Fedora kernel-2.6.17-1.2142_FC4 patched with stable patch-2.6.17.4-vs2.0.2-rc26.diff
[linux-2.6.git] / drivers / net / ppp_generic.c
index ffd5ac3..b2073fc 100644 (file)
@@ -19,7 +19,7 @@
  * PPP driver, written by Michael Callahan and Al Longyear, and
  * subsequently hacked by Paul Mackerras.
  *
- * ==FILEVERSION 20020217==
+ * ==FILEVERSION 20041108==
  */
 
 #include <linux/config.h>
@@ -46,6 +46,7 @@
 #include <linux/rwsem.h>
 #include <linux/stddef.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 #include <net/slhc_vj.h>
 #include <asm/atomic.h>
 
@@ -129,20 +130,22 @@ struct ppp {
 #endif /* CONFIG_PPP_MULTILINK */
        struct net_device_stats stats;  /* statistics */
 #ifdef CONFIG_PPP_FILTER
-       struct sock_fprog pass_filter;  /* filter for packets to pass */
-       struct sock_fprog active_filter;/* filter for pkts to reset idle */
+       struct sock_filter *pass_filter;        /* filter for packets to pass */
+       struct sock_filter *active_filter;/* filter for pkts to reset idle */
+       unsigned pass_len, active_len;
 #endif /* CONFIG_PPP_FILTER */
 };
 
 /*
  * Bits in flags: SC_NO_TCP_CCID, SC_CCP_OPEN, SC_CCP_UP, SC_LOOP_TRAFFIC,
- * SC_MULTILINK, SC_MP_SHORTSEQ, SC_MP_XSHORTSEQ, SC_COMP_TCP, SC_REJ_COMP_TCP.
+ * SC_MULTILINK, SC_MP_SHORTSEQ, SC_MP_XSHORTSEQ, SC_COMP_TCP, SC_REJ_COMP_TCP,
+ * SC_MUST_COMP
  * Bits in rstate: SC_DECOMP_RUN, SC_DC_ERROR, SC_DC_FERROR.
  * Bits in xstate: SC_COMP_RUN
  */
 #define SC_FLAG_BITS   (SC_NO_TCP_CCID|SC_CCP_OPEN|SC_CCP_UP|SC_LOOP_TRAFFIC \
                         |SC_MULTILINK|SC_MP_SHORTSEQ|SC_MP_XSHORTSEQ \
-                        |SC_COMP_TCP|SC_REJ_COMP_TCP)
+                        |SC_COMP_TCP|SC_REJ_COMP_TCP|SC_MUST_COMP)
 
 /*
  * Private data structure for each channel.
@@ -196,11 +199,11 @@ static unsigned int cardmap_find_first_free(struct cardmap *map);
 static void cardmap_destroy(struct cardmap **map);
 
 /*
- * all_ppp_sem protects the all_ppp_units mapping.
+ * all_ppp_mutex protects the all_ppp_units mapping.
  * It also ensures that finding a ppp unit in the all_ppp_units map
  * and updating its file.refcnt field is atomic.
  */
-static DECLARE_MUTEX(all_ppp_sem);
+static DEFINE_MUTEX(all_ppp_mutex);
 static struct cardmap *all_ppp_units;
 static atomic_t ppp_unit_count = ATOMIC_INIT(0);
 
@@ -209,7 +212,7 @@ static atomic_t ppp_unit_count = ATOMIC_INIT(0);
  * and the atomicity of find a channel and updating its file.refcnt
  * field.
  */
-static spinlock_t all_channels_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(all_channels_lock);
 static LIST_HEAD(all_channels);
 static LIST_HEAD(new_channels);
 static int last_channel_index;
@@ -272,7 +275,7 @@ static int ppp_connect_channel(struct channel *pch, int unit);
 static int ppp_disconnect_channel(struct channel *pch);
 static void ppp_destroy_channel(struct channel *pch);
 
-static struct class_simple *ppp_class;
+static struct class *ppp_class;
 
 /* Translates a PPP protocol number to a NP index (NP == network protocol) */
 static inline int proto_to_npindex(int proto)
@@ -370,7 +373,7 @@ static int ppp_release(struct inode *inode, struct file *file)
        struct ppp *ppp;
 
        if (pf != 0) {
-               file->private_data = 0;
+               file->private_data = NULL;
                if (pf->kind == INTERFACE) {
                        ppp = PF_TO_PPP(pf);
                        if (file == ppp->owner)
@@ -396,7 +399,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
        struct ppp_file *pf = file->private_data;
        DECLARE_WAITQUEUE(wait, current);
        ssize_t ret;
-       struct sk_buff *skb = 0;
+       struct sk_buff *skb = NULL;
 
        ret = count;
 
@@ -411,6 +414,17 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
                ret = 0;
                if (pf->dead)
                        break;
+               if (pf->kind == INTERFACE) {
+                       /*
+                        * Return 0 (EOF) on an interface that has no
+                        * channels connected, unless it is looping
+                        * network traffic (demand mode).
+                        */
+                       struct ppp *ppp = PF_TO_PPP(pf);
+                       if (ppp->n_channels == 0
+                           && (ppp->flags & SC_LOOP_TRAFFIC) == 0)
+                               break;
+               }
                ret = -EAGAIN;
                if (file->f_flags & O_NONBLOCK)
                        break;
@@ -490,9 +504,53 @@ static unsigned int ppp_poll(struct file *file, poll_table *wait)
                mask |= POLLIN | POLLRDNORM;
        if (pf->dead)
                mask |= POLLHUP;
+       else if (pf->kind == INTERFACE) {
+               /* see comment in ppp_read */
+               struct ppp *ppp = PF_TO_PPP(pf);
+               if (ppp->n_channels == 0
+                   && (ppp->flags & SC_LOOP_TRAFFIC) == 0)
+                       mask |= POLLIN | POLLRDNORM;
+       }
+
        return mask;
 }
 
+#ifdef CONFIG_PPP_FILTER
+static int get_filter(void __user *arg, struct sock_filter **p)
+{
+       struct sock_fprog uprog;
+       struct sock_filter *code = NULL;
+       int len, err;
+
+       if (copy_from_user(&uprog, arg, sizeof(uprog)))
+               return -EFAULT;
+
+       if (!uprog.len) {
+               *p = NULL;
+               return 0;
+       }
+
+       len = uprog.len * sizeof(struct sock_filter);
+       code = kmalloc(len, GFP_KERNEL);
+       if (code == NULL)
+               return -ENOMEM;
+
+       if (copy_from_user(code, uprog.filter, len)) {
+               kfree(code);
+               return -EFAULT;
+       }
+
+       err = sk_chk_filter(code, uprog.len);
+       if (err) {
+               kfree(code);
+               return err;
+       }
+
+       *p = code;
+       return uprog.len;
+}
+#endif /* CONFIG_PPP_FILTER */
+
 static int ppp_ioctl(struct inode *inode, struct file *file,
                     unsigned int cmd, unsigned long arg)
 {
@@ -503,6 +561,8 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
        struct npioctl npi;
        int unit, cflags;
        struct slcompress *vj;
+       void __user *argp = (void __user *)arg;
+       int __user *p = argp;
 
        if (pf == 0)
                return ppp_unattached_ioctl(pf, file, cmd, arg);
@@ -540,7 +600,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
                switch (cmd) {
                case PPPIOCCONNECT:
-                       if (get_user(unit, (int *) arg))
+                       if (get_user(unit, p))
                                break;
                        err = ppp_connect_channel(pch, unit);
                        break;
@@ -569,14 +629,14 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
        ppp = PF_TO_PPP(pf);
        switch (cmd) {
        case PPPIOCSMRU:
-               if (get_user(val, (int *) arg))
+               if (get_user(val, p))
                        break;
                ppp->mru = val;
                err = 0;
                break;
 
        case PPPIOCSFLAGS:
-               if (get_user(val, (int *) arg))
+               if (get_user(val, p))
                        break;
                ppp_lock(ppp);
                cflags = ppp->flags & ~val;
@@ -589,7 +649,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
        case PPPIOCGFLAGS:
                val = ppp->flags | ppp->xstate | ppp->rstate;
-               if (put_user(val, (int *) arg))
+               if (put_user(val, p))
                        break;
                err = 0;
                break;
@@ -599,20 +659,20 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
                break;
 
        case PPPIOCGUNIT:
-               if (put_user(ppp->file.index, (int *) arg))
+               if (put_user(ppp->file.index, p))
                        break;
                err = 0;
                break;
 
        case PPPIOCSDEBUG:
-               if (get_user(val, (int *) arg))
+               if (get_user(val, p))
                        break;
                ppp->debug = val;
                err = 0;
                break;
 
        case PPPIOCGDEBUG:
-               if (put_user(ppp->debug, (int *) arg))
+               if (put_user(ppp->debug, p))
                        break;
                err = 0;
                break;
@@ -620,13 +680,13 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
        case PPPIOCGIDLE:
                idle.xmit_idle = (jiffies - ppp->last_xmit) / HZ;
                idle.recv_idle = (jiffies - ppp->last_recv) / HZ;
-               if (copy_to_user((void __user *) arg, &idle, sizeof(idle)))
+               if (copy_to_user(argp, &idle, sizeof(idle)))
                        break;
                err = 0;
                break;
 
        case PPPIOCSMAXCID:
-               if (get_user(val, (int *) arg))
+               if (get_user(val, p))
                        break;
                val2 = 15;
                if ((val >> 16) != 0) {
@@ -649,7 +709,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
        case PPPIOCGNPMODE:
        case PPPIOCSNPMODE:
-               if (copy_from_user(&npi, (void __user *) arg, sizeof(npi)))
+               if (copy_from_user(&npi, argp, sizeof(npi)))
                        break;
                err = proto_to_npindex(npi.protocol);
                if (err < 0)
@@ -658,7 +718,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
                if (cmd == PPPIOCGNPMODE) {
                        err = -EFAULT;
                        npi.mode = ppp->npmode[i];
-                       if (copy_to_user((void __user *) arg, &npi, sizeof(npi)))
+                       if (copy_to_user(argp, &npi, sizeof(npi)))
                                break;
                } else {
                        ppp->npmode[i] = npi.mode;
@@ -670,49 +730,38 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
 #ifdef CONFIG_PPP_FILTER
        case PPPIOCSPASS:
+       {
+               struct sock_filter *code;
+               err = get_filter(argp, &code);
+               if (err >= 0) {
+                       ppp_lock(ppp);
+                       kfree(ppp->pass_filter);
+                       ppp->pass_filter = code;
+                       ppp->pass_len = err;
+                       ppp_unlock(ppp);
+                       err = 0;
+               }
+               break;
+       }
        case PPPIOCSACTIVE:
        {
-               struct sock_fprog uprog, *filtp;
-               struct sock_filter *code = NULL;
-               int len;
-
-               if (copy_from_user(&uprog, (void __user *) arg, sizeof(uprog)))
-                       break;
-               err = -EINVAL;
-               if (uprog.len > BPF_MAXINSNS)
-                       break;
-               err = -ENOMEM;
-               if (uprog.len > 0) {
-                       len = uprog.len * sizeof(struct sock_filter);
-                       code = kmalloc(len, GFP_KERNEL);
-                       if (code == NULL)
-                               break;
-                       err = -EFAULT;
-                       if (copy_from_user(code, (void __user *) uprog.filter, len)) {
-                               kfree(code);
-                               break;
-                       }
-                       err = sk_chk_filter(code, uprog.len);
-                       if (err) {
-                               kfree(code);
-                               break;
-                       }
+               struct sock_filter *code;
+               err = get_filter(argp, &code);
+               if (err >= 0) {
+                       ppp_lock(ppp);
+                       kfree(ppp->active_filter);
+                       ppp->active_filter = code;
+                       ppp->active_len = err;
+                       ppp_unlock(ppp);
+                       err = 0;
                }
-               filtp = (cmd == PPPIOCSPASS)? &ppp->pass_filter: &ppp->active_filter;
-               ppp_lock(ppp);
-               if (filtp->filter)
-                       kfree(filtp->filter);
-               filtp->filter = code;
-               filtp->len = uprog.len;
-               ppp_unlock(ppp);
-               err = 0;
                break;
        }
 #endif /* CONFIG_PPP_FILTER */
 
 #ifdef CONFIG_PPP_MULTILINK
        case PPPIOCSMRRU:
-               if (get_user(val, (int *) arg))
+               if (get_user(val, p))
                        break;
                ppp_recv_lock(ppp);
                ppp->mrru = val;
@@ -734,11 +783,12 @@ static int ppp_unattached_ioctl(struct ppp_file *pf, struct file *file,
        int unit, err = -EFAULT;
        struct ppp *ppp;
        struct channel *chan;
+       int __user *p = (int __user *)arg;
 
        switch (cmd) {
        case PPPIOCNEWUNIT:
                /* Create a new ppp unit */
-               if (get_user(unit, (int *) arg))
+               if (get_user(unit, p))
                        break;
                ppp = ppp_create_interface(unit, &err);
                if (ppp == 0)
@@ -746,16 +796,16 @@ static int ppp_unattached_ioctl(struct ppp_file *pf, struct file *file,
                file->private_data = &ppp->file;
                ppp->owner = file;
                err = -EFAULT;
-               if (put_user(ppp->file.index, (int *) arg))
+               if (put_user(ppp->file.index, p))
                        break;
                err = 0;
                break;
 
        case PPPIOCATTACH:
                /* Attach to an existing ppp unit */
-               if (get_user(unit, (int *) arg))
+               if (get_user(unit, p))
                        break;
-               down(&all_ppp_sem);
+               mutex_lock(&all_ppp_mutex);
                err = -ENXIO;
                ppp = ppp_find_unit(unit);
                if (ppp != 0) {
@@ -763,11 +813,11 @@ static int ppp_unattached_ioctl(struct ppp_file *pf, struct file *file,
                        file->private_data = &ppp->file;
                        err = 0;
                }
-               up(&all_ppp_sem);
+               mutex_unlock(&all_ppp_mutex);
                break;
 
        case PPPIOCATTCHAN:
-               if (get_user(unit, (int *) arg))
+               if (get_user(unit, p))
                        break;
                spin_lock_bh(&all_channels_lock);
                err = -ENXIO;
@@ -807,12 +857,12 @@ static int __init ppp_init(void)
        printk(KERN_INFO "PPP generic driver version " PPP_VERSION "\n");
        err = register_chrdev(PPP_MAJOR, "ppp", &ppp_device_fops);
        if (!err) {
-               ppp_class = class_simple_create(THIS_MODULE, "ppp");
+               ppp_class = class_create(THIS_MODULE, "ppp");
                if (IS_ERR(ppp_class)) {
                        err = PTR_ERR(ppp_class);
                        goto out_chrdev;
                }
-               class_simple_device_add(ppp_class, MKDEV(PPP_MAJOR, 0), NULL, "ppp");
+               class_device_create(ppp_class, NULL, MKDEV(PPP_MAJOR, 0), NULL, "ppp");
                err = devfs_mk_cdev(MKDEV(PPP_MAJOR, 0),
                                S_IFCHR|S_IRUSR|S_IWUSR, "ppp");
                if (err)
@@ -825,8 +875,8 @@ out:
        return err;
 
 out_class:
-       class_simple_device_remove(MKDEV(PPP_MAJOR,0));
-       class_simple_destroy(ppp_class);
+       class_device_destroy(ppp_class, MKDEV(PPP_MAJOR,0));
+       class_destroy(ppp_class);
 out_chrdev:
        unregister_chrdev(PPP_MAJOR, "ppp");
        goto out;
@@ -976,6 +1026,56 @@ ppp_xmit_process(struct ppp *ppp)
        ppp_xmit_unlock(ppp);
 }
 
+static inline struct sk_buff *
+pad_compress_skb(struct ppp *ppp, struct sk_buff *skb)
+{
+       struct sk_buff *new_skb;
+       int len;
+       int new_skb_size = ppp->dev->mtu +
+               ppp->xcomp->comp_extra + ppp->dev->hard_header_len;
+       int compressor_skb_size = ppp->dev->mtu +
+               ppp->xcomp->comp_extra + PPP_HDRLEN;
+       new_skb = alloc_skb(new_skb_size, GFP_ATOMIC);
+       if (!new_skb) {
+               if (net_ratelimit())
+                       printk(KERN_ERR "PPP: no memory (comp pkt)\n");
+               return NULL;
+       }
+       if (ppp->dev->hard_header_len > PPP_HDRLEN)
+               skb_reserve(new_skb,
+                           ppp->dev->hard_header_len - PPP_HDRLEN);
+
+       /* compressor still expects A/C bytes in hdr */
+       len = ppp->xcomp->compress(ppp->xc_state, skb->data - 2,
+                                  new_skb->data, skb->len + 2,
+                                  compressor_skb_size);
+       if (len > 0 && (ppp->flags & SC_CCP_UP)) {
+               kfree_skb(skb);
+               skb = new_skb;
+               skb_put(skb, len);
+               skb_pull(skb, 2);       /* pull off A/C bytes */
+       } else if (len == 0) {
+               /* didn't compress, or CCP not up yet */
+               kfree_skb(new_skb);
+               new_skb = skb;
+       } else {
+               /*
+                * (len < 0)
+                * MPPE requires that we do not send unencrypted
+                * frames.  The compressor will return -1 if we
+                * should drop the frame.  We cannot simply test
+                * the compress_proto because MPPE and MPPC share
+                * the same number.
+                */
+               if (net_ratelimit())
+                       printk(KERN_ERR "ppp: compressor dropped pkt\n");
+               kfree_skb(skb);
+               kfree_skb(new_skb);
+               new_skb = NULL;
+       }
+       return new_skb;
+}
+
 /*
  * Compress and send a frame.
  * The caller should have locked the xmit path,
@@ -994,23 +1094,19 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
                /* check if we should pass this packet */
                /* the filter instructions are constructed assuming
                   a four-byte PPP header on each packet */
-               {
-                       u_int16_t *p = (u_int16_t *) skb_push(skb, 2);
-
-                       *p = htons(4); /* indicate outbound in DLT_LINUX_SLL */;
-               }
-               if (ppp->pass_filter.filter
-                   && sk_run_filter(skb, ppp->pass_filter.filter,
-                                    ppp->pass_filter.len) == 0) {
+               *skb_push(skb, 2) = 1;
+               if (ppp->pass_filter
+                   && sk_run_filter(skb, ppp->pass_filter,
+                                    ppp->pass_len) == 0) {
                        if (ppp->debug & 1)
                                printk(KERN_DEBUG "PPP: outbound frame not passed\n");
                        kfree_skb(skb);
                        return;
                }
                /* if this packet passes the active filter, record the time */
-               if (!(ppp->active_filter.filter
-                     && sk_run_filter(skb, ppp->active_filter.filter,
-                                      ppp->active_filter.len) == 0))
+               if (!(ppp->active_filter
+                     && sk_run_filter(skb, ppp->active_filter,
+                                      ppp->active_len) == 0))
                        ppp->last_xmit = jiffies;
                skb_pull(skb, 2);
 #else
@@ -1066,29 +1162,14 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
        /* try to do packet compression */
        if ((ppp->xstate & SC_COMP_RUN) && ppp->xc_state != 0
            && proto != PPP_LCP && proto != PPP_CCP) {
-               new_skb = alloc_skb(ppp->dev->mtu + ppp->dev->hard_header_len,
-                                   GFP_ATOMIC);
-               if (new_skb == 0) {
-                       printk(KERN_ERR "PPP: no memory (comp pkt)\n");
+               if (!(ppp->flags & SC_CCP_UP) && (ppp->flags & SC_MUST_COMP)) {
+                       if (net_ratelimit())
+                               printk(KERN_ERR "ppp: compression required but down - pkt dropped.\n");
                        goto drop;
                }
-               if (ppp->dev->hard_header_len > PPP_HDRLEN)
-                       skb_reserve(new_skb,
-                                   ppp->dev->hard_header_len - PPP_HDRLEN);
-
-               /* compressor still expects A/C bytes in hdr */
-               len = ppp->xcomp->compress(ppp->xc_state, skb->data - 2,
-                                          new_skb->data, skb->len + 2,
-                                          ppp->dev->mtu + PPP_HDRLEN);
-               if (len > 0 && (ppp->flags & SC_CCP_UP)) {
-                       kfree_skb(skb);
-                       skb = new_skb;
-                       skb_put(skb, len);
-                       skb_pull(skb, 2);       /* pull off A/C bytes */
-               } else {
-                       /* didn't compress, or CCP not up yet */
-                       kfree_skb(new_skb);
-               }
+               skb = pad_compress_skb(ppp, skb);
+               if (!skb)
+                       goto drop;
        }
 
        /*
@@ -1108,7 +1189,8 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
        return;
 
  drop:
-       kfree_skb(skb);
+       if (skb)
+               kfree_skb(skb);
        ++ppp->stats.tx_errors;
 }
 
@@ -1129,7 +1211,7 @@ ppp_push(struct ppp *ppp)
        list = &ppp->channels;
        if (list_empty(list)) {
                /* nowhere to send the packet, just drop it */
-               ppp->xmit_pending = 0;
+               ppp->xmit_pending = NULL;
                kfree_skb(skb);
                return;
        }
@@ -1142,11 +1224,11 @@ ppp_push(struct ppp *ppp)
                spin_lock_bh(&pch->downl);
                if (pch->chan) {
                        if (pch->chan->ops->start_xmit(pch->chan, skb))
-                               ppp->xmit_pending = 0;
+                               ppp->xmit_pending = NULL;
                } else {
                        /* channel got unregistered */
                        kfree_skb(skb);
-                       ppp->xmit_pending = 0;
+                       ppp->xmit_pending = NULL;
                }
                spin_unlock_bh(&pch->downl);
                return;
@@ -1159,7 +1241,7 @@ ppp_push(struct ppp *ppp)
                return;
 #endif /* CONFIG_PPP_MULTILINK */
 
-       ppp->xmit_pending = 0;
+       ppp->xmit_pending = NULL;
        kfree_skb(skb);
 }
 
@@ -1170,36 +1252,41 @@ ppp_push(struct ppp *ppp)
  */
 static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
 {
-       int nch, len, fragsize;
+       int len, fragsize;
        int i, bits, hdrlen, mtu;
-       int flen, fnb;
+       int flen;
+       int navail, nfree;
+       int nbigger;
        unsigned char *p, *q;
        struct list_head *list;
        struct channel *pch;
        struct sk_buff *frag;
        struct ppp_channel *chan;
 
-       nch = 0;
+       nfree = 0;      /* # channels which have no packet already queued */
+       navail = 0;     /* total # of usable channels (not deregistered) */
        hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
-       list = &ppp->channels;
-       while ((list = list->next) != &ppp->channels) {
-               pch = list_entry(list, struct channel, clist);
-               nch += pch->avail = (skb_queue_len(&pch->file.xq) == 0);
-               /*
-                * If a channel hasn't had a fragment yet, it has to get
-                * one before we send any fragments on later channels.
-                * If it can't take a fragment now, don't give any
-                * to subsequent channels.
-                */
-               if (!pch->had_frag && !pch->avail) {
-                       while ((list = list->next) != &ppp->channels) {
-                               pch = list_entry(list, struct channel, clist);
-                               pch->avail = 0;
+       i = 0;
+       list_for_each_entry(pch, &ppp->channels, clist) {
+               navail += pch->avail = (pch->chan != NULL);
+               if (pch->avail) {
+                       if (skb_queue_empty(&pch->file.xq) ||
+                           !pch->had_frag) {
+                               pch->avail = 2;
+                               ++nfree;
                        }
-                       break;
+                       if (!pch->had_frag && i < ppp->nxchan)
+                               ppp->nxchan = i;
                }
+               ++i;
        }
-       if (nch == 0)
+
+       /*
+        * Don't start sending this packet unless at least half of
+        * the channels are free.  This gives much better TCP
+        * performance if we have a lot of channels.
+        */
+       if (nfree == 0 || nfree < navail / 2)
                return 0;       /* can't take now, leave it in xmit_pending */
 
        /* Do protocol field compression (XXX this should be optional) */
@@ -1210,17 +1297,23 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                --len;
        }
 
-       /* decide on fragment size */
+       /*
+        * Decide on fragment size.
+        * We create a fragment for each free channel regardless of
+        * how small they are (i.e. even 0 length) in order to minimize
+        * the time that it will take to detect when a channel drops
+        * a fragment.
+        */
        fragsize = len;
-       if (nch > 1) {
-               int maxch = ROUNDUP(len, MIN_FRAG_SIZE);
-               if (nch > maxch)
-                       nch = maxch;
-               fragsize = ROUNDUP(fragsize, nch);
-       }
+       if (nfree > 1)
+               fragsize = ROUNDUP(fragsize, nfree);
+       /* nbigger channels get fragsize bytes, the rest get fragsize-1,
+          except if nbigger==0, then they all get fragsize. */
+       nbigger = len % nfree;
 
        /* skip to the channel after the one we last used
           and start at that one */
+       list = &ppp->channels;
        for (i = 0; i < ppp->nxchan; ++i) {
                list = list->next;
                if (list == &ppp->channels) {
@@ -1231,7 +1324,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
 
        /* create a fragment for each channel */
        bits = B;
-       do {
+       while (nfree > 0 || len > 0) {
                list = list->next;
                if (list == &ppp->channels) {
                        i = 0;
@@ -1242,61 +1335,92 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                if (!pch->avail)
                        continue;
 
+               /*
+                * Skip this channel if it has a fragment pending already and
+                * we haven't given a fragment to all of the free channels.
+                */
+               if (pch->avail == 1) {
+                       if (nfree > 0)
+                               continue;
+               } else {
+                       --nfree;
+                       pch->avail = 1;
+               }
+
                /* check the channel's mtu and whether it is still attached. */
                spin_lock_bh(&pch->downl);
-               if (pch->chan == 0 || (mtu = pch->chan->mtu) < hdrlen) {
-                       /* can't use this channel */
+               if (pch->chan == NULL) {
+                       /* can't use this channel, it's being deregistered */
                        spin_unlock_bh(&pch->downl);
                        pch->avail = 0;
-                       if (--nch == 0)
+                       if (--navail == 0)
                                break;
                        continue;
                }
 
                /*
-                * We have to create multiple fragments for this channel
-                * if fragsize is greater than the channel's mtu.
+                * Create a fragment for this channel of
+                * min(max(mtu+2-hdrlen, 4), fragsize, len) bytes.
+                * If mtu+2-hdrlen < 4, that is a ridiculously small
+                * MTU, so we use mtu = 2 + hdrlen.
                 */
                if (fragsize > len)
                        fragsize = len;
-               for (flen = fragsize; flen > 0; flen -= fnb) {
-                       fnb = flen;
-                       if (fnb > mtu + 2 - hdrlen)
-                               fnb = mtu + 2 - hdrlen;
-                       if (fnb >= len)
-                               bits |= E;
-                       frag = alloc_skb(fnb + hdrlen, GFP_ATOMIC);
-                       if (frag == 0)
-                               goto noskb;
-                       q = skb_put(frag, fnb + hdrlen);
-                       /* make the MP header */
-                       q[0] = PPP_MP >> 8;
-                       q[1] = PPP_MP;
-                       if (ppp->flags & SC_MP_XSHORTSEQ) {
-                               q[2] = bits + ((ppp->nxseq >> 8) & 0xf);
-                               q[3] = ppp->nxseq;
-                       } else {
-                               q[2] = bits;
-                               q[3] = ppp->nxseq >> 16;
-                               q[4] = ppp->nxseq >> 8;
-                               q[5] = ppp->nxseq;
-                       }
-
-                       /* copy the data in */
-                       memcpy(q + hdrlen, p, fnb);
-
-                       /* try to send it down the channel */
-                       chan = pch->chan;
-                       if (!chan->ops->start_xmit(chan, frag))
-                               skb_queue_tail(&pch->file.xq, frag);
-                       pch->had_frag = 1;
-                       p += fnb;
-                       len -= fnb;
-                       ++ppp->nxseq;
-                       bits = 0;
+               flen = fragsize;
+               mtu = pch->chan->mtu + 2 - hdrlen;
+               if (mtu < 4)
+                       mtu = 4;
+               if (flen > mtu)
+                       flen = mtu;
+               if (flen == len && nfree == 0)
+                       bits |= E;
+               frag = alloc_skb(flen + hdrlen + (flen == 0), GFP_ATOMIC);
+               if (frag == 0)
+                       goto noskb;
+               q = skb_put(frag, flen + hdrlen);
+
+               /* make the MP header */
+               q[0] = PPP_MP >> 8;
+               q[1] = PPP_MP;
+               if (ppp->flags & SC_MP_XSHORTSEQ) {
+                       q[2] = bits + ((ppp->nxseq >> 8) & 0xf);
+                       q[3] = ppp->nxseq;
+               } else {
+                       q[2] = bits;
+                       q[3] = ppp->nxseq >> 16;
+                       q[4] = ppp->nxseq >> 8;
+                       q[5] = ppp->nxseq;
                }
+
+               /*
+                * Copy the data in.
+                * Unfortunately there is a bug in older versions of
+                * the Linux PPP multilink reconstruction code where it
+                * drops 0-length fragments.  Therefore we make sure the
+                * fragment has at least one byte of data.  Any bytes
+                * we add in this situation will end up as padding on the
+                * end of the reconstructed packet.
+                */
+               if (flen == 0)
+                       *skb_put(frag, 1) = 0;
+               else
+                       memcpy(q + hdrlen, p, flen);
+
+               /* try to send it down the channel */
+               chan = pch->chan;
+               if (!skb_queue_empty(&pch->file.xq) ||
+                   !chan->ops->start_xmit(chan, frag))
+                       skb_queue_tail(&pch->file.xq, frag);
+               pch->had_frag = 1;
+               p += flen;
+               len -= flen;
+               ++ppp->nxseq;
+               bits = 0;
                spin_unlock_bh(&pch->downl);
-       } while (len > 0);
+
+               if (--nbigger == 0 && fragsize > 0)
+                       --fragsize;
+       }
        ppp->nxchan = i;
 
        return 1;
@@ -1322,7 +1446,7 @@ ppp_channel_push(struct channel *pch)
 
        spin_lock_bh(&pch->downl);
        if (pch->chan != 0) {
-               while (skb_queue_len(&pch->file.xq) > 0) {
+               while (!skb_queue_empty(&pch->file.xq)) {
                        skb = skb_dequeue(&pch->file.xq);
                        if (!pch->chan->ops->start_xmit(pch->chan, skb)) {
                                /* put the packet back and try again later */
@@ -1336,7 +1460,7 @@ ppp_channel_push(struct channel *pch)
        }
        spin_unlock_bh(&pch->downl);
        /* see if there is anything from the attached unit to be sent */
-       if (skb_queue_len(&pch->file.xq) == 0) {
+       if (skb_queue_empty(&pch->file.xq)) {
                read_lock_bh(&pch->upl);
                ppp = pch->ppp;
                if (ppp != 0)
@@ -1375,7 +1499,7 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
                kfree_skb(skb);
                return;
        }
-       
+
        proto = PPP_PROTO(skb);
        read_lock_bh(&pch->upl);
        if (pch->ppp == 0 || proto >= 0xc000 || proto == PPP_CCPFRAG) {
@@ -1463,6 +1587,9 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
            && (ppp->rstate & (SC_DC_FERROR | SC_DC_ERROR)) == 0)
                skb = ppp_decompress_frame(ppp, skb);
 
+       if (ppp->flags & SC_MUST_COMP && ppp->rstate & SC_DC_FERROR)
+               goto err;
+
        proto = PPP_PROTO(skb);
        switch (proto) {
        case PPP_VJC_COMP:
@@ -1484,6 +1611,8 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                }
                else if (!pskb_may_pull(skb, skb->len))
                        goto err;
+               else
+                       skb->ip_summed = CHECKSUM_NONE;
 
                len = slhc_uncompress(ppp->vj, skb->data + 2, skb->len - 2);
                if (len <= 0) {
@@ -1541,22 +1670,18 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                /* check if the packet passes the pass and active filters */
                /* the filter instructions are constructed assuming
                   a four-byte PPP header on each packet */
-               {
-                       u_int16_t *p = (u_int16_t *) skb_push(skb, 2);
-
-                       *p = 0; /* indicate inbound in DLT_LINUX_SLL */
-               }
-               if (ppp->pass_filter.filter
-                   && sk_run_filter(skb, ppp->pass_filter.filter,
-                                    ppp->pass_filter.len) == 0) {
+               *skb_push(skb, 2) = 0;
+               if (ppp->pass_filter
+                   && sk_run_filter(skb, ppp->pass_filter,
+                                    ppp->pass_len) == 0) {
                        if (ppp->debug & 1)
                                printk(KERN_DEBUG "PPP: inbound frame not passed\n");
                        kfree_skb(skb);
                        return;
                }
-               if (!(ppp->active_filter.filter
-                     && sk_run_filter(skb, ppp->active_filter.filter,
-                                      ppp->active_filter.len) == 0))
+               if (!(ppp->active_filter
+                     && sk_run_filter(skb, ppp->active_filter,
+                                      ppp->active_len) == 0))
                        ppp->last_recv = jiffies;
                skb_pull(skb, 2);
 #else
@@ -1567,7 +1692,8 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                    || ppp->npmode[npi] != NPMODE_PASS) {
                        kfree_skb(skb);
                } else {
-                       skb_pull(skb, 2);       /* chop off protocol */
+                       /* chop off protocol */
+                       skb_pull_rcsum(skb, 2);
                        skb->dev = ppp->dev;
                        skb->protocol = htons(npindex_to_ethertype[npi]);
                        skb->mac.raw = skb->data;
@@ -1644,10 +1770,10 @@ static void
 ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
        u32 mask, seq;
-       struct list_head *l;
+       struct channel *ch;
        int mphdrlen = (ppp->flags & SC_MP_SHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
 
-       if (!pskb_may_pull(skb, mphdrlen + 1) || ppp->mrru == 0)
+       if (!pskb_may_pull(skb, mphdrlen) || ppp->mrru == 0)
                goto err;               /* no good, throw it away */
 
        /* Decode sequence number and begin/end bits */
@@ -1698,8 +1824,7 @@ ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
         * The list of channels can't change because we have the receive
         * side of the ppp unit locked.
         */
-       for (l = ppp->channels.next; l != &ppp->channels; l = l->next) {
-               struct channel *ch = list_entry(l, struct channel, clist);
+       list_for_each_entry(ch, &ppp->channels, clist) {
                if (seq_before(ch->lastseq, seq))
                        seq = ch->lastseq;
        }
@@ -1895,7 +2020,7 @@ ppp_register_channel(struct ppp_channel *chan)
 #endif /* CONFIG_PPP_MULTILINK */
        init_rwsem(&pch->chan_sem);
        spin_lock_init(&pch->downl);
-       pch->upl = RW_LOCK_UNLOCKED;
+       rwlock_init(&pch->upl);
        spin_lock_bh(&all_channels_lock);
        pch->file.index = ++last_channel_index;
        list_add(&pch->list, &new_channels);
@@ -1944,7 +2069,7 @@ ppp_unregister_channel(struct ppp_channel *chan)
 
        if (pch == 0)
                return;         /* should never happen */
-       chan->ppp = 0;
+       chan->ppp = NULL;
 
        /*
         * This ensures that we have returned from any calls into the
@@ -1952,7 +2077,7 @@ ppp_unregister_channel(struct ppp_channel *chan)
         */
        down_write(&pch->chan_sem);
        spin_lock_bh(&pch->downl);
-       pch->chan = 0;
+       pch->chan = NULL;
        spin_unlock_bh(&pch->downl);
        up_write(&pch->chan_sem);
        ppp_disconnect_channel(pch);
@@ -2155,11 +2280,11 @@ ppp_ccp_closed(struct ppp *ppp)
        ppp->xstate = 0;
        xcomp = ppp->xcomp;
        xstate = ppp->xc_state;
-       ppp->xc_state = 0;
+       ppp->xc_state = NULL;
        ppp->rstate = 0;
        rcomp = ppp->rcomp;
        rstate = ppp->rc_state;
-       ppp->rc_state = 0;
+       ppp->rc_state = NULL;
        ppp_unlock(ppp);
 
        if (xstate) {
@@ -2174,7 +2299,7 @@ ppp_ccp_closed(struct ppp *ppp)
 
 /* List of compressors. */
 static LIST_HEAD(compressor_list);
-static spinlock_t compressor_list_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(compressor_list_lock);
 
 struct compressor_entry {
        struct list_head list;
@@ -2185,14 +2310,12 @@ static struct compressor_entry *
 find_comp_entry(int proto)
 {
        struct compressor_entry *ce;
-       struct list_head *list = &compressor_list;
 
-       while ((list = list->next) != &compressor_list) {
-               ce = list_entry(list, struct compressor_entry, list);
+       list_for_each_entry(ce, &compressor_list, list) {
                if (ce->comp->compress_proto == proto)
                        return ce;
        }
-       return 0;
+       return NULL;
 }
 
 /* Register a compressor */
@@ -2237,7 +2360,7 @@ static struct compressor *
 find_compressor(int type)
 {
        struct compressor_entry *ce;
-       struct compressor *cp = 0;
+       struct compressor *cp = NULL;
 
        spin_lock(&compressor_list_lock);
        ce = find_comp_entry(type);
@@ -2324,7 +2447,7 @@ ppp_create_interface(int unit, int *retp)
        dev->do_ioctl = ppp_net_ioctl;
 
        ret = -EEXIST;
-       down(&all_ppp_sem);
+       mutex_lock(&all_ppp_mutex);
        if (unit < 0)
                unit = cardmap_find_first_free(all_ppp_units);
        else if (cardmap_get(all_ppp_units, unit) != NULL)
@@ -2343,12 +2466,12 @@ ppp_create_interface(int unit, int *retp)
 
        atomic_inc(&ppp_unit_count);
        cardmap_set(&all_ppp_units, unit, ppp);
-       up(&all_ppp_sem);
+       mutex_unlock(&all_ppp_mutex);
        *retp = 0;
        return ppp;
 
 out2:
-       up(&all_ppp_sem);
+       mutex_unlock(&all_ppp_mutex);
        free_netdev(dev);
 out1:
        kfree(ppp);
@@ -2378,10 +2501,10 @@ static void ppp_shutdown_interface(struct ppp *ppp)
 {
        struct net_device *dev;
 
-       down(&all_ppp_sem);
+       mutex_lock(&all_ppp_mutex);
        ppp_lock(ppp);
        dev = ppp->dev;
-       ppp->dev = 0;
+       ppp->dev = NULL;
        ppp_unlock(ppp);
        /* This will call dev_close() for us. */
        if (dev) {
@@ -2392,7 +2515,7 @@ static void ppp_shutdown_interface(struct ppp *ppp)
        ppp->file.dead = 1;
        ppp->owner = NULL;
        wake_up_interruptible(&ppp->file.rwait);
-       up(&all_ppp_sem);
+       mutex_unlock(&all_ppp_mutex);
 }
 
 /*
@@ -2415,7 +2538,7 @@ static void ppp_destroy_interface(struct ppp *ppp)
        ppp_ccp_closed(ppp);
        if (ppp->vj) {
                slhc_free(ppp->vj);
-               ppp->vj = 0;
+               ppp->vj = NULL;
        }
        skb_queue_purge(&ppp->file.xq);
        skb_queue_purge(&ppp->file.rq);
@@ -2423,14 +2546,10 @@ static void ppp_destroy_interface(struct ppp *ppp)
        skb_queue_purge(&ppp->mrq);
 #endif /* CONFIG_PPP_MULTILINK */
 #ifdef CONFIG_PPP_FILTER
-       if (ppp->pass_filter.filter) {
-               kfree(ppp->pass_filter.filter);
-               ppp->pass_filter.filter = NULL;
-       }
-       if (ppp->active_filter.filter) {
-               kfree(ppp->active_filter.filter);
-               ppp->active_filter.filter = 0;
-       }
+       kfree(ppp->pass_filter);
+       ppp->pass_filter = NULL;
+       kfree(ppp->active_filter);
+       ppp->active_filter = NULL;
 #endif /* CONFIG_PPP_FILTER */
 
        kfree(ppp);
@@ -2438,7 +2557,7 @@ static void ppp_destroy_interface(struct ppp *ppp)
 
 /*
  * Locate an existing ppp unit.
- * The caller should have locked the all_ppp_sem.
+ * The caller should have locked the all_ppp_mutex.
  */
 static struct ppp *
 ppp_find_unit(int unit)
@@ -2458,24 +2577,19 @@ static struct channel *
 ppp_find_channel(int unit)
 {
        struct channel *pch;
-       struct list_head *list;
 
-       list = &new_channels;
-       while ((list = list->next) != &new_channels) {
-               pch = list_entry(list, struct channel, list);
+       list_for_each_entry(pch, &new_channels, list) {
                if (pch->file.index == unit) {
                        list_del(&pch->list);
                        list_add(&pch->list, &all_channels);
                        return pch;
                }
        }
-       list = &all_channels;
-       while ((list = list->next) != &all_channels) {
-               pch = list_entry(list, struct channel, list);
+       list_for_each_entry(pch, &all_channels, list) {
                if (pch->file.index == unit)
                        return pch;
        }
-       return 0;
+       return NULL;
 }
 
 /*
@@ -2488,7 +2602,7 @@ ppp_connect_channel(struct channel *pch, int unit)
        int ret = -ENXIO;
        int hdrlen;
 
-       down(&all_ppp_sem);
+       mutex_lock(&all_ppp_mutex);
        ppp = ppp_find_unit(unit);
        if (ppp == 0)
                goto out;
@@ -2513,7 +2627,7 @@ ppp_connect_channel(struct channel *pch, int unit)
  outl:
        write_unlock_bh(&pch->upl);
  out:
-       up(&all_ppp_sem);
+       mutex_unlock(&all_ppp_mutex);
        return ret;
 }
 
@@ -2534,7 +2648,8 @@ ppp_disconnect_channel(struct channel *pch)
                /* remove it from the ppp unit's list */
                ppp_lock(ppp);
                list_del(&pch->clist);
-               --ppp->n_channels;
+               if (--ppp->n_channels == 0)
+                       wake_up_interruptible(&ppp->file.rwait);
                ppp_unlock(ppp);
                if (atomic_dec_and_test(&ppp->file.refcnt))
                        ppp_destroy_interface(ppp);
@@ -2570,8 +2685,8 @@ static void __exit ppp_cleanup(void)
        if (unregister_chrdev(PPP_MAJOR, "ppp") != 0)
                printk(KERN_ERR "PPP: failed to unregister PPP device\n");
        devfs_remove("ppp");
-       class_simple_device_remove(MKDEV(PPP_MAJOR, 0));
-       class_simple_destroy(ppp_class);
+       class_device_destroy(ppp_class, MKDEV(PPP_MAJOR, 0));
+       class_destroy(ppp_class);
 }
 
 /*
@@ -2696,8 +2811,6 @@ EXPORT_SYMBOL(ppp_input_error);
 EXPORT_SYMBOL(ppp_output_wakeup);
 EXPORT_SYMBOL(ppp_register_compressor);
 EXPORT_SYMBOL(ppp_unregister_compressor);
-EXPORT_SYMBOL(all_ppp_units); /* for debugging */
-EXPORT_SYMBOL(all_channels); /* for debugging */
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CHARDEV_MAJOR(PPP_MAJOR);
 MODULE_ALIAS("/dev/ppp");