1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * PPP synchronous tty channel driver for Linux. 4 * 5 * This is a ppp channel driver that can be used with tty device drivers 6 * that are frame oriented, such as synchronous HDLC devices. 7 * 8 * Complete PPP frames without encoding/decoding are exchanged between 9 * the channel driver and the device driver. 10 * 11 * The async map IOCTL codes are implemented to keep the user mode 12 * applications happy if they call them. Synchronous PPP does not use 13 * the async maps. 14 * 15 * Copyright 1999 Paul Mackerras. 16 * 17 * Also touched by the grubby hands of Paul Fulghum paulkf@microgate.com 18 * 19 * This driver provides the encapsulation and framing for sending 20 * and receiving PPP frames over sync serial lines. It relies on 21 * the generic PPP layer to give it frames to send and to process 22 * received frames. It implements the PPP line discipline. 23 * 24 * Part of the code in this driver was inspired by the old async-only 25 * PPP driver, written by Michael Callahan and Al Longyear, and 26 * subsequently hacked by Paul Mackerras. 27 * 28 * ==FILEVERSION 20040616== 29 */ 30 31 #include <linux/module.h> 32 #include <linux/kernel.h> 33 #include <linux/skbuff.h> 34 #include <linux/tty.h> 35 #include <linux/netdevice.h> 36 #include <linux/poll.h> 37 #include <linux/ppp_defs.h> 38 #include <linux/ppp-ioctl.h> 39 #include <linux/ppp_channel.h> 40 #include <linux/spinlock.h> 41 #include <linux/completion.h> 42 #include <linux/init.h> 43 #include <linux/interrupt.h> 44 #include <linux/slab.h> 45 #include <linux/refcount.h> 46 #include <linux/unaligned.h> 47 #include <linux/uaccess.h> 48 49 #define PPP_VERSION "2.4.2" 50 51 /* Structure for storing local state. */ 52 struct syncppp { 53 struct tty_struct *tty; 54 unsigned int flags; 55 unsigned int rbits; 56 int mru; 57 spinlock_t xmit_lock; 58 spinlock_t recv_lock; 59 unsigned long xmit_flags; 60 u32 xaccm[8]; 61 u32 raccm; 62 63 struct sk_buff *tpkt; 64 unsigned long last_xmit; 65 66 struct sk_buff_head rqueue; 67 68 struct tasklet_struct tsk; 69 70 refcount_t refcnt; 71 struct completion dead_cmp; 72 struct ppp_channel chan; /* interface to generic ppp layer */ 73 }; 74 75 /* Bit numbers in xmit_flags */ 76 #define XMIT_WAKEUP 0 77 #define XMIT_FULL 1 78 79 /* Bits in rbits */ 80 #define SC_RCV_BITS (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP) 81 82 #define PPPSYNC_MAX_RQLEN 32 /* arbitrary */ 83 84 /* 85 * Prototypes. 86 */ 87 static struct sk_buff* ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *); 88 static int ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb); 89 static int ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, 90 unsigned long arg); 91 static void ppp_sync_process(struct tasklet_struct *t); 92 static int ppp_sync_push(struct syncppp *ap); 93 static void ppp_sync_flush_output(struct syncppp *ap); 94 static void ppp_sync_input(struct syncppp *ap, const u8 *buf, const u8 *flags, 95 int count); 96 97 static const struct ppp_channel_ops sync_ops = { 98 .start_xmit = ppp_sync_send, 99 .ioctl = ppp_sync_ioctl, 100 }; 101 102 /* 103 * Utility procedure to print a buffer in hex/ascii 104 */ 105 static void 106 ppp_print_buffer (const char *name, const __u8 *buf, int count) 107 { 108 if (name != NULL) 109 printk(KERN_DEBUG "ppp_synctty: %s, count = %d\n", name, count); 110 111 print_hex_dump_bytes("", DUMP_PREFIX_NONE, buf, count); 112 } 113 114 115 /* 116 * Routines implementing the synchronous PPP line discipline. 117 */ 118 119 /* 120 * We have a potential race on dereferencing tty->disc_data, 121 * because the tty layer provides no locking at all - thus one 122 * cpu could be running ppp_synctty_receive while another 123 * calls ppp_synctty_close, which zeroes tty->disc_data and 124 * frees the memory that ppp_synctty_receive is using. The best 125 * way to fix this is to use a rwlock in the tty struct, but for now 126 * we use a single global rwlock for all ttys in ppp line discipline. 127 * 128 * FIXME: Fixed in tty_io nowadays. 129 */ 130 static DEFINE_RWLOCK(disc_data_lock); 131 132 static struct syncppp *sp_get(struct tty_struct *tty) 133 { 134 struct syncppp *ap; 135 136 read_lock(&disc_data_lock); 137 ap = tty->disc_data; 138 if (ap != NULL) 139 refcount_inc(&ap->refcnt); 140 read_unlock(&disc_data_lock); 141 return ap; 142 } 143 144 static void sp_put(struct syncppp *ap) 145 { 146 if (refcount_dec_and_test(&ap->refcnt)) 147 complete(&ap->dead_cmp); 148 } 149 150 /* 151 * Called when a tty is put into sync-PPP line discipline. 152 */ 153 static int 154 ppp_sync_open(struct tty_struct *tty) 155 { 156 struct syncppp *ap; 157 int err; 158 int speed; 159 160 if (tty->ops->write == NULL) 161 return -EOPNOTSUPP; 162 163 ap = kzalloc_obj(*ap); 164 err = -ENOMEM; 165 if (!ap) 166 goto out; 167 168 /* initialize the syncppp structure */ 169 ap->tty = tty; 170 ap->mru = PPP_MRU; 171 spin_lock_init(&ap->xmit_lock); 172 spin_lock_init(&ap->recv_lock); 173 ap->xaccm[0] = ~0U; 174 ap->xaccm[3] = 0x60000000U; 175 ap->raccm = ~0U; 176 177 skb_queue_head_init(&ap->rqueue); 178 tasklet_setup(&ap->tsk, ppp_sync_process); 179 180 refcount_set(&ap->refcnt, 1); 181 init_completion(&ap->dead_cmp); 182 183 ap->chan.private = ap; 184 ap->chan.ops = &sync_ops; 185 ap->chan.mtu = PPP_MRU; 186 ap->chan.hdrlen = 2; /* for A/C bytes */ 187 speed = tty_get_baud_rate(tty); 188 ap->chan.speed = speed; 189 err = ppp_register_channel(&ap->chan); 190 if (err) 191 goto out_free; 192 193 tty->disc_data = ap; 194 tty->receive_room = 65536; 195 return 0; 196 197 out_free: 198 kfree(ap); 199 out: 200 return err; 201 } 202 203 /* 204 * Called when the tty is put into another line discipline 205 * or it hangs up. We have to wait for any cpu currently 206 * executing in any of the other ppp_synctty_* routines to 207 * finish before we can call ppp_unregister_channel and free 208 * the syncppp struct. This routine must be called from 209 * process context, not interrupt or softirq context. 210 */ 211 static void 212 ppp_sync_close(struct tty_struct *tty) 213 { 214 struct syncppp *ap; 215 216 write_lock_irq(&disc_data_lock); 217 ap = tty->disc_data; 218 tty->disc_data = NULL; 219 write_unlock_irq(&disc_data_lock); 220 if (!ap) 221 return; 222 223 /* 224 * We have now ensured that nobody can start using ap from now 225 * on, but we have to wait for all existing users to finish. 226 * Note that ppp_unregister_channel ensures that no calls to 227 * our channel ops (i.e. ppp_sync_send/ioctl) are in progress 228 * by the time it returns. 229 */ 230 if (!refcount_dec_and_test(&ap->refcnt)) 231 wait_for_completion(&ap->dead_cmp); 232 tasklet_kill(&ap->tsk); 233 234 ppp_unregister_channel(&ap->chan); 235 skb_queue_purge(&ap->rqueue); 236 kfree_skb(ap->tpkt); 237 kfree(ap); 238 } 239 240 /* 241 * Called on tty hangup in process context. 242 * 243 * Wait for I/O to driver to complete and unregister PPP channel. 244 * This is already done by the close routine, so just call that. 245 */ 246 static void ppp_sync_hangup(struct tty_struct *tty) 247 { 248 ppp_sync_close(tty); 249 } 250 251 /* 252 * Read does nothing - no data is ever available this way. 253 * Pppd reads and writes packets via /dev/ppp instead. 254 */ 255 static ssize_t 256 ppp_sync_read(struct tty_struct *tty, struct file *file, u8 *buf, size_t count, 257 void **cookie, unsigned long offset) 258 { 259 return -EAGAIN; 260 } 261 262 /* 263 * Write on the tty does nothing, the packets all come in 264 * from the ppp generic stuff. 265 */ 266 static ssize_t 267 ppp_sync_write(struct tty_struct *tty, struct file *file, const u8 *buf, 268 size_t count) 269 { 270 return -EAGAIN; 271 } 272 273 static int 274 ppp_synctty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg) 275 { 276 struct syncppp *ap = sp_get(tty); 277 int __user *p = (int __user *)arg; 278 int err, val; 279 280 if (!ap) 281 return -ENXIO; 282 err = -EFAULT; 283 switch (cmd) { 284 case PPPIOCGCHAN: 285 err = -EFAULT; 286 if (put_user(ppp_channel_index(&ap->chan), p)) 287 break; 288 err = 0; 289 break; 290 291 case PPPIOCGUNIT: 292 err = -EFAULT; 293 if (put_user(ppp_unit_number(&ap->chan), p)) 294 break; 295 err = 0; 296 break; 297 298 case TCFLSH: 299 /* flush our buffers and the serial port's buffer */ 300 if (arg == TCIOFLUSH || arg == TCOFLUSH) 301 ppp_sync_flush_output(ap); 302 err = n_tty_ioctl_helper(tty, cmd, arg); 303 break; 304 305 case FIONREAD: 306 val = 0; 307 if (put_user(val, p)) 308 break; 309 err = 0; 310 break; 311 312 default: 313 err = tty_mode_ioctl(tty, cmd, arg); 314 break; 315 } 316 317 sp_put(ap); 318 return err; 319 } 320 321 /* May sleep, don't call from interrupt level or with interrupts disabled */ 322 static void 323 ppp_sync_receive(struct tty_struct *tty, const u8 *buf, const u8 *cflags, 324 size_t count) 325 { 326 struct syncppp *ap = sp_get(tty); 327 unsigned long flags; 328 329 if (!ap) 330 return; 331 spin_lock_irqsave(&ap->recv_lock, flags); 332 ppp_sync_input(ap, buf, cflags, count); 333 spin_unlock_irqrestore(&ap->recv_lock, flags); 334 if (!skb_queue_empty(&ap->rqueue)) 335 tasklet_schedule(&ap->tsk); 336 sp_put(ap); 337 tty_unthrottle(tty); 338 } 339 340 static void 341 ppp_sync_wakeup(struct tty_struct *tty) 342 { 343 struct syncppp *ap = sp_get(tty); 344 345 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 346 if (!ap) 347 return; 348 set_bit(XMIT_WAKEUP, &ap->xmit_flags); 349 tasklet_schedule(&ap->tsk); 350 sp_put(ap); 351 } 352 353 354 static struct tty_ldisc_ops ppp_sync_ldisc = { 355 .owner = THIS_MODULE, 356 .num = N_SYNC_PPP, 357 .name = "pppsync", 358 .open = ppp_sync_open, 359 .close = ppp_sync_close, 360 .hangup = ppp_sync_hangup, 361 .read = ppp_sync_read, 362 .write = ppp_sync_write, 363 .ioctl = ppp_synctty_ioctl, 364 .receive_buf = ppp_sync_receive, 365 .write_wakeup = ppp_sync_wakeup, 366 }; 367 368 static int __init 369 ppp_sync_init(void) 370 { 371 int err; 372 373 err = tty_register_ldisc(&ppp_sync_ldisc); 374 if (err != 0) 375 printk(KERN_ERR "PPP_sync: error %d registering line disc.\n", 376 err); 377 return err; 378 } 379 380 /* 381 * The following routines provide the PPP channel interface. 382 */ 383 static int 384 ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) 385 { 386 struct syncppp *ap = chan->private; 387 int err, val; 388 u32 accm[8]; 389 void __user *argp = (void __user *)arg; 390 u32 __user *p = argp; 391 392 err = -EFAULT; 393 switch (cmd) { 394 case PPPIOCGFLAGS: 395 val = ap->flags | ap->rbits; 396 if (put_user(val, (int __user *) argp)) 397 break; 398 err = 0; 399 break; 400 case PPPIOCSFLAGS: 401 if (get_user(val, (int __user *) argp)) 402 break; 403 ap->flags = val & ~SC_RCV_BITS; 404 spin_lock_irq(&ap->recv_lock); 405 ap->rbits = val & SC_RCV_BITS; 406 spin_unlock_irq(&ap->recv_lock); 407 err = 0; 408 break; 409 410 case PPPIOCGASYNCMAP: 411 if (put_user(ap->xaccm[0], p)) 412 break; 413 err = 0; 414 break; 415 case PPPIOCSASYNCMAP: 416 if (get_user(ap->xaccm[0], p)) 417 break; 418 err = 0; 419 break; 420 421 case PPPIOCGRASYNCMAP: 422 if (put_user(ap->raccm, p)) 423 break; 424 err = 0; 425 break; 426 case PPPIOCSRASYNCMAP: 427 if (get_user(ap->raccm, p)) 428 break; 429 err = 0; 430 break; 431 432 case PPPIOCGXASYNCMAP: 433 if (copy_to_user(argp, ap->xaccm, sizeof(ap->xaccm))) 434 break; 435 err = 0; 436 break; 437 case PPPIOCSXASYNCMAP: 438 if (copy_from_user(accm, argp, sizeof(accm))) 439 break; 440 accm[2] &= ~0x40000000U; /* can't escape 0x5e */ 441 accm[3] |= 0x60000000U; /* must escape 0x7d, 0x7e */ 442 memcpy(ap->xaccm, accm, sizeof(ap->xaccm)); 443 err = 0; 444 break; 445 446 case PPPIOCGMRU: 447 if (put_user(ap->mru, (int __user *) argp)) 448 break; 449 err = 0; 450 break; 451 case PPPIOCSMRU: 452 if (get_user(val, (int __user *) argp)) 453 break; 454 if (val > U16_MAX) { 455 err = -EINVAL; 456 break; 457 } 458 if (val < PPP_MRU) 459 val = PPP_MRU; 460 ap->mru = val; 461 err = 0; 462 break; 463 464 default: 465 err = -ENOTTY; 466 } 467 return err; 468 } 469 470 /* 471 * This is called at softirq level to deliver received packets 472 * to the ppp_generic code, and to tell the ppp_generic code 473 * if we can accept more output now. 474 */ 475 static void ppp_sync_process(struct tasklet_struct *t) 476 { 477 struct syncppp *ap = from_tasklet(ap, t, tsk); 478 struct sk_buff *skb; 479 480 /* process received packets */ 481 while ((skb = skb_dequeue(&ap->rqueue)) != NULL) { 482 if (skb->len == 0) { 483 /* zero length buffers indicate error */ 484 ppp_input_error(&ap->chan); 485 kfree_skb(skb); 486 } 487 else 488 ppp_input(&ap->chan, skb); 489 } 490 491 /* try to push more stuff out */ 492 if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_sync_push(ap)) 493 ppp_output_wakeup(&ap->chan); 494 } 495 496 /* 497 * Procedures for encapsulation and framing. 498 */ 499 500 static struct sk_buff* 501 ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb) 502 { 503 int proto; 504 unsigned char *data; 505 int islcp; 506 507 /* Ensure we can safely access protocol field and LCP code */ 508 if (!pskb_may_pull(skb, 3)) { 509 kfree_skb(skb); 510 return NULL; 511 } 512 data = skb->data; 513 proto = get_unaligned_be16(data); 514 515 /* LCP packets with codes between 1 (configure-request) 516 * and 7 (code-reject) must be sent as though no options 517 * have been negotiated. 518 */ 519 islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7; 520 521 /* compress protocol field if option enabled */ 522 if (data[0] == 0 && (ap->flags & SC_COMP_PROT) && !islcp) 523 skb_pull(skb,1); 524 525 /* prepend address/control fields if necessary */ 526 if ((ap->flags & SC_COMP_AC) == 0 || islcp) { 527 if (skb_headroom(skb) < 2) { 528 struct sk_buff *npkt = dev_alloc_skb(skb->len + 2); 529 if (npkt == NULL) { 530 kfree_skb(skb); 531 return NULL; 532 } 533 skb_reserve(npkt,2); 534 skb_copy_from_linear_data(skb, 535 skb_put(npkt, skb->len), skb->len); 536 consume_skb(skb); 537 skb = npkt; 538 } 539 skb_push(skb,2); 540 skb->data[0] = PPP_ALLSTATIONS; 541 skb->data[1] = PPP_UI; 542 } 543 544 ap->last_xmit = jiffies; 545 546 if (skb && ap->flags & SC_LOG_OUTPKT) 547 ppp_print_buffer ("send buffer", skb->data, skb->len); 548 549 return skb; 550 } 551 552 /* 553 * Transmit-side routines. 554 */ 555 556 /* 557 * Send a packet to the peer over an sync tty line. 558 * Returns 1 iff the packet was accepted. 559 * If the packet was not accepted, we will call ppp_output_wakeup 560 * at some later time. 561 */ 562 static int 563 ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb) 564 { 565 struct syncppp *ap = chan->private; 566 567 ppp_sync_push(ap); 568 569 if (test_and_set_bit(XMIT_FULL, &ap->xmit_flags)) 570 return 0; /* already full */ 571 skb = ppp_sync_txmunge(ap, skb); 572 if (skb != NULL) 573 ap->tpkt = skb; 574 else 575 clear_bit(XMIT_FULL, &ap->xmit_flags); 576 577 ppp_sync_push(ap); 578 return 1; 579 } 580 581 /* 582 * Push as much data as possible out to the tty. 583 */ 584 static int 585 ppp_sync_push(struct syncppp *ap) 586 { 587 int sent, done = 0; 588 struct tty_struct *tty = ap->tty; 589 int tty_stuffed = 0; 590 591 if (!spin_trylock_bh(&ap->xmit_lock)) 592 return 0; 593 for (;;) { 594 if (test_and_clear_bit(XMIT_WAKEUP, &ap->xmit_flags)) 595 tty_stuffed = 0; 596 if (!tty_stuffed && ap->tpkt) { 597 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 598 sent = tty->ops->write(tty, ap->tpkt->data, ap->tpkt->len); 599 if (sent < 0) 600 goto flush; /* error, e.g. loss of CD */ 601 if (sent < ap->tpkt->len) { 602 tty_stuffed = 1; 603 } else { 604 consume_skb(ap->tpkt); 605 ap->tpkt = NULL; 606 clear_bit(XMIT_FULL, &ap->xmit_flags); 607 done = 1; 608 } 609 continue; 610 } 611 /* haven't made any progress */ 612 spin_unlock_bh(&ap->xmit_lock); 613 if (!(test_bit(XMIT_WAKEUP, &ap->xmit_flags) || 614 (!tty_stuffed && ap->tpkt))) 615 break; 616 if (!spin_trylock_bh(&ap->xmit_lock)) 617 break; 618 } 619 return done; 620 621 flush: 622 if (ap->tpkt) { 623 kfree_skb(ap->tpkt); 624 ap->tpkt = NULL; 625 clear_bit(XMIT_FULL, &ap->xmit_flags); 626 done = 1; 627 } 628 spin_unlock_bh(&ap->xmit_lock); 629 return done; 630 } 631 632 /* 633 * Flush output from our internal buffers. 634 * Called for the TCFLSH ioctl. 635 */ 636 static void 637 ppp_sync_flush_output(struct syncppp *ap) 638 { 639 int done = 0; 640 641 spin_lock_bh(&ap->xmit_lock); 642 if (ap->tpkt != NULL) { 643 kfree_skb(ap->tpkt); 644 ap->tpkt = NULL; 645 clear_bit(XMIT_FULL, &ap->xmit_flags); 646 done = 1; 647 } 648 spin_unlock_bh(&ap->xmit_lock); 649 if (done) 650 ppp_output_wakeup(&ap->chan); 651 } 652 653 /* 654 * Receive-side routines. 655 */ 656 657 /* called when the tty driver has data for us. 658 * 659 * Data is frame oriented: each call to ppp_sync_input is considered 660 * a whole frame. If the 1st flag byte is non-zero then the whole 661 * frame is considered to be in error and is tossed. 662 */ 663 static void 664 ppp_sync_input(struct syncppp *ap, const u8 *buf, const u8 *flags, int count) 665 { 666 struct sk_buff *skb; 667 unsigned char *p; 668 669 if (count == 0) 670 return; 671 672 if (ap->flags & SC_LOG_INPKT) 673 ppp_print_buffer ("receive buffer", buf, count); 674 675 /* stuff the chars in the skb */ 676 skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2); 677 if (!skb) { 678 printk(KERN_ERR "PPPsync: no memory (input pkt)\n"); 679 goto err; 680 } 681 /* Try to get the payload 4-byte aligned */ 682 if (buf[0] != PPP_ALLSTATIONS) 683 skb_reserve(skb, 2 + (buf[0] & 1)); 684 685 if (flags && *flags) { 686 /* error flag set, ignore frame */ 687 goto err; 688 } else if (count > skb_tailroom(skb)) { 689 /* packet overflowed MRU */ 690 goto err; 691 } 692 693 skb_put_data(skb, buf, count); 694 695 /* strip address/control field if present */ 696 p = skb->data; 697 if (skb->len >= 2 && p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) { 698 /* chop off address/control */ 699 if (skb->len < 3) 700 goto err; 701 p = skb_pull(skb, 2); 702 } 703 704 /* PPP packet length should be >= 2 bytes when protocol field is not 705 * compressed. 706 */ 707 if (!(p[0] & 0x01) && skb->len < 2) 708 goto err; 709 710 /* queue the frame to be processed */ 711 skb_queue_tail(&ap->rqueue, skb); 712 return; 713 714 err: 715 /* queue zero length packet as error indication */ 716 if (skb || (skb = dev_alloc_skb(0))) { 717 skb_trim(skb, 0); 718 skb_queue_tail(&ap->rqueue, skb); 719 } 720 } 721 722 static void __exit 723 ppp_sync_cleanup(void) 724 { 725 tty_unregister_ldisc(&ppp_sync_ldisc); 726 } 727 728 module_init(ppp_sync_init); 729 module_exit(ppp_sync_cleanup); 730 MODULE_DESCRIPTION("PPP synchronous TTY channel module"); 731 MODULE_LICENSE("GPL"); 732 MODULE_ALIAS_LDISC(N_SYNC_PPP); 733