xref: /linux/drivers/isdn/mISDN/l1oip_core.c (revision 55d0969c451159cff86949b38c39171cab962069)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 
4  * l1oip.c  low level driver for tunneling layer 1 over IP
5  *
6  * NOTE: It is not compatible with TDMoIP nor "ISDN over IP".
7  *
8  * Author	Andreas Eversberg (jolly@eversberg.eu)
9  */
10 
11 /* module parameters:
12  * type:
13  Value 1	= BRI
14  Value 2	= PRI
15  Value 3 = BRI (multi channel frame, not supported yet)
16  Value 4 = PRI (multi channel frame, not supported yet)
17  A multi channel frame reduces overhead to a single frame for all
18  b-channels, but increases delay.
19  (NOTE: Multi channel frames are not implemented yet.)
20 
21  * codec:
22  Value 0 = transparent (default)
23  Value 1 = transfer ALAW
24  Value 2 = transfer ULAW
25  Value 3 = transfer generic 4 bit compression.
26 
27  * ulaw:
28  0 = we use a-Law (default)
29  1 = we use u-Law
30 
31  * limit:
32  limitation of B-channels to control bandwidth (1...126)
33  BRI: 1 or 2
34  PRI: 1-30, 31-126 (126, because dchannel ist not counted here)
35  Also limited ressources are used for stack, resulting in less channels.
36  It is possible to have more channels than 30 in PRI mode, this must
37  be supported by the application.
38 
39  * ip:
40  byte representation of remote ip address (127.0.0.1 -> 127,0,0,1)
41  If not given or four 0, no remote address is set.
42  For multiple interfaces, concat ip addresses. (127,0,0,1,127,0,0,1)
43 
44  * port:
45  port number (local interface)
46  If not given or 0, port 931 is used for fist instance, 932 for next...
47  For multiple interfaces, different ports must be given.
48 
49  * remoteport:
50  port number (remote interface)
51  If not given or 0, remote port equals local port
52  For multiple interfaces on equal sites, different ports must be given.
53 
54  * ondemand:
55  0 = fixed (always transmit packets, even when remote side timed out)
56  1 = on demand (only transmit packets, when remote side is detected)
57  the default is 0
58  NOTE: ID must also be set for on demand.
59 
60  * id:
61  optional value to identify frames. This value must be equal on both
62  peers and should be random. If omitted or 0, no ID is transmitted.
63 
64  * debug:
65  NOTE: only one debug value must be given for all cards
66  enable debugging (see l1oip.h for debug options)
67 
68 
69  Special mISDN controls:
70 
71  op = MISDN_CTRL_SETPEER*
72  p1 = bytes 0-3 : remote IP address in network order (left element first)
73  p2 = bytes 1-2 : remote port in network order (high byte first)
74  optional:
75  p2 = bytes 3-4 : local port in network order (high byte first)
76 
77  op = MISDN_CTRL_UNSETPEER*
78 
79  * Use l1oipctrl for comfortable setting or removing ip address.
80  (Layer 1 Over IP CTRL)
81 
82 
83  L1oIP-Protocol
84  --------------
85 
86  Frame Header:
87 
88  7 6 5 4 3 2 1 0
89  +---------------+
90  |Ver|T|I|Coding |
91  +---------------+
92  |  ID byte 3 *  |
93  +---------------+
94  |  ID byte 2 *  |
95  +---------------+
96  |  ID byte 1 *  |
97  +---------------+
98  |  ID byte 0 *  |
99  +---------------+
100  |M|   Channel   |
101  +---------------+
102  |    Length *   |
103  +---------------+
104  | Time Base MSB |
105  +---------------+
106  | Time Base LSB |
107  +---------------+
108  | Data....	|
109 
110  ...
111 
112  |               |
113  +---------------+
114  |M|   Channel   |
115  +---------------+
116  |    Length *   |
117  +---------------+
118  | Time Base MSB |
119  +---------------+
120  | Time Base LSB |
121  +---------------+
122  | Data....	|
123 
124  ...
125 
126 
127  * Only included in some cases.
128 
129  - Ver = Version
130  If version is missmatch, the frame must be ignored.
131 
132  - T = Type of interface
133  Must be 0 for S0 or 1 for E1.
134 
135  - I = Id present
136  If bit is set, four ID bytes are included in frame.
137 
138  - ID = Connection ID
139  Additional ID to prevent Denial of Service attacs. Also it prevents hijacking
140  connections with dynamic IP. The ID should be random and must not be 0.
141 
142  - Coding = Type of codec
143  Must be 0 for no transcoding. Also for D-channel and other HDLC frames.
144  1 and 2 are reserved for explicitly use of a-LAW or u-LAW codec.
145  3 is used for generic table compressor.
146 
147  - M = More channels to come. If this flag is 1, the following byte contains
148  the length of the channel data. After the data block, the next channel will
149  be defined. The flag for the last channel block (or if only one channel is
150  transmitted), must be 0 and no length is given.
151 
152  - Channel = Channel number
153  0 reserved
154  1-3 channel data for S0 (3 is D-channel)
155  1-31 channel data for E1 (16 is D-channel)
156  32-127 channel data for extended E1 (16 is D-channel)
157 
158  - The length is used if the M-flag is 1. It is used to find the next channel
159  inside frame.
160  NOTE: A value of 0 equals 256 bytes of data.
161  -> For larger data blocks, a single frame must be used.
162  -> For larger streams, a single frame or multiple blocks with same channel ID
163  must be used.
164 
165  - Time Base = Timestamp of first sample in frame
166  The "Time Base" is used to rearange packets and to detect packet loss.
167  The 16 bits are sent in network order (MSB first) and count 1/8000 th of a
168  second. This causes a wrap around each 8,192 seconds. There is no requirement
169  for the initial "Time Base", but 0 should be used for the first packet.
170  In case of HDLC data, this timestamp counts the packet or byte number.
171 
172 
173  Two Timers:
174 
175  After initialisation, a timer of 15 seconds is started. Whenever a packet is
176  transmitted, the timer is reset to 15 seconds again. If the timer expires, an
177  empty packet is transmitted. This keep the connection alive.
178 
179  When a valid packet is received, a timer 65 seconds is started. The interface
180  become ACTIVE. If the timer expires, the interface becomes INACTIVE.
181 
182 
183  Dynamic IP handling:
184 
185  To allow dynamic IP, the ID must be non 0. In this case, any packet with the
186  correct port number and ID will be accepted. If the remote side changes its IP
187  the new IP is used for all transmitted packets until it changes again.
188 
189 
190  On Demand:
191 
192  If the ondemand parameter is given, the remote IP is set to 0 on timeout.
193  This will stop keepalive traffic to remote. If the remote is online again,
194  traffic will continue to the remote address. This is useful for road warriors.
195  This feature only works with ID set, otherwhise it is highly unsecure.
196 
197 
198  Socket and Thread
199  -----------------
200 
201  The complete socket opening and closing is done by a thread.
202  When the thread opened a socket, the hc->socket descriptor is set. Whenever a
203  packet shall be sent to the socket, the hc->socket must be checked whether not
204  NULL. To prevent change in socket descriptor, the hc->socket_lock must be used.
205  To change the socket, a recall of l1oip_socket_open() will safely kill the
206  socket process and create a new one.
207 
208 */
209 
210 #define L1OIP_VERSION	0	/* 0...3 */
211 
212 #include <linux/module.h>
213 #include <linux/delay.h>
214 #include <linux/mISDNif.h>
215 #include <linux/mISDNhw.h>
216 #include <linux/mISDNdsp.h>
217 #include <linux/init.h>
218 #include <linux/in.h>
219 #include <linux/inet.h>
220 #include <linux/workqueue.h>
221 #include <linux/kthread.h>
222 #include <linux/slab.h>
223 #include <linux/sched/signal.h>
224 
225 #include <net/sock.h>
226 #include "core.h"
227 #include "l1oip.h"
228 
229 static const char *l1oip_revision = "2.00";
230 
231 static int l1oip_cnt;
232 static DEFINE_SPINLOCK(l1oip_lock);
233 static LIST_HEAD(l1oip_ilist);
234 
235 #define MAX_CARDS	16
236 static u_int type[MAX_CARDS];
237 static u_int codec[MAX_CARDS];
238 static u_int ip[MAX_CARDS * 4];
239 static u_int port[MAX_CARDS];
240 static u_int remoteport[MAX_CARDS];
241 static u_int ondemand[MAX_CARDS];
242 static u_int limit[MAX_CARDS];
243 static u_int id[MAX_CARDS];
244 static int debug;
245 static int ulaw;
246 
247 MODULE_AUTHOR("Andreas Eversberg");
248 MODULE_DESCRIPTION("mISDN driver for tunneling layer 1 over IP");
249 MODULE_LICENSE("GPL");
250 module_param_array(type, uint, NULL, S_IRUGO | S_IWUSR);
251 module_param_array(codec, uint, NULL, S_IRUGO | S_IWUSR);
252 module_param_array(ip, uint, NULL, S_IRUGO | S_IWUSR);
253 module_param_array(port, uint, NULL, S_IRUGO | S_IWUSR);
254 module_param_array(remoteport, uint, NULL, S_IRUGO | S_IWUSR);
255 module_param_array(ondemand, uint, NULL, S_IRUGO | S_IWUSR);
256 module_param_array(limit, uint, NULL, S_IRUGO | S_IWUSR);
257 module_param_array(id, uint, NULL, S_IRUGO | S_IWUSR);
258 module_param(ulaw, uint, S_IRUGO | S_IWUSR);
259 module_param(debug, uint, S_IRUGO | S_IWUSR);
260 
261 /*
262  * send a frame via socket, if open and restart timer
263  */
264 static int
265 l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask,
266 		  u16 timebase, u8 *buf, int len)
267 {
268 	u8 *p;
269 	u8 frame[MAX_DFRAME_LEN_L1 + 32];
270 	struct socket *socket = NULL;
271 
272 	if (debug & DEBUG_L1OIP_MSG)
273 		printk(KERN_DEBUG "%s: sending data to socket (len = %d)\n",
274 		       __func__, len);
275 
276 	p = frame;
277 
278 	/* restart timer */
279 	if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ) && !hc->shutdown)
280 		mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ);
281 	else
282 		hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ;
283 
284 	if (debug & DEBUG_L1OIP_MSG)
285 		printk(KERN_DEBUG "%s: resetting timer\n", __func__);
286 
287 	/* drop if we have no remote ip or port */
288 	if (!hc->sin_remote.sin_addr.s_addr || !hc->sin_remote.sin_port) {
289 		if (debug & DEBUG_L1OIP_MSG)
290 			printk(KERN_DEBUG "%s: dropping frame, because remote "
291 			       "IP is not set.\n", __func__);
292 		return len;
293 	}
294 
295 	/* assemble frame */
296 	*p++ = (L1OIP_VERSION << 6) /* version and coding */
297 		| (hc->pri ? 0x20 : 0x00) /* type */
298 		| (hc->id ? 0x10 : 0x00) /* id */
299 		| localcodec;
300 	if (hc->id) {
301 		*p++ = hc->id >> 24; /* id */
302 		*p++ = hc->id >> 16;
303 		*p++ = hc->id >> 8;
304 		*p++ = hc->id;
305 	}
306 	*p++ =  0x00 + channel; /* m-flag, channel */
307 	*p++ = timebase >> 8; /* time base */
308 	*p++ = timebase;
309 
310 	if (buf && len) { /* add data to frame */
311 		if (localcodec == 1 && ulaw)
312 			l1oip_ulaw_to_alaw(buf, len, p);
313 		else if (localcodec == 2 && !ulaw)
314 			l1oip_alaw_to_ulaw(buf, len, p);
315 		else if (localcodec == 3)
316 			len = l1oip_law_to_4bit(buf, len, p,
317 						&hc->chan[channel].codecstate);
318 		else
319 			memcpy(p, buf, len);
320 	}
321 	len += p - frame;
322 
323 	/* check for socket in safe condition */
324 	spin_lock(&hc->socket_lock);
325 	if (!hc->socket) {
326 		spin_unlock(&hc->socket_lock);
327 		return 0;
328 	}
329 	/* seize socket */
330 	socket = hc->socket;
331 	hc->socket = NULL;
332 	spin_unlock(&hc->socket_lock);
333 	/* send packet */
334 	if (debug & DEBUG_L1OIP_MSG)
335 		printk(KERN_DEBUG "%s: sending packet to socket (len "
336 		       "= %d)\n", __func__, len);
337 	hc->sendiov.iov_base = frame;
338 	hc->sendiov.iov_len  = len;
339 	len = kernel_sendmsg(socket, &hc->sendmsg, &hc->sendiov, 1, len);
340 	/* give socket back */
341 	hc->socket = socket; /* no locking required */
342 
343 	return len;
344 }
345 
346 
347 /*
348  * receive channel data from socket
349  */
350 static void
351 l1oip_socket_recv(struct l1oip *hc, u8 remotecodec, u8 channel, u16 timebase,
352 		  u8 *buf, int len)
353 {
354 	struct sk_buff *nskb;
355 	struct bchannel *bch;
356 	struct dchannel *dch;
357 	u8 *p;
358 	u32 rx_counter;
359 
360 	if (len == 0) {
361 		if (debug & DEBUG_L1OIP_MSG)
362 			printk(KERN_DEBUG "%s: received empty keepalive data, "
363 			       "ignoring\n", __func__);
364 		return;
365 	}
366 
367 	if (debug & DEBUG_L1OIP_MSG)
368 		printk(KERN_DEBUG "%s: received data, sending to mISDN (%d)\n",
369 		       __func__, len);
370 
371 	if (channel < 1 || channel > 127) {
372 		printk(KERN_WARNING "%s: packet error - channel %d out of "
373 		       "range\n", __func__, channel);
374 		return;
375 	}
376 	dch = hc->chan[channel].dch;
377 	bch = hc->chan[channel].bch;
378 	if (!dch && !bch) {
379 		printk(KERN_WARNING "%s: packet error - channel %d not in "
380 		       "stack\n", __func__, channel);
381 		return;
382 	}
383 
384 	/* prepare message */
385 	nskb = mI_alloc_skb((remotecodec == 3) ? (len << 1) : len, GFP_ATOMIC);
386 	if (!nskb) {
387 		printk(KERN_ERR "%s: No mem for skb.\n", __func__);
388 		return;
389 	}
390 	p = skb_put(nskb, (remotecodec == 3) ? (len << 1) : len);
391 
392 	if (remotecodec == 1 && ulaw)
393 		l1oip_alaw_to_ulaw(buf, len, p);
394 	else if (remotecodec == 2 && !ulaw)
395 		l1oip_ulaw_to_alaw(buf, len, p);
396 	else if (remotecodec == 3)
397 		len = l1oip_4bit_to_law(buf, len, p);
398 	else
399 		memcpy(p, buf, len);
400 
401 	/* send message up */
402 	if (dch && len >= 2) {
403 		dch->rx_skb = nskb;
404 		recv_Dchannel(dch);
405 	}
406 	if (bch) {
407 		/* expand 16 bit sequence number to 32 bit sequence number */
408 		rx_counter = hc->chan[channel].rx_counter;
409 		if (((s16)(timebase - rx_counter)) >= 0) {
410 			/* time has changed forward */
411 			if (timebase >= (rx_counter & 0xffff))
412 				rx_counter =
413 					(rx_counter & 0xffff0000) | timebase;
414 			else
415 				rx_counter = ((rx_counter & 0xffff0000) + 0x10000)
416 					| timebase;
417 		} else {
418 			/* time has changed backwards */
419 			if (timebase < (rx_counter & 0xffff))
420 				rx_counter =
421 					(rx_counter & 0xffff0000) | timebase;
422 			else
423 				rx_counter = ((rx_counter & 0xffff0000) - 0x10000)
424 					| timebase;
425 		}
426 		hc->chan[channel].rx_counter = rx_counter;
427 
428 #ifdef REORDER_DEBUG
429 		if (hc->chan[channel].disorder_flag) {
430 			swap(hc->chan[channel].disorder_skb, nskb);
431 			swap(hc->chan[channel].disorder_cnt, rx_counter);
432 		}
433 		hc->chan[channel].disorder_flag ^= 1;
434 		if (nskb)
435 #endif
436 			queue_ch_frame(&bch->ch, PH_DATA_IND, rx_counter, nskb);
437 	}
438 }
439 
440 
441 /*
442  * parse frame and extract channel data
443  */
444 static void
445 l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len)
446 {
447 	u32			packet_id;
448 	u8			channel;
449 	u8			remotecodec;
450 	u16			timebase;
451 	int			m, mlen;
452 	int			len_start = len; /* initial frame length */
453 	struct dchannel		*dch = hc->chan[hc->d_idx].dch;
454 
455 	if (debug & DEBUG_L1OIP_MSG)
456 		printk(KERN_DEBUG "%s: received frame, parsing... (%d)\n",
457 		       __func__, len);
458 
459 	/* check length */
460 	if (len < 1 + 1 + 2) {
461 		printk(KERN_WARNING "%s: packet error - length %d below "
462 		       "4 bytes\n", __func__, len);
463 		return;
464 	}
465 
466 	/* check version */
467 	if (((*buf) >> 6) != L1OIP_VERSION) {
468 		printk(KERN_WARNING "%s: packet error - unknown version %d\n",
469 		       __func__, buf[0]>>6);
470 		return;
471 	}
472 
473 	/* check type */
474 	if (((*buf) & 0x20) && !hc->pri) {
475 		printk(KERN_WARNING "%s: packet error - received E1 packet "
476 		       "on S0 interface\n", __func__);
477 		return;
478 	}
479 	if (!((*buf) & 0x20) && hc->pri) {
480 		printk(KERN_WARNING "%s: packet error - received S0 packet "
481 		       "on E1 interface\n", __func__);
482 		return;
483 	}
484 
485 	/* get id flag */
486 	packet_id = (*buf >> 4) & 1;
487 
488 	/* check coding */
489 	remotecodec = (*buf) & 0x0f;
490 	if (remotecodec > 3) {
491 		printk(KERN_WARNING "%s: packet error - remotecodec %d "
492 		       "unsupported\n", __func__, remotecodec);
493 		return;
494 	}
495 	buf++;
496 	len--;
497 
498 	/* check packet_id */
499 	if (packet_id) {
500 		if (!hc->id) {
501 			printk(KERN_WARNING "%s: packet error - packet has id "
502 			       "0x%x, but we have not\n", __func__, packet_id);
503 			return;
504 		}
505 		if (len < 4) {
506 			printk(KERN_WARNING "%s: packet error - packet too "
507 			       "short for ID value\n", __func__);
508 			return;
509 		}
510 		packet_id = (*buf++) << 24;
511 		packet_id += (*buf++) << 16;
512 		packet_id += (*buf++) << 8;
513 		packet_id += (*buf++);
514 		len -= 4;
515 
516 		if (packet_id != hc->id) {
517 			printk(KERN_WARNING "%s: packet error - ID mismatch, "
518 			       "got 0x%x, we 0x%x\n",
519 			       __func__, packet_id, hc->id);
520 			return;
521 		}
522 	} else {
523 		if (hc->id) {
524 			printk(KERN_WARNING "%s: packet error - packet has no "
525 			       "ID, but we have\n", __func__);
526 			return;
527 		}
528 	}
529 
530 multiframe:
531 	if (len < 1) {
532 		printk(KERN_WARNING "%s: packet error - packet too short, "
533 		       "channel expected at position %d.\n",
534 		       __func__, len-len_start + 1);
535 		return;
536 	}
537 
538 	/* get channel and multiframe flag */
539 	channel = *buf & 0x7f;
540 	m = *buf >> 7;
541 	buf++;
542 	len--;
543 
544 	/* check length on multiframe */
545 	if (m) {
546 		if (len < 1) {
547 			printk(KERN_WARNING "%s: packet error - packet too "
548 			       "short, length expected at position %d.\n",
549 			       __func__, len_start - len - 1);
550 			return;
551 		}
552 
553 		mlen = *buf++;
554 		len--;
555 		if (mlen == 0)
556 			mlen = 256;
557 		if (len < mlen + 3) {
558 			printk(KERN_WARNING "%s: packet error - length %d at "
559 			       "position %d exceeds total length %d.\n",
560 			       __func__, mlen, len_start-len - 1, len_start);
561 			return;
562 		}
563 		if (len == mlen + 3) {
564 			printk(KERN_WARNING "%s: packet error - length %d at "
565 			       "position %d will not allow additional "
566 			       "packet.\n",
567 			       __func__, mlen, len_start-len + 1);
568 			return;
569 		}
570 	} else
571 		mlen = len - 2; /* single frame, subtract timebase */
572 
573 	if (len < 2) {
574 		printk(KERN_WARNING "%s: packet error - packet too short, time "
575 		       "base expected at position %d.\n",
576 		       __func__, len-len_start + 1);
577 		return;
578 	}
579 
580 	/* get time base */
581 	timebase = (*buf++) << 8;
582 	timebase |= (*buf++);
583 	len -= 2;
584 
585 	/* if inactive, we send up a PH_ACTIVATE and activate */
586 	if (!test_bit(FLG_ACTIVE, &dch->Flags)) {
587 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
588 			printk(KERN_DEBUG "%s: interface become active due to "
589 			       "received packet\n", __func__);
590 		test_and_set_bit(FLG_ACTIVE, &dch->Flags);
591 		_queue_data(&dch->dev.D, PH_ACTIVATE_IND, MISDN_ID_ANY, 0,
592 			    NULL, GFP_ATOMIC);
593 	}
594 
595 	/* distribute packet */
596 	l1oip_socket_recv(hc, remotecodec, channel, timebase, buf, mlen);
597 	buf += mlen;
598 	len -= mlen;
599 
600 	/* multiframe */
601 	if (m)
602 		goto multiframe;
603 
604 	/* restart timer */
605 	if ((time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) ||
606 	     !hc->timeout_on) &&
607 	    !hc->shutdown) {
608 		hc->timeout_on = 1;
609 		mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ);
610 	} else /* only adjust timer */
611 		hc->timeout_tl.expires = jiffies + L1OIP_TIMEOUT * HZ;
612 
613 	/* if ip or source port changes */
614 	if ((hc->sin_remote.sin_addr.s_addr != sin->sin_addr.s_addr)
615 	    || (hc->sin_remote.sin_port != sin->sin_port)) {
616 		if (debug & DEBUG_L1OIP_SOCKET)
617 			printk(KERN_DEBUG "%s: remote address changes from "
618 			       "0x%08x to 0x%08x (port %d to %d)\n", __func__,
619 			       ntohl(hc->sin_remote.sin_addr.s_addr),
620 			       ntohl(sin->sin_addr.s_addr),
621 			       ntohs(hc->sin_remote.sin_port),
622 			       ntohs(sin->sin_port));
623 		hc->sin_remote.sin_addr.s_addr = sin->sin_addr.s_addr;
624 		hc->sin_remote.sin_port = sin->sin_port;
625 	}
626 }
627 
628 
629 /*
630  * socket stuff
631  */
632 static int
633 l1oip_socket_thread(void *data)
634 {
635 	struct l1oip *hc = (struct l1oip *)data;
636 	int ret = 0;
637 	struct sockaddr_in sin_rx;
638 	struct kvec iov;
639 	struct msghdr msg = {.msg_name = &sin_rx,
640 			     .msg_namelen = sizeof(sin_rx)};
641 	unsigned char *recvbuf;
642 	size_t recvbuf_size = 1500;
643 	int recvlen;
644 	struct socket *socket = NULL;
645 	DECLARE_COMPLETION_ONSTACK(wait);
646 
647 	/* allocate buffer memory */
648 	recvbuf = kmalloc(recvbuf_size, GFP_KERNEL);
649 	if (!recvbuf) {
650 		printk(KERN_ERR "%s: Failed to alloc recvbuf.\n", __func__);
651 		ret = -ENOMEM;
652 		goto fail;
653 	}
654 
655 	iov.iov_base = recvbuf;
656 	iov.iov_len = recvbuf_size;
657 
658 	/* make daemon */
659 	allow_signal(SIGTERM);
660 
661 	/* create socket */
662 	if (sock_create(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &socket)) {
663 		printk(KERN_ERR "%s: Failed to create socket.\n", __func__);
664 		ret = -EIO;
665 		goto fail;
666 	}
667 
668 	/* set incoming address */
669 	hc->sin_local.sin_family = AF_INET;
670 	hc->sin_local.sin_addr.s_addr = INADDR_ANY;
671 	hc->sin_local.sin_port = htons((unsigned short)hc->localport);
672 
673 	/* set outgoing address */
674 	hc->sin_remote.sin_family = AF_INET;
675 	hc->sin_remote.sin_addr.s_addr = htonl(hc->remoteip);
676 	hc->sin_remote.sin_port = htons((unsigned short)hc->remoteport);
677 
678 	/* bind to incoming port */
679 	if (socket->ops->bind(socket, (struct sockaddr *)&hc->sin_local,
680 			      sizeof(hc->sin_local))) {
681 		printk(KERN_ERR "%s: Failed to bind socket to port %d.\n",
682 		       __func__, hc->localport);
683 		ret = -EINVAL;
684 		goto fail;
685 	}
686 
687 	/* check sk */
688 	if (socket->sk == NULL) {
689 		printk(KERN_ERR "%s: socket->sk == NULL\n", __func__);
690 		ret = -EIO;
691 		goto fail;
692 	}
693 
694 	/* build send message */
695 	hc->sendmsg.msg_name = &hc->sin_remote;
696 	hc->sendmsg.msg_namelen = sizeof(hc->sin_remote);
697 	hc->sendmsg.msg_control = NULL;
698 	hc->sendmsg.msg_controllen = 0;
699 
700 	/* give away socket */
701 	spin_lock(&hc->socket_lock);
702 	hc->socket = socket;
703 	spin_unlock(&hc->socket_lock);
704 
705 	/* read loop */
706 	if (debug & DEBUG_L1OIP_SOCKET)
707 		printk(KERN_DEBUG "%s: socket created and open\n",
708 		       __func__);
709 	while (!signal_pending(current)) {
710 		iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, recvbuf_size);
711 		recvlen = sock_recvmsg(socket, &msg, 0);
712 		if (recvlen > 0) {
713 			l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen);
714 		} else {
715 			if (debug & DEBUG_L1OIP_SOCKET)
716 				printk(KERN_WARNING
717 				       "%s: broken pipe on socket\n", __func__);
718 		}
719 	}
720 
721 	/* get socket back, check first if in use, maybe by send function */
722 	spin_lock(&hc->socket_lock);
723 	/* if hc->socket is NULL, it is in use until it is given back */
724 	while (!hc->socket) {
725 		spin_unlock(&hc->socket_lock);
726 		schedule_timeout(HZ / 10);
727 		spin_lock(&hc->socket_lock);
728 	}
729 	hc->socket = NULL;
730 	spin_unlock(&hc->socket_lock);
731 
732 	if (debug & DEBUG_L1OIP_SOCKET)
733 		printk(KERN_DEBUG "%s: socket thread terminating\n",
734 		       __func__);
735 
736 fail:
737 	/* free recvbuf */
738 	kfree(recvbuf);
739 
740 	/* close socket */
741 	if (socket)
742 		sock_release(socket);
743 
744 	/* if we got killed, signal completion */
745 	complete(&hc->socket_complete);
746 	hc->socket_thread = NULL; /* show termination of thread */
747 
748 	if (debug & DEBUG_L1OIP_SOCKET)
749 		printk(KERN_DEBUG "%s: socket thread terminated\n",
750 		       __func__);
751 	return ret;
752 }
753 
754 static void
755 l1oip_socket_close(struct l1oip *hc)
756 {
757 	struct dchannel *dch = hc->chan[hc->d_idx].dch;
758 
759 	/* kill thread */
760 	if (hc->socket_thread) {
761 		if (debug & DEBUG_L1OIP_SOCKET)
762 			printk(KERN_DEBUG "%s: socket thread exists, "
763 			       "killing...\n", __func__);
764 		send_sig(SIGTERM, hc->socket_thread, 0);
765 		wait_for_completion(&hc->socket_complete);
766 	}
767 
768 	/* if active, we send up a PH_DEACTIVATE and deactivate */
769 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
770 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
771 			printk(KERN_DEBUG "%s: interface become deactivated "
772 			       "due to timeout\n", __func__);
773 		test_and_clear_bit(FLG_ACTIVE, &dch->Flags);
774 		_queue_data(&dch->dev.D, PH_DEACTIVATE_IND, MISDN_ID_ANY, 0,
775 			    NULL, GFP_ATOMIC);
776 	}
777 }
778 
779 static int
780 l1oip_socket_open(struct l1oip *hc)
781 {
782 	/* in case of reopen, we need to close first */
783 	l1oip_socket_close(hc);
784 
785 	init_completion(&hc->socket_complete);
786 
787 	/* create receive process */
788 	hc->socket_thread = kthread_run(l1oip_socket_thread, hc, "l1oip_%s",
789 					hc->name);
790 	if (IS_ERR(hc->socket_thread)) {
791 		int err = PTR_ERR(hc->socket_thread);
792 		printk(KERN_ERR "%s: Failed (%d) to create socket process.\n",
793 		       __func__, err);
794 		hc->socket_thread = NULL;
795 		sock_release(hc->socket);
796 		return err;
797 	}
798 	if (debug & DEBUG_L1OIP_SOCKET)
799 		printk(KERN_DEBUG "%s: socket thread created\n", __func__);
800 
801 	return 0;
802 }
803 
804 
805 static void
806 l1oip_send_bh(struct work_struct *work)
807 {
808 	struct l1oip *hc = container_of(work, struct l1oip, workq);
809 
810 	if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
811 		printk(KERN_DEBUG "%s: keepalive timer expired, sending empty "
812 		       "frame on dchannel\n", __func__);
813 
814 	/* send an empty l1oip frame at D-channel */
815 	l1oip_socket_send(hc, 0, hc->d_idx, 0, 0, NULL, 0);
816 }
817 
818 
819 /*
820  * timer stuff
821  */
822 static void
823 l1oip_keepalive(struct timer_list *t)
824 {
825 	struct l1oip *hc = from_timer(hc, t, keep_tl);
826 
827 	schedule_work(&hc->workq);
828 }
829 
830 static void
831 l1oip_timeout(struct timer_list *t)
832 {
833 	struct l1oip			*hc = from_timer(hc, t,
834 								  timeout_tl);
835 	struct dchannel		*dch = hc->chan[hc->d_idx].dch;
836 
837 	if (debug & DEBUG_L1OIP_MSG)
838 		printk(KERN_DEBUG "%s: timeout timer expired, turn layer one "
839 		       "down.\n", __func__);
840 
841 	hc->timeout_on = 0; /* state that timer must be initialized next time */
842 
843 	/* if timeout, we send up a PH_DEACTIVATE and deactivate */
844 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
845 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
846 			printk(KERN_DEBUG "%s: interface become deactivated "
847 			       "due to timeout\n", __func__);
848 		test_and_clear_bit(FLG_ACTIVE, &dch->Flags);
849 		_queue_data(&dch->dev.D, PH_DEACTIVATE_IND, MISDN_ID_ANY, 0,
850 			    NULL, GFP_ATOMIC);
851 	}
852 
853 	/* if we have ondemand set, we remove ip address */
854 	if (hc->ondemand) {
855 		if (debug & DEBUG_L1OIP_MSG)
856 			printk(KERN_DEBUG "%s: on demand causes ip address to "
857 			       "be removed\n", __func__);
858 		hc->sin_remote.sin_addr.s_addr = 0;
859 	}
860 }
861 
862 
863 /*
864  * message handling
865  */
866 static int
867 handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
868 {
869 	struct mISDNdevice	*dev = container_of(ch, struct mISDNdevice, D);
870 	struct dchannel		*dch = container_of(dev, struct dchannel, dev);
871 	struct l1oip			*hc = dch->hw;
872 	struct mISDNhead	*hh = mISDN_HEAD_P(skb);
873 	int			ret = -EINVAL;
874 	int			l, ll;
875 	unsigned char		*p;
876 
877 	switch (hh->prim) {
878 	case PH_DATA_REQ:
879 		if (skb->len < 1) {
880 			printk(KERN_WARNING "%s: skb too small\n",
881 			       __func__);
882 			break;
883 		}
884 		if (skb->len > MAX_DFRAME_LEN_L1 || skb->len > L1OIP_MAX_LEN) {
885 			printk(KERN_WARNING "%s: skb too large\n",
886 			       __func__);
887 			break;
888 		}
889 		/* send frame */
890 		p = skb->data;
891 		l = skb->len;
892 		while (l) {
893 			/*
894 			 * This is technically bounded by L1OIP_MAX_PERFRAME but
895 			 * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
896 			 */
897 			ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
898 			l1oip_socket_send(hc, 0, dch->slot, 0,
899 					  hc->chan[dch->slot].tx_counter++, p, ll);
900 			p += ll;
901 			l -= ll;
902 		}
903 		skb_trim(skb, 0);
904 		queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
905 		return 0;
906 	case PH_ACTIVATE_REQ:
907 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
908 			printk(KERN_DEBUG "%s: PH_ACTIVATE channel %d (1..%d)\n"
909 			       , __func__, dch->slot, hc->b_num + 1);
910 		skb_trim(skb, 0);
911 		if (test_bit(FLG_ACTIVE, &dch->Flags))
912 			queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
913 		else
914 			queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
915 		return 0;
916 	case PH_DEACTIVATE_REQ:
917 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
918 			printk(KERN_DEBUG "%s: PH_DEACTIVATE channel %d "
919 			       "(1..%d)\n", __func__, dch->slot,
920 			       hc->b_num + 1);
921 		skb_trim(skb, 0);
922 		if (test_bit(FLG_ACTIVE, &dch->Flags))
923 			queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
924 		else
925 			queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
926 		return 0;
927 	}
928 	if (!ret)
929 		dev_kfree_skb(skb);
930 	return ret;
931 }
932 
933 static int
934 channel_dctrl(struct dchannel *dch, struct mISDN_ctrl_req *cq)
935 {
936 	int	ret = 0;
937 	struct l1oip	*hc = dch->hw;
938 
939 	switch (cq->op) {
940 	case MISDN_CTRL_GETOP:
941 		cq->op = MISDN_CTRL_SETPEER | MISDN_CTRL_UNSETPEER
942 			| MISDN_CTRL_GETPEER;
943 		break;
944 	case MISDN_CTRL_SETPEER:
945 		hc->remoteip = (u32)cq->p1;
946 		hc->remoteport = cq->p2 & 0xffff;
947 		hc->localport = cq->p2 >> 16;
948 		if (!hc->remoteport)
949 			hc->remoteport = hc->localport;
950 		if (debug & DEBUG_L1OIP_SOCKET)
951 			printk(KERN_DEBUG "%s: got new ip address from user "
952 			       "space.\n", __func__);
953 		l1oip_socket_open(hc);
954 		break;
955 	case MISDN_CTRL_UNSETPEER:
956 		if (debug & DEBUG_L1OIP_SOCKET)
957 			printk(KERN_DEBUG "%s: removing ip address.\n",
958 			       __func__);
959 		hc->remoteip = 0;
960 		l1oip_socket_open(hc);
961 		break;
962 	case MISDN_CTRL_GETPEER:
963 		if (debug & DEBUG_L1OIP_SOCKET)
964 			printk(KERN_DEBUG "%s: getting ip address.\n",
965 			       __func__);
966 		cq->p1 = hc->remoteip;
967 		cq->p2 = hc->remoteport | (hc->localport << 16);
968 		break;
969 	default:
970 		printk(KERN_WARNING "%s: unknown Op %x\n",
971 		       __func__, cq->op);
972 		ret = -EINVAL;
973 		break;
974 	}
975 	return ret;
976 }
977 
978 static int
979 open_dchannel(struct l1oip *hc, struct dchannel *dch, struct channel_req *rq)
980 {
981 	if (debug & DEBUG_HW_OPEN)
982 		printk(KERN_DEBUG "%s: dev(%d) open from %p\n", __func__,
983 		       dch->dev.id, __builtin_return_address(0));
984 	if (rq->protocol == ISDN_P_NONE)
985 		return -EINVAL;
986 	if ((dch->dev.D.protocol != ISDN_P_NONE) &&
987 	    (dch->dev.D.protocol != rq->protocol)) {
988 		if (debug & DEBUG_HW_OPEN)
989 			printk(KERN_WARNING "%s: change protocol %x to %x\n",
990 			       __func__, dch->dev.D.protocol, rq->protocol);
991 	}
992 	if (dch->dev.D.protocol != rq->protocol)
993 		dch->dev.D.protocol = rq->protocol;
994 
995 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
996 		_queue_data(&dch->dev.D, PH_ACTIVATE_IND, MISDN_ID_ANY,
997 			    0, NULL, GFP_KERNEL);
998 	}
999 	rq->ch = &dch->dev.D;
1000 	if (!try_module_get(THIS_MODULE))
1001 		printk(KERN_WARNING "%s:cannot get module\n", __func__);
1002 	return 0;
1003 }
1004 
1005 static int
1006 open_bchannel(struct l1oip *hc, struct dchannel *dch, struct channel_req *rq)
1007 {
1008 	struct bchannel	*bch;
1009 	int		ch;
1010 
1011 	if (!test_channelmap(rq->adr.channel, dch->dev.channelmap))
1012 		return -EINVAL;
1013 	if (rq->protocol == ISDN_P_NONE)
1014 		return -EINVAL;
1015 	ch = rq->adr.channel; /* BRI: 1=B1 2=B2  PRI: 1..15,17.. */
1016 	bch = hc->chan[ch].bch;
1017 	if (!bch) {
1018 		printk(KERN_ERR "%s:internal error ch %d has no bch\n",
1019 		       __func__, ch);
1020 		return -EINVAL;
1021 	}
1022 	if (test_and_set_bit(FLG_OPEN, &bch->Flags))
1023 		return -EBUSY; /* b-channel can be only open once */
1024 	bch->ch.protocol = rq->protocol;
1025 	rq->ch = &bch->ch;
1026 	if (!try_module_get(THIS_MODULE))
1027 		printk(KERN_WARNING "%s:cannot get module\n", __func__);
1028 	return 0;
1029 }
1030 
1031 static int
1032 l1oip_dctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
1033 {
1034 	struct mISDNdevice	*dev = container_of(ch, struct mISDNdevice, D);
1035 	struct dchannel		*dch = container_of(dev, struct dchannel, dev);
1036 	struct l1oip			*hc = dch->hw;
1037 	struct channel_req	*rq;
1038 	int			err = 0;
1039 
1040 	if (dch->debug & DEBUG_HW)
1041 		printk(KERN_DEBUG "%s: cmd:%x %p\n",
1042 		       __func__, cmd, arg);
1043 	switch (cmd) {
1044 	case OPEN_CHANNEL:
1045 		rq = arg;
1046 		switch (rq->protocol) {
1047 		case ISDN_P_TE_S0:
1048 		case ISDN_P_NT_S0:
1049 			if (hc->pri) {
1050 				err = -EINVAL;
1051 				break;
1052 			}
1053 			err = open_dchannel(hc, dch, rq);
1054 			break;
1055 		case ISDN_P_TE_E1:
1056 		case ISDN_P_NT_E1:
1057 			if (!hc->pri) {
1058 				err = -EINVAL;
1059 				break;
1060 			}
1061 			err = open_dchannel(hc, dch, rq);
1062 			break;
1063 		default:
1064 			err = open_bchannel(hc, dch, rq);
1065 		}
1066 		break;
1067 	case CLOSE_CHANNEL:
1068 		if (debug & DEBUG_HW_OPEN)
1069 			printk(KERN_DEBUG "%s: dev(%d) close from %p\n",
1070 			       __func__, dch->dev.id,
1071 			       __builtin_return_address(0));
1072 		module_put(THIS_MODULE);
1073 		break;
1074 	case CONTROL_CHANNEL:
1075 		err = channel_dctrl(dch, arg);
1076 		break;
1077 	default:
1078 		if (dch->debug & DEBUG_HW)
1079 			printk(KERN_DEBUG "%s: unknown command %x\n",
1080 			       __func__, cmd);
1081 		err = -EINVAL;
1082 	}
1083 	return err;
1084 }
1085 
1086 static int
1087 handle_bmsg(struct mISDNchannel *ch, struct sk_buff *skb)
1088 {
1089 	struct bchannel		*bch = container_of(ch, struct bchannel, ch);
1090 	struct l1oip			*hc = bch->hw;
1091 	int			ret = -EINVAL;
1092 	struct mISDNhead	*hh = mISDN_HEAD_P(skb);
1093 	int			l, ll;
1094 	unsigned char		*p;
1095 
1096 	switch (hh->prim) {
1097 	case PH_DATA_REQ:
1098 		if (skb->len <= 0) {
1099 			printk(KERN_WARNING "%s: skb too small\n",
1100 			       __func__);
1101 			break;
1102 		}
1103 		if (skb->len > MAX_DFRAME_LEN_L1 || skb->len > L1OIP_MAX_LEN) {
1104 			printk(KERN_WARNING "%s: skb too large\n",
1105 			       __func__);
1106 			break;
1107 		}
1108 		/* check for AIS / ulaw-silence */
1109 		l = skb->len;
1110 		if (!memchr_inv(skb->data, 0xff, l)) {
1111 			if (debug & DEBUG_L1OIP_MSG)
1112 				printk(KERN_DEBUG "%s: got AIS, not sending, "
1113 				       "but counting\n", __func__);
1114 			hc->chan[bch->slot].tx_counter += l;
1115 			skb_trim(skb, 0);
1116 			queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1117 			return 0;
1118 		}
1119 		/* check for silence */
1120 		l = skb->len;
1121 		if (!memchr_inv(skb->data, 0x2a, l)) {
1122 			if (debug & DEBUG_L1OIP_MSG)
1123 				printk(KERN_DEBUG "%s: got silence, not sending"
1124 				       ", but counting\n", __func__);
1125 			hc->chan[bch->slot].tx_counter += l;
1126 			skb_trim(skb, 0);
1127 			queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1128 			return 0;
1129 		}
1130 
1131 		/* send frame */
1132 		p = skb->data;
1133 		l = skb->len;
1134 		while (l) {
1135 			/*
1136 			 * This is technically bounded by L1OIP_MAX_PERFRAME but
1137 			 * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
1138 			 */
1139 			ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
1140 			l1oip_socket_send(hc, hc->codec, bch->slot, 0,
1141 					  hc->chan[bch->slot].tx_counter, p, ll);
1142 			hc->chan[bch->slot].tx_counter += ll;
1143 			p += ll;
1144 			l -= ll;
1145 		}
1146 		skb_trim(skb, 0);
1147 		queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1148 		return 0;
1149 	case PH_ACTIVATE_REQ:
1150 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
1151 			printk(KERN_DEBUG "%s: PH_ACTIVATE channel %d (1..%d)\n"
1152 			       , __func__, bch->slot, hc->b_num + 1);
1153 		hc->chan[bch->slot].codecstate = 0;
1154 		test_and_set_bit(FLG_ACTIVE, &bch->Flags);
1155 		skb_trim(skb, 0);
1156 		queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
1157 		return 0;
1158 	case PH_DEACTIVATE_REQ:
1159 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
1160 			printk(KERN_DEBUG "%s: PH_DEACTIVATE channel %d "
1161 			       "(1..%d)\n", __func__, bch->slot,
1162 			       hc->b_num + 1);
1163 		test_and_clear_bit(FLG_ACTIVE, &bch->Flags);
1164 		skb_trim(skb, 0);
1165 		queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
1166 		return 0;
1167 	}
1168 	if (!ret)
1169 		dev_kfree_skb(skb);
1170 	return ret;
1171 }
1172 
1173 static int
1174 channel_bctrl(struct bchannel *bch, struct mISDN_ctrl_req *cq)
1175 {
1176 	int			ret = 0;
1177 	struct dsp_features	*features =
1178 		(struct dsp_features *)(*((u_long *)&cq->p1));
1179 
1180 	switch (cq->op) {
1181 	case MISDN_CTRL_GETOP:
1182 		cq->op = MISDN_CTRL_HW_FEATURES_OP;
1183 		break;
1184 	case MISDN_CTRL_HW_FEATURES: /* fill features structure */
1185 		if (debug & DEBUG_L1OIP_MSG)
1186 			printk(KERN_DEBUG "%s: HW_FEATURE request\n",
1187 			       __func__);
1188 		/* create confirm */
1189 		features->unclocked = 1;
1190 		features->unordered = 1;
1191 		break;
1192 	default:
1193 		printk(KERN_WARNING "%s: unknown Op %x\n",
1194 		       __func__, cq->op);
1195 		ret = -EINVAL;
1196 		break;
1197 	}
1198 	return ret;
1199 }
1200 
1201 static int
1202 l1oip_bctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
1203 {
1204 	struct bchannel	*bch = container_of(ch, struct bchannel, ch);
1205 	int		err = -EINVAL;
1206 
1207 	if (bch->debug & DEBUG_HW)
1208 		printk(KERN_DEBUG "%s: cmd:%x %p\n",
1209 		       __func__, cmd, arg);
1210 	switch (cmd) {
1211 	case CLOSE_CHANNEL:
1212 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
1213 		test_and_clear_bit(FLG_ACTIVE, &bch->Flags);
1214 		ch->protocol = ISDN_P_NONE;
1215 		ch->peer = NULL;
1216 		module_put(THIS_MODULE);
1217 		err = 0;
1218 		break;
1219 	case CONTROL_CHANNEL:
1220 		err = channel_bctrl(bch, arg);
1221 		break;
1222 	default:
1223 		printk(KERN_WARNING "%s: unknown prim(%x)\n",
1224 		       __func__, cmd);
1225 	}
1226 	return err;
1227 }
1228 
1229 
1230 /*
1231  * cleanup module and stack
1232  */
1233 static void
1234 release_card(struct l1oip *hc)
1235 {
1236 	int	ch;
1237 
1238 	hc->shutdown = true;
1239 
1240 	timer_shutdown_sync(&hc->keep_tl);
1241 	timer_shutdown_sync(&hc->timeout_tl);
1242 
1243 	cancel_work_sync(&hc->workq);
1244 
1245 	if (hc->socket_thread)
1246 		l1oip_socket_close(hc);
1247 
1248 	if (hc->registered && hc->chan[hc->d_idx].dch)
1249 		mISDN_unregister_device(&hc->chan[hc->d_idx].dch->dev);
1250 	for (ch = 0; ch < 128; ch++) {
1251 		if (hc->chan[ch].dch) {
1252 			mISDN_freedchannel(hc->chan[ch].dch);
1253 			kfree(hc->chan[ch].dch);
1254 		}
1255 		if (hc->chan[ch].bch) {
1256 			mISDN_freebchannel(hc->chan[ch].bch);
1257 			kfree(hc->chan[ch].bch);
1258 #ifdef REORDER_DEBUG
1259 			dev_kfree_skb(hc->chan[ch].disorder_skb);
1260 #endif
1261 		}
1262 	}
1263 
1264 	spin_lock(&l1oip_lock);
1265 	list_del(&hc->list);
1266 	spin_unlock(&l1oip_lock);
1267 
1268 	kfree(hc);
1269 }
1270 
1271 static void
1272 l1oip_cleanup(void)
1273 {
1274 	struct l1oip *hc, *next;
1275 
1276 	list_for_each_entry_safe(hc, next, &l1oip_ilist, list)
1277 		release_card(hc);
1278 
1279 	l1oip_4bit_free();
1280 }
1281 
1282 
1283 /*
1284  * module and stack init
1285  */
1286 static int
1287 init_card(struct l1oip *hc, int pri, int bundle)
1288 {
1289 	struct dchannel	*dch;
1290 	struct bchannel	*bch;
1291 	int		ret;
1292 	int		i, ch;
1293 
1294 	spin_lock_init(&hc->socket_lock);
1295 	hc->idx = l1oip_cnt;
1296 	hc->pri = pri;
1297 	hc->d_idx = pri ? 16 : 3;
1298 	hc->b_num = pri ? 30 : 2;
1299 	hc->bundle = bundle;
1300 	if (hc->pri)
1301 		sprintf(hc->name, "l1oip-e1.%d", l1oip_cnt + 1);
1302 	else
1303 		sprintf(hc->name, "l1oip-s0.%d", l1oip_cnt + 1);
1304 
1305 	switch (codec[l1oip_cnt]) {
1306 	case 0: /* as is */
1307 	case 1: /* alaw */
1308 	case 2: /* ulaw */
1309 	case 3: /* 4bit */
1310 		break;
1311 	default:
1312 		printk(KERN_ERR "Codec(%d) not supported.\n",
1313 		       codec[l1oip_cnt]);
1314 		return -EINVAL;
1315 	}
1316 	hc->codec = codec[l1oip_cnt];
1317 	if (debug & DEBUG_L1OIP_INIT)
1318 		printk(KERN_DEBUG "%s: using codec %d\n",
1319 		       __func__, hc->codec);
1320 
1321 	if (id[l1oip_cnt] == 0) {
1322 		printk(KERN_WARNING "Warning: No 'id' value given or "
1323 		       "0, this is highly unsecure. Please use 32 "
1324 		       "bit random number 0x...\n");
1325 	}
1326 	hc->id = id[l1oip_cnt];
1327 	if (debug & DEBUG_L1OIP_INIT)
1328 		printk(KERN_DEBUG "%s: using id 0x%x\n", __func__, hc->id);
1329 
1330 	hc->ondemand = ondemand[l1oip_cnt];
1331 	if (hc->ondemand && !hc->id) {
1332 		printk(KERN_ERR "%s: ondemand option only allowed in "
1333 		       "conjunction with non 0 ID\n", __func__);
1334 		return -EINVAL;
1335 	}
1336 
1337 	if (limit[l1oip_cnt])
1338 		hc->b_num = limit[l1oip_cnt];
1339 	if (!pri && hc->b_num > 2) {
1340 		printk(KERN_ERR "Maximum limit for BRI interface is 2 "
1341 		       "channels.\n");
1342 		return -EINVAL;
1343 	}
1344 	if (pri && hc->b_num > 126) {
1345 		printk(KERN_ERR "Maximum limit for PRI interface is 126 "
1346 		       "channels.\n");
1347 		return -EINVAL;
1348 	}
1349 	if (pri && hc->b_num > 30) {
1350 		printk(KERN_WARNING "Maximum limit for BRI interface is 30 "
1351 		       "channels.\n");
1352 		printk(KERN_WARNING "Your selection of %d channels must be "
1353 		       "supported by application.\n", hc->limit);
1354 	}
1355 
1356 	hc->remoteip = ip[l1oip_cnt << 2] << 24
1357 		| ip[(l1oip_cnt << 2) + 1] << 16
1358 		| ip[(l1oip_cnt << 2) + 2] << 8
1359 		| ip[(l1oip_cnt << 2) + 3];
1360 	hc->localport = port[l1oip_cnt]?:(L1OIP_DEFAULTPORT + l1oip_cnt);
1361 	if (remoteport[l1oip_cnt])
1362 		hc->remoteport = remoteport[l1oip_cnt];
1363 	else
1364 		hc->remoteport = hc->localport;
1365 	if (debug & DEBUG_L1OIP_INIT)
1366 		printk(KERN_DEBUG "%s: using local port %d remote ip "
1367 		       "%d.%d.%d.%d port %d ondemand %d\n", __func__,
1368 		       hc->localport, hc->remoteip >> 24,
1369 		       (hc->remoteip >> 16) & 0xff,
1370 		       (hc->remoteip >> 8) & 0xff, hc->remoteip & 0xff,
1371 		       hc->remoteport, hc->ondemand);
1372 
1373 	dch = kzalloc(sizeof(struct dchannel), GFP_KERNEL);
1374 	if (!dch)
1375 		return -ENOMEM;
1376 	dch->debug = debug;
1377 	mISDN_initdchannel(dch, MAX_DFRAME_LEN_L1, NULL);
1378 	dch->hw = hc;
1379 	if (pri)
1380 		dch->dev.Dprotocols = (1 << ISDN_P_TE_E1) | (1 << ISDN_P_NT_E1);
1381 	else
1382 		dch->dev.Dprotocols = (1 << ISDN_P_TE_S0) | (1 << ISDN_P_NT_S0);
1383 	dch->dev.Bprotocols = (1 << (ISDN_P_B_RAW & ISDN_P_B_MASK)) |
1384 		(1 << (ISDN_P_B_HDLC & ISDN_P_B_MASK));
1385 	dch->dev.D.send = handle_dmsg;
1386 	dch->dev.D.ctrl = l1oip_dctrl;
1387 	dch->dev.nrbchan = hc->b_num;
1388 	dch->slot = hc->d_idx;
1389 	hc->chan[hc->d_idx].dch = dch;
1390 	i = 1;
1391 	for (ch = 0; ch < dch->dev.nrbchan; ch++) {
1392 		if (ch == 15)
1393 			i++;
1394 		bch = kzalloc(sizeof(struct bchannel), GFP_KERNEL);
1395 		if (!bch) {
1396 			printk(KERN_ERR "%s: no memory for bchannel\n",
1397 			       __func__);
1398 			return -ENOMEM;
1399 		}
1400 		bch->nr = i + ch;
1401 		bch->slot = i + ch;
1402 		bch->debug = debug;
1403 		mISDN_initbchannel(bch, MAX_DATA_MEM, 0);
1404 		bch->hw = hc;
1405 		bch->ch.send = handle_bmsg;
1406 		bch->ch.ctrl = l1oip_bctrl;
1407 		bch->ch.nr = i + ch;
1408 		list_add(&bch->ch.list, &dch->dev.bchannels);
1409 		hc->chan[i + ch].bch = bch;
1410 		set_channelmap(bch->nr, dch->dev.channelmap);
1411 	}
1412 	/* TODO: create a parent device for this driver */
1413 	ret = mISDN_register_device(&dch->dev, NULL, hc->name);
1414 	if (ret)
1415 		return ret;
1416 	hc->registered = 1;
1417 
1418 	if (debug & DEBUG_L1OIP_INIT)
1419 		printk(KERN_DEBUG "%s: Setting up network card(%d)\n",
1420 		       __func__, l1oip_cnt + 1);
1421 	ret = l1oip_socket_open(hc);
1422 	if (ret)
1423 		return ret;
1424 
1425 	timer_setup(&hc->keep_tl, l1oip_keepalive, 0);
1426 	hc->keep_tl.expires = jiffies + 2 * HZ; /* two seconds first time */
1427 	add_timer(&hc->keep_tl);
1428 
1429 	timer_setup(&hc->timeout_tl, l1oip_timeout, 0);
1430 	hc->timeout_on = 0; /* state that we have timer off */
1431 
1432 	return 0;
1433 }
1434 
1435 static int __init
1436 l1oip_init(void)
1437 {
1438 	int		pri, bundle;
1439 	struct l1oip		*hc;
1440 	int		ret;
1441 
1442 	printk(KERN_INFO "mISDN: Layer-1-over-IP driver Rev. %s\n",
1443 	       l1oip_revision);
1444 
1445 	if (l1oip_4bit_alloc(ulaw))
1446 		return -ENOMEM;
1447 
1448 	l1oip_cnt = 0;
1449 	while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
1450 		switch (type[l1oip_cnt] & 0xff) {
1451 		case 1:
1452 			pri = 0;
1453 			bundle = 0;
1454 			break;
1455 		case 2:
1456 			pri = 1;
1457 			bundle = 0;
1458 			break;
1459 		case 3:
1460 			pri = 0;
1461 			bundle = 1;
1462 			break;
1463 		case 4:
1464 			pri = 1;
1465 			bundle = 1;
1466 			break;
1467 		default:
1468 			printk(KERN_ERR "Card type(%d) not supported.\n",
1469 			       type[l1oip_cnt] & 0xff);
1470 			l1oip_cleanup();
1471 			return -EINVAL;
1472 		}
1473 
1474 		if (debug & DEBUG_L1OIP_INIT)
1475 			printk(KERN_DEBUG "%s: interface %d is %s with %s.\n",
1476 			       __func__, l1oip_cnt, pri ? "PRI" : "BRI",
1477 			       bundle ? "bundled IP packet for all B-channels" :
1478 			       "separate IP packets for every B-channel");
1479 
1480 		hc = kzalloc(sizeof(struct l1oip), GFP_ATOMIC);
1481 		if (!hc) {
1482 			printk(KERN_ERR "No kmem for L1-over-IP driver.\n");
1483 			l1oip_cleanup();
1484 			return -ENOMEM;
1485 		}
1486 		INIT_WORK(&hc->workq, (void *)l1oip_send_bh);
1487 
1488 		spin_lock(&l1oip_lock);
1489 		list_add_tail(&hc->list, &l1oip_ilist);
1490 		spin_unlock(&l1oip_lock);
1491 
1492 		ret = init_card(hc, pri, bundle);
1493 		if (ret) {
1494 			l1oip_cleanup();
1495 			return ret;
1496 		}
1497 
1498 		l1oip_cnt++;
1499 	}
1500 	printk(KERN_INFO "%d virtual devices registered\n", l1oip_cnt);
1501 	return 0;
1502 }
1503 
1504 module_init(l1oip_init);
1505 module_exit(l1oip_cleanup);
1506