1/*
2 *  This program is free software; you can distribute it and/or modify it
3 *  under the terms of the GNU General Public License (Version 2) as
4 *  published by the Free Software Foundation.
5 *
6 *  This program is distributed in the hope it will be useful, but WITHOUT
7 *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
8 *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
9 *  for more details.
10 *
11 *  You should have received a copy of the GNU General Public License along
12 *  with this program; if not, write to the Free Software Foundation, Inc.,
13 *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
14 *
15 * Copyright (C) Hans Alblas PE1AYX <hans@esrac.ele.tue.nl>
16 * Copyright (C) 2004, 05 Ralf Baechle DL5RB <ralf@linux-mips.org>
17 * Copyright (C) 2004, 05 Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de>
18 */
19#include <linux/module.h>
20#include <asm/system.h>
21#include <linux/bitops.h>
22#include <asm/uaccess.h>
23#include <linux/crc16.h>
24#include <linux/string.h>
25#include <linux/mm.h>
26#include <linux/interrupt.h>
27#include <linux/in.h>
28#include <linux/inet.h>
29#include <linux/tty.h>
30#include <linux/errno.h>
31#include <linux/netdevice.h>
32#include <linux/major.h>
33#include <linux/init.h>
34#include <linux/rtnetlink.h>
35#include <linux/etherdevice.h>
36#include <linux/skbuff.h>
37#include <linux/if_arp.h>
38#include <linux/jiffies.h>
39
40#include <net/ax25.h>
41
42#define AX_MTU		236
43
44/* SLIP/KISS protocol characters. */
45#define END             0300		/* indicates end of frame	*/
46#define ESC             0333		/* indicates byte stuffing	*/
47#define ESC_END         0334		/* ESC ESC_END means END 'data'	*/
48#define ESC_ESC         0335		/* ESC ESC_ESC means ESC 'data'	*/
49
50struct mkiss {
51	struct tty_struct	*tty;	/* ptr to TTY structure		*/
52	struct net_device	*dev;	/* easy for intr handling	*/
53
54	/* These are pointers to the malloc()ed frame buffers. */
55	spinlock_t		buflock;/* lock for rbuf and xbuf */
56	unsigned char		*rbuff;	/* receiver buffer		*/
57	int			rcount;	/* received chars counter       */
58	unsigned char		*xbuff;	/* transmitter buffer		*/
59	unsigned char		*xhead;	/* pointer to next byte to XMIT */
60	int			xleft;	/* bytes left in XMIT queue     */
61
62	struct net_device_stats	stats;
63
64	/* Detailed SLIP statistics. */
65	int		mtu;		/* Our mtu (to spot changes!)   */
66	int		buffsize;	/* Max buffers sizes            */
67
68	unsigned long	flags;		/* Flag values/ mode etc	*/
69					/* long req'd: used by set_bit --RR */
70#define AXF_INUSE	0		/* Channel in use               */
71#define AXF_ESCAPE	1               /* ESC received                 */
72#define AXF_ERROR	2               /* Parity, etc. error           */
73#define AXF_KEEPTEST	3		/* Keepalive test flag		*/
74#define AXF_OUTWAIT	4		/* is outpacket was flag	*/
75
76	int		mode;
77        int		crcmode;	/* MW: for FlexNet, SMACK etc.  */
78	int		crcauto;	/* CRC auto mode */
79
80#define CRC_MODE_NONE		0
81#define CRC_MODE_FLEX		1
82#define CRC_MODE_SMACK		2
83#define CRC_MODE_FLEX_TEST	3
84#define CRC_MODE_SMACK_TEST	4
85
86	atomic_t		refcnt;
87	struct semaphore	dead_sem;
88};
89
90/*---------------------------------------------------------------------------*/
91
92static const unsigned short crc_flex_table[] = {
93	0x0f87, 0x1e0e, 0x2c95, 0x3d1c, 0x49a3, 0x582a, 0x6ab1, 0x7b38,
94	0x83cf, 0x9246, 0xa0dd, 0xb154, 0xc5eb, 0xd462, 0xe6f9, 0xf770,
95	0x1f06, 0x0e8f, 0x3c14, 0x2d9d, 0x5922, 0x48ab, 0x7a30, 0x6bb9,
96	0x934e, 0x82c7, 0xb05c, 0xa1d5, 0xd56a, 0xc4e3, 0xf678, 0xe7f1,
97	0x2e85, 0x3f0c, 0x0d97, 0x1c1e, 0x68a1, 0x7928, 0x4bb3, 0x5a3a,
98	0xa2cd, 0xb344, 0x81df, 0x9056, 0xe4e9, 0xf560, 0xc7fb, 0xd672,
99	0x3e04, 0x2f8d, 0x1d16, 0x0c9f, 0x7820, 0x69a9, 0x5b32, 0x4abb,
100	0xb24c, 0xa3c5, 0x915e, 0x80d7, 0xf468, 0xe5e1, 0xd77a, 0xc6f3,
101	0x4d83, 0x5c0a, 0x6e91, 0x7f18, 0x0ba7, 0x1a2e, 0x28b5, 0x393c,
102	0xc1cb, 0xd042, 0xe2d9, 0xf350, 0x87ef, 0x9666, 0xa4fd, 0xb574,
103	0x5d02, 0x4c8b, 0x7e10, 0x6f99, 0x1b26, 0x0aaf, 0x3834, 0x29bd,
104	0xd14a, 0xc0c3, 0xf258, 0xe3d1, 0x976e, 0x86e7, 0xb47c, 0xa5f5,
105	0x6c81, 0x7d08, 0x4f93, 0x5e1a, 0x2aa5, 0x3b2c, 0x09b7, 0x183e,
106	0xe0c9, 0xf140, 0xc3db, 0xd252, 0xa6ed, 0xb764, 0x85ff, 0x9476,
107	0x7c00, 0x6d89, 0x5f12, 0x4e9b, 0x3a24, 0x2bad, 0x1936, 0x08bf,
108	0xf048, 0xe1c1, 0xd35a, 0xc2d3, 0xb66c, 0xa7e5, 0x957e, 0x84f7,
109	0x8b8f, 0x9a06, 0xa89d, 0xb914, 0xcdab, 0xdc22, 0xeeb9, 0xff30,
110	0x07c7, 0x164e, 0x24d5, 0x355c, 0x41e3, 0x506a, 0x62f1, 0x7378,
111	0x9b0e, 0x8a87, 0xb81c, 0xa995, 0xdd2a, 0xcca3, 0xfe38, 0xefb1,
112	0x1746, 0x06cf, 0x3454, 0x25dd, 0x5162, 0x40eb, 0x7270, 0x63f9,
113	0xaa8d, 0xbb04, 0x899f, 0x9816, 0xeca9, 0xfd20, 0xcfbb, 0xde32,
114	0x26c5, 0x374c, 0x05d7, 0x145e, 0x60e1, 0x7168, 0x43f3, 0x527a,
115	0xba0c, 0xab85, 0x991e, 0x8897, 0xfc28, 0xeda1, 0xdf3a, 0xceb3,
116	0x3644, 0x27cd, 0x1556, 0x04df, 0x7060, 0x61e9, 0x5372, 0x42fb,
117	0xc98b, 0xd802, 0xea99, 0xfb10, 0x8faf, 0x9e26, 0xacbd, 0xbd34,
118	0x45c3, 0x544a, 0x66d1, 0x7758, 0x03e7, 0x126e, 0x20f5, 0x317c,
119	0xd90a, 0xc883, 0xfa18, 0xeb91, 0x9f2e, 0x8ea7, 0xbc3c, 0xadb5,
120	0x5542, 0x44cb, 0x7650, 0x67d9, 0x1366, 0x02ef, 0x3074, 0x21fd,
121	0xe889, 0xf900, 0xcb9b, 0xda12, 0xaead, 0xbf24, 0x8dbf, 0x9c36,
122	0x64c1, 0x7548, 0x47d3, 0x565a, 0x22e5, 0x336c, 0x01f7, 0x107e,
123	0xf808, 0xe981, 0xdb1a, 0xca93, 0xbe2c, 0xafa5, 0x9d3e, 0x8cb7,
124	0x7440, 0x65c9, 0x5752, 0x46db, 0x3264, 0x23ed, 0x1176, 0x00ff
125};
126
127static unsigned short calc_crc_flex(unsigned char *cp, int size)
128{
129	unsigned short crc = 0xffff;
130
131	while (size--)
132		crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
133
134	return crc;
135}
136
137static int check_crc_flex(unsigned char *cp, int size)
138{
139	unsigned short crc = 0xffff;
140
141	if (size < 3)
142		return -1;
143
144	while (size--)
145		crc = (crc << 8) ^ crc_flex_table[((crc >> 8) ^ *cp++) & 0xff];
146
147	if ((crc & 0xffff) != 0x7070)
148		return -1;
149
150	return 0;
151}
152
153static int check_crc_16(unsigned char *cp, int size)
154{
155	unsigned short crc = 0x0000;
156
157	if (size < 3)
158		return -1;
159
160	crc = crc16(0, cp, size);
161
162	if (crc != 0x0000)
163		return -1;
164
165	return 0;
166}
167
168/*
169 * Standard encapsulation
170 */
171
172static int kiss_esc(unsigned char *s, unsigned char *d, int len)
173{
174	unsigned char *ptr = d;
175	unsigned char c;
176
177	/*
178	 * Send an initial END character to flush out any data that may have
179	 * accumulated in the receiver due to line noise.
180	 */
181
182	*ptr++ = END;
183
184	while (len-- > 0) {
185		switch (c = *s++) {
186		case END:
187			*ptr++ = ESC;
188			*ptr++ = ESC_END;
189			break;
190		case ESC:
191			*ptr++ = ESC;
192			*ptr++ = ESC_ESC;
193			break;
194		default:
195			*ptr++ = c;
196			break;
197		}
198	}
199
200	*ptr++ = END;
201
202	return ptr - d;
203}
204
205/*
206 * MW:
207 * OK its ugly, but tell me a better solution without copying the
208 * packet to a temporary buffer :-)
209 */
210static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
211	int len)
212{
213	unsigned char *ptr = d;
214	unsigned char c=0;
215
216	*ptr++ = END;
217	while (len > 0) {
218		if (len > 2)
219			c = *s++;
220		else if (len > 1)
221			c = crc >> 8;
222		else if (len > 0)
223			c = crc & 0xff;
224
225		len--;
226
227		switch (c) {
228		case END:
229			*ptr++ = ESC;
230			*ptr++ = ESC_END;
231			break;
232		case ESC:
233			*ptr++ = ESC;
234			*ptr++ = ESC_ESC;
235			break;
236		default:
237			*ptr++ = c;
238			break;
239		}
240	}
241	*ptr++ = END;
242
243	return ptr - d;
244}
245
246/* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
247static void ax_bump(struct mkiss *ax)
248{
249	struct sk_buff *skb;
250	int count;
251
252	spin_lock_bh(&ax->buflock);
253	if (ax->rbuff[0] > 0x0f) {
254		if (ax->rbuff[0] & 0x80) {
255			if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
256				ax->stats.rx_errors++;
257				spin_unlock_bh(&ax->buflock);
258
259				return;
260			}
261			if (ax->crcmode != CRC_MODE_SMACK && ax->crcauto) {
262				printk(KERN_INFO
263				       "mkiss: %s: Switchting to crc-smack\n",
264				       ax->dev->name);
265				ax->crcmode = CRC_MODE_SMACK;
266			}
267			ax->rcount -= 2;
268			*ax->rbuff &= ~0x80;
269		} else if (ax->rbuff[0] & 0x20)  {
270			if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
271				ax->stats.rx_errors++;
272				spin_unlock_bh(&ax->buflock);
273				return;
274			}
275			if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
276				printk(KERN_INFO
277				       "mkiss: %s: Switchting to crc-flexnet\n",
278				       ax->dev->name);
279				ax->crcmode = CRC_MODE_FLEX;
280			}
281			ax->rcount -= 2;
282
283			/*
284			 * dl9sau bugfix: the trailling two bytes flexnet crc
285			 * will not be passed to the kernel. thus we have to
286			 * correct the kissparm signature, because it indicates
287			 * a crc but there's none
288			 */
289			*ax->rbuff &= ~0x20;
290		}
291 	}
292	spin_unlock_bh(&ax->buflock);
293
294	count = ax->rcount;
295
296	if ((skb = dev_alloc_skb(count)) == NULL) {
297		printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
298		       ax->dev->name);
299		ax->stats.rx_dropped++;
300		return;
301	}
302
303	spin_lock_bh(&ax->buflock);
304	memcpy(skb_put(skb,count), ax->rbuff, count);
305	spin_unlock_bh(&ax->buflock);
306	skb->protocol = ax25_type_trans(skb, ax->dev);
307	netif_rx(skb);
308	ax->dev->last_rx = jiffies;
309	ax->stats.rx_packets++;
310	ax->stats.rx_bytes += count;
311}
312
313static void kiss_unesc(struct mkiss *ax, unsigned char s)
314{
315	switch (s) {
316	case END:
317		/* drop keeptest bit = VSV */
318		if (test_bit(AXF_KEEPTEST, &ax->flags))
319			clear_bit(AXF_KEEPTEST, &ax->flags);
320
321		if (!test_and_clear_bit(AXF_ERROR, &ax->flags) && (ax->rcount > 2))
322			ax_bump(ax);
323
324		clear_bit(AXF_ESCAPE, &ax->flags);
325		ax->rcount = 0;
326		return;
327
328	case ESC:
329		set_bit(AXF_ESCAPE, &ax->flags);
330		return;
331	case ESC_ESC:
332		if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
333			s = ESC;
334		break;
335	case ESC_END:
336		if (test_and_clear_bit(AXF_ESCAPE, &ax->flags))
337			s = END;
338		break;
339	}
340
341	spin_lock_bh(&ax->buflock);
342	if (!test_bit(AXF_ERROR, &ax->flags)) {
343		if (ax->rcount < ax->buffsize) {
344			ax->rbuff[ax->rcount++] = s;
345			spin_unlock_bh(&ax->buflock);
346			return;
347		}
348
349		ax->stats.rx_over_errors++;
350		set_bit(AXF_ERROR, &ax->flags);
351	}
352	spin_unlock_bh(&ax->buflock);
353}
354
355static int ax_set_mac_address(struct net_device *dev, void *addr)
356{
357	struct sockaddr_ax25 *sa = addr;
358
359	netif_tx_lock_bh(dev);
360	memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
361	netif_tx_unlock_bh(dev);
362
363	return 0;
364}
365
366/*---------------------------------------------------------------------------*/
367
368static void ax_changedmtu(struct mkiss *ax)
369{
370	struct net_device *dev = ax->dev;
371	unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
372	int len;
373
374	len = dev->mtu * 2;
375
376	/*
377	 * allow for arrival of larger UDP packets, even if we say not to
378	 * also fixes a bug in which SunOS sends 512-byte packets even with
379	 * an MSS of 128
380	 */
381	if (len < 576 * 2)
382		len = 576 * 2;
383
384	xbuff = kmalloc(len + 4, GFP_ATOMIC);
385	rbuff = kmalloc(len + 4, GFP_ATOMIC);
386
387	if (xbuff == NULL || rbuff == NULL)  {
388		printk(KERN_ERR "mkiss: %s: unable to grow ax25 buffers, "
389		       "MTU change cancelled.\n",
390		       ax->dev->name);
391		dev->mtu = ax->mtu;
392		kfree(xbuff);
393		kfree(rbuff);
394		return;
395	}
396
397	spin_lock_bh(&ax->buflock);
398
399	oxbuff    = ax->xbuff;
400	ax->xbuff = xbuff;
401	orbuff    = ax->rbuff;
402	ax->rbuff = rbuff;
403
404	if (ax->xleft) {
405		if (ax->xleft <= len) {
406			memcpy(ax->xbuff, ax->xhead, ax->xleft);
407		} else  {
408			ax->xleft = 0;
409			ax->stats.tx_dropped++;
410		}
411	}
412
413	ax->xhead = ax->xbuff;
414
415	if (ax->rcount) {
416		if (ax->rcount <= len) {
417			memcpy(ax->rbuff, orbuff, ax->rcount);
418		} else  {
419			ax->rcount = 0;
420			ax->stats.rx_over_errors++;
421			set_bit(AXF_ERROR, &ax->flags);
422		}
423	}
424
425	ax->mtu      = dev->mtu + 73;
426	ax->buffsize = len;
427
428	spin_unlock_bh(&ax->buflock);
429
430	kfree(oxbuff);
431	kfree(orbuff);
432}
433
434/* Encapsulate one AX.25 packet and stuff into a TTY queue. */
435static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
436{
437	struct mkiss *ax = netdev_priv(dev);
438	unsigned char *p;
439	int actual, count;
440
441	if (ax->mtu != ax->dev->mtu + 73)	/* Someone has been ifconfigging */
442		ax_changedmtu(ax);
443
444	if (len > ax->mtu) {		/* Sigh, shouldn't occur BUT ... */
445		len = ax->mtu;
446		printk(KERN_ERR "mkiss: %s: truncating oversized transmit packet!\n", ax->dev->name);
447		ax->stats.tx_dropped++;
448		netif_start_queue(dev);
449		return;
450	}
451
452	p = icp;
453
454	spin_lock_bh(&ax->buflock);
455	if ((*p & 0x0f) != 0) {
456		/* Configuration Command (kissparms(1).
457		 * Protocol spec says: never append CRC.
458		 * This fixes a very old bug in the linux
459		 * kiss driver. -- dl9sau */
460		switch (*p & 0xff) {
461		case 0x85:
462			/* command from userspace especially for us,
463			 * not for delivery to the tnc */
464			if (len > 1) {
465				int cmd = (p[1] & 0xff);
466				switch(cmd) {
467				case 3:
468				  ax->crcmode = CRC_MODE_SMACK;
469				  break;
470				case 2:
471				  ax->crcmode = CRC_MODE_FLEX;
472				  break;
473				case 1:
474				  ax->crcmode = CRC_MODE_NONE;
475				  break;
476				case 0:
477				default:
478				  ax->crcmode = CRC_MODE_SMACK_TEST;
479				  cmd = 0;
480				}
481				ax->crcauto = (cmd ? 0 : 1);
482				printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd);
483			}
484			spin_unlock_bh(&ax->buflock);
485			netif_start_queue(dev);
486
487			return;
488		default:
489			count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
490		}
491	} else {
492		unsigned short crc;
493		switch (ax->crcmode) {
494		case CRC_MODE_SMACK_TEST:
495			ax->crcmode  = CRC_MODE_FLEX_TEST;
496			printk(KERN_INFO "mkiss: %s: Trying crc-smack\n", ax->dev->name);
497			// fall through
498		case CRC_MODE_SMACK:
499			*p |= 0x80;
500			crc = swab16(crc16(0, p, len));
501			count = kiss_esc_crc(p, (unsigned char *)ax->xbuff, crc, len+2);
502			break;
503		case CRC_MODE_FLEX_TEST:
504			ax->crcmode = CRC_MODE_NONE;
505			printk(KERN_INFO "mkiss: %s: Trying crc-flexnet\n", ax->dev->name);
506			// fall through
507		case CRC_MODE_FLEX:
508			*p |= 0x20;
509			crc = calc_crc_flex(p, len);
510			count = kiss_esc_crc(p, (unsigned char *)ax->xbuff, crc, len+2);
511			break;
512
513		default:
514			count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
515		}
516  	}
517	spin_unlock_bh(&ax->buflock);
518
519	set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
520	actual = ax->tty->driver->write(ax->tty, ax->xbuff, count);
521	ax->stats.tx_packets++;
522	ax->stats.tx_bytes += actual;
523
524	ax->dev->trans_start = jiffies;
525	ax->xleft = count - actual;
526	ax->xhead = ax->xbuff + actual;
527}
528
529/* Encapsulate an AX.25 packet and kick it into a TTY queue. */
530static int ax_xmit(struct sk_buff *skb, struct net_device *dev)
531{
532	struct mkiss *ax = netdev_priv(dev);
533
534	if (!netif_running(dev))  {
535		printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
536		return 1;
537	}
538
539	if (netif_queue_stopped(dev)) {
540		/*
541		 * May be we must check transmitter timeout here ?
542		 *      14 Oct 1994 Dmitry Gorodchanin.
543		 */
544		if (time_before(jiffies, dev->trans_start + 20 * HZ)) {
545			/* 20 sec timeout not reached */
546			return 1;
547		}
548
549		printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name,
550		       (ax->tty->driver->chars_in_buffer(ax->tty) || ax->xleft) ?
551		       "bad line quality" : "driver error");
552
553		ax->xleft = 0;
554		clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
555		netif_start_queue(dev);
556	}
557
558	/* We were not busy, so we are now... :-) */
559	if (skb != NULL) {
560		netif_stop_queue(dev);
561		ax_encaps(dev, skb->data, skb->len);
562		kfree_skb(skb);
563	}
564
565	return 0;
566}
567
568static int ax_open_dev(struct net_device *dev)
569{
570	struct mkiss *ax = netdev_priv(dev);
571
572	if (ax->tty == NULL)
573		return -ENODEV;
574
575	return 0;
576}
577
578#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
579
580/* Return the frame type ID */
581static int ax_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
582	  void *daddr, void *saddr, unsigned len)
583{
584#ifdef CONFIG_INET
585	if (type != htons(ETH_P_AX25))
586		return ax25_hard_header(skb, dev, type, daddr, saddr, len);
587#endif
588	return 0;
589}
590
591
592static int ax_rebuild_header(struct sk_buff *skb)
593{
594#ifdef CONFIG_INET
595	return ax25_rebuild_header(skb);
596#else
597	return 0;
598#endif
599}
600
601#endif	/* CONFIG_{AX25,AX25_MODULE} */
602
603/* Open the low-level part of the AX25 channel. Easy! */
604static int ax_open(struct net_device *dev)
605{
606	struct mkiss *ax = netdev_priv(dev);
607	unsigned long len;
608
609	if (ax->tty == NULL)
610		return -ENODEV;
611
612	/*
613	 * Allocate the frame buffers:
614	 *
615	 * rbuff	Receive buffer.
616	 * xbuff	Transmit buffer.
617	 */
618	len = dev->mtu * 2;
619
620	/*
621	 * allow for arrival of larger UDP packets, even if we say not to
622	 * also fixes a bug in which SunOS sends 512-byte packets even with
623	 * an MSS of 128
624	 */
625	if (len < 576 * 2)
626		len = 576 * 2;
627
628	if ((ax->rbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
629		goto norbuff;
630
631	if ((ax->xbuff = kmalloc(len + 4, GFP_KERNEL)) == NULL)
632		goto noxbuff;
633
634	ax->mtu	     = dev->mtu + 73;
635	ax->buffsize = len;
636	ax->rcount   = 0;
637	ax->xleft    = 0;
638
639	ax->flags   &= (1 << AXF_INUSE);      /* Clear ESCAPE & ERROR flags */
640
641	spin_lock_init(&ax->buflock);
642
643	return 0;
644
645noxbuff:
646	kfree(ax->rbuff);
647
648norbuff:
649	return -ENOMEM;
650}
651
652
653/* Close the low-level part of the AX25 channel. Easy! */
654static int ax_close(struct net_device *dev)
655{
656	struct mkiss *ax = netdev_priv(dev);
657
658	if (ax->tty)
659		clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
660
661	netif_stop_queue(dev);
662
663	return 0;
664}
665
666static struct net_device_stats *ax_get_stats(struct net_device *dev)
667{
668	struct mkiss *ax = netdev_priv(dev);
669
670	return &ax->stats;
671}
672
673static void ax_setup(struct net_device *dev)
674{
675	/* Finish setting up the DEVICE info. */
676	dev->mtu             = AX_MTU;
677	dev->hard_start_xmit = ax_xmit;
678	dev->open            = ax_open_dev;
679	dev->stop            = ax_close;
680	dev->get_stats	     = ax_get_stats;
681	dev->set_mac_address = ax_set_mac_address;
682	dev->hard_header_len = 0;
683	dev->addr_len        = 0;
684	dev->type            = ARPHRD_AX25;
685	dev->tx_queue_len    = 10;
686	dev->hard_header     = ax_header;
687	dev->rebuild_header  = ax_rebuild_header;
688
689	memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
690	memcpy(dev->dev_addr,  &ax25_defaddr,  AX25_ADDR_LEN);
691
692	dev->flags      = IFF_BROADCAST | IFF_MULTICAST;
693}
694
695/*
696 * We have a potential race on dereferencing tty->disc_data, because the tty
697 * layer provides no locking at all - thus one cpu could be running
698 * sixpack_receive_buf while another calls sixpack_close, which zeroes
699 * tty->disc_data and frees the memory that sixpack_receive_buf is using.  The
700 * best way to fix this is to use a rwlock in the tty struct, but for now we
701 * use a single global rwlock for all ttys in ppp line discipline.
702 */
703static DEFINE_RWLOCK(disc_data_lock);
704
705static struct mkiss *mkiss_get(struct tty_struct *tty)
706{
707	struct mkiss *ax;
708
709	read_lock(&disc_data_lock);
710	ax = tty->disc_data;
711	if (ax)
712		atomic_inc(&ax->refcnt);
713	read_unlock(&disc_data_lock);
714
715	return ax;
716}
717
718static void mkiss_put(struct mkiss *ax)
719{
720	if (atomic_dec_and_test(&ax->refcnt))
721		up(&ax->dead_sem);
722}
723
724static int crc_force = 0;	/* Can be overridden with insmod */
725
726static int mkiss_open(struct tty_struct *tty)
727{
728	struct net_device *dev;
729	struct mkiss *ax;
730	int err;
731
732	if (!capable(CAP_NET_ADMIN))
733		return -EPERM;
734
735	dev = alloc_netdev(sizeof(struct mkiss), "ax%d", ax_setup);
736	if (!dev) {
737		err = -ENOMEM;
738		goto out;
739	}
740
741	ax = netdev_priv(dev);
742	ax->dev = dev;
743
744	spin_lock_init(&ax->buflock);
745	atomic_set(&ax->refcnt, 1);
746	init_MUTEX_LOCKED(&ax->dead_sem);
747
748	ax->tty = tty;
749	tty->disc_data = ax;
750	tty->receive_room = 65535;
751
752	if (tty->driver->flush_buffer)
753		tty->driver->flush_buffer(tty);
754
755	/* Restore default settings */
756	dev->type = ARPHRD_AX25;
757
758	/* Perform the low-level AX25 initialization. */
759	if ((err = ax_open(ax->dev))) {
760		goto out_free_netdev;
761	}
762
763	if (register_netdev(dev))
764		goto out_free_buffers;
765
766	/* after register_netdev() - because else printk smashes the kernel */
767	switch (crc_force) {
768	case 3:
769		ax->crcmode  = CRC_MODE_SMACK;
770		printk(KERN_INFO "mkiss: %s: crc mode smack forced.\n",
771		       ax->dev->name);
772		break;
773	case 2:
774		ax->crcmode  = CRC_MODE_FLEX;
775		printk(KERN_INFO "mkiss: %s: crc mode flexnet forced.\n",
776		       ax->dev->name);
777		break;
778	case 1:
779		ax->crcmode  = CRC_MODE_NONE;
780		printk(KERN_INFO "mkiss: %s: crc mode disabled.\n",
781		       ax->dev->name);
782		break;
783	case 0:
784		/* fall through */
785	default:
786		crc_force = 0;
787		printk(KERN_INFO "mkiss: %s: crc mode is auto.\n",
788		       ax->dev->name);
789		ax->crcmode  = CRC_MODE_SMACK_TEST;
790	}
791	ax->crcauto = (crc_force ? 0 : 1);
792
793	netif_start_queue(dev);
794
795	/* Done.  We have linked the TTY line to a channel. */
796	return 0;
797
798out_free_buffers:
799	kfree(ax->rbuff);
800	kfree(ax->xbuff);
801
802out_free_netdev:
803	free_netdev(dev);
804
805out:
806	return err;
807}
808
809static void mkiss_close(struct tty_struct *tty)
810{
811	struct mkiss *ax;
812
813	write_lock(&disc_data_lock);
814	ax = tty->disc_data;
815	tty->disc_data = NULL;
816	write_unlock(&disc_data_lock);
817
818	if (ax == 0)
819		return;
820
821	/*
822	 * We have now ensured that nobody can start using ap from now on, but
823	 * we have to wait for all existing users to finish.
824	 */
825	if (!atomic_dec_and_test(&ax->refcnt))
826		down(&ax->dead_sem);
827
828	unregister_netdev(ax->dev);
829
830	/* Free all AX25 frame buffers. */
831	kfree(ax->rbuff);
832	kfree(ax->xbuff);
833
834	ax->tty = NULL;
835}
836
837/* Perform I/O control on an active ax25 channel. */
838static int mkiss_ioctl(struct tty_struct *tty, struct file *file,
839	unsigned int cmd, unsigned long arg)
840{
841	struct mkiss *ax = mkiss_get(tty);
842	struct net_device *dev = ax->dev;
843	unsigned int tmp, err;
844
845	/* First make sure we're connected. */
846	if (ax == NULL)
847		return -ENXIO;
848
849	switch (cmd) {
850 	case SIOCGIFNAME:
851		err = copy_to_user((void __user *) arg, ax->dev->name,
852		                   strlen(ax->dev->name) + 1) ? -EFAULT : 0;
853		break;
854
855	case SIOCGIFENCAP:
856		err = put_user(4, (int __user *) arg);
857		break;
858
859	case SIOCSIFENCAP:
860		if (get_user(tmp, (int __user *) arg)) {
861			err = -EFAULT;
862			break;
863		}
864
865		ax->mode = tmp;
866		dev->addr_len        = AX25_ADDR_LEN;
867		dev->hard_header_len = AX25_KISS_HEADER_LEN +
868		                       AX25_MAX_HEADER_LEN + 3;
869		dev->type            = ARPHRD_AX25;
870
871		err = 0;
872		break;
873
874	case SIOCSIFHWADDR: {
875		char addr[AX25_ADDR_LEN];
876
877		if (copy_from_user(&addr,
878		                   (void __user *) arg, AX25_ADDR_LEN)) {
879			err = -EFAULT;
880			break;
881		}
882
883		netif_tx_lock_bh(dev);
884		memcpy(dev->dev_addr, addr, AX25_ADDR_LEN);
885		netif_tx_unlock_bh(dev);
886
887		err = 0;
888		break;
889	}
890	default:
891		err = -ENOIOCTLCMD;
892	}
893
894	mkiss_put(ax);
895
896	return err;
897}
898
899/*
900 * Handle the 'receiver data ready' interrupt.
901 * This function is called by the 'tty_io' module in the kernel when
902 * a block of data has been received, which can now be decapsulated
903 * and sent on to the AX.25 layer for further processing.
904 */
905static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
906	char *fp, int count)
907{
908	struct mkiss *ax = mkiss_get(tty);
909
910	if (!ax)
911		return;
912
913	/*
914	 * Argh! mtu change time! - costs us the packet part received
915	 * at the change
916	 */
917	if (ax->mtu != ax->dev->mtu + 73)
918		ax_changedmtu(ax);
919
920	/* Read the characters out of the buffer */
921	while (count--) {
922		if (fp != NULL && *fp++) {
923			if (!test_and_set_bit(AXF_ERROR, &ax->flags))
924				ax->stats.rx_errors++;
925			cp++;
926			continue;
927		}
928
929		kiss_unesc(ax, *cp++);
930	}
931
932	mkiss_put(ax);
933	if (test_and_clear_bit(TTY_THROTTLED, &tty->flags)
934	    && tty->driver->unthrottle)
935		tty->driver->unthrottle(tty);
936}
937
938/*
939 * Called by the driver when there's room for more data.  If we have
940 * more packets to send, we send them here.
941 */
942static void mkiss_write_wakeup(struct tty_struct *tty)
943{
944	struct mkiss *ax = mkiss_get(tty);
945	int actual;
946
947	if (!ax)
948		return;
949
950	if (ax->xleft <= 0)  {
951		/* Now serial buffer is almost free & we can start
952		 * transmission of another packet
953		 */
954		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
955
956		netif_wake_queue(ax->dev);
957		goto out;
958	}
959
960	actual = tty->driver->write(tty, ax->xhead, ax->xleft);
961	ax->xleft -= actual;
962	ax->xhead += actual;
963
964out:
965	mkiss_put(ax);
966}
967
968static struct tty_ldisc ax_ldisc = {
969	.owner		= THIS_MODULE,
970	.magic		= TTY_LDISC_MAGIC,
971	.name		= "mkiss",
972	.open		= mkiss_open,
973	.close		= mkiss_close,
974	.ioctl		= mkiss_ioctl,
975	.receive_buf	= mkiss_receive_buf,
976	.write_wakeup	= mkiss_write_wakeup
977};
978
979static char banner[] __initdata = KERN_INFO \
980	"mkiss: AX.25 Multikiss, Hans Albas PE1AYX\n";
981static char msg_regfail[] __initdata = KERN_ERR \
982	"mkiss: can't register line discipline (err = %d)\n";
983
984static int __init mkiss_init_driver(void)
985{
986	int status;
987
988	printk(banner);
989
990	if ((status = tty_register_ldisc(N_AX25, &ax_ldisc)) != 0)
991		printk(msg_regfail);
992
993	return status;
994}
995
996static const char msg_unregfail[] __exitdata = KERN_ERR \
997	"mkiss: can't unregister line discipline (err = %d)\n";
998
999static void __exit mkiss_exit_driver(void)
1000{
1001	int ret;
1002
1003	if ((ret = tty_unregister_ldisc(N_AX25)))
1004		printk(msg_unregfail, ret);
1005}
1006
1007MODULE_AUTHOR("Ralf Baechle DL5RB <ralf@linux-mips.org>");
1008MODULE_DESCRIPTION("KISS driver for AX.25 over TTYs");
1009module_param(crc_force, int, 0);
1010MODULE_PARM_DESC(crc_force, "crc [0 = auto | 1 = none | 2 = flexnet | 3 = smack]");
1011MODULE_LICENSE("GPL");
1012MODULE_ALIAS_LDISC(N_AX25);
1013
1014module_init(mkiss_init_driver);
1015module_exit(mkiss_exit_driver);
1016