1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* n_gsm.c GSM 0710 tty multiplexor
4	* Copyright (c) 2009/10 Intel Corporation
5	* Copyright (c) 2022/23 Siemens Mobility GmbH
6	*
7	* * THIS IS A DEVELOPMENT SNAPSHOT IT IS NOT A FINAL RELEASE *
8	*
9	* Outgoing path:
10	* tty -> DLCI fifo -> scheduler -> GSM MUX data queue ---o-> ldisc
11	* control message -> GSM MUX control queue --´
12	*
13	* Incoming path:
14	* ldisc -> gsm_queue() -o--> tty
15	* `-> gsm_control_response()
16	*
17	* TO DO:
18	* Mostly done: ioctls for setting modes/timing
19	* Partly done: hooks so you can pull off frames to non tty devs
20	* Restart DLCI 0 when it closes ?
21	* Improve the tx engine
22	* Resolve tx side locking by adding a queue_head and routing
23	* all control traffic via it
24	* General tidy/document
25	* Review the locking/move to refcounts more (mux now moved to an
26	* alloc/free model ready)
27	* Use newest tty open/close port helpers and install hooks
28	* What to do about power functions ?
29	* Termios setting and negotiation
30	* Do we need a 'which mux are you' ioctl to correlate mux and tty sets
31	*
32	*/
33
34	#include <linux/types.h>
35	#include <linux/major.h>
36	#include <linux/errno.h>
37	#include <linux/signal.h>
38	#include <linux/fcntl.h>
39	#include <linux/sched/signal.h>
40	#include <linux/interrupt.h>
41	#include <linux/tty.h>
42	#include <linux/bitfield.h>
43	#include <linux/ctype.h>
44	#include <linux/mm.h>
45	#include <linux/math.h>
46	#include <linux/nospec.h>
47	#include <linux/string.h>
48	#include <linux/slab.h>
49	#include <linux/poll.h>
50	#include <linux/bitops.h>
51	#include <linux/file.h>
52	#include <linux/uaccess.h>
53	#include <linux/module.h>
54	#include <linux/timer.h>
55	#include <linux/tty_flip.h>
56	#include <linux/tty_driver.h>
57	#include <linux/serial.h>
58	#include <linux/kfifo.h>
59	#include <linux/skbuff.h>
60	#include <net/arp.h>
61	#include <linux/ip.h>
62	#include <linux/netdevice.h>
63	#include <linux/etherdevice.h>
64	#include <linux/gsmmux.h>
65	#include "tty.h"
66
67	static int debug;
68	module_param(debug, int, 0600);
69
70	/* Module debug bits */
71	#define DBG_DUMP BIT(0) /* Data transmission dump. */
72	#define DBG_CD_ON BIT(1) /* Always assume CD line on. */
73	#define DBG_DATA BIT(2) /* Data transmission details. */
74	#define DBG_ERRORS BIT(3) /* Details for fail conditions. */
75	#define DBG_TTY BIT(4) /* Transmission statistics for DLCI TTYs. */
76	#define DBG_PAYLOAD BIT(5) /* Limits DBG_DUMP to payload frames. */
77
78	/* Defaults: these are from the specification */
79
80	#define T1 10 /* 100mS */
81	#define T2 34 /* 333mS */
82	#define T3 10 /* 10s */
83	#define N2 3 /* Retry 3 times */
84	#define K 2 /* outstanding I frames */
85
86	#define MAX_T3 255 /* In seconds. */
87	#define MAX_WINDOW_SIZE 7 /* Limit of K in error recovery mode. */
88
89	/* Use long timers for testing at low speed with debug on */
90	#ifdef DEBUG_TIMING
91	#define T1 100
92	#define T2 200
93	#endif
94
95	/*
96	* Semi-arbitrary buffer size limits. 0710 is normally run with 32-64 byte
97	* limits so this is plenty
98	*/
99	#define MAX_MRU 1500
100	#define MAX_MTU 1500
101	#define MIN_MTU (PROT_OVERHEAD + 1)
102	/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */
103	#define PROT_OVERHEAD 7
104	#define GSM_NET_TX_TIMEOUT (HZ*10)
105
106	/*
107	* struct gsm_mux_net - network interface
108	*
109	* Created when net interface is initialized.
110	*/
111	struct gsm_mux_net {
112	struct kref ref;
113	struct gsm_dlci *dlci;
114	};
115
116	/*
117	* Each block of data we have queued to go out is in the form of
118	* a gsm_msg which holds everything we need in a link layer independent
119	* format
120	*/
121
122	struct gsm_msg {
123	struct list_head list;
124	u8 addr; /* DLCI address + flags */
125	u8 ctrl; /* Control byte + flags */
126	unsigned int len; /* Length of data block (can be zero) */
127	unsigned char *data; /* Points into buffer but not at the start */
128	unsigned char buffer[];
129	};
130
131	enum gsm_dlci_state {
132	DLCI_CLOSED,
133	DLCI_WAITING_CONFIG, /* Waiting for DLCI configuration from user */
134	DLCI_CONFIGURE, /* Sending PN (for adaption > 1) */
135	DLCI_OPENING, /* Sending SABM not seen UA */
136	DLCI_OPEN, /* SABM/UA complete */
137	DLCI_CLOSING, /* Sending DISC not seen UA/DM */
138	};
139
140	enum gsm_dlci_mode {
141	DLCI_MODE_ABM, /* Normal Asynchronous Balanced Mode */
142	DLCI_MODE_ADM, /* Asynchronous Disconnected Mode */
143	};
144
145	/*
146	* Each active data link has a gsm_dlci structure associated which ties
147	* the link layer to an optional tty (if the tty side is open). To avoid
148	* complexity right now these are only ever freed up when the mux is
149	* shut down.
150	*
151	* At the moment we don't free DLCI objects until the mux is torn down
152	* this avoid object life time issues but might be worth review later.
153	*/
154
155	struct gsm_dlci {
156	struct gsm_mux *gsm;
157	int addr;
158	enum gsm_dlci_state state;
159	struct mutex mutex;
160
161	/* Link layer */
162	enum gsm_dlci_mode mode;
163	spinlock_t lock; /* Protects the internal state */
164	struct timer_list t1; /* Retransmit timer for SABM and UA */
165	int retries;
166	/* Uplink tty if active */
167	struct tty_port port; /* The tty bound to this DLCI if there is one */
168	#define TX_SIZE 4096 /* Must be power of 2. */
169	struct kfifo fifo; /* Queue fifo for the DLCI */
170	int adaption; /* Adaption layer in use */
171	int prev_adaption;
172	u32 modem_rx; /* Our incoming virtual modem lines */
173	u32 modem_tx; /* Our outgoing modem lines */
174	unsigned int mtu;
175	bool dead; /* Refuse re-open */
176	/* Configuration */
177	u8 prio; /* Priority */
178	u8 ftype; /* Frame type */
179	u8 k; /* Window size */
180	/* Flow control */
181	bool throttled; /* Private copy of throttle state */
182	bool constipated; /* Throttle status for outgoing */
183	/* Packetised I/O */
184	struct sk_buff *skb; /* Frame being sent */
185	struct sk_buff_head skb_list; /* Queued frames */
186	/* Data handling callback */
187	void (*data)(struct gsm_dlci *dlci, const u8 *data, int len);
188	void (*prev_data)(struct gsm_dlci *dlci, const u8 *data, int len);
189	struct net_device *net; /* network interface, if created */
190	};
191
192	/*
193	* Parameter bits used for parameter negotiation according to 3GPP 27.010
194	* chapter 5.4.6.3.1.
195	*/
196
197	struct gsm_dlci_param_bits {
198	u8 d_bits;
199	u8 i_cl_bits;
200	u8 p_bits;
201	u8 t_bits;
202	__le16 n_bits;
203	u8 na_bits;
204	u8 k_bits;
205	};
206
207	static_assert(sizeof(struct gsm_dlci_param_bits) == 8);
208
209	#define PN_D_FIELD_DLCI GENMASK(5, 0)
210	#define PN_I_CL_FIELD_FTYPE GENMASK(3, 0)
211	#define PN_I_CL_FIELD_ADAPTION GENMASK(7, 4)
212	#define PN_P_FIELD_PRIO GENMASK(5, 0)
213	#define PN_T_FIELD_T1 GENMASK(7, 0)
214	#define PN_N_FIELD_N1 GENMASK(15, 0)
215	#define PN_NA_FIELD_N2 GENMASK(7, 0)
216	#define PN_K_FIELD_K GENMASK(2, 0)
217
218	/* Total number of supported devices */
219	#define GSM_TTY_MINORS 256
220
221	/* DLCI 0, 62/63 are special or reserved see gsmtty_open */
222
223	#define NUM_DLCI 64
224
225	/*
226	* DLCI 0 is used to pass control blocks out of band of the data
227	* flow (and with a higher link priority). One command can be outstanding
228	* at a time and we use this structure to manage them. They are created
229	* and destroyed by the user context, and updated by the receive paths
230	* and timers
231	*/
232
233	struct gsm_control {
234	u8 cmd; /* Command we are issuing */
235	u8 *data; /* Data for the command in case we retransmit */
236	int len; /* Length of block for retransmission */
237	int done; /* Done flag */
238	int error; /* Error if any */
239	};
240
241	enum gsm_encoding {
242	GSM_BASIC_OPT,
243	GSM_ADV_OPT,
244	};
245
246	enum gsm_mux_state {
247	GSM_SEARCH,
248	GSM_START,
249	GSM_ADDRESS,
250	GSM_CONTROL,
251	GSM_LEN,
252	GSM_DATA,
253	GSM_FCS,
254	GSM_OVERRUN,
255	GSM_LEN0,
256	GSM_LEN1,
257	GSM_SSOF,
258	};
259
260	/*
261	* Each GSM mux we have is represented by this structure. If we are
262	* operating as an ldisc then we use this structure as our ldisc
263	* state. We need to sort out lifetimes and locking with respect
264	* to the gsm mux array. For now we don't free DLCI objects that
265	* have been instantiated until the mux itself is terminated.
266	*
267	* To consider further: tty open versus mux shutdown.
268	*/
269
270	struct gsm_mux {
271	struct tty_struct *tty; /* The tty our ldisc is bound to */
272	spinlock_t lock;
273	struct mutex mutex;
274	unsigned int num;
275	struct kref ref;
276
277	/* Events on the GSM channel */
278	wait_queue_head_t event;
279
280	/* ldisc send work */
281	struct work_struct tx_work;
282
283	/* Bits for GSM mode decoding */
284
285	/* Framing Layer */
286	unsigned char *buf;
287	enum gsm_mux_state state;
288	unsigned int len;
289	unsigned int address;
290	unsigned int count;
291	bool escape;
292	enum gsm_encoding encoding;
293	u8 control;
294	u8 fcs;
295	u8 *txframe; /* TX framing buffer */
296
297	/* Method for the receiver side */
298	void (*receive)(struct gsm_mux *gsm, u8 ch);
299
300	/* Link Layer */
301	unsigned int mru;
302	unsigned int mtu;
303	int initiator; /* Did we initiate connection */
304	bool dead; /* Has the mux been shut down */
305	struct gsm_dlci *dlci[NUM_DLCI];
306	int old_c_iflag; /* termios c_iflag value before attach */
307	bool constipated; /* Asked by remote to shut up */
308	bool has_devices; /* Devices were registered */
309
310	spinlock_t tx_lock;
311	unsigned int tx_bytes; /* TX data outstanding */
312	#define TX_THRESH_HI 8192
313	#define TX_THRESH_LO 2048
314	struct list_head tx_ctrl_list; /* Pending control packets */
315	struct list_head tx_data_list; /* Pending data packets */
316
317	/* Control messages */
318	struct timer_list kick_timer; /* Kick TX queuing on timeout */
319	struct timer_list t2_timer; /* Retransmit timer for commands */
320	int cretries; /* Command retry counter */
321	struct gsm_control *pending_cmd;/* Our current pending command */
322	spinlock_t control_lock; /* Protects the pending command */
323
324	/* Keep-alive */
325	struct timer_list ka_timer; /* Keep-alive response timer */
326	u8 ka_num; /* Keep-alive match pattern */
327	signed int ka_retries; /* Keep-alive retry counter, -1 if not yet initialized */
328
329	/* Configuration */
330	int adaption; /* 1 or 2 supported */
331	u8 ftype; /* UI or UIH */
332	int t1, t2; /* Timers in 1/100th of a sec */
333	unsigned int t3; /* Power wake-up timer in seconds. */
334	int n2; /* Retry count */
335	u8 k; /* Window size */
336	bool wait_config; /* Wait for configuration by ioctl before DLCI open */
337	u32 keep_alive; /* Control channel keep-alive in 10ms */
338
339	/* Statistics (not currently exposed) */
340	unsigned long bad_fcs;
341	unsigned long malformed;
342	unsigned long io_error;
343	unsigned long open_error;
344	unsigned long bad_size;
345	unsigned long unsupported;
346	};
347
348
349	/*
350	* Mux objects - needed so that we can translate a tty index into the
351	* relevant mux and DLCI.
352	*/
353
354	#define MAX_MUX 4 /* 256 minors */
355	static struct gsm_mux *gsm_mux[MAX_MUX]; /* GSM muxes */
356	static DEFINE_SPINLOCK(gsm_mux_lock);
357
358	static struct tty_driver *gsm_tty_driver;
359
360	/*
361	* This section of the driver logic implements the GSM encodings
362	* both the basic and the 'advanced'. Reliable transport is not
363	* supported.
364	*/
365
366	#define CR 0x02
367	#define EA 0x01
368	#define PF 0x10
369
370	/* I is special: the rest are ..*/
371	#define RR 0x01
372	#define UI 0x03
373	#define RNR 0x05
374	#define REJ 0x09
375	#define DM 0x0F
376	#define SABM 0x2F
377	#define DISC 0x43
378	#define UA 0x63
379	#define UIH 0xEF
380
381	/* Channel commands */
382	#define CMD_NSC 0x09
383	#define CMD_TEST 0x11
384	#define CMD_PSC 0x21
385	#define CMD_RLS 0x29
386	#define CMD_FCOFF 0x31
387	#define CMD_PN 0x41
388	#define CMD_RPN 0x49
389	#define CMD_FCON 0x51
390	#define CMD_CLD 0x61
391	#define CMD_SNC 0x69
392	#define CMD_MSC 0x71
393
394	/* Virtual modem bits */
395	#define MDM_FC 0x01
396	#define MDM_RTC 0x02
397	#define MDM_RTR 0x04
398	#define MDM_IC 0x20
399	#define MDM_DV 0x40
400
401	#define GSM0_SOF 0xF9
402	#define GSM1_SOF 0x7E
403	#define GSM1_ESCAPE 0x7D
404	#define GSM1_ESCAPE_BITS 0x20
405	#define XON 0x11
406	#define XOFF 0x13
407	#define ISO_IEC_646_MASK 0x7F
408
409	static const struct tty_port_operations gsm_port_ops;
410
411	/*
412	* CRC table for GSM 0710
413	*/
414
415	static const u8 gsm_fcs8[256] = {
416	0x00, 0x91, 0xE3, 0x72, 0x07, 0x96, 0xE4, 0x75,
417	0x0E, 0x9F, 0xED, 0x7C, 0x09, 0x98, 0xEA, 0x7B,
418	0x1C, 0x8D, 0xFF, 0x6E, 0x1B, 0x8A, 0xF8, 0x69,
419	0x12, 0x83, 0xF1, 0x60, 0x15, 0x84, 0xF6, 0x67,
420	0x38, 0xA9, 0xDB, 0x4A, 0x3F, 0xAE, 0xDC, 0x4D,
421	0x36, 0xA7, 0xD5, 0x44, 0x31, 0xA0, 0xD2, 0x43,
422	0x24, 0xB5, 0xC7, 0x56, 0x23, 0xB2, 0xC0, 0x51,
423	0x2A, 0xBB, 0xC9, 0x58, 0x2D, 0xBC, 0xCE, 0x5F,
424	0x70, 0xE1, 0x93, 0x02, 0x77, 0xE6, 0x94, 0x05,
425	0x7E, 0xEF, 0x9D, 0x0C, 0x79, 0xE8, 0x9A, 0x0B,
426	0x6C, 0xFD, 0x8F, 0x1E, 0x6B, 0xFA, 0x88, 0x19,
427	0x62, 0xF3, 0x81, 0x10, 0x65, 0xF4, 0x86, 0x17,
428	0x48, 0xD9, 0xAB, 0x3A, 0x4F, 0xDE, 0xAC, 0x3D,
429	0x46, 0xD7, 0xA5, 0x34, 0x41, 0xD0, 0xA2, 0x33,
430	0x54, 0xC5, 0xB7, 0x26, 0x53, 0xC2, 0xB0, 0x21,
431	0x5A, 0xCB, 0xB9, 0x28, 0x5D, 0xCC, 0xBE, 0x2F,
432	0xE0, 0x71, 0x03, 0x92, 0xE7, 0x76, 0x04, 0x95,
433	0xEE, 0x7F, 0x0D, 0x9C, 0xE9, 0x78, 0x0A, 0x9B,
434	0xFC, 0x6D, 0x1F, 0x8E, 0xFB, 0x6A, 0x18, 0x89,
435	0xF2, 0x63, 0x11, 0x80, 0xF5, 0x64, 0x16, 0x87,
436	0xD8, 0x49, 0x3B, 0xAA, 0xDF, 0x4E, 0x3C, 0xAD,
437	0xD6, 0x47, 0x35, 0xA4, 0xD1, 0x40, 0x32, 0xA3,
438	0xC4, 0x55, 0x27, 0xB6, 0xC3, 0x52, 0x20, 0xB1,
439	0xCA, 0x5B, 0x29, 0xB8, 0xCD, 0x5C, 0x2E, 0xBF,
440	0x90, 0x01, 0x73, 0xE2, 0x97, 0x06, 0x74, 0xE5,
441	0x9E, 0x0F, 0x7D, 0xEC, 0x99, 0x08, 0x7A, 0xEB,
442	0x8C, 0x1D, 0x6F, 0xFE, 0x8B, 0x1A, 0x68, 0xF9,
443	0x82, 0x13, 0x61, 0xF0, 0x85, 0x14, 0x66, 0xF7,
444	0xA8, 0x39, 0x4B, 0xDA, 0xAF, 0x3E, 0x4C, 0xDD,
445	0xA6, 0x37, 0x45, 0xD4, 0xA1, 0x30, 0x42, 0xD3,
446	0xB4, 0x25, 0x57, 0xC6, 0xB3, 0x22, 0x50, 0xC1,
447	0xBA, 0x2B, 0x59, 0xC8, 0xBD, 0x2C, 0x5E, 0xCF
448	};
449
450	#define INIT_FCS 0xFF
451	#define GOOD_FCS 0xCF
452
453	static void gsm_dlci_close(struct gsm_dlci *dlci);
454	static int gsmld_output(struct gsm_mux *gsm, u8 *data, int len);
455	static int gsm_modem_update(struct gsm_dlci *dlci, u8 brk);
456	static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
457	u8 ctrl);
458	static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
459	static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
460	static void gsmld_write_trigger(struct gsm_mux *gsm);
461	static void gsmld_write_task(struct work_struct *work);
462
463	/**
464	* gsm_fcs_add - update FCS
465	* @fcs: Current FCS
466	* @c: Next data
467	*
468	* Update the FCS to include c. Uses the algorithm in the specification
469	* notes.
470	*/
471
472	static inline u8 gsm_fcs_add(u8 fcs, u8 c)
473	{
474	return gsm_fcs8[fcs ^ c];
475	}
476
477	/**
478	* gsm_fcs_add_block - update FCS for a block
479	* @fcs: Current FCS
480	* @c: buffer of data
481	* @len: length of buffer
482	*
483	* Update the FCS to include c. Uses the algorithm in the specification
484	* notes.
485	*/
486
487	static inline u8 gsm_fcs_add_block(u8 fcs, u8 *c, int len)
488	{
489	while (len--)
490	fcs = gsm_fcs8[fcs ^ *c++];
491	return fcs;
492	}
493
494	/**
495	* gsm_read_ea - read a byte into an EA
496	* @val: variable holding value
497	* @c: byte going into the EA
498	*
499	* Processes one byte of an EA. Updates the passed variable
500	* and returns 1 if the EA is now completely read
501	*/
502
503	static int gsm_read_ea(unsigned int *val, u8 c)
504	{
505	/* Add the next 7 bits into the value */
506	*val <<= 7;
507	*val |= c >> 1;
508	/* Was this the last byte of the EA 1 = yes*/
509	return c & EA;
510	}
511
512	/**
513	* gsm_read_ea_val - read a value until EA
514	* @val: variable holding value
515	* @data: buffer of data
516	* @dlen: length of data
517	*
518	* Processes an EA value. Updates the passed variable and
519	* returns the processed data length.
520	*/
521	static unsigned int gsm_read_ea_val(unsigned int *val, const u8 *data, int dlen)
522	{
523	unsigned int len = 0;
524
525	for (; dlen > 0; dlen--) {
526	len++;
527	if (gsm_read_ea(val, c: *data++))
528	break;
529	}
530	return len;
531	}
532
533	/**
534	* gsm_encode_modem - encode modem data bits
535	* @dlci: DLCI to encode from
536	*
537	* Returns the correct GSM encoded modem status bits (6 bit field) for
538	* the current status of the DLCI and attached tty object
539	*/
540
541	static u8 gsm_encode_modem(const struct gsm_dlci *dlci)
542	{
543	u8 modembits = 0;
544	/* FC is true flow control not modem bits */
545	if (dlci->throttled)
546	modembits |= MDM_FC;
547	if (dlci->modem_tx & TIOCM_DTR)
548	modembits |= MDM_RTC;
549	if (dlci->modem_tx & TIOCM_RTS)
550	modembits |= MDM_RTR;
551	if (dlci->modem_tx & TIOCM_RI)
552	modembits |= MDM_IC;
553	if (dlci->modem_tx & TIOCM_CD || dlci->gsm->initiator)
554	modembits |= MDM_DV;
555	/* special mappings for passive side to operate as UE */
556	if (dlci->modem_tx & TIOCM_OUT1)
557	modembits |= MDM_IC;
558	if (dlci->modem_tx & TIOCM_OUT2)
559	modembits |= MDM_DV;
560	return modembits;
561	}
562
563	static void gsm_hex_dump_bytes(const char *fname, const u8 *data,
564	unsigned long len)
565	{
566	char *prefix;
567
568	if (!fname) {
569	print_hex_dump(KERN_INFO, prefix_str: "", prefix_type: DUMP_PREFIX_NONE, rowsize: 16, groupsize: 1, buf: data, len,
570	ascii: true);
571	return;
572	}
573
574	prefix = kasprintf(GFP_ATOMIC, fmt: "%s: ", fname);
575	if (!prefix)
576	return;
577	print_hex_dump(KERN_INFO, prefix_str: prefix, prefix_type: DUMP_PREFIX_OFFSET, rowsize: 16, groupsize: 1, buf: data, len,
578	ascii: true);
579	kfree(objp: prefix);
580	}
581
582	/**
583	* gsm_encode_params - encode DLCI parameters
584	* @dlci: DLCI to encode from
585	* @params: buffer to fill with the encoded parameters
586	*
587	* Encodes the parameters according to GSM 07.10 section 5.4.6.3.1
588	* table 3.
589	*/
590	static int gsm_encode_params(const struct gsm_dlci *dlci,
591	struct gsm_dlci_param_bits *params)
592	{
593	const struct gsm_mux *gsm = dlci->gsm;
594	unsigned int i, cl;
595
596	switch (dlci->ftype) {
597	case UIH:
598	i = 0; /* UIH */
599	break;
600	case UI:
601	i = 1; /* UI */
602	break;
603	default:
604	pr_debug("unsupported frame type %d\n", dlci->ftype);
605	return -EINVAL;
606	}
607
608	switch (dlci->adaption) {
609	case 1: /* Unstructured */
610	cl = 0; /* convergence layer type 1 */
611	break;
612	case 2: /* Unstructured with modem bits. */
613	cl = 1; /* convergence layer type 2 */
614	break;
615	default:
616	pr_debug("unsupported adaption %d\n", dlci->adaption);
617	return -EINVAL;
618	}
619
620	params->d_bits = FIELD_PREP(PN_D_FIELD_DLCI, dlci->addr);
621	/* UIH, convergence layer type 1 */
622	params->i_cl_bits = FIELD_PREP(PN_I_CL_FIELD_FTYPE, i) |
623	FIELD_PREP(PN_I_CL_FIELD_ADAPTION, cl);
624	params->p_bits = FIELD_PREP(PN_P_FIELD_PRIO, dlci->prio);
625	params->t_bits = FIELD_PREP(PN_T_FIELD_T1, gsm->t1);
626	params->n_bits = cpu_to_le16(FIELD_PREP(PN_N_FIELD_N1, dlci->mtu));
627	params->na_bits = FIELD_PREP(PN_NA_FIELD_N2, gsm->n2);
628	params->k_bits = FIELD_PREP(PN_K_FIELD_K, dlci->k);
629
630	return 0;
631	}
632
633	/**
634	* gsm_register_devices - register all tty devices for a given mux index
635	*
636	* @driver: the tty driver that describes the tty devices
637	* @index: the mux number is used to calculate the minor numbers of the
638	* ttys for this mux and may differ from the position in the
639	* mux array.
640	*/
641	static int gsm_register_devices(struct tty_driver *driver, unsigned int index)
642	{
643	struct device *dev;
644	int i;
645	unsigned int base;
646
647	if (!driver || index >= MAX_MUX)
648	return -EINVAL;
649
650	base = index * NUM_DLCI; /* first minor for this index */
651	for (i = 1; i < NUM_DLCI; i++) {
652	/* Don't register device 0 - this is the control channel
653	* and not a usable tty interface
654	*/
655	dev = tty_register_device(driver: gsm_tty_driver, index: base + i, NULL);
656	if (IS_ERR(ptr: dev)) {
657	if (debug & DBG_ERRORS)
658	pr_info("%s failed to register device minor %u",
659	__func__, base + i);
660	for (i--; i >= 1; i--)
661	tty_unregister_device(driver: gsm_tty_driver, index: base + i);
662	return PTR_ERR(ptr: dev);
663	}
664	}
665
666	return 0;
667	}
668
669	/**
670	* gsm_unregister_devices - unregister all tty devices for a given mux index
671	*
672	* @driver: the tty driver that describes the tty devices
673	* @index: the mux number is used to calculate the minor numbers of the
674	* ttys for this mux and may differ from the position in the
675	* mux array.
676	*/
677	static void gsm_unregister_devices(struct tty_driver *driver,
678	unsigned int index)
679	{
680	int i;
681	unsigned int base;
682
683	if (!driver || index >= MAX_MUX)
684	return;
685
686	base = index * NUM_DLCI; /* first minor for this index */
687	for (i = 1; i < NUM_DLCI; i++) {
688	/* Don't unregister device 0 - this is the control
689	* channel and not a usable tty interface
690	*/
691	tty_unregister_device(driver: gsm_tty_driver, index: base + i);
692	}
693	}
694
695	/**
696	* gsm_print_packet - display a frame for debug
697	* @hdr: header to print before decode
698	* @addr: address EA from the frame
699	* @cr: C/R bit seen as initiator
700	* @control: control including PF bit
701	* @data: following data bytes
702	* @dlen: length of data
703	*
704	* Displays a packet in human readable format for debugging purposes. The
705	* style is based on amateur radio LAP-B dump display.
706	*/
707
708	static void gsm_print_packet(const char *hdr, int addr, int cr,
709	u8 control, const u8 *data, int dlen)
710	{
711	if (!(debug & DBG_DUMP))
712	return;
713	/* Only show user payload frames if debug & DBG_PAYLOAD */
714	if (!(debug & DBG_PAYLOAD) && addr != 0)
715	if ((control & ~PF) == UI || (control & ~PF) == UIH)
716	return;
717
718	pr_info("%s %d) %c: ", hdr, addr, "RC"[cr]);
719
720	switch (control & ~PF) {
721	case SABM:
722	pr_cont("SABM");
723	break;
724	case UA:
725	pr_cont("UA");
726	break;
727	case DISC:
728	pr_cont("DISC");
729	break;
730	case DM:
731	pr_cont("DM");
732	break;
733	case UI:
734	pr_cont("UI");
735	break;
736	case UIH:
737	pr_cont("UIH");
738	break;
739	default:
740	if (!(control & 0x01)) {
741	pr_cont("I N(S)%d N(R)%d",
742	(control & 0x0E) >> 1, (control & 0xE0) >> 5);
743	} else switch (control & 0x0F) {
744	case RR:
745	pr_cont("RR(%d)", (control & 0xE0) >> 5);
746	break;
747	case RNR:
748	pr_cont("RNR(%d)", (control & 0xE0) >> 5);
749	break;
750	case REJ:
751	pr_cont("REJ(%d)", (control & 0xE0) >> 5);
752	break;
753	default:
754	pr_cont("[%02X]", control);
755	}
756	}
757
758	if (control & PF)
759	pr_cont("(P)");
760	else
761	pr_cont("(F)");
762
763	gsm_hex_dump_bytes(NULL, data, len: dlen);
764	}
765
766
767	/*
768	* Link level transmission side
769	*/
770
771	/**
772	* gsm_stuff_frame - bytestuff a packet
773	* @input: input buffer
774	* @output: output buffer
775	* @len: length of input
776	*
777	* Expand a buffer by bytestuffing it. The worst case size change
778	* is doubling and the caller is responsible for handing out
779	* suitable sized buffers.
780	*/
781
782	static int gsm_stuff_frame(const u8 *input, u8 *output, int len)
783	{
784	int olen = 0;
785	while (len--) {
786	if (*input == GSM1_SOF || *input == GSM1_ESCAPE
787	|| (*input & ISO_IEC_646_MASK) == XON
788	|| (*input & ISO_IEC_646_MASK) == XOFF) {
789	*output++ = GSM1_ESCAPE;
790	*output++ = *input++ ^ GSM1_ESCAPE_BITS;
791	olen++;
792	} else
793	*output++ = *input++;
794	olen++;
795	}
796	return olen;
797	}
798
799	/**
800	* gsm_send - send a control frame
801	* @gsm: our GSM mux
802	* @addr: address for control frame
803	* @cr: command/response bit seen as initiator
804	* @control: control byte including PF bit
805	*
806	* Format up and transmit a control frame. These should be transmitted
807	* ahead of data when they are needed.
808	*/
809	static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control)
810	{
811	struct gsm_msg *msg;
812	u8 *dp;
813	int ocr;
814	unsigned long flags;
815
816	msg = gsm_data_alloc(gsm, addr, len: 0, ctrl: control);
817	if (!msg)
818	return -ENOMEM;
819
820	/* toggle C/R coding if not initiator */
821	ocr = cr ^ (gsm->initiator ? 0 : 1);
822
823	msg->data -= 3;
824	dp = msg->data;
825	*dp++ = (addr << 2) | (ocr << 1) | EA;
826	*dp++ = control;
827
828	if (gsm->encoding == GSM_BASIC_OPT)
829	*dp++ = EA; /* Length of data = 0 */
830
831	*dp = 0xFF - gsm_fcs_add_block(INIT_FCS, c: msg->data, len: dp - msg->data);
832	msg->len = (dp - msg->data) + 1;
833
834	gsm_print_packet(hdr: "Q->", addr, cr, control, NULL, dlen: 0);
835
836	spin_lock_irqsave(&gsm->tx_lock, flags);
837	list_add_tail(new: &msg->list, head: &gsm->tx_ctrl_list);
838	gsm->tx_bytes += msg->len;
839	spin_unlock_irqrestore(lock: &gsm->tx_lock, flags);
840	gsmld_write_trigger(gsm);
841
842	return 0;
843	}
844
845	/**
846	* gsm_dlci_clear_queues - remove outstanding data for a DLCI
847	* @gsm: mux
848	* @dlci: clear for this DLCI
849	*
850	* Clears the data queues for a given DLCI.
851	*/
852	static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci)
853	{
854	struct gsm_msg *msg, *nmsg;
855	int addr = dlci->addr;
856	unsigned long flags;
857
858	/* Clear DLCI write fifo first */
859	spin_lock_irqsave(&dlci->lock, flags);
860	kfifo_reset(&dlci->fifo);
861	spin_unlock_irqrestore(lock: &dlci->lock, flags);
862
863	/* Clear data packets in MUX write queue */
864	spin_lock_irqsave(&gsm->tx_lock, flags);
865	list_for_each_entry_safe(msg, nmsg, &gsm->tx_data_list, list) {
866	if (msg->addr != addr)
867	continue;
868	gsm->tx_bytes -= msg->len;
869	list_del(entry: &msg->list);
870	kfree(objp: msg);
871	}
872	spin_unlock_irqrestore(lock: &gsm->tx_lock, flags);
873	}
874
875	/**
876	* gsm_response - send a control response
877	* @gsm: our GSM mux
878	* @addr: address for control frame
879	* @control: control byte including PF bit
880	*
881	* Format up and transmit a link level response frame.
882	*/
883
884	static inline void gsm_response(struct gsm_mux *gsm, int addr, int control)
885	{
886	gsm_send(gsm, addr, cr: 0, control);
887	}
888
889	/**
890	* gsm_command - send a control command
891	* @gsm: our GSM mux
892	* @addr: address for control frame
893	* @control: control byte including PF bit
894	*
895	* Format up and transmit a link level command frame.
896	*/
897
898	static inline void gsm_command(struct gsm_mux *gsm, int addr, int control)
899	{
900	gsm_send(gsm, addr, cr: 1, control);
901	}
902
903	/* Data transmission */
904
905	#define HDR_LEN 6 /* ADDR CTRL [LEN.2] DATA FCS */
906
907	/**
908	* gsm_data_alloc - allocate data frame
909	* @gsm: GSM mux
910	* @addr: DLCI address
911	* @len: length excluding header and FCS
912	* @ctrl: control byte
913	*
914	* Allocate a new data buffer for sending frames with data. Space is left
915	* at the front for header bytes but that is treated as an implementation
916	* detail and not for the high level code to use
917	*/
918
919	static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
920	u8 ctrl)
921	{
922	struct gsm_msg *m = kmalloc(size: sizeof(struct gsm_msg) + len + HDR_LEN,
923	GFP_ATOMIC);
924	if (m == NULL)
925	return NULL;
926	m->data = m->buffer + HDR_LEN - 1; /* Allow for FCS */
927	m->len = len;
928	m->addr = addr;
929	m->ctrl = ctrl;
930	INIT_LIST_HEAD(list: &m->list);
931	return m;
932	}
933
934	/**
935	* gsm_send_packet - sends a single packet
936	* @gsm: GSM Mux
937	* @msg: packet to send
938	*
939	* The given packet is encoded and sent out. No memory is freed.
940	* The caller must hold the gsm tx lock.
941	*/
942	static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg)
943	{
944	int len, ret;
945
946
947	if (gsm->encoding == GSM_BASIC_OPT) {
948	gsm->txframe[0] = GSM0_SOF;
949	memcpy(gsm->txframe + 1, msg->data, msg->len);
950	gsm->txframe[msg->len + 1] = GSM0_SOF;
951	len = msg->len + 2;
952	} else {
953	gsm->txframe[0] = GSM1_SOF;
954	len = gsm_stuff_frame(input: msg->data, output: gsm->txframe + 1, len: msg->len);
955	gsm->txframe[len + 1] = GSM1_SOF;
956	len += 2;
957	}
958
959	if (debug & DBG_DATA)
960	gsm_hex_dump_bytes(fname: __func__, data: gsm->txframe, len);
961	gsm_print_packet(hdr: "-->", addr: msg->addr, cr: gsm->initiator, control: msg->ctrl, data: msg->data,
962	dlen: msg->len);
963
964	ret = gsmld_output(gsm, data: gsm->txframe, len);
965	if (ret <= 0)
966	return ret;
967	/* FIXME: Can eliminate one SOF in many more cases */
968	gsm->tx_bytes -= msg->len;
969
970	return 0;
971	}
972
973	/**
974	* gsm_is_flow_ctrl_msg - checks if flow control message
975	* @msg: message to check
976	*
977	* Returns true if the given message is a flow control command of the
978	* control channel. False is returned in any other case.
979	*/
980	static bool gsm_is_flow_ctrl_msg(struct gsm_msg *msg)
981	{
982	unsigned int cmd;
983
984	if (msg->addr > 0)
985	return false;
986
987	switch (msg->ctrl & ~PF) {
988	case UI:
989	case UIH:
990	cmd = 0;
991	if (gsm_read_ea_val(val: &cmd, data: msg->data + 2, dlen: msg->len - 2) < 1)
992	break;
993	switch (cmd & ~PF) {
994	case CMD_FCOFF:
995	case CMD_FCON:
996	return true;
997	}
998	break;
999	}
1000
1001	return false;
1002	}
1003
1004	/**
1005	* gsm_data_kick - poke the queue
1006	* @gsm: GSM Mux
1007	*
1008	* The tty device has called us to indicate that room has appeared in
1009	* the transmit queue. Ram more data into the pipe if we have any.
1010	* If we have been flow-stopped by a CMD_FCOFF, then we can only
1011	* send messages on DLCI0 until CMD_FCON. The caller must hold
1012	* the gsm tx lock.
1013	*/
1014	static int gsm_data_kick(struct gsm_mux *gsm)
1015	{
1016	struct gsm_msg *msg, *nmsg;
1017	struct gsm_dlci *dlci;
1018	int ret;
1019
1020	clear_bit(TTY_DO_WRITE_WAKEUP, addr: &gsm->tty->flags);
1021
1022	/* Serialize control messages and control channel messages first */
1023	list_for_each_entry_safe(msg, nmsg, &gsm->tx_ctrl_list, list) {
1024	if (gsm->constipated && !gsm_is_flow_ctrl_msg(msg))
1025	continue;
1026	ret = gsm_send_packet(gsm, msg);
1027	switch (ret) {
1028	case -ENOSPC:
1029	return -ENOSPC;
1030	case -ENODEV:
1031	/* ldisc not open */
1032	gsm->tx_bytes -= msg->len;
1033	list_del(entry: &msg->list);
1034	kfree(objp: msg);
1035	continue;
1036	default:
1037	if (ret >= 0) {
1038	list_del(entry: &msg->list);
1039	kfree(objp: msg);
1040	}
1041	break;
1042	}
1043	}
1044
1045	if (gsm->constipated)
1046	return -EAGAIN;
1047
1048	/* Serialize other channels */
1049	if (list_empty(head: &gsm->tx_data_list))
1050	return 0;
1051	list_for_each_entry_safe(msg, nmsg, &gsm->tx_data_list, list) {
1052	dlci = gsm->dlci[msg->addr];
1053	/* Send only messages for DLCIs with valid state */
1054	if (dlci->state != DLCI_OPEN) {
1055	gsm->tx_bytes -= msg->len;
1056	list_del(entry: &msg->list);
1057	kfree(objp: msg);
1058	continue;
1059	}
1060	ret = gsm_send_packet(gsm, msg);
1061	switch (ret) {
1062	case -ENOSPC:
1063	return -ENOSPC;
1064	case -ENODEV:
1065	/* ldisc not open */
1066	gsm->tx_bytes -= msg->len;
1067	list_del(entry: &msg->list);
1068	kfree(objp: msg);
1069	continue;
1070	default:
1071	if (ret >= 0) {
1072	list_del(entry: &msg->list);
1073	kfree(objp: msg);
1074	}
1075	break;
1076	}
1077	}
1078
1079	return 1;
1080	}
1081
1082	/**
1083	* __gsm_data_queue - queue a UI or UIH frame
1084	* @dlci: DLCI sending the data
1085	* @msg: message queued
1086	*
1087	* Add data to the transmit queue and try and get stuff moving
1088	* out of the mux tty if not already doing so. The Caller must hold
1089	* the gsm tx lock.
1090	*/
1091
1092	static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
1093	{
1094	struct gsm_mux *gsm = dlci->gsm;
1095	u8 *dp = msg->data;
1096	u8 *fcs = dp + msg->len;
1097
1098	/* Fill in the header */
1099	if (gsm->encoding == GSM_BASIC_OPT) {
1100	if (msg->len < 128)
1101	*--dp = (msg->len << 1) | EA;
1102	else {
1103	*--dp = (msg->len >> 7); /* bits 7 - 15 */
1104	*--dp = (msg->len & 127) << 1; /* bits 0 - 6 */
1105	}
1106	}
1107
1108	*--dp = msg->ctrl;
1109	if (gsm->initiator)
1110	*--dp = (msg->addr << 2) | CR | EA;
1111	else
1112	*--dp = (msg->addr << 2) | EA;
1113	*fcs = gsm_fcs_add_block(INIT_FCS, c: dp , len: msg->data - dp);
1114	/* Ugly protocol layering violation */
1115	if (msg->ctrl == UI || msg->ctrl == (UI|PF))
1116	*fcs = gsm_fcs_add_block(fcs: *fcs, c: msg->data, len: msg->len);
1117	*fcs = 0xFF - *fcs;
1118
1119	gsm_print_packet(hdr: "Q> ", addr: msg->addr, cr: gsm->initiator, control: msg->ctrl,
1120	data: msg->data, dlen: msg->len);
1121
1122	/* Move the header back and adjust the length, also allow for the FCS
1123	now tacked on the end */
1124	msg->len += (msg->data - dp) + 1;
1125	msg->data = dp;
1126
1127	/* Add to the actual output queue */
1128	switch (msg->ctrl & ~PF) {
1129	case UI:
1130	case UIH:
1131	if (msg->addr > 0) {
1132	list_add_tail(new: &msg->list, head: &gsm->tx_data_list);
1133	break;
1134	}
1135	fallthrough;
1136	default:
1137	list_add_tail(new: &msg->list, head: &gsm->tx_ctrl_list);
1138	break;
1139	}
1140	gsm->tx_bytes += msg->len;
1141
1142	gsmld_write_trigger(gsm);
1143	mod_timer(timer: &gsm->kick_timer, expires: jiffies + 10 * gsm->t1 * HZ / 100);
1144	}
1145
1146	/**
1147	* gsm_data_queue - queue a UI or UIH frame
1148	* @dlci: DLCI sending the data
1149	* @msg: message queued
1150	*
1151	* Add data to the transmit queue and try and get stuff moving
1152	* out of the mux tty if not already doing so. Take the
1153	* the gsm tx lock and dlci lock.
1154	*/
1155
1156	static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
1157	{
1158	unsigned long flags;
1159	spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
1160	__gsm_data_queue(dlci, msg);
1161	spin_unlock_irqrestore(lock: &dlci->gsm->tx_lock, flags);
1162	}
1163
1164	/**
1165	* gsm_dlci_data_output - try and push data out of a DLCI
1166	* @gsm: mux
1167	* @dlci: the DLCI to pull data from
1168	*
1169	* Pull data from a DLCI and send it into the transmit queue if there
1170	* is data. Keep to the MRU of the mux. This path handles the usual tty
1171	* interface which is a byte stream with optional modem data.
1172	*
1173	* Caller must hold the tx_lock of the mux.
1174	*/
1175
1176	static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci)
1177	{
1178	struct gsm_msg *msg;
1179	u8 *dp;
1180	int h, len, size;
1181
1182	/* for modem bits without break data */
1183	h = ((dlci->adaption == 1) ? 0 : 1);
1184
1185	len = kfifo_len(&dlci->fifo);
1186	if (len == 0)
1187	return 0;
1188
1189	/* MTU/MRU count only the data bits but watch adaption mode */
1190	if ((len + h) > dlci->mtu)
1191	len = dlci->mtu - h;
1192
1193	size = len + h;
1194
1195	msg = gsm_data_alloc(gsm, addr: dlci->addr, len: size, ctrl: dlci->ftype);
1196	if (!msg)
1197	return -ENOMEM;
1198	dp = msg->data;
1199	switch (dlci->adaption) {
1200	case 1: /* Unstructured */
1201	break;
1202	case 2: /* Unstructured with modem bits.
1203	* Always one byte as we never send inline break data
1204	*/
1205	*dp++ = (gsm_encode_modem(dlci) << 1) | EA;
1206	break;
1207	default:
1208	pr_err("%s: unsupported adaption %d\n", __func__,
1209	dlci->adaption);
1210	break;
1211	}
1212
1213	WARN_ON(len != kfifo_out_locked(&dlci->fifo, dp, len,
1214	&dlci->lock));
1215
1216	/* Notify upper layer about available send space. */
1217	tty_port_tty_wakeup(port: &dlci->port);
1218
1219	__gsm_data_queue(dlci, msg);
1220	/* Bytes of data we used up */
1221	return size;
1222	}
1223
1224	/**
1225	* gsm_dlci_data_output_framed - try and push data out of a DLCI
1226	* @gsm: mux
1227	* @dlci: the DLCI to pull data from
1228	*
1229	* Pull data from a DLCI and send it into the transmit queue if there
1230	* is data. Keep to the MRU of the mux. This path handles framed data
1231	* queued as skbuffs to the DLCI.
1232	*
1233	* Caller must hold the tx_lock of the mux.
1234	*/
1235
1236	static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
1237	struct gsm_dlci *dlci)
1238	{
1239	struct gsm_msg *msg;
1240	u8 *dp;
1241	int len, size;
1242	int last = 0, first = 0;
1243	int overhead = 0;
1244
1245	/* One byte per frame is used for B/F flags */
1246	if (dlci->adaption == 4)
1247	overhead = 1;
1248
1249	/* dlci->skb is locked by tx_lock */
1250	if (dlci->skb == NULL) {
1251	dlci->skb = skb_dequeue_tail(list: &dlci->skb_list);
1252	if (dlci->skb == NULL)
1253	return 0;
1254	first = 1;
1255	}
1256	len = dlci->skb->len + overhead;
1257
1258	/* MTU/MRU count only the data bits */
1259	if (len > dlci->mtu) {
1260	if (dlci->adaption == 3) {
1261	/* Over long frame, bin it */
1262	dev_kfree_skb_any(skb: dlci->skb);
1263	dlci->skb = NULL;
1264	return 0;
1265	}
1266	len = dlci->mtu;
1267	} else
1268	last = 1;
1269
1270	size = len + overhead;
1271	msg = gsm_data_alloc(gsm, addr: dlci->addr, len: size, ctrl: dlci->ftype);
1272	if (msg == NULL) {
1273	skb_queue_tail(list: &dlci->skb_list, newsk: dlci->skb);
1274	dlci->skb = NULL;
1275	return -ENOMEM;
1276	}
1277	dp = msg->data;
1278
1279	if (dlci->adaption == 4) { /* Interruptible framed (Packetised Data) */
1280	/* Flag byte to carry the start/end info */
1281	*dp++ = last << 7 | first << 6 | 1; /* EA */
1282	len--;
1283	}
1284	memcpy(dp, dlci->skb->data, len);
1285	skb_pull(skb: dlci->skb, len);
1286	__gsm_data_queue(dlci, msg);
1287	if (last) {
1288	dev_kfree_skb_any(skb: dlci->skb);
1289	dlci->skb = NULL;
1290	}
1291	return size;
1292	}
1293
1294	/**
1295	* gsm_dlci_modem_output - try and push modem status out of a DLCI
1296	* @gsm: mux
1297	* @dlci: the DLCI to pull modem status from
1298	* @brk: break signal
1299	*
1300	* Push an empty frame in to the transmit queue to update the modem status
1301	* bits and to transmit an optional break.
1302	*
1303	* Caller must hold the tx_lock of the mux.
1304	*/
1305
1306	static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci,
1307	u8 brk)
1308	{
1309	u8 *dp = NULL;
1310	struct gsm_msg *msg;
1311	int size = 0;
1312
1313	/* for modem bits without break data */
1314	switch (dlci->adaption) {
1315	case 1: /* Unstructured */
1316	break;
1317	case 2: /* Unstructured with modem bits. */
1318	size++;
1319	if (brk > 0)
1320	size++;
1321	break;
1322	default:
1323	pr_err("%s: unsupported adaption %d\n", __func__,
1324	dlci->adaption);
1325	return -EINVAL;
1326	}
1327
1328	msg = gsm_data_alloc(gsm, addr: dlci->addr, len: size, ctrl: dlci->ftype);
1329	if (!msg) {
1330	pr_err("%s: gsm_data_alloc error", __func__);
1331	return -ENOMEM;
1332	}
1333	dp = msg->data;
1334	switch (dlci->adaption) {
1335	case 1: /* Unstructured */
1336	break;
1337	case 2: /* Unstructured with modem bits. */
1338	if (brk == 0) {
1339	*dp++ = (gsm_encode_modem(dlci) << 1) | EA;
1340	} else {
1341	*dp++ = gsm_encode_modem(dlci) << 1;
1342	*dp++ = (brk << 4) | 2 | EA; /* Length, Break, EA */
1343	}
1344	break;
1345	default:
1346	/* Handled above */
1347	break;
1348	}
1349
1350	__gsm_data_queue(dlci, msg);
1351	return size;
1352	}
1353
1354	/**
1355	* gsm_dlci_data_sweep - look for data to send
1356	* @gsm: the GSM mux
1357	*
1358	* Sweep the GSM mux channels in priority order looking for ones with
1359	* data to send. We could do with optimising this scan a bit. We aim
1360	* to fill the queue totally or up to TX_THRESH_HI bytes. Once we hit
1361	* TX_THRESH_LO we get called again
1362	*
1363	* FIXME: We should round robin between groups and in theory you can
1364	* renegotiate DLCI priorities with optional stuff. Needs optimising.
1365	*/
1366
1367	static int gsm_dlci_data_sweep(struct gsm_mux *gsm)
1368	{
1369	/* Priority ordering: We should do priority with RR of the groups */
1370	int i, len, ret = 0;
1371	bool sent;
1372	struct gsm_dlci *dlci;
1373
1374	while (gsm->tx_bytes < TX_THRESH_HI) {
1375	for (sent = false, i = 1; i < NUM_DLCI; i++) {
1376	dlci = gsm->dlci[i];
1377	/* skip unused or blocked channel */
1378	if (!dlci || dlci->constipated)
1379	continue;
1380	/* skip channels with invalid state */
1381	if (dlci->state != DLCI_OPEN)
1382	continue;
1383	/* count the sent data per adaption */
1384	if (dlci->adaption < 3 && !dlci->net)
1385	len = gsm_dlci_data_output(gsm, dlci);
1386	else
1387	len = gsm_dlci_data_output_framed(gsm, dlci);
1388	/* on error exit */
1389	if (len < 0)
1390	return ret;
1391	if (len > 0) {
1392	ret++;
1393	sent = true;
1394	/* The lower DLCs can starve the higher DLCs! */
1395	break;
1396	}
1397	/* try next */
1398	}
1399	if (!sent)
1400	break;
1401	}
1402
1403	return ret;
1404	}
1405
1406	/**
1407	* gsm_dlci_data_kick - transmit if possible
1408	* @dlci: DLCI to kick
1409	*
1410	* Transmit data from this DLCI if the queue is empty. We can't rely on
1411	* a tty wakeup except when we filled the pipe so we need to fire off
1412	* new data ourselves in other cases.
1413	*/
1414
1415	static void gsm_dlci_data_kick(struct gsm_dlci *dlci)
1416	{
1417	unsigned long flags;
1418	int sweep;
1419
1420	if (dlci->constipated)
1421	return;
1422
1423	spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
1424	/* If we have nothing running then we need to fire up */
1425	sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO);
1426	if (dlci->gsm->tx_bytes == 0) {
1427	if (dlci->net)
1428	gsm_dlci_data_output_framed(gsm: dlci->gsm, dlci);
1429	else
1430	gsm_dlci_data_output(gsm: dlci->gsm, dlci);
1431	}
1432	if (sweep)
1433	gsm_dlci_data_sweep(gsm: dlci->gsm);
1434	spin_unlock_irqrestore(lock: &dlci->gsm->tx_lock, flags);
1435	}
1436
1437	/*
1438	* Control message processing
1439	*/
1440
1441
1442	/**
1443	* gsm_control_command - send a command frame to a control
1444	* @gsm: gsm channel
1445	* @cmd: the command to use
1446	* @data: data to follow encoded info
1447	* @dlen: length of data
1448	*
1449	* Encode up and queue a UI/UIH frame containing our command.
1450	*/
1451	static int gsm_control_command(struct gsm_mux *gsm, int cmd, const u8 *data,
1452	int dlen)
1453	{
1454	struct gsm_msg *msg;
1455	struct gsm_dlci *dlci = gsm->dlci[0];
1456
1457	msg = gsm_data_alloc(gsm, addr: 0, len: dlen + 2, ctrl: dlci->ftype);
1458	if (msg == NULL)
1459	return -ENOMEM;
1460
1461	msg->data[0] = (cmd << 1) | CR | EA; /* Set C/R */
1462	msg->data[1] = (dlen << 1) | EA;
1463	memcpy(msg->data + 2, data, dlen);
1464	gsm_data_queue(dlci, msg);
1465
1466	return 0;
1467	}
1468
1469	/**
1470	* gsm_control_reply - send a response frame to a control
1471	* @gsm: gsm channel
1472	* @cmd: the command to use
1473	* @data: data to follow encoded info
1474	* @dlen: length of data
1475	*
1476	* Encode up and queue a UI/UIH frame containing our response.
1477	*/
1478
1479	static void gsm_control_reply(struct gsm_mux *gsm, int cmd, const u8 *data,
1480	int dlen)
1481	{
1482	struct gsm_msg *msg;
1483	struct gsm_dlci *dlci = gsm->dlci[0];
1484
1485	msg = gsm_data_alloc(gsm, addr: 0, len: dlen + 2, ctrl: dlci->ftype);
1486	if (msg == NULL)
1487	return;
1488	msg->data[0] = (cmd & 0xFE) << 1 | EA; /* Clear C/R */
1489	msg->data[1] = (dlen << 1) | EA;
1490	memcpy(msg->data + 2, data, dlen);
1491	gsm_data_queue(dlci, msg);
1492	}
1493
1494	/**
1495	* gsm_process_modem - process received modem status
1496	* @tty: virtual tty bound to the DLCI
1497	* @dlci: DLCI to affect
1498	* @modem: modem bits (full EA)
1499	* @slen: number of signal octets
1500	*
1501	* Used when a modem control message or line state inline in adaption
1502	* layer 2 is processed. Sort out the local modem state and throttles
1503	*/
1504
1505	static void gsm_process_modem(struct tty_struct *tty, struct gsm_dlci *dlci,
1506	u32 modem, int slen)
1507	{
1508	int mlines = 0;
1509	u8 brk = 0;
1510	int fc;
1511
1512	/* The modem status command can either contain one octet (V.24 signals)
1513	* or two octets (V.24 signals + break signals). This is specified in
1514	* section 5.4.6.3.7 of the 07.10 mux spec.
1515	*/
1516
1517	if (slen == 1)
1518	modem = modem & 0x7f;
1519	else {
1520	brk = modem & 0x7f;
1521	modem = (modem >> 7) & 0x7f;
1522	}
1523
1524	/* Flow control/ready to communicate */
1525	fc = (modem & MDM_FC) || !(modem & MDM_RTR);
1526	if (fc && !dlci->constipated) {
1527	/* Need to throttle our output on this device */
1528	dlci->constipated = true;
1529	} else if (!fc && dlci->constipated) {
1530	dlci->constipated = false;
1531	gsm_dlci_data_kick(dlci);
1532	}
1533
1534	/* Map modem bits */
1535	if (modem & MDM_RTC)
1536	mlines |= TIOCM_DSR | TIOCM_DTR;
1537	if (modem & MDM_RTR)
1538	mlines |= TIOCM_RTS | TIOCM_CTS;
1539	if (modem & MDM_IC)
1540	mlines |= TIOCM_RI;
1541	if (modem & MDM_DV)
1542	mlines |= TIOCM_CD;
1543
1544	/* Carrier drop -> hangup */
1545	if (tty) {
1546	if ((mlines & TIOCM_CD) == 0 && (dlci->modem_rx & TIOCM_CD))
1547	if (!C_CLOCAL(tty))
1548	tty_hangup(tty);
1549	}
1550	if (brk & 0x01)
1551	tty_insert_flip_char(port: &dlci->port, ch: 0, TTY_BREAK);
1552	dlci->modem_rx = mlines;
1553	wake_up_interruptible(&dlci->gsm->event);
1554	}
1555
1556	/**
1557	* gsm_process_negotiation - process received parameters
1558	* @gsm: GSM channel
1559	* @addr: DLCI address
1560	* @cr: command/response
1561	* @params: encoded parameters from the parameter negotiation message
1562	*
1563	* Used when the response for our parameter negotiation command was
1564	* received.
1565	*/
1566	static int gsm_process_negotiation(struct gsm_mux *gsm, unsigned int addr,
1567	unsigned int cr,
1568	const struct gsm_dlci_param_bits *params)
1569	{
1570	struct gsm_dlci *dlci = gsm->dlci[addr];
1571	unsigned int ftype, i, adaption, prio, n1, k;
1572
1573	i = FIELD_GET(PN_I_CL_FIELD_FTYPE, params->i_cl_bits);
1574	adaption = FIELD_GET(PN_I_CL_FIELD_ADAPTION, params->i_cl_bits) + 1;
1575	prio = FIELD_GET(PN_P_FIELD_PRIO, params->p_bits);
1576	n1 = FIELD_GET(PN_N_FIELD_N1, get_unaligned_le16(&params->n_bits));
1577	k = FIELD_GET(PN_K_FIELD_K, params->k_bits);
1578
1579	if (n1 < MIN_MTU) {
1580	if (debug & DBG_ERRORS)
1581	pr_info("%s N1 out of range in PN\n", __func__);
1582	return -EINVAL;
1583	}
1584
1585	switch (i) {
1586	case 0x00:
1587	ftype = UIH;
1588	break;
1589	case 0x01:
1590	ftype = UI;
1591	break;
1592	case 0x02: /* I frames are not supported */
1593	if (debug & DBG_ERRORS)
1594	pr_info("%s unsupported I frame request in PN\n",
1595	__func__);
1596	gsm->unsupported++;
1597	return -EINVAL;
1598	default:
1599	if (debug & DBG_ERRORS)
1600	pr_info("%s i out of range in PN\n", __func__);
1601	return -EINVAL;
1602	}
1603
1604	if (!cr && gsm->initiator) {
1605	if (adaption != dlci->adaption) {
1606	if (debug & DBG_ERRORS)
1607	pr_info("%s invalid adaption %d in PN\n",
1608	__func__, adaption);
1609	return -EINVAL;
1610	}
1611	if (prio != dlci->prio) {
1612	if (debug & DBG_ERRORS)
1613	pr_info("%s invalid priority %d in PN",
1614	__func__, prio);
1615	return -EINVAL;
1616	}
1617	if (n1 > gsm->mru || n1 > dlci->mtu) {
1618	/* We requested a frame size but the other party wants
1619	* to send larger frames. The standard allows only a
1620	* smaller response value than requested (5.4.6.3.1).
1621	*/
1622	if (debug & DBG_ERRORS)
1623	pr_info("%s invalid N1 %d in PN\n", __func__,
1624	n1);
1625	return -EINVAL;
1626	}
1627	dlci->mtu = n1;
1628	if (ftype != dlci->ftype) {
1629	if (debug & DBG_ERRORS)
1630	pr_info("%s invalid i %d in PN\n", __func__, i);
1631	return -EINVAL;
1632	}
1633	if (ftype != UI && ftype != UIH && k > dlci->k) {
1634	if (debug & DBG_ERRORS)
1635	pr_info("%s invalid k %d in PN\n", __func__, k);
1636	return -EINVAL;
1637	}
1638	dlci->k = k;
1639	} else if (cr && !gsm->initiator) {
1640	/* Only convergence layer type 1 and 2 are supported. */
1641	if (adaption != 1 && adaption != 2) {
1642	if (debug & DBG_ERRORS)
1643	pr_info("%s invalid adaption %d in PN\n",
1644	__func__, adaption);
1645	return -EINVAL;
1646	}
1647	dlci->adaption = adaption;
1648	if (n1 > gsm->mru) {
1649	/* Propose a smaller value */
1650	dlci->mtu = gsm->mru;
1651	} else if (n1 > MAX_MTU) {
1652	/* Propose a smaller value */
1653	dlci->mtu = MAX_MTU;
1654	} else {
1655	dlci->mtu = n1;
1656	}
1657	dlci->prio = prio;
1658	dlci->ftype = ftype;
1659	dlci->k = k;
1660	} else {
1661	return -EINVAL;
1662	}
1663
1664	return 0;
1665	}
1666
1667	/**
1668	* gsm_control_modem - modem status received
1669	* @gsm: GSM channel
1670	* @data: data following command
1671	* @clen: command length
1672	*
1673	* We have received a modem status control message. This is used by
1674	* the GSM mux protocol to pass virtual modem line status and optionally
1675	* to indicate break signals. Unpack it, convert to Linux representation
1676	* and if need be stuff a break message down the tty.
1677	*/
1678
1679	static void gsm_control_modem(struct gsm_mux *gsm, const u8 *data, int clen)
1680	{
1681	unsigned int addr = 0;
1682	unsigned int modem = 0;
1683	struct gsm_dlci *dlci;
1684	int len = clen;
1685	int cl = clen;
1686	const u8 *dp = data;
1687	struct tty_struct *tty;
1688
1689	len = gsm_read_ea_val(val: &addr, data, dlen: cl);
1690	if (len < 1)
1691	return;
1692
1693	addr >>= 1;
1694	/* Closed port, or invalid ? */
1695	if (addr == 0 || addr >= NUM_DLCI || gsm->dlci[addr] == NULL)
1696	return;
1697	dlci = gsm->dlci[addr];
1698
1699	/* Must be at least one byte following the EA */
1700	if ((cl - len) < 1)
1701	return;
1702
1703	dp += len;
1704	cl -= len;
1705
1706	/* get the modem status */
1707	len = gsm_read_ea_val(val: &modem, data: dp, dlen: cl);
1708	if (len < 1)
1709	return;
1710
1711	tty = tty_port_tty_get(port: &dlci->port);
1712	gsm_process_modem(tty, dlci, modem, slen: cl);
1713	if (tty) {
1714	tty_wakeup(tty);
1715	tty_kref_put(tty);
1716	}
1717	gsm_control_reply(gsm, CMD_MSC, data, dlen: clen);
1718	}
1719
1720	/**
1721	* gsm_control_negotiation - parameter negotiation received
1722	* @gsm: GSM channel
1723	* @cr: command/response flag
1724	* @data: data following command
1725	* @dlen: data length
1726	*
1727	* We have received a parameter negotiation message. This is used by
1728	* the GSM mux protocol to configure protocol parameters for a new DLCI.
1729	*/
1730	static void gsm_control_negotiation(struct gsm_mux *gsm, unsigned int cr,
1731	const u8 *data, unsigned int dlen)
1732	{
1733	unsigned int addr;
1734	struct gsm_dlci_param_bits pn_reply;
1735	struct gsm_dlci *dlci;
1736	struct gsm_dlci_param_bits *params;
1737
1738	if (dlen < sizeof(struct gsm_dlci_param_bits)) {
1739	gsm->open_error++;
1740	return;
1741	}
1742
1743	/* Invalid DLCI? */
1744	params = (struct gsm_dlci_param_bits *)data;
1745	addr = FIELD_GET(PN_D_FIELD_DLCI, params->d_bits);
1746	if (addr == 0 || addr >= NUM_DLCI || !gsm->dlci[addr]) {
1747	gsm->open_error++;
1748	return;
1749	}
1750	dlci = gsm->dlci[addr];
1751
1752	/* Too late for parameter negotiation? */
1753	if ((!cr && dlci->state == DLCI_OPENING) || dlci->state == DLCI_OPEN) {
1754	gsm->open_error++;
1755	return;
1756	}
1757
1758	/* Process the received parameters */
1759	if (gsm_process_negotiation(gsm, addr, cr, params) != 0) {
1760	/* Negotiation failed. Close the link. */
1761	if (debug & DBG_ERRORS)
1762	pr_info("%s PN failed\n", __func__);
1763	gsm->open_error++;
1764	gsm_dlci_close(dlci);
1765	return;
1766	}
1767
1768	if (cr) {
1769	/* Reply command with accepted parameters. */
1770	if (gsm_encode_params(dlci, params: &pn_reply) == 0)
1771	gsm_control_reply(gsm, CMD_PN, data: (const u8 *)&pn_reply,
1772	dlen: sizeof(pn_reply));
1773	else if (debug & DBG_ERRORS)
1774	pr_info("%s PN invalid\n", __func__);
1775	} else if (dlci->state == DLCI_CONFIGURE) {
1776	/* Proceed with link setup by sending SABM before UA */
1777	dlci->state = DLCI_OPENING;
1778	gsm_command(gsm, addr: dlci->addr, SABM|PF);
1779	mod_timer(timer: &dlci->t1, expires: jiffies + gsm->t1 * HZ / 100);
1780	} else {
1781	if (debug & DBG_ERRORS)
1782	pr_info("%s PN in invalid state\n", __func__);
1783	gsm->open_error++;
1784	}
1785	}
1786
1787	/**
1788	* gsm_control_rls - remote line status
1789	* @gsm: GSM channel
1790	* @data: data bytes
1791	* @clen: data length
1792	*
1793	* The modem sends us a two byte message on the control channel whenever
1794	* it wishes to send us an error state from the virtual link. Stuff
1795	* this into the uplink tty if present
1796	*/
1797
1798	static void gsm_control_rls(struct gsm_mux *gsm, const u8 *data, int clen)
1799	{
1800	struct tty_port *port;
1801	unsigned int addr = 0;
1802	u8 bits;
1803	int len = clen;
1804	const u8 *dp = data;
1805
1806	while (gsm_read_ea(val: &addr, c: *dp++) == 0) {
1807	len--;
1808	if (len == 0)
1809	return;
1810	}
1811	/* Must be at least one byte following ea */
1812	len--;
1813	if (len <= 0)
1814	return;
1815	addr >>= 1;
1816	/* Closed port, or invalid ? */
1817	if (addr == 0 || addr >= NUM_DLCI || gsm->dlci[addr] == NULL)
1818	return;
1819	/* No error ? */
1820	bits = *dp;
1821	if ((bits & 1) == 0)
1822	return;
1823
1824	port = &gsm->dlci[addr]->port;
1825
1826	if (bits & 2)
1827	tty_insert_flip_char(port, ch: 0, TTY_OVERRUN);
1828	if (bits & 4)
1829	tty_insert_flip_char(port, ch: 0, TTY_PARITY);
1830	if (bits & 8)
1831	tty_insert_flip_char(port, ch: 0, TTY_FRAME);
1832
1833	tty_flip_buffer_push(port);
1834
1835	gsm_control_reply(gsm, CMD_RLS, data, dlen: clen);
1836	}
1837
1838	static void gsm_dlci_begin_close(struct gsm_dlci *dlci);
1839
1840	/**
1841	* gsm_control_message - DLCI 0 control processing
1842	* @gsm: our GSM mux
1843	* @command: the command EA
1844	* @data: data beyond the command/length EAs
1845	* @clen: length
1846	*
1847	* Input processor for control messages from the other end of the link.
1848	* Processes the incoming request and queues a response frame or an
1849	* NSC response if not supported
1850	*/
1851
1852	static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
1853	const u8 *data, int clen)
1854	{
1855	u8 buf[1];
1856
1857	switch (command) {
1858	case CMD_CLD: {
1859	struct gsm_dlci *dlci = gsm->dlci[0];
1860	/* Modem wishes to close down */
1861	if (dlci) {
1862	dlci->dead = true;
1863	gsm->dead = true;
1864	gsm_dlci_begin_close(dlci);
1865	}
1866	}
1867	break;
1868	case CMD_TEST:
1869	/* Modem wishes to test, reply with the data */
1870	gsm_control_reply(gsm, CMD_TEST, data, dlen: clen);
1871	break;
1872	case CMD_FCON:
1873	/* Modem can accept data again */
1874	gsm->constipated = false;
1875	gsm_control_reply(gsm, CMD_FCON, NULL, dlen: 0);
1876	/* Kick the link in case it is idling */
1877	gsmld_write_trigger(gsm);
1878	break;
1879	case CMD_FCOFF:
1880	/* Modem wants us to STFU */
1881	gsm->constipated = true;
1882	gsm_control_reply(gsm, CMD_FCOFF, NULL, dlen: 0);
1883	break;
1884	case CMD_MSC:
1885	/* Out of band modem line change indicator for a DLCI */
1886	gsm_control_modem(gsm, data, clen);
1887	break;
1888	case CMD_RLS:
1889	/* Out of band error reception for a DLCI */
1890	gsm_control_rls(gsm, data, clen);
1891	break;
1892	case CMD_PSC:
1893	/* Modem wishes to enter power saving state */
1894	gsm_control_reply(gsm, CMD_PSC, NULL, dlen: 0);
1895	break;
1896	/* Optional commands */
1897	case CMD_PN:
1898	/* Modem sends a parameter negotiation command */
1899	gsm_control_negotiation(gsm, cr: 1, data, dlen: clen);
1900	break;
1901	/* Optional unsupported commands */
1902	case CMD_RPN: /* Remote port negotiation */
1903	case CMD_SNC: /* Service negotiation command */
1904	gsm->unsupported++;
1905	fallthrough;
1906	default:
1907	/* Reply to bad commands with an NSC */
1908	buf[0] = command;
1909	gsm_control_reply(gsm, CMD_NSC, data: buf, dlen: 1);
1910	break;
1911	}
1912	}
1913
1914	/**
1915	* gsm_control_response - process a response to our control
1916	* @gsm: our GSM mux
1917	* @command: the command (response) EA
1918	* @data: data beyond the command/length EA
1919	* @clen: length
1920	*
1921	* Process a response to an outstanding command. We only allow a single
1922	* control message in flight so this is fairly easy. All the clean up
1923	* is done by the caller, we just update the fields, flag it as done
1924	* and return
1925	*/
1926
1927	static void gsm_control_response(struct gsm_mux *gsm, unsigned int command,
1928	const u8 *data, int clen)
1929	{
1930	struct gsm_control *ctrl;
1931	struct gsm_dlci *dlci;
1932	unsigned long flags;
1933
1934	spin_lock_irqsave(&gsm->control_lock, flags);
1935
1936	ctrl = gsm->pending_cmd;
1937	dlci = gsm->dlci[0];
1938	command |= 1;
1939	/* Does the reply match our command */
1940	if (ctrl != NULL && (command == ctrl->cmd || command == CMD_NSC)) {
1941	/* Our command was replied to, kill the retry timer */
1942	del_timer(timer: &gsm->t2_timer);
1943	gsm->pending_cmd = NULL;
1944	/* Rejected by the other end */
1945	if (command == CMD_NSC)
1946	ctrl->error = -EOPNOTSUPP;
1947	ctrl->done = 1;
1948	wake_up(&gsm->event);
1949	/* Or did we receive the PN response to our PN command */
1950	} else if (command == CMD_PN) {
1951	gsm_control_negotiation(gsm, cr: 0, data, dlen: clen);
1952	/* Or did we receive the TEST response to our TEST command */
1953	} else if (command == CMD_TEST && clen == 1 && *data == gsm->ka_num) {
1954	gsm->ka_retries = -1; /* trigger new keep-alive message */
1955	if (dlci && !dlci->dead)
1956	mod_timer(timer: &gsm->ka_timer, expires: jiffies + gsm->keep_alive * HZ / 100);
1957	}
1958	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
1959	}
1960
1961	/**
1962	* gsm_control_keep_alive - check timeout or start keep-alive
1963	* @t: timer contained in our gsm object
1964	*
1965	* Called off the keep-alive timer expiry signaling that our link
1966	* partner is not responding anymore. Link will be closed.
1967	* This is also called to startup our timer.
1968	*/
1969
1970	static void gsm_control_keep_alive(struct timer_list *t)
1971	{
1972	struct gsm_mux *gsm = from_timer(gsm, t, ka_timer);
1973	unsigned long flags;
1974
1975	spin_lock_irqsave(&gsm->control_lock, flags);
1976	if (gsm->ka_num && gsm->ka_retries == 0) {
1977	/* Keep-alive expired -> close the link */
1978	if (debug & DBG_ERRORS)
1979	pr_debug("%s keep-alive timed out\n", __func__);
1980	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
1981	if (gsm->dlci[0])
1982	gsm_dlci_begin_close(dlci: gsm->dlci[0]);
1983	return;
1984	} else if (gsm->keep_alive && gsm->dlci[0] && !gsm->dlci[0]->dead) {
1985	if (gsm->ka_retries > 0) {
1986	/* T2 expired for keep-alive -> resend */
1987	gsm->ka_retries--;
1988	} else {
1989	/* Start keep-alive timer */
1990	gsm->ka_num++;
1991	if (!gsm->ka_num)
1992	gsm->ka_num++;
1993	gsm->ka_retries = (signed int)gsm->n2;
1994	}
1995	gsm_control_command(gsm, CMD_TEST, data: &gsm->ka_num,
1996	dlen: sizeof(gsm->ka_num));
1997	mod_timer(timer: &gsm->ka_timer,
1998	expires: jiffies + gsm->t2 * HZ / 100);
1999	}
2000	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
2001	}
2002
2003	/**
2004	* gsm_control_transmit - send control packet
2005	* @gsm: gsm mux
2006	* @ctrl: frame to send
2007	*
2008	* Send out a pending control command (called under control lock)
2009	*/
2010
2011	static void gsm_control_transmit(struct gsm_mux *gsm, struct gsm_control *ctrl)
2012	{
2013	gsm_control_command(gsm, cmd: ctrl->cmd, data: ctrl->data, dlen: ctrl->len);
2014	}
2015
2016	/**
2017	* gsm_control_retransmit - retransmit a control frame
2018	* @t: timer contained in our gsm object
2019	*
2020	* Called off the T2 timer expiry in order to retransmit control frames
2021	* that have been lost in the system somewhere. The control_lock protects
2022	* us from colliding with another sender or a receive completion event.
2023	* In that situation the timer may still occur in a small window but
2024	* gsm->pending_cmd will be NULL and we just let the timer expire.
2025	*/
2026
2027	static void gsm_control_retransmit(struct timer_list *t)
2028	{
2029	struct gsm_mux *gsm = from_timer(gsm, t, t2_timer);
2030	struct gsm_control *ctrl;
2031	unsigned long flags;
2032	spin_lock_irqsave(&gsm->control_lock, flags);
2033	ctrl = gsm->pending_cmd;
2034	if (ctrl) {
2035	if (gsm->cretries == 0 || !gsm->dlci[0] || gsm->dlci[0]->dead) {
2036	gsm->pending_cmd = NULL;
2037	ctrl->error = -ETIMEDOUT;
2038	ctrl->done = 1;
2039	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
2040	wake_up(&gsm->event);
2041	return;
2042	}
2043	gsm->cretries--;
2044	gsm_control_transmit(gsm, ctrl);
2045	mod_timer(timer: &gsm->t2_timer, expires: jiffies + gsm->t2 * HZ / 100);
2046	}
2047	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
2048	}
2049
2050	/**
2051	* gsm_control_send - send a control frame on DLCI 0
2052	* @gsm: the GSM channel
2053	* @command: command to send including CR bit
2054	* @data: bytes of data (must be kmalloced)
2055	* @clen: length of the block to send
2056	*
2057	* Queue and dispatch a control command. Only one command can be
2058	* active at a time. In theory more can be outstanding but the matching
2059	* gets really complicated so for now stick to one outstanding.
2060	*/
2061
2062	static struct gsm_control *gsm_control_send(struct gsm_mux *gsm,
2063	unsigned int command, u8 *data, int clen)
2064	{
2065	struct gsm_control *ctrl = kzalloc(size: sizeof(struct gsm_control),
2066	GFP_ATOMIC);
2067	unsigned long flags;
2068	if (ctrl == NULL)
2069	return NULL;
2070	retry:
2071	wait_event(gsm->event, gsm->pending_cmd == NULL);
2072	spin_lock_irqsave(&gsm->control_lock, flags);
2073	if (gsm->pending_cmd != NULL) {
2074	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
2075	goto retry;
2076	}
2077	ctrl->cmd = command;
2078	ctrl->data = data;
2079	ctrl->len = clen;
2080	gsm->pending_cmd = ctrl;
2081
2082	/* If DLCI0 is in ADM mode skip retries, it won't respond */
2083	if (gsm->dlci[0]->mode == DLCI_MODE_ADM)
2084	gsm->cretries = 0;
2085	else
2086	gsm->cretries = gsm->n2;
2087
2088	mod_timer(timer: &gsm->t2_timer, expires: jiffies + gsm->t2 * HZ / 100);
2089	gsm_control_transmit(gsm, ctrl);
2090	spin_unlock_irqrestore(lock: &gsm->control_lock, flags);
2091	return ctrl;
2092	}
2093
2094	/**
2095	* gsm_control_wait - wait for a control to finish
2096	* @gsm: GSM mux
2097	* @control: control we are waiting on
2098	*
2099	* Waits for the control to complete or time out. Frees any used
2100	* resources and returns 0 for success, or an error if the remote
2101	* rejected or ignored the request.
2102	*/
2103
2104	static int gsm_control_wait(struct gsm_mux *gsm, struct gsm_control *control)
2105	{
2106	int err;
2107	wait_event(gsm->event, control->done == 1);
2108	err = control->error;
2109	kfree(objp: control);
2110	return err;
2111	}
2112
2113
2114	/*
2115	* DLCI level handling: Needs krefs
2116	*/
2117
2118	/*
2119	* State transitions and timers
2120	*/
2121
2122	/**
2123	* gsm_dlci_close - a DLCI has closed
2124	* @dlci: DLCI that closed
2125	*
2126	* Perform processing when moving a DLCI into closed state. If there
2127	* is an attached tty this is hung up
2128	*/
2129
2130	static void gsm_dlci_close(struct gsm_dlci *dlci)
2131	{
2132	del_timer(timer: &dlci->t1);
2133	if (debug & DBG_ERRORS)
2134	pr_debug("DLCI %d goes closed.\n", dlci->addr);
2135	dlci->state = DLCI_CLOSED;
2136	/* Prevent us from sending data before the link is up again */
2137	dlci->constipated = true;
2138	if (dlci->addr != 0) {
2139	tty_port_tty_hangup(port: &dlci->port, check_clocal: false);
2140	gsm_dlci_clear_queues(gsm: dlci->gsm, dlci);
2141	/* Ensure that gsmtty_open() can return. */
2142	tty_port_set_initialized(port: &dlci->port, val: false);
2143	wake_up_interruptible(&dlci->port.open_wait);
2144	} else {
2145	del_timer(timer: &dlci->gsm->ka_timer);
2146	dlci->gsm->dead = true;
2147	}
2148	/* A DLCI 0 close is a MUX termination so we need to kick that
2149	back to userspace somehow */
2150	gsm_dlci_data_kick(dlci);
2151	wake_up_all(&dlci->gsm->event);
2152	}
2153
2154	/**
2155	* gsm_dlci_open - a DLCI has opened
2156	* @dlci: DLCI that opened
2157	*
2158	* Perform processing when moving a DLCI into open state.
2159	*/
2160
2161	static void gsm_dlci_open(struct gsm_dlci *dlci)
2162	{
2163	struct gsm_mux *gsm = dlci->gsm;
2164
2165	/* Note that SABM UA .. SABM UA first UA lost can mean that we go
2166	open -> open */
2167	del_timer(timer: &dlci->t1);
2168	/* This will let a tty open continue */
2169	dlci->state = DLCI_OPEN;
2170	dlci->constipated = false;
2171	if (debug & DBG_ERRORS)
2172	pr_debug("DLCI %d goes open.\n", dlci->addr);
2173	/* Send current modem state */
2174	if (dlci->addr) {
2175	gsm_modem_update(dlci, brk: 0);
2176	} else {
2177	/* Start keep-alive control */
2178	gsm->ka_num = 0;
2179	gsm->ka_retries = -1;
2180	mod_timer(timer: &gsm->ka_timer,
2181	expires: jiffies + gsm->keep_alive * HZ / 100);
2182	}
2183	gsm_dlci_data_kick(dlci);
2184	wake_up(&dlci->gsm->event);
2185	}
2186
2187	/**
2188	* gsm_dlci_negotiate - start parameter negotiation
2189	* @dlci: DLCI to open
2190	*
2191	* Starts the parameter negotiation for the new DLCI. This needs to be done
2192	* before the DLCI initialized the channel via SABM.
2193	*/
2194	static int gsm_dlci_negotiate(struct gsm_dlci *dlci)
2195	{
2196	struct gsm_mux *gsm = dlci->gsm;
2197	struct gsm_dlci_param_bits params;
2198	int ret;
2199
2200	ret = gsm_encode_params(dlci, params: &params);
2201	if (ret != 0)
2202	return ret;
2203
2204	/* We cannot asynchronous wait for the command response with
2205	* gsm_command() and gsm_control_wait() at this point.
2206	*/
2207	ret = gsm_control_command(gsm, CMD_PN, data: (const u8 *)&params,
2208	dlen: sizeof(params));
2209
2210	return ret;
2211	}
2212
2213	/**
2214	* gsm_dlci_t1 - T1 timer expiry
2215	* @t: timer contained in the DLCI that opened
2216	*
2217	* The T1 timer handles retransmits of control frames (essentially of
2218	* SABM and DISC). We resend the command until the retry count runs out
2219	* in which case an opening port goes back to closed and a closing port
2220	* is simply put into closed state (any further frames from the other
2221	* end will get a DM response)
2222	*
2223	* Some control dlci can stay in ADM mode with other dlci working just
2224	* fine. In that case we can just keep the control dlci open after the
2225	* DLCI_OPENING retries time out.
2226	*/
2227
2228	static void gsm_dlci_t1(struct timer_list *t)
2229	{
2230	struct gsm_dlci *dlci = from_timer(dlci, t, t1);
2231	struct gsm_mux *gsm = dlci->gsm;
2232
2233	switch (dlci->state) {
2234	case DLCI_CONFIGURE:
2235	if (dlci->retries && gsm_dlci_negotiate(dlci) == 0) {
2236	dlci->retries--;
2237	mod_timer(timer: &dlci->t1, expires: jiffies + gsm->t1 * HZ / 100);
2238	} else {
2239	gsm->open_error++;
2240	gsm_dlci_begin_close(dlci); /* prevent half open link */
2241	}
2242	break;
2243	case DLCI_OPENING:
2244	if (dlci->retries) {
2245	dlci->retries--;
2246	gsm_command(gsm: dlci->gsm, addr: dlci->addr, SABM|PF);
2247	mod_timer(timer: &dlci->t1, expires: jiffies + gsm->t1 * HZ / 100);
2248	} else if (!dlci->addr && gsm->control == (DM | PF)) {
2249	if (debug & DBG_ERRORS)
2250	pr_info("DLCI %d opening in ADM mode.\n",
2251	dlci->addr);
2252	dlci->mode = DLCI_MODE_ADM;
2253	gsm_dlci_open(dlci);
2254	} else {
2255	gsm->open_error++;
2256	gsm_dlci_begin_close(dlci); /* prevent half open link */
2257	}
2258
2259	break;
2260	case DLCI_CLOSING:
2261	if (dlci->retries) {
2262	dlci->retries--;
2263	gsm_command(gsm: dlci->gsm, addr: dlci->addr, DISC|PF);
2264	mod_timer(timer: &dlci->t1, expires: jiffies + gsm->t1 * HZ / 100);
2265	} else
2266	gsm_dlci_close(dlci);
2267	break;
2268	default:
2269	pr_debug("%s: unhandled state: %d\n", __func__, dlci->state);
2270	break;
2271	}
2272	}
2273
2274	/**
2275	* gsm_dlci_begin_open - start channel open procedure
2276	* @dlci: DLCI to open
2277	*
2278	* Commence opening a DLCI from the Linux side. We issue SABM messages
2279	* to the modem which should then reply with a UA or ADM, at which point
2280	* we will move into open state. Opening is done asynchronously with retry
2281	* running off timers and the responses.
2282	* Parameter negotiation is performed before SABM if required.
2283	*/
2284
2285	static void gsm_dlci_begin_open(struct gsm_dlci *dlci)
2286	{
2287	struct gsm_mux *gsm = dlci ? dlci->gsm : NULL;
2288	bool need_pn = false;
2289
2290	if (!gsm)
2291	return;
2292
2293	if (dlci->addr != 0) {
2294	if (gsm->adaption != 1 || gsm->adaption != dlci->adaption)
2295	need_pn = true;
2296	if (dlci->prio != (roundup(dlci->addr + 1, 8) - 1))
2297	need_pn = true;
2298	if (gsm->ftype != dlci->ftype)
2299	need_pn = true;
2300	}
2301
2302	switch (dlci->state) {
2303	case DLCI_CLOSED:
2304	case DLCI_WAITING_CONFIG:
2305	case DLCI_CLOSING:
2306	dlci->retries = gsm->n2;
2307	if (!need_pn) {
2308	dlci->state = DLCI_OPENING;
2309	gsm_command(gsm, addr: dlci->addr, SABM|PF);
2310	} else {
2311	/* Configure DLCI before setup */
2312	dlci->state = DLCI_CONFIGURE;
2313	if (gsm_dlci_negotiate(dlci) != 0) {
2314	gsm_dlci_close(dlci);
2315	return;
2316	}
2317	}
2318	mod_timer(timer: &dlci->t1, expires: jiffies + gsm->t1 * HZ / 100);
2319	break;
2320	default:
2321	break;
2322	}
2323	}
2324
2325	/**
2326	* gsm_dlci_set_opening - change state to opening
2327	* @dlci: DLCI to open
2328	*
2329	* Change internal state to wait for DLCI open from initiator side.
2330	* We set off timers and responses upon reception of an SABM.
2331	*/
2332	static void gsm_dlci_set_opening(struct gsm_dlci *dlci)
2333	{
2334	switch (dlci->state) {
2335	case DLCI_CLOSED:
2336	case DLCI_WAITING_CONFIG:
2337	case DLCI_CLOSING:
2338	dlci->state = DLCI_OPENING;
2339	break;
2340	default:
2341	break;
2342	}
2343	}
2344
2345	/**
2346	* gsm_dlci_set_wait_config - wait for channel configuration
2347	* @dlci: DLCI to configure
2348	*
2349	* Wait for a DLCI configuration from the application.
2350	*/
2351	static void gsm_dlci_set_wait_config(struct gsm_dlci *dlci)
2352	{
2353	switch (dlci->state) {
2354	case DLCI_CLOSED:
2355	case DLCI_CLOSING:
2356	dlci->state = DLCI_WAITING_CONFIG;
2357	break;
2358	default:
2359	break;
2360	}
2361	}
2362
2363	/**
2364	* gsm_dlci_begin_close - start channel open procedure
2365	* @dlci: DLCI to open
2366	*
2367	* Commence closing a DLCI from the Linux side. We issue DISC messages
2368	* to the modem which should then reply with a UA, at which point we
2369	* will move into closed state. Closing is done asynchronously with retry
2370	* off timers. We may also receive a DM reply from the other end which
2371	* indicates the channel was already closed.
2372	*/
2373
2374	static void gsm_dlci_begin_close(struct gsm_dlci *dlci)
2375	{
2376	struct gsm_mux *gsm = dlci->gsm;
2377	if (dlci->state == DLCI_CLOSED || dlci->state == DLCI_CLOSING)
2378	return;
2379	dlci->retries = gsm->n2;
2380	dlci->state = DLCI_CLOSING;
2381	gsm_command(gsm: dlci->gsm, addr: dlci->addr, DISC|PF);
2382	mod_timer(timer: &dlci->t1, expires: jiffies + gsm->t1 * HZ / 100);
2383	wake_up_interruptible(&gsm->event);
2384	}
2385
2386	/**
2387	* gsm_dlci_data - data arrived
2388	* @dlci: channel
2389	* @data: block of bytes received
2390	* @clen: length of received block
2391	*
2392	* A UI or UIH frame has arrived which contains data for a channel
2393	* other than the control channel. If the relevant virtual tty is
2394	* open we shovel the bits down it, if not we drop them.
2395	*/
2396
2397	static void gsm_dlci_data(struct gsm_dlci *dlci, const u8 *data, int clen)
2398	{
2399	/* krefs .. */
2400	struct tty_port *port = &dlci->port;
2401	struct tty_struct *tty;
2402	unsigned int modem = 0;
2403	int len;
2404
2405	if (debug & DBG_TTY)
2406	pr_debug("%d bytes for tty\n", clen);
2407	switch (dlci->adaption) {
2408	/* Unsupported types */
2409	case 4: /* Packetised interruptible data */
2410	break;
2411	case 3: /* Packetised uininterruptible voice/data */
2412	break;
2413	case 2: /* Asynchronous serial with line state in each frame */
2414	len = gsm_read_ea_val(val: &modem, data, dlen: clen);
2415	if (len < 1)
2416	return;
2417	tty = tty_port_tty_get(port);
2418	if (tty) {
2419	gsm_process_modem(tty, dlci, modem, slen: len);
2420	tty_wakeup(tty);
2421	tty_kref_put(tty);
2422	}
2423	/* Skip processed modem data */
2424	data += len;
2425	clen -= len;
2426	fallthrough;
2427	case 1: /* Line state will go via DLCI 0 controls only */
2428	default:
2429	tty_insert_flip_string(port, chars: data, size: clen);
2430	tty_flip_buffer_push(port);
2431	}
2432	}
2433
2434	/**
2435	* gsm_dlci_command - data arrived on control channel
2436	* @dlci: channel
2437	* @data: block of bytes received
2438	* @len: length of received block
2439	*
2440	* A UI or UIH frame has arrived which contains data for DLCI 0 the
2441	* control channel. This should contain a command EA followed by
2442	* control data bytes. The command EA contains a command/response bit
2443	* and we divide up the work accordingly.
2444	*/
2445
2446	static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len)
2447	{
2448	/* See what command is involved */
2449	unsigned int command = 0;
2450	unsigned int clen = 0;
2451	unsigned int dlen;
2452
2453	/* read the command */
2454	dlen = gsm_read_ea_val(val: &command, data, dlen: len);
2455	len -= dlen;
2456	data += dlen;
2457
2458	/* read any control data */
2459	dlen = gsm_read_ea_val(val: &clen, data, dlen: len);
2460	len -= dlen;
2461	data += dlen;
2462
2463	/* Malformed command? */
2464	if (clen > len) {
2465	dlci->gsm->malformed++;
2466	return;
2467	}
2468
2469	if (command & 1)
2470	gsm_control_message(gsm: dlci->gsm, command, data, clen);
2471	else
2472	gsm_control_response(gsm: dlci->gsm, command, data, clen);
2473	}
2474
2475	/**
2476	* gsm_kick_timer - transmit if possible
2477	* @t: timer contained in our gsm object
2478	*
2479	* Transmit data from DLCIs if the queue is empty. We can't rely on
2480	* a tty wakeup except when we filled the pipe so we need to fire off
2481	* new data ourselves in other cases.
2482	*/
2483	static void gsm_kick_timer(struct timer_list *t)
2484	{
2485	struct gsm_mux *gsm = from_timer(gsm, t, kick_timer);
2486	unsigned long flags;
2487	int sent = 0;
2488
2489	spin_lock_irqsave(&gsm->tx_lock, flags);
2490	/* If we have nothing running then we need to fire up */
2491	if (gsm->tx_bytes < TX_THRESH_LO)
2492	sent = gsm_dlci_data_sweep(gsm);
2493	spin_unlock_irqrestore(lock: &gsm->tx_lock, flags);
2494
2495	if (sent && debug & DBG_DATA)
2496	pr_info("%s TX queue stalled\n", __func__);
2497	}
2498
2499	/**
2500	* gsm_dlci_copy_config_values - copy DLCI configuration
2501	* @dlci: source DLCI
2502	* @dc: configuration structure to fill
2503	*/
2504	static void gsm_dlci_copy_config_values(struct gsm_dlci *dlci, struct gsm_dlci_config *dc)
2505	{
2506	memset(dc, 0, sizeof(*dc));
2507	dc->channel = (u32)dlci->addr;
2508	dc->adaption = (u32)dlci->adaption;
2509	dc->mtu = (u32)dlci->mtu;
2510	dc->priority = (u32)dlci->prio;
2511	if (dlci->ftype == UIH)
2512	dc->i = 1;
2513	else
2514	dc->i = 2;
2515	dc->k = (u32)dlci->k;
2516	}
2517
2518	/**
2519	* gsm_dlci_config - configure DLCI from configuration
2520	* @dlci: DLCI to configure
2521	* @dc: DLCI configuration
2522	* @open: open DLCI after configuration?
2523	*/
2524	static int gsm_dlci_config(struct gsm_dlci *dlci, struct gsm_dlci_config *dc, int open)
2525	{
2526	struct gsm_mux *gsm;
2527	bool need_restart = false;
2528	bool need_open = false;
2529	unsigned int i;
2530
2531	/*
2532	* Check that userspace doesn't put stuff in here to prevent breakages
2533	* in the future.
2534	*/
2535	for (i = 0; i < ARRAY_SIZE(dc->reserved); i++)
2536	if (dc->reserved[i])
2537	return -EINVAL;
2538
2539	if (!dlci)
2540	return -EINVAL;
2541	gsm = dlci->gsm;
2542
2543	/* Stuff we don't support yet - I frame transport */
2544	if (dc->adaption != 1 && dc->adaption != 2)
2545	return -EOPNOTSUPP;
2546	if (dc->mtu > MAX_MTU || dc->mtu < MIN_MTU || dc->mtu > gsm->mru)
2547	return -EINVAL;
2548	if (dc->priority >= 64)
2549	return -EINVAL;
2550	if (dc->i == 0 || dc->i > 2) /* UIH and UI only */
2551	return -EINVAL;
2552	if (dc->k > 7)
2553	return -EINVAL;
2554	if (dc->flags & ~GSM_FL_RESTART) /* allow future extensions */
2555	return -EINVAL;
2556
2557	/*
2558	* See what is needed for reconfiguration
2559	*/
2560	/* Framing fields */
2561	if (dc->adaption != dlci->adaption)
2562	need_restart = true;
2563	if (dc->mtu != dlci->mtu)
2564	need_restart = true;
2565	if (dc->i != dlci->ftype)
2566	need_restart = true;
2567	/* Requires care */
2568	if (dc->priority != dlci->prio)
2569	need_restart = true;
2570	if (dc->flags & GSM_FL_RESTART)
2571	need_restart = true;
2572
2573	if ((open && gsm->wait_config) || need_restart)
2574	need_open = true;
2575	if (dlci->state == DLCI_WAITING_CONFIG) {
2576	need_restart = false;
2577	need_open = true;
2578	}
2579
2580	/*
2581	* Close down what is needed, restart and initiate the new
2582	* configuration.
2583	*/
2584	if (need_restart) {
2585	gsm_dlci_begin_close(dlci);
2586	wait_event_interruptible(gsm->event, dlci->state == DLCI_CLOSED);
2587	if (signal_pending(current))
2588	return -EINTR;
2589	}
2590	/*
2591	* Setup the new configuration values
2592	*/
2593	dlci->adaption = (int)dc->adaption;
2594
2595	if (dc->mtu)
2596	dlci->mtu = (unsigned int)dc->mtu;
2597	else
2598	dlci->mtu = gsm->mtu;
2599
2600	if (dc->priority)
2601	dlci->prio = (u8)dc->priority;
2602	else
2603	dlci->prio = roundup(dlci->addr + 1, 8) - 1;
2604
2605	if (dc->i == 1)
2606	dlci->ftype = UIH;
2607	else if (dc->i == 2)
2608	dlci->ftype = UI;
2609
2610	if (dc->k)
2611	dlci->k = (u8)dc->k;
2612	else
2613	dlci->k = gsm->k;
2614
2615	if (need_open) {
2616	if (gsm->initiator)
2617	gsm_dlci_begin_open(dlci);
2618	else
2619	gsm_dlci_set_opening(dlci);
2620	}
2621
2622	return 0;
2623	}
2624
2625	/*
2626	* Allocate/Free DLCI channels
2627	*/
2628
2629	/**
2630	* gsm_dlci_alloc - allocate a DLCI
2631	* @gsm: GSM mux
2632	* @addr: address of the DLCI
2633	*
2634	* Allocate and install a new DLCI object into the GSM mux.
2635	*
2636	* FIXME: review locking races
2637	*/
2638
2639	static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
2640	{
2641	struct gsm_dlci *dlci = kzalloc(size: sizeof(struct gsm_dlci), GFP_ATOMIC);
2642	if (dlci == NULL)
2643	return NULL;
2644	spin_lock_init(&dlci->lock);
2645	mutex_init(&dlci->mutex);
2646	if (kfifo_alloc(&dlci->fifo, TX_SIZE, GFP_KERNEL) < 0) {
2647	kfree(objp: dlci);
2648	return NULL;
2649	}
2650
2651	skb_queue_head_init(list: &dlci->skb_list);
2652	timer_setup(&dlci->t1, gsm_dlci_t1, 0);
2653	tty_port_init(port: &dlci->port);
2654	dlci->port.ops = &gsm_port_ops;
2655	dlci->gsm = gsm;
2656	dlci->addr = addr;
2657	dlci->adaption = gsm->adaption;
2658	dlci->mtu = gsm->mtu;
2659	if (addr == 0)
2660	dlci->prio = 0;
2661	else
2662	dlci->prio = roundup(addr + 1, 8) - 1;
2663	dlci->ftype = gsm->ftype;
2664	dlci->k = gsm->k;
2665	dlci->state = DLCI_CLOSED;
2666	if (addr) {
2667	dlci->data = gsm_dlci_data;
2668	/* Prevent us from sending data before the link is up */
2669	dlci->constipated = true;
2670	} else {
2671	dlci->data = gsm_dlci_command;
2672	}
2673	gsm->dlci[addr] = dlci;
2674	return dlci;
2675	}
2676
2677	/**
2678	* gsm_dlci_free - free DLCI
2679	* @port: tty port for DLCI to free
2680	*
2681	* Free up a DLCI.
2682	*
2683	* Can sleep.
2684	*/
2685	static void gsm_dlci_free(struct tty_port *port)
2686	{
2687	struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
2688
2689	timer_shutdown_sync(timer: &dlci->t1);
2690	dlci->gsm->dlci[dlci->addr] = NULL;
2691	kfifo_free(&dlci->fifo);
2692	while ((dlci->skb = skb_dequeue(list: &dlci->skb_list)))
2693	dev_kfree_skb(dlci->skb);
2694	kfree(objp: dlci);
2695	}
2696
2697	static inline void dlci_get(struct gsm_dlci *dlci)
2698	{
2699	tty_port_get(port: &dlci->port);
2700	}
2701
2702	static inline void dlci_put(struct gsm_dlci *dlci)
2703	{
2704	tty_port_put(port: &dlci->port);
2705	}
2706
2707	static void gsm_destroy_network(struct gsm_dlci *dlci);
2708
2709	/**
2710	* gsm_dlci_release - release DLCI
2711	* @dlci: DLCI to destroy
2712	*
2713	* Release a DLCI. Actual free is deferred until either
2714	* mux is closed or tty is closed - whichever is last.
2715	*
2716	* Can sleep.
2717	*/
2718	static void gsm_dlci_release(struct gsm_dlci *dlci)
2719	{
2720	struct tty_struct *tty = tty_port_tty_get(port: &dlci->port);
2721	if (tty) {
2722	mutex_lock(&dlci->mutex);
2723	gsm_destroy_network(dlci);
2724	mutex_unlock(lock: &dlci->mutex);
2725
2726	/* We cannot use tty_hangup() because in tty_kref_put() the tty
2727	* driver assumes that the hangup queue is free and reuses it to
2728	* queue release_one_tty() -> NULL pointer panic in
2729	* process_one_work().
2730	*/
2731	tty_vhangup(tty);
2732
2733	tty_port_tty_set(port: &dlci->port, NULL);
2734	tty_kref_put(tty);
2735	}
2736	dlci->state = DLCI_CLOSED;
2737	dlci_put(dlci);
2738	}
2739
2740	/*
2741	* LAPBish link layer logic
2742	*/
2743
2744	/**
2745	* gsm_queue - a GSM frame is ready to process
2746	* @gsm: pointer to our gsm mux
2747	*
2748	* At this point in time a frame has arrived and been demangled from
2749	* the line encoding. All the differences between the encodings have
2750	* been handled below us and the frame is unpacked into the structures.
2751	* The fcs holds the header FCS but any data FCS must be added here.
2752	*/
2753
2754	static void gsm_queue(struct gsm_mux *gsm)
2755	{
2756	struct gsm_dlci *dlci;
2757	u8 cr;
2758	int address;
2759
2760	if (gsm->fcs != GOOD_FCS) {
2761	gsm->bad_fcs++;
2762	if (debug & DBG_DATA)
2763	pr_debug("BAD FCS %02x\n", gsm->fcs);
2764	return;
2765	}
2766	address = gsm->address >> 1;
2767	if (address >= NUM_DLCI)
2768	goto invalid;
2769
2770	cr = gsm->address & 1; /* C/R bit */
2771	cr ^= gsm->initiator ? 0 : 1; /* Flip so 1 always means command */
2772
2773	gsm_print_packet(hdr: "<--", addr: address, cr, control: gsm->control, data: gsm->buf, dlen: gsm->len);
2774
2775	dlci = gsm->dlci[address];
2776
2777	switch (gsm->control) {
2778	case SABM|PF:
2779	if (cr == 1) {
2780	gsm->open_error++;
2781	goto invalid;
2782	}
2783	if (dlci == NULL)
2784	dlci = gsm_dlci_alloc(gsm, addr: address);
2785	if (dlci == NULL) {
2786	gsm->open_error++;
2787	return;
2788	}
2789	if (dlci->dead)
2790	gsm_response(gsm, addr: address, DM|PF);
2791	else {
2792	gsm_response(gsm, addr: address, UA|PF);
2793	gsm_dlci_open(dlci);
2794	}
2795	break;
2796	case DISC|PF:
2797	if (cr == 1)
2798	goto invalid;
2799	if (dlci == NULL || dlci->state == DLCI_CLOSED) {
2800	gsm_response(gsm, addr: address, DM|PF);
2801	return;
2802	}
2803	/* Real close complete */
2804	gsm_response(gsm, addr: address, UA|PF);
2805	gsm_dlci_close(dlci);
2806	break;
2807	case UA|PF:
2808	if (cr == 0 || dlci == NULL)
2809	break;
2810	switch (dlci->state) {
2811	case DLCI_CLOSING:
2812	gsm_dlci_close(dlci);
2813	break;
2814	case DLCI_OPENING:
2815	gsm_dlci_open(dlci);
2816	break;
2817	default:
2818	pr_debug("%s: unhandled state: %d\n", __func__,
2819	dlci->state);
2820	break;
2821	}
2822	break;
2823	case DM: /* DM can be valid unsolicited */
2824	case DM|PF:
2825	if (cr)
2826	goto invalid;
2827	if (dlci == NULL)
2828	return;
2829	gsm_dlci_close(dlci);
2830	break;
2831	case UI:
2832	case UI|PF:
2833	case UIH:
2834	case UIH|PF:
2835	if (dlci == NULL || dlci->state != DLCI_OPEN) {
2836	gsm_response(gsm, addr: address, DM|PF);
2837	return;
2838	}
2839	dlci->data(dlci, gsm->buf, gsm->len);
2840	break;
2841	default:
2842	goto invalid;
2843	}
2844	return;
2845	invalid:
2846	gsm->malformed++;
2847	return;
2848	}
2849
2850
2851	/**
2852	* gsm0_receive - perform processing for non-transparency
2853	* @gsm: gsm data for this ldisc instance
2854	* @c: character
2855	*
2856	* Receive bytes in gsm mode 0
2857	*/
2858
2859	static void gsm0_receive(struct gsm_mux *gsm, unsigned char c)
2860	{
2861	unsigned int len;
2862
2863	switch (gsm->state) {
2864	case GSM_SEARCH: /* SOF marker */
2865	if (c == GSM0_SOF) {
2866	gsm->state = GSM_ADDRESS;
2867	gsm->address = 0;
2868	gsm->len = 0;
2869	gsm->fcs = INIT_FCS;
2870	}
2871	break;
2872	case GSM_ADDRESS: /* Address EA */
2873	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
2874	if (gsm_read_ea(val: &gsm->address, c))
2875	gsm->state = GSM_CONTROL;
2876	break;
2877	case GSM_CONTROL: /* Control Byte */
2878	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
2879	gsm->control = c;
2880	gsm->state = GSM_LEN0;
2881	break;
2882	case GSM_LEN0: /* Length EA */
2883	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
2884	if (gsm_read_ea(val: &gsm->len, c)) {
2885	if (gsm->len > gsm->mru) {
2886	gsm->bad_size++;
2887	gsm->state = GSM_SEARCH;
2888	break;
2889	}
2890	gsm->count = 0;
2891	if (!gsm->len)
2892	gsm->state = GSM_FCS;
2893	else
2894	gsm->state = GSM_DATA;
2895	break;
2896	}
2897	gsm->state = GSM_LEN1;
2898	break;
2899	case GSM_LEN1:
2900	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
2901	len = c;
2902	gsm->len |= len << 7;
2903	if (gsm->len > gsm->mru) {
2904	gsm->bad_size++;
2905	gsm->state = GSM_SEARCH;
2906	break;
2907	}
2908	gsm->count = 0;
2909	if (!gsm->len)
2910	gsm->state = GSM_FCS;
2911	else
2912	gsm->state = GSM_DATA;
2913	break;
2914	case GSM_DATA: /* Data */
2915	gsm->buf[gsm->count++] = c;
2916	if (gsm->count == gsm->len) {
2917	/* Calculate final FCS for UI frames over all data */
2918	if ((gsm->control & ~PF) != UIH) {
2919	gsm->fcs = gsm_fcs_add_block(fcs: gsm->fcs, c: gsm->buf,
2920	len: gsm->count);
2921	}
2922	gsm->state = GSM_FCS;
2923	}
2924	break;
2925	case GSM_FCS: /* FCS follows the packet */
2926	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
2927	gsm->state = GSM_SSOF;
2928	break;
2929	case GSM_SSOF:
2930	gsm->state = GSM_SEARCH;
2931	if (c == GSM0_SOF)
2932	gsm_queue(gsm);
2933	else
2934	gsm->bad_size++;
2935	break;
2936	default:
2937	pr_debug("%s: unhandled state: %d\n", __func__, gsm->state);
2938	break;
2939	}
2940	}
2941
2942	/**
2943	* gsm1_receive - perform processing for non-transparency
2944	* @gsm: gsm data for this ldisc instance
2945	* @c: character
2946	*
2947	* Receive bytes in mode 1 (Advanced option)
2948	*/
2949
2950	static void gsm1_receive(struct gsm_mux *gsm, unsigned char c)
2951	{
2952	/* handle XON/XOFF */
2953	if ((c & ISO_IEC_646_MASK) == XON) {
2954	gsm->constipated = true;
2955	return;
2956	} else if ((c & ISO_IEC_646_MASK) == XOFF) {
2957	gsm->constipated = false;
2958	/* Kick the link in case it is idling */
2959	gsmld_write_trigger(gsm);
2960	return;
2961	}
2962	if (c == GSM1_SOF) {
2963	/* EOF is only valid in frame if we have got to the data state */
2964	if (gsm->state == GSM_DATA) {
2965	if (gsm->count < 1) {
2966	/* Missing FSC */
2967	gsm->malformed++;
2968	gsm->state = GSM_START;
2969	return;
2970	}
2971	/* Remove the FCS from data */
2972	gsm->count--;
2973	if ((gsm->control & ~PF) != UIH) {
2974	/* Calculate final FCS for UI frames over all
2975	* data but FCS
2976	*/
2977	gsm->fcs = gsm_fcs_add_block(fcs: gsm->fcs, c: gsm->buf,
2978	len: gsm->count);
2979	}
2980	/* Add the FCS itself to test against GOOD_FCS */
2981	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c: gsm->buf[gsm->count]);
2982	gsm->len = gsm->count;
2983	gsm_queue(gsm);
2984	gsm->state = GSM_START;
2985	return;
2986	}
2987	/* Any partial frame was a runt so go back to start */
2988	if (gsm->state != GSM_START) {
2989	if (gsm->state != GSM_SEARCH)
2990	gsm->malformed++;
2991	gsm->state = GSM_START;
2992	}
2993	/* A SOF in GSM_START means we are still reading idling or
2994	framing bytes */
2995	return;
2996	}
2997
2998	if (c == GSM1_ESCAPE) {
2999	gsm->escape = true;
3000	return;
3001	}
3002
3003	/* Only an unescaped SOF gets us out of GSM search */
3004	if (gsm->state == GSM_SEARCH)
3005	return;
3006
3007	if (gsm->escape) {
3008	c ^= GSM1_ESCAPE_BITS;
3009	gsm->escape = false;
3010	}
3011	switch (gsm->state) {
3012	case GSM_START: /* First byte after SOF */
3013	gsm->address = 0;
3014	gsm->state = GSM_ADDRESS;
3015	gsm->fcs = INIT_FCS;
3016	fallthrough;
3017	case GSM_ADDRESS: /* Address continuation */
3018	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
3019	if (gsm_read_ea(val: &gsm->address, c))
3020	gsm->state = GSM_CONTROL;
3021	break;
3022	case GSM_CONTROL: /* Control Byte */
3023	gsm->fcs = gsm_fcs_add(fcs: gsm->fcs, c);
3024	gsm->control = c;
3025	gsm->count = 0;
3026	gsm->state = GSM_DATA;
3027	break;
3028	case GSM_DATA: /* Data */
3029	if (gsm->count > gsm->mru) { /* Allow one for the FCS */
3030	gsm->state = GSM_OVERRUN;
3031	gsm->bad_size++;
3032	} else
3033	gsm->buf[gsm->count++] = c;
3034	break;
3035	case GSM_OVERRUN: /* Over-long - eg a dropped SOF */
3036	break;
3037	default:
3038	pr_debug("%s: unhandled state: %d\n", __func__, gsm->state);
3039	break;
3040	}
3041	}
3042
3043	/**
3044	* gsm_error - handle tty error
3045	* @gsm: ldisc data
3046	*
3047	* Handle an error in the receipt of data for a frame. Currently we just
3048	* go back to hunting for a SOF.
3049	*
3050	* FIXME: better diagnostics ?
3051	*/
3052
3053	static void gsm_error(struct gsm_mux *gsm)
3054	{
3055	gsm->state = GSM_SEARCH;
3056	gsm->io_error++;
3057	}
3058
3059	/**
3060	* gsm_cleanup_mux - generic GSM protocol cleanup
3061	* @gsm: our mux
3062	* @disc: disconnect link?
3063	*
3064	* Clean up the bits of the mux which are the same for all framing
3065	* protocols. Remove the mux from the mux table, stop all the timers
3066	* and then shut down each device hanging up the channels as we go.
3067	*/
3068
3069	static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
3070	{
3071	int i;
3072	struct gsm_dlci *dlci;
3073	struct gsm_msg *txq, *ntxq;
3074
3075	gsm->dead = true;
3076	mutex_lock(&gsm->mutex);
3077
3078	dlci = gsm->dlci[0];
3079	if (dlci) {
3080	if (disc && dlci->state != DLCI_CLOSED) {
3081	gsm_dlci_begin_close(dlci);
3082	wait_event(gsm->event, dlci->state == DLCI_CLOSED);
3083	}
3084	dlci->dead = true;
3085	}
3086
3087	/* Finish outstanding timers, making sure they are done */
3088	del_timer_sync(timer: &gsm->kick_timer);
3089	del_timer_sync(timer: &gsm->t2_timer);
3090	del_timer_sync(timer: &gsm->ka_timer);
3091
3092	/* Finish writing to ldisc */
3093	flush_work(work: &gsm->tx_work);
3094
3095	/* Free up any link layer users and finally the control channel */
3096	if (gsm->has_devices) {
3097	gsm_unregister_devices(driver: gsm_tty_driver, index: gsm->num);
3098	gsm->has_devices = false;
3099	}
3100	for (i = NUM_DLCI - 1; i >= 0; i--)
3101	if (gsm->dlci[i])
3102	gsm_dlci_release(dlci: gsm->dlci[i]);
3103	mutex_unlock(lock: &gsm->mutex);
3104	/* Now wipe the queues */
3105	tty_ldisc_flush(tty: gsm->tty);
3106	list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list)
3107	kfree(objp: txq);
3108	INIT_LIST_HEAD(list: &gsm->tx_ctrl_list);
3109	list_for_each_entry_safe(txq, ntxq, &gsm->tx_data_list, list)
3110	kfree(objp: txq);
3111	INIT_LIST_HEAD(list: &gsm->tx_data_list);
3112	}
3113
3114	/**
3115	* gsm_activate_mux - generic GSM setup
3116	* @gsm: our mux
3117	*
3118	* Set up the bits of the mux which are the same for all framing
3119	* protocols. Add the mux to the mux table so it can be opened and
3120	* finally kick off connecting to DLCI 0 on the modem.
3121	*/
3122
3123	static int gsm_activate_mux(struct gsm_mux *gsm)
3124	{
3125	struct gsm_dlci *dlci;
3126	int ret;
3127
3128	dlci = gsm_dlci_alloc(gsm, addr: 0);
3129	if (dlci == NULL)
3130	return -ENOMEM;
3131
3132	if (gsm->encoding == GSM_BASIC_OPT)
3133	gsm->receive = gsm0_receive;
3134	else
3135	gsm->receive = gsm1_receive;
3136
3137	ret = gsm_register_devices(driver: gsm_tty_driver, index: gsm->num);
3138	if (ret)
3139	return ret;
3140
3141	gsm->has_devices = true;
3142	gsm->dead = false; /* Tty opens are now permissible */
3143	return 0;
3144	}
3145
3146	/**
3147	* gsm_free_mux - free up a mux
3148	* @gsm: mux to free
3149	*
3150	* Dispose of allocated resources for a dead mux
3151	*/
3152	static void gsm_free_mux(struct gsm_mux *gsm)
3153	{
3154	int i;
3155
3156	for (i = 0; i < MAX_MUX; i++) {
3157	if (gsm == gsm_mux[i]) {
3158	gsm_mux[i] = NULL;
3159	break;
3160	}
3161	}
3162	mutex_destroy(lock: &gsm->mutex);
3163	kfree(objp: gsm->txframe);
3164	kfree(objp: gsm->buf);
3165	kfree(objp: gsm);
3166	}
3167
3168	/**
3169	* gsm_free_muxr - free up a mux
3170	* @ref: kreference to the mux to free
3171	*
3172	* Dispose of allocated resources for a dead mux
3173	*/
3174	static void gsm_free_muxr(struct kref *ref)
3175	{
3176	struct gsm_mux *gsm = container_of(ref, struct gsm_mux, ref);
3177	gsm_free_mux(gsm);
3178	}
3179
3180	static inline void mux_get(struct gsm_mux *gsm)
3181	{
3182	unsigned long flags;
3183
3184	spin_lock_irqsave(&gsm_mux_lock, flags);
3185	kref_get(kref: &gsm->ref);
3186	spin_unlock_irqrestore(lock: &gsm_mux_lock, flags);
3187	}
3188
3189	static inline void mux_put(struct gsm_mux *gsm)
3190	{
3191	unsigned long flags;
3192
3193	spin_lock_irqsave(&gsm_mux_lock, flags);
3194	kref_put(kref: &gsm->ref, release: gsm_free_muxr);
3195	spin_unlock_irqrestore(lock: &gsm_mux_lock, flags);
3196	}
3197
3198	static inline unsigned int mux_num_to_base(struct gsm_mux *gsm)
3199	{
3200	return gsm->num * NUM_DLCI;
3201	}
3202
3203	static inline unsigned int mux_line_to_num(unsigned int line)
3204	{
3205	return line / NUM_DLCI;
3206	}
3207
3208	/**
3209	* gsm_alloc_mux - allocate a mux
3210	*
3211	* Creates a new mux ready for activation.
3212	*/
3213
3214	static struct gsm_mux *gsm_alloc_mux(void)
3215	{
3216	int i;
3217	struct gsm_mux *gsm = kzalloc(size: sizeof(struct gsm_mux), GFP_KERNEL);
3218	if (gsm == NULL)
3219	return NULL;
3220	gsm->buf = kmalloc(MAX_MRU + 1, GFP_KERNEL);
3221	if (gsm->buf == NULL) {
3222	kfree(objp: gsm);
3223	return NULL;
3224	}
3225	gsm->txframe = kmalloc(size: 2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL);
3226	if (gsm->txframe == NULL) {
3227	kfree(objp: gsm->buf);
3228	kfree(objp: gsm);
3229	return NULL;
3230	}
3231	spin_lock_init(&gsm->lock);
3232	mutex_init(&gsm->mutex);
3233	kref_init(kref: &gsm->ref);
3234	INIT_LIST_HEAD(list: &gsm->tx_ctrl_list);
3235	INIT_LIST_HEAD(list: &gsm->tx_data_list);
3236	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
3237	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
3238	timer_setup(&gsm->ka_timer, gsm_control_keep_alive, 0);
3239	INIT_WORK(&gsm->tx_work, gsmld_write_task);
3240	init_waitqueue_head(&gsm->event);
3241	spin_lock_init(&gsm->control_lock);
3242	spin_lock_init(&gsm->tx_lock);
3243
3244	gsm->t1 = T1;
3245	gsm->t2 = T2;
3246	gsm->t3 = T3;
3247	gsm->n2 = N2;
3248	gsm->k = K;
3249	gsm->ftype = UIH;
3250	gsm->adaption = 1;
3251	gsm->encoding = GSM_ADV_OPT;
3252	gsm->mru = 64; /* Default to encoding 1 so these should be 64 */
3253	gsm->mtu = 64;
3254	gsm->dead = true; /* Avoid early tty opens */
3255	gsm->wait_config = false; /* Disabled */
3256	gsm->keep_alive = 0; /* Disabled */
3257
3258	/* Store the instance to the mux array or abort if no space is
3259	* available.
3260	*/
3261	spin_lock(lock: &gsm_mux_lock);
3262	for (i = 0; i < MAX_MUX; i++) {
3263	if (!gsm_mux[i]) {
3264	gsm_mux[i] = gsm;
3265	gsm->num = i;
3266	break;
3267	}
3268	}
3269	spin_unlock(lock: &gsm_mux_lock);
3270	if (i == MAX_MUX) {
3271	mutex_destroy(lock: &gsm->mutex);
3272	kfree(objp: gsm->txframe);
3273	kfree(objp: gsm->buf);
3274	kfree(objp: gsm);
3275	return NULL;
3276	}
3277
3278	return gsm;
3279	}
3280
3281	static void gsm_copy_config_values(struct gsm_mux *gsm,
3282	struct gsm_config *c)
3283	{
3284	memset(c, 0, sizeof(*c));
3285	c->adaption = gsm->adaption;
3286	c->encapsulation = gsm->encoding;
3287	c->initiator = gsm->initiator;
3288	c->t1 = gsm->t1;
3289	c->t2 = gsm->t2;
3290	c->t3 = gsm->t3;
3291	c->n2 = gsm->n2;
3292	if (gsm->ftype == UIH)
3293	c->i = 1;
3294	else
3295	c->i = 2;
3296	pr_debug("Ftype %d i %d\n", gsm->ftype, c->i);
3297	c->mru = gsm->mru;
3298	c->mtu = gsm->mtu;
3299	c->k = gsm->k;
3300	}
3301
3302	static int gsm_config(struct gsm_mux *gsm, struct gsm_config *c)
3303	{
3304	int need_close = 0;
3305	int need_restart = 0;
3306
3307	/* Stuff we don't support yet - UI or I frame transport */
3308	if (c->adaption != 1 && c->adaption != 2)
3309	return -EOPNOTSUPP;
3310	/* Check the MRU/MTU range looks sane */
3311	if (c->mru < MIN_MTU || c->mtu < MIN_MTU)
3312	return -EINVAL;
3313	if (c->mru > MAX_MRU || c->mtu > MAX_MTU)
3314	return -EINVAL;
3315	if (c->t3 > MAX_T3)
3316	return -EINVAL;
3317	if (c->n2 > 255)
3318	return -EINVAL;
3319	if (c->encapsulation > 1) /* Basic, advanced, no I */
3320	return -EINVAL;
3321	if (c->initiator > 1)
3322	return -EINVAL;
3323	if (c->k > MAX_WINDOW_SIZE)
3324	return -EINVAL;
3325	if (c->i == 0 || c->i > 2) /* UIH and UI only */
3326	return -EINVAL;
3327	/*
3328	* See what is needed for reconfiguration
3329	*/
3330
3331	/* Timing fields */
3332	if (c->t1 != 0 && c->t1 != gsm->t1)
3333	need_restart = 1;
3334	if (c->t2 != 0 && c->t2 != gsm->t2)
3335	need_restart = 1;
3336	if (c->encapsulation != gsm->encoding)
3337	need_restart = 1;
3338	if (c->adaption != gsm->adaption)
3339	need_restart = 1;
3340	/* Requires care */
3341	if (c->initiator != gsm->initiator)
3342	need_close = 1;
3343	if (c->mru != gsm->mru)
3344	need_restart = 1;
3345	if (c->mtu != gsm->mtu)
3346	need_restart = 1;
3347
3348	/*
3349	* Close down what is needed, restart and initiate the new
3350	* configuration. On the first time there is no DLCI[0]
3351	* and closing or cleaning up is not necessary.
3352	*/
3353	if (need_close || need_restart)
3354	gsm_cleanup_mux(gsm, disc: true);
3355
3356	gsm->initiator = c->initiator;
3357	gsm->mru = c->mru;
3358	gsm->mtu = c->mtu;
3359	gsm->encoding = c->encapsulation ? GSM_ADV_OPT : GSM_BASIC_OPT;
3360	gsm->adaption = c->adaption;
3361	gsm->n2 = c->n2;
3362
3363	if (c->i == 1)
3364	gsm->ftype = UIH;
3365	else if (c->i == 2)
3366	gsm->ftype = UI;
3367
3368	if (c->t1)
3369	gsm->t1 = c->t1;
3370	if (c->t2)
3371	gsm->t2 = c->t2;
3372	if (c->t3)
3373	gsm->t3 = c->t3;
3374	if (c->k)
3375	gsm->k = c->k;
3376
3377	/*
3378	* FIXME: We need to separate activation/deactivation from adding
3379	* and removing from the mux array
3380	*/
3381	if (gsm->dead) {
3382	int ret = gsm_activate_mux(gsm);
3383	if (ret)
3384	return ret;
3385	if (gsm->initiator)
3386	gsm_dlci_begin_open(dlci: gsm->dlci[0]);
3387	}
3388	return 0;
3389	}
3390
3391	static void gsm_copy_config_ext_values(struct gsm_mux *gsm,
3392	struct gsm_config_ext *ce)
3393	{
3394	memset(ce, 0, sizeof(*ce));
3395	ce->wait_config = gsm->wait_config ? 1 : 0;
3396	ce->keep_alive = gsm->keep_alive;
3397	}
3398
3399	static int gsm_config_ext(struct gsm_mux *gsm, struct gsm_config_ext *ce)
3400	{
3401	bool need_restart = false;
3402	unsigned int i;
3403
3404	/*
3405	* Check that userspace doesn't put stuff in here to prevent breakages
3406	* in the future.
3407	*/
3408	for (i = 0; i < ARRAY_SIZE(ce->reserved); i++)
3409	if (ce->reserved[i])
3410	return -EINVAL;
3411	if (ce->flags & ~GSM_FL_RESTART)
3412	return -EINVAL;
3413
3414	/* Requires care */
3415	if (ce->flags & GSM_FL_RESTART)
3416	need_restart = true;
3417
3418	/*
3419	* Close down what is needed, restart and initiate the new
3420	* configuration. On the first time there is no DLCI[0]
3421	* and closing or cleaning up is not necessary.
3422	*/
3423	if (need_restart)
3424	gsm_cleanup_mux(gsm, disc: true);
3425
3426	/*
3427	* Setup the new configuration values
3428	*/
3429	gsm->wait_config = ce->wait_config ? true : false;
3430	gsm->keep_alive = ce->keep_alive;
3431
3432	if (gsm->dead) {
3433	int ret = gsm_activate_mux(gsm);
3434	if (ret)
3435	return ret;
3436	if (gsm->initiator)
3437	gsm_dlci_begin_open(dlci: gsm->dlci[0]);
3438	}
3439
3440	return 0;
3441	}
3442
3443	/**
3444	* gsmld_output - write to link
3445	* @gsm: our mux
3446	* @data: bytes to output
3447	* @len: size
3448	*
3449	* Write a block of data from the GSM mux to the data channel. This
3450	* will eventually be serialized from above but at the moment isn't.
3451	*/
3452
3453	static int gsmld_output(struct gsm_mux *gsm, u8 *data, int len)
3454	{
3455	if (tty_write_room(tty: gsm->tty) < len) {
3456	set_bit(TTY_DO_WRITE_WAKEUP, addr: &gsm->tty->flags);
3457	return -ENOSPC;
3458	}
3459	if (debug & DBG_DATA)
3460	gsm_hex_dump_bytes(fname: __func__, data, len);
3461	return gsm->tty->ops->write(gsm->tty, data, len);
3462	}
3463
3464
3465	/**
3466	* gsmld_write_trigger - schedule ldisc write task
3467	* @gsm: our mux
3468	*/
3469	static void gsmld_write_trigger(struct gsm_mux *gsm)
3470	{
3471	if (!gsm || !gsm->dlci[0] || gsm->dlci[0]->dead)
3472	return;
3473	schedule_work(work: &gsm->tx_work);
3474	}
3475
3476
3477	/**
3478	* gsmld_write_task - ldisc write task
3479	* @work: our tx write work
3480	*
3481	* Writes out data to the ldisc if possible. We are doing this here to
3482	* avoid dead-locking. This returns if no space or data is left for output.
3483	*/
3484	static void gsmld_write_task(struct work_struct *work)
3485	{
3486	struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work);
3487	unsigned long flags;
3488	int i, ret;
3489
3490	/* All outstanding control channel and control messages and one data
3491	* frame is sent.
3492	*/
3493	ret = -ENODEV;
3494	spin_lock_irqsave(&gsm->tx_lock, flags);
3495	if (gsm->tty)
3496	ret = gsm_data_kick(gsm);
3497	spin_unlock_irqrestore(lock: &gsm->tx_lock, flags);
3498
3499	if (ret >= 0)
3500	for (i = 0; i < NUM_DLCI; i++)
3501	if (gsm->dlci[i])
3502	tty_port_tty_wakeup(port: &gsm->dlci[i]->port);
3503	}
3504
3505	/**
3506	* gsmld_attach_gsm - mode set up
3507	* @tty: our tty structure
3508	* @gsm: our mux
3509	*
3510	* Set up the MUX for basic mode and commence connecting to the
3511	* modem. Currently called from the line discipline set up but
3512	* will need moving to an ioctl path.
3513	*/
3514
3515	static void gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
3516	{
3517	gsm->tty = tty_kref_get(tty);
3518	/* Turn off tty XON/XOFF handling to handle it explicitly. */
3519	gsm->old_c_iflag = tty->termios.c_iflag;
3520	tty->termios.c_iflag &= (IXON | IXOFF);
3521	}
3522
3523	/**
3524	* gsmld_detach_gsm - stop doing 0710 mux
3525	* @tty: tty attached to the mux
3526	* @gsm: mux
3527	*
3528	* Shutdown and then clean up the resources used by the line discipline
3529	*/
3530
3531	static void gsmld_detach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
3532	{
3533	WARN_ON(tty != gsm->tty);
3534	/* Restore tty XON/XOFF handling. */
3535	gsm->tty->termios.c_iflag = gsm->old_c_iflag;
3536	tty_kref_put(tty: gsm->tty);
3537	gsm->tty = NULL;
3538	}
3539
3540	static void gsmld_receive_buf(struct tty_struct *tty, const u8 *cp,
3541	const u8 *fp, size_t count)
3542	{
3543	struct gsm_mux *gsm = tty->disc_data;
3544	char flags = TTY_NORMAL;
3545
3546	if (debug & DBG_DATA)
3547	gsm_hex_dump_bytes(fname: __func__, data: cp, len: count);
3548
3549	for (; count; count--, cp++) {
3550	if (fp)
3551	flags = *fp++;
3552	switch (flags) {
3553	case TTY_NORMAL:
3554	if (gsm->receive)
3555	gsm->receive(gsm, *cp);
3556	break;
3557	case TTY_OVERRUN:
3558	case TTY_BREAK:
3559	case TTY_PARITY:
3560	case TTY_FRAME:
3561	gsm_error(gsm);
3562	break;
3563	default:
3564	WARN_ONCE(1, "%s: unknown flag %d\n",
3565	tty_name(tty), flags);
3566	break;
3567	}
3568	}
3569	/* FASYNC if needed ? */
3570	/* If clogged call tty_throttle(tty); */
3571	}
3572
3573	/**
3574	* gsmld_flush_buffer - clean input queue
3575	* @tty: terminal device
3576	*
3577	* Flush the input buffer. Called when the line discipline is
3578	* being closed, when the tty layer wants the buffer flushed (eg
3579	* at hangup).
3580	*/
3581
3582	static void gsmld_flush_buffer(struct tty_struct *tty)
3583	{
3584	}
3585
3586	/**
3587	* gsmld_close - close the ldisc for this tty
3588	* @tty: device
3589	*
3590	* Called from the terminal layer when this line discipline is
3591	* being shut down, either because of a close or becsuse of a
3592	* discipline change. The function will not be called while other
3593	* ldisc methods are in progress.
3594	*/
3595
3596	static void gsmld_close(struct tty_struct *tty)
3597	{
3598	struct gsm_mux *gsm = tty->disc_data;
3599
3600	/* The ldisc locks and closes the port before calling our close. This
3601	* means we have no way to do a proper disconnect. We will not bother
3602	* to do one.
3603	*/
3604	gsm_cleanup_mux(gsm, disc: false);
3605
3606	gsmld_detach_gsm(tty, gsm);
3607
3608	gsmld_flush_buffer(tty);
3609	/* Do other clean up here */
3610	mux_put(gsm);
3611	}
3612
3613	/**
3614	* gsmld_open - open an ldisc
3615	* @tty: terminal to open
3616	*
3617	* Called when this line discipline is being attached to the
3618	* terminal device. Can sleep. Called serialized so that no
3619	* other events will occur in parallel. No further open will occur
3620	* until a close.
3621	*/
3622
3623	static int gsmld_open(struct tty_struct *tty)
3624	{
3625	struct gsm_mux *gsm;
3626
3627	if (!capable(CAP_NET_ADMIN))
3628	return -EPERM;
3629
3630	if (tty->ops->write == NULL)
3631	return -EINVAL;
3632
3633	/* Attach our ldisc data */
3634	gsm = gsm_alloc_mux();
3635	if (gsm == NULL)
3636	return -ENOMEM;
3637
3638	tty->disc_data = gsm;
3639	tty->receive_room = 65536;
3640
3641	/* Attach the initial passive connection */
3642	gsmld_attach_gsm(tty, gsm);
3643
3644	/* The mux will not be activated yet, we wait for correct
3645	* configuration first.
3646	*/
3647	if (gsm->encoding == GSM_BASIC_OPT)
3648	gsm->receive = gsm0_receive;
3649	else
3650	gsm->receive = gsm1_receive;
3651
3652	return 0;
3653	}
3654
3655	/**
3656	* gsmld_write_wakeup - asynchronous I/O notifier
3657	* @tty: tty device
3658	*
3659	* Required for the ptys, serial driver etc. since processes
3660	* that attach themselves to the master and rely on ASYNC
3661	* IO must be woken up
3662	*/
3663
3664	static void gsmld_write_wakeup(struct tty_struct *tty)
3665	{
3666	struct gsm_mux *gsm = tty->disc_data;
3667
3668	/* Queue poll */
3669	gsmld_write_trigger(gsm);
3670	}
3671
3672	/**
3673	* gsmld_read - read function for tty
3674	* @tty: tty device
3675	* @file: file object
3676	* @buf: userspace buffer pointer
3677	* @nr: size of I/O
3678	* @cookie: unused
3679	* @offset: unused
3680	*
3681	* Perform reads for the line discipline. We are guaranteed that the
3682	* line discipline will not be closed under us but we may get multiple
3683	* parallel readers and must handle this ourselves. We may also get
3684	* a hangup. Always called in user context, may sleep.
3685	*
3686	* This code must be sure never to sleep through a hangup.
3687	*/
3688
3689	static ssize_t gsmld_read(struct tty_struct *tty, struct file *file, u8 *buf,
3690	size_t nr, void **cookie, unsigned long offset)
3691	{
3692	return -EOPNOTSUPP;
3693	}
3694
3695	/**
3696	* gsmld_write - write function for tty
3697	* @tty: tty device
3698	* @file: file object
3699	* @buf: userspace buffer pointer
3700	* @nr: size of I/O
3701	*
3702	* Called when the owner of the device wants to send a frame
3703	* itself (or some other control data). The data is transferred
3704	* as-is and must be properly framed and checksummed as appropriate
3705	* by userspace. Frames are either sent whole or not at all as this
3706	* avoids pain user side.
3707	*/
3708
3709	static ssize_t gsmld_write(struct tty_struct *tty, struct file *file,
3710	const u8 *buf, size_t nr)
3711	{
3712	struct gsm_mux *gsm = tty->disc_data;
3713	unsigned long flags;
3714	int space;
3715	int ret;
3716
3717	if (!gsm)
3718	return -ENODEV;
3719
3720	ret = -ENOBUFS;
3721	spin_lock_irqsave(&gsm->tx_lock, flags);
3722	space = tty_write_room(tty);
3723	if (space >= nr)
3724	ret = tty->ops->write(tty, buf, nr);
3725	else
3726	set_bit(TTY_DO_WRITE_WAKEUP, addr: &tty->flags);
3727	spin_unlock_irqrestore(lock: &gsm->tx_lock, flags);
3728
3729	return ret;
3730	}
3731
3732	/**
3733	* gsmld_poll - poll method for N_GSM0710
3734	* @tty: terminal device
3735	* @file: file accessing it
3736	* @wait: poll table
3737	*
3738	* Called when the line discipline is asked to poll() for data or
3739	* for special events. This code is not serialized with respect to
3740	* other events save open/close.
3741	*
3742	* This code must be sure never to sleep through a hangup.
3743	* Called without the kernel lock held - fine
3744	*/
3745
3746	static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file,
3747	poll_table *wait)
3748	{
3749	__poll_t mask = 0;
3750	struct gsm_mux *gsm = tty->disc_data;
3751
3752	poll_wait(filp: file, wait_address: &tty->read_wait, p: wait);
3753	poll_wait(filp: file, wait_address: &tty->write_wait, p: wait);
3754
3755	if (gsm->dead)
3756	mask |= EPOLLHUP;
3757	if (tty_hung_up_p(filp: file))
3758	mask |= EPOLLHUP;
3759	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
3760	mask |= EPOLLHUP;
3761	if (!tty_is_writelocked(tty) && tty_write_room(tty) > 0)
3762	mask |= EPOLLOUT | EPOLLWRNORM;
3763	return mask;
3764	}
3765
3766	static int gsmld_ioctl(struct tty_struct *tty, unsigned int cmd,
3767	unsigned long arg)
3768	{
3769	struct gsm_config c;
3770	struct gsm_config_ext ce;
3771	struct gsm_dlci_config dc;
3772	struct gsm_mux *gsm = tty->disc_data;
3773	unsigned int base, addr;
3774	struct gsm_dlci *dlci;
3775
3776	switch (cmd) {
3777	case GSMIOC_GETCONF:
3778	gsm_copy_config_values(gsm, c: &c);
3779	if (copy_to_user(to: (void __user *)arg, from: &c, n: sizeof(c)))
3780	return -EFAULT;
3781	return 0;
3782	case GSMIOC_SETCONF:
3783	if (copy_from_user(to: &c, from: (void __user *)arg, n: sizeof(c)))
3784	return -EFAULT;
3785	return gsm_config(gsm, c: &c);
3786	case GSMIOC_GETFIRST:
3787	base = mux_num_to_base(gsm);
3788	return put_user(base + 1, (__u32 __user *)arg);
3789	case GSMIOC_GETCONF_EXT:
3790	gsm_copy_config_ext_values(gsm, ce: &ce);
3791	if (copy_to_user(to: (void __user *)arg, from: &ce, n: sizeof(ce)))
3792	return -EFAULT;
3793	return 0;
3794	case GSMIOC_SETCONF_EXT:
3795	if (copy_from_user(to: &ce, from: (void __user *)arg, n: sizeof(ce)))
3796	return -EFAULT;
3797	return gsm_config_ext(gsm, ce: &ce);
3798	case GSMIOC_GETCONF_DLCI:
3799	if (copy_from_user(to: &dc, from: (void __user *)arg, n: sizeof(dc)))
3800	return -EFAULT;
3801	if (dc.channel == 0 || dc.channel >= NUM_DLCI)
3802	return -EINVAL;
3803	addr = array_index_nospec(dc.channel, NUM_DLCI);
3804	dlci = gsm->dlci[addr];
3805	if (!dlci) {
3806	dlci = gsm_dlci_alloc(gsm, addr);
3807	if (!dlci)
3808	return -ENOMEM;
3809	}
3810	gsm_dlci_copy_config_values(dlci, dc: &dc);
3811	if (copy_to_user(to: (void __user *)arg, from: &dc, n: sizeof(dc)))
3812	return -EFAULT;
3813	return 0;
3814	case GSMIOC_SETCONF_DLCI:
3815	if (copy_from_user(to: &dc, from: (void __user *)arg, n: sizeof(dc)))
3816	return -EFAULT;
3817	if (dc.channel == 0 || dc.channel >= NUM_DLCI)
3818	return -EINVAL;
3819	addr = array_index_nospec(dc.channel, NUM_DLCI);
3820	dlci = gsm->dlci[addr];
3821	if (!dlci) {
3822	dlci = gsm_dlci_alloc(gsm, addr);
3823	if (!dlci)
3824	return -ENOMEM;
3825	}
3826	return gsm_dlci_config(dlci, dc: &dc, open: 0);
3827	default:
3828	return n_tty_ioctl_helper(tty, cmd, arg);
3829	}
3830	}
3831
3832	/*
3833	* Network interface
3834	*
3835	*/
3836
3837	static int gsm_mux_net_open(struct net_device *net)
3838	{
3839	pr_debug("%s called\n", __func__);
3840	netif_start_queue(dev: net);
3841	return 0;
3842	}
3843
3844	static int gsm_mux_net_close(struct net_device *net)
3845	{
3846	netif_stop_queue(dev: net);
3847	return 0;
3848	}
3849
3850	static void dlci_net_free(struct gsm_dlci *dlci)
3851	{
3852	if (!dlci->net) {
3853	WARN_ON(1);
3854	return;
3855	}
3856	dlci->adaption = dlci->prev_adaption;
3857	dlci->data = dlci->prev_data;
3858	free_netdev(dev: dlci->net);
3859	dlci->net = NULL;
3860	}
3861	static void net_free(struct kref *ref)
3862	{
3863	struct gsm_mux_net *mux_net;
3864	struct gsm_dlci *dlci;
3865
3866	mux_net = container_of(ref, struct gsm_mux_net, ref);
3867	dlci = mux_net->dlci;
3868
3869	if (dlci->net) {
3870	unregister_netdev(dev: dlci->net);
3871	dlci_net_free(dlci);
3872	}
3873	}
3874
3875	static inline void muxnet_get(struct gsm_mux_net *mux_net)
3876	{
3877	kref_get(kref: &mux_net->ref);
3878	}
3879
3880	static inline void muxnet_put(struct gsm_mux_net *mux_net)
3881	{
3882	kref_put(kref: &mux_net->ref, release: net_free);
3883	}
3884
3885	static netdev_tx_t gsm_mux_net_start_xmit(struct sk_buff *skb,
3886	struct net_device *net)
3887	{
3888	struct gsm_mux_net *mux_net = netdev_priv(dev: net);
3889	struct gsm_dlci *dlci = mux_net->dlci;
3890	muxnet_get(mux_net);
3891
3892	skb_queue_head(list: &dlci->skb_list, newsk: skb);
3893	net->stats.tx_packets++;
3894	net->stats.tx_bytes += skb->len;
3895	gsm_dlci_data_kick(dlci);
3896	/* And tell the kernel when the last transmit started. */
3897	netif_trans_update(dev: net);
3898	muxnet_put(mux_net);
3899	return NETDEV_TX_OK;
3900	}
3901
3902	/* called when a packet did not ack after watchdogtimeout */
3903	static void gsm_mux_net_tx_timeout(struct net_device *net, unsigned int txqueue)
3904	{
3905	/* Tell syslog we are hosed. */
3906	dev_dbg(&net->dev, "Tx timed out.\n");
3907
3908	/* Update statistics */
3909	net->stats.tx_errors++;
3910	}
3911
3912	static void gsm_mux_rx_netchar(struct gsm_dlci *dlci,
3913	const unsigned char *in_buf, int size)
3914	{
3915	struct net_device *net = dlci->net;
3916	struct sk_buff *skb;
3917	struct gsm_mux_net *mux_net = netdev_priv(dev: net);
3918	muxnet_get(mux_net);
3919
3920	/* Allocate an sk_buff */
3921	skb = dev_alloc_skb(length: size + NET_IP_ALIGN);
3922	if (!skb) {
3923	/* We got no receive buffer. */
3924	net->stats.rx_dropped++;
3925	muxnet_put(mux_net);
3926	return;
3927	}
3928	skb_reserve(skb, NET_IP_ALIGN);
3929	skb_put_data(skb, data: in_buf, len: size);
3930
3931	skb->dev = net;
3932	skb->protocol = htons(ETH_P_IP);
3933
3934	/* Ship it off to the kernel */
3935	netif_rx(skb);
3936
3937	/* update out statistics */
3938	net->stats.rx_packets++;
3939	net->stats.rx_bytes += size;
3940	muxnet_put(mux_net);
3941	return;
3942	}
3943
3944	static void gsm_mux_net_init(struct net_device *net)
3945	{
3946	static const struct net_device_ops gsm_netdev_ops = {
3947	.ndo_open = gsm_mux_net_open,
3948	.ndo_stop = gsm_mux_net_close,
3949	.ndo_start_xmit = gsm_mux_net_start_xmit,
3950	.ndo_tx_timeout = gsm_mux_net_tx_timeout,
3951	};
3952
3953	net->netdev_ops = &gsm_netdev_ops;
3954
3955	/* fill in the other fields */
3956	net->watchdog_timeo = GSM_NET_TX_TIMEOUT;
3957	net->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
3958	net->type = ARPHRD_NONE;
3959	net->tx_queue_len = 10;
3960	}
3961
3962
3963	/* caller holds the dlci mutex */
3964	static void gsm_destroy_network(struct gsm_dlci *dlci)
3965	{
3966	struct gsm_mux_net *mux_net;
3967
3968	pr_debug("destroy network interface\n");
3969	if (!dlci->net)
3970	return;
3971	mux_net = netdev_priv(dev: dlci->net);
3972	muxnet_put(mux_net);
3973	}
3974
3975
3976	/* caller holds the dlci mutex */
3977	static int gsm_create_network(struct gsm_dlci *dlci, struct gsm_netconfig *nc)
3978	{
3979	char *netname;
3980	int retval = 0;
3981	struct net_device *net;
3982	struct gsm_mux_net *mux_net;
3983
3984	if (!capable(CAP_NET_ADMIN))
3985	return -EPERM;
3986
3987	/* Already in a non tty mode */
3988	if (dlci->adaption > 2)
3989	return -EBUSY;
3990
3991	if (nc->protocol != htons(ETH_P_IP))
3992	return -EPROTONOSUPPORT;
3993
3994	if (nc->adaption != 3 && nc->adaption != 4)
3995	return -EPROTONOSUPPORT;
3996
3997	pr_debug("create network interface\n");
3998
3999	netname = "gsm%d";
4000	if (nc->if_name[0] != '\0')
4001	netname = nc->if_name;
4002	net = alloc_netdev(sizeof(struct gsm_mux_net), netname,
4003	NET_NAME_UNKNOWN, gsm_mux_net_init);
4004	if (!net) {
4005	pr_err("alloc_netdev failed\n");
4006	return -ENOMEM;
4007	}
4008	net->mtu = dlci->mtu;
4009	net->min_mtu = MIN_MTU;
4010	net->max_mtu = dlci->mtu;
4011	mux_net = netdev_priv(dev: net);
4012	mux_net->dlci = dlci;
4013	kref_init(kref: &mux_net->ref);
4014	strncpy(p: nc->if_name, q: net->name, IFNAMSIZ); /* return net name */
4015
4016	/* reconfigure dlci for network */
4017	dlci->prev_adaption = dlci->adaption;
4018	dlci->prev_data = dlci->data;
4019	dlci->adaption = nc->adaption;
4020	dlci->data = gsm_mux_rx_netchar;
4021	dlci->net = net;
4022
4023	pr_debug("register netdev\n");
4024	retval = register_netdev(dev: net);
4025	if (retval) {
4026	pr_err("network register fail %d\n", retval);
4027	dlci_net_free(dlci);
4028	return retval;
4029	}
4030	return net->ifindex; /* return network index */
4031	}
4032
4033	/* Line discipline for real tty */
4034	static struct tty_ldisc_ops tty_ldisc_packet = {
4035	.owner = THIS_MODULE,
4036	.num = N_GSM0710,
4037	.name = "n_gsm",
4038	.open = gsmld_open,
4039	.close = gsmld_close,
4040	.flush_buffer = gsmld_flush_buffer,
4041	.read = gsmld_read,
4042	.write = gsmld_write,
4043	.ioctl = gsmld_ioctl,
4044	.poll = gsmld_poll,
4045	.receive_buf = gsmld_receive_buf,
4046	.write_wakeup = gsmld_write_wakeup
4047	};
4048
4049	/*
4050	* Virtual tty side
4051	*/
4052
4053	/**
4054	* gsm_modem_upd_via_data - send modem bits via convergence layer
4055	* @dlci: channel
4056	* @brk: break signal
4057	*
4058	* Send an empty frame to signal mobile state changes and to transmit the
4059	* break signal for adaption 2.
4060	*/
4061
4062	static void gsm_modem_upd_via_data(struct gsm_dlci *dlci, u8 brk)
4063	{
4064	struct gsm_mux *gsm = dlci->gsm;
4065	unsigned long flags;
4066
4067	if (dlci->state != DLCI_OPEN || dlci->adaption != 2)
4068	return;
4069
4070	spin_lock_irqsave(&gsm->tx_lock, flags);
4071	gsm_dlci_modem_output(gsm, dlci, brk);
4072	spin_unlock_irqrestore(lock: &gsm->tx_lock, flags);
4073	}
4074
4075	/**
4076	* gsm_modem_upd_via_msc - send modem bits via control frame
4077	* @dlci: channel
4078	* @brk: break signal
4079	*/
4080
4081	static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
4082	{
4083	u8 modembits[3];
4084	struct gsm_control *ctrl;
4085	int len = 2;
4086
4087	if (dlci->gsm->encoding != GSM_BASIC_OPT)
4088	return 0;
4089
4090	modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
4091	if (!brk) {
4092	modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
4093	} else {
4094	modembits[1] = gsm_encode_modem(dlci) << 1;
4095	modembits[2] = (brk << 4) | 2 | EA; /* Length, Break, EA */
4096	len++;
4097	}
4098	ctrl = gsm_control_send(gsm: dlci->gsm, CMD_MSC, data: modembits, clen: len);
4099	if (ctrl == NULL)
4100	return -ENOMEM;
4101	return gsm_control_wait(gsm: dlci->gsm, control: ctrl);
4102	}
4103
4104	/**
4105	* gsm_modem_update - send modem status line state
4106	* @dlci: channel
4107	* @brk: break signal
4108	*/
4109
4110	static int gsm_modem_update(struct gsm_dlci *dlci, u8 brk)
4111	{
4112	if (dlci->gsm->dead)
4113	return -EL2HLT;
4114	if (dlci->adaption == 2) {
4115	/* Send convergence layer type 2 empty data frame. */
4116	gsm_modem_upd_via_data(dlci, brk);
4117	return 0;
4118	} else if (dlci->gsm->encoding == GSM_BASIC_OPT) {
4119	/* Send as MSC control message. */
4120	return gsm_modem_upd_via_msc(dlci, brk);
4121	}
4122
4123	/* Modem status lines are not supported. */
4124	return -EPROTONOSUPPORT;
4125	}
4126
4127	/**
4128	* gsm_wait_modem_change - wait for modem status line change
4129	* @dlci: channel
4130	* @mask: modem status line bits
4131	*
4132	* The function returns if:
4133	* - any given modem status line bit changed
4134	* - the wait event function got interrupted (e.g. by a signal)
4135	* - the underlying DLCI was closed
4136	* - the underlying ldisc device was removed
4137	*/
4138	static int gsm_wait_modem_change(struct gsm_dlci *dlci, u32 mask)
4139	{
4140	struct gsm_mux *gsm = dlci->gsm;
4141	u32 old = dlci->modem_rx;
4142	int ret;
4143
4144	ret = wait_event_interruptible(gsm->event, gsm->dead ||
4145	dlci->state != DLCI_OPEN ||
4146	(old ^ dlci->modem_rx) & mask);
4147	if (gsm->dead)
4148	return -ENODEV;
4149	if (dlci->state != DLCI_OPEN)
4150	return -EL2NSYNC;
4151	return ret;
4152	}
4153
4154	static bool gsm_carrier_raised(struct tty_port *port)
4155	{
4156	struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
4157	struct gsm_mux *gsm = dlci->gsm;
4158
4159	/* Not yet open so no carrier info */
4160	if (dlci->state != DLCI_OPEN)
4161	return false;
4162	if (debug & DBG_CD_ON)
4163	return true;
4164
4165	/*
4166	* Basic mode with control channel in ADM mode may not respond
4167	* to CMD_MSC at all and modem_rx is empty.
4168	*/
4169	if (gsm->encoding == GSM_BASIC_OPT &&
4170	gsm->dlci[0]->mode == DLCI_MODE_ADM && !dlci->modem_rx)
4171	return true;
4172
4173	return dlci->modem_rx & TIOCM_CD;
4174	}
4175
4176	static void gsm_dtr_rts(struct tty_port *port, bool active)
4177	{
4178	struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
4179	unsigned int modem_tx = dlci->modem_tx;
4180	if (active)
4181	modem_tx |= TIOCM_DTR | TIOCM_RTS;
4182	else
4183	modem_tx &= ~(TIOCM_DTR | TIOCM_RTS);
4184	if (modem_tx != dlci->modem_tx) {
4185	dlci->modem_tx = modem_tx;
4186	gsm_modem_update(dlci, brk: 0);
4187	}
4188	}
4189
4190	static const struct tty_port_operations gsm_port_ops = {
4191	.carrier_raised = gsm_carrier_raised,
4192	.dtr_rts = gsm_dtr_rts,
4193	.destruct = gsm_dlci_free,
4194	};
4195
4196	static int gsmtty_install(struct tty_driver *driver, struct tty_struct *tty)
4197	{
4198	struct gsm_mux *gsm;
4199	struct gsm_dlci *dlci;
4200	unsigned int line = tty->index;
4201	unsigned int mux = mux_line_to_num(line);
4202	bool alloc = false;
4203	int ret;
4204
4205	line = line & 0x3F;
4206
4207	if (mux >= MAX_MUX)
4208	return -ENXIO;
4209	/* FIXME: we need to lock gsm_mux for lifetimes of ttys eventually */
4210	if (gsm_mux[mux] == NULL)
4211	return -EUNATCH;
4212	if (line == 0 || line > 61) /* 62/63 reserved */
4213	return -ECHRNG;
4214	gsm = gsm_mux[mux];
4215	if (gsm->dead)
4216	return -EL2HLT;
4217	/* If DLCI 0 is not yet fully open return an error.
4218	This is ok from a locking
4219	perspective as we don't have to worry about this
4220	if DLCI0 is lost */
4221	mutex_lock(&gsm->mutex);
4222	if (gsm->dlci[0] && gsm->dlci[0]->state != DLCI_OPEN) {
4223	mutex_unlock(lock: &gsm->mutex);
4224	return -EL2NSYNC;
4225	}
4226	dlci = gsm->dlci[line];
4227	if (dlci == NULL) {
4228	alloc = true;
4229	dlci = gsm_dlci_alloc(gsm, addr: line);
4230	}
4231	if (dlci == NULL) {
4232	mutex_unlock(lock: &gsm->mutex);
4233	return -ENOMEM;
4234	}
4235	ret = tty_port_install(port: &dlci->port, driver, tty);
4236	if (ret) {
4237	if (alloc)
4238	dlci_put(dlci);
4239	mutex_unlock(lock: &gsm->mutex);
4240	return ret;
4241	}
4242
4243	dlci_get(dlci);
4244	dlci_get(dlci: gsm->dlci[0]);
4245	mux_get(gsm);
4246	tty->driver_data = dlci;
4247	mutex_unlock(lock: &gsm->mutex);
4248
4249	return 0;
4250	}
4251
4252	static int gsmtty_open(struct tty_struct *tty, struct file *filp)
4253	{
4254	struct gsm_dlci *dlci = tty->driver_data;
4255	struct tty_port *port = &dlci->port;
4256
4257	port->count++;
4258	tty_port_tty_set(port, tty);
4259
4260	dlci->modem_rx = 0;
4261	/* We could in theory open and close before we wait - eg if we get
4262	a DM straight back. This is ok as that will have caused a hangup */
4263	tty_port_set_initialized(port, val: true);
4264	/* Start sending off SABM messages */
4265	if (!dlci->gsm->wait_config) {
4266	/* Start sending off SABM messages */
4267	if (dlci->gsm->initiator)
4268	gsm_dlci_begin_open(dlci);
4269	else
4270	gsm_dlci_set_opening(dlci);
4271	} else {
4272	gsm_dlci_set_wait_config(dlci);
4273	}
4274	/* And wait for virtual carrier */
4275	return tty_port_block_til_ready(port, tty, filp);
4276	}
4277
4278	static void gsmtty_close(struct tty_struct *tty, struct file *filp)
4279	{
4280	struct gsm_dlci *dlci = tty->driver_data;
4281
4282	if (dlci == NULL)
4283	return;
4284	if (dlci->state == DLCI_CLOSED)
4285	return;
4286	mutex_lock(&dlci->mutex);
4287	gsm_destroy_network(dlci);
4288	mutex_unlock(lock: &dlci->mutex);
4289	if (tty_port_close_start(port: &dlci->port, tty, filp) == 0)
4290	return;
4291	gsm_dlci_begin_close(dlci);
4292	if (tty_port_initialized(port: &dlci->port) && C_HUPCL(tty))
4293	tty_port_lower_dtr_rts(port: &dlci->port);
4294	tty_port_close_end(port: &dlci->port, tty);
4295	tty_port_tty_set(port: &dlci->port, NULL);
4296	return;
4297	}
4298
4299	static void gsmtty_hangup(struct tty_struct *tty)
4300	{
4301	struct gsm_dlci *dlci = tty->driver_data;
4302	if (dlci->state == DLCI_CLOSED)
4303	return;
4304	tty_port_hangup(port: &dlci->port);
4305	gsm_dlci_begin_close(dlci);
4306	}
4307
4308	static ssize_t gsmtty_write(struct tty_struct *tty, const u8 *buf, size_t len)
4309	{
4310	int sent;
4311	struct gsm_dlci *dlci = tty->driver_data;
4312	if (dlci->state == DLCI_CLOSED)
4313	return -EINVAL;
4314	/* Stuff the bytes into the fifo queue */
4315	sent = kfifo_in_locked(&dlci->fifo, buf, len, &dlci->lock);
4316	/* Need to kick the channel */
4317	gsm_dlci_data_kick(dlci);
4318	return sent;
4319	}
4320
4321	static unsigned int gsmtty_write_room(struct tty_struct *tty)
4322	{
4323	struct gsm_dlci *dlci = tty->driver_data;
4324	if (dlci->state == DLCI_CLOSED)
4325	return 0;
4326	return kfifo_avail(&dlci->fifo);
4327	}
4328
4329	static unsigned int gsmtty_chars_in_buffer(struct tty_struct *tty)
4330	{
4331	struct gsm_dlci *dlci = tty->driver_data;
4332	if (dlci->state == DLCI_CLOSED)
4333	return 0;
4334	return kfifo_len(&dlci->fifo);
4335	}
4336
4337	static void gsmtty_flush_buffer(struct tty_struct *tty)
4338	{
4339	struct gsm_dlci *dlci = tty->driver_data;
4340	unsigned long flags;
4341
4342	if (dlci->state == DLCI_CLOSED)
4343	return;
4344	/* Caution needed: If we implement reliable transport classes
4345	then the data being transmitted can't simply be junked once
4346	it has first hit the stack. Until then we can just blow it
4347	away */
4348	spin_lock_irqsave(&dlci->lock, flags);
4349	kfifo_reset(&dlci->fifo);
4350	spin_unlock_irqrestore(lock: &dlci->lock, flags);
4351	/* Need to unhook this DLCI from the transmit queue logic */
4352	}
4353
4354	static void gsmtty_wait_until_sent(struct tty_struct *tty, int timeout)
4355	{
4356	/* The FIFO handles the queue so the kernel will do the right
4357	thing waiting on chars_in_buffer before calling us. No work
4358	to do here */
4359	}
4360
4361	static int gsmtty_tiocmget(struct tty_struct *tty)
4362	{
4363	struct gsm_dlci *dlci = tty->driver_data;
4364	if (dlci->state == DLCI_CLOSED)
4365	return -EINVAL;
4366	return dlci->modem_rx;
4367	}
4368
4369	static int gsmtty_tiocmset(struct tty_struct *tty,
4370	unsigned int set, unsigned int clear)
4371	{
4372	struct gsm_dlci *dlci = tty->driver_data;
4373	unsigned int modem_tx = dlci->modem_tx;
4374
4375	if (dlci->state == DLCI_CLOSED)
4376	return -EINVAL;
4377	modem_tx &= ~clear;
4378	modem_tx |= set;
4379
4380	if (modem_tx != dlci->modem_tx) {
4381	dlci->modem_tx = modem_tx;
4382	return gsm_modem_update(dlci, brk: 0);
4383	}
4384	return 0;
4385	}
4386
4387
4388	static int gsmtty_ioctl(struct tty_struct *tty,
4389	unsigned int cmd, unsigned long arg)
4390	{
4391	struct gsm_dlci *dlci = tty->driver_data;
4392	struct gsm_netconfig nc;
4393	struct gsm_dlci_config dc;
4394	int index;
4395
4396	if (dlci->state == DLCI_CLOSED)
4397	return -EINVAL;
4398	switch (cmd) {
4399	case GSMIOC_ENABLE_NET:
4400	if (copy_from_user(to: &nc, from: (void __user *)arg, n: sizeof(nc)))
4401	return -EFAULT;
4402	nc.if_name[IFNAMSIZ-1] = '\0';
4403	/* return net interface index or error code */
4404	mutex_lock(&dlci->mutex);
4405	index = gsm_create_network(dlci, nc: &nc);
4406	mutex_unlock(lock: &dlci->mutex);
4407	if (copy_to_user(to: (void __user *)arg, from: &nc, n: sizeof(nc)))
4408	return -EFAULT;
4409	return index;
4410	case GSMIOC_DISABLE_NET:
4411	if (!capable(CAP_NET_ADMIN))
4412	return -EPERM;
4413	mutex_lock(&dlci->mutex);
4414	gsm_destroy_network(dlci);
4415	mutex_unlock(lock: &dlci->mutex);
4416	return 0;
4417	case GSMIOC_GETCONF_DLCI:
4418	if (copy_from_user(to: &dc, from: (void __user *)arg, n: sizeof(dc)))
4419	return -EFAULT;
4420	if (dc.channel != dlci->addr)
4421	return -EPERM;
4422	gsm_dlci_copy_config_values(dlci, dc: &dc);
4423	if (copy_to_user(to: (void __user *)arg, from: &dc, n: sizeof(dc)))
4424	return -EFAULT;
4425	return 0;
4426	case GSMIOC_SETCONF_DLCI:
4427	if (copy_from_user(to: &dc, from: (void __user *)arg, n: sizeof(dc)))
4428	return -EFAULT;
4429	if (dc.channel >= NUM_DLCI)
4430	return -EINVAL;
4431	if (dc.channel != 0 && dc.channel != dlci->addr)
4432	return -EPERM;
4433	return gsm_dlci_config(dlci, dc: &dc, open: 1);
4434	case TIOCMIWAIT:
4435	return gsm_wait_modem_change(dlci, mask: (u32)arg);
4436	default:
4437	return -ENOIOCTLCMD;
4438	}
4439	}
4440
4441	static void gsmtty_set_termios(struct tty_struct *tty,
4442	const struct ktermios *old)
4443	{
4444	struct gsm_dlci *dlci = tty->driver_data;
4445	if (dlci->state == DLCI_CLOSED)
4446	return;
4447	/* For the moment its fixed. In actual fact the speed information
4448	for the virtual channel can be propogated in both directions by
4449	the RPN control message. This however rapidly gets nasty as we
4450	then have to remap modem signals each way according to whether
4451	our virtual cable is null modem etc .. */
4452	tty_termios_copy_hw(new: &tty->termios, old);
4453	}
4454
4455	static void gsmtty_throttle(struct tty_struct *tty)
4456	{
4457	struct gsm_dlci *dlci = tty->driver_data;
4458	if (dlci->state == DLCI_CLOSED)
4459	return;
4460	if (C_CRTSCTS(tty))
4461	dlci->modem_tx &= ~TIOCM_RTS;
4462	dlci->throttled = true;
4463	/* Send an MSC with RTS cleared */
4464	gsm_modem_update(dlci, brk: 0);
4465	}
4466
4467	static void gsmtty_unthrottle(struct tty_struct *tty)
4468	{
4469	struct gsm_dlci *dlci = tty->driver_data;
4470	if (dlci->state == DLCI_CLOSED)
4471	return;
4472	if (C_CRTSCTS(tty))
4473	dlci->modem_tx |= TIOCM_RTS;
4474	dlci->throttled = false;
4475	/* Send an MSC with RTS set */
4476	gsm_modem_update(dlci, brk: 0);
4477	}
4478
4479	static int gsmtty_break_ctl(struct tty_struct *tty, int state)
4480	{
4481	struct gsm_dlci *dlci = tty->driver_data;
4482	int encode = 0; /* Off */
4483	if (dlci->state == DLCI_CLOSED)
4484	return -EINVAL;
4485
4486	if (state == -1) /* "On indefinitely" - we can't encode this
4487	properly */
4488	encode = 0x0F;
4489	else if (state > 0) {
4490	encode = state / 200; /* mS to encoding */
4491	if (encode > 0x0F)
4492	encode = 0x0F; /* Best effort */
4493	}
4494	return gsm_modem_update(dlci, brk: encode);
4495	}
4496
4497	static void gsmtty_cleanup(struct tty_struct *tty)
4498	{
4499	struct gsm_dlci *dlci = tty->driver_data;
4500	struct gsm_mux *gsm = dlci->gsm;
4501
4502	dlci_put(dlci);
4503	dlci_put(dlci: gsm->dlci[0]);
4504	mux_put(gsm);
4505	}
4506
4507	/* Virtual ttys for the demux */
4508	static const struct tty_operations gsmtty_ops = {
4509	.install = gsmtty_install,
4510	.open = gsmtty_open,
4511	.close = gsmtty_close,
4512	.write = gsmtty_write,
4513	.write_room = gsmtty_write_room,
4514	.chars_in_buffer = gsmtty_chars_in_buffer,
4515	.flush_buffer = gsmtty_flush_buffer,
4516	.ioctl = gsmtty_ioctl,
4517	.throttle = gsmtty_throttle,
4518	.unthrottle = gsmtty_unthrottle,
4519	.set_termios = gsmtty_set_termios,
4520	.hangup = gsmtty_hangup,
4521	.wait_until_sent = gsmtty_wait_until_sent,
4522	.tiocmget = gsmtty_tiocmget,
4523	.tiocmset = gsmtty_tiocmset,
4524	.break_ctl = gsmtty_break_ctl,
4525	.cleanup = gsmtty_cleanup,
4526	};
4527
4528
4529
4530	static int __init gsm_init(void)
4531	{
4532	/* Fill in our line protocol discipline, and register it */
4533	int status = tty_register_ldisc(new_ldisc: &tty_ldisc_packet);
4534	if (status != 0) {
4535	pr_err("n_gsm: can't register line discipline (err = %d)\n",
4536	status);
4537	return status;
4538	}
4539
4540	gsm_tty_driver = tty_alloc_driver(GSM_TTY_MINORS, TTY_DRIVER_REAL_RAW |
4541	TTY_DRIVER_DYNAMIC_DEV | TTY_DRIVER_HARDWARE_BREAK);
4542	if (IS_ERR(ptr: gsm_tty_driver)) {
4543	pr_err("gsm_init: tty allocation failed.\n");
4544	status = PTR_ERR(ptr: gsm_tty_driver);
4545	goto err_unreg_ldisc;
4546	}
4547	gsm_tty_driver->driver_name = "gsmtty";
4548	gsm_tty_driver->name = "gsmtty";
4549	gsm_tty_driver->major = 0; /* Dynamic */
4550	gsm_tty_driver->minor_start = 0;
4551	gsm_tty_driver->type = TTY_DRIVER_TYPE_SERIAL;
4552	gsm_tty_driver->subtype = SERIAL_TYPE_NORMAL;
4553	gsm_tty_driver->init_termios = tty_std_termios;
4554	/* Fixme */
4555	gsm_tty_driver->init_termios.c_lflag &= ~ECHO;
4556	tty_set_operations(driver: gsm_tty_driver, op: &gsmtty_ops);
4557
4558	if (tty_register_driver(driver: gsm_tty_driver)) {
4559	pr_err("gsm_init: tty registration failed.\n");
4560	status = -EBUSY;
4561	goto err_put_driver;
4562	}
4563	pr_debug("gsm_init: loaded as %d,%d.\n",
4564	gsm_tty_driver->major, gsm_tty_driver->minor_start);
4565	return 0;
4566	err_put_driver:
4567	tty_driver_kref_put(driver: gsm_tty_driver);
4568	err_unreg_ldisc:
4569	tty_unregister_ldisc(ldisc: &tty_ldisc_packet);
4570	return status;
4571	}
4572
4573	static void __exit gsm_exit(void)
4574	{
4575	tty_unregister_ldisc(ldisc: &tty_ldisc_packet);
4576	tty_unregister_driver(driver: gsm_tty_driver);
4577	tty_driver_kref_put(driver: gsm_tty_driver);
4578	}
4579
4580	module_init(gsm_init);
4581	module_exit(gsm_exit);
4582
4583
4584	MODULE_LICENSE("GPL");
4585	MODULE_ALIAS_LDISC(N_GSM0710);
4586