1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * PPP synchronous tty channel driver for Linux. 4 * 5 * This is a ppp channel driver that can be used with tty device drivers 6 * that are frame oriented, such as synchronous HDLC devices. 7 * 8 * Complete PPP frames without encoding/decoding are exchanged between 9 * the channel driver and the device driver. 10 * 11 * The async map IOCTL codes are implemented to keep the user mode 12 * applications happy if they call them. Synchronous PPP does not use 13 * the async maps. 14 * 15 * Copyright 1999 Paul Mackerras. 16 * 17 * Also touched by the grubby hands of Paul Fulghum paulkf@microgate.com 18 * 19 * This driver provides the encapsulation and framing for sending 20 * and receiving PPP frames over sync serial lines. It relies on 21 * the generic PPP layer to give it frames to send and to process 22 * received frames. It implements the PPP line discipline. 23 * 24 * Part of the code in this driver was inspired by the old async-only 25 * PPP driver, written by Michael Callahan and Al Longyear, and 26 * subsequently hacked by Paul Mackerras. 27 * 28 * ==FILEVERSION 20040616== 29 */ 30 31 #include <linux/module.h> 32 #include <linux/kernel.h> 33 #include <linux/skbuff.h> 34 #include <linux/tty.h> 35 #include <linux/netdevice.h> 36 #include <linux/poll.h> 37 #include <linux/ppp_defs.h> 38 #include <linux/ppp-ioctl.h> 39 #include <linux/ppp_channel.h> 40 #include <linux/spinlock.h> 41 #include <linux/init.h> 42 #include <linux/interrupt.h> 43 #include <linux/slab.h> 44 #include <linux/unaligned.h> 45 #include <linux/uaccess.h> 46 47 #define PPP_VERSION "2.4.2" 48 49 /* Structure for storing local state. */ 50 struct syncppp { 51 struct tty_struct *tty; 52 unsigned int flags; 53 unsigned int rbits; 54 int mru; 55 spinlock_t xmit_lock; 56 spinlock_t recv_lock; 57 unsigned long xmit_flags; 58 u32 xaccm[8]; 59 u32 raccm; 60 61 struct sk_buff *tpkt; 62 unsigned long last_xmit; 63 64 struct sk_buff_head rqueue; 65 66 struct tasklet_struct tsk; 67 68 struct ppp_channel chan; /* interface to generic ppp layer */ 69 }; 70 71 /* Bit numbers in xmit_flags */ 72 #define XMIT_WAKEUP 0 73 #define XMIT_FULL 1 74 75 /* Bits in rbits */ 76 #define SC_RCV_BITS (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP) 77 78 #define PPPSYNC_MAX_RQLEN 32 /* arbitrary */ 79 80 /* 81 * Prototypes. 82 */ 83 static struct sk_buff* ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *); 84 static int ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb); 85 static int ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, 86 unsigned long arg); 87 static void ppp_sync_process(struct tasklet_struct *t); 88 static int ppp_sync_push(struct syncppp *ap); 89 static void ppp_sync_flush_output(struct syncppp *ap); 90 static void ppp_sync_input(struct syncppp *ap, const u8 *buf, const u8 *flags, 91 int count); 92 93 static const struct ppp_channel_ops sync_ops = { 94 .start_xmit = ppp_sync_send, 95 .ioctl = ppp_sync_ioctl, 96 }; 97 98 /* 99 * Utility procedure to print a buffer in hex/ascii 100 */ 101 static void 102 ppp_print_buffer (const char *name, const __u8 *buf, int count) 103 { 104 if (name != NULL) 105 printk(KERN_DEBUG "ppp_synctty: %s, count = %d\n", name, count); 106 107 print_hex_dump_bytes("", DUMP_PREFIX_NONE, buf, count); 108 } 109 110 111 /* 112 * Routines implementing the synchronous PPP line discipline. 113 */ 114 115 /* 116 * Called when a tty is put into sync-PPP line discipline. 117 */ 118 static int 119 ppp_sync_open(struct tty_struct *tty) 120 { 121 struct syncppp *ap; 122 int err; 123 int speed; 124 125 if (tty->ops->write == NULL) 126 return -EOPNOTSUPP; 127 128 ap = kzalloc_obj(*ap); 129 err = -ENOMEM; 130 if (!ap) 131 goto out; 132 133 /* initialize the syncppp structure */ 134 ap->tty = tty; 135 ap->mru = PPP_MRU; 136 spin_lock_init(&ap->xmit_lock); 137 spin_lock_init(&ap->recv_lock); 138 ap->xaccm[0] = ~0U; 139 ap->xaccm[3] = 0x60000000U; 140 ap->raccm = ~0U; 141 142 skb_queue_head_init(&ap->rqueue); 143 tasklet_setup(&ap->tsk, ppp_sync_process); 144 145 ap->chan.private = ap; 146 ap->chan.ops = &sync_ops; 147 ap->chan.mtu = PPP_MRU; 148 ap->chan.hdrlen = 2; /* for A/C bytes */ 149 speed = tty_get_baud_rate(tty); 150 ap->chan.speed = speed; 151 err = ppp_register_channel(&ap->chan); 152 if (err) 153 goto out_free; 154 155 tty->disc_data = ap; 156 tty->receive_room = 65536; 157 return 0; 158 159 out_free: 160 kfree(ap); 161 out: 162 return err; 163 } 164 165 /* 166 * Called when the tty is put into another line discipline or it hangs up. 167 * This call is serialized against other ldisc functions. 168 */ 169 static void 170 ppp_sync_close(struct tty_struct *tty) 171 { 172 struct syncppp *ap = tty->disc_data; 173 174 if (!ap) 175 return; 176 177 tty->disc_data = NULL; 178 tasklet_kill(&ap->tsk); 179 180 ppp_unregister_channel(&ap->chan); 181 skb_queue_purge(&ap->rqueue); 182 kfree_skb(ap->tpkt); 183 kfree(ap); 184 } 185 186 /* 187 * Read does nothing - no data is ever available this way. 188 * Pppd reads and writes packets via /dev/ppp instead. 189 */ 190 static ssize_t 191 ppp_sync_read(struct tty_struct *tty, struct file *file, u8 *buf, size_t count, 192 void **cookie, unsigned long offset) 193 { 194 return -EAGAIN; 195 } 196 197 /* 198 * Write on the tty does nothing, the packets all come in 199 * from the ppp generic stuff. 200 */ 201 static ssize_t 202 ppp_sync_write(struct tty_struct *tty, struct file *file, const u8 *buf, 203 size_t count) 204 { 205 return -EAGAIN; 206 } 207 208 static int 209 ppp_synctty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg) 210 { 211 struct syncppp *ap = tty->disc_data; 212 int __user *p = (int __user *)arg; 213 int err, val; 214 215 if (!ap) 216 return -ENXIO; 217 err = -EFAULT; 218 switch (cmd) { 219 case PPPIOCGCHAN: 220 err = -EFAULT; 221 if (put_user(ppp_channel_index(&ap->chan), p)) 222 break; 223 err = 0; 224 break; 225 226 case PPPIOCGUNIT: 227 err = -EFAULT; 228 if (put_user(ppp_unit_number(&ap->chan), p)) 229 break; 230 err = 0; 231 break; 232 233 case TCFLSH: 234 /* flush our buffers and the serial port's buffer */ 235 if (arg == TCIOFLUSH || arg == TCOFLUSH) 236 ppp_sync_flush_output(ap); 237 err = n_tty_ioctl_helper(tty, cmd, arg); 238 break; 239 240 case FIONREAD: 241 val = 0; 242 if (put_user(val, p)) 243 break; 244 err = 0; 245 break; 246 247 default: 248 err = tty_mode_ioctl(tty, cmd, arg); 249 break; 250 } 251 252 return err; 253 } 254 255 /* May sleep, don't call from interrupt level or with interrupts disabled */ 256 static void 257 ppp_sync_receive(struct tty_struct *tty, const u8 *buf, const u8 *cflags, 258 size_t count) 259 { 260 struct syncppp *ap = tty->disc_data; 261 unsigned long flags; 262 263 if (!ap) 264 return; 265 spin_lock_irqsave(&ap->recv_lock, flags); 266 ppp_sync_input(ap, buf, cflags, count); 267 spin_unlock_irqrestore(&ap->recv_lock, flags); 268 if (!skb_queue_empty(&ap->rqueue)) 269 tasklet_schedule(&ap->tsk); 270 tty_unthrottle(tty); 271 } 272 273 static void 274 ppp_sync_wakeup(struct tty_struct *tty) 275 { 276 struct syncppp *ap = tty->disc_data; 277 278 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 279 if (!ap) 280 return; 281 set_bit(XMIT_WAKEUP, &ap->xmit_flags); 282 tasklet_schedule(&ap->tsk); 283 } 284 285 286 static struct tty_ldisc_ops ppp_sync_ldisc = { 287 .owner = THIS_MODULE, 288 .num = N_SYNC_PPP, 289 .name = "pppsync", 290 .open = ppp_sync_open, 291 .close = ppp_sync_close, 292 .read = ppp_sync_read, 293 .write = ppp_sync_write, 294 .ioctl = ppp_synctty_ioctl, 295 .receive_buf = ppp_sync_receive, 296 .write_wakeup = ppp_sync_wakeup, 297 }; 298 299 static int __init 300 ppp_sync_init(void) 301 { 302 int err; 303 304 err = tty_register_ldisc(&ppp_sync_ldisc); 305 if (err != 0) 306 printk(KERN_ERR "PPP_sync: error %d registering line disc.\n", 307 err); 308 return err; 309 } 310 311 /* 312 * The following routines provide the PPP channel interface. 313 */ 314 static int 315 ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) 316 { 317 struct syncppp *ap = chan->private; 318 int err, val; 319 u32 accm[8]; 320 void __user *argp = (void __user *)arg; 321 u32 __user *p = argp; 322 323 err = -EFAULT; 324 switch (cmd) { 325 case PPPIOCGFLAGS: 326 val = ap->flags | ap->rbits; 327 if (put_user(val, (int __user *) argp)) 328 break; 329 err = 0; 330 break; 331 case PPPIOCSFLAGS: 332 if (get_user(val, (int __user *) argp)) 333 break; 334 ap->flags = val & ~SC_RCV_BITS; 335 spin_lock_irq(&ap->recv_lock); 336 ap->rbits = val & SC_RCV_BITS; 337 spin_unlock_irq(&ap->recv_lock); 338 err = 0; 339 break; 340 341 case PPPIOCGASYNCMAP: 342 if (put_user(ap->xaccm[0], p)) 343 break; 344 err = 0; 345 break; 346 case PPPIOCSASYNCMAP: 347 if (get_user(ap->xaccm[0], p)) 348 break; 349 err = 0; 350 break; 351 352 case PPPIOCGRASYNCMAP: 353 if (put_user(ap->raccm, p)) 354 break; 355 err = 0; 356 break; 357 case PPPIOCSRASYNCMAP: 358 if (get_user(ap->raccm, p)) 359 break; 360 err = 0; 361 break; 362 363 case PPPIOCGXASYNCMAP: 364 if (copy_to_user(argp, ap->xaccm, sizeof(ap->xaccm))) 365 break; 366 err = 0; 367 break; 368 case PPPIOCSXASYNCMAP: 369 if (copy_from_user(accm, argp, sizeof(accm))) 370 break; 371 accm[2] &= ~0x40000000U; /* can't escape 0x5e */ 372 accm[3] |= 0x60000000U; /* must escape 0x7d, 0x7e */ 373 memcpy(ap->xaccm, accm, sizeof(ap->xaccm)); 374 err = 0; 375 break; 376 377 case PPPIOCGMRU: 378 if (put_user(ap->mru, (int __user *) argp)) 379 break; 380 err = 0; 381 break; 382 case PPPIOCSMRU: 383 if (get_user(val, (int __user *) argp)) 384 break; 385 if (val > U16_MAX) { 386 err = -EINVAL; 387 break; 388 } 389 if (val < PPP_MRU) 390 val = PPP_MRU; 391 ap->mru = val; 392 err = 0; 393 break; 394 395 default: 396 err = -ENOTTY; 397 } 398 return err; 399 } 400 401 /* 402 * This is called at softirq level to deliver received packets 403 * to the ppp_generic code, and to tell the ppp_generic code 404 * if we can accept more output now. 405 */ 406 static void ppp_sync_process(struct tasklet_struct *t) 407 { 408 struct syncppp *ap = from_tasklet(ap, t, tsk); 409 struct sk_buff *skb; 410 411 /* process received packets */ 412 while ((skb = skb_dequeue(&ap->rqueue)) != NULL) { 413 if (skb->len == 0) { 414 /* zero length buffers indicate error */ 415 ppp_input_error(&ap->chan); 416 kfree_skb(skb); 417 } 418 else 419 ppp_input(&ap->chan, skb); 420 } 421 422 /* try to push more stuff out */ 423 if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_sync_push(ap)) 424 ppp_output_wakeup(&ap->chan); 425 } 426 427 /* 428 * Procedures for encapsulation and framing. 429 */ 430 431 static struct sk_buff* 432 ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb) 433 { 434 int proto; 435 unsigned char *data; 436 int islcp; 437 438 /* Ensure we can safely access protocol field and LCP code */ 439 if (!pskb_may_pull(skb, 3)) { 440 kfree_skb(skb); 441 return NULL; 442 } 443 data = skb->data; 444 proto = get_unaligned_be16(data); 445 446 /* LCP packets with codes between 1 (configure-request) 447 * and 7 (code-reject) must be sent as though no options 448 * have been negotiated. 449 */ 450 islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7; 451 452 /* compress protocol field if option enabled */ 453 if (data[0] == 0 && (ap->flags & SC_COMP_PROT) && !islcp) 454 skb_pull(skb,1); 455 456 /* prepend address/control fields if necessary */ 457 if ((ap->flags & SC_COMP_AC) == 0 || islcp) { 458 if (skb_cow_head(skb, 2)) { 459 kfree_skb(skb); 460 return NULL; 461 } 462 skb_push(skb,2); 463 skb->data[0] = PPP_ALLSTATIONS; 464 skb->data[1] = PPP_UI; 465 } 466 467 ap->last_xmit = jiffies; 468 469 if (skb && ap->flags & SC_LOG_OUTPKT) 470 ppp_print_buffer ("send buffer", skb->data, skb->len); 471 472 return skb; 473 } 474 475 /* 476 * Transmit-side routines. 477 */ 478 479 /* 480 * Send a packet to the peer over an sync tty line. 481 * Returns 1 iff the packet was accepted. 482 * If the packet was not accepted, we will call ppp_output_wakeup 483 * at some later time. 484 */ 485 static int 486 ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb) 487 { 488 struct syncppp *ap = chan->private; 489 490 ppp_sync_push(ap); 491 492 if (test_and_set_bit(XMIT_FULL, &ap->xmit_flags)) 493 return 0; /* already full */ 494 skb = ppp_sync_txmunge(ap, skb); 495 if (skb != NULL) 496 ap->tpkt = skb; 497 else 498 clear_bit(XMIT_FULL, &ap->xmit_flags); 499 500 ppp_sync_push(ap); 501 return 1; 502 } 503 504 /* 505 * Push as much data as possible out to the tty. 506 */ 507 static int 508 ppp_sync_push(struct syncppp *ap) 509 { 510 int sent, done = 0; 511 struct tty_struct *tty = ap->tty; 512 int tty_stuffed = 0; 513 514 if (!spin_trylock_bh(&ap->xmit_lock)) 515 return 0; 516 for (;;) { 517 if (test_and_clear_bit(XMIT_WAKEUP, &ap->xmit_flags)) 518 tty_stuffed = 0; 519 if (!tty_stuffed && ap->tpkt) { 520 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 521 sent = tty->ops->write(tty, ap->tpkt->data, ap->tpkt->len); 522 if (sent < 0) 523 goto flush; /* error, e.g. loss of CD */ 524 if (sent < ap->tpkt->len) { 525 tty_stuffed = 1; 526 } else { 527 consume_skb(ap->tpkt); 528 ap->tpkt = NULL; 529 clear_bit(XMIT_FULL, &ap->xmit_flags); 530 done = 1; 531 } 532 continue; 533 } 534 /* haven't made any progress */ 535 spin_unlock_bh(&ap->xmit_lock); 536 if (!(test_bit(XMIT_WAKEUP, &ap->xmit_flags) || 537 (!tty_stuffed && ap->tpkt))) 538 break; 539 if (!spin_trylock_bh(&ap->xmit_lock)) 540 break; 541 } 542 return done; 543 544 flush: 545 if (ap->tpkt) { 546 kfree_skb(ap->tpkt); 547 ap->tpkt = NULL; 548 clear_bit(XMIT_FULL, &ap->xmit_flags); 549 done = 1; 550 } 551 spin_unlock_bh(&ap->xmit_lock); 552 return done; 553 } 554 555 /* 556 * Flush output from our internal buffers. 557 * Called for the TCFLSH ioctl. 558 */ 559 static void 560 ppp_sync_flush_output(struct syncppp *ap) 561 { 562 int done = 0; 563 564 spin_lock_bh(&ap->xmit_lock); 565 if (ap->tpkt != NULL) { 566 kfree_skb(ap->tpkt); 567 ap->tpkt = NULL; 568 clear_bit(XMIT_FULL, &ap->xmit_flags); 569 done = 1; 570 } 571 spin_unlock_bh(&ap->xmit_lock); 572 if (done) 573 ppp_output_wakeup(&ap->chan); 574 } 575 576 /* 577 * Receive-side routines. 578 */ 579 580 /* called when the tty driver has data for us. 581 * 582 * Data is frame oriented: each call to ppp_sync_input is considered 583 * a whole frame. If the 1st flag byte is non-zero then the whole 584 * frame is considered to be in error and is tossed. 585 */ 586 static void 587 ppp_sync_input(struct syncppp *ap, const u8 *buf, const u8 *flags, int count) 588 { 589 struct sk_buff *skb; 590 unsigned char *p; 591 592 if (count == 0) 593 return; 594 595 if (ap->flags & SC_LOG_INPKT) 596 ppp_print_buffer ("receive buffer", buf, count); 597 598 /* stuff the chars in the skb */ 599 skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2); 600 if (!skb) { 601 printk(KERN_ERR "PPPsync: no memory (input pkt)\n"); 602 goto err; 603 } 604 /* Try to get the payload 4-byte aligned */ 605 if (buf[0] != PPP_ALLSTATIONS) 606 skb_reserve(skb, 2 + (buf[0] & 1)); 607 608 if (flags && *flags) { 609 /* error flag set, ignore frame */ 610 goto err; 611 } else if (count > skb_tailroom(skb)) { 612 /* packet overflowed MRU */ 613 goto err; 614 } 615 616 skb_put_data(skb, buf, count); 617 618 /* strip address/control field if present */ 619 p = skb->data; 620 if (skb->len >= 2 && p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) { 621 /* chop off address/control */ 622 if (skb->len < 3) 623 goto err; 624 p = skb_pull(skb, 2); 625 } 626 627 /* PPP packet length should be >= 2 bytes when protocol field is not 628 * compressed. 629 */ 630 if (!(p[0] & 0x01) && skb->len < 2) 631 goto err; 632 633 /* queue the frame to be processed */ 634 skb_queue_tail(&ap->rqueue, skb); 635 return; 636 637 err: 638 /* queue zero length packet as error indication */ 639 if (skb || (skb = dev_alloc_skb(0))) { 640 skb_trim(skb, 0); 641 skb_queue_tail(&ap->rqueue, skb); 642 } 643 } 644 645 static void __exit 646 ppp_sync_cleanup(void) 647 { 648 tty_unregister_ldisc(&ppp_sync_ldisc); 649 } 650 651 module_init(ppp_sync_init); 652 module_exit(ppp_sync_cleanup); 653 MODULE_DESCRIPTION("PPP synchronous TTY channel module"); 654 MODULE_LICENSE("GPL"); 655 MODULE_ALIAS_LDISC(N_SYNC_PPP); 656