linux/netdevice.h>
32#include <linux/major.h>
33#include <linux/init.h>
34#include <linux/rtnetlink.h>
35#include <linux/etherdevice.h>
36#include <linux/skbuff.h>
37#include <linux/if_arp.h>
38#include <linux/jiffies.h>
39#include <linux/compat.h>
40
41#include <net/ax25.h>
42
43#define AX_MTU 236
44
45/* SLIP/KISS protocol characters. */
46#define END 0300 /* indicates end of frame */
47#define ESC 0333 /* indicates byte stuffing */
48#define ESC_END 0334 /* ESC ESC_END means END 'data' */
49#define ESC_ESC 0335 /* ESC ESC_ESC means ESC 'data' */
50
51struct mkiss {
52 struct tty_struct *tty; /* ptr to TTY structure */
53 struct net_device *dev; /* easy for intr handling */
54
55 /* These are pointers to the malloc()ed frame buffers. */
56 spinlock_t buflock;/* lock for rbuf and xbuf */
57 unsigned char *rbuff; /* receiver buffer */
58 int rcount; /* received chars counter */
59 unsigned char *xbuff; /* transmitter buffer */
60 unsigned char *xhead; /* pointer to next byte to XMIT */
61 int xleft; /* bytes left in XMIT queue */
62
63 /* Detailed SLIP statistics. */
64 int mtu; /* Our mtu (to spot changes!) */
65 int buffsize; /* Max buffers sizes */
66
67 unsigned long flags; /* Flag values/ mode etc */
68 /* long req'd: used by set_bit --RR */
69#define AXF_INUSE 0 /* Channel in use */
70#define AXF_ESCAPE 1 /* ESC received */
71#define AXF_ERROR 2 /* Parity, etc. error */
72#define AXF_KEEPTEST 3 /* Keepalive test flag */
73#define AXF_OUTWAIT 4 /* is outpacket was flag */
74
75 int mode;
76 int crcmode; /* MW: for FlexNet, SMACK etc. */
77 int crcauto; /* CRC auto mode */
78
79#define CRC_MODE_NONE 0
80#define CRC_MODE_FLEX 1
81#define CRC_MODE_SMACK 2
82#define CRC_MODE_FLEX_TEST 3
83#define CRC_MODE_SMACK_TEST 4
84
85 atomic_t refcnt;
86 struct semaphore dead_sem;
87};
88
89/*---------------------------------------------------------------------------*/
90
91static const unsigned short crc_flex_table[] = {
92 0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
93 0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
94 0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
95 0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
96 0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
97 0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
98 0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
99 0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
100 0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
101 0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
102 0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
103 0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
104 0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
105 0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
106 0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
107 0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
108 0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
109 0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
110 0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
111 0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
112 0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
113 0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
114 0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
115 0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
116 0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
117 0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
118 0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
119 0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
120 0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
121 0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
122 0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
123 0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
124};
125
126static unsigned short calc_crc_flex(unsigned char *cp, int size)
127{
128 unsigned short crc = 0xffff;
129
130 while (size--)
131 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
132
133 return crc;
134}
135
136static int check_crc_flex(unsigned char *cp, int size)
137{
138 unsigned short crc = 0xffff;
139
140 if (size < 3)
141 return -1;
142
143 while (size--)
144 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
145
146 if ((crc & 0xffff) != 0x7070)
147 return -1;
148
149 return 0;
150}
151
152static int check_crc_16(unsigned char *cp, int size)
153{
154 unsigned short crc = 0x0000;
155
156 if (size < 3)
157 return -1;
158
159 crc = crc16(0, cp, size);
160
161 if (crc != 0x0000)
162 return -1;
163
164 return 0;
165}
166
167/*
168 * Standard encapsulation
169 */
170
171static int kiss_esc(unsigned char *s, unsigned char *d, int len)
172{
173 unsigned char *ptr = d;
174 unsigned char c;
175
176 /*
177 * Send an initial END character to flush out any data that may have
178 * accumulated in the receiver due to line noise.
179 */
180
181 *ptr++ = END;
182
183 while (len-- > 0) {
184 switch (c = *s++) {
185 case END:
186 *ptr++ = ESC;
187 *ptr++ = ESC_END;
188 break;
189 case ESC:
190 *ptr++ = ESC;
191 *ptr++ = ESC_ESC;
192 break;
193 default:
194 *ptr++ = c;
195 break;
196 }
197 }
198
199 *ptr++ = END;
200
201 return ptr - d;
202}
203
204/*
205 * MW:
206 * OK its ugly, but tell me a better solution without copying the
207 * packet to a temporary buffer :-)
208 */
209static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
210 int len)
211{
212 unsigned char *ptr = d;
213 unsigned char c=0;
214
215 *ptr++ = END;
216 while (len > 0) {
217 if (len > 2)
218 c = *s++;
219 else if (len > 1)
220 c = crc >> 8;
221 else if (len > 0)
222 c = crc & 0xff;
223
224 len--;
225
226 switch (c) {
227 case END:
228 *ptr++ = ESC;
229 *ptr++ = ESC_END;
230 break;
231 case ESC:
232 *ptr++ = ESC;
233 *ptr++ = ESC_ESC;
234 break;
235 default:
236 *ptr++ = c;
237 break;
238 }
239 }
240 *ptr++ = END;
241
242 return ptr - d;
243}
244
245/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
246static void ax_bump(struct mkiss *ax)
247{
248 struct sk_buff *skb;
249 int count;
250
251 spin_lock_bh(&ax->buflock);
252 if (ax->rbuff[0] > 0x0f) {
253 if (ax->rbuff[0] & 0x80) {
254 if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
255 ax->dev->stats.rx_errors++;
256 spin_unlock_bh(&ax->buflock);
257
258 return;
259 }
260 if (ax->crcmode != CRC_MODE_SMACK && ax->crcauto) {
261 printk(KERN_INFO
262 "mkiss: %s: Switching to crc-smack\n",
263 ax->dev->name);
264 ax->crcmode = CRC_MODE_SMACK;
265 }
266 ax->rcount -= 2;
267 *ax->rbuff &= ~0x80;
268 } else if (ax->rbuff[0] & 0x20) {
269 if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
270 ax->dev->stats.rx_errors++;
271 spin_unlock_bh(&ax->buflock);
272 return;
273 }
274 if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
275 printk(KERN_INFO
276 "mkiss: %s: Switching to crc-flexnet\n",
277 ax->dev->name);
278 ax->crcmode = CRC_MODE_FLEX;
279 }
280 ax->rcount -= 2;
281
282 /*
283 * dl9sau bugfix: the trailling two bytes flexnet crc
284 * will not be passed to the kernel. thus we have to
285 * correct the kissparm signature, because it indicates
286 * a crc but there's none
287 */
288 *ax->rbuff &= ~0x20;
289 }
290 }
291
292 count = ax->rcount;
293
294 if ((skb = dev_alloc_skb(count)) == NULL) {
295 printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
296 ax->dev->name);
297 ax->dev->stats.rx_dropped++;
298 spin_unlock_bh(&ax->buflock);
299 return;
300 }
301
302 memcpy(skb_put(skb,count), ax->rbuff, count);
303 skb->protocol = ax25_type_trans(skb, ax->dev);
304 netif_rx(skb);
305 ax->dev->stats.rx_packets++;
306 ax->dev->stats.rx_bytes += count;
307 spin_unlock_bh(&ax->buflock);
308}
309
310static void kiss_unesc(struct mkiss *ax, unsigned char s)
311{
312 switch (s) {
313 case END:
314 /* drop keeptest bit = VSV */
315 if (test_bit(AXF_KEEPTEST, &ax->flags))
316 clear_bit(AXF_KEEPTEST, &ax->flags);
317
318 if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
319 ax_bump(ax);
320
321 clear_bit(AXF_ESCAPE, &ax->flags);
322 ax->rcount = 0;
323 return;
324
325 case ESC:
326 set_bit(AXF_ESCAPE, &ax->flags);
327 return;
328 case ESC_ESC:
329 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
330 s = ESC;
331 break;
332 case ESC_END:
333 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
334 s = END;
335 break;
336 }
337
338 spin_lock_bh(&ax->buflock);
339 if (!test_bit(AXF_ERROR, &ax->flags)) {
340 if (ax->rcount < ax->buffsize) {
341 ax->rbuff[ax->rcount++] = s;
342 spin_unlock_bh(&ax->buflock);
343 return;
344 }
345
346 ax->dev->stats.rx_over_errors++;
347 set_bit(AXF_ERROR, &ax->flags);
348 }
349 spin_unlock_bh(&ax->buflock);
350}
351
352static int ax_set_mac_address(struct net_device *dev, void *addr)
353{
354 struct sockaddr_ax25 *sa = addr;
355
356 netif_tx_lock_bh(dev);
357 netif_addr_lock(dev);
358 memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
359 netif_addr_unlock(dev);
360 netif_tx_unlock_bh(dev);
361
362 return 0;
363}
364
365/*---------------------------------------------------------------------------*/
366
367static void ax_changedmtu(struct mkiss *ax)
368{
369 struct net_device *dev = ax->dev;
370 unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
371 int len;
372
373 len = dev->mtu * 2;
374
375 /*
376 * allow for arrival of larger UDP packets, even if we say not to
377 * also fixes a bug in which SunOS sends 512-byte packets even with
378 * an MSS of 128
379 */
380 if (len < 576 * 2)
381 len = 576 * 2;
382
383 xbuff = kmalloc(len + 4, GFP_ATOMIC);
384 rbuff = kmalloc(len + 4, GFP_ATOMIC);
385
386 if (xbuff == NULL || rbuff == NULL) {
387 printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, "
388 "MTU change cancelled.\n",
389 ax->dev->name);
390 dev->mtu = ax->mtu;
391 kfree(xbuff);
392 kfree(rbuff);
393 return;
394 }
395
396 spin_lock_bh(&ax->buflock);
397
398 oxbuff = ax->xbuff;
399 ax->xbuff = xbuff;
400 orbuff = ax->rbuff;
401 ax->rbuff = rbuff;
402
403 if (ax->xleft) {
404 if (ax->xleft <= len) {
405 memcpy(ax->xbuff, ax->xhead, ax->xleft);
406 } else {
407 ax->xleft = 0;
408 dev->stats.tx_dropped++;
409 }
410 }
411
412 ax->xhead = ax->xbuff;
413
414 if (ax->rcount) {
415 if (ax->rcount <= len) {
416 memcpy(ax->rbuff, orbuff, ax->rcount);
417 } else {
418 ax->rcount = 0;
419 dev->stats.rx_over_errors++;
420 set_bit(AXF_ERROR, &ax->flags);
421 }
422 }
423
424 ax->mtu = dev->mtu + 73;
425 ax->buffsize = len;
426
427 spin_unlock_bh(&ax->buflock);
428
429 kfree(oxbuff);
430 kfree(orbuff);
431}
432
433/* Encapsulate one AX.25 packet and stuff into a TTY queue. */
434static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
435{
436 struct mkiss *ax = netdev_priv(dev);
437 unsigned char *p;
438 int actual, count;
439
440 if (ax->mtu != ax->dev->mtu + 73) /* Someone has been ifconfigging */
441 ax_changedmtu(ax);
442
443 if (len > ax->mtu) { /* Sigh, shouldn't occur BUT ... */
444 len = ax->mtu;
445 printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name);
446 dev->stats.tx_dropped++;
447 netif_start_queue(dev);
448 return;
449 }
450
451 p = icp;
452
453 spin_lock_bh(&ax->buflock);
454 if ((*p & 0x0f) != 0) {
455 /* Configuration Command (kissparms(1).
456 * Protocol spec says: never append CRC.
457 * This fixes a very old bug in the linux
458 * kiss driver. -- dl9sau */
459 switch (*p & 0xff) {
460 case 0x85:
461 /* command from userspace especially for us,
462 * not for delivery to the tnc */
463 if (len > 1) {
464 int cmd = (p[1] & 0xff);
465 switch(cmd) {
466 case 3:
467 ax->crcmode = CRC_MODE_SMACK;
468 break;
469 case 2:
470 ax->crcmode = CRC_MODE_FLEX;
471 break;
472 case 1:
473 ax->crcmode = CRC_MODE_NONE;
474 break;
475 case 0:
476 default:
477 ax->crcmode = CRC_MODE_SMACK_TEST;
478 cmd = 0;
479 }
480 ax->crcauto = (cmd ? 0 : 1);
481 printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd);
482 }
483 spin_unlock_bh(&ax->buflock);
484 netif_start_queue(dev);
485
486 return;
487 default:
488 count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
489 }
490 } else {
491 unsigned short crc;
492 switch (ax->crcmode) {
493 case CRC_MODE_SMACK_TEST:
494 ax->crcmode = CRC_MODE_FLEX_TEST;
495 printk(KERN_INFO "mkiss: %s: Trying crc-smack\n", ax->dev->name);
496 // fall through
497 case CRC_MODE_SMACK:
498 *p |= 0x80;
499 crc = swab16(crc16(0, p, len));
500 count = kiss_esc_crc(p, (unsigned char *)ax->xbuff, crc, len+2);
501 break;
502 case CRC_MODE_FLEX_TEST:
503 ax->crcmode = CRC_MODE_NONE;
504 printk(KERN_INFO "mkiss: %s: Trying crc-flexnet\n", ax->dev->name);
505 // fall through
506 case CRC_MODE_FLEX:
507 *p |= 0x20;
508 crc = calc_crc_flex(p, len);
509 count = kiss_esc_crc(p, (unsigned char *)ax->xbuff, crc, len+2);
510 break;
511
512 default:
513 count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
514 }
515 }
516 spin_unlock_bh(&ax->buflock);
517
518 set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
519 actual = ax->tty->ops->write(ax->tty, ax->xbuff, count);
520 dev->stats.tx_packets++;
521 dev->stats.tx_bytes += actual;
522
523 ax->dev->trans_start = jiffies;
524 ax->xleft = count - actual;
525 ax->xhead = ax->xbuff + actual;
526}
527
528/* Encapsulate an AX.25 packet and kick it into a TTY queue. */
529static netdev_tx_t ax_xmit(struct sk_buff *skb, struct net_device *dev)
530{
531 struct mkiss *ax = netdev_priv(dev);
532
533 if (!netif_running(dev)) {
534 printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
535 return NETDEV_TX_BUSY;
536 }
537
538 if (netif_queue_stopped(dev)) {
539 /*
540 * May be we must check transmitter timeout here ?
541 * 14 Oct 1994 Dmitry Gorodchanin.
542 */
543 if (time_before(jiffies, dev->trans_start + 20 * HZ)) {
544 /* 20 sec timeout not reached */
545 return NETDEV_TX_BUSY;
546 }
547
548 printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name,
549 (tty_chars_in_buffer(ax->tty) || ax->xleft) ?
550 "bad line quality" : "driver error");
551
552 ax->xleft = 0;
553 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
554 netif_start_queue(dev);
555 }
556
557 /* We were not busy, so we are now... :-) */
558 if (skb != NULL) {
559 netif_stop_queue(dev);
560 ax_encaps(dev, skb->data, skb->len);
561 kfree_skb(skb);
562 }
563
564 return NETDEV_TX_OK;
565}
566
567static int ax_open_dev(struct net_device *dev)
568{
569 struct mkiss *ax = netdev_priv(dev);
570
571 if (ax->tty == NULL)
572 return -ENODEV;
573
574 return 0;
575}
576
577#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
578
579/* Return the frame type ID */
580static int ax_header(struct sk_buff *skb, struct net_device *dev,
581 unsigned short type, const void *daddr,
582 const void *saddr, unsigned len)
583{
584#ifdef CONFIG_INET
585 if (type != ETH_P_AX25)
586 return ax25_hard_header(skb, dev, type, daddr, saddr, len);
587#endif
588 return 0;
589}
590
591
592static int ax_rebuild_header(struct sk_buff *skb)
593{
594#ifdef CONFIG_INET
595 return ax25_rebuild_header(skb);
596#else
597 return 0;
598#endif
599}
600
601#endif /* CONFIG_{AX25,AX25_MODULE} */
602
603/* Open the low-level part of the AX25 channel. Easy! */
604static int ax_open(struct net_device *dev)
605{
606 struct mkiss *ax = netdev_priv(dev);
607 unsigned long len;
608
609 if (ax->tty == NULL)
610 return -ENODEV;
611
612 /*
613 * Allocate the frame buffers:
614 *
615 * rbuff Receive buffer.
616 * xbuff Transmit buffer.
617 */
618 len = dev->mtu * 2;
619
620 /*
621 * allow for arrival of larger UDP packets, even if we say not to
622 * also fixes a bug in which SunOS sends 512-byte packets even with
623 * an MSS of 128
624 */
625 if (len < 576 * 2)
626 len = 576 * 2;
627
628 if ((ax->rbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
629 goto norbuff;
630
631 if ((ax->xbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
632 goto noxbuff;
633
634 ax->mtu = dev->mtu + 73;
635 ax->buffsize = len;
636 ax->rcount = 0;
637 ax->xleft = 0;
638
639 ax->flags &= (1 << AXF_INUSE); /* Clear ESCAPE & ERROR flags */
640
641 spin_lock_init(&ax->buflock);
642
643 return 0;
644
645noxbuff:
646 kfree(ax->rbuff);
647
648norbuff:
649 return -ENOMEM;
650}
651
652
653/* Close the low-level part of the AX25 channel. Easy! */
654static int ax_close(struct net_device *dev)
655{
656 struct mkiss *ax = netdev_priv(dev);
657
658 if (ax->tty)
659 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
660
661 netif_stop_queue(dev);
662
663 return 0;
664}
665
666static const struct header_ops ax_header_ops = {
667 .create = ax_header,
668 .rebuild = ax_rebuild_header,
669};
670
671static const struct net_device_ops ax_netdev_ops = {
672 .ndo_open = ax_open_dev,
673 .ndo_stop = ax_close,
674 .ndo_start_xmit = ax_xmit,
675 .ndo_set_mac_address = ax_set_mac_address,
676};
677
678static void ax_setup(struct net_device *dev)
679{
680 /* Finish setting up the DEVICE info. */
681 dev->mtu = AX_MTU;
682 dev->hard_header_len = 0;
683 dev->addr_len = 0;
684 dev->type = ARPHRD_AX25;
685 dev->tx_queue_len = 10;
686 dev->header_ops = &ax_header_ops;
687 dev->netdev_ops = &ax_netdev_ops;
688
689
690 memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
691 memcpy(dev->dev_addr, &ax25_defaddr, AX25_ADDR_LEN);
692
693 dev->flags = IFF_BROADCAST | IFF_MULTICAST;
694}
695
696/*
697 * We have a potential race on dereferencing tty->disc_data, because the tty
698 * layer provides no locking at all - thus one cpu could be running
699 * sixpack_receive_buf while another calls sixpack_close, which zeroes
700 * tty->disc_data and frees the memory that sixpack_receive_buf is using. The
701 * best way to fix this is to use a rwlock in the tty struct, but for now we
702 * use a single global rwlock for all ttys in ppp line discipline.
703 */
704static DEFINE_RWLOCK(disc_data_lock);
705
706static struct mkiss *mkiss_get(struct tty_struct *tty)
707{
708 struct mkiss *ax;
709
710 read_lock(&disc_data_lock);
711 ax = tty->disc_data;
712 if (ax)
713 atomic_inc(&ax->refcnt);
714 read_unlock(&disc_data_lock);
715
716 return ax;
717}
718
719static void mkiss_put(struct mkiss *ax)
720{
721 if (atomic_dec_and_test(&ax->refcnt))
722 up(&ax->dead_sem);
723}
724
725static int crc_force = 0; /* Can be overridden with insmod */
726
727static int mkiss_open(struct tty_struct *tty)
728{
729 struct net_device *dev;
730 struct mkiss *ax;
731 int err;
732
733 if (!capable(CAP_NET_ADMIN))
734 return -EPERM;
735 if (tty->ops->write == NULL)
736 return -EOPNOTSUPP;
737
738 dev = alloc_netdev(sizeof(struct mkiss), "ax%d", ax_setup);
739 if (!dev) {
740 err = -ENOMEM;
741 goto out;
742 }
743
744 ax = netdev_priv(dev);
745 ax->dev = dev;
746
747 spin_lock_init(&ax->buflock);
748 atomic_set(&ax->refcnt, 1);
749 sema_init(&ax->dead_sem, 0);
750
751 ax->tty = tty;
752 tty->disc_data = ax;
753 tty->receive_room = 65535;
754
755 tty_driver_flush_buffer(tty);
756
757 /* Restore default settings */
758 dev->type = ARPHRD_AX25;
759
760 /* Perform the low-level AX25 initialization. */
761 if ((err = ax_open(ax->dev))) {
762 goto out_free_netdev;
763 }
764
765 if (register_netdev(dev))
766 goto out_free_buffers;
767
768 /* after register_netdev() - because else printk smashes the kernel */
769 switch (crc_force) {
770 case 3:
771 ax->crcmode = CRC_MODE_SMACK;
772 printk(KERN_INFO "mkiss: %s: crc mode smack forced.\n",
773 ax->dev->name);
774 break;
775 case 2:
776 ax->crcmode = CRC_MODE_FLEX;
777 printk(KERN_INFO "mkiss: %s: crc mode flexnet forced.\n",
778 ax->dev->name);
779 break;
780 case 1:
781 ax->crcmode = CRC_MODE_NONE;
782 printk(KERN_INFO "mkiss: %s: crc mode disabled.\n",
783 ax->dev->name);
784 break;
785 case 0:
786 /* fall through */
787 default:
788 crc_force = 0;
789 printk(KERN_INFO "mkiss: %s: crc mode is auto.\n",
790 ax->dev->name);
791 ax->crcmode = CRC_MODE_SMACK_TEST;
792 }
793 ax->crcauto = (crc_force ? 0 : 1);
794
795 netif_start_queue(dev);
796
797 /* Done. We have linked the TTY line to a channel. */
798 return 0;
799
800out_free_buffers:
801 kfree(ax->rbuff);
802 kfree(ax->xbuff);
803
804out_free_netdev:
805 free_netdev(dev);
806
807out:
808 return err;
809}
810
811static void mkiss_close(struct tty_struct *tty)
812{
813 struct mkiss *ax;
814
815 write_lock_bh(&disc_data_lock);
816 ax = tty->disc_data;
817 tty->disc_data = NULL;
818 write_unlock_bh(&disc_data_lock);
819
820 if (!ax)
821 return;
822
823 /*
824 * We have now ensured that nobody can start using ap from now on, but
825 * we have to wait for all existing users to finish.
826 */
827 if (!atomic_dec_and_test(&ax->refcnt))
828 down(&ax->dead_sem);
829
830 unregister_netdev(ax->dev);
831
832 /* Free all AX25 frame buffers. */
833 kfree(ax->rbuff);
834 kfree(ax->xbuff);
835
836 ax->tty = NULL;
837}
838
839/* Perform I/O control on an active ax25 channel. */
840static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
841 unsigned int cmd, unsigned long arg)
842{
843 struct mkiss *ax = mkiss_get(tty);
844 struct net_device *dev;
845 unsigned int tmp, err;
846
847 /* First make sure we're connected. */
848 if (ax == NULL)
849 return -ENXIO;
850 dev = ax->dev;
851
852 switch (cmd) {
853 case SIOCGIFNAME:
854 err = copy_to_user((void __user *) arg, ax->dev->name,
855 strlen(ax->dev->name) + 1) ? -EFAULT : 0;
856 break;
857
858 case SIOCGIFENCAP:
859 err = put_user(4, (int __user *) arg);
860 break;
861
862 case SIOCSIFENCAP:
863 if (get_user(tmp, (int __user *) arg)) {
864 err = -EFAULT;
865 break;
866 }
867
868 ax->mode = tmp;
869 dev->addr_len = AX25_ADDR_LEN;
870 dev->hard_header_len = AX25_KISS_HEADER_LEN +
871 AX25_MAX_HEADER_LEN + 3;
872 dev->type = ARPHRD_AX25;
873
874 err = 0;
875 break;
876
877 case SIOCSIFHWADDR: {
878 char addr[AX25_ADDR_LEN];
879
880 if (copy_from_user(&addr,
881 (void __user *) arg, AX25_ADDR_LEN)) {
882 err = -EFAULT;
883 break;
884 }
885
886 netif_tx_lock_bh(dev);
887 memcpy(dev->dev_addr, addr, AX25_ADDR_LEN);
888 netif_tx_unlock_bh(dev);
889
890 err = 0;
891 break;
892 }
893 default:
894 err = -ENOIOCTLCMD;
895 }
896
897 mkiss_put(ax);
898
899 return err;
900}
901
902#ifdef CONFIG_COMPAT
903static long mkiss_compat_ioctl(struct tty_struct *tty, struct file *file,
904 unsigned int cmd, unsigned long arg)
905{
906 switch (cmd) {
907 case SIOCGIFNAME:
908 case SIOCGIFENCAP:
909 case SIOCSIFENCAP:
910 case SIOCSIFHWADDR:
911 return mkiss_ioctl(tty, file, cmd,
912 (unsigned long)compat_ptr(arg));
913 }
914
915 return -ENOIOCTLCMD;
916}
917#endif
918
919/*
920 * Handle the 'receiver data ready' interrupt.
921 * This function is called by the 'tty_io' module in the kernel when
922 * a block of data has been received, which can now be decapsulated
923 * and sent on to the AX.25 layer for further processing.
924 */
925static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
926 char *fp, int count)
927{
928 struct mkiss *ax = mkiss_get(tty);
929
930 if (!ax)
931 return;
932
933 /*
934 * Argh! mtu change time! - costs us the packet part received
935 * at the change
936 */
937 if (ax->mtu != ax->dev->mtu + 73)
938 ax_changedmtu(ax);
939
940 /* Read the characters out of the buffer */
941 while (count--) {
942 if (fp != NULL && *fp++) {
943 if (!test_and_set_bit(AXF_ERROR, &ax->flags))
944 ax->dev->stats.rx_errors++;
945 cp++;
946 continue;
947 }
948
949 kiss_unesc(ax, *cp++);
950 }
951
952 mkiss_put(ax);
953 tty_unthrottle(tty);
954}
955
956/*
957 * Called by the driver when there's room for more data. If we have
958 * more packets to send, we send them here.
959 */
960static void mkiss_write_wakeup(struct tty_struct *tty)
961{
962 struct mkiss *ax = mkiss_get(tty);
963 int actual;
964
965 if (!ax)
966 return;
967
968 if (ax->xleft <= 0) {
969 /* Now serial buffer is almost free & we can start
970 * transmission of another packet
971 */
972 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
973
974 netif_wake_queue(ax->dev);
975 goto out;
976 }
977
978 actual = tty->ops->write(tty, ax->xhead, ax->xleft);
979 ax->xleft -= actual;
980 ax->xhead += actual;
981
982out:
983 mkiss_put(ax);
984}
985
986static struct tty_ldisc_ops ax_ldisc = {
987 .owner = THIS_MODULE,
988 .magic = TTY_LDISC_MAGIC,
989 .name = "mkiss",
990 .open = mkiss_open,
991 .close = mkiss_close,
992 .ioctl = mkiss_ioctl,
993#ifdef CONFIG_COMPAT
994 .compat_ioctl = mkiss_compat_ioctl,
995#endif
996 .receive_buf = mkiss_receive_buf,
997 .write_wakeup = mkiss_write_wakeup
998};
999
1000static const char banner[] __initdata = KERN_INFO \
1001 "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
1002static const char msg_regfail[] __initdata = KERN_ERR \
1003 "mkiss: can't register line discipline (err = %d)\n";
1004
1005static int __init mkiss_init_driver(void)
1006{
1007 int status;
1008
1009 printk(banner);
1010
1011 status = tty_register_ldisc(N_AX25, &ax_ldisc);
1012 if (status != 0)
1013 printk(msg_regfail, status);
1014
1015 return status;
1016}
1017
1018static const char msg_unregfail[] __exitdata = KERN_ERR \
1019 "mkiss: can't unregister line discipline (err = %d)\n";
1020
1021static void __exit mkiss_exit_driver(void)
1022{
1023 int ret;
1024
1025 if ((ret = tty_unregister_ldisc(N_AX25)))
1026 printk(msg_unregfail, ret);
1027}
1028
1029MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>");
1030MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs");
1031module_param(crc_force, int, 0);
1032MODULE_PARM_DESC(crc_force, "crc [0 = auto | 1 = none | 2 = flexnet | 3 = smack]");
1033MODULE_LICENSE("GPL");
1034MODULE_ALIAS_LDISC(N_AX25);
1035
1036module_init(mkiss_init_driver);
1037module_exit(mkiss_exit_driver);