linux/ppp.c

   1 /*  PPP for Linux
   2  *
   3  *  Michael Callahan <callahan@maths.ox.ac.uk>
   4  *  Al Longyear <longyear@netcom.com>
   5  *  Extensively rewritten by Paul Mackerras <paulus@cs.anu.edu.au>
   6  *
   7  *  ==FILEVERSION 990412==
   8  *
   9  *  NOTE TO MAINTAINERS:
  10  *     If you modify this file at all, please set the number above to the
  11  *     date of the modification as YYMMDD (year month day).
  12  *     ppp.c is shipped with a PPP distribution as well as with the kernel;
  13  *     if everyone increases the FILEVERSION number above, then scripts
  14  *     can do the right thing when deciding whether to install a new ppp.c
  15  *     file.  Don't change the format of that line otherwise, so the
  16  *     installation script can recognize it.
  17  */
  18
  19 /*
  20    Sources:
  21
  22    slip.c
  23
  24    RFC1331: The Point-to-Point Protocol (PPP) for the Transmission of
  25    Multi-protocol Datagrams over Point-to-Point Links
  26
  27    RFC1332: IPCP
  28
  29    ppp-2.0
  30
  31    Flags for this module (any combination is acceptable for testing.):
  32
  33    OPTIMIZE_FLAG_TIME - Number of jiffies to force sending of leading flag
  34                         character. This is normally set to ((HZ * 3) / 2).
  35                         This is 1.5 seconds. If zero then the leading
  36                         flag is always sent.
  37
  38    CHECK_CHARACTERS   - Enable the checking on all received characters for
  39                         8 data bits, no parity. This adds a small amount of
  40                         processing for each received character.
  41 */
  42
  43 #define OPTIMIZE_FLAG_TIME      ((HZ * 3)/2)
  44 #define CHECK_CHARACTERS        1
  45
  46 #define PPP_MAX_RCV_QLEN        32      /* max # frames we queue up for pppd */
  47
  48 /* $Id: ppp.c,v 1.25 1999/04/16 11:29:13 paulus Exp $ */
  49
  50 #include <linux/version.h>
  51 #include <linux/config.h>
  52 #include <linux/module.h>
  53 #include <linux/kernel.h>
  54 #include <linux/sched.h>
  55 #include <linux/types.h>
  56 #include <linux/fcntl.h>
  57 #include <linux/interrupt.h>
  58 #include <linux/ptrace.h>
  59
  60 /* a macro to generate linux version number codes */
  61 #define VERSION(major,minor,patch) (((((major)<<8)+(minor))<<8)+(patch))
  62
  63 #if LINUX_VERSION_CODE < VERSION(2,1,14)
  64 #include <linux/ioport.h>
  65 #endif
  66
  67 #if LINUX_VERSION_CODE >= VERSION(2,1,23)
  68 #include <linux/poll.h>
  69 #endif
  70
  71 #include <linux/in.h>
  72 #include <linux/malloc.h>
  73 #include <linux/tty.h>
  74 #include <linux/errno.h>
  75 #include <linux/sched.h>        /* to get the struct task_struct */
  76 #include <linux/string.h>       /* used in new tty drivers */
  77 #include <linux/signal.h>       /* used in new tty drivers */
  78 #include <asm/system.h>
  79 #include <asm/bitops.h>
  80 #include <linux/if.h>
  81 #include <linux/if_ether.h>
  82 #include <linux/netdevice.h>
  83 #include <linux/skbuff.h>
  84 #include <linux/inet.h>
  85 #include <linux/ioctl.h>
  86 #include <linux/ip.h>
  87 #include <linux/tcp.h>
  88 #include <linux/if_arp.h>
  89 #include <net/slhc_vj.h>
  90
  91 #define fcstab  ppp_crc16_table         /* Name of the table in the kernel */
  92 #include <linux/ppp_defs.h>
  93
  94 #include <linux/socket.h>
  95 #include <linux/if_ppp.h>
  96 #include <linux/if_pppvar.h>
  97 #include <linux/ppp-comp.h>
  98
  99 #ifdef CONFIG_KMOD
 100 #include <linux/kmod.h>
 101 #endif
 102 #ifdef CONFIG_KERNELD
 103 #include <linux/kerneld.h>
 104 #endif
 105
 106 #undef PPP_VERSION
 107 #define PPP_VERSION     "2.3.7"
 108
 109 #if LINUX_VERSION_CODE >= VERSION(2,1,4)
 110
 111 #if LINUX_VERSION_CODE >= VERSION(2,1,5)
 112 #include <asm/uaccess.h>
 113 #else
 114 #include <asm/segment.h>
 115 #endif
 116
 117 #define GET_USER        get_user
 118 #define PUT_USER        put_user
 119 #define COPY_FROM_USER  copy_from_user
 120 #define COPY_TO_USER    copy_to_user
 121
 122 #else  /* 2.0.x and 2.1.x before 2.1.4 */
 123
 124 #define GET_USER(val, src)      \
 125         (verify_area(VERIFY_READ, src, sizeof(*src))? -EFAULT: \
 126          ((val) = get_user(src), 0))
 127 #define PUT_USER(val, dst)      \
 128         (verify_area(VERIFY_WRITE, dst, sizeof(*dst))? -EFAULT: \
 129          (put_user(val, dst), 0))
 130 #define COPY_FROM_USER(dst, src, size)  \
 131         (verify_area(VERIFY_READ, src, size)? -EFAULT: \
 132          (memcpy_fromfs(dst, src, size), 0))
 133 #define COPY_TO_USER(dst, src, size)    \
 134         (verify_area(VERIFY_WRITE, dst, size)? -EFAULT: \
 135          (memcpy_tofs(dst, src, size), 0))
 136
 137 #endif /* < 2.1.4 */
 138
 139 #if LINUX_VERSION_CODE < VERSION(2,1,37)
 140 #define test_and_set_bit(nr, addr)      set_bit(nr, addr)
 141 #endif
 142
 143 #if LINUX_VERSION_CODE < VERSION(2,1,25)
 144 #define net_device_stats        enet_statistics
 145 #endif
 146
 147 #if LINUX_VERSION_CODE < VERSION(2,1,57)
 148 #define signal_pending(tsk)     ((tsk)->signal & ~(tsk)->blocked)
 149 #endif
 150
 151 #if LINUX_VERSION_CODE < VERSION(2,1,60)
 152 typedef int             rw_ret_t;
 153 typedef unsigned int    rw_count_t;
 154 #else
 155 typedef ssize_t         rw_ret_t;
 156 typedef size_t          rw_count_t;
 157 #endif
 158
 159 #if LINUX_VERSION_CODE < VERSION(2,1,86)
 160 #define KFREE_SKB(s)    dev_kfree_skb((s), FREE_WRITE)
 161 #else
 162 #define KFREE_SKB(s)    kfree_skb(s)
 163 #endif
 164
 165 #if LINUX_VERSION_CODE < VERSION(2,1,15)
 166 #define LIBERATE_SKB(s) ((s)->free = 1)
 167 #else
 168 #define LIBERATE_SKB(s) do { } while (0)
 169 #endif
 170
 171 #if LINUX_VERSION_CODE < VERSION(2,1,95)
 172 #define SUSER()         suser()
 173 #else
 174 #define SUSER()         capable(CAP_NET_ADMIN)
 175 #endif
 176
 177 /*
 178  * Local functions
 179  */
 180
 181 #ifdef CONFIG_MODULES
 182 static int ppp_register_compressor (struct compressor *cp);
 183 static void ppp_unregister_compressor (struct compressor *cp);
 184 #endif
 185
 186 static void ppp_async_init(struct ppp *ppp);
 187 static void ppp_async_release(struct ppp *ppp);
 188 static int ppp_tty_sync_push(struct ppp *ppp);
 189 static int ppp_tty_push(struct ppp *ppp);
 190 static int ppp_async_encode(struct ppp *ppp);
 191 static int ppp_async_send(struct ppp *, struct sk_buff *);
 192 static int ppp_sync_send(struct ppp *, struct sk_buff *);
 193
 194 static int ppp_ioctl(struct ppp *, unsigned int, unsigned long);
 195 static int ppp_set_compression (struct ppp *ppp, struct ppp_option_data *odp);
 196 static void ppp_proto_ccp(struct ppp *ppp, __u8 *dp, int len, int rcvd);
 197 static void ppp_ccp_closed(struct ppp *ppp);
 198 static int ppp_receive_frame(struct ppp *, struct sk_buff *);
 199 static void ppp_receive_error(struct ppp *ppp);
 200 static void ppp_output_wakeup(struct ppp *ppp);
 201 static void ppp_send_ctrl(struct ppp *ppp, struct sk_buff *skb);
 202 static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);
 203 static void ppp_send_frames(struct ppp *ppp);
 204 static struct sk_buff *ppp_vj_compress(struct ppp *ppp, struct sk_buff *skb);
 205
 206 static struct ppp *ppp_find (int pid_value);
 207 static struct ppp *ppp_alloc (void);
 208 static void ppp_generic_init(struct ppp *ppp);
 209 static void ppp_release(struct ppp *ppp);
 210 static void ppp_print_buffer (const char *, const __u8 *, int);
 211 static struct compressor *find_compressor (int type);
 212
 213 #ifndef OPTIMIZE_FLAG_TIME
 214 #define OPTIMIZE_FLAG_TIME      0
 215 #endif
 216
 217 /*
 218  * Parameters which may be changed via insmod.
 219  */
 220
 221 static int  flag_time = OPTIMIZE_FLAG_TIME;
 222 #if LINUX_VERSION_CODE >= VERSION(2,1,19)
 223 MODULE_PARM(flag_time, "i");
 224 #endif
 225
 226 #define CHECK_PPP_MAGIC(ppp)    do { \
 227         if (ppp->magic != PPP_MAGIC) { \
 228                 printk(ppp_magic_warn, ppp, __FILE__, __LINE__); \
 229         } \
 230 } while (0)
 231 #define CHECK_PPP(a)    do { \
 232         CHECK_PPP_MAGIC(ppp); \
 233         if (!ppp->inuse) { \
 234                 printk(ppp_warning, __LINE__); \
 235                 return a; \
 236         } \
 237 } while (0)
 238 #define CHECK_PPP_VOID() do { \
 239         CHECK_PPP_MAGIC(ppp); \
 240         if (!ppp->inuse) { \
 241                 printk(ppp_warning, __LINE__); \
 242                 return; \
 243         } \
 244 } while (0)
 245
 246 #define tty2ppp(tty)    ((struct ppp *) ((tty)->disc_data))
 247 #define dev2ppp(dev)    ((struct ppp *) ((dev)->priv))
 248 #define ppp2tty(ppp)    ((ppp)->tty)
 249 #define ppp2dev(ppp)    (&(ppp)->dev)
 250
 251 static struct ppp *ppp_list = NULL;
 252 static struct ppp *ppp_last = NULL;
 253
 254 /* Define these strings only once for all macro invocations */
 255 static char ppp_warning[] = KERN_WARNING "PPP: ALERT! not INUSE! %d\n";
 256 static char ppp_magic_warn[] = KERN_WARNING "bad magic for ppp %p at %s:%d\n";
 257
 258 static char szVersion[]         = PPP_VERSION;
 259
 260 #if LINUX_VERSION_CODE < VERSION(2,1,18)
 261 static struct symbol_table ppp_syms = {
 262 #include <linux/symtab_begin.h>
 263         X(ppp_register_compressor),
 264         X(ppp_unregister_compressor),
 265 #include <linux/symtab_end.h>
 266 };
 267 #else
 268 EXPORT_SYMBOL(ppp_register_compressor);
 269 EXPORT_SYMBOL(ppp_unregister_compressor);
 270 #endif
 271
 272 /*************************************************************
 273  * LINE DISCIPLINE SUPPORT
 274  *    The following code implements the PPP line discipline
 275  *    and supports using PPP on an async serial line.
 276  *************************************************************/
 277
 278 #define in_xmap(ppp,c)  (ppp->xmit_async_map[(c) >> 5] & (1 << ((c) & 0x1f)))
 279 #define in_rmap(ppp,c)  ((((unsigned int) (__u8) (c)) < 0x20) && \
 280                         ppp->recv_async_map & (1 << (c)))
 281
 282 /*
 283  * TTY callbacks
 284  */
 285
 286 static rw_ret_t ppp_tty_read(struct tty_struct *, struct file *, __u8 *,
 287                              rw_count_t);
 288 static rw_ret_t ppp_tty_write(struct tty_struct *, struct file *, const __u8 *,
 289                               rw_count_t);
 290 static int ppp_tty_ioctl(struct tty_struct *, struct file *, unsigned int,
 291                          unsigned long);
 292 #if LINUX_VERSION_CODE < VERSION(2,1,23)
 293 static int ppp_tty_select(struct tty_struct *tty, struct inode *inode,
 294                         struct file *filp, int sel_type, select_table * wait);
 295 #else
 296 static unsigned int ppp_tty_poll(struct tty_struct *tty, struct file *filp,
 297                                  poll_table * wait);
 298 #endif
 299 static int ppp_tty_open (struct tty_struct *);
 300 static void ppp_tty_close (struct tty_struct *);
 301 static int ppp_tty_room (struct tty_struct *tty);
 302 static void ppp_tty_receive (struct tty_struct *tty, const __u8 * cp,
 303                              char *fp, int count);
 304 static void ppp_tty_wakeup (struct tty_struct *tty);
 305
 306 __u16 ppp_crc16_table[256] =
 307 {
 308         0x0000, 0x1189, 0x2312, 0x329b, 0x4624, 0x57ad, 0x6536, 0x74bf,
 309         0x8c48, 0x9dc1, 0xaf5a, 0xbed3, 0xca6c, 0xdbe5, 0xe97e, 0xf8f7,
 310         0x1081, 0x0108, 0x3393, 0x221a, 0x56a5, 0x472c, 0x75b7, 0x643e,
 311         0x9cc9, 0x8d40, 0xbfdb, 0xae52, 0xdaed, 0xcb64, 0xf9ff, 0xe876,
 312         0x2102, 0x308b, 0x0210, 0x1399, 0x6726, 0x76af, 0x4434, 0x55bd,
 313         0xad4a, 0xbcc3, 0x8e58, 0x9fd1, 0xeb6e, 0xfae7, 0xc87c, 0xd9f5,
 314         0x3183, 0x200a, 0x1291, 0x0318, 0x77a7, 0x662e, 0x54b5, 0x453c,
 315         0xbdcb, 0xac42, 0x9ed9, 0x8f50, 0xfbef, 0xea66, 0xd8fd, 0xc974,
 316         0x4204, 0x538d, 0x6116, 0x709f, 0x0420, 0x15a9, 0x2732, 0x36bb,
 317         0xce4c, 0xdfc5, 0xed5e, 0xfcd7, 0x8868, 0x99e1, 0xab7a, 0xbaf3,
 318         0x5285, 0x430c, 0x7197, 0x601e, 0x14a1, 0x0528, 0x37b3, 0x263a,
 319         0xdecd, 0xcf44, 0xfddf, 0xec56, 0x98e9, 0x8960, 0xbbfb, 0xaa72,
 320         0x6306, 0x728f, 0x4014, 0x519d, 0x2522, 0x34ab, 0x0630, 0x17b9,
 321         0xef4e, 0xfec7, 0xcc5c, 0xddd5, 0xa96a, 0xb8e3, 0x8a78, 0x9bf1,
 322         0x7387, 0x620e, 0x5095, 0x411c, 0x35a3, 0x242a, 0x16b1, 0x0738,
 323         0xffcf, 0xee46, 0xdcdd, 0xcd54, 0xb9eb, 0xa862, 0x9af9, 0x8b70,
 324         0x8408, 0x9581, 0xa71a, 0xb693, 0xc22c, 0xd3a5, 0xe13e, 0xf0b7,
 325         0x0840, 0x19c9, 0x2b52, 0x3adb, 0x4e64, 0x5fed, 0x6d76, 0x7cff,
 326         0x9489, 0x8500, 0xb79b, 0xa612, 0xd2ad, 0xc324, 0xf1bf, 0xe036,
 327         0x18c1, 0x0948, 0x3bd3, 0x2a5a, 0x5ee5, 0x4f6c, 0x7df7, 0x6c7e,
 328         0xa50a, 0xb483, 0x8618, 0x9791, 0xe32e, 0xf2a7, 0xc03c, 0xd1b5,
 329         0x2942, 0x38cb, 0x0a50, 0x1bd9, 0x6f66, 0x7eef, 0x4c74, 0x5dfd,
 330         0xb58b, 0xa402, 0x9699, 0x8710, 0xf3af, 0xe226, 0xd0bd, 0xc134,
 331         0x39c3, 0x284a, 0x1ad1, 0x0b58, 0x7fe7, 0x6e6e, 0x5cf5, 0x4d7c,
 332         0xc60c, 0xd785, 0xe51e, 0xf497, 0x8028, 0x91a1, 0xa33a, 0xb2b3,
 333         0x4a44, 0x5bcd, 0x6956, 0x78df, 0x0c60, 0x1de9, 0x2f72, 0x3efb,
 334         0xd68d, 0xc704, 0xf59f, 0xe416, 0x90a9, 0x8120, 0xb3bb, 0xa232,
 335         0x5ac5, 0x4b4c, 0x79d7, 0x685e, 0x1ce1, 0x0d68, 0x3ff3, 0x2e7a,
 336         0xe70e, 0xf687, 0xc41c, 0xd595, 0xa12a, 0xb0a3, 0x8238, 0x93b1,
 337         0x6b46, 0x7acf, 0x4854, 0x59dd, 0x2d62, 0x3ceb, 0x0e70, 0x1ff9,
 338         0xf78f, 0xe606, 0xd49d, 0xc514, 0xb1ab, 0xa022, 0x92b9, 0x8330,
 339         0x7bc7, 0x6a4e, 0x58d5, 0x495c, 0x3de3, 0x2c6a, 0x1ef1, 0x0f78
 340 };
 341
 342 #ifdef CHECK_CHARACTERS
 343 static __u32 paritytab[8] =
 344 {
 345         0x96696996, 0x69969669, 0x69969669, 0x96696996,
 346         0x69969669, 0x96696996, 0x96696996, 0x69969669
 347 };
 348 #endif
 349
 350 /*
 351  * This procedure is called at initialization time to register
 352  * the PPP line discipline.
 353  */
 354 static int
 355 ppp_first_time(void)
 356 {
 357         static struct tty_ldisc ppp_ldisc;
 358         int    status;
 359
 360         printk(KERN_INFO
 361                "PPP: version %s (demand dialling)"
 362                "\n", szVersion);
 363
 364 #ifndef MODULE /* slhc module logic has its own copyright announcement */
 365         printk(KERN_INFO
 366                "TCP compression code copyright 1989 Regents of the "
 367                "University of California\n");
 368 #endif
 369
 370         /*
 371          * Register the tty discipline
 372          */
 373         (void) memset (&ppp_ldisc, 0, sizeof (ppp_ldisc));
 374         ppp_ldisc.magic         = TTY_LDISC_MAGIC;
 375 #if LINUX_VERSION_CODE >= VERSION(2,1,28)
 376         ppp_ldisc.name          = "ppp";
 377 #endif
 378         ppp_ldisc.open          = ppp_tty_open;
 379         ppp_ldisc.close         = ppp_tty_close;
 380         ppp_ldisc.read          = ppp_tty_read;
 381         ppp_ldisc.write         = ppp_tty_write;
 382         ppp_ldisc.ioctl         = ppp_tty_ioctl;
 383 #if LINUX_VERSION_CODE < VERSION(2,1,23)
 384         ppp_ldisc.select        = ppp_tty_select;
 385 #else
 386         ppp_ldisc.poll          = ppp_tty_poll;
 387 #endif
 388         ppp_ldisc.receive_room  = ppp_tty_room;
 389         ppp_ldisc.receive_buf   = ppp_tty_receive;
 390         ppp_ldisc.write_wakeup  = ppp_tty_wakeup;
 391
 392         status = tty_register_ldisc (N_PPP, &ppp_ldisc);
 393         if (status == 0)
 394                 printk(KERN_INFO "PPP line discipline registered.\n");
 395         else
 396                 printk(KERN_ERR "error registering line discipline: %d\n",
 397                        status);
 398         return status;
 399 }
 400
 401
 402 #ifndef MODULE
 403 /*
 404  * Called at boot time if the PPP driver is compiled into the kernel.
 405  */
 406 int
 407 ppp_init(struct device *dev)
 408 {
 409         static int first_time = 1;
 410         int    answer = 0;
 411
 412         if (first_time) {
 413                 first_time = 0;
 414                 answer     = ppp_first_time();
 415 #if LINUX_VERSION_CODE < VERSION(2,1,18)
 416                 if (answer == 0)
 417                         (void) register_symtab(&ppp_syms);
 418 #endif
 419         }
 420         if (answer == 0)
 421                 answer = -ENODEV;
 422         return answer;
 423 }
 424 #endif
 425
 426 /*
 427  * Initialize the async-specific parts of the ppp structure.
 428  */
 429 static void
 430 ppp_async_init(struct ppp *ppp)
 431 {
 432         ppp->escape = 0;
 433         ppp->toss   = 0xE0;
 434         ppp->tty_pushing = 0;
 435
 436         memset (ppp->xmit_async_map, 0, sizeof (ppp->xmit_async_map));
 437         ppp->xmit_async_map[0] = 0xffffffff;
 438         ppp->xmit_async_map[3] = 0x60000000;
 439         ppp->recv_async_map    = 0xffffffff;
 440
 441         ppp->tpkt = NULL;
 442         ppp->tfcs = PPP_INITFCS;
 443         ppp->optr = ppp->obuf;
 444         ppp->olim = ppp->obuf;
 445
 446         ppp->rpkt = NULL;
 447         ppp->rfcs = PPP_INITFCS;
 448
 449         ppp->tty  = NULL;
 450         ppp->backup_tty = NULL;
 451
 452         ppp->bytes_sent = 0;
 453         ppp->bytes_rcvd = 0;
 454 }
 455
 456 /*
 457  * Clean up the async-specific parts of the ppp structure.
 458  */
 459 static void
 460 ppp_async_release(struct ppp *ppp)
 461 {
 462         struct sk_buff *skb;
 463
 464         if ((skb = ppp->rpkt) != NULL)
 465                 KFREE_SKB(skb);
 466         ppp->rpkt = NULL;
 467         if ((skb = ppp->tpkt) != NULL)
 468                 KFREE_SKB(skb);
 469         ppp->tpkt = NULL;
 470 }
 471
 472 /*
 473  * TTY callback.
 474  *
 475  * Called when the tty discipline is switched to PPP.
 476  */
 477
 478 static int
 479 ppp_tty_open (struct tty_struct *tty)
 480 {
 481         struct ppp *ppp;
 482
 483         /*
 484          * Allocate a ppp structure to use.
 485          */
 486         tty->disc_data = NULL;
 487         ppp = ppp_find(current->pid);
 488         if (ppp != NULL) {
 489                 /*
 490                  * If we are taking over a ppp unit which is currently
 491                  * connected to a loopback pty, there's not much to do.
 492                  */
 493                 CHECK_PPP(-EINVAL);
 494
 495         } else {
 496                 ppp = ppp_alloc();
 497                 if (ppp == NULL) {
 498                         printk(KERN_ERR "ppp_alloc failed\n");
 499                         return -ENFILE;
 500                 }
 501
 502                 /*
 503                  * Initialize the control block
 504                  */
 505                 ppp_generic_init(ppp);
 506                 ppp_async_init(ppp);
 507
 508                 MOD_INC_USE_COUNT;
 509         }
 510
 511         tty->disc_data = ppp;
 512         ppp->tty       = tty;
 513
 514         /*
 515          * Flush any pending characters in the driver
 516          */
 517         if (tty->driver.flush_buffer)
 518                 tty->driver.flush_buffer (tty);
 519
 520         return ppp->line;
 521 }
 522
 523 /*
 524  * TTY callback.
 525  *
 526  * Called when the line discipline is changed to something
 527  * else, the tty is closed, or the tty detects a hangup.
 528  */
 529
 530 static void
 531 ppp_tty_close (struct tty_struct *tty)
 532 {
 533         struct ppp *ppp = tty2ppp(tty);
 534
 535         if (ppp == NULL)
 536                 return;
 537         tty->disc_data = NULL;
 538         if (ppp->magic != PPP_MAGIC) {
 539                 printk(KERN_WARNING "ppp_tty_close: bogus\n");
 540                 return;
 541         }
 542         if (!ppp->inuse) {
 543                 printk(KERN_WARNING "ppp_tty_close: not inuse\n");
 544                 ppp->tty = ppp->backup_tty = 0;
 545                 return;
 546         }
 547         if (tty == ppp->backup_tty)
 548                 ppp->backup_tty = 0;
 549         if (tty != ppp->tty)
 550                 return;
 551         if (ppp->backup_tty) {
 552                 ppp->tty = ppp->backup_tty;
 553                 if (ppp_tty_push(ppp))
 554                         ppp_output_wakeup(ppp);
 555                 wake_up_interruptible(&ppp->read_wait);
 556         } else {
 557                 ppp->tty = 0;
 558                 ppp->sc_xfer = 0;
 559                 if (ppp->flags & SC_DEBUG)
 560                         printk(KERN_INFO "ppp: channel %s closing.\n",
 561                                ppp2dev(ppp)->name);
 562
 563                 ppp_async_release(ppp);
 564                 ppp_release(ppp);
 565                 MOD_DEC_USE_COUNT;
 566         }
 567 }
 568
 569 /*
 570  * Read a PPP frame from the rcv_q list,
 571  * waiting if necessary
 572  */
 573 static rw_ret_t
 574 ppp_tty_read(struct tty_struct *tty, struct file *file, __u8 * buf,
 575              rw_count_t nr)
 576 {
 577         struct ppp *ppp = tty2ppp (tty);
 578         struct sk_buff *skb;
 579         rw_ret_t len, err;
 580
 581         /*
 582          * Validate the pointers
 583          */
 584         if (!ppp)
 585                 return -EIO;
 586         CHECK_PPP(-ENXIO);
 587
 588         /*
 589          * Before we attempt to write the frame to the user, ensure that the
 590          * user has access to the pages for the total buffer length.
 591          */
 592         err = verify_area(VERIFY_WRITE, buf, nr);
 593         if (err != 0)
 594                 return (err);
 595
 596         /*
 597          * Wait for a frame to arrive if necessary.
 598          * We increment the module use count so that the module
 599          * can't go away while we're sleeping.
 600          */
 601         MOD_INC_USE_COUNT;
 602         skb = NULL;
 603         for (;;) {
 604                 ppp = tty2ppp(tty);
 605                 err = 0;
 606                 if (!ppp || ppp->magic != PPP_MAGIC || !ppp->inuse
 607                     || tty != ppp->tty)
 608                         break;
 609
 610                 skb = skb_dequeue(&ppp->rcv_q);
 611                 if (skb != 0)
 612                         break;
 613
 614                 /*
 615                  * If no frame is available, return -EAGAIN or wait.
 616                  */
 617                 err = -EAGAIN;
 618                 if (file->f_flags & O_NONBLOCK)
 619                         break;
 620
 621                 interruptible_sleep_on(&ppp->read_wait);
 622                 err = -EINTR;
 623                 if (signal_pending(current))
 624                         break;
 625         }
 626         MOD_DEC_USE_COUNT;
 627         if (skb == 0)
 628                 return err;
 629
 630         /*
 631          * Ensure that the frame will fit within the caller's buffer.
 632          * If not, just discard the frame.
 633          */
 634         len = skb->len;
 635         if (len > nr) {
 636                 if (ppp->flags & SC_DEBUG)
 637                         printk(KERN_DEBUG
 638                                "ppp: read of %lu bytes too small for %ld "
 639                                "frame\n", (unsigned long) nr, (long) len);
 640                 ppp->stats.ppp_ierrors++;
 641                 err = -EOVERFLOW;
 642                 goto out;
 643         }
 644
 645         /*
 646          * Copy the received data from the buffer to the caller's area.
 647          */
 648         err = len;
 649         if (COPY_TO_USER(buf, skb->data, len))
 650                 err = -EFAULT;
 651
 652 out:
 653         KFREE_SKB(skb);
 654         return err;
 655 }
 656
 657 /*
 658  * Writing to a tty in ppp line discipline sends a PPP frame.
 659  * Used by pppd to send control packets (LCP, etc.).
 660  */
 661 static rw_ret_t
 662 ppp_tty_write(struct tty_struct *tty, struct file *file, const __u8 * data,
 663               rw_count_t count)
 664 {
 665         struct ppp *ppp = tty2ppp (tty);
 666         __u8 *new_data;
 667         struct sk_buff *skb;
 668
 669         /*
 670          * Verify the pointers.
 671          */
 672         if (!ppp)
 673                 return -EIO;
 674
 675         if (ppp->magic != PPP_MAGIC)
 676                 return -EIO;
 677
 678         CHECK_PPP(-ENXIO);
 679
 680         /*
 681          * Ensure that the caller does not wish to send too much.
 682          */
 683         if (count > PPP_MTU + PPP_HDRLEN) {
 684                 if (ppp->flags & SC_DEBUG)
 685                         printk(KERN_WARNING
 686                                "ppp_tty_write: truncating user packet "
 687                                "from %lu to mtu %d\n", (unsigned long) count,
 688                                PPP_MTU + PPP_HDRLEN);
 689                 count = PPP_MTU + PPP_HDRLEN;
 690         }
 691
 692         /*
 693          * Allocate a buffer for the data and fetch it from the user space.
 694          */
 695         skb = alloc_skb(count, GFP_KERNEL);
 696         if (skb == NULL) {
 697                 printk(KERN_ERR "ppp_tty_write: no memory\n");
 698                 return 0;
 699         }
 700         LIBERATE_SKB(skb);
 701         new_data = skb_put(skb, count);
 702
 703         /*
 704          * Retrieve the user's buffer
 705          */
 706         if (COPY_FROM_USER(new_data, data, count)) {
 707                 KFREE_SKB(skb);
 708                 return -EFAULT;
 709         }
 710
 711         /*
 712          * Send the frame
 713          */
 714         ppp_send_ctrl(ppp, skb);
 715
 716         return (rw_ret_t) count;
 717 }
 718
 719 /*
 720  * Process the IOCTL call for the tty device.
 721  * Only the ioctls that relate to using ppp on async serial lines
 722  * are processed here; the rest are handled by ppp_ioctl.
 723  */
 724 static int
 725 ppp_tty_ioctl (struct tty_struct *tty, struct file * file,
 726                unsigned int param2, unsigned long param3)
 727 {
 728         struct ppp *ppp = tty2ppp (tty);
 729         register int temp_i = 0;
 730         int error = -EFAULT;
 731
 732         /*
 733          * Verify the status of the PPP device.
 734          */
 735         if (!ppp || ppp->magic != PPP_MAGIC || !ppp->inuse)
 736                 return -ENXIO;
 737
 738         /*
 739          * The user must have an euid of root to do these requests.
 740          */
 741         if (!SUSER())
 742                 return -EPERM;
 743
 744         switch (param2) {
 745         case PPPIOCGASYNCMAP:
 746                 /*
 747                  * Retrieve the transmit async map
 748                  */
 749                 if (PUT_USER(ppp->xmit_async_map[0], (int *) param3))
 750                         break;
 751                 error = 0;
 752                 break;
 753
 754         case PPPIOCSASYNCMAP:
 755                 /*
 756                  * Set the transmit async map
 757                  */
 758                 if (GET_USER(temp_i, (int *) param3))
 759                         break;
 760                 ppp->xmit_async_map[0] = temp_i;
 761                 if (ppp->flags & SC_DEBUG)
 762                         printk(KERN_INFO
 763                                "ppp_tty_ioctl: set xmit asyncmap %x\n",
 764                                ppp->xmit_async_map[0]);
 765                 error = 0;
 766                 break;
 767
 768         case PPPIOCSRASYNCMAP:
 769                 /*
 770                  * Set the receive async map
 771                  */
 772                 if (GET_USER(temp_i, (int *) param3))
 773                         break;
 774                 ppp->recv_async_map = temp_i;
 775                 if (ppp->flags & SC_DEBUG)
 776                         printk(KERN_INFO
 777                                "ppp_tty_ioctl: set rcv asyncmap %x\n",
 778                                ppp->recv_async_map);
 779                 error = 0;
 780                 break;
 781
 782         case PPPIOCGXASYNCMAP:
 783                 /*
 784                  * Get the map of characters to be escaped on transmission.
 785                  */
 786                 if (COPY_TO_USER((void *) param3, ppp->xmit_async_map,
 787                                  sizeof (ppp->xmit_async_map)))
 788                         break;
 789                 error = 0;
 790                 break;
 791
 792         case PPPIOCSXASYNCMAP:
 793                 /*
 794                  * Set the map of characters to be escaped on transmission.
 795                  */
 796                 {
 797                         __u32 temp_tbl[8];
 798
 799                         if (COPY_FROM_USER(temp_tbl, (void *) param3,
 800                                            sizeof (temp_tbl)))
 801                                 break;
 802
 803                         temp_tbl[1]  =  0x00000000;
 804                         temp_tbl[2] &= ~0x40000000;
 805                         temp_tbl[3] |=  0x60000000;
 806
 807                         memcpy(ppp->xmit_async_map, temp_tbl,
 808                                sizeof (ppp->xmit_async_map));
 809
 810                         if (ppp->flags & SC_DEBUG)
 811                                 printk(KERN_INFO
 812                                        "ppp_tty_ioctl: set xasyncmap\n");
 813                         error = 0;
 814                 }
 815                 break;
 816
 817         case PPPIOCXFERUNIT:
 818                 /*
 819                  * Set up this PPP unit to be used next time this
 820                  * process sets a tty to PPP line discipline.
 821                  */
 822                 ppp->backup_tty = tty;
 823                 ppp->sc_xfer = current->pid;
 824                 error = 0;
 825                 break;
 826
 827         case TCGETS:
 828         case TCGETA:
 829                 /*
 830                  * Allow users to read, but not set, the serial port parameters
 831                  */
 832                 error = n_tty_ioctl (tty, file, param2, param3);
 833                 break;
 834
 835         case FIONREAD:
 836                 /*
 837                  * Returns how many bytes are available for a read().
 838                  */
 839                 {
 840                         unsigned long flags;
 841                         struct sk_buff *skb;
 842                         int count = 0;
 843
 844                         save_flags(flags);
 845                         cli();
 846                         skb = skb_peek(&ppp->rcv_q);
 847                         if (skb != 0)
 848                                 count = skb->len;
 849                         restore_flags(flags);
 850                         if (PUT_USER(count, (int *) param3))
 851                                 break;
 852                         error = 0;
 853                 }
 854                 break;
 855
 856         default:
 857                 /*
 858                  *  All other ioctl() events will come here.
 859                  */
 860                 error = ppp_ioctl(ppp, param2, param3);
 861                 break;
 862         }
 863         return error;
 864 }
 865
 866 /*
 867  * TTY callback.
 868  *
 869  * Process the select() or poll() statement for the PPP device.
 870  */
 871
 872 #if LINUX_VERSION_CODE < VERSION(2,1,23)
 873 static int
 874 ppp_tty_select(struct tty_struct *tty, struct inode *inode,
 875                struct file *filp, int sel_type, select_table * wait)
 876 {
 877         struct ppp *ppp = tty2ppp(tty);
 878         int result = 1;
 879
 880         /*
 881          * Verify the status of the PPP device.
 882          */
 883         if (!ppp || tty != ppp->tty)
 884                 return -EBADF;
 885
 886         CHECK_PPP(-EBADF);
 887
 888         switch (sel_type) {
 889         case SEL_IN:
 890                 /* The fd is readable if the receive queue isn't empty. */
 891                 if (skb_peek(&ppp->rcv_q) != NULL)
 892                         break;
 893                 /* fall through */
 894         case SEL_EX:
 895                 /* Check for exceptions or read errors. */
 896                 /* Is this a pty link and the remote disconnected? */
 897                 if (tty->flags & (1 << TTY_OTHER_CLOSED))
 898                         break;
 899
 900                 /* Is this a local link and the modem disconnected? */
 901                 if (tty_hung_up_p (filp))
 902                         break;
 903
 904                 select_wait(&ppp->read_wait, wait);
 905                 result = 0;
 906                 break;
 907
 908         case SEL_OUT:
 909                 /* The fd is always writable. */
 910                 break;
 911         }
 912         return result;
 913 }
 914
 915 #else   /* 2.1.23 or later */
 916
 917 static unsigned int
 918 ppp_tty_poll(struct tty_struct *tty, struct file *filp, poll_table * wait)
 919 {
 920         struct ppp *ppp = tty2ppp(tty);
 921         unsigned int mask = 0;
 922
 923         if (ppp && ppp->magic == PPP_MAGIC && tty == ppp->tty) {
 924                 CHECK_PPP(0);
 925
 926                 poll_wait(filp, &ppp->read_wait, wait);
 927
 928                 if (skb_peek(&ppp->rcv_q) != NULL)
 929                         mask |= POLLIN | POLLRDNORM;
 930                 if (tty->flags & (1 << TTY_OTHER_CLOSED)
 931                     || tty_hung_up_p(filp))
 932                         mask |= POLLHUP;
 933                 mask |= POLLOUT | POLLWRNORM;
 934         }
 935         return mask;
 936 }
 937 #endif  /* >= 2.1.23 */
 938
 939 /*
 940  * This function is called by the tty driver when the transmit buffer has
 941  * additional space. It is used by the ppp code to continue to transmit
 942  * the current buffer should the buffer have been partially sent.
 943  */
 944 static void
 945 ppp_tty_wakeup (struct tty_struct *tty)
 946 {
 947         struct ppp *ppp = tty2ppp (tty);
 948
 949         tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
 950         if (!ppp)
 951                 return;
 952         CHECK_PPP_VOID();
 953         if (tty != ppp->tty)
 954                 return;
 955
 956         if (ppp_tty_push(ppp))
 957                 ppp_output_wakeup(ppp);
 958 }
 959
 960 /*
 961  * Send a packet to the peer over a synchronous tty line.
 962  * All encoding and FCS are handled by hardware.
 963  * Addr/Ctrl and Protocol field compression implemented.
 964  * Returns -1 iff the packet could not be accepted at present,
 965  * 0 if the packet was accepted but we can't accept another yet, or
 966  * 1 if we can accept another packet immediately.
 967  * If this procedure returns 0, ppp_output_wakeup will be called
 968  * exactly once.
 969  */
 970 static int
 971 ppp_sync_send(struct ppp *ppp, struct sk_buff *skb)
 972 {
 973         unsigned char *data;
 974         int islcp;
 975
 976         CHECK_PPP(0);
 977
 978         if (ppp->tpkt != NULL)
 979                 return -1;
 980         ppp->tpkt = skb;
 981
 982         data = ppp->tpkt->data;
 983
 984         /*
 985          * LCP packets with code values between 1 (configure-reqest)
 986          * and 7 (code-reject) must be sent as though no options
 987          * had been negotiated.
 988          */
 989         islcp = PPP_PROTOCOL(data) == PPP_LCP
 990                 && 1 <= data[PPP_HDRLEN] && data[PPP_HDRLEN] <= 7;
 991
 992         /* only reset idle time for data packets */
 993         if (PPP_PROTOCOL(data) < 0x8000)
 994                 ppp->last_xmit = jiffies;
 995         ++ppp->stats.ppp_opackets;
 996         ppp->stats.ppp_ooctects += ppp->tpkt->len;
 997
 998         if ( !(data[2]) && (ppp->flags & SC_COMP_PROT) ) {
 999                 /* compress protocol field */
1000                 data[2] = data[1];
1001                 data[1] = data[0];
1002                 skb_pull(ppp->tpkt,1);
1003                 data = ppp->tpkt->data;
1004         }
1005
1006         /*
1007          * Do address/control compression
1008          */
1009         if ((ppp->flags & SC_COMP_AC) && !islcp
1010             && PPP_ADDRESS(data) == PPP_ALLSTATIONS
1011             && PPP_CONTROL(data) == PPP_UI) {
1012                 /* strip addr and control field */
1013                 skb_pull(ppp->tpkt,2);
1014         }
1015
1016         return ppp_tty_sync_push(ppp);
1017 }
1018
1019 /*
1020  * Push a synchronous frame out to the tty.
1021  * Returns 1 if frame accepted (or discarded), 0 otherwise.
1022  */
1023 static int
1024 ppp_tty_sync_push(struct ppp *ppp)
1025 {
1026         int sent;
1027         struct tty_struct *tty = ppp2tty(ppp);
1028         unsigned long flags;
1029
1030         CHECK_PPP(0);
1031
1032         if (ppp->tpkt == NULL)
1033                 return 0;
1034
1035         /* prevent reentrancy with tty_pushing flag */
1036         save_flags(flags);
1037         cli();
1038         if (ppp->tty_pushing) {
1039                 /* record wakeup attempt so we don't loose */
1040                 /* a wakeup call while doing push processing */
1041                 ppp->woke_up=1;
1042                 restore_flags(flags);
1043                 return 0;
1044         }
1045         ppp->tty_pushing = 1;
1046         restore_flags(flags);
1047
1048         if (tty == NULL || tty->disc_data != (void *) ppp)
1049                 goto flush;
1050
1051         for(;;){
1052                 ppp->woke_up=0;
1053
1054                 /* Note: Sync driver accepts complete frame or nothing */
1055                 tty->flags |= (1 << TTY_DO_WRITE_WAKEUP);
1056                 sent = tty->driver.write(tty, 0, ppp->tpkt->data, ppp->tpkt->len);
1057                 if (sent < 0) {
1058                         /* write error (possible loss of CD) */
1059                         /* record error and discard current packet */
1060                         ppp->stats.ppp_oerrors++;
1061                         break;
1062                 }
1063                 ppp->stats.ppp_obytes += sent;
1064                 if (sent < ppp->tpkt->len) {
1065                         /* driver unable to accept frame just yet */
1066                         save_flags(flags);
1067                         cli();
1068                         if (ppp->woke_up) {
1069                                 /* wake up called while processing */
1070                                 /* try to send the frame again */
1071                                 restore_flags(flags);
1072                                 continue;
1073                         }
1074                         /* wait for wakeup callback to try send again */
1075                         ppp->tty_pushing = 0;
1076                         restore_flags(flags);
1077                         return 0;
1078                 }
1079                 break;
1080         }
1081 flush:
1082         /* done with current packet (sent or discarded) */
1083         KFREE_SKB(ppp->tpkt);
1084         ppp->tpkt = 0;
1085         ppp->tty_pushing = 0;
1086         return 1;
1087 }
1088
1089 /*
1090  * Send a packet to the peer over an async tty line.
1091  * Returns -1 iff the packet could not be accepted at present,
1092  * 0 if the packet was accepted but we can't accept another yet, or
1093  * 1 if we can accept another packet immediately.
1094  * If this procedure returns 0, ppp_output_wakeup will be called
1095  * exactly once.
1096  */
1097 static int
1098 ppp_async_send(struct ppp *ppp, struct sk_buff *skb)
1099 {
1100         CHECK_PPP(0);
1101
1102         ppp_tty_push(ppp);
1103
1104         if (ppp->tpkt != NULL)
1105                 return -1;
1106         ppp->tpkt = skb;
1107         ppp->tpkt_pos = 0;
1108
1109         return ppp_tty_push(ppp);
1110 }
1111
1112 /*
1113  * Push as much data as possible out to the tty.
1114  * Returns 1 if we finished encoding the current frame, 0 otherwise.
1115  */
1116 static int
1117 ppp_tty_push(struct ppp *ppp)
1118 {
1119         int avail, sent, done = 0;
1120         struct tty_struct *tty = ppp2tty(ppp);
1121
1122         if ( ppp->flags & SC_SYNC )
1123                 return ppp_tty_sync_push(ppp);
1124
1125         CHECK_PPP(0);
1126         if (ppp->tty_pushing)
1127                 return 0;
1128         if (tty == NULL || tty->disc_data != (void *) ppp)
1129                 goto flush;
1130         while (ppp->optr < ppp->olim || ppp->tpkt != 0) {
1131                 ppp->tty_pushing = 1;
1132                 avail = ppp->olim - ppp->optr;
1133                 if (avail > 0) {
1134                         tty->flags |= (1 << TTY_DO_WRITE_WAKEUP);
1135                         sent = tty->driver.write(tty, 0, ppp->optr, avail);
1136                         if (sent < 0)
1137                                 goto flush;     /* error, e.g. loss of CD */
1138                         ppp->stats.ppp_obytes += sent;
1139                         ppp->optr += sent;
1140                         if (sent < avail) {
1141                                 ppp->tty_pushing = 0;
1142                                 return done;
1143                         }
1144                 }
1145                 if (ppp->tpkt != 0)
1146                         done = ppp_async_encode(ppp);
1147                 ppp->tty_pushing = 0;
1148         }
1149         return done;
1150
1151 flush:
1152         ppp->tty_pushing = 1;
1153         ppp->stats.ppp_oerrors++;
1154         if (ppp->tpkt != 0) {
1155                 KFREE_SKB(ppp->tpkt);
1156                 ppp->tpkt = 0;
1157                 done = 1;
1158         }
1159         ppp->optr = ppp->olim;
1160         ppp->tty_pushing = 0;
1161         return done;
1162 }
1163
1164 /*
1165  * Procedure to encode the data for async serial transmission.
1166  * Does octet stuffing (escaping) and address/control
1167  * and protocol compression.
1168  * Assumes ppp->opkt != 0 on entry.
1169  * Returns 1 if we finished the current frame, 0 otherwise.
1170  */
1171 static int
1172 ppp_async_encode(struct ppp *ppp)
1173 {
1174         int fcs, i, count, c;
1175         unsigned char *buf, *buflim;
1176         unsigned char *data;
1177         int islcp;
1178
1179         CHECK_PPP(0);
1180
1181         buf = ppp->obuf;
1182         ppp->olim = buf;
1183         ppp->optr = buf;
1184         i = ppp->tpkt_pos;
1185         data = ppp->tpkt->data;
1186         count = ppp->tpkt->len;
1187         fcs = ppp->tfcs;
1188
1189         /*
1190          * LCP packets with code values between 1 (configure-reqest)
1191          * and 7 (code-reject) must be sent as though no options
1192          * had been negotiated.
1193          */
1194         islcp = PPP_PROTOCOL(data) == PPP_LCP
1195                 && 1 <= data[PPP_HDRLEN] && data[PPP_HDRLEN] <= 7;
1196
1197         if (i == 0) {
1198                 /*
1199                  * Start of a new packet - insert the leading FLAG
1200                  * character if necessary.
1201                  */
1202                 if (islcp || flag_time == 0
1203                     || jiffies - ppp->last_xmit >= flag_time)
1204                         *buf++ = PPP_FLAG;
1205                 /* only reset idle time for data packets */
1206                 if (PPP_PROTOCOL(data) < 0x8000)
1207                         ppp->last_xmit = jiffies;
1208                 fcs = PPP_INITFCS;
1209                 ++ppp->stats.ppp_opackets;
1210                 ppp->stats.ppp_ooctects += count;
1211
1212                 /*
1213                  * Do address/control compression
1214                  */
1215                 if ((ppp->flags & SC_COMP_AC) != 0 && !islcp
1216                     && PPP_ADDRESS(data) == PPP_ALLSTATIONS
1217                     && PPP_CONTROL(data) == PPP_UI)
1218                         i += 2;
1219         }
1220
1221         /*
1222          * Once we put in the last byte, we need to put in the FCS
1223          * and closing flag, so make sure there is at least 7 bytes
1224          * of free space in the output buffer.
1225          */
1226         buflim = buf + OBUFSIZE - 6;
1227         while (i < count && buf < buflim) {
1228                 c = data[i++];
1229                 if (i == 3 && c == 0 && (ppp->flags & SC_COMP_PROT))
1230                         continue;       /* compress protocol field */
1231                 fcs = PPP_FCS(fcs, c);
1232                 if (in_xmap(ppp, c) || (islcp && c < 0x20)) {
1233                         *buf++ = PPP_ESCAPE;
1234                         c ^= 0x20;
1235                 }
1236                 *buf++ = c;
1237         }
1238
1239         if (i == count) {
1240                 /*
1241                  * We have finished the packet.  Add the FCS and flag.
1242                  */
1243                 fcs = ~fcs;
1244                 c = fcs & 0xff;
1245                 if (in_xmap(ppp, c) || (islcp && c < 0x20)) {
1246                         *buf++ = PPP_ESCAPE;
1247                         c ^= 0x20;
1248                 }
1249                 *buf++ = c;
1250                 c = (fcs >> 8) & 0xff;
1251                 if (in_xmap(ppp, c) || (islcp && c < 0x20)) {
1252                         *buf++ = PPP_ESCAPE;
1253                         c ^= 0x20;
1254                 }
1255                 *buf++ = c;
1256                 *buf++ = PPP_FLAG;
1257                 ppp->olim = buf;
1258
1259                 KFREE_SKB(ppp->tpkt);
1260                 ppp->tpkt = 0;
1261                 return 1;
1262         }
1263
1264         /*
1265          * Remember where we are up to in this packet.
1266          */
1267         ppp->olim = buf;
1268         ppp->tpkt_pos = i;
1269         ppp->tfcs = fcs;
1270         return 0;
1271 }
1272
1273 /*
1274  * Callback function from tty driver. Return the amount of space left
1275  * in the receiver's buffer to decide if remote transmitter is to be
1276  * throttled.
1277  */
1278 static int
1279 ppp_tty_room (struct tty_struct *tty)
1280 {
1281         return 65536;       /* We can handle an infinite amount of data. :-) */
1282 }
1283
1284 /*
1285  * Callback function when data is available at the tty driver.
1286  */
1287 static void
1288 ppp_tty_receive (struct tty_struct *tty, const __u8 * data,
1289                  char *flags, int count)
1290 {
1291         register struct ppp *ppp = tty2ppp (tty);
1292         struct sk_buff *skb;
1293         int chr, flg;
1294         unsigned char *p;
1295
1296         if (ppp != 0)
1297                 CHECK_PPP_VOID();
1298         /*
1299          * This can happen if stuff comes in on the backup tty.
1300          */
1301         if (ppp == 0 || tty != ppp->tty)
1302                 return;
1303         /*
1304          * Verify the table pointer and ensure that the line is
1305          * still in PPP discipline.
1306          */
1307         if (ppp->magic != PPP_MAGIC) {
1308                 if (ppp->flags & SC_DEBUG)
1309                         printk(KERN_DEBUG
1310                                "PPP: tty_receive called but couldn't find "
1311                                "PPP struct.\n");
1312                 return;
1313         }
1314         /*
1315          * Print the buffer if desired
1316          */
1317         if (ppp->flags & SC_LOG_RAWIN)
1318                 ppp_print_buffer ("receive buffer", data, count);
1319
1320         ppp->stats.ppp_ibytes += count;
1321         skb = ppp->rpkt;
1322
1323         if ( ppp->flags & SC_SYNC ) {
1324                 /* synchronous mode */
1325
1326                 if (ppp->toss==0xE0) {
1327                         /* this is the 1st frame, reset vj comp */
1328                         ppp_receive_error(ppp);
1329                         ppp->toss = 0;
1330                 }
1331
1332                 /*
1333                  * Allocate an skbuff for frame.
1334                  * The 128 is room for VJ header expansion.
1335                  */
1336
1337                 if (skb == NULL)
1338                         skb = dev_alloc_skb(ppp->mru + 128 + PPP_HDRLEN);
1339
1340                 if (skb == NULL) {
1341                         if (ppp->flags & SC_DEBUG)
1342                                 printk(KERN_DEBUG "couldn't "
1343                                        "alloc skb for recv\n");
1344                 } else {
1345                         LIBERATE_SKB(skb);
1346                         /*
1347                          * Decompress A/C and protocol compression here.
1348                          */
1349                         p = skb_put(skb, 2);
1350                         p[0] = PPP_ALLSTATIONS;
1351                         p[1] = PPP_UI;
1352                         if (*data == PPP_ALLSTATIONS) {
1353                                 data += 2;
1354                                 count -= 2;
1355                         }
1356                         if ((*data & 1) != 0) {
1357                                 p = skb_put(skb, 1);
1358                                 p[0] = 0;
1359                         }
1360
1361                         /* copy frame to socket buffer */
1362                         p = skb_put(skb, count);
1363                         memcpy(p,data,count);
1364
1365                         /*
1366                          * Check if we've overflowed the MRU
1367                          */
1368                         if (skb->len >= ppp->mru + PPP_HDRLEN + 2
1369                             || skb_tailroom(skb) <= 0) {
1370                                 ++ppp->estats.rx_length_errors;
1371                                 if (ppp->flags & SC_DEBUG)
1372                                         printk(KERN_DEBUG "rcv frame too long: "
1373                                                "len=%d mru=%d hroom=%d troom=%d\n",
1374                                                skb->len, ppp->mru, skb_headroom(skb),
1375                                                skb_tailroom(skb));
1376                         } else {
1377                                 if (!ppp_receive_frame(ppp, skb)) {
1378                                         KFREE_SKB(skb);
1379                                         ppp_receive_error(ppp);
1380                                 }
1381                         }
1382
1383                         /* Reset for the next frame */
1384                         skb = NULL;
1385                 }
1386                 ppp->rpkt = skb;
1387                 return;
1388         }
1389
1390         while (count-- > 0) {
1391                 /*
1392                  * Collect the character and error condition for the character.
1393                  * Set the toss flag for the first character error.
1394                  */
1395                 chr = *data++;
1396                 if (flags) {
1397                         flg = *flags++;
1398                         if (flg) {
1399                                 if (ppp->toss == 0)
1400                                         ppp->toss = flg;
1401                                 switch (flg) {
1402                                 case TTY_OVERRUN:
1403                                         ++ppp->estats.rx_fifo_errors;
1404                                         break;
1405                                 case TTY_FRAME:
1406                                 case TTY_BREAK:
1407                                         ++ppp->estats.rx_frame_errors;
1408                                         break;
1409                                 }
1410                                 continue;
1411                         }
1412                 }
1413
1414                 /*
1415                  * Set the flags for d7 being 0/1 and parity being
1416                  * even/odd so that the normal processing would have
1417                  * all flags set at the end of the session.  A
1418                  * missing flag bit indicates an error condition.
1419                  */
1420
1421 #ifdef CHECK_CHARACTERS
1422                 if (chr & 0x80)
1423                         ppp->flags |= SC_RCV_B7_1;
1424                 else
1425                         ppp->flags |= SC_RCV_B7_0;
1426
1427                 if (paritytab[chr >> 5] & (1 << (chr & 0x1F)))
1428                         ppp->flags |= SC_RCV_ODDP;
1429                 else
1430                         ppp->flags |= SC_RCV_EVNP;
1431 #endif
1432
1433                 if (chr == PPP_FLAG) {
1434                         /*
1435                          * FLAG. This is the end of the block. If the block
1436                          * ends with ESC FLAG, then the block is to be ignored.
1437                          */
1438                         if (ppp->escape)
1439                                 ppp->toss |= 0x80;
1440                         /*
1441                          * Process the frame if it was received correctly.
1442                          * If there was an error, let the VJ decompressor know.
1443                          * There are 4 cases here:
1444                          * skb != NULL, toss != 0: error in frame
1445                          * skb != NULL, toss == 0: frame ok
1446                          * skb == NULL, toss != 0: very first frame,
1447                          *      error on 1st char, or alloc_skb failed
1448                          * skb == NULL, toss == 0: empty frame (~~)
1449                          */
1450                         if (ppp->toss || !ppp_receive_frame(ppp, skb)) {
1451                                 if (ppp->toss && (ppp->flags & SC_DEBUG))
1452                                         printk(KERN_DEBUG
1453                                                "ppp: tossing frame (%x)\n",
1454                                                ppp->toss);
1455                                 if (skb != NULL)
1456                                         KFREE_SKB(skb);
1457                                 if (!(ppp->toss == 0xE0 || ppp->toss == 0x80))
1458                                         ++ppp->stats.ppp_ierrors;
1459                                 ppp_receive_error(ppp);
1460                         }
1461                         /*
1462                          * Reset for the next frame.
1463                          */
1464                         skb = NULL;
1465                         ppp->rfcs = PPP_INITFCS;
1466                         ppp->escape = 0;
1467                         ppp->toss = 0;
1468                         continue;
1469                 }
1470
1471                 /* If we're tossing, look no further. */
1472                 if (ppp->toss != 0)
1473                         continue;
1474
1475                 /* If this is a control char to be ignored, do so */
1476                 if (in_rmap(ppp, chr))
1477                         continue;
1478
1479                 /*
1480                  * Modify the next character if preceded by escape.
1481                  * The escape character (0x7d) could be an escaped
1482                  * 0x5d, if it follows an escape :-)
1483                  */
1484                 if (ppp->escape) {
1485                         chr ^= PPP_TRANS;
1486                         ppp->escape = 0;
1487                 } else if (chr == PPP_ESCAPE) {
1488                         ppp->escape = PPP_TRANS;
1489                         continue;
1490                 }
1491
1492                 /*
1493                  * Allocate an skbuff on the first character received.
1494                  * The 128 is room for VJ header expansion and FCS.
1495                  */
1496                 if (skb == NULL) {
1497                         skb = dev_alloc_skb(ppp->mru + 128 + PPP_HDRLEN);
1498                         if (skb == NULL) {
1499                                 if (ppp->flags & SC_DEBUG)
1500                                         printk(KERN_DEBUG "couldn't "
1501                                                "alloc skb for recv\n");
1502                                 ppp->toss = 1;
1503                                 continue;
1504                         }
1505                         LIBERATE_SKB(skb);
1506                 }
1507
1508                 /*
1509                  * Decompress A/C and protocol compression here.
1510                  */
1511                 if (skb->len == 0 && chr != PPP_ALLSTATIONS) {
1512                         p = skb_put(skb, 2);
1513                         p[0] = PPP_ALLSTATIONS;
1514                         p[1] = PPP_UI;
1515                 }
1516                 if (skb->len == 2 && (chr & 1) != 0) {
1517                         p = skb_put(skb, 1);
1518                         p[0] = 0;
1519                 }
1520
1521                 /*
1522                  * Check if we've overflowed the MRU
1523                  */
1524                 if (skb->len >= ppp->mru + PPP_HDRLEN + 2
1525                     || skb_tailroom(skb) <= 0) {
1526                         ++ppp->estats.rx_length_errors;
1527                         ppp->toss = 0xC0;
1528                         if (ppp->flags & SC_DEBUG)
1529                                 printk(KERN_DEBUG "rcv frame too long: "
1530                                        "len=%d mru=%d hroom=%d troom=%d\n",
1531                                        skb->len, ppp->mru, skb_headroom(skb),
1532                                        skb_tailroom(skb));
1533                         continue;
1534                 }
1535
1536                 /*
1537                  * Store the character and update the FCS.
1538                  */
1539                 p = skb_put(skb, 1);
1540                 *p = chr;
1541                 ppp->rfcs = PPP_FCS(ppp->rfcs, chr);
1542         }
1543         ppp->rpkt = skb;
1544 }
1545
1546 /*************************************************************
1547  * PPP NETWORK INTERFACE SUPPORT
1548  *      The following code implements the PPP network
1549  *      interface device and handles those parts of
1550  *      the PPP processing which are independent of the
1551  *      type of hardware link being used, including
1552  *      VJ and packet compression.
1553  *************************************************************/
1554
1555 /*
1556  * Network device driver callback routines
1557  */
1558
1559 static int ppp_init_dev(struct device *dev);
1560 static int ppp_dev_open(struct device *);
1561 static int ppp_dev_ioctl(struct device *dev, struct ifreq *ifr, int cmd);
1562 static int ppp_dev_close(struct device *);
1563 static int ppp_dev_xmit(struct sk_buff *, struct device *);
1564 static struct net_device_stats *ppp_dev_stats (struct device *);
1565
1566 #if LINUX_VERSION_CODE < VERSION(2,1,15)
1567 static int ppp_dev_header(struct sk_buff *, struct device *, __u16,
1568                           void *, void *, unsigned int);
1569 static int ppp_dev_rebuild(void *eth, struct device *dev,
1570                            unsigned long raddr, struct sk_buff *skb);
1571 #endif
1572
1573 /*
1574  * Information for the protocol decoder
1575  */
1576
1577 typedef int (*pfn_proto)  (struct ppp *, struct sk_buff *);
1578
1579 typedef struct ppp_proto_struct {
1580         int             proto;
1581         pfn_proto       func;
1582 } ppp_proto_type;
1583
1584 static int rcv_proto_ip         (struct ppp *, struct sk_buff *);
1585 static int rcv_proto_ipv6       (struct ppp *, struct sk_buff *);
1586 static int rcv_proto_ipx        (struct ppp *, struct sk_buff *);
1587 static int rcv_proto_at         (struct ppp *, struct sk_buff *);
1588 static int rcv_proto_vjc_comp   (struct ppp *, struct sk_buff *);
1589 static int rcv_proto_vjc_uncomp (struct ppp *, struct sk_buff *);
1590 static int rcv_proto_ccp        (struct ppp *, struct sk_buff *);
1591 static int rcv_proto_unknown    (struct ppp *, struct sk_buff *);
1592
1593 static
1594 ppp_proto_type proto_list[] = {
1595         { PPP_IP,         rcv_proto_ip         },
1596         { PPP_IPV6,       rcv_proto_ipv6       },
1597         { PPP_IPX,        rcv_proto_ipx        },
1598         { PPP_AT,         rcv_proto_at         },
1599         { PPP_VJC_COMP,   rcv_proto_vjc_comp   },
1600         { PPP_VJC_UNCOMP, rcv_proto_vjc_uncomp },
1601         { PPP_CCP,        rcv_proto_ccp        },
1602         { 0,              rcv_proto_unknown    }  /* !!! MUST BE LAST !!! */
1603 };
1604
1605 /*
1606  * Called when the PPP network interface device is actually created.
1607  */
1608 static int
1609 ppp_init_dev (struct device *dev)
1610 {
1611         dev->hard_header_len  = PPP_HDRLEN;
1612 #if LINUX_VERSION_CODE < VERSION(2,1,15)
1613         dev->hard_header      = ppp_dev_header;
1614         dev->rebuild_header   = ppp_dev_rebuild;
1615 #endif
1616
1617         /* device INFO */
1618         dev->mtu              = PPP_MTU;
1619         dev->hard_start_xmit  = ppp_dev_xmit;
1620         dev->open             = ppp_dev_open;
1621         dev->stop             = ppp_dev_close;
1622         dev->get_stats        = ppp_dev_stats;
1623         dev->do_ioctl         = ppp_dev_ioctl;
1624         dev->addr_len         = 0;
1625         dev->tx_queue_len     = 10;
1626         dev->type             = ARPHRD_PPP;
1627
1628 #if LINUX_VERSION_CODE < VERSION(2,1,20)
1629         {
1630                 int    indx;
1631
1632                 for (indx = 0; indx < DEV_NUMBUFFS; indx++)
1633                         skb_queue_head_init (&dev->buffs[indx]);
1634         }
1635 #else
1636         dev_init_buffers(dev);
1637 #endif
1638
1639         dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
1640
1641         return 0;
1642 }
1643
1644 /*
1645  * Callback from the network layer when the device goes up.
1646  */
1647
1648 static int
1649 ppp_dev_open (struct device *dev)
1650 {
1651         struct ppp *ppp = dev2ppp(dev);
1652
1653         if (!ppp->inuse || ppp2tty(ppp) == NULL) {
1654                 printk(KERN_ERR "ppp: %s not active\n", dev->name);
1655                 return -ENXIO;
1656         }
1657
1658         MOD_INC_USE_COUNT;
1659
1660         return 0;
1661 }
1662
1663 /*
1664  * Callback from the network layer when the ppp device goes down.
1665  */
1666
1667 static int
1668 ppp_dev_close (struct device *dev)
1669 {
1670         struct ppp *ppp = dev2ppp (dev);
1671
1672         CHECK_PPP_MAGIC(ppp);
1673
1674         MOD_DEC_USE_COUNT;
1675
1676         return 0;
1677 }
1678
1679 static inline void
1680 get_vj_stats(struct vjstat *vj, struct slcompress *slc)
1681 {
1682         vj->vjs_packets    = slc->sls_o_compressed + slc->sls_o_uncompressed;
1683         vj->vjs_compressed = slc->sls_o_compressed;
1684         vj->vjs_searches   = slc->sls_o_searches;
1685         vj->vjs_misses     = slc->sls_o_misses;
1686         vj->vjs_errorin    = slc->sls_i_error;
1687         vj->vjs_tossed     = slc->sls_i_tossed;
1688         vj->vjs_uncompressedin = slc->sls_i_uncompressed;
1689         vj->vjs_compressedin   = slc->sls_i_compressed;
1690 }
1691
1692 /*
1693  * Callback from the network layer to process the sockioctl functions.
1694  */
1695 static int
1696 ppp_dev_ioctl (struct device *dev, struct ifreq *ifr, int cmd)
1697 {
1698         struct ppp *ppp = dev2ppp(dev);
1699         int nb;
1700         union {
1701                 struct ppp_stats stats;
1702                 struct ppp_comp_stats cstats;
1703                 char vers[32];
1704         } u;
1705
1706         CHECK_PPP_MAGIC(ppp);
1707
1708         memset(&u, 0, sizeof(u));
1709         switch (cmd) {
1710         case SIOCGPPPSTATS:
1711                 u.stats.p = ppp->stats;
1712                 if (ppp->slcomp != NULL)
1713                         get_vj_stats(&u.stats.vj, ppp->slcomp);
1714                 nb = sizeof(u.stats);
1715                 break;
1716
1717         case SIOCGPPPCSTATS:
1718                 if (ppp->sc_xc_state != NULL)
1719                         (*ppp->sc_xcomp->comp_stat)
1720                                 (ppp->sc_xc_state, &u.cstats.c);
1721                 if (ppp->sc_rc_state != NULL)
1722                         (*ppp->sc_rcomp->decomp_stat)
1723                                 (ppp->sc_rc_state, &u.cstats.d);
1724                 nb = sizeof(u.cstats);
1725                 break;
1726
1727         case SIOCGPPPVER:
1728                 strcpy(u.vers, szVersion);
1729                 nb = strlen(u.vers) + 1;
1730                 break;
1731
1732         default:
1733                 return -EINVAL;
1734         }
1735
1736         if (COPY_TO_USER((void *) ifr->ifr_ifru.ifru_data, &u, nb))
1737                 return -EFAULT;
1738         return 0;
1739 }
1740
1741 /*
1742  * Process the generic PPP ioctls, i.e. those which are not specific
1743  * to any particular type of hardware link.
1744  */
1745 static int
1746 ppp_ioctl(struct ppp *ppp, unsigned int param2, unsigned long param3)
1747 {
1748         register int temp_i = 0, oldflags;
1749         int error = -EFAULT;
1750         unsigned long flags;
1751         struct ppp_idle cur_ddinfo;
1752         struct npioctl npi;
1753
1754         CHECK_PPP(-ENXIO);
1755
1756         /*
1757          * The user must have an euid of root to do these requests.
1758          */
1759         if (!SUSER())
1760                 return -EPERM;
1761
1762         switch (param2) {
1763         case PPPIOCSMRU:
1764                 /*
1765                  * Set the MRU value
1766                  */
1767                 if (GET_USER(temp_i, (int *) param3))
1768                         break;
1769                 if (temp_i < PPP_MRU)
1770                         temp_i = PPP_MRU;
1771                 ppp->mru = temp_i;
1772                 if (ppp->flags & SC_DEBUG)
1773                         printk(KERN_INFO
1774                                "ppp_ioctl: set mru to %x\n", temp_i);
1775                 error = 0;
1776                 break;
1777
1778         case PPPIOCGFLAGS:
1779                 /*
1780                  * Fetch the current flags
1781                  */
1782                 temp_i = ppp->flags & SC_MASK;
1783 #ifndef CHECK_CHARACTERS /* Don't generate errors if we don't check chars. */
1784                 temp_i |= SC_RCV_B7_1 | SC_RCV_B7_0 |
1785                           SC_RCV_ODDP | SC_RCV_EVNP;
1786 #endif
1787                 if (PUT_USER(temp_i, (int *) param3))
1788                         break;
1789                 error = 0;
1790                 break;
1791
1792         case PPPIOCSFLAGS:
1793                 /*
1794                  * Set the flags for the various options
1795                  */
1796                 if (GET_USER(temp_i, (int *) param3))
1797                         break;
1798
1799                 if (ppp->flags & ~temp_i & SC_CCP_OPEN)
1800                         ppp_ccp_closed(ppp);
1801
1802                 save_flags(flags);
1803                 cli();
1804                 oldflags = ppp->flags;
1805                 temp_i = (temp_i & SC_MASK) | (oldflags & ~SC_MASK);
1806                 ppp->flags = temp_i;
1807                 restore_flags(flags);
1808
1809                 if ((oldflags | temp_i) & SC_DEBUG)
1810                         printk(KERN_INFO
1811                                "ppp_ioctl: set flags to %x\n", temp_i);
1812                 error = 0;
1813                 break;
1814
1815         case PPPIOCSCOMPRESS:
1816                 /*
1817                  * Set the compression mode
1818                  */
1819                 error = ppp_set_compression
1820                         (ppp, (struct ppp_option_data *) param3);
1821                 break;
1822
1823         case PPPIOCGUNIT:
1824                 /*
1825                  * Obtain the unit number for this device.
1826                  */
1827                 if (PUT_USER(ppp->line, (int *) param3))
1828                         break;
1829                 if (ppp->flags & SC_DEBUG)
1830                         printk(KERN_INFO
1831                                "ppp_ioctl: get unit: %d\n", ppp->line);
1832                 error = 0;
1833                 break;
1834
1835         case PPPIOCSDEBUG:
1836                 /*
1837                  * Set the debug level
1838                  */
1839                 if (GET_USER(temp_i, (int *) param3))
1840                         break;
1841                 temp_i = (temp_i & 0x1F) << 16;
1842
1843                 if ((ppp->flags | temp_i) & SC_DEBUG)
1844                         printk(KERN_INFO
1845                                "ppp_ioctl: set dbg flags to %x\n", temp_i);
1846
1847                 save_flags(flags);
1848                 cli();
1849                 ppp->flags = (ppp->flags & ~0x1F0000) | temp_i;
1850                 restore_flags(flags);
1851                 error = 0;
1852                 break;
1853
1854         case PPPIOCGDEBUG:
1855                 /*
1856                  * Get the debug level
1857                  */
1858                 temp_i = (ppp->flags >> 16) & 0x1F;
1859                 if (PUT_USER(temp_i, (int *) param3))
1860                         break;
1861                 error = 0;
1862                 break;
1863
1864         case PPPIOCGIDLE:
1865                 /*
1866                  * Get the times since the last send/receive frame operation
1867                  */
1868                 /* change absolute times to relative times. */
1869                 cur_ddinfo.xmit_idle = (jiffies - ppp->last_xmit) / HZ;
1870                 cur_ddinfo.recv_idle = (jiffies - ppp->last_recv) / HZ;
1871                 if (COPY_TO_USER((void *) param3, &cur_ddinfo,
1872                                  sizeof (cur_ddinfo)))
1873                         break;
1874                 error = 0;
1875                 break;
1876
1877         case PPPIOCSMAXCID:
1878                 /*
1879                  * Set the maximum VJ header compression slot number.
1880                  */
1881                 if (GET_USER(temp_i, (int *) param3))
1882                         break;
1883                 error = -EINVAL;
1884                 if (temp_i < 2 || temp_i > 255)
1885                         break;
1886                 ++temp_i;
1887                 if (ppp->flags & SC_DEBUG)
1888                         printk(KERN_INFO "ppp_ioctl: set maxcid to %d\n",
1889                                temp_i);
1890                 if (ppp->slcomp != NULL)
1891                         slhc_free(ppp->slcomp);
1892                 ppp->slcomp = slhc_init(16, temp_i);
1893
1894                 error = -ENOMEM;
1895                 if (ppp->slcomp == NULL) {
1896                         printk(KERN_ERR "ppp: no memory for VJ compression\n");
1897                         break;
1898                 }
1899                 error = 0;
1900                 break;
1901
1902         case PPPIOCGNPMODE:
1903         case PPPIOCSNPMODE:
1904                 if (COPY_FROM_USER(&npi, (void *) param3, sizeof(npi)))
1905                         break;
1906
1907                 switch (npi.protocol) {
1908                 case PPP_IP:
1909                         npi.protocol = NP_IP;
1910                         break;
1911                 case PPP_IPX:
1912                         npi.protocol = NP_IPX;
1913                         break;
1914                 case PPP_AT:
1915                         npi.protocol = NP_AT;
1916                         break;
1917                 default:
1918                         if (ppp->flags & SC_DEBUG)
1919                                 printk(KERN_DEBUG "pppioc[gs]npmode: "
1920                                        "invalid proto %d\n", npi.protocol);
1921                         error = -EINVAL;
1922                         goto out;
1923                 }
1924
1925                 if (param2 == PPPIOCGNPMODE) {
1926                         npi.mode = ppp->sc_npmode[npi.protocol];
1927                         if (COPY_TO_USER((void *) param3, &npi, sizeof(npi)))
1928                                 break;
1929                 } else {
1930                         ppp->sc_npmode[npi.protocol] = npi.mode;
1931                         if (ppp->flags & SC_DEBUG)
1932                                 printk(KERN_DEBUG "ppp: set np %d to %d\n",
1933                                        npi.protocol, npi.mode);
1934                         mark_bh(NET_BH);
1935                 }
1936                 error = 0;
1937                 break;
1938
1939         default:
1940                 /*
1941                  *  All other ioctl() events will come here.
1942                  */
1943                 if (ppp->flags & SC_DEBUG)
1944                         printk(KERN_ERR
1945                                "ppp_ioctl: invalid ioctl: %x, addr %lx\n",
1946                                param2, param3);
1947
1948                 error = -ENOIOCTLCMD;
1949                 break;
1950         }
1951 out:
1952         return error;
1953 }
1954
1955 /*
1956  * Process the set-compression ioctl.
1957  */
1958 static int
1959 ppp_set_compression (struct ppp *ppp, struct ppp_option_data *odp)
1960 {
1961         struct compressor *cp;
1962         int error, nb;
1963         unsigned long flags;
1964         __u8 *ptr;
1965         __u8 ccp_option[CCP_MAX_OPTION_LENGTH];
1966         struct ppp_option_data data;
1967
1968         /*
1969          * Fetch the compression parameters
1970          */
1971         error = -EFAULT;
1972         if (COPY_FROM_USER(&data, odp, sizeof (data)))
1973                 goto out;
1974
1975         nb  = data.length;
1976         ptr = data.ptr;
1977         if ((unsigned) nb >= CCP_MAX_OPTION_LENGTH)
1978                 nb = CCP_MAX_OPTION_LENGTH;
1979
1980         if (COPY_FROM_USER(ccp_option, ptr, nb))
1981                 goto out;
1982
1983         error = -EINVAL;
1984         if (ccp_option[1] < 2)  /* preliminary check on the length byte */
1985                 goto out;
1986
1987         save_flags(flags);
1988         cli();
1989         ppp->flags &= ~(data.transmit? SC_COMP_RUN: SC_DECOMP_RUN);
1990         restore_flags(flags);
1991
1992         cp = find_compressor (ccp_option[0]);
1993 #if defined(CONFIG_KMOD) || defined(CONFIG_KERNELD)
1994         if (cp == NULL) {
1995                 char modname[32];
1996                 sprintf(modname, "ppp-compress-%d", ccp_option[0]);
1997                 request_module(modname);
1998                 cp = find_compressor(ccp_option[0]);
1999         }
2000 #endif /* CONFIG_KMOD */
2001
2002         if (cp == NULL) {
2003                 if (ppp->flags & SC_DEBUG)
2004                         printk(KERN_DEBUG
2005                                "%s: no compressor for [%x %x %x], %x\n",
2006                                ppp->name, ccp_option[0], ccp_option[1],
2007                                ccp_option[2], nb);
2008                 goto out;               /* compressor not loaded */
2009         }
2010
2011         /*
2012          * Found a handler for the protocol - try to allocate
2013          * a compressor or decompressor.
2014          */
2015         error = 0;
2016         if (data.transmit) {
2017                 if (ppp->sc_xc_state != NULL)
2018                         (*ppp->sc_xcomp->comp_free)(ppp->sc_xc_state);
2019                 ppp->sc_xc_state = NULL;
2020
2021                 ppp->sc_xcomp    = cp;
2022                 ppp->sc_xc_state = cp->comp_alloc(ccp_option, nb);
2023                 if (ppp->sc_xc_state == NULL) {
2024                         if (ppp->flags & SC_DEBUG)
2025                                 printk(KERN_DEBUG "%s: comp_alloc failed\n",
2026                                        ppp->name);
2027                         error = -ENOBUFS;
2028                 }
2029         } else {
2030                 if (ppp->sc_rc_state != NULL)
2031                         (*ppp->sc_rcomp->decomp_free)(ppp->sc_rc_state);
2032                 ppp->sc_rc_state = NULL;
2033
2034                 ppp->sc_rcomp    = cp;
2035                 ppp->sc_rc_state = cp->decomp_alloc(ccp_option, nb);
2036                 if (ppp->sc_rc_state == NULL) {
2037                         if (ppp->flags & SC_DEBUG)
2038                                 printk(KERN_DEBUG "%s: decomp_alloc failed\n",
2039                                        ppp->name);
2040                         error = -ENOBUFS;
2041                 }
2042         }
2043 out:
2044         return error;
2045 }
2046
2047 /*
2048  * Handle a CCP packet.
2049  *
2050  * The CCP packet is passed along to the pppd process just like any
2051  * other PPP frame. The difference is that some processing needs to be
2052  * immediate or the compressors will become confused on the peer.
2053  */
2054
2055 static void ppp_proto_ccp(struct ppp *ppp, __u8 *dp, int len, int rcvd)
2056 {
2057         int slen    = CCP_LENGTH(dp);
2058         __u8 *opt = dp   + CCP_HDRLEN;
2059         int opt_len = slen - CCP_HDRLEN;
2060         unsigned long flags;
2061
2062         if (slen > len)
2063                 return;
2064
2065         if (ppp->flags & SC_DEBUG)
2066                 printk(KERN_DEBUG "ppp_proto_ccp rcvd=%d code=%x flags=%x\n",
2067                        rcvd, CCP_CODE(dp), ppp->flags);
2068         save_flags(flags);
2069         switch (CCP_CODE(dp)) {
2070         case CCP_CONFREQ:
2071         case CCP_TERMREQ:
2072         case CCP_TERMACK:
2073                 /*
2074                  * CCP must be going down - disable compression
2075                  */
2076                 if (ppp->flags & SC_CCP_UP) {
2077                         cli();
2078                         ppp->flags &= ~(SC_CCP_UP   |
2079                                         SC_COMP_RUN |
2080                                         SC_DECOMP_RUN);
2081                 }
2082                 break;
2083
2084         case CCP_CONFACK:
2085                 if ((ppp->flags & SC_CCP_OPEN) == 0)
2086                         break;
2087                 if (ppp->flags & SC_CCP_UP)
2088                         break;
2089                 if (slen < (CCP_HDRLEN + CCP_OPT_MINLEN))
2090                         break;
2091                 if (slen < (CCP_OPT_LENGTH (opt) + CCP_HDRLEN))
2092                         break;
2093                 if (!rcvd) {
2094                         /*
2095                          * we're agreeing to send compressed packets.
2096                          */
2097                         if (ppp->sc_xc_state == NULL)
2098                                 break;
2099
2100                         if ((*ppp->sc_xcomp->comp_init)
2101                             (ppp->sc_xc_state,
2102                              opt, opt_len,
2103                              ppp->line, 0, ppp->flags & SC_DEBUG)) {
2104                                 if (ppp->flags & SC_DEBUG)
2105                                         printk(KERN_DEBUG "%s: comp running\n",
2106                                                ppp->name);
2107                                 cli();
2108                                 ppp->flags |= SC_COMP_RUN;
2109                         }
2110                         break;
2111                 }
2112
2113                 /*
2114                  * peer is agreeing to send compressed packets.
2115                  */
2116                 if (ppp->sc_rc_state == NULL)
2117                         break;
2118
2119                 if ((*ppp->sc_rcomp->decomp_init)
2120                     (ppp->sc_rc_state,
2121                      opt, opt_len,
2122                      ppp->line, 0, ppp->mru, ppp->flags & SC_DEBUG)) {
2123                         if (ppp->flags & SC_DEBUG)
2124                                 printk(KERN_DEBUG "%s: decomp running\n",
2125                                        ppp->name);
2126                         cli();
2127                         ppp->flags |= SC_DECOMP_RUN;
2128                         ppp->flags &= ~(SC_DC_ERROR | SC_DC_FERROR);
2129                 }
2130                 break;
2131
2132         case CCP_RESETACK:
2133                 /*
2134                  * CCP Reset-ack resets compressors and decompressors
2135                  * as it passes through.
2136                  */
2137                 if ((ppp->flags & SC_CCP_UP) == 0)
2138                         break;
2139
2140                 if (!rcvd) {
2141                         if (ppp->sc_xc_state && (ppp->flags & SC_COMP_RUN)) {
2142                                 (*ppp->sc_xcomp->comp_reset)(ppp->sc_xc_state);
2143                                 if (ppp->flags & SC_DEBUG)
2144                                         printk(KERN_DEBUG "%s: comp reset\n",
2145                                                ppp->name);
2146                         }
2147                 } else {
2148                         if (ppp->sc_rc_state && (ppp->flags & SC_DECOMP_RUN)) {
2149                               (*ppp->sc_rcomp->decomp_reset)(ppp->sc_rc_state);
2150                               if (ppp->flags & SC_DEBUG)
2151                                         printk(KERN_DEBUG "%s: decomp reset\n",
2152                                                ppp->name);
2153                               cli();
2154                               ppp->flags &= ~SC_DC_ERROR;
2155                         }
2156                 }
2157                 break;
2158         }
2159         restore_flags(flags);
2160 }
2161
2162 /*
2163  * CCP is down; free (de)compressor state if necessary.
2164  */
2165
2166 static void
2167 ppp_ccp_closed(struct ppp *ppp)
2168 {
2169         unsigned long flags;
2170
2171         save_flags(flags);
2172         cli();
2173         ppp->flags &= ~(SC_CCP_OPEN | SC_CCP_UP | SC_COMP_RUN | SC_DECOMP_RUN);
2174         restore_flags(flags);
2175         if (ppp->flags & SC_DEBUG)
2176                 printk(KERN_DEBUG "%s: ccp closed\n", ppp->name);
2177         if (ppp->sc_xc_state) {
2178                 (*ppp->sc_xcomp->comp_free) (ppp->sc_xc_state);
2179                 ppp->sc_xc_state = NULL;
2180         }
2181
2182         if (ppp->sc_rc_state) {
2183                 (*ppp->sc_rcomp->decomp_free) (ppp->sc_rc_state);
2184                 ppp->sc_rc_state = NULL;
2185         }
2186 }
2187
2188 /*************************************************************
2189  * RECEIVE-SIDE ROUTINES
2190  *************************************************************/
2191
2192 /*
2193  * On entry, a received frame is in skb.
2194  * Check it and dispose as appropriate.
2195  */
2196 static int
2197 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb)
2198 {
2199         __u8    *data;
2200         int     count;
2201         int     proto;
2202         int     new_count;
2203         struct sk_buff *new_skb;
2204         ppp_proto_type  *proto_ptr;
2205
2206         /*
2207          * An empty frame is ignored. This occurs if the FLAG sequence
2208          * precedes and follows each frame.
2209          */
2210         if (skb == NULL)
2211                 return 1;
2212         if (skb->len == 0) {
2213                 KFREE_SKB(skb);
2214                 return 1;
2215         }
2216         data = skb->data;
2217         count = skb->len;
2218
2219         /*
2220          * Generate an error if the frame is too small.
2221          */
2222         if (count < PPP_HDRLEN + 2) {
2223                 if (ppp->flags & SC_DEBUG)
2224                         printk(KERN_DEBUG
2225                                "ppp: got runt ppp frame, %d chars\n", count);
2226                 ++ppp->estats.rx_length_errors;
2227                 return 0;
2228         }
2229
2230         if ( !(ppp->flags & SC_SYNC) ) {
2231                 /*
2232                  * Verify the FCS of the frame and discard the FCS characters
2233                  * from the end of the buffer.
2234                  */
2235                 if (ppp->rfcs != PPP_GOODFCS) {
2236                         if (ppp->flags & SC_DEBUG) {
2237                                 printk(KERN_DEBUG
2238                                        "ppp: frame with bad fcs, length = %d\n",
2239                                        count);
2240                                 ppp_print_buffer("bad frame", data, count);
2241                         }
2242                         ++ppp->estats.rx_crc_errors;
2243                         return 0;
2244                 }
2245                 count -= 2;             /* ignore the fcs characters */
2246                 skb_trim(skb, count);
2247         }
2248
2249         /*
2250          * Process the active decompressor.
2251          */
2252         if (ppp->sc_rc_state != NULL &&
2253             (ppp->flags & SC_DECOMP_RUN) &&
2254             ((ppp->flags & (SC_DC_FERROR | SC_DC_ERROR)) == 0)) {
2255                 if (PPP_PROTOCOL(data) == PPP_COMP) {
2256                         /*
2257                          * If the frame is compressed then decompress it.
2258                          */
2259                         new_skb = dev_alloc_skb(ppp->mru + 128 + PPP_HDRLEN);
2260                         if (new_skb == NULL) {
2261                                 printk(KERN_ERR "ppp_recv_frame: no memory\n");
2262                                 new_count = DECOMP_ERROR;
2263                         } else {
2264                                 LIBERATE_SKB(new_skb);
2265                                 new_count = (*ppp->sc_rcomp->decompress)
2266                                         (ppp->sc_rc_state, data, count,
2267                                          new_skb->data, ppp->mru + PPP_HDRLEN);
2268                         }
2269                         if (new_count > 0) {
2270                                 /* Frame was decompressed OK */
2271                                 KFREE_SKB(skb);
2272                                 skb = new_skb;
2273                                 count = new_count;
2274                                 data = skb_put(skb, count);
2275
2276                         } else {
2277                                 /*
2278                                  * On a decompression error, we pass the
2279                                  * compressed frame up to pppd as an
2280                                  * error indication.
2281                                  */
2282                                 if (ppp->flags & SC_DEBUG)
2283                                         printk(KERN_INFO "%s: decomp err %d\n",
2284                                                ppp->name, new_count);
2285                                 if (new_skb != 0)
2286                                         KFREE_SKB(new_skb);
2287                                 if (ppp->slcomp != 0)
2288                                         slhc_toss(ppp->slcomp);
2289                                 ++ppp->stats.ppp_ierrors;
2290                                 if (new_count == DECOMP_FATALERROR) {
2291                                         ppp->flags |= SC_DC_FERROR;
2292                                 } else {
2293                                         ppp->flags |= SC_DC_ERROR;
2294                                 }
2295                         }
2296
2297
2298                 } else {
2299                         /*
2300                          * The frame is not compressed. Pass it to the
2301                          * decompression code so it can update its
2302                          * dictionary if necessary.
2303                          */
2304                         (*ppp->sc_rcomp->incomp)(ppp->sc_rc_state,
2305                                                  data, count);
2306                 }
2307         }
2308         else if (PPP_PROTOCOL(data) == PPP_COMP && (ppp->flags & SC_DEBUG))
2309                 printk(KERN_INFO "%s: not decomp, rc_state=%p flags=%x\n",
2310                        ppp->name, ppp->sc_rc_state, ppp->flags);
2311
2312         /*
2313          * Count the frame and print it
2314          */
2315         ++ppp->stats.ppp_ipackets;
2316         ppp->stats.ppp_ioctects += count;
2317         if (ppp->flags & SC_LOG_INPKT)
2318                 ppp_print_buffer ("receive frame", data, count);
2319
2320         /*
2321          * Find the procedure to handle this protocol.
2322          * The last one is marked as protocol 0 which is the 'catch-all'
2323          * to feed it to the pppd daemon.
2324          */
2325         proto = PPP_PROTOCOL(data);
2326         proto_ptr = proto_list;
2327         while (proto_ptr->proto != 0 && proto_ptr->proto != proto)
2328                 ++proto_ptr;
2329
2330         /*
2331          * Update the appropriate statistic counter.
2332          */
2333         if (!(*proto_ptr->func)(ppp, skb)) {
2334                 KFREE_SKB(skb);
2335                 ++ppp->stats.ppp_discards;
2336         }
2337
2338         return 1;
2339 }
2340
2341 /*
2342  * An input error has been detected, so we need to inform
2343  * the VJ decompressor.
2344  */
2345 static void
2346 ppp_receive_error(struct ppp *ppp)
2347 {
2348         CHECK_PPP_VOID();
2349
2350         if (ppp->slcomp != 0)
2351                 slhc_toss(ppp->slcomp);
2352 }
2353
2354 /*
2355  * Put the input frame into the networking system for the indicated protocol
2356  */
2357 static int
2358 ppp_rcv_rx(struct ppp *ppp, __u16 proto, struct sk_buff *skb)
2359 {
2360
2361         /*
2362          * Fill in a few fields of the skb and give it to netif_rx().
2363          */
2364         skb->dev      = ppp2dev(ppp);   /* We are the device */
2365         skb->protocol = htons(proto);
2366         skb_pull(skb, PPP_HDRLEN);      /* pull off ppp header */
2367         skb->mac.raw   = skb->data;
2368         ppp->last_recv = jiffies;
2369         netif_rx (skb);
2370         return 1;
2371 }
2372
2373 /*
2374  * Process the receipt of an IP frame
2375  */
2376 static int
2377 rcv_proto_ip(struct ppp *ppp, struct sk_buff *skb)
2378 {
2379         CHECK_PPP(0);
2380         if ((ppp2dev(ppp)->flags & IFF_UP) && (skb->len > 0)
2381             && ppp->sc_npmode[NP_IP] == NPMODE_PASS)
2382                 return ppp_rcv_rx(ppp, ETH_P_IP, skb);
2383         return 0;
2384 }
2385
2386 /*
2387  * Process the receipt of an IPv6 frame
2388  */
2389 static int
2390 rcv_proto_ipv6(struct ppp *ppp, struct sk_buff *skb)
2391 {
2392         CHECK_PPP(0);
2393         if ((ppp2dev(ppp)->flags & IFF_UP) && (skb->len > 0)
2394             && ppp->sc_npmode[NP_IPV6] == NPMODE_PASS)
2395                 return ppp_rcv_rx(ppp, ETH_P_IPV6, skb);
2396         return 0;
2397 }
2398
2399 /*
2400  * Process the receipt of an IPX frame
2401  */
2402 static int
2403 rcv_proto_ipx(struct ppp *ppp, struct sk_buff *skb)
2404 {
2405         CHECK_PPP(0);
2406         if (((ppp2dev(ppp)->flags & IFF_UP) != 0) && (skb->len > 0)
2407             && ppp->sc_npmode[NP_IPX] == NPMODE_PASS)
2408                 return ppp_rcv_rx(ppp, ETH_P_IPX, skb);
2409         return 0;
2410 }
2411
2412 /*
2413  * Process the receipt of an Appletalk frame
2414  */
2415 static int
2416 rcv_proto_at(struct ppp *ppp, struct sk_buff *skb)
2417 {
2418         CHECK_PPP(0);
2419         if ((ppp2dev(ppp)->flags & IFF_UP) && (skb->len > 0)
2420             && ppp->sc_npmode[NP_AT] == NPMODE_PASS)
2421                 return ppp_rcv_rx(ppp, ETH_P_PPPTALK, skb);
2422         return 0;
2423 }
2424
2425 /*
2426  * Process the receipt of an VJ Compressed frame
2427  */
2428 static int
2429 rcv_proto_vjc_comp(struct ppp *ppp, struct sk_buff *skb)
2430 {
2431         int new_count;
2432
2433         CHECK_PPP(0);
2434         if ((ppp->flags & SC_REJ_COMP_TCP) || ppp->slcomp == NULL)
2435                 return 0;
2436         new_count = slhc_uncompress(ppp->slcomp, skb->data + PPP_HDRLEN,
2437                                     skb->len - PPP_HDRLEN);
2438         if (new_count <= 0) {
2439                 if (ppp->flags & SC_DEBUG)
2440                         printk(KERN_NOTICE
2441                                "ppp: error in VJ decompression\n");
2442                 return 0;
2443         }
2444         new_count += PPP_HDRLEN;
2445         if (new_count > skb->len)
2446                 skb_put(skb, new_count - skb->len);
2447         else
2448                 skb_trim(skb, new_count);
2449         return rcv_proto_ip(ppp, skb);
2450 }
2451
2452 /*
2453  * Process the receipt of an VJ Un-compressed frame
2454  */
2455 static int
2456 rcv_proto_vjc_uncomp(struct ppp *ppp, struct sk_buff *skb)
2457 {
2458         CHECK_PPP(0);
2459         if ((ppp->flags & SC_REJ_COMP_TCP) || ppp->slcomp == NULL)
2460                 return 0;
2461         if (slhc_remember(ppp->slcomp, skb->data + PPP_HDRLEN,
2462                           skb->len - PPP_HDRLEN) <= 0) {
2463                 if (ppp->flags & SC_DEBUG)
2464                         printk(KERN_NOTICE "ppp: error in VJ memorizing\n");
2465                 return 0;
2466         }
2467         return rcv_proto_ip(ppp, skb);
2468 }
2469
2470 static int
2471 rcv_proto_ccp(struct ppp *ppp, struct sk_buff *skb)
2472 {
2473         CHECK_PPP(0);
2474         ppp_proto_ccp (ppp, skb->data + PPP_HDRLEN, skb->len - PPP_HDRLEN, 1);
2475         return rcv_proto_unknown(ppp, skb);
2476 }
2477
2478 /*
2479  * Receive all unclassified protocols.
2480  */
2481 static int
2482 rcv_proto_unknown(struct ppp *ppp, struct sk_buff *skb)
2483 {
2484         CHECK_PPP(0);
2485
2486         /*
2487          * Limit queue length by dropping old frames.
2488          */
2489         skb_queue_tail(&ppp->rcv_q, skb);
2490         while (ppp->rcv_q.qlen > PPP_MAX_RCV_QLEN) {
2491                 struct sk_buff *skb = skb_dequeue(&ppp->rcv_q);
2492                 if (skb)
2493                         KFREE_SKB(skb);
2494         }
2495
2496         wake_up_interruptible (&ppp->read_wait);
2497         if (ppp->tty->fasync != NULL)
2498                 kill_fasync (ppp->tty->fasync, SIGIO);
2499
2500         return 1;
2501 }
2502
2503 /*************************************************************
2504  * TRANSMIT-SIDE ROUTINES
2505  *************************************************************/
2506
2507 /* local function to store a value into the LQR frame */
2508 extern inline __u8 * store_long (register __u8 *p, register int value) {
2509         *p++ = (__u8) (value >> 24);
2510         *p++ = (__u8) (value >> 16);
2511         *p++ = (__u8) (value >>  8);
2512         *p++ = (__u8) value;
2513         return p;
2514 }
2515
2516 /*
2517  * Compress and send an frame to the peer.
2518  * Should be called with xmit_busy == 1, having been set by the caller.
2519  * That is, we use xmit_busy as a lock to prevent reentry of this
2520  * procedure.
2521  */
2522 static void
2523 ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
2524 {
2525         int     proto;
2526         __u8    *data;
2527         int     count;
2528         __u8    *p;
2529         int     ret;
2530
2531         CHECK_PPP_VOID();
2532         data = skb->data;
2533         count = skb->len;
2534
2535         /* dump the buffer */
2536         if (ppp->flags & SC_LOG_OUTPKT)
2537                 ppp_print_buffer ("write frame", data, count);
2538
2539         /*
2540          * Handle various types of protocol-specific compression
2541          * and other processing, including:
2542          * - VJ TCP header compression
2543          * - updating LQR packets
2544          * - updating CCP state on CCP packets
2545          */
2546         proto = PPP_PROTOCOL(data);
2547         switch (proto) {
2548         case PPP_IP:
2549                 if ((ppp->flags & SC_COMP_TCP) && ppp->slcomp != NULL)
2550                         skb = ppp_vj_compress(ppp, skb);
2551                 break;
2552
2553         case PPP_LQR:
2554                 /*
2555                  * Update the LQR frame with the current MIB information.
2556                  * This way the information is accurate and up-to-date.
2557                  */
2558                 if (count < 48)
2559                         break;
2560                 p = data + 40;  /* Point to last two items. */
2561                 p = store_long(p, ppp->stats.ppp_opackets + 1);
2562                 p = store_long(p, ppp->stats.ppp_ooctects + count);
2563                 ++ppp->stats.ppp_olqrs;
2564                 break;
2565
2566         case PPP_CCP:
2567                 /*
2568                  * Outbound compression control frames
2569                  */
2570                 ppp_proto_ccp(ppp, data + PPP_HDRLEN, count - PPP_HDRLEN, 0);
2571                 break;
2572         }
2573         data = skb->data;
2574         count = skb->len;
2575
2576         /*
2577          * Compress the whole frame if possible.
2578          */
2579         if (((ppp->flags & SC_COMP_RUN) != 0)   &&
2580             (ppp->sc_xc_state != (void *) 0)    &&
2581             (proto != PPP_LCP)                  &&
2582             (proto != PPP_CCP)) {
2583                 struct sk_buff *new_skb;
2584                 int new_count;
2585
2586                 /* Allocate an skb for the compressed frame. */
2587                 new_skb = alloc_skb(ppp->mtu + PPP_HDRLEN, GFP_ATOMIC);
2588                 if (new_skb == NULL) {
2589                         printk(KERN_ERR "ppp_send_frame: no memory\n");
2590                         KFREE_SKB(skb);
2591                         ppp->xmit_busy = 0;
2592                         return;
2593                 }
2594                 LIBERATE_SKB(new_skb);
2595
2596                 /* Compress the frame. */
2597                 new_count = (*ppp->sc_xcomp->compress)
2598                         (ppp->sc_xc_state, data, new_skb->data,
2599                          count, ppp->mtu + PPP_HDRLEN);
2600
2601                 /* Did it compress? */
2602                 if (new_count > 0 && (ppp->flags & SC_CCP_UP)) {
2603                         skb_put(new_skb, new_count);
2604                         KFREE_SKB(skb);
2605                         skb = new_skb;
2606                 } else {
2607                         /*
2608                          * The frame could not be compressed, or it could not
2609                          * be sent in compressed form because CCP is down.
2610                          */
2611                         KFREE_SKB(new_skb);
2612                 }
2613         }
2614
2615         /*
2616          * Send the frame
2617          */
2618         if ( ppp->flags & SC_SYNC )
2619                 ret = ppp_sync_send(ppp, skb);
2620         else
2621                 ret = ppp_async_send(ppp, skb);
2622         if (ret > 0) {
2623                 /* we can release the lock */
2624                 ppp->xmit_busy = 0;
2625         } else if (ret < 0) {
2626                 /* can't happen, since the caller got the xmit_busy lock */
2627                 printk(KERN_ERR "ppp: ppp_async_send didn't accept pkt\n");
2628         }
2629 }
2630
2631 /*
2632  * Apply VJ TCP header compression to a packet.
2633  */
2634 static struct sk_buff *
2635 ppp_vj_compress(struct ppp *ppp, struct sk_buff *skb)
2636 {
2637         __u8 *orig_data, *data;
2638         struct sk_buff *new_skb;
2639         int len, proto;
2640
2641         new_skb = alloc_skb(skb->len, GFP_ATOMIC);
2642         if (new_skb == NULL) {
2643                 printk(KERN_ERR "ppp: no memory for vj compression\n");
2644                 return skb;
2645         }
2646         LIBERATE_SKB(new_skb);
2647
2648         orig_data = data = skb->data + PPP_HDRLEN;
2649         len = slhc_compress(ppp->slcomp, data, skb->len - PPP_HDRLEN,
2650                             new_skb->data + PPP_HDRLEN, &data,
2651                             (ppp->flags & SC_NO_TCP_CCID) == 0);
2652
2653         if (data == orig_data) {
2654                 /* Couldn't compress the data */
2655                 KFREE_SKB(new_skb);
2656                 return skb;
2657         }
2658
2659         /* The data has been changed */
2660         if (data[0] & SL_TYPE_COMPRESSED_TCP) {
2661                 proto = PPP_VJC_COMP;
2662                 data[0] ^= SL_TYPE_COMPRESSED_TCP;
2663         } else {
2664                 if (data[0] >= SL_TYPE_UNCOMPRESSED_TCP)
2665                         proto = PPP_VJC_UNCOMP;
2666                 else
2667                         proto = PPP_IP;
2668                 data[0] = orig_data[0];
2669         }
2670
2671         data = skb_put(new_skb, len + PPP_HDRLEN);
2672         data[0] = PPP_ALLSTATIONS;
2673         data[1] = PPP_UI;
2674         data[2] = 0;
2675         data[3] = proto;
2676
2677         KFREE_SKB(skb);
2678         return new_skb;
2679 }
2680
2681 static inline void
2682 ppp_send_frames(struct ppp *ppp)
2683 {
2684         struct sk_buff *skb;
2685
2686         while (!test_and_set_bit(0, &ppp->xmit_busy)) {
2687                 skb = skb_dequeue(&ppp->xmt_q);
2688                 if (skb == NULL) {
2689                         ppp->xmit_busy = 0;
2690                         break;
2691                 }
2692                 ppp_send_frame(ppp, skb);
2693         }
2694         if (!ppp->xmit_busy && ppp->dev.tbusy) {
2695                 ppp->dev.tbusy = 0;
2696                 mark_bh(NET_BH);
2697         }
2698 }
2699
2700 /*
2701  * Called from the hardware (tty) layer when it can accept
2702  * another packet.
2703  */
2704 static void
2705 ppp_output_wakeup(struct ppp *ppp)
2706 {
2707         CHECK_PPP_VOID();
2708
2709         if (!ppp->xmit_busy) {
2710                 printk(KERN_ERR "ppp_output_wakeup called but xmit_busy==0\n");
2711                 return;
2712         }
2713         ppp->xmit_busy = 0;
2714         ppp_send_frames(ppp);
2715 }
2716
2717 /*
2718  * Send a control frame (from pppd).
2719  */
2720 static void
2721 ppp_send_ctrl(struct ppp *ppp, struct sk_buff *skb)
2722 {
2723         CHECK_PPP_VOID();
2724
2725         /*
2726          * Put the packet on the queue, then send as many as we can.
2727          */
2728         skb_queue_tail(&ppp->xmt_q, skb);
2729         ppp_send_frames(ppp);
2730 }
2731
2732
2733 /*************************************************************
2734  * NETWORK OUTPUT
2735  *    This routine accepts requests from the network layer
2736  *    and attempts to deliver the packets.
2737  *************************************************************/
2738 /*
2739  * Send a frame to the peer.
2740  * Returns 1 iff the frame was not accepted.
2741  */
2742 static int
2743 ppp_dev_xmit(struct sk_buff *skb, struct device *dev)
2744 {
2745         struct ppp *ppp = dev2ppp(dev);
2746         struct tty_struct *tty = ppp2tty(ppp);
2747         enum NPmode npmode;
2748         int proto;
2749         unsigned char *hdr;
2750
2751         /* just a little sanity check. */
2752         if (skb == NULL)
2753                 return 0;
2754         if (skb->data == NULL) {
2755                 KFREE_SKB(skb);
2756                 return 0;
2757         }
2758
2759         /*
2760          * Avoid timing problem should tty hangup while data is
2761          * queued to be sent.
2762          */
2763         if (!ppp->inuse) {
2764                 KFREE_SKB(skb);
2765                 return 0;
2766         }
2767
2768         /*
2769          * Validate the tty interface
2770          */
2771         if (tty == NULL) {
2772                 if (ppp->flags & SC_DEBUG)
2773                         printk(KERN_ERR
2774                                "ppp_dev_xmit: %s not connected to a TTY!\n",
2775                                dev->name);
2776                 KFREE_SKB(skb);
2777                 return 0;
2778         }
2779
2780         /*
2781          * Work out the appropriate network-protocol mode for this packet.
2782          */
2783         npmode = NPMODE_PASS;   /* default */
2784         switch (ntohs(skb->protocol)) {
2785         case ETH_P_IP:
2786                 proto = PPP_IP;
2787                 npmode = ppp->sc_npmode[NP_IP];
2788                 break;
2789         case ETH_P_IPV6:
2790                 proto = PPP_IPV6;
2791                 npmode = ppp->sc_npmode[NP_IPV6];
2792                 break;
2793         case ETH_P_IPX:
2794                 proto = PPP_IPX;
2795                 npmode = ppp->sc_npmode[NP_IPX];
2796                 break;
2797         case ETH_P_PPPTALK:
2798         case ETH_P_ATALK:
2799                 proto = PPP_AT;
2800                 npmode = ppp->sc_npmode[NP_AT];
2801                 break;
2802         default:
2803                 if (ppp->flags & SC_DEBUG)
2804                         printk(KERN_INFO "%s: packet for unknown proto %x\n",
2805                                ppp->name, ntohs(skb->protocol));
2806                 KFREE_SKB(skb);
2807                 return 0;
2808         }
2809
2810         /*
2811          * Drop, accept or reject the packet depending on the mode.
2812          */
2813         switch (npmode) {
2814         case NPMODE_PASS:
2815                 break;
2816
2817         case NPMODE_QUEUE:
2818                 /*
2819                  * We may not send the packet now, so drop it.
2820                  * XXX It would be nice to be able to return it to the
2821                  * network system to be queued and retransmitted later.
2822                  */
2823                 if (ppp->flags & SC_DEBUG)
2824                         printk(KERN_DEBUG "%s: returning frame\n", ppp->name);
2825                 KFREE_SKB(skb);
2826                 return 0;
2827
2828         case NPMODE_ERROR:
2829         case NPMODE_DROP:
2830                 if (ppp->flags & SC_DEBUG)
2831                         printk(KERN_DEBUG
2832                                "ppp_dev_xmit: dropping (npmode = %d) on %s\n",
2833                                npmode, ppp->name);
2834                 KFREE_SKB(skb);
2835                 return 0;
2836         }
2837
2838         /*
2839          * The dev->tbusy field acts as a lock to allow only
2840          * one packet to be processed at a time.  If we can't
2841          * get the lock, try again later.
2842          * We deliberately queue as little as possible inside
2843          * the ppp driver in order to minimize the latency
2844          * for high-priority packets.
2845          */
2846         if (test_and_set_bit(0, &ppp->xmit_busy)) {
2847                 dev->tbusy = 1; /* can't take it now */
2848                 return 1;
2849         }
2850         dev->tbusy = 0;
2851
2852         /*
2853          * Put the 4-byte PPP header on the packet.
2854          * If there isn't room for it, we have to copy the packet.
2855          */
2856         if (skb_headroom(skb) < PPP_HDRLEN) {
2857                 struct sk_buff *new_skb;
2858
2859                 new_skb = alloc_skb(skb->len + PPP_HDRLEN, GFP_ATOMIC);
2860                 if (new_skb == NULL) {
2861                         printk(KERN_ERR "%s: skb hdr alloc failed\n",
2862                                ppp->name);
2863                         KFREE_SKB(skb);
2864                         ppp->xmit_busy = 0;
2865                         ppp_send_frames(ppp);
2866                         return 0;
2867                 }
2868                 LIBERATE_SKB(new_skb);
2869                 skb_reserve(new_skb, PPP_HDRLEN);
2870                 memcpy(skb_put(new_skb, skb->len), skb->data, skb->len);
2871                 KFREE_SKB(skb);
2872                 skb = new_skb;
2873         }
2874
2875         hdr = skb_push(skb, PPP_HDRLEN);
2876         hdr[0] = PPP_ALLSTATIONS;
2877         hdr[1] = PPP_UI;
2878         hdr[2] = proto >> 8;
2879         hdr[3] = proto;
2880
2881         ppp_send_frame(ppp, skb);
2882         if (!ppp->xmit_busy)
2883                 ppp_send_frames(ppp);
2884         return 0;
2885 }
2886
2887 #if LINUX_VERSION_CODE < VERSION(2,1,15)
2888 /*
2889  * Null hard_header and header_rebuild routines.
2890  */
2891 static int ppp_dev_header(struct sk_buff *skb, struct device *dev,
2892                           unsigned short type, void *daddr,
2893                           void *saddr, unsigned int len)
2894 {
2895         return 0;
2896 }
2897
2898 static int ppp_dev_rebuild(void *eth, struct device *dev,
2899                            unsigned long raddr, struct sk_buff *skb)
2900 {
2901         return 0;
2902 }
2903 #endif /* < 2.1.15 */
2904
2905 /*
2906  * Generate the statistic information for the /proc/net/dev listing.
2907  */
2908 static struct net_device_stats *
2909 ppp_dev_stats (struct device *dev)
2910 {
2911         struct ppp *ppp = dev2ppp (dev);
2912
2913         ppp->estats.rx_packets = ppp->stats.ppp_ipackets;
2914         ppp->estats.rx_errors  = ppp->stats.ppp_ierrors;
2915         ppp->estats.tx_packets = ppp->stats.ppp_opackets;
2916         ppp->estats.tx_errors  = ppp->stats.ppp_oerrors;
2917 #if LINUX_VERSION_CODE >= VERSION(2,1,25)
2918         ppp->estats.rx_bytes   = ppp->stats.ppp_ibytes;
2919         ppp->estats.tx_bytes   = ppp->stats.ppp_obytes;
2920 #endif
2921
2922         return &ppp->estats;
2923 }
2924
2925 /*************************************************************
2926  * UTILITIES
2927  *    Miscellany called by various functions above.
2928  *************************************************************/
2929
2930 /* Locate the previous instance of the PPP channel */
2931 static struct ppp *
2932 ppp_find(int pid_value)
2933 {
2934         struct ppp      *ppp;
2935
2936         /* try to find the device which this pid is already using */
2937         for (ppp = ppp_list; ppp != 0; ppp = ppp->next) {
2938                 if (ppp->inuse && ppp->sc_xfer == pid_value) {
2939                         ppp->sc_xfer = 0;
2940                         break;
2941                 }
2942         }
2943         return ppp;
2944 }
2945
2946 /* allocate or create a PPP channel */
2947 static struct ppp *
2948 ppp_alloc(void)
2949 {
2950         int             if_num;
2951         int             status;
2952         struct device   *dev;
2953         struct ppp      *ppp;
2954
2955         /* try to find an free device */
2956         for (ppp = ppp_list; ppp != 0; ppp = ppp->next) {
2957                 if (!test_and_set_bit(0, &ppp->inuse)) {
2958                         dev = ppp2dev(ppp);
2959                         if (dev->flags & IFF_UP) {
2960                                 clear_bit(0, &ppp->inuse);
2961                                 continue;
2962                         }
2963                         /* Reregister device */
2964                         unregister_netdev(dev);
2965                         if (register_netdev(dev) == 0)
2966                                 return ppp;
2967                         printk(KERN_DEBUG "could not reregister ppp device\n");
2968                         /* leave inuse set in this case */
2969                 }
2970         }
2971
2972         /*
2973          * There are no available units, so make a new one.
2974          */
2975         ppp = (struct ppp *) kmalloc(sizeof(struct ppp), GFP_KERNEL);
2976         if (ppp == 0) {
2977                 printk(KERN_ERR "ppp: struct ppp allocation failed\n");
2978                 return 0;
2979         }
2980         memset(ppp, 0, sizeof(*ppp));
2981
2982         /* initialize channel control data */
2983         ppp->magic = PPP_MAGIC;
2984         ppp->next = NULL;
2985         ppp->inuse = 1;
2986         ppp->read_wait = NULL;
2987
2988         /*
2989          * Make up a suitable name for this device
2990          */
2991         dev = ppp2dev(ppp);
2992         dev->name = ppp->name;
2993 #if LINUX_VERSION_CODE < VERSION(2,1,31)
2994         if_num = (ppp_list == 0)? 0: ppp_last->line + 1;
2995         sprintf(ppp->name, "ppp%d", if_num);
2996 #else
2997         if_num = dev_alloc_name(dev, "ppp%d");
2998 #endif
2999         if (if_num < 0) {
3000                 printk(KERN_ERR "ppp: dev_alloc_name failed (%d)\n", if_num);
3001                 kfree(ppp);
3002                 return 0;
3003         }
3004         ppp->line = if_num;
3005         ppp->slcomp = NULL;
3006
3007         dev->next = NULL;
3008         dev->init = ppp_init_dev;
3009         dev->name = ppp->name;
3010         dev->priv = (void *) ppp;
3011
3012         /* register device so that we can be ifconfig'd */
3013         /* ppp_init_dev() will be called as a side-effect */
3014         status = register_netdev (dev);
3015         if (status == 0) {
3016                 printk(KERN_INFO "registered device %s\n", dev->name);
3017         } else {
3018                 printk(KERN_ERR
3019                        "ppp_alloc - register_netdev(%s) = %d failure.\n",
3020                        dev->name, status);
3021                 kfree(ppp);
3022                 ppp = NULL;
3023         }
3024
3025         /* link this unit into our list */
3026         if (ppp_list == 0)
3027                 ppp_list = ppp;
3028         else
3029                 ppp_last->next = ppp;
3030         ppp_last = ppp;
3031
3032         return ppp;
3033 }
3034
3035 /*
3036  * Initialize the generic parts of the ppp structure.
3037  */
3038 static void
3039 ppp_generic_init(struct ppp *ppp)
3040 {
3041         int indx;
3042
3043         ppp->flags  = 0;
3044         ppp->mtu    = PPP_MTU;
3045         ppp->mru    = PPP_MRU;
3046
3047         skb_queue_head_init(&ppp->xmt_q);
3048         skb_queue_head_init(&ppp->rcv_q);
3049
3050         ppp->last_xmit  = jiffies;
3051         ppp->last_recv  = jiffies;
3052         ppp->xmit_busy  = 0;
3053
3054         /* clear statistics */
3055         memset(&ppp->stats, 0, sizeof (struct pppstat));
3056         memset(&ppp->estats, 0, sizeof(struct net_device_stats));
3057
3058         /* PPP compression data */
3059         ppp->sc_xc_state = NULL;
3060         ppp->sc_rc_state = NULL;
3061
3062         for (indx = 0; indx < NUM_NP; ++indx)
3063                 ppp->sc_npmode[indx] = NPMODE_PASS;
3064 }
3065
3066 /*
3067  * Called to clean up the generic parts of the ppp structure.
3068  */
3069 static void
3070 ppp_release(struct ppp *ppp)
3071 {
3072         struct sk_buff *skb;
3073
3074         CHECK_PPP_MAGIC(ppp);
3075
3076         if (ppp->flags & SC_DEBUG)
3077                 printk(KERN_DEBUG "%s released\n", ppp->name);
3078
3079         ppp_ccp_closed(ppp);
3080
3081         /* Ensure that the pppd process is not hanging on select()/poll() */
3082         wake_up_interruptible(&ppp->read_wait);
3083
3084         if (ppp->slcomp) {
3085                 slhc_free(ppp->slcomp);
3086                 ppp->slcomp = NULL;
3087         }
3088
3089         while ((skb = skb_dequeue(&ppp->rcv_q)) != NULL)
3090                 KFREE_SKB(skb);
3091         while ((skb = skb_dequeue(&ppp->xmt_q)) != NULL)
3092                 KFREE_SKB(skb);
3093
3094         ppp->inuse = 0;
3095         if (ppp->dev.tbusy) {
3096                 ppp->dev.tbusy = 0;
3097                 mark_bh(NET_BH);
3098         }
3099 }
3100
3101 /*
3102  * Utility procedures to print a buffer in hex/ascii
3103  */
3104 static void
3105 ppp_print_hex (register __u8 * out, const __u8 * in, int count)
3106 {
3107         register __u8 next_ch;
3108         static char hex[] = "0123456789ABCDEF";
3109
3110         while (count-- > 0) {
3111                 next_ch = *in++;
3112                 *out++ = hex[(next_ch >> 4) & 0x0F];
3113                 *out++ = hex[next_ch & 0x0F];
3114                 ++out;
3115         }
3116 }
3117
3118 static void
3119 ppp_print_char (register __u8 * out, const __u8 * in, int count)
3120 {
3121         register __u8 next_ch;
3122
3123         while (count-- > 0) {
3124                 next_ch = *in++;
3125
3126                 if (next_ch < 0x20 || next_ch > 0x7e)
3127                         *out++ = '.';
3128                 else {
3129                         *out++ = next_ch;
3130                         if (next_ch == '%')   /* printk/syslogd has a bug !! */
3131                                 *out++ = '%';
3132                 }
3133         }
3134         *out = '\0';
3135 }
3136
3137 static void
3138 ppp_print_buffer (const char *name, const __u8 *buf, int count)
3139 {
3140         __u8 line[44];
3141
3142         if (name != NULL)
3143                 printk(KERN_DEBUG "ppp: %s, count = %d\n", name, count);
3144
3145         while (count > 8) {
3146                 memset (line, 32, 44);
3147                 ppp_print_hex (line, buf, 8);
3148                 ppp_print_char (&line[8 * 3], buf, 8);
3149                 printk(KERN_DEBUG "%s\n", line);
3150                 count -= 8;
3151                 buf += 8;
3152         }
3153
3154         if (count > 0) {
3155                 memset (line, 32, 44);
3156                 ppp_print_hex (line, buf, count);
3157                 ppp_print_char (&line[8 * 3], buf, count);
3158                 printk(KERN_DEBUG "%s\n", line);
3159         }
3160 }
3161
3162 /*************************************************************
3163  * Compressor module interface
3164  *************************************************************/
3165
3166 struct compressor_link {
3167         struct compressor_link  *next;
3168         struct compressor       *comp;
3169 };
3170
3171 static struct compressor_link *ppp_compressors = (struct compressor_link *) 0;
3172
3173 static struct compressor *find_compressor (int type)
3174 {
3175         struct compressor_link *lnk;
3176         unsigned long flags;
3177
3178         save_flags(flags);
3179         cli();
3180
3181         lnk = ppp_compressors;
3182         while (lnk != (struct compressor_link *) 0) {
3183                 if ((int) (__u8) lnk->comp->compress_proto == type) {
3184                         restore_flags(flags);
3185                         return lnk->comp;
3186                 }
3187                 lnk = lnk->next;
3188         }
3189
3190         restore_flags(flags);
3191         return (struct compressor *) 0;
3192 }
3193
3194 #ifdef CONFIG_MODULES
3195 static int ppp_register_compressor (struct compressor *cp)
3196 {
3197         struct compressor_link *new;
3198         unsigned long flags;
3199
3200         new = (struct compressor_link *)
3201                 kmalloc (sizeof (struct compressor_link), GFP_KERNEL);
3202
3203         if (new == (struct compressor_link *) 0)
3204                 return 1;
3205
3206         save_flags(flags);
3207         cli();
3208
3209         if (find_compressor (cp->compress_proto)) {
3210                 restore_flags(flags);
3211                 kfree (new);
3212                 return 0;
3213         }
3214
3215         new->next       = ppp_compressors;
3216         new->comp       = cp;
3217         ppp_compressors = new;
3218
3219         restore_flags(flags);
3220         return 0;
3221 }
3222
3223 static void ppp_unregister_compressor (struct compressor *cp)
3224 {
3225         struct compressor_link *prev = (struct compressor_link *) 0;
3226         struct compressor_link *lnk;
3227         unsigned long flags;
3228
3229         save_flags(flags);
3230         cli();
3231
3232         lnk  = ppp_compressors;
3233         while (lnk != (struct compressor_link *) 0) {
3234                 if (lnk->comp == cp) {
3235                         if (prev)
3236                                 prev->next = lnk->next;
3237                         else
3238                                 ppp_compressors = lnk->next;
3239                         kfree (lnk);
3240                         break;
3241                 }
3242                 prev = lnk;
3243                 lnk  = lnk->next;
3244         }
3245         restore_flags(flags);
3246 }
3247 #endif
3248
3249 /*************************************************************
3250  * Module support routines
3251  *************************************************************/
3252
3253 #ifdef MODULE
3254 int
3255 init_module(void)
3256 {
3257         int status;
3258
3259         /* register our line disciplines */
3260         status = ppp_first_time();
3261         if (status != 0)
3262                 printk(KERN_INFO "PPP: ppp_init() failure %d\n", status);
3263 #if LINUX_VERSION_CODE < VERSION(2,1,18)
3264         else
3265                 (void) register_symtab (&ppp_syms);
3266 #endif
3267
3268         return status;
3269 }
3270
3271 void
3272 cleanup_module(void)
3273 {
3274         int status;
3275         struct ppp *ppp, *next_ppp;
3276         int busy = 0;
3277
3278         /*
3279          * Ensure that the devices are not in operation.
3280          */
3281         for (ppp = ppp_list; ppp != 0; ppp = ppp->next) {
3282                 CHECK_PPP_MAGIC(ppp);
3283                 if (ppp->inuse || (ppp->dev.flags & IFF_UP))
3284                         ++busy;
3285         }
3286         if (busy)
3287                 printk(KERN_CRIT "PPP: removing despite %d units in use!\n",
3288                        busy);
3289
3290         /*
3291          * Release the tty registration of the line discipline so that
3292          * ttys can no longer be put into PPP line discipline.
3293          */
3294         status = tty_register_ldisc (N_PPP, NULL);
3295         if (status != 0)
3296                 printk(KERN_ERR
3297                        "PPP: Unable to unregister ppp line discipline "
3298                        "(err = %d)\n", status);
3299         else
3300                 printk(KERN_INFO
3301                        "PPP: ppp line discipline successfully unregistered\n");
3302
3303         /*
3304          * De-register the devices so that there is no problem with them
3305          */
3306         for (ppp = ppp_list; ppp != 0; ppp = next_ppp) {
3307                 next_ppp = ppp->next;
3308                 unregister_netdev(&ppp->dev);
3309                 kfree (ppp);
3310         }
3311 }
3312 #endif