1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * 4 * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl> 5 * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org> 6 * Copyright (C) 2004, 05 Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de> 7 */ 8 #include <linux/module.h> 9 #include <linux/bitops.h> 10 #include <linux/uaccess.h> 11 #include <linux/crc16.h> 12 #include <linux/string.h> 13 #include <linux/mm.h> 14 #include <linux/interrupt.h> 15 #include <linux/in.h> 16 #include <linux/inet.h> 17 #include <linux/slab.h> 18 #include <linux/tty.h> 19 #include <linux/errno.h> 20 #include <linux/netdevice.h> 21 #include <linux/major.h> 22 #include <linux/init.h> 23 #include <linux/rtnetlink.h> 24 #include <linux/etherdevice.h> 25 #include <linux/skbuff.h> 26 #include <linux/if_arp.h> 27 #include <linux/jiffies.h> 28 29 #include <net/ax25.h> 30 31 #define AX_MTU 236 32 33 /* SLIP/KISS protocol characters. */ 34 #define END 0300 /* indicates end of frame */ 35 #define ESC 0333 /* indicates byte stuffing */ 36 #define ESC_END 0334 /* ESC ESC_END means END 'data' */ 37 #define ESC_ESC 0335 /* ESC ESC_ESC means ESC 'data' */ 38 39 struct mkiss { 40 struct tty_struct *tty; /* ptr to TTY structure */ 41 struct net_device *dev; /* easy for intr handling */ 42 43 /* These are pointers to the malloc()ed frame buffers. */ 44 spinlock_t buflock;/* lock for rbuf and xbuf */ 45 unsigned char *rbuff; /* receiver buffer */ 46 int rcount; /* received chars counter */ 47 unsigned char *xbuff; /* transmitter buffer */ 48 unsigned char *xhead; /* pointer to next byte to XMIT */ 49 int xleft; /* bytes left in XMIT queue */ 50 51 /* Detailed SLIP statistics. */ 52 int mtu; /* Our mtu (to spot changes!) */ 53 int buffsize; /* Max buffers sizes */ 54 55 unsigned long flags; /* Flag values/ mode etc */ 56 /* long req'd: used by set_bit --RR */ 57 #define AXF_INUSE 0 /* Channel in use */ 58 #define AXF_ESCAPE 1 /* ESC received */ 59 #define AXF_ERROR 2 /* Parity, etc. error */ 60 #define AXF_KEEPTEST 3 /* Keepalive test flag */ 61 #define AXF_OUTWAIT 4 /* is outpacket was flag */ 62 63 int mode; 64 int crcmode; /* MW: for FlexNet, SMACK etc. */ 65 int crcauto; /* CRC auto mode */ 66 67 #define CRC_MODE_NONE 0 68 #define CRC_MODE_FLEX 1 69 #define CRC_MODE_SMACK 2 70 #define CRC_MODE_FLEX_TEST 3 71 #define CRC_MODE_SMACK_TEST 4 72 73 atomic_t refcnt; 74 struct completion dead; 75 }; 76 77 /*---------------------------------------------------------------------------*/ 78 79 static const unsigned short crc_flex_table[] = { 80 0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38, 81 0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770, 82 0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9, 83 0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1, 84 0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a, 85 0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672, 86 0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb, 87 0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3, 88 0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c, 89 0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574, 90 0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd, 91 0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5, 92 0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e, 93 0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476, 94 0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf, 95 0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7, 96 0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30, 97 0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378, 98 0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1, 99 0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9, 100 0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32, 101 0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a, 102 0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3, 103 0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb, 104 0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34, 105 0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c, 106 0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5, 107 0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd, 108 0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36, 109 0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e, 110 0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7, 111 0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff 112 }; 113 114 static unsigned short calc_crc_flex(unsigned char *cp, int size) 115 { 116 unsigned short crc = 0xffff; 117 118 while (size--) 119 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff]; 120 121 return crc; 122 } 123 124 static int check_crc_flex(unsigned char *cp, int size) 125 { 126 unsigned short crc = 0xffff; 127 128 if (size < 3) 129 return -1; 130 131 while (size--) 132 crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff]; 133 134 if ((crc & 0xffff) != 0x7070) 135 return -1; 136 137 return 0; 138 } 139 140 static int check_crc_16(unsigned char *cp, int size) 141 { 142 unsigned short crc = 0x0000; 143 144 if (size < 3) 145 return -1; 146 147 crc = crc16(0, cp, size); 148 149 if (crc != 0x0000) 150 return -1; 151 152 return 0; 153 } 154 155 /* 156 * Standard encapsulation 157 */ 158 159 static int kiss_esc(unsigned char *s, unsigned char *d, int len) 160 { 161 unsigned char *ptr = d; 162 unsigned char c; 163 164 /* 165 * Send an initial END character to flush out any data that may have 166 * accumulated in the receiver due to line noise. 167 */ 168 169 *ptr++ = END; 170 171 while (len-- > 0) { 172 switch (c = *s++) { 173 case END: 174 *ptr++ = ESC; 175 *ptr++ = ESC_END; 176 break; 177 case ESC: 178 *ptr++ = ESC; 179 *ptr++ = ESC_ESC; 180 break; 181 default: 182 *ptr++ = c; 183 break; 184 } 185 } 186 187 *ptr++ = END; 188 189 return ptr - d; 190 } 191 192 /* 193 * MW: 194 * OK its ugly, but tell me a better solution without copying the 195 * packet to a temporary buffer :-) 196 */ 197 static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc, 198 int len) 199 { 200 unsigned char *ptr = d; 201 unsigned char c=0; 202 203 *ptr++ = END; 204 while (len > 0) { 205 if (len > 2) 206 c = *s++; 207 else if (len > 1) 208 c = crc >> 8; 209 else 210 c = crc & 0xff; 211 212 len--; 213 214 switch (c) { 215 case END: 216 *ptr++ = ESC; 217 *ptr++ = ESC_END; 218 break; 219 case ESC: 220 *ptr++ = ESC; 221 *ptr++ = ESC_ESC; 222 break; 223 default: 224 *ptr++ = c; 225 break; 226 } 227 } 228 *ptr++ = END; 229 230 return ptr - d; 231 } 232 233 /* Send one completely decapsulated AX.25 packet to the AX.25 layer. */ 234 static void ax_bump(struct mkiss *ax) 235 { 236 struct sk_buff *skb; 237 int count; 238 239 spin_lock_bh(&ax->buflock); 240 if (ax->rbuff[0] > 0x0f) { 241 if (ax->rbuff[0] & 0x80) { 242 if (check_crc_16(ax->rbuff, ax->rcount) < 0) { 243 ax->dev->stats.rx_errors++; 244 spin_unlock_bh(&ax->buflock); 245 246 return; 247 } 248 if (ax->crcmode != CRC_MODE_SMACK && ax->crcauto) { 249 printk(KERN_INFO 250 "mkiss: %s: Switching to crc-smack\n", 251 ax->dev->name); 252 ax->crcmode = CRC_MODE_SMACK; 253 } 254 ax->rcount -= 2; 255 *ax->rbuff &= ~0x80; 256 } else if (ax->rbuff[0] & 0x20) { 257 if (check_crc_flex(ax->rbuff, ax->rcount) < 0) { 258 ax->dev->stats.rx_errors++; 259 spin_unlock_bh(&ax->buflock); 260 return; 261 } 262 if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) { 263 printk(KERN_INFO 264 "mkiss: %s: Switching to crc-flexnet\n", 265 ax->dev->name); 266 ax->crcmode = CRC_MODE_FLEX; 267 } 268 ax->rcount -= 2; 269 270 /* 271 * dl9sau bugfix: the trailling two bytes flexnet crc 272 * will not be passed to the kernel. thus we have to 273 * correct the kissparm signature, because it indicates 274 * a crc but there's none 275 */ 276 *ax->rbuff &= ~0x20; 277 } 278 } 279 280 count = ax->rcount; 281 282 if ((skb = dev_alloc_skb(count)) == NULL) { 283 printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n", 284 ax->dev->name); 285 ax->dev->stats.rx_dropped++; 286 spin_unlock_bh(&ax->buflock); 287 return; 288 } 289 290 skb_put_data(skb, ax->rbuff, count); 291 skb->protocol = ax25_type_trans(skb, ax->dev); 292 netif_rx(skb); 293 ax->dev->stats.rx_packets++; 294 ax->dev->stats.rx_bytes += count; 295 spin_unlock_bh(&ax->buflock); 296 } 297 298 static void kiss_unesc(struct mkiss *ax, unsigned char s) 299 { 300 switch (s) { 301 case END: 302 /* drop keeptest bit = VSV */ 303 if (test_bit(AXF_KEEPTEST, &ax->flags)) 304 clear_bit(AXF_KEEPTEST, &ax->flags); 305 306 if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2)) 307 ax_bump(ax); 308 309 clear_bit(AXF_ESCAPE, &ax->flags); 310 ax->rcount = 0; 311 return; 312 313 case ESC: 314 set_bit(AXF_ESCAPE, &ax->flags); 315 return; 316 case ESC_ESC: 317 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags)) 318 s = ESC; 319 break; 320 case ESC_END: 321 if (test_and_clear_bit(AXF_ESCAPE, &ax->flags)) 322 s = END; 323 break; 324 } 325 326 spin_lock_bh(&ax->buflock); 327 if (!test_bit(AXF_ERROR, &ax->flags)) { 328 if (ax->rcount < ax->buffsize) { 329 ax->rbuff[ax->rcount++] = s; 330 spin_unlock_bh(&ax->buflock); 331 return; 332 } 333 334 ax->dev->stats.rx_over_errors++; 335 set_bit(AXF_ERROR, &ax->flags); 336 } 337 spin_unlock_bh(&ax->buflock); 338 } 339 340 static int ax_set_mac_address(struct net_device *dev, void *addr) 341 { 342 struct sockaddr_ax25 *sa = addr; 343 344 netif_tx_lock_bh(dev); 345 netif_addr_lock(dev); 346 memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN); 347 netif_addr_unlock(dev); 348 netif_tx_unlock_bh(dev); 349 350 return 0; 351 } 352 353 /*---------------------------------------------------------------------------*/ 354 355 static void ax_changedmtu(struct mkiss *ax) 356 { 357 struct net_device *dev = ax->dev; 358 unsigned char *xbuff, *rbuff, *oxbuff, *orbuff; 359 int len; 360 361 len = dev->mtu * 2; 362 363 /* 364 * allow for arrival of larger UDP packets, even if we say not to 365 * also fixes a bug in which SunOS sends 512-byte packets even with 366 * an MSS of 128 367 */ 368 if (len < 576 * 2) 369 len = 576 * 2; 370 371 xbuff = kmalloc(len + 4, GFP_ATOMIC); 372 rbuff = kmalloc(len + 4, GFP_ATOMIC); 373 374 if (xbuff == NULL || rbuff == NULL) { 375 printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, " 376 "MTU change cancelled.\n", 377 ax->dev->name); 378 dev->mtu = ax->mtu; 379 kfree(xbuff); 380 kfree(rbuff); 381 return; 382 } 383 384 spin_lock_bh(&ax->buflock); 385 386 oxbuff = ax->xbuff; 387 ax->xbuff = xbuff; 388 orbuff = ax->rbuff; 389 ax->rbuff = rbuff; 390 391 if (ax->xleft) { 392 if (ax->xleft <= len) { 393 memcpy(ax->xbuff, ax->xhead, ax->xleft); 394 } else { 395 ax->xleft = 0; 396 dev->stats.tx_dropped++; 397 } 398 } 399 400 ax->xhead = ax->xbuff; 401 402 if (ax->rcount) { 403 if (ax->rcount <= len) { 404 memcpy(ax->rbuff, orbuff, ax->rcount); 405 } else { 406 ax->rcount = 0; 407 dev->stats.rx_over_errors++; 408 set_bit(AXF_ERROR, &ax->flags); 409 } 410 } 411 412 ax->mtu = dev->mtu + 73; 413 ax->buffsize = len; 414 415 spin_unlock_bh(&ax->buflock); 416 417 kfree(oxbuff); 418 kfree(orbuff); 419 } 420 421 /* Encapsulate one AX.25 packet and stuff into a TTY queue. */ 422 static void ax_encaps(struct net_device *dev, unsigned char *icp, int len) 423 { 424 struct mkiss *ax = netdev_priv(dev); 425 unsigned char *p; 426 int actual, count; 427 428 if (ax->mtu != ax->dev->mtu + 73) /* Someone has been ifconfigging */ 429 ax_changedmtu(ax); 430 431 if (len > ax->mtu) { /* Sigh, shouldn't occur BUT ... */ 432 printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name); 433 dev->stats.tx_dropped++; 434 netif_start_queue(dev); 435 return; 436 } 437 438 p = icp; 439 440 spin_lock_bh(&ax->buflock); 441 if ((*p & 0x0f) != 0) { 442 /* Configuration Command (kissparms(1). 443 * Protocol spec says: never append CRC. 444 * This fixes a very old bug in the linux 445 * kiss driver. -- dl9sau */ 446 switch (*p & 0xff) { 447 case 0x85: 448 /* command from userspace especially for us, 449 * not for delivery to the tnc */ 450 if (len > 1) { 451 int cmd = (p[1] & 0xff); 452 switch(cmd) { 453 case 3: 454 ax->crcmode = CRC_MODE_SMACK; 455 break; 456 case 2: 457 ax->crcmode = CRC_MODE_FLEX; 458 break; 459 case 1: 460 ax->crcmode = CRC_MODE_NONE; 461 break; 462 case 0: 463 default: 464 ax->crcmode = CRC_MODE_SMACK_TEST; 465 cmd = 0; 466 } 467 ax->crcauto = (cmd ? 0 : 1); 468 printk(KERN_INFO "mkiss: %s: crc mode set to %d\n", 469 ax->dev->name, cmd); 470 } 471 spin_unlock_bh(&ax->buflock); 472 netif_start_queue(dev); 473 474 return; 475 default: 476 count = kiss_esc(p, ax->xbuff, len); 477 } 478 } else { 479 unsigned short crc; 480 switch (ax->crcmode) { 481 case CRC_MODE_SMACK_TEST: 482 ax->crcmode = CRC_MODE_FLEX_TEST; 483 printk(KERN_INFO "mkiss: %s: Trying crc-smack\n", ax->dev->name); 484 // fall through 485 case CRC_MODE_SMACK: 486 *p |= 0x80; 487 crc = swab16(crc16(0, p, len)); 488 count = kiss_esc_crc(p, ax->xbuff, crc, len+2); 489 break; 490 case CRC_MODE_FLEX_TEST: 491 ax->crcmode = CRC_MODE_NONE; 492 printk(KERN_INFO "mkiss: %s: Trying crc-flexnet\n", ax->dev->name); 493 // fall through 494 case CRC_MODE_FLEX: 495 *p |= 0x20; 496 crc = calc_crc_flex(p, len); 497 count = kiss_esc_crc(p, ax->xbuff, crc, len+2); 498 break; 499 500 default: 501 count = kiss_esc(p, ax->xbuff, len); 502 } 503 } 504 spin_unlock_bh(&ax->buflock); 505 506 set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); 507 actual = ax->tty->ops->write(ax->tty, ax->xbuff, count); 508 dev->stats.tx_packets++; 509 dev->stats.tx_bytes += actual; 510 511 netif_trans_update(ax->dev); 512 ax->xleft = count - actual; 513 ax->xhead = ax->xbuff + actual; 514 } 515 516 /* Encapsulate an AX.25 packet and kick it into a TTY queue. */ 517 static netdev_tx_t ax_xmit(struct sk_buff *skb, struct net_device *dev) 518 { 519 struct mkiss *ax = netdev_priv(dev); 520 521 if (skb->protocol == htons(ETH_P_IP)) 522 return ax25_ip_xmit(skb); 523 524 if (!netif_running(dev)) { 525 printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name); 526 return NETDEV_TX_BUSY; 527 } 528 529 if (netif_queue_stopped(dev)) { 530 /* 531 * May be we must check transmitter timeout here ? 532 * 14 Oct 1994 Dmitry Gorodchanin. 533 */ 534 if (time_before(jiffies, dev_trans_start(dev) + 20 * HZ)) { 535 /* 20 sec timeout not reached */ 536 return NETDEV_TX_BUSY; 537 } 538 539 printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name, 540 (tty_chars_in_buffer(ax->tty) || ax->xleft) ? 541 "bad line quality" : "driver error"); 542 543 ax->xleft = 0; 544 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); 545 netif_start_queue(dev); 546 } 547 548 /* We were not busy, so we are now... :-) */ 549 netif_stop_queue(dev); 550 ax_encaps(dev, skb->data, skb->len); 551 kfree_skb(skb); 552 553 return NETDEV_TX_OK; 554 } 555 556 static int ax_open_dev(struct net_device *dev) 557 { 558 struct mkiss *ax = netdev_priv(dev); 559 560 if (ax->tty == NULL) 561 return -ENODEV; 562 563 return 0; 564 } 565 566 /* Open the low-level part of the AX25 channel. Easy! */ 567 static int ax_open(struct net_device *dev) 568 { 569 struct mkiss *ax = netdev_priv(dev); 570 unsigned long len; 571 572 if (ax->tty == NULL) 573 return -ENODEV; 574 575 /* 576 * Allocate the frame buffers: 577 * 578 * rbuff Receive buffer. 579 * xbuff Transmit buffer. 580 */ 581 len = dev->mtu * 2; 582 583 /* 584 * allow for arrival of larger UDP packets, even if we say not to 585 * also fixes a bug in which SunOS sends 512-byte packets even with 586 * an MSS of 128 587 */ 588 if (len < 576 * 2) 589 len = 576 * 2; 590 591 if ((ax->rbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL) 592 goto norbuff; 593 594 if ((ax->xbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL) 595 goto noxbuff; 596 597 ax->mtu = dev->mtu + 73; 598 ax->buffsize = len; 599 ax->rcount = 0; 600 ax->xleft = 0; 601 602 ax->flags &= (1 << AXF_INUSE); /* Clear ESCAPE & ERROR flags */ 603 604 spin_lock_init(&ax->buflock); 605 606 return 0; 607 608 noxbuff: 609 kfree(ax->rbuff); 610 611 norbuff: 612 return -ENOMEM; 613 } 614 615 616 /* Close the low-level part of the AX25 channel. Easy! */ 617 static int ax_close(struct net_device *dev) 618 { 619 struct mkiss *ax = netdev_priv(dev); 620 621 if (ax->tty) 622 clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); 623 624 netif_stop_queue(dev); 625 626 return 0; 627 } 628 629 static const struct net_device_ops ax_netdev_ops = { 630 .ndo_open = ax_open_dev, 631 .ndo_stop = ax_close, 632 .ndo_start_xmit = ax_xmit, 633 .ndo_set_mac_address = ax_set_mac_address, 634 }; 635 636 static void ax_setup(struct net_device *dev) 637 { 638 /* Finish setting up the DEVICE info. */ 639 dev->mtu = AX_MTU; 640 dev->hard_header_len = AX25_MAX_HEADER_LEN; 641 dev->addr_len = AX25_ADDR_LEN; 642 dev->type = ARPHRD_AX25; 643 dev->tx_queue_len = 10; 644 dev->header_ops = &ax25_header_ops; 645 dev->netdev_ops = &ax_netdev_ops; 646 647 648 memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN); 649 memcpy(dev->dev_addr, &ax25_defaddr, AX25_ADDR_LEN); 650 651 dev->flags = IFF_BROADCAST | IFF_MULTICAST; 652 } 653 654 /* 655 * We have a potential race on dereferencing tty->disc_data, because the tty 656 * layer provides no locking at all - thus one cpu could be running 657 * sixpack_receive_buf while another calls sixpack_close, which zeroes 658 * tty->disc_data and frees the memory that sixpack_receive_buf is using. The 659 * best way to fix this is to use a rwlock in the tty struct, but for now we 660 * use a single global rwlock for all ttys in ppp line discipline. 661 */ 662 static DEFINE_RWLOCK(disc_data_lock); 663 664 static struct mkiss *mkiss_get(struct tty_struct *tty) 665 { 666 struct mkiss *ax; 667 668 read_lock(&disc_data_lock); 669 ax = tty->disc_data; 670 if (ax) 671 atomic_inc(&ax->refcnt); 672 read_unlock(&disc_data_lock); 673 674 return ax; 675 } 676 677 static void mkiss_put(struct mkiss *ax) 678 { 679 if (atomic_dec_and_test(&ax->refcnt)) 680 complete(&ax->dead); 681 } 682 683 static int crc_force = 0; /* Can be overridden with insmod */ 684 685 static int mkiss_open(struct tty_struct *tty) 686 { 687 struct net_device *dev; 688 struct mkiss *ax; 689 int err; 690 691 if (!capable(CAP_NET_ADMIN)) 692 return -EPERM; 693 if (tty->ops->write == NULL) 694 return -EOPNOTSUPP; 695 696 dev = alloc_netdev(sizeof(struct mkiss), "ax%d", NET_NAME_UNKNOWN, 697 ax_setup); 698 if (!dev) { 699 err = -ENOMEM; 700 goto out; 701 } 702 703 ax = netdev_priv(dev); 704 ax->dev = dev; 705 706 spin_lock_init(&ax->buflock); 707 atomic_set(&ax->refcnt, 1); 708 init_completion(&ax->dead); 709 710 ax->tty = tty; 711 tty->disc_data = ax; 712 tty->receive_room = 65535; 713 714 tty_driver_flush_buffer(tty); 715 716 /* Restore default settings */ 717 dev->type = ARPHRD_AX25; 718 719 /* Perform the low-level AX25 initialization. */ 720 err = ax_open(ax->dev); 721 if (err) 722 goto out_free_netdev; 723 724 err = register_netdev(dev); 725 if (err) 726 goto out_free_buffers; 727 728 /* after register_netdev() - because else printk smashes the kernel */ 729 switch (crc_force) { 730 case 3: 731 ax->crcmode = CRC_MODE_SMACK; 732 printk(KERN_INFO "mkiss: %s: crc mode smack forced.\n", 733 ax->dev->name); 734 break; 735 case 2: 736 ax->crcmode = CRC_MODE_FLEX; 737 printk(KERN_INFO "mkiss: %s: crc mode flexnet forced.\n", 738 ax->dev->name); 739 break; 740 case 1: 741 ax->crcmode = CRC_MODE_NONE; 742 printk(KERN_INFO "mkiss: %s: crc mode disabled.\n", 743 ax->dev->name); 744 break; 745 case 0: 746 /* fall through */ 747 default: 748 crc_force = 0; 749 printk(KERN_INFO "mkiss: %s: crc mode is auto.\n", 750 ax->dev->name); 751 ax->crcmode = CRC_MODE_SMACK_TEST; 752 } 753 ax->crcauto = (crc_force ? 0 : 1); 754 755 netif_start_queue(dev); 756 757 /* Done. We have linked the TTY line to a channel. */ 758 return 0; 759 760 out_free_buffers: 761 kfree(ax->rbuff); 762 kfree(ax->xbuff); 763 764 out_free_netdev: 765 free_netdev(dev); 766 767 out: 768 return err; 769 } 770 771 static void mkiss_close(struct tty_struct *tty) 772 { 773 struct mkiss *ax; 774 775 write_lock_bh(&disc_data_lock); 776 ax = tty->disc_data; 777 tty->disc_data = NULL; 778 write_unlock_bh(&disc_data_lock); 779 780 if (!ax) 781 return; 782 783 /* 784 * We have now ensured that nobody can start using ap from now on, but 785 * we have to wait for all existing users to finish. 786 */ 787 if (!atomic_dec_and_test(&ax->refcnt)) 788 wait_for_completion(&ax->dead); 789 /* 790 * Halt the transmit queue so that a new transmit cannot scribble 791 * on our buffers 792 */ 793 netif_stop_queue(ax->dev); 794 795 /* Free all AX25 frame buffers. */ 796 kfree(ax->rbuff); 797 kfree(ax->xbuff); 798 799 ax->tty = NULL; 800 801 unregister_netdev(ax->dev); 802 } 803 804 /* Perform I/O control on an active ax25 channel. */ 805 static int mkiss_ioctl(struct tty_struct *tty, struct file *file, 806 unsigned int cmd, unsigned long arg) 807 { 808 struct mkiss *ax = mkiss_get(tty); 809 struct net_device *dev; 810 unsigned int tmp, err; 811 812 /* First make sure we're connected. */ 813 if (ax == NULL) 814 return -ENXIO; 815 dev = ax->dev; 816 817 switch (cmd) { 818 case SIOCGIFNAME: 819 err = copy_to_user((void __user *) arg, ax->dev->name, 820 strlen(ax->dev->name) + 1) ? -EFAULT : 0; 821 break; 822 823 case SIOCGIFENCAP: 824 err = put_user(4, (int __user *) arg); 825 break; 826 827 case SIOCSIFENCAP: 828 if (get_user(tmp, (int __user *) arg)) { 829 err = -EFAULT; 830 break; 831 } 832 833 ax->mode = tmp; 834 dev->addr_len = AX25_ADDR_LEN; 835 dev->hard_header_len = AX25_KISS_HEADER_LEN + 836 AX25_MAX_HEADER_LEN + 3; 837 dev->type = ARPHRD_AX25; 838 839 err = 0; 840 break; 841 842 case SIOCSIFHWADDR: { 843 char addr[AX25_ADDR_LEN]; 844 845 if (copy_from_user(&addr, 846 (void __user *) arg, AX25_ADDR_LEN)) { 847 err = -EFAULT; 848 break; 849 } 850 851 netif_tx_lock_bh(dev); 852 memcpy(dev->dev_addr, addr, AX25_ADDR_LEN); 853 netif_tx_unlock_bh(dev); 854 855 err = 0; 856 break; 857 } 858 default: 859 err = -ENOIOCTLCMD; 860 } 861 862 mkiss_put(ax); 863 864 return err; 865 } 866 867 /* 868 * Handle the 'receiver data ready' interrupt. 869 * This function is called by the 'tty_io' module in the kernel when 870 * a block of data has been received, which can now be decapsulated 871 * and sent on to the AX.25 layer for further processing. 872 */ 873 static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp, 874 char *fp, int count) 875 { 876 struct mkiss *ax = mkiss_get(tty); 877 878 if (!ax) 879 return; 880 881 /* 882 * Argh! mtu change time! - costs us the packet part received 883 * at the change 884 */ 885 if (ax->mtu != ax->dev->mtu + 73) 886 ax_changedmtu(ax); 887 888 /* Read the characters out of the buffer */ 889 while (count--) { 890 if (fp != NULL && *fp++) { 891 if (!test_and_set_bit(AXF_ERROR, &ax->flags)) 892 ax->dev->stats.rx_errors++; 893 cp++; 894 continue; 895 } 896 897 kiss_unesc(ax, *cp++); 898 } 899 900 mkiss_put(ax); 901 tty_unthrottle(tty); 902 } 903 904 /* 905 * Called by the driver when there's room for more data. If we have 906 * more packets to send, we send them here. 907 */ 908 static void mkiss_write_wakeup(struct tty_struct *tty) 909 { 910 struct mkiss *ax = mkiss_get(tty); 911 int actual; 912 913 if (!ax) 914 return; 915 916 if (ax->xleft <= 0) { 917 /* Now serial buffer is almost free & we can start 918 * transmission of another packet 919 */ 920 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 921 922 netif_wake_queue(ax->dev); 923 goto out; 924 } 925 926 actual = tty->ops->write(tty, ax->xhead, ax->xleft); 927 ax->xleft -= actual; 928 ax->xhead += actual; 929 930 out: 931 mkiss_put(ax); 932 } 933 934 static struct tty_ldisc_ops ax_ldisc = { 935 .owner = THIS_MODULE, 936 .magic = TTY_LDISC_MAGIC, 937 .name = "mkiss", 938 .open = mkiss_open, 939 .close = mkiss_close, 940 .ioctl = mkiss_ioctl, 941 .receive_buf = mkiss_receive_buf, 942 .write_wakeup = mkiss_write_wakeup 943 }; 944 945 static const char banner[] __initconst = KERN_INFO \ 946 "mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n"; 947 static const char msg_regfail[] __initconst = KERN_ERR \ 948 "mkiss: can't register line discipline (err = %d)\n"; 949 950 static int __init mkiss_init_driver(void) 951 { 952 int status; 953 954 printk(banner); 955 956 status = tty_register_ldisc(N_AX25, &ax_ldisc); 957 if (status != 0) 958 printk(msg_regfail, status); 959 960 return status; 961 } 962 963 static const char msg_unregfail[] = KERN_ERR \ 964 "mkiss: can't unregister line discipline (err = %d)\n"; 965 966 static void __exit mkiss_exit_driver(void) 967 { 968 int ret; 969 970 if ((ret = tty_unregister_ldisc(N_AX25))) 971 printk(msg_unregfail, ret); 972 } 973 974 MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>"); 975 MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs"); 976 module_param(crc_force, int, 0); 977 MODULE_PARM_DESC(crc_force, "crc [0 = auto | 1 = none | 2 = flexnet | 3 = smack]"); 978 MODULE_LICENSE("GPL"); 979 MODULE_ALIAS_LDISC(N_AX25); 980 981 module_init(mkiss_init_driver); 982 module_exit(mkiss_exit_driver); 983