xref: /openbmc/linux/drivers/isdn/mISDN/l1oip_core.c (revision 55fd7e02)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 
4  * l1oip.c  low level driver for tunneling layer 1 over IP
5  *
6  * NOTE: It is not compatible with TDMoIP nor "ISDN over IP".
7  *
8  * Author	Andreas Eversberg (jolly@eversberg.eu)
9  */
10 
11 /* module parameters:
12  * type:
13  Value 1	= BRI
14  Value 2	= PRI
15  Value 3 = BRI (multi channel frame, not supported yet)
16  Value 4 = PRI (multi channel frame, not supported yet)
17  A multi channel frame reduces overhead to a single frame for all
18  b-channels, but increases delay.
19  (NOTE: Multi channel frames are not implemented yet.)
20 
21  * codec:
22  Value 0 = transparent (default)
23  Value 1 = transfer ALAW
24  Value 2 = transfer ULAW
25  Value 3 = transfer generic 4 bit compression.
26 
27  * ulaw:
28  0 = we use a-Law (default)
29  1 = we use u-Law
30 
31  * limit:
32  limitation of B-channels to control bandwidth (1...126)
33  BRI: 1 or 2
34  PRI: 1-30, 31-126 (126, because dchannel ist not counted here)
35  Also limited ressources are used for stack, resulting in less channels.
36  It is possible to have more channels than 30 in PRI mode, this must
37  be supported by the application.
38 
39  * ip:
40  byte representation of remote ip address (127.0.0.1 -> 127,0,0,1)
41  If not given or four 0, no remote address is set.
42  For multiple interfaces, concat ip addresses. (127,0,0,1,127,0,0,1)
43 
44  * port:
45  port number (local interface)
46  If not given or 0, port 931 is used for fist instance, 932 for next...
47  For multiple interfaces, different ports must be given.
48 
49  * remoteport:
50  port number (remote interface)
51  If not given or 0, remote port equals local port
52  For multiple interfaces on equal sites, different ports must be given.
53 
54  * ondemand:
55  0 = fixed (always transmit packets, even when remote side timed out)
56  1 = on demand (only transmit packets, when remote side is detected)
57  the default is 0
58  NOTE: ID must also be set for on demand.
59 
60  * id:
61  optional value to identify frames. This value must be equal on both
62  peers and should be random. If omitted or 0, no ID is transmitted.
63 
64  * debug:
65  NOTE: only one debug value must be given for all cards
66  enable debugging (see l1oip.h for debug options)
67 
68 
69  Special mISDN controls:
70 
71  op = MISDN_CTRL_SETPEER*
72  p1 = bytes 0-3 : remote IP address in network order (left element first)
73  p2 = bytes 1-2 : remote port in network order (high byte first)
74  optional:
75  p2 = bytes 3-4 : local port in network order (high byte first)
76 
77  op = MISDN_CTRL_UNSETPEER*
78 
79  * Use l1oipctrl for comfortable setting or removing ip address.
80  (Layer 1 Over IP CTRL)
81 
82 
83  L1oIP-Protocol
84  --------------
85 
86  Frame Header:
87 
88  7 6 5 4 3 2 1 0
89  +---------------+
90  |Ver|T|I|Coding |
91  +---------------+
92  |  ID byte 3 *  |
93  +---------------+
94  |  ID byte 2 *  |
95  +---------------+
96  |  ID byte 1 *  |
97  +---------------+
98  |  ID byte 0 *  |
99  +---------------+
100  |M|   Channel   |
101  +---------------+
102  |    Length *   |
103  +---------------+
104  | Time Base MSB |
105  +---------------+
106  | Time Base LSB |
107  +---------------+
108  | Data....	|
109 
110  ...
111 
112  |               |
113  +---------------+
114  |M|   Channel   |
115  +---------------+
116  |    Length *   |
117  +---------------+
118  | Time Base MSB |
119  +---------------+
120  | Time Base LSB |
121  +---------------+
122  | Data....	|
123 
124  ...
125 
126 
127  * Only included in some cases.
128 
129  - Ver = Version
130  If version is missmatch, the frame must be ignored.
131 
132  - T = Type of interface
133  Must be 0 for S0 or 1 for E1.
134 
135  - I = Id present
136  If bit is set, four ID bytes are included in frame.
137 
138  - ID = Connection ID
139  Additional ID to prevent Denial of Service attacs. Also it prevents hijacking
140  connections with dynamic IP. The ID should be random and must not be 0.
141 
142  - Coding = Type of codec
143  Must be 0 for no transcoding. Also for D-channel and other HDLC frames.
144  1 and 2 are reserved for explicitly use of a-LAW or u-LAW codec.
145  3 is used for generic table compressor.
146 
147  - M = More channels to come. If this flag is 1, the following byte contains
148  the length of the channel data. After the data block, the next channel will
149  be defined. The flag for the last channel block (or if only one channel is
150  transmitted), must be 0 and no length is given.
151 
152  - Channel = Channel number
153  0 reserved
154  1-3 channel data for S0 (3 is D-channel)
155  1-31 channel data for E1 (16 is D-channel)
156  32-127 channel data for extended E1 (16 is D-channel)
157 
158  - The length is used if the M-flag is 1. It is used to find the next channel
159  inside frame.
160  NOTE: A value of 0 equals 256 bytes of data.
161  -> For larger data blocks, a single frame must be used.
162  -> For larger streams, a single frame or multiple blocks with same channel ID
163  must be used.
164 
165  - Time Base = Timestamp of first sample in frame
166  The "Time Base" is used to rearange packets and to detect packet loss.
167  The 16 bits are sent in network order (MSB first) and count 1/8000 th of a
168  second. This causes a wrap around each 8,192 seconds. There is no requirement
169  for the initial "Time Base", but 0 should be used for the first packet.
170  In case of HDLC data, this timestamp counts the packet or byte number.
171 
172 
173  Two Timers:
174 
175  After initialisation, a timer of 15 seconds is started. Whenever a packet is
176  transmitted, the timer is reset to 15 seconds again. If the timer expires, an
177  empty packet is transmitted. This keep the connection alive.
178 
179  When a valid packet is received, a timer 65 seconds is started. The interface
180  become ACTIVE. If the timer expires, the interface becomes INACTIVE.
181 
182 
183  Dynamic IP handling:
184 
185  To allow dynamic IP, the ID must be non 0. In this case, any packet with the
186  correct port number and ID will be accepted. If the remote side changes its IP
187  the new IP is used for all transmitted packets until it changes again.
188 
189 
190  On Demand:
191 
192  If the ondemand parameter is given, the remote IP is set to 0 on timeout.
193  This will stop keepalive traffic to remote. If the remote is online again,
194  traffic will continue to the remote address. This is useful for road warriors.
195  This feature only works with ID set, otherwhise it is highly unsecure.
196 
197 
198  Socket and Thread
199  -----------------
200 
201  The complete socket opening and closing is done by a thread.
202  When the thread opened a socket, the hc->socket descriptor is set. Whenever a
203  packet shall be sent to the socket, the hc->socket must be checked wheter not
204  NULL. To prevent change in socket descriptor, the hc->socket_lock must be used.
205  To change the socket, a recall of l1oip_socket_open() will safely kill the
206  socket process and create a new one.
207 
208 */
209 
210 #define L1OIP_VERSION	0	/* 0...3 */
211 
212 #include <linux/module.h>
213 #include <linux/delay.h>
214 #include <linux/mISDNif.h>
215 #include <linux/mISDNhw.h>
216 #include <linux/mISDNdsp.h>
217 #include <linux/init.h>
218 #include <linux/in.h>
219 #include <linux/inet.h>
220 #include <linux/workqueue.h>
221 #include <linux/kthread.h>
222 #include <linux/slab.h>
223 #include <linux/sched/signal.h>
224 
225 #include <net/sock.h>
226 #include "core.h"
227 #include "l1oip.h"
228 
229 static const char *l1oip_revision = "2.00";
230 
231 static int l1oip_cnt;
232 static spinlock_t l1oip_lock;
233 static struct list_head l1oip_ilist;
234 
235 #define MAX_CARDS	16
236 static u_int type[MAX_CARDS];
237 static u_int codec[MAX_CARDS];
238 static u_int ip[MAX_CARDS * 4];
239 static u_int port[MAX_CARDS];
240 static u_int remoteport[MAX_CARDS];
241 static u_int ondemand[MAX_CARDS];
242 static u_int limit[MAX_CARDS];
243 static u_int id[MAX_CARDS];
244 static int debug;
245 static int ulaw;
246 
247 MODULE_AUTHOR("Andreas Eversberg");
248 MODULE_LICENSE("GPL");
249 module_param_array(type, uint, NULL, S_IRUGO | S_IWUSR);
250 module_param_array(codec, uint, NULL, S_IRUGO | S_IWUSR);
251 module_param_array(ip, uint, NULL, S_IRUGO | S_IWUSR);
252 module_param_array(port, uint, NULL, S_IRUGO | S_IWUSR);
253 module_param_array(remoteport, uint, NULL, S_IRUGO | S_IWUSR);
254 module_param_array(ondemand, uint, NULL, S_IRUGO | S_IWUSR);
255 module_param_array(limit, uint, NULL, S_IRUGO | S_IWUSR);
256 module_param_array(id, uint, NULL, S_IRUGO | S_IWUSR);
257 module_param(ulaw, uint, S_IRUGO | S_IWUSR);
258 module_param(debug, uint, S_IRUGO | S_IWUSR);
259 
260 /*
261  * send a frame via socket, if open and restart timer
262  */
263 static int
264 l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask,
265 		  u16 timebase, u8 *buf, int len)
266 {
267 	u8 *p;
268 	u8 frame[MAX_DFRAME_LEN_L1 + 32];
269 	struct socket *socket = NULL;
270 
271 	if (debug & DEBUG_L1OIP_MSG)
272 		printk(KERN_DEBUG "%s: sending data to socket (len = %d)\n",
273 		       __func__, len);
274 
275 	p = frame;
276 
277 	/* restart timer */
278 	if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ))
279 		mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ);
280 	else
281 		hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ;
282 
283 	if (debug & DEBUG_L1OIP_MSG)
284 		printk(KERN_DEBUG "%s: resetting timer\n", __func__);
285 
286 	/* drop if we have no remote ip or port */
287 	if (!hc->sin_remote.sin_addr.s_addr || !hc->sin_remote.sin_port) {
288 		if (debug & DEBUG_L1OIP_MSG)
289 			printk(KERN_DEBUG "%s: dropping frame, because remote "
290 			       "IP is not set.\n", __func__);
291 		return len;
292 	}
293 
294 	/* assemble frame */
295 	*p++ = (L1OIP_VERSION << 6) /* version and coding */
296 		| (hc->pri ? 0x20 : 0x00) /* type */
297 		| (hc->id ? 0x10 : 0x00) /* id */
298 		| localcodec;
299 	if (hc->id) {
300 		*p++ = hc->id >> 24; /* id */
301 		*p++ = hc->id >> 16;
302 		*p++ = hc->id >> 8;
303 		*p++ = hc->id;
304 	}
305 	*p++ =  0x00 + channel; /* m-flag, channel */
306 	*p++ = timebase >> 8; /* time base */
307 	*p++ = timebase;
308 
309 	if (buf && len) { /* add data to frame */
310 		if (localcodec == 1 && ulaw)
311 			l1oip_ulaw_to_alaw(buf, len, p);
312 		else if (localcodec == 2 && !ulaw)
313 			l1oip_alaw_to_ulaw(buf, len, p);
314 		else if (localcodec == 3)
315 			len = l1oip_law_to_4bit(buf, len, p,
316 						&hc->chan[channel].codecstate);
317 		else
318 			memcpy(p, buf, len);
319 	}
320 	len += p - frame;
321 
322 	/* check for socket in safe condition */
323 	spin_lock(&hc->socket_lock);
324 	if (!hc->socket) {
325 		spin_unlock(&hc->socket_lock);
326 		return 0;
327 	}
328 	/* seize socket */
329 	socket = hc->socket;
330 	hc->socket = NULL;
331 	spin_unlock(&hc->socket_lock);
332 	/* send packet */
333 	if (debug & DEBUG_L1OIP_MSG)
334 		printk(KERN_DEBUG "%s: sending packet to socket (len "
335 		       "= %d)\n", __func__, len);
336 	hc->sendiov.iov_base = frame;
337 	hc->sendiov.iov_len  = len;
338 	len = kernel_sendmsg(socket, &hc->sendmsg, &hc->sendiov, 1, len);
339 	/* give socket back */
340 	hc->socket = socket; /* no locking required */
341 
342 	return len;
343 }
344 
345 
346 /*
347  * receive channel data from socket
348  */
349 static void
350 l1oip_socket_recv(struct l1oip *hc, u8 remotecodec, u8 channel, u16 timebase,
351 		  u8 *buf, int len)
352 {
353 	struct sk_buff *nskb;
354 	struct bchannel *bch;
355 	struct dchannel *dch;
356 	u8 *p;
357 	u32 rx_counter;
358 
359 	if (len == 0) {
360 		if (debug & DEBUG_L1OIP_MSG)
361 			printk(KERN_DEBUG "%s: received empty keepalive data, "
362 			       "ignoring\n", __func__);
363 		return;
364 	}
365 
366 	if (debug & DEBUG_L1OIP_MSG)
367 		printk(KERN_DEBUG "%s: received data, sending to mISDN (%d)\n",
368 		       __func__, len);
369 
370 	if (channel < 1 || channel > 127) {
371 		printk(KERN_WARNING "%s: packet error - channel %d out of "
372 		       "range\n", __func__, channel);
373 		return;
374 	}
375 	dch = hc->chan[channel].dch;
376 	bch = hc->chan[channel].bch;
377 	if (!dch && !bch) {
378 		printk(KERN_WARNING "%s: packet error - channel %d not in "
379 		       "stack\n", __func__, channel);
380 		return;
381 	}
382 
383 	/* prepare message */
384 	nskb = mI_alloc_skb((remotecodec == 3) ? (len << 1) : len, GFP_ATOMIC);
385 	if (!nskb) {
386 		printk(KERN_ERR "%s: No mem for skb.\n", __func__);
387 		return;
388 	}
389 	p = skb_put(nskb, (remotecodec == 3) ? (len << 1) : len);
390 
391 	if (remotecodec == 1 && ulaw)
392 		l1oip_alaw_to_ulaw(buf, len, p);
393 	else if (remotecodec == 2 && !ulaw)
394 		l1oip_ulaw_to_alaw(buf, len, p);
395 	else if (remotecodec == 3)
396 		len = l1oip_4bit_to_law(buf, len, p);
397 	else
398 		memcpy(p, buf, len);
399 
400 	/* send message up */
401 	if (dch && len >= 2) {
402 		dch->rx_skb = nskb;
403 		recv_Dchannel(dch);
404 	}
405 	if (bch) {
406 		/* expand 16 bit sequence number to 32 bit sequence number */
407 		rx_counter = hc->chan[channel].rx_counter;
408 		if (((s16)(timebase - rx_counter)) >= 0) {
409 			/* time has changed forward */
410 			if (timebase >= (rx_counter & 0xffff))
411 				rx_counter =
412 					(rx_counter & 0xffff0000) | timebase;
413 			else
414 				rx_counter = ((rx_counter & 0xffff0000) + 0x10000)
415 					| timebase;
416 		} else {
417 			/* time has changed backwards */
418 			if (timebase < (rx_counter & 0xffff))
419 				rx_counter =
420 					(rx_counter & 0xffff0000) | timebase;
421 			else
422 				rx_counter = ((rx_counter & 0xffff0000) - 0x10000)
423 					| timebase;
424 		}
425 		hc->chan[channel].rx_counter = rx_counter;
426 
427 #ifdef REORDER_DEBUG
428 		if (hc->chan[channel].disorder_flag) {
429 			swap(hc->chan[channel].disorder_skb, nskb);
430 			swap(hc->chan[channel].disorder_cnt, rx_counter);
431 		}
432 		hc->chan[channel].disorder_flag ^= 1;
433 		if (nskb)
434 #endif
435 			queue_ch_frame(&bch->ch, PH_DATA_IND, rx_counter, nskb);
436 	}
437 }
438 
439 
440 /*
441  * parse frame and extract channel data
442  */
443 static void
444 l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len)
445 {
446 	u32			packet_id;
447 	u8			channel;
448 	u8			remotecodec;
449 	u16			timebase;
450 	int			m, mlen;
451 	int			len_start = len; /* initial frame length */
452 	struct dchannel		*dch = hc->chan[hc->d_idx].dch;
453 
454 	if (debug & DEBUG_L1OIP_MSG)
455 		printk(KERN_DEBUG "%s: received frame, parsing... (%d)\n",
456 		       __func__, len);
457 
458 	/* check length */
459 	if (len < 1 + 1 + 2) {
460 		printk(KERN_WARNING "%s: packet error - length %d below "
461 		       "4 bytes\n", __func__, len);
462 		return;
463 	}
464 
465 	/* check version */
466 	if (((*buf) >> 6) != L1OIP_VERSION) {
467 		printk(KERN_WARNING "%s: packet error - unknown version %d\n",
468 		       __func__, buf[0]>>6);
469 		return;
470 	}
471 
472 	/* check type */
473 	if (((*buf) & 0x20) && !hc->pri) {
474 		printk(KERN_WARNING "%s: packet error - received E1 packet "
475 		       "on S0 interface\n", __func__);
476 		return;
477 	}
478 	if (!((*buf) & 0x20) && hc->pri) {
479 		printk(KERN_WARNING "%s: packet error - received S0 packet "
480 		       "on E1 interface\n", __func__);
481 		return;
482 	}
483 
484 	/* get id flag */
485 	packet_id = (*buf >> 4) & 1;
486 
487 	/* check coding */
488 	remotecodec = (*buf) & 0x0f;
489 	if (remotecodec > 3) {
490 		printk(KERN_WARNING "%s: packet error - remotecodec %d "
491 		       "unsupported\n", __func__, remotecodec);
492 		return;
493 	}
494 	buf++;
495 	len--;
496 
497 	/* check packet_id */
498 	if (packet_id) {
499 		if (!hc->id) {
500 			printk(KERN_WARNING "%s: packet error - packet has id "
501 			       "0x%x, but we have not\n", __func__, packet_id);
502 			return;
503 		}
504 		if (len < 4) {
505 			printk(KERN_WARNING "%s: packet error - packet too "
506 			       "short for ID value\n", __func__);
507 			return;
508 		}
509 		packet_id = (*buf++) << 24;
510 		packet_id += (*buf++) << 16;
511 		packet_id += (*buf++) << 8;
512 		packet_id += (*buf++);
513 		len -= 4;
514 
515 		if (packet_id != hc->id) {
516 			printk(KERN_WARNING "%s: packet error - ID mismatch, "
517 			       "got 0x%x, we 0x%x\n",
518 			       __func__, packet_id, hc->id);
519 			return;
520 		}
521 	} else {
522 		if (hc->id) {
523 			printk(KERN_WARNING "%s: packet error - packet has no "
524 			       "ID, but we have\n", __func__);
525 			return;
526 		}
527 	}
528 
529 multiframe:
530 	if (len < 1) {
531 		printk(KERN_WARNING "%s: packet error - packet too short, "
532 		       "channel expected at position %d.\n",
533 		       __func__, len-len_start + 1);
534 		return;
535 	}
536 
537 	/* get channel and multiframe flag */
538 	channel = *buf & 0x7f;
539 	m = *buf >> 7;
540 	buf++;
541 	len--;
542 
543 	/* check length on multiframe */
544 	if (m) {
545 		if (len < 1) {
546 			printk(KERN_WARNING "%s: packet error - packet too "
547 			       "short, length expected at position %d.\n",
548 			       __func__, len_start - len - 1);
549 			return;
550 		}
551 
552 		mlen = *buf++;
553 		len--;
554 		if (mlen == 0)
555 			mlen = 256;
556 		if (len < mlen + 3) {
557 			printk(KERN_WARNING "%s: packet error - length %d at "
558 			       "position %d exceeds total length %d.\n",
559 			       __func__, mlen, len_start-len - 1, len_start);
560 			return;
561 		}
562 		if (len == mlen + 3) {
563 			printk(KERN_WARNING "%s: packet error - length %d at "
564 			       "position %d will not allow additional "
565 			       "packet.\n",
566 			       __func__, mlen, len_start-len + 1);
567 			return;
568 		}
569 	} else
570 		mlen = len - 2; /* single frame, subtract timebase */
571 
572 	if (len < 2) {
573 		printk(KERN_WARNING "%s: packet error - packet too short, time "
574 		       "base expected at position %d.\n",
575 		       __func__, len-len_start + 1);
576 		return;
577 	}
578 
579 	/* get time base */
580 	timebase = (*buf++) << 8;
581 	timebase |= (*buf++);
582 	len -= 2;
583 
584 	/* if inactive, we send up a PH_ACTIVATE and activate */
585 	if (!test_bit(FLG_ACTIVE, &dch->Flags)) {
586 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
587 			printk(KERN_DEBUG "%s: interface become active due to "
588 			       "received packet\n", __func__);
589 		test_and_set_bit(FLG_ACTIVE, &dch->Flags);
590 		_queue_data(&dch->dev.D, PH_ACTIVATE_IND, MISDN_ID_ANY, 0,
591 			    NULL, GFP_ATOMIC);
592 	}
593 
594 	/* distribute packet */
595 	l1oip_socket_recv(hc, remotecodec, channel, timebase, buf, mlen);
596 	buf += mlen;
597 	len -= mlen;
598 
599 	/* multiframe */
600 	if (m)
601 		goto multiframe;
602 
603 	/* restart timer */
604 	if (time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || !hc->timeout_on) {
605 		hc->timeout_on = 1;
606 		mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ);
607 	} else /* only adjust timer */
608 		hc->timeout_tl.expires = jiffies + L1OIP_TIMEOUT * HZ;
609 
610 	/* if ip or source port changes */
611 	if ((hc->sin_remote.sin_addr.s_addr != sin->sin_addr.s_addr)
612 	    || (hc->sin_remote.sin_port != sin->sin_port)) {
613 		if (debug & DEBUG_L1OIP_SOCKET)
614 			printk(KERN_DEBUG "%s: remote address changes from "
615 			       "0x%08x to 0x%08x (port %d to %d)\n", __func__,
616 			       ntohl(hc->sin_remote.sin_addr.s_addr),
617 			       ntohl(sin->sin_addr.s_addr),
618 			       ntohs(hc->sin_remote.sin_port),
619 			       ntohs(sin->sin_port));
620 		hc->sin_remote.sin_addr.s_addr = sin->sin_addr.s_addr;
621 		hc->sin_remote.sin_port = sin->sin_port;
622 	}
623 }
624 
625 
626 /*
627  * socket stuff
628  */
629 static int
630 l1oip_socket_thread(void *data)
631 {
632 	struct l1oip *hc = (struct l1oip *)data;
633 	int ret = 0;
634 	struct sockaddr_in sin_rx;
635 	struct kvec iov;
636 	struct msghdr msg = {.msg_name = &sin_rx,
637 			     .msg_namelen = sizeof(sin_rx)};
638 	unsigned char *recvbuf;
639 	size_t recvbuf_size = 1500;
640 	int recvlen;
641 	struct socket *socket = NULL;
642 	DECLARE_COMPLETION_ONSTACK(wait);
643 
644 	/* allocate buffer memory */
645 	recvbuf = kmalloc(recvbuf_size, GFP_KERNEL);
646 	if (!recvbuf) {
647 		printk(KERN_ERR "%s: Failed to alloc recvbuf.\n", __func__);
648 		ret = -ENOMEM;
649 		goto fail;
650 	}
651 
652 	iov.iov_base = recvbuf;
653 	iov.iov_len = recvbuf_size;
654 
655 	/* make daemon */
656 	allow_signal(SIGTERM);
657 
658 	/* create socket */
659 	if (sock_create(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &socket)) {
660 		printk(KERN_ERR "%s: Failed to create socket.\n", __func__);
661 		ret = -EIO;
662 		goto fail;
663 	}
664 
665 	/* set incoming address */
666 	hc->sin_local.sin_family = AF_INET;
667 	hc->sin_local.sin_addr.s_addr = INADDR_ANY;
668 	hc->sin_local.sin_port = htons((unsigned short)hc->localport);
669 
670 	/* set outgoing address */
671 	hc->sin_remote.sin_family = AF_INET;
672 	hc->sin_remote.sin_addr.s_addr = htonl(hc->remoteip);
673 	hc->sin_remote.sin_port = htons((unsigned short)hc->remoteport);
674 
675 	/* bind to incoming port */
676 	if (socket->ops->bind(socket, (struct sockaddr *)&hc->sin_local,
677 			      sizeof(hc->sin_local))) {
678 		printk(KERN_ERR "%s: Failed to bind socket to port %d.\n",
679 		       __func__, hc->localport);
680 		ret = -EINVAL;
681 		goto fail;
682 	}
683 
684 	/* check sk */
685 	if (socket->sk == NULL) {
686 		printk(KERN_ERR "%s: socket->sk == NULL\n", __func__);
687 		ret = -EIO;
688 		goto fail;
689 	}
690 
691 	/* build send message */
692 	hc->sendmsg.msg_name = &hc->sin_remote;
693 	hc->sendmsg.msg_namelen = sizeof(hc->sin_remote);
694 	hc->sendmsg.msg_control = NULL;
695 	hc->sendmsg.msg_controllen = 0;
696 
697 	/* give away socket */
698 	spin_lock(&hc->socket_lock);
699 	hc->socket = socket;
700 	spin_unlock(&hc->socket_lock);
701 
702 	/* read loop */
703 	if (debug & DEBUG_L1OIP_SOCKET)
704 		printk(KERN_DEBUG "%s: socket created and open\n",
705 		       __func__);
706 	while (!signal_pending(current)) {
707 		iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, recvbuf_size);
708 		recvlen = sock_recvmsg(socket, &msg, 0);
709 		if (recvlen > 0) {
710 			l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen);
711 		} else {
712 			if (debug & DEBUG_L1OIP_SOCKET)
713 				printk(KERN_WARNING
714 				       "%s: broken pipe on socket\n", __func__);
715 		}
716 	}
717 
718 	/* get socket back, check first if in use, maybe by send function */
719 	spin_lock(&hc->socket_lock);
720 	/* if hc->socket is NULL, it is in use until it is given back */
721 	while (!hc->socket) {
722 		spin_unlock(&hc->socket_lock);
723 		schedule_timeout(HZ / 10);
724 		spin_lock(&hc->socket_lock);
725 	}
726 	hc->socket = NULL;
727 	spin_unlock(&hc->socket_lock);
728 
729 	if (debug & DEBUG_L1OIP_SOCKET)
730 		printk(KERN_DEBUG "%s: socket thread terminating\n",
731 		       __func__);
732 
733 fail:
734 	/* free recvbuf */
735 	kfree(recvbuf);
736 
737 	/* close socket */
738 	if (socket)
739 		sock_release(socket);
740 
741 	/* if we got killed, signal completion */
742 	complete(&hc->socket_complete);
743 	hc->socket_thread = NULL; /* show termination of thread */
744 
745 	if (debug & DEBUG_L1OIP_SOCKET)
746 		printk(KERN_DEBUG "%s: socket thread terminated\n",
747 		       __func__);
748 	return ret;
749 }
750 
751 static void
752 l1oip_socket_close(struct l1oip *hc)
753 {
754 	struct dchannel *dch = hc->chan[hc->d_idx].dch;
755 
756 	/* kill thread */
757 	if (hc->socket_thread) {
758 		if (debug & DEBUG_L1OIP_SOCKET)
759 			printk(KERN_DEBUG "%s: socket thread exists, "
760 			       "killing...\n", __func__);
761 		send_sig(SIGTERM, hc->socket_thread, 0);
762 		wait_for_completion(&hc->socket_complete);
763 	}
764 
765 	/* if active, we send up a PH_DEACTIVATE and deactivate */
766 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
767 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
768 			printk(KERN_DEBUG "%s: interface become deactivated "
769 			       "due to timeout\n", __func__);
770 		test_and_clear_bit(FLG_ACTIVE, &dch->Flags);
771 		_queue_data(&dch->dev.D, PH_DEACTIVATE_IND, MISDN_ID_ANY, 0,
772 			    NULL, GFP_ATOMIC);
773 	}
774 }
775 
776 static int
777 l1oip_socket_open(struct l1oip *hc)
778 {
779 	/* in case of reopen, we need to close first */
780 	l1oip_socket_close(hc);
781 
782 	init_completion(&hc->socket_complete);
783 
784 	/* create receive process */
785 	hc->socket_thread = kthread_run(l1oip_socket_thread, hc, "l1oip_%s",
786 					hc->name);
787 	if (IS_ERR(hc->socket_thread)) {
788 		int err = PTR_ERR(hc->socket_thread);
789 		printk(KERN_ERR "%s: Failed (%d) to create socket process.\n",
790 		       __func__, err);
791 		hc->socket_thread = NULL;
792 		sock_release(hc->socket);
793 		return err;
794 	}
795 	if (debug & DEBUG_L1OIP_SOCKET)
796 		printk(KERN_DEBUG "%s: socket thread created\n", __func__);
797 
798 	return 0;
799 }
800 
801 
802 static void
803 l1oip_send_bh(struct work_struct *work)
804 {
805 	struct l1oip *hc = container_of(work, struct l1oip, workq);
806 
807 	if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
808 		printk(KERN_DEBUG "%s: keepalive timer expired, sending empty "
809 		       "frame on dchannel\n", __func__);
810 
811 	/* send an empty l1oip frame at D-channel */
812 	l1oip_socket_send(hc, 0, hc->d_idx, 0, 0, NULL, 0);
813 }
814 
815 
816 /*
817  * timer stuff
818  */
819 static void
820 l1oip_keepalive(struct timer_list *t)
821 {
822 	struct l1oip *hc = from_timer(hc, t, keep_tl);
823 
824 	schedule_work(&hc->workq);
825 }
826 
827 static void
828 l1oip_timeout(struct timer_list *t)
829 {
830 	struct l1oip			*hc = from_timer(hc, t,
831 								  timeout_tl);
832 	struct dchannel		*dch = hc->chan[hc->d_idx].dch;
833 
834 	if (debug & DEBUG_L1OIP_MSG)
835 		printk(KERN_DEBUG "%s: timeout timer expired, turn layer one "
836 		       "down.\n", __func__);
837 
838 	hc->timeout_on = 0; /* state that timer must be initialized next time */
839 
840 	/* if timeout, we send up a PH_DEACTIVATE and deactivate */
841 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
842 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
843 			printk(KERN_DEBUG "%s: interface become deactivated "
844 			       "due to timeout\n", __func__);
845 		test_and_clear_bit(FLG_ACTIVE, &dch->Flags);
846 		_queue_data(&dch->dev.D, PH_DEACTIVATE_IND, MISDN_ID_ANY, 0,
847 			    NULL, GFP_ATOMIC);
848 	}
849 
850 	/* if we have ondemand set, we remove ip address */
851 	if (hc->ondemand) {
852 		if (debug & DEBUG_L1OIP_MSG)
853 			printk(KERN_DEBUG "%s: on demand causes ip address to "
854 			       "be removed\n", __func__);
855 		hc->sin_remote.sin_addr.s_addr = 0;
856 	}
857 }
858 
859 
860 /*
861  * message handling
862  */
863 static int
864 handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
865 {
866 	struct mISDNdevice	*dev = container_of(ch, struct mISDNdevice, D);
867 	struct dchannel		*dch = container_of(dev, struct dchannel, dev);
868 	struct l1oip			*hc = dch->hw;
869 	struct mISDNhead	*hh = mISDN_HEAD_P(skb);
870 	int			ret = -EINVAL;
871 	int			l, ll;
872 	unsigned char		*p;
873 
874 	switch (hh->prim) {
875 	case PH_DATA_REQ:
876 		if (skb->len < 1) {
877 			printk(KERN_WARNING "%s: skb too small\n",
878 			       __func__);
879 			break;
880 		}
881 		if (skb->len > MAX_DFRAME_LEN_L1 || skb->len > L1OIP_MAX_LEN) {
882 			printk(KERN_WARNING "%s: skb too large\n",
883 			       __func__);
884 			break;
885 		}
886 		/* send frame */
887 		p = skb->data;
888 		l = skb->len;
889 		while (l) {
890 			/*
891 			 * This is technically bounded by L1OIP_MAX_PERFRAME but
892 			 * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
893 			 */
894 			ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
895 			l1oip_socket_send(hc, 0, dch->slot, 0,
896 					  hc->chan[dch->slot].tx_counter++, p, ll);
897 			p += ll;
898 			l -= ll;
899 		}
900 		skb_trim(skb, 0);
901 		queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
902 		return 0;
903 	case PH_ACTIVATE_REQ:
904 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
905 			printk(KERN_DEBUG "%s: PH_ACTIVATE channel %d (1..%d)\n"
906 			       , __func__, dch->slot, hc->b_num + 1);
907 		skb_trim(skb, 0);
908 		if (test_bit(FLG_ACTIVE, &dch->Flags))
909 			queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
910 		else
911 			queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
912 		return 0;
913 	case PH_DEACTIVATE_REQ:
914 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
915 			printk(KERN_DEBUG "%s: PH_DEACTIVATE channel %d "
916 			       "(1..%d)\n", __func__, dch->slot,
917 			       hc->b_num + 1);
918 		skb_trim(skb, 0);
919 		if (test_bit(FLG_ACTIVE, &dch->Flags))
920 			queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
921 		else
922 			queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
923 		return 0;
924 	}
925 	if (!ret)
926 		dev_kfree_skb(skb);
927 	return ret;
928 }
929 
930 static int
931 channel_dctrl(struct dchannel *dch, struct mISDN_ctrl_req *cq)
932 {
933 	int	ret = 0;
934 	struct l1oip	*hc = dch->hw;
935 
936 	switch (cq->op) {
937 	case MISDN_CTRL_GETOP:
938 		cq->op = MISDN_CTRL_SETPEER | MISDN_CTRL_UNSETPEER
939 			| MISDN_CTRL_GETPEER;
940 		break;
941 	case MISDN_CTRL_SETPEER:
942 		hc->remoteip = (u32)cq->p1;
943 		hc->remoteport = cq->p2 & 0xffff;
944 		hc->localport = cq->p2 >> 16;
945 		if (!hc->remoteport)
946 			hc->remoteport = hc->localport;
947 		if (debug & DEBUG_L1OIP_SOCKET)
948 			printk(KERN_DEBUG "%s: got new ip address from user "
949 			       "space.\n", __func__);
950 		l1oip_socket_open(hc);
951 		break;
952 	case MISDN_CTRL_UNSETPEER:
953 		if (debug & DEBUG_L1OIP_SOCKET)
954 			printk(KERN_DEBUG "%s: removing ip address.\n",
955 			       __func__);
956 		hc->remoteip = 0;
957 		l1oip_socket_open(hc);
958 		break;
959 	case MISDN_CTRL_GETPEER:
960 		if (debug & DEBUG_L1OIP_SOCKET)
961 			printk(KERN_DEBUG "%s: getting ip address.\n",
962 			       __func__);
963 		cq->p1 = hc->remoteip;
964 		cq->p2 = hc->remoteport | (hc->localport << 16);
965 		break;
966 	default:
967 		printk(KERN_WARNING "%s: unknown Op %x\n",
968 		       __func__, cq->op);
969 		ret = -EINVAL;
970 		break;
971 	}
972 	return ret;
973 }
974 
975 static int
976 open_dchannel(struct l1oip *hc, struct dchannel *dch, struct channel_req *rq)
977 {
978 	if (debug & DEBUG_HW_OPEN)
979 		printk(KERN_DEBUG "%s: dev(%d) open from %p\n", __func__,
980 		       dch->dev.id, __builtin_return_address(0));
981 	if (rq->protocol == ISDN_P_NONE)
982 		return -EINVAL;
983 	if ((dch->dev.D.protocol != ISDN_P_NONE) &&
984 	    (dch->dev.D.protocol != rq->protocol)) {
985 		if (debug & DEBUG_HW_OPEN)
986 			printk(KERN_WARNING "%s: change protocol %x to %x\n",
987 			       __func__, dch->dev.D.protocol, rq->protocol);
988 	}
989 	if (dch->dev.D.protocol != rq->protocol)
990 		dch->dev.D.protocol = rq->protocol;
991 
992 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
993 		_queue_data(&dch->dev.D, PH_ACTIVATE_IND, MISDN_ID_ANY,
994 			    0, NULL, GFP_KERNEL);
995 	}
996 	rq->ch = &dch->dev.D;
997 	if (!try_module_get(THIS_MODULE))
998 		printk(KERN_WARNING "%s:cannot get module\n", __func__);
999 	return 0;
1000 }
1001 
1002 static int
1003 open_bchannel(struct l1oip *hc, struct dchannel *dch, struct channel_req *rq)
1004 {
1005 	struct bchannel	*bch;
1006 	int		ch;
1007 
1008 	if (!test_channelmap(rq->adr.channel, dch->dev.channelmap))
1009 		return -EINVAL;
1010 	if (rq->protocol == ISDN_P_NONE)
1011 		return -EINVAL;
1012 	ch = rq->adr.channel; /* BRI: 1=B1 2=B2  PRI: 1..15,17.. */
1013 	bch = hc->chan[ch].bch;
1014 	if (!bch) {
1015 		printk(KERN_ERR "%s:internal error ch %d has no bch\n",
1016 		       __func__, ch);
1017 		return -EINVAL;
1018 	}
1019 	if (test_and_set_bit(FLG_OPEN, &bch->Flags))
1020 		return -EBUSY; /* b-channel can be only open once */
1021 	bch->ch.protocol = rq->protocol;
1022 	rq->ch = &bch->ch;
1023 	if (!try_module_get(THIS_MODULE))
1024 		printk(KERN_WARNING "%s:cannot get module\n", __func__);
1025 	return 0;
1026 }
1027 
1028 static int
1029 l1oip_dctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
1030 {
1031 	struct mISDNdevice	*dev = container_of(ch, struct mISDNdevice, D);
1032 	struct dchannel		*dch = container_of(dev, struct dchannel, dev);
1033 	struct l1oip			*hc = dch->hw;
1034 	struct channel_req	*rq;
1035 	int			err = 0;
1036 
1037 	if (dch->debug & DEBUG_HW)
1038 		printk(KERN_DEBUG "%s: cmd:%x %p\n",
1039 		       __func__, cmd, arg);
1040 	switch (cmd) {
1041 	case OPEN_CHANNEL:
1042 		rq = arg;
1043 		switch (rq->protocol) {
1044 		case ISDN_P_TE_S0:
1045 		case ISDN_P_NT_S0:
1046 			if (hc->pri) {
1047 				err = -EINVAL;
1048 				break;
1049 			}
1050 			err = open_dchannel(hc, dch, rq);
1051 			break;
1052 		case ISDN_P_TE_E1:
1053 		case ISDN_P_NT_E1:
1054 			if (!hc->pri) {
1055 				err = -EINVAL;
1056 				break;
1057 			}
1058 			err = open_dchannel(hc, dch, rq);
1059 			break;
1060 		default:
1061 			err = open_bchannel(hc, dch, rq);
1062 		}
1063 		break;
1064 	case CLOSE_CHANNEL:
1065 		if (debug & DEBUG_HW_OPEN)
1066 			printk(KERN_DEBUG "%s: dev(%d) close from %p\n",
1067 			       __func__, dch->dev.id,
1068 			       __builtin_return_address(0));
1069 		module_put(THIS_MODULE);
1070 		break;
1071 	case CONTROL_CHANNEL:
1072 		err = channel_dctrl(dch, arg);
1073 		break;
1074 	default:
1075 		if (dch->debug & DEBUG_HW)
1076 			printk(KERN_DEBUG "%s: unknown command %x\n",
1077 			       __func__, cmd);
1078 		err = -EINVAL;
1079 	}
1080 	return err;
1081 }
1082 
1083 static int
1084 handle_bmsg(struct mISDNchannel *ch, struct sk_buff *skb)
1085 {
1086 	struct bchannel		*bch = container_of(ch, struct bchannel, ch);
1087 	struct l1oip			*hc = bch->hw;
1088 	int			ret = -EINVAL;
1089 	struct mISDNhead	*hh = mISDN_HEAD_P(skb);
1090 	int			l, ll;
1091 	unsigned char		*p;
1092 
1093 	switch (hh->prim) {
1094 	case PH_DATA_REQ:
1095 		if (skb->len <= 0) {
1096 			printk(KERN_WARNING "%s: skb too small\n",
1097 			       __func__);
1098 			break;
1099 		}
1100 		if (skb->len > MAX_DFRAME_LEN_L1 || skb->len > L1OIP_MAX_LEN) {
1101 			printk(KERN_WARNING "%s: skb too large\n",
1102 			       __func__);
1103 			break;
1104 		}
1105 		/* check for AIS / ulaw-silence */
1106 		l = skb->len;
1107 		if (!memchr_inv(skb->data, 0xff, l)) {
1108 			if (debug & DEBUG_L1OIP_MSG)
1109 				printk(KERN_DEBUG "%s: got AIS, not sending, "
1110 				       "but counting\n", __func__);
1111 			hc->chan[bch->slot].tx_counter += l;
1112 			skb_trim(skb, 0);
1113 			queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1114 			return 0;
1115 		}
1116 		/* check for silence */
1117 		l = skb->len;
1118 		if (!memchr_inv(skb->data, 0x2a, l)) {
1119 			if (debug & DEBUG_L1OIP_MSG)
1120 				printk(KERN_DEBUG "%s: got silence, not sending"
1121 				       ", but counting\n", __func__);
1122 			hc->chan[bch->slot].tx_counter += l;
1123 			skb_trim(skb, 0);
1124 			queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1125 			return 0;
1126 		}
1127 
1128 		/* send frame */
1129 		p = skb->data;
1130 		l = skb->len;
1131 		while (l) {
1132 			/*
1133 			 * This is technically bounded by L1OIP_MAX_PERFRAME but
1134 			 * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
1135 			 */
1136 			ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
1137 			l1oip_socket_send(hc, hc->codec, bch->slot, 0,
1138 					  hc->chan[bch->slot].tx_counter, p, ll);
1139 			hc->chan[bch->slot].tx_counter += ll;
1140 			p += ll;
1141 			l -= ll;
1142 		}
1143 		skb_trim(skb, 0);
1144 		queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1145 		return 0;
1146 	case PH_ACTIVATE_REQ:
1147 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
1148 			printk(KERN_DEBUG "%s: PH_ACTIVATE channel %d (1..%d)\n"
1149 			       , __func__, bch->slot, hc->b_num + 1);
1150 		hc->chan[bch->slot].codecstate = 0;
1151 		test_and_set_bit(FLG_ACTIVE, &bch->Flags);
1152 		skb_trim(skb, 0);
1153 		queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
1154 		return 0;
1155 	case PH_DEACTIVATE_REQ:
1156 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
1157 			printk(KERN_DEBUG "%s: PH_DEACTIVATE channel %d "
1158 			       "(1..%d)\n", __func__, bch->slot,
1159 			       hc->b_num + 1);
1160 		test_and_clear_bit(FLG_ACTIVE, &bch->Flags);
1161 		skb_trim(skb, 0);
1162 		queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
1163 		return 0;
1164 	}
1165 	if (!ret)
1166 		dev_kfree_skb(skb);
1167 	return ret;
1168 }
1169 
1170 static int
1171 channel_bctrl(struct bchannel *bch, struct mISDN_ctrl_req *cq)
1172 {
1173 	int			ret = 0;
1174 	struct dsp_features	*features =
1175 		(struct dsp_features *)(*((u_long *)&cq->p1));
1176 
1177 	switch (cq->op) {
1178 	case MISDN_CTRL_GETOP:
1179 		cq->op = MISDN_CTRL_HW_FEATURES_OP;
1180 		break;
1181 	case MISDN_CTRL_HW_FEATURES: /* fill features structure */
1182 		if (debug & DEBUG_L1OIP_MSG)
1183 			printk(KERN_DEBUG "%s: HW_FEATURE request\n",
1184 			       __func__);
1185 		/* create confirm */
1186 		features->unclocked = 1;
1187 		features->unordered = 1;
1188 		break;
1189 	default:
1190 		printk(KERN_WARNING "%s: unknown Op %x\n",
1191 		       __func__, cq->op);
1192 		ret = -EINVAL;
1193 		break;
1194 	}
1195 	return ret;
1196 }
1197 
1198 static int
1199 l1oip_bctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
1200 {
1201 	struct bchannel	*bch = container_of(ch, struct bchannel, ch);
1202 	int		err = -EINVAL;
1203 
1204 	if (bch->debug & DEBUG_HW)
1205 		printk(KERN_DEBUG "%s: cmd:%x %p\n",
1206 		       __func__, cmd, arg);
1207 	switch (cmd) {
1208 	case CLOSE_CHANNEL:
1209 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
1210 		test_and_clear_bit(FLG_ACTIVE, &bch->Flags);
1211 		ch->protocol = ISDN_P_NONE;
1212 		ch->peer = NULL;
1213 		module_put(THIS_MODULE);
1214 		err = 0;
1215 		break;
1216 	case CONTROL_CHANNEL:
1217 		err = channel_bctrl(bch, arg);
1218 		break;
1219 	default:
1220 		printk(KERN_WARNING "%s: unknown prim(%x)\n",
1221 		       __func__, cmd);
1222 	}
1223 	return err;
1224 }
1225 
1226 
1227 /*
1228  * cleanup module and stack
1229  */
1230 static void
1231 release_card(struct l1oip *hc)
1232 {
1233 	int	ch;
1234 
1235 	if (timer_pending(&hc->keep_tl))
1236 		del_timer(&hc->keep_tl);
1237 
1238 	if (timer_pending(&hc->timeout_tl))
1239 		del_timer(&hc->timeout_tl);
1240 
1241 	cancel_work_sync(&hc->workq);
1242 
1243 	if (hc->socket_thread)
1244 		l1oip_socket_close(hc);
1245 
1246 	if (hc->registered && hc->chan[hc->d_idx].dch)
1247 		mISDN_unregister_device(&hc->chan[hc->d_idx].dch->dev);
1248 	for (ch = 0; ch < 128; ch++) {
1249 		if (hc->chan[ch].dch) {
1250 			mISDN_freedchannel(hc->chan[ch].dch);
1251 			kfree(hc->chan[ch].dch);
1252 		}
1253 		if (hc->chan[ch].bch) {
1254 			mISDN_freebchannel(hc->chan[ch].bch);
1255 			kfree(hc->chan[ch].bch);
1256 #ifdef REORDER_DEBUG
1257 			dev_kfree_skb(hc->chan[ch].disorder_skb);
1258 #endif
1259 		}
1260 	}
1261 
1262 	spin_lock(&l1oip_lock);
1263 	list_del(&hc->list);
1264 	spin_unlock(&l1oip_lock);
1265 
1266 	kfree(hc);
1267 }
1268 
1269 static void
1270 l1oip_cleanup(void)
1271 {
1272 	struct l1oip *hc, *next;
1273 
1274 	list_for_each_entry_safe(hc, next, &l1oip_ilist, list)
1275 		release_card(hc);
1276 
1277 	l1oip_4bit_free();
1278 }
1279 
1280 
1281 /*
1282  * module and stack init
1283  */
1284 static int
1285 init_card(struct l1oip *hc, int pri, int bundle)
1286 {
1287 	struct dchannel	*dch;
1288 	struct bchannel	*bch;
1289 	int		ret;
1290 	int		i, ch;
1291 
1292 	spin_lock_init(&hc->socket_lock);
1293 	hc->idx = l1oip_cnt;
1294 	hc->pri = pri;
1295 	hc->d_idx = pri ? 16 : 3;
1296 	hc->b_num = pri ? 30 : 2;
1297 	hc->bundle = bundle;
1298 	if (hc->pri)
1299 		sprintf(hc->name, "l1oip-e1.%d", l1oip_cnt + 1);
1300 	else
1301 		sprintf(hc->name, "l1oip-s0.%d", l1oip_cnt + 1);
1302 
1303 	switch (codec[l1oip_cnt]) {
1304 	case 0: /* as is */
1305 	case 1: /* alaw */
1306 	case 2: /* ulaw */
1307 	case 3: /* 4bit */
1308 		break;
1309 	default:
1310 		printk(KERN_ERR "Codec(%d) not supported.\n",
1311 		       codec[l1oip_cnt]);
1312 		return -EINVAL;
1313 	}
1314 	hc->codec = codec[l1oip_cnt];
1315 	if (debug & DEBUG_L1OIP_INIT)
1316 		printk(KERN_DEBUG "%s: using codec %d\n",
1317 		       __func__, hc->codec);
1318 
1319 	if (id[l1oip_cnt] == 0) {
1320 		printk(KERN_WARNING "Warning: No 'id' value given or "
1321 		       "0, this is highly unsecure. Please use 32 "
1322 		       "bit random number 0x...\n");
1323 	}
1324 	hc->id = id[l1oip_cnt];
1325 	if (debug & DEBUG_L1OIP_INIT)
1326 		printk(KERN_DEBUG "%s: using id 0x%x\n", __func__, hc->id);
1327 
1328 	hc->ondemand = ondemand[l1oip_cnt];
1329 	if (hc->ondemand && !hc->id) {
1330 		printk(KERN_ERR "%s: ondemand option only allowed in "
1331 		       "conjunction with non 0 ID\n", __func__);
1332 		return -EINVAL;
1333 	}
1334 
1335 	if (limit[l1oip_cnt])
1336 		hc->b_num = limit[l1oip_cnt];
1337 	if (!pri && hc->b_num > 2) {
1338 		printk(KERN_ERR "Maximum limit for BRI interface is 2 "
1339 		       "channels.\n");
1340 		return -EINVAL;
1341 	}
1342 	if (pri && hc->b_num > 126) {
1343 		printk(KERN_ERR "Maximum limit for PRI interface is 126 "
1344 		       "channels.\n");
1345 		return -EINVAL;
1346 	}
1347 	if (pri && hc->b_num > 30) {
1348 		printk(KERN_WARNING "Maximum limit for BRI interface is 30 "
1349 		       "channels.\n");
1350 		printk(KERN_WARNING "Your selection of %d channels must be "
1351 		       "supported by application.\n", hc->limit);
1352 	}
1353 
1354 	hc->remoteip = ip[l1oip_cnt << 2] << 24
1355 		| ip[(l1oip_cnt << 2) + 1] << 16
1356 		| ip[(l1oip_cnt << 2) + 2] << 8
1357 		| ip[(l1oip_cnt << 2) + 3];
1358 	hc->localport = port[l1oip_cnt]?:(L1OIP_DEFAULTPORT + l1oip_cnt);
1359 	if (remoteport[l1oip_cnt])
1360 		hc->remoteport = remoteport[l1oip_cnt];
1361 	else
1362 		hc->remoteport = hc->localport;
1363 	if (debug & DEBUG_L1OIP_INIT)
1364 		printk(KERN_DEBUG "%s: using local port %d remote ip "
1365 		       "%d.%d.%d.%d port %d ondemand %d\n", __func__,
1366 		       hc->localport, hc->remoteip >> 24,
1367 		       (hc->remoteip >> 16) & 0xff,
1368 		       (hc->remoteip >> 8) & 0xff, hc->remoteip & 0xff,
1369 		       hc->remoteport, hc->ondemand);
1370 
1371 	dch = kzalloc(sizeof(struct dchannel), GFP_KERNEL);
1372 	if (!dch)
1373 		return -ENOMEM;
1374 	dch->debug = debug;
1375 	mISDN_initdchannel(dch, MAX_DFRAME_LEN_L1, NULL);
1376 	dch->hw = hc;
1377 	if (pri)
1378 		dch->dev.Dprotocols = (1 << ISDN_P_TE_E1) | (1 << ISDN_P_NT_E1);
1379 	else
1380 		dch->dev.Dprotocols = (1 << ISDN_P_TE_S0) | (1 << ISDN_P_NT_S0);
1381 	dch->dev.Bprotocols = (1 << (ISDN_P_B_RAW & ISDN_P_B_MASK)) |
1382 		(1 << (ISDN_P_B_HDLC & ISDN_P_B_MASK));
1383 	dch->dev.D.send = handle_dmsg;
1384 	dch->dev.D.ctrl = l1oip_dctrl;
1385 	dch->dev.nrbchan = hc->b_num;
1386 	dch->slot = hc->d_idx;
1387 	hc->chan[hc->d_idx].dch = dch;
1388 	i = 1;
1389 	for (ch = 0; ch < dch->dev.nrbchan; ch++) {
1390 		if (ch == 15)
1391 			i++;
1392 		bch = kzalloc(sizeof(struct bchannel), GFP_KERNEL);
1393 		if (!bch) {
1394 			printk(KERN_ERR "%s: no memory for bchannel\n",
1395 			       __func__);
1396 			return -ENOMEM;
1397 		}
1398 		bch->nr = i + ch;
1399 		bch->slot = i + ch;
1400 		bch->debug = debug;
1401 		mISDN_initbchannel(bch, MAX_DATA_MEM, 0);
1402 		bch->hw = hc;
1403 		bch->ch.send = handle_bmsg;
1404 		bch->ch.ctrl = l1oip_bctrl;
1405 		bch->ch.nr = i + ch;
1406 		list_add(&bch->ch.list, &dch->dev.bchannels);
1407 		hc->chan[i + ch].bch = bch;
1408 		set_channelmap(bch->nr, dch->dev.channelmap);
1409 	}
1410 	/* TODO: create a parent device for this driver */
1411 	ret = mISDN_register_device(&dch->dev, NULL, hc->name);
1412 	if (ret)
1413 		return ret;
1414 	hc->registered = 1;
1415 
1416 	if (debug & DEBUG_L1OIP_INIT)
1417 		printk(KERN_DEBUG "%s: Setting up network card(%d)\n",
1418 		       __func__, l1oip_cnt + 1);
1419 	ret = l1oip_socket_open(hc);
1420 	if (ret)
1421 		return ret;
1422 
1423 	timer_setup(&hc->keep_tl, l1oip_keepalive, 0);
1424 	hc->keep_tl.expires = jiffies + 2 * HZ; /* two seconds first time */
1425 	add_timer(&hc->keep_tl);
1426 
1427 	timer_setup(&hc->timeout_tl, l1oip_timeout, 0);
1428 	hc->timeout_on = 0; /* state that we have timer off */
1429 
1430 	return 0;
1431 }
1432 
1433 static int __init
1434 l1oip_init(void)
1435 {
1436 	int		pri, bundle;
1437 	struct l1oip		*hc;
1438 	int		ret;
1439 
1440 	printk(KERN_INFO "mISDN: Layer-1-over-IP driver Rev. %s\n",
1441 	       l1oip_revision);
1442 
1443 	INIT_LIST_HEAD(&l1oip_ilist);
1444 	spin_lock_init(&l1oip_lock);
1445 
1446 	if (l1oip_4bit_alloc(ulaw))
1447 		return -ENOMEM;
1448 
1449 	l1oip_cnt = 0;
1450 	while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
1451 		switch (type[l1oip_cnt] & 0xff) {
1452 		case 1:
1453 			pri = 0;
1454 			bundle = 0;
1455 			break;
1456 		case 2:
1457 			pri = 1;
1458 			bundle = 0;
1459 			break;
1460 		case 3:
1461 			pri = 0;
1462 			bundle = 1;
1463 			break;
1464 		case 4:
1465 			pri = 1;
1466 			bundle = 1;
1467 			break;
1468 		default:
1469 			printk(KERN_ERR "Card type(%d) not supported.\n",
1470 			       type[l1oip_cnt] & 0xff);
1471 			l1oip_cleanup();
1472 			return -EINVAL;
1473 		}
1474 
1475 		if (debug & DEBUG_L1OIP_INIT)
1476 			printk(KERN_DEBUG "%s: interface %d is %s with %s.\n",
1477 			       __func__, l1oip_cnt, pri ? "PRI" : "BRI",
1478 			       bundle ? "bundled IP packet for all B-channels" :
1479 			       "separate IP packets for every B-channel");
1480 
1481 		hc = kzalloc(sizeof(struct l1oip), GFP_ATOMIC);
1482 		if (!hc) {
1483 			printk(KERN_ERR "No kmem for L1-over-IP driver.\n");
1484 			l1oip_cleanup();
1485 			return -ENOMEM;
1486 		}
1487 		INIT_WORK(&hc->workq, (void *)l1oip_send_bh);
1488 
1489 		spin_lock(&l1oip_lock);
1490 		list_add_tail(&hc->list, &l1oip_ilist);
1491 		spin_unlock(&l1oip_lock);
1492 
1493 		ret = init_card(hc, pri, bundle);
1494 		if (ret) {
1495 			l1oip_cleanup();
1496 			return ret;
1497 		}
1498 
1499 		l1oip_cnt++;
1500 	}
1501 	printk(KERN_INFO "%d virtual devices registered\n", l1oip_cnt);
1502 	return 0;
1503 }
1504 
1505 module_init(l1oip_init);
1506 module_exit(l1oip_cleanup);
1507