projects/linux·blob master · refs

943 lines · 21.2 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * PPP async serial channel driver for Linux.
4 *
5 * Copyright 1999 Paul Mackerras.
6 *
7 * This driver provides the encapsulation and framing for sending
8 * and receiving PPP frames over async serial lines. It relies on
9 * the generic PPP layer to give it frames to send and to process
10 * received frames. It implements the PPP line discipline.
11 *
12 * Part of the code in this driver was inspired by the old async-only
13 * PPP driver, written by Michael Callahan and Al Longyear, and
14 * subsequently hacked by Paul Mackerras.
15 */
16
17#include <linux/module.h>
18#include <linux/kernel.h>
19#include <linux/skbuff.h>
20#include <linux/tty.h>
21#include <linux/netdevice.h>
22#include <linux/poll.h>
23#include <linux/crc-ccitt.h>
24#include <linux/ppp_defs.h>
25#include <linux/ppp-ioctl.h>
26#include <linux/ppp_channel.h>
27#include <linux/spinlock.h>
28#include <linux/init.h>
29#include <linux/interrupt.h>
30#include <linux/jiffies.h>
31#include <linux/slab.h>
32#include <linux/unaligned.h>
33#include <linux/uaccess.h>
34#include <asm/string.h>
35
36#define PPP_VERSION "2.4.2"
37
38#define OBUFSIZE 4096
39
40/* Structure for storing local state. */
41struct asyncppp {
42 struct tty_struct *tty;
43 unsigned int flags;
44 unsigned int state;
45 unsigned int rbits;
46 int mru;
47 spinlock_t xmit_lock;
48 spinlock_t recv_lock;
49 unsigned long xmit_flags;
50 u32 xaccm[8];
51 u32 raccm;
52
53 struct sk_buff *tpkt;
54 int tpkt_pos;
55 u16 tfcs;
56 unsigned char *optr;
57 unsigned char *olim;
58 unsigned long last_xmit;
59
60 struct sk_buff *rpkt;
61 int lcp_fcs;
62 struct sk_buff_head rqueue;
63
64 struct tasklet_struct tsk;
65
66 struct ppp_channel chan; /* interface to generic ppp layer */
67 unsigned char obuf[OBUFSIZE];
68};
69
70/* Bit numbers in xmit_flags */
71#define XMIT_WAKEUP 0
72#define XMIT_FULL 1
73#define XMIT_BUSY 2
74
75/* State bits */
76#define SC_TOSS 1
77#define SC_ESCAPE 2
78#define SC_PREV_ERROR 4
79
80/* Bits in rbits */
81#define SC_RCV_BITS (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP)
82
83static int flag_time = HZ;
84module_param(flag_time, int, 0);
85MODULE_PARM_DESC(flag_time, "ppp_async: interval between flagged packets (in clock ticks)");
86MODULE_DESCRIPTION("PPP async serial channel module");
87MODULE_LICENSE("GPL");
88MODULE_ALIAS_LDISC(N_PPP);
89
90/*
91 * Prototypes.
92 */
93static int ppp_async_encode(struct asyncppp *ap);
94static int ppp_async_send(struct ppp_channel *chan, struct sk_buff *skb);
95static int ppp_async_push(struct asyncppp *ap);
96static void ppp_async_flush_output(struct asyncppp *ap);
97static void ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
98 const u8 *flags, int count);
99static int ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd,
100 unsigned long arg);
101static void ppp_async_process(struct tasklet_struct *t);
102
103static void async_lcp_peek(struct asyncppp *ap, unsigned char *data,
104 int len, int inbound);
105
106static const struct ppp_channel_ops async_ops = {
107 .start_xmit = ppp_async_send,
108 .ioctl = ppp_async_ioctl,
109};
110
111/*
112 * Routines implementing the PPP line discipline.
113 */
114
115/*
116 * Called when a tty is put into PPP line discipline. Called in process
117 * context.
118 */
119static int
120ppp_asynctty_open(struct tty_struct *tty)
121{
122 struct asyncppp *ap;
123 int err;
124 int speed;
125
126 if (tty->ops->write == NULL)
127 return -EOPNOTSUPP;
128
129 err = -ENOMEM;
130 ap = kzalloc_obj(*ap);
131 if (!ap)
132 goto out;
133
134 /* initialize the asyncppp structure */
135 ap->tty = tty;
136 ap->mru = PPP_MRU;
137 spin_lock_init(&ap->xmit_lock);
138 spin_lock_init(&ap->recv_lock);
139 ap->xaccm[0] = ~0U;
140 ap->xaccm[3] = 0x60000000U;
141 ap->raccm = ~0U;
142 ap->optr = ap->obuf;
143 ap->olim = ap->obuf;
144 ap->lcp_fcs = -1;
145
146 skb_queue_head_init(&ap->rqueue);
147 tasklet_setup(&ap->tsk, ppp_async_process);
148
149 ap->chan.private = ap;
150 ap->chan.ops = &async_ops;
151 ap->chan.mtu = PPP_MRU;
152 speed = tty_get_baud_rate(tty);
153 ap->chan.speed = speed;
154 err = ppp_register_channel(&ap->chan);
155 if (err)
156 goto out_free;
157
158 tty->disc_data = ap;
159 tty->receive_room = 65536;
160 return 0;
161
162 out_free:
163 kfree(ap);
164 out:
165 return err;
166}
167
168/*
169 * Called when the tty is put into another line discipline or it hangs up.
170 * This call is serialized against other ldisc functions.
171 */
172static void
173ppp_asynctty_close(struct tty_struct *tty)
174{
175 struct asyncppp *ap = tty->disc_data;
176
177 if (!ap)
178 return;
179
180 tty->disc_data = NULL;
181 tasklet_kill(&ap->tsk);
182
183 ppp_unregister_channel(&ap->chan);
184 kfree_skb(ap->rpkt);
185 skb_queue_purge(&ap->rqueue);
186 kfree_skb(ap->tpkt);
187 kfree(ap);
188}
189
190/*
191 * Read does nothing - no data is ever available this way.
192 * Pppd reads and writes packets via /dev/ppp instead.
193 */
194static ssize_t
195ppp_asynctty_read(struct tty_struct *tty, struct file *file, u8 *buf,
196 size_t count, void **cookie, unsigned long offset)
197{
198 return -EAGAIN;
199}
200
201/*
202 * Write on the tty does nothing, the packets all come in
203 * from the ppp generic stuff.
204 */
205static ssize_t
206ppp_asynctty_write(struct tty_struct *tty, struct file *file, const u8 *buf,
207 size_t count)
208{
209 return -EAGAIN;
210}
211
212/*
213 * Called in process context only. May be re-entered by multiple
214 * ioctl calling threads.
215 */
216
217static int
218ppp_asynctty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
219{
220 struct asyncppp *ap = tty->disc_data;
221 int err, val;
222 int __user *p = (int __user *)arg;
223
224 if (!ap)
225 return -ENXIO;
226 err = -EFAULT;
227 switch (cmd) {
228 case PPPIOCGCHAN:
229 err = -EFAULT;
230 if (put_user(ppp_channel_index(&ap->chan), p))
231 break;
232 err = 0;
233 break;
234
235 case PPPIOCGUNIT:
236 err = -EFAULT;
237 if (put_user(ppp_unit_number(&ap->chan), p))
238 break;
239 err = 0;
240 break;
241
242 case TCFLSH:
243 /* flush our buffers and the serial port's buffer */
244 if (arg == TCIOFLUSH || arg == TCOFLUSH)
245 ppp_async_flush_output(ap);
246 err = n_tty_ioctl_helper(tty, cmd, arg);
247 break;
248
249 case FIONREAD:
250 val = 0;
251 if (put_user(val, p))
252 break;
253 err = 0;
254 break;
255
256 default:
257 /* Try the various mode ioctls */
258 err = tty_mode_ioctl(tty, cmd, arg);
259 }
260
261 return err;
262}
263
264/* May sleep, don't call from interrupt level or with interrupts disabled */
265static void
266ppp_asynctty_receive(struct tty_struct *tty, const u8 *buf, const u8 *cflags,
267 size_t count)
268{
269 struct asyncppp *ap = tty->disc_data;
270 unsigned long flags;
271
272 if (!ap)
273 return;
274 spin_lock_irqsave(&ap->recv_lock, flags);
275 ppp_async_input(ap, buf, cflags, count);
276 spin_unlock_irqrestore(&ap->recv_lock, flags);
277 if (!skb_queue_empty(&ap->rqueue))
278 tasklet_schedule(&ap->tsk);
279 tty_unthrottle(tty);
280}
281
282static void
283ppp_asynctty_wakeup(struct tty_struct *tty)
284{
285 struct asyncppp *ap = tty->disc_data;
286
287 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
288 if (!ap)
289 return;
290 set_bit(XMIT_WAKEUP, &ap->xmit_flags);
291 tasklet_schedule(&ap->tsk);
292}
293
294
295static struct tty_ldisc_ops ppp_ldisc = {
296 .owner = THIS_MODULE,
297 .num = N_PPP,
298 .name = "ppp",
299 .open = ppp_asynctty_open,
300 .close = ppp_asynctty_close,
301 .read = ppp_asynctty_read,
302 .write = ppp_asynctty_write,
303 .ioctl = ppp_asynctty_ioctl,
304 .receive_buf = ppp_asynctty_receive,
305 .write_wakeup = ppp_asynctty_wakeup,
306};
307
308static int __init
309ppp_async_init(void)
310{
311 int err;
312
313 err = tty_register_ldisc(&ppp_ldisc);
314 if (err != 0)
315 printk(KERN_ERR "PPP_async: error %d registering line disc.\n",
316 err);
317 return err;
318}
319
320/*
321 * The following routines provide the PPP channel interface.
322 */
323static int
324ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
325{
326 struct asyncppp *ap = chan->private;
327 void __user *argp = (void __user *)arg;
328 int __user *p = argp;
329 int err, val;
330 u32 accm[8];
331
332 err = -EFAULT;
333 switch (cmd) {
334 case PPPIOCGFLAGS:
335 val = ap->flags | ap->rbits;
336 if (put_user(val, p))
337 break;
338 err = 0;
339 break;
340 case PPPIOCSFLAGS:
341 if (get_user(val, p))
342 break;
343 ap->flags = val & ~SC_RCV_BITS;
344 spin_lock_irq(&ap->recv_lock);
345 ap->rbits = val & SC_RCV_BITS;
346 spin_unlock_irq(&ap->recv_lock);
347 err = 0;
348 break;
349
350 case PPPIOCGASYNCMAP:
351 if (put_user(ap->xaccm[0], (u32 __user *)argp))
352 break;
353 err = 0;
354 break;
355 case PPPIOCSASYNCMAP:
356 if (get_user(ap->xaccm[0], (u32 __user *)argp))
357 break;
358 err = 0;
359 break;
360
361 case PPPIOCGRASYNCMAP:
362 if (put_user(ap->raccm, (u32 __user *)argp))
363 break;
364 err = 0;
365 break;
366 case PPPIOCSRASYNCMAP:
367 if (get_user(ap->raccm, (u32 __user *)argp))
368 break;
369 err = 0;
370 break;
371
372 case PPPIOCGXASYNCMAP:
373 if (copy_to_user(argp, ap->xaccm, sizeof(ap->xaccm)))
374 break;
375 err = 0;
376 break;
377 case PPPIOCSXASYNCMAP:
378 if (copy_from_user(accm, argp, sizeof(accm)))
379 break;
380 accm[2] &= ~0x40000000U; /* can't escape 0x5e */
381 accm[3] |= 0x60000000U; /* must escape 0x7d, 0x7e */
382 memcpy(ap->xaccm, accm, sizeof(ap->xaccm));
383 err = 0;
384 break;
385
386 case PPPIOCGMRU:
387 if (put_user(ap->mru, p))
388 break;
389 err = 0;
390 break;
391 case PPPIOCSMRU:
392 if (get_user(val, p))
393 break;
394 if (val > U16_MAX) {
395 err = -EINVAL;
396 break;
397 }
398 if (val < PPP_MRU)
399 val = PPP_MRU;
400 ap->mru = val;
401 err = 0;
402 break;
403
404 default:
405 err = -ENOTTY;
406 }
407
408 return err;
409}
410
411/*
412 * This is called at softirq level to deliver received packets
413 * to the ppp_generic code, and to tell the ppp_generic code
414 * if we can accept more output now.
415 */
416static void ppp_async_process(struct tasklet_struct *t)
417{
418 struct asyncppp *ap = from_tasklet(ap, t, tsk);
419 struct sk_buff *skb;
420
421 /* process received packets */
422 while ((skb = skb_dequeue(&ap->rqueue)) != NULL) {
423 if (skb->cb[0])
424 ppp_input_error(&ap->chan);
425 ppp_input(&ap->chan, skb);
426 }
427
428 /* try to push more stuff out */
429 if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_async_push(ap))
430 ppp_output_wakeup(&ap->chan);
431}
432
433/*
434 * Procedures for encapsulation and framing.
435 */
436
437/*
438 * Procedure to encode the data for async serial transmission.
439 * Does octet stuffing (escaping), puts the address/control bytes
440 * on if A/C compression is disabled, and does protocol compression.
441 * Assumes ap->tpkt != 0 on entry.
442 * Returns 1 if we finished the current frame, 0 otherwise.
443 */
444
445#define PUT_BYTE(ap, buf, c, islcp) do { \
446 if ((islcp && c < 0x20) || (ap->xaccm[c >> 5] & (1 << (c & 0x1f)))) {\
447 *buf++ = PPP_ESCAPE; \
448 *buf++ = c ^ PPP_TRANS; \
449 } else \
450 *buf++ = c; \
451} while (0)
452
453static int
454ppp_async_encode(struct asyncppp *ap)
455{
456 int fcs, i, count, c, proto;
457 unsigned char *buf, *buflim;
458 unsigned char *data;
459 int islcp;
460
461 buf = ap->obuf;
462 ap->olim = buf;
463 ap->optr = buf;
464 i = ap->tpkt_pos;
465 data = ap->tpkt->data;
466 count = ap->tpkt->len;
467 fcs = ap->tfcs;
468 proto = get_unaligned_be16(data);
469
470 /*
471 * LCP packets with code values between 1 (configure-request)
472 * and 7 (code-reject) must be sent as though no options
473 * had been negotiated.
474 */
475 islcp = proto == PPP_LCP && count >= 3 && 1 <= data[2] && data[2] <= 7;
476
477 if (i == 0) {
478 if (islcp)
479 async_lcp_peek(ap, data, count, 0);
480
481 /*
482 * Start of a new packet - insert the leading FLAG
483 * character if necessary.
484 */
485 if (islcp || flag_time == 0 ||
486 time_after_eq(jiffies, ap->last_xmit + flag_time))
487 *buf++ = PPP_FLAG;
488 ap->last_xmit = jiffies;
489 fcs = PPP_INITFCS;
490
491 /*
492 * Put in the address/control bytes if necessary
493 */
494 if ((ap->flags & SC_COMP_AC) == 0 || islcp) {
495 PUT_BYTE(ap, buf, 0xff, islcp);
496 fcs = PPP_FCS(fcs, 0xff);
497 PUT_BYTE(ap, buf, 0x03, islcp);
498 fcs = PPP_FCS(fcs, 0x03);
499 }
500 }
501
502 /*
503 * Once we put in the last byte, we need to put in the FCS
504 * and closing flag, so make sure there is at least 7 bytes
505 * of free space in the output buffer.
506 */
507 buflim = ap->obuf + OBUFSIZE - 6;
508 while (i < count && buf < buflim) {
509 c = data[i++];
510 if (i == 1 && c == 0 && (ap->flags & SC_COMP_PROT))
511 continue; /* compress protocol field */
512 fcs = PPP_FCS(fcs, c);
513 PUT_BYTE(ap, buf, c, islcp);
514 }
515
516 if (i < count) {
517 /*
518 * Remember where we are up to in this packet.
519 */
520 ap->olim = buf;
521 ap->tpkt_pos = i;
522 ap->tfcs = fcs;
523 return 0;
524 }
525
526 /*
527 * We have finished the packet. Add the FCS and flag.
528 */
529 fcs = ~fcs;
530 c = fcs & 0xff;
531 PUT_BYTE(ap, buf, c, islcp);
532 c = (fcs >> 8) & 0xff;
533 PUT_BYTE(ap, buf, c, islcp);
534 *buf++ = PPP_FLAG;
535 ap->olim = buf;
536
537 consume_skb(ap->tpkt);
538 ap->tpkt = NULL;
539 return 1;
540}
541
542/*
543 * Transmit-side routines.
544 */
545
546/*
547 * Send a packet to the peer over an async tty line.
548 * Returns 1 iff the packet was accepted.
549 * If the packet was not accepted, we will call ppp_output_wakeup
550 * at some later time.
551 */
552static int
553ppp_async_send(struct ppp_channel *chan, struct sk_buff *skb)
554{
555 struct asyncppp *ap = chan->private;
556
557 ppp_async_push(ap);
558
559 if (test_and_set_bit(XMIT_FULL, &ap->xmit_flags))
560 return 0; /* already full */
561 ap->tpkt = skb;
562 ap->tpkt_pos = 0;
563
564 ppp_async_push(ap);
565 return 1;
566}
567
568/*
569 * Push as much data as possible out to the tty.
570 */
571static int
572ppp_async_push(struct asyncppp *ap)
573{
574 int avail, sent, done = 0;
575 struct tty_struct *tty = ap->tty;
576 int tty_stuffed = 0;
577
578 /*
579 * We can get called recursively here if the tty write
580 * function calls our wakeup function. This can happen
581 * for example on a pty with both the master and slave
582 * set to PPP line discipline.
583 * We use the XMIT_BUSY bit to detect this and get out,
584 * leaving the XMIT_WAKEUP bit set to tell the other
585 * instance that it may now be able to write more now.
586 */
587 if (test_and_set_bit(XMIT_BUSY, &ap->xmit_flags))
588 return 0;
589 spin_lock_bh(&ap->xmit_lock);
590 for (;;) {
591 if (test_and_clear_bit(XMIT_WAKEUP, &ap->xmit_flags))
592 tty_stuffed = 0;
593 if (!tty_stuffed && ap->optr < ap->olim) {
594 avail = ap->olim - ap->optr;
595 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
596 sent = tty->ops->write(tty, ap->optr, avail);
597 if (sent < 0)
598 goto flush; /* error, e.g. loss of CD */
599 ap->optr += sent;
600 if (sent < avail)
601 tty_stuffed = 1;
602 continue;
603 }
604 if (ap->optr >= ap->olim && ap->tpkt) {
605 if (ppp_async_encode(ap)) {
606 /* finished processing ap->tpkt */
607 clear_bit(XMIT_FULL, &ap->xmit_flags);
608 done = 1;
609 }
610 continue;
611 }
612 /*
613 * We haven't made any progress this time around.
614 * Clear XMIT_BUSY to let other callers in, but
615 * after doing so we have to check if anyone set
616 * XMIT_WAKEUP since we last checked it. If they
617 * did, we should try again to set XMIT_BUSY and go
618 * around again in case XMIT_BUSY was still set when
619 * the other caller tried.
620 */
621 clear_bit(XMIT_BUSY, &ap->xmit_flags);
622 /* any more work to do? if not, exit the loop */
623 if (!(test_bit(XMIT_WAKEUP, &ap->xmit_flags) ||
624 (!tty_stuffed && ap->tpkt)))
625 break;
626 /* more work to do, see if we can do it now */
627 if (test_and_set_bit(XMIT_BUSY, &ap->xmit_flags))
628 break;
629 }
630 spin_unlock_bh(&ap->xmit_lock);
631 return done;
632
633flush:
634 clear_bit(XMIT_BUSY, &ap->xmit_flags);
635 if (ap->tpkt) {
636 kfree_skb(ap->tpkt);
637 ap->tpkt = NULL;
638 clear_bit(XMIT_FULL, &ap->xmit_flags);
639 done = 1;
640 }
641 ap->optr = ap->olim;
642 spin_unlock_bh(&ap->xmit_lock);
643 return done;
644}
645
646/*
647 * Flush output from our internal buffers.
648 * Called for the TCFLSH ioctl. Can be entered in parallel
649 * but this is covered by the xmit_lock.
650 */
651static void
652ppp_async_flush_output(struct asyncppp *ap)
653{
654 int done = 0;
655
656 spin_lock_bh(&ap->xmit_lock);
657 ap->optr = ap->olim;
658 if (ap->tpkt != NULL) {
659 kfree_skb(ap->tpkt);
660 ap->tpkt = NULL;
661 clear_bit(XMIT_FULL, &ap->xmit_flags);
662 done = 1;
663 }
664 spin_unlock_bh(&ap->xmit_lock);
665 if (done)
666 ppp_output_wakeup(&ap->chan);
667}
668
669/*
670 * Receive-side routines.
671 */
672
673/* see how many ordinary chars there are at the start of buf */
674static inline int
675scan_ordinary(struct asyncppp *ap, const unsigned char *buf, int count)
676{
677 int i, c;
678
679 for (i = 0; i < count; ++i) {
680 c = buf[i];
681 if (c == PPP_ESCAPE || c == PPP_FLAG ||
682 (c < 0x20 && (ap->raccm & (1 << c)) != 0))
683 break;
684 }
685 return i;
686}
687
688/* called when a flag is seen - do end-of-packet processing */
689static void
690process_input_packet(struct asyncppp *ap)
691{
692 struct sk_buff *skb;
693 unsigned char *p;
694 unsigned int len, fcs;
695
696 skb = ap->rpkt;
697 if (ap->state & (SC_TOSS | SC_ESCAPE))
698 goto err;
699
700 if (skb == NULL)
701 return; /* 0-length packet */
702
703 /* check the FCS */
704 p = skb->data;
705 len = skb->len;
706 if (len < 3)
707 goto err; /* too short */
708 fcs = PPP_INITFCS;
709 for (; len > 0; --len)
710 fcs = PPP_FCS(fcs, *p++);
711 if (fcs != PPP_GOODFCS)
712 goto err; /* bad FCS */
713 skb_trim(skb, skb->len - 2);
714
715 /* check for address/control and protocol compression */
716 p = skb->data;
717 if (p[0] == PPP_ALLSTATIONS) {
718 /* chop off address/control */
719 if (p[1] != PPP_UI || skb->len < 3)
720 goto err;
721 p = skb_pull(skb, 2);
722 }
723
724 /* If protocol field is not compressed, it can be LCP packet */
725 if (!(p[0] & 0x01)) {
726 unsigned int proto;
727
728 if (skb->len < 2)
729 goto err;
730 proto = (p[0] << 8) + p[1];
731 if (proto == PPP_LCP)
732 async_lcp_peek(ap, p, skb->len, 1);
733 }
734
735 /* queue the frame to be processed */
736 skb->cb[0] = ap->state;
737 skb_queue_tail(&ap->rqueue, skb);
738 ap->rpkt = NULL;
739 ap->state = 0;
740 return;
741
742 err:
743 /* frame had an error, remember that, reset SC_TOSS & SC_ESCAPE */
744 ap->state = SC_PREV_ERROR;
745 kfree_skb(skb);
746 ap->rpkt = NULL;
747}
748
749/* Called when the tty driver has data for us. Runs parallel with the
750 other ldisc functions but will not be re-entered */
751
752static void
753ppp_async_input(struct asyncppp *ap, const u8 *buf, const u8 *flags, int count)
754{
755 struct sk_buff *skb;
756 int c, i, j, n, s, f;
757 unsigned char *sp;
758
759 /* update bits used for 8-bit cleanness detection */
760 if (~ap->rbits & SC_RCV_BITS) {
761 s = 0;
762 for (i = 0; i < count; ++i) {
763 c = buf[i];
764 if (flags && flags[i] != 0)
765 continue;
766 s |= (c & 0x80)? SC_RCV_B7_1: SC_RCV_B7_0;
767 c = ((c >> 4) ^ c) & 0xf;
768 s |= (0x6996 & (1 << c))? SC_RCV_ODDP: SC_RCV_EVNP;
769 }
770 ap->rbits |= s;
771 }
772
773 while (count > 0) {
774 /* scan through and see how many chars we can do in bulk */
775 if ((ap->state & SC_ESCAPE) && buf[0] == PPP_ESCAPE)
776 n = 1;
777 else
778 n = scan_ordinary(ap, buf, count);
779
780 f = 0;
781 if (flags && (ap->state & SC_TOSS) == 0) {
782 /* check the flags to see if any char had an error */
783 for (j = 0; j < n; ++j)
784 if ((f = flags[j]) != 0)
785 break;
786 }
787 if (f != 0) {
788 /* start tossing */
789 ap->state |= SC_TOSS;
790
791 } else if (n > 0 && (ap->state & SC_TOSS) == 0) {
792 /* stuff the chars in the skb */
793 skb = ap->rpkt;
794 if (!skb) {
795 skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2);
796 if (!skb)
797 goto nomem;
798 ap->rpkt = skb;
799 }
800 if (skb->len == 0) {
801 /* Try to get the payload 4-byte aligned.
802 * This should match the
803 * PPP_ALLSTATIONS/PPP_UI/compressed tests in
804 * process_input_packet, but we do not have
805 * enough chars here to test buf[1] and buf[2].
806 */
807 if (buf[0] != PPP_ALLSTATIONS)
808 skb_reserve(skb, 2 + (buf[0] & 1));
809 }
810 if (n > skb_tailroom(skb)) {
811 /* packet overflowed MRU */
812 ap->state |= SC_TOSS;
813 } else {
814 sp = skb_put_data(skb, buf, n);
815 if (ap->state & SC_ESCAPE) {
816 sp[0] ^= PPP_TRANS;
817 ap->state &= ~SC_ESCAPE;
818 }
819 }
820 }
821
822 if (n >= count)
823 break;
824
825 c = buf[n];
826 if (flags != NULL && flags[n] != 0) {
827 ap->state |= SC_TOSS;
828 } else if (c == PPP_FLAG) {
829 process_input_packet(ap);
830 } else if (c == PPP_ESCAPE) {
831 ap->state |= SC_ESCAPE;
832 } else if (I_IXON(ap->tty)) {
833 if (c == START_CHAR(ap->tty))
834 start_tty(ap->tty);
835 else if (c == STOP_CHAR(ap->tty))
836 stop_tty(ap->tty);
837 }
838 /* otherwise it's a char in the recv ACCM */
839 ++n;
840
841 buf += n;
842 if (flags)
843 flags += n;
844 count -= n;
845 }
846 return;
847
848 nomem:
849 printk(KERN_ERR "PPPasync: no memory (input pkt)\n");
850 ap->state |= SC_TOSS;
851}
852
853/*
854 * We look at LCP frames going past so that we can notice
855 * and react to the LCP configure-ack from the peer.
856 * In the situation where the peer has been sent a configure-ack
857 * already, LCP is up once it has sent its configure-ack
858 * so the immediately following packet can be sent with the
859 * configured LCP options. This allows us to process the following
860 * packet correctly without pppd needing to respond quickly.
861 *
862 * We only respond to the received configure-ack if we have just
863 * sent a configure-request, and the configure-ack contains the
864 * same data (this is checked using a 16-bit crc of the data).
865 */
866#define CONFREQ 1 /* LCP code field values */
867#define CONFACK 2
868#define LCP_MRU 1 /* LCP option numbers */
869#define LCP_ASYNCMAP 2
870
871static void async_lcp_peek(struct asyncppp *ap, unsigned char *data,
872 int len, int inbound)
873{
874 int dlen, fcs, i, code;
875 u32 val;
876
877 data += 2; /* skip protocol bytes */
878 len -= 2;
879 if (len < 4) /* 4 = code, ID, length */
880 return;
881 code = data[0];
882 if (code != CONFACK && code != CONFREQ)
883 return;
884 dlen = get_unaligned_be16(data + 2);
885 if (len < dlen)
886 return; /* packet got truncated or length is bogus */
887
888 if (code == (inbound? CONFACK: CONFREQ)) {
889 /*
890 * sent confreq or received confack:
891 * calculate the crc of the data from the ID field on.
892 */
893 fcs = PPP_INITFCS;
894 for (i = 1; i < dlen; ++i)
895 fcs = PPP_FCS(fcs, data[i]);
896
897 if (!inbound) {
898 /* outbound confreq - remember the crc for later */
899 ap->lcp_fcs = fcs;
900 return;
901 }
902
903 /* received confack, check the crc */
904 fcs ^= ap->lcp_fcs;
905 ap->lcp_fcs = -1;
906 if (fcs != 0)
907 return;
908 } else if (inbound)
909 return; /* not interested in received confreq */
910
911 /* process the options in the confack */
912 data += 4;
913 dlen -= 4;
914 /* data[0] is code, data[1] is length */
915 while (dlen >= 2 && dlen >= data[1] && data[1] >= 2) {
916 switch (data[0]) {
917 case LCP_MRU:
918 val = get_unaligned_be16(data + 2);
919 if (inbound)
920 ap->mru = val;
921 else
922 ap->chan.mtu = val;
923 break;
924 case LCP_ASYNCMAP:
925 val = get_unaligned_be32(data + 2);
926 if (inbound)
927 ap->raccm = val;
928 else
929 ap->xaccm[0] = val;
930 break;
931 }
932 dlen -= data[1];
933 data += data[1];
934 }
935}
936
937static void __exit ppp_async_cleanup(void)
938{
939 tty_unregister_ldisc(&ppp_ldisc);
940}
941
942module_init(ppp_async_init);
943module_exit(ppp_async_cleanup);