xref: /linux/drivers/isdn/mISDN/l1oip_core.c (revision be239684b18e1cdcafcf8c7face4a2f562c745ad)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 
4  * l1oip.c  low level driver for tunneling layer 1 over IP
5  *
6  * NOTE: It is not compatible with TDMoIP nor "ISDN over IP".
7  *
8  * Author	Andreas Eversberg (jolly@eversberg.eu)
9  */
10 
11 /* module parameters:
12  * type:
13  Value 1	= BRI
14  Value 2	= PRI
15  Value 3 = BRI (multi channel frame, not supported yet)
16  Value 4 = PRI (multi channel frame, not supported yet)
17  A multi channel frame reduces overhead to a single frame for all
18  b-channels, but increases delay.
19  (NOTE: Multi channel frames are not implemented yet.)
20 
21  * codec:
22  Value 0 = transparent (default)
23  Value 1 = transfer ALAW
24  Value 2 = transfer ULAW
25  Value 3 = transfer generic 4 bit compression.
26 
27  * ulaw:
28  0 = we use a-Law (default)
29  1 = we use u-Law
30 
31  * limit:
32  limitation of B-channels to control bandwidth (1...126)
33  BRI: 1 or 2
34  PRI: 1-30, 31-126 (126, because dchannel ist not counted here)
35  Also limited ressources are used for stack, resulting in less channels.
36  It is possible to have more channels than 30 in PRI mode, this must
37  be supported by the application.
38 
39  * ip:
40  byte representation of remote ip address (127.0.0.1 -> 127,0,0,1)
41  If not given or four 0, no remote address is set.
42  For multiple interfaces, concat ip addresses. (127,0,0,1,127,0,0,1)
43 
44  * port:
45  port number (local interface)
46  If not given or 0, port 931 is used for fist instance, 932 for next...
47  For multiple interfaces, different ports must be given.
48 
49  * remoteport:
50  port number (remote interface)
51  If not given or 0, remote port equals local port
52  For multiple interfaces on equal sites, different ports must be given.
53 
54  * ondemand:
55  0 = fixed (always transmit packets, even when remote side timed out)
56  1 = on demand (only transmit packets, when remote side is detected)
57  the default is 0
58  NOTE: ID must also be set for on demand.
59 
60  * id:
61  optional value to identify frames. This value must be equal on both
62  peers and should be random. If omitted or 0, no ID is transmitted.
63 
64  * debug:
65  NOTE: only one debug value must be given for all cards
66  enable debugging (see l1oip.h for debug options)
67 
68 
69  Special mISDN controls:
70 
71  op = MISDN_CTRL_SETPEER*
72  p1 = bytes 0-3 : remote IP address in network order (left element first)
73  p2 = bytes 1-2 : remote port in network order (high byte first)
74  optional:
75  p2 = bytes 3-4 : local port in network order (high byte first)
76 
77  op = MISDN_CTRL_UNSETPEER*
78 
79  * Use l1oipctrl for comfortable setting or removing ip address.
80  (Layer 1 Over IP CTRL)
81 
82 
83  L1oIP-Protocol
84  --------------
85 
86  Frame Header:
87 
88  7 6 5 4 3 2 1 0
89  +---------------+
90  |Ver|T|I|Coding |
91  +---------------+
92  |  ID byte 3 *  |
93  +---------------+
94  |  ID byte 2 *  |
95  +---------------+
96  |  ID byte 1 *  |
97  +---------------+
98  |  ID byte 0 *  |
99  +---------------+
100  |M|   Channel   |
101  +---------------+
102  |    Length *   |
103  +---------------+
104  | Time Base MSB |
105  +---------------+
106  | Time Base LSB |
107  +---------------+
108  | Data....	|
109 
110  ...
111 
112  |               |
113  +---------------+
114  |M|   Channel   |
115  +---------------+
116  |    Length *   |
117  +---------------+
118  | Time Base MSB |
119  +---------------+
120  | Time Base LSB |
121  +---------------+
122  | Data....	|
123 
124  ...
125 
126 
127  * Only included in some cases.
128 
129  - Ver = Version
130  If version is missmatch, the frame must be ignored.
131 
132  - T = Type of interface
133  Must be 0 for S0 or 1 for E1.
134 
135  - I = Id present
136  If bit is set, four ID bytes are included in frame.
137 
138  - ID = Connection ID
139  Additional ID to prevent Denial of Service attacs. Also it prevents hijacking
140  connections with dynamic IP. The ID should be random and must not be 0.
141 
142  - Coding = Type of codec
143  Must be 0 for no transcoding. Also for D-channel and other HDLC frames.
144  1 and 2 are reserved for explicitly use of a-LAW or u-LAW codec.
145  3 is used for generic table compressor.
146 
147  - M = More channels to come. If this flag is 1, the following byte contains
148  the length of the channel data. After the data block, the next channel will
149  be defined. The flag for the last channel block (or if only one channel is
150  transmitted), must be 0 and no length is given.
151 
152  - Channel = Channel number
153  0 reserved
154  1-3 channel data for S0 (3 is D-channel)
155  1-31 channel data for E1 (16 is D-channel)
156  32-127 channel data for extended E1 (16 is D-channel)
157 
158  - The length is used if the M-flag is 1. It is used to find the next channel
159  inside frame.
160  NOTE: A value of 0 equals 256 bytes of data.
161  -> For larger data blocks, a single frame must be used.
162  -> For larger streams, a single frame or multiple blocks with same channel ID
163  must be used.
164 
165  - Time Base = Timestamp of first sample in frame
166  The "Time Base" is used to rearange packets and to detect packet loss.
167  The 16 bits are sent in network order (MSB first) and count 1/8000 th of a
168  second. This causes a wrap around each 8,192 seconds. There is no requirement
169  for the initial "Time Base", but 0 should be used for the first packet.
170  In case of HDLC data, this timestamp counts the packet or byte number.
171 
172 
173  Two Timers:
174 
175  After initialisation, a timer of 15 seconds is started. Whenever a packet is
176  transmitted, the timer is reset to 15 seconds again. If the timer expires, an
177  empty packet is transmitted. This keep the connection alive.
178 
179  When a valid packet is received, a timer 65 seconds is started. The interface
180  become ACTIVE. If the timer expires, the interface becomes INACTIVE.
181 
182 
183  Dynamic IP handling:
184 
185  To allow dynamic IP, the ID must be non 0. In this case, any packet with the
186  correct port number and ID will be accepted. If the remote side changes its IP
187  the new IP is used for all transmitted packets until it changes again.
188 
189 
190  On Demand:
191 
192  If the ondemand parameter is given, the remote IP is set to 0 on timeout.
193  This will stop keepalive traffic to remote. If the remote is online again,
194  traffic will continue to the remote address. This is useful for road warriors.
195  This feature only works with ID set, otherwhise it is highly unsecure.
196 
197 
198  Socket and Thread
199  -----------------
200 
201  The complete socket opening and closing is done by a thread.
202  When the thread opened a socket, the hc->socket descriptor is set. Whenever a
203  packet shall be sent to the socket, the hc->socket must be checked whether not
204  NULL. To prevent change in socket descriptor, the hc->socket_lock must be used.
205  To change the socket, a recall of l1oip_socket_open() will safely kill the
206  socket process and create a new one.
207 
208 */
209 
210 #define L1OIP_VERSION	0	/* 0...3 */
211 
212 #include <linux/module.h>
213 #include <linux/delay.h>
214 #include <linux/mISDNif.h>
215 #include <linux/mISDNhw.h>
216 #include <linux/mISDNdsp.h>
217 #include <linux/init.h>
218 #include <linux/in.h>
219 #include <linux/inet.h>
220 #include <linux/workqueue.h>
221 #include <linux/kthread.h>
222 #include <linux/slab.h>
223 #include <linux/sched/signal.h>
224 
225 #include <net/sock.h>
226 #include "core.h"
227 #include "l1oip.h"
228 
229 static const char *l1oip_revision = "2.00";
230 
231 static int l1oip_cnt;
232 static DEFINE_SPINLOCK(l1oip_lock);
233 static LIST_HEAD(l1oip_ilist);
234 
235 #define MAX_CARDS	16
236 static u_int type[MAX_CARDS];
237 static u_int codec[MAX_CARDS];
238 static u_int ip[MAX_CARDS * 4];
239 static u_int port[MAX_CARDS];
240 static u_int remoteport[MAX_CARDS];
241 static u_int ondemand[MAX_CARDS];
242 static u_int limit[MAX_CARDS];
243 static u_int id[MAX_CARDS];
244 static int debug;
245 static int ulaw;
246 
247 MODULE_AUTHOR("Andreas Eversberg");
248 MODULE_LICENSE("GPL");
249 module_param_array(type, uint, NULL, S_IRUGO | S_IWUSR);
250 module_param_array(codec, uint, NULL, S_IRUGO | S_IWUSR);
251 module_param_array(ip, uint, NULL, S_IRUGO | S_IWUSR);
252 module_param_array(port, uint, NULL, S_IRUGO | S_IWUSR);
253 module_param_array(remoteport, uint, NULL, S_IRUGO | S_IWUSR);
254 module_param_array(ondemand, uint, NULL, S_IRUGO | S_IWUSR);
255 module_param_array(limit, uint, NULL, S_IRUGO | S_IWUSR);
256 module_param_array(id, uint, NULL, S_IRUGO | S_IWUSR);
257 module_param(ulaw, uint, S_IRUGO | S_IWUSR);
258 module_param(debug, uint, S_IRUGO | S_IWUSR);
259 
260 /*
261  * send a frame via socket, if open and restart timer
262  */
263 static int
264 l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask,
265 		  u16 timebase, u8 *buf, int len)
266 {
267 	u8 *p;
268 	u8 frame[MAX_DFRAME_LEN_L1 + 32];
269 	struct socket *socket = NULL;
270 
271 	if (debug & DEBUG_L1OIP_MSG)
272 		printk(KERN_DEBUG "%s: sending data to socket (len = %d)\n",
273 		       __func__, len);
274 
275 	p = frame;
276 
277 	/* restart timer */
278 	if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ) && !hc->shutdown)
279 		mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ);
280 	else
281 		hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ;
282 
283 	if (debug & DEBUG_L1OIP_MSG)
284 		printk(KERN_DEBUG "%s: resetting timer\n", __func__);
285 
286 	/* drop if we have no remote ip or port */
287 	if (!hc->sin_remote.sin_addr.s_addr || !hc->sin_remote.sin_port) {
288 		if (debug & DEBUG_L1OIP_MSG)
289 			printk(KERN_DEBUG "%s: dropping frame, because remote "
290 			       "IP is not set.\n", __func__);
291 		return len;
292 	}
293 
294 	/* assemble frame */
295 	*p++ = (L1OIP_VERSION << 6) /* version and coding */
296 		| (hc->pri ? 0x20 : 0x00) /* type */
297 		| (hc->id ? 0x10 : 0x00) /* id */
298 		| localcodec;
299 	if (hc->id) {
300 		*p++ = hc->id >> 24; /* id */
301 		*p++ = hc->id >> 16;
302 		*p++ = hc->id >> 8;
303 		*p++ = hc->id;
304 	}
305 	*p++ =  0x00 + channel; /* m-flag, channel */
306 	*p++ = timebase >> 8; /* time base */
307 	*p++ = timebase;
308 
309 	if (buf && len) { /* add data to frame */
310 		if (localcodec == 1 && ulaw)
311 			l1oip_ulaw_to_alaw(buf, len, p);
312 		else if (localcodec == 2 && !ulaw)
313 			l1oip_alaw_to_ulaw(buf, len, p);
314 		else if (localcodec == 3)
315 			len = l1oip_law_to_4bit(buf, len, p,
316 						&hc->chan[channel].codecstate);
317 		else
318 			memcpy(p, buf, len);
319 	}
320 	len += p - frame;
321 
322 	/* check for socket in safe condition */
323 	spin_lock(&hc->socket_lock);
324 	if (!hc->socket) {
325 		spin_unlock(&hc->socket_lock);
326 		return 0;
327 	}
328 	/* seize socket */
329 	socket = hc->socket;
330 	hc->socket = NULL;
331 	spin_unlock(&hc->socket_lock);
332 	/* send packet */
333 	if (debug & DEBUG_L1OIP_MSG)
334 		printk(KERN_DEBUG "%s: sending packet to socket (len "
335 		       "= %d)\n", __func__, len);
336 	hc->sendiov.iov_base = frame;
337 	hc->sendiov.iov_len  = len;
338 	len = kernel_sendmsg(socket, &hc->sendmsg, &hc->sendiov, 1, len);
339 	/* give socket back */
340 	hc->socket = socket; /* no locking required */
341 
342 	return len;
343 }
344 
345 
346 /*
347  * receive channel data from socket
348  */
349 static void
350 l1oip_socket_recv(struct l1oip *hc, u8 remotecodec, u8 channel, u16 timebase,
351 		  u8 *buf, int len)
352 {
353 	struct sk_buff *nskb;
354 	struct bchannel *bch;
355 	struct dchannel *dch;
356 	u8 *p;
357 	u32 rx_counter;
358 
359 	if (len == 0) {
360 		if (debug & DEBUG_L1OIP_MSG)
361 			printk(KERN_DEBUG "%s: received empty keepalive data, "
362 			       "ignoring\n", __func__);
363 		return;
364 	}
365 
366 	if (debug & DEBUG_L1OIP_MSG)
367 		printk(KERN_DEBUG "%s: received data, sending to mISDN (%d)\n",
368 		       __func__, len);
369 
370 	if (channel < 1 || channel > 127) {
371 		printk(KERN_WARNING "%s: packet error - channel %d out of "
372 		       "range\n", __func__, channel);
373 		return;
374 	}
375 	dch = hc->chan[channel].dch;
376 	bch = hc->chan[channel].bch;
377 	if (!dch && !bch) {
378 		printk(KERN_WARNING "%s: packet error - channel %d not in "
379 		       "stack\n", __func__, channel);
380 		return;
381 	}
382 
383 	/* prepare message */
384 	nskb = mI_alloc_skb((remotecodec == 3) ? (len << 1) : len, GFP_ATOMIC);
385 	if (!nskb) {
386 		printk(KERN_ERR "%s: No mem for skb.\n", __func__);
387 		return;
388 	}
389 	p = skb_put(nskb, (remotecodec == 3) ? (len << 1) : len);
390 
391 	if (remotecodec == 1 && ulaw)
392 		l1oip_alaw_to_ulaw(buf, len, p);
393 	else if (remotecodec == 2 && !ulaw)
394 		l1oip_ulaw_to_alaw(buf, len, p);
395 	else if (remotecodec == 3)
396 		len = l1oip_4bit_to_law(buf, len, p);
397 	else
398 		memcpy(p, buf, len);
399 
400 	/* send message up */
401 	if (dch && len >= 2) {
402 		dch->rx_skb = nskb;
403 		recv_Dchannel(dch);
404 	}
405 	if (bch) {
406 		/* expand 16 bit sequence number to 32 bit sequence number */
407 		rx_counter = hc->chan[channel].rx_counter;
408 		if (((s16)(timebase - rx_counter)) >= 0) {
409 			/* time has changed forward */
410 			if (timebase >= (rx_counter & 0xffff))
411 				rx_counter =
412 					(rx_counter & 0xffff0000) | timebase;
413 			else
414 				rx_counter = ((rx_counter & 0xffff0000) + 0x10000)
415 					| timebase;
416 		} else {
417 			/* time has changed backwards */
418 			if (timebase < (rx_counter & 0xffff))
419 				rx_counter =
420 					(rx_counter & 0xffff0000) | timebase;
421 			else
422 				rx_counter = ((rx_counter & 0xffff0000) - 0x10000)
423 					| timebase;
424 		}
425 		hc->chan[channel].rx_counter = rx_counter;
426 
427 #ifdef REORDER_DEBUG
428 		if (hc->chan[channel].disorder_flag) {
429 			swap(hc->chan[channel].disorder_skb, nskb);
430 			swap(hc->chan[channel].disorder_cnt, rx_counter);
431 		}
432 		hc->chan[channel].disorder_flag ^= 1;
433 		if (nskb)
434 #endif
435 			queue_ch_frame(&bch->ch, PH_DATA_IND, rx_counter, nskb);
436 	}
437 }
438 
439 
440 /*
441  * parse frame and extract channel data
442  */
443 static void
444 l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len)
445 {
446 	u32			packet_id;
447 	u8			channel;
448 	u8			remotecodec;
449 	u16			timebase;
450 	int			m, mlen;
451 	int			len_start = len; /* initial frame length */
452 	struct dchannel		*dch = hc->chan[hc->d_idx].dch;
453 
454 	if (debug & DEBUG_L1OIP_MSG)
455 		printk(KERN_DEBUG "%s: received frame, parsing... (%d)\n",
456 		       __func__, len);
457 
458 	/* check length */
459 	if (len < 1 + 1 + 2) {
460 		printk(KERN_WARNING "%s: packet error - length %d below "
461 		       "4 bytes\n", __func__, len);
462 		return;
463 	}
464 
465 	/* check version */
466 	if (((*buf) >> 6) != L1OIP_VERSION) {
467 		printk(KERN_WARNING "%s: packet error - unknown version %d\n",
468 		       __func__, buf[0]>>6);
469 		return;
470 	}
471 
472 	/* check type */
473 	if (((*buf) & 0x20) && !hc->pri) {
474 		printk(KERN_WARNING "%s: packet error - received E1 packet "
475 		       "on S0 interface\n", __func__);
476 		return;
477 	}
478 	if (!((*buf) & 0x20) && hc->pri) {
479 		printk(KERN_WARNING "%s: packet error - received S0 packet "
480 		       "on E1 interface\n", __func__);
481 		return;
482 	}
483 
484 	/* get id flag */
485 	packet_id = (*buf >> 4) & 1;
486 
487 	/* check coding */
488 	remotecodec = (*buf) & 0x0f;
489 	if (remotecodec > 3) {
490 		printk(KERN_WARNING "%s: packet error - remotecodec %d "
491 		       "unsupported\n", __func__, remotecodec);
492 		return;
493 	}
494 	buf++;
495 	len--;
496 
497 	/* check packet_id */
498 	if (packet_id) {
499 		if (!hc->id) {
500 			printk(KERN_WARNING "%s: packet error - packet has id "
501 			       "0x%x, but we have not\n", __func__, packet_id);
502 			return;
503 		}
504 		if (len < 4) {
505 			printk(KERN_WARNING "%s: packet error - packet too "
506 			       "short for ID value\n", __func__);
507 			return;
508 		}
509 		packet_id = (*buf++) << 24;
510 		packet_id += (*buf++) << 16;
511 		packet_id += (*buf++) << 8;
512 		packet_id += (*buf++);
513 		len -= 4;
514 
515 		if (packet_id != hc->id) {
516 			printk(KERN_WARNING "%s: packet error - ID mismatch, "
517 			       "got 0x%x, we 0x%x\n",
518 			       __func__, packet_id, hc->id);
519 			return;
520 		}
521 	} else {
522 		if (hc->id) {
523 			printk(KERN_WARNING "%s: packet error - packet has no "
524 			       "ID, but we have\n", __func__);
525 			return;
526 		}
527 	}
528 
529 multiframe:
530 	if (len < 1) {
531 		printk(KERN_WARNING "%s: packet error - packet too short, "
532 		       "channel expected at position %d.\n",
533 		       __func__, len-len_start + 1);
534 		return;
535 	}
536 
537 	/* get channel and multiframe flag */
538 	channel = *buf & 0x7f;
539 	m = *buf >> 7;
540 	buf++;
541 	len--;
542 
543 	/* check length on multiframe */
544 	if (m) {
545 		if (len < 1) {
546 			printk(KERN_WARNING "%s: packet error - packet too "
547 			       "short, length expected at position %d.\n",
548 			       __func__, len_start - len - 1);
549 			return;
550 		}
551 
552 		mlen = *buf++;
553 		len--;
554 		if (mlen == 0)
555 			mlen = 256;
556 		if (len < mlen + 3) {
557 			printk(KERN_WARNING "%s: packet error - length %d at "
558 			       "position %d exceeds total length %d.\n",
559 			       __func__, mlen, len_start-len - 1, len_start);
560 			return;
561 		}
562 		if (len == mlen + 3) {
563 			printk(KERN_WARNING "%s: packet error - length %d at "
564 			       "position %d will not allow additional "
565 			       "packet.\n",
566 			       __func__, mlen, len_start-len + 1);
567 			return;
568 		}
569 	} else
570 		mlen = len - 2; /* single frame, subtract timebase */
571 
572 	if (len < 2) {
573 		printk(KERN_WARNING "%s: packet error - packet too short, time "
574 		       "base expected at position %d.\n",
575 		       __func__, len-len_start + 1);
576 		return;
577 	}
578 
579 	/* get time base */
580 	timebase = (*buf++) << 8;
581 	timebase |= (*buf++);
582 	len -= 2;
583 
584 	/* if inactive, we send up a PH_ACTIVATE and activate */
585 	if (!test_bit(FLG_ACTIVE, &dch->Flags)) {
586 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
587 			printk(KERN_DEBUG "%s: interface become active due to "
588 			       "received packet\n", __func__);
589 		test_and_set_bit(FLG_ACTIVE, &dch->Flags);
590 		_queue_data(&dch->dev.D, PH_ACTIVATE_IND, MISDN_ID_ANY, 0,
591 			    NULL, GFP_ATOMIC);
592 	}
593 
594 	/* distribute packet */
595 	l1oip_socket_recv(hc, remotecodec, channel, timebase, buf, mlen);
596 	buf += mlen;
597 	len -= mlen;
598 
599 	/* multiframe */
600 	if (m)
601 		goto multiframe;
602 
603 	/* restart timer */
604 	if ((time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) ||
605 	     !hc->timeout_on) &&
606 	    !hc->shutdown) {
607 		hc->timeout_on = 1;
608 		mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ);
609 	} else /* only adjust timer */
610 		hc->timeout_tl.expires = jiffies + L1OIP_TIMEOUT * HZ;
611 
612 	/* if ip or source port changes */
613 	if ((hc->sin_remote.sin_addr.s_addr != sin->sin_addr.s_addr)
614 	    || (hc->sin_remote.sin_port != sin->sin_port)) {
615 		if (debug & DEBUG_L1OIP_SOCKET)
616 			printk(KERN_DEBUG "%s: remote address changes from "
617 			       "0x%08x to 0x%08x (port %d to %d)\n", __func__,
618 			       ntohl(hc->sin_remote.sin_addr.s_addr),
619 			       ntohl(sin->sin_addr.s_addr),
620 			       ntohs(hc->sin_remote.sin_port),
621 			       ntohs(sin->sin_port));
622 		hc->sin_remote.sin_addr.s_addr = sin->sin_addr.s_addr;
623 		hc->sin_remote.sin_port = sin->sin_port;
624 	}
625 }
626 
627 
628 /*
629  * socket stuff
630  */
631 static int
632 l1oip_socket_thread(void *data)
633 {
634 	struct l1oip *hc = (struct l1oip *)data;
635 	int ret = 0;
636 	struct sockaddr_in sin_rx;
637 	struct kvec iov;
638 	struct msghdr msg = {.msg_name = &sin_rx,
639 			     .msg_namelen = sizeof(sin_rx)};
640 	unsigned char *recvbuf;
641 	size_t recvbuf_size = 1500;
642 	int recvlen;
643 	struct socket *socket = NULL;
644 	DECLARE_COMPLETION_ONSTACK(wait);
645 
646 	/* allocate buffer memory */
647 	recvbuf = kmalloc(recvbuf_size, GFP_KERNEL);
648 	if (!recvbuf) {
649 		printk(KERN_ERR "%s: Failed to alloc recvbuf.\n", __func__);
650 		ret = -ENOMEM;
651 		goto fail;
652 	}
653 
654 	iov.iov_base = recvbuf;
655 	iov.iov_len = recvbuf_size;
656 
657 	/* make daemon */
658 	allow_signal(SIGTERM);
659 
660 	/* create socket */
661 	if (sock_create(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &socket)) {
662 		printk(KERN_ERR "%s: Failed to create socket.\n", __func__);
663 		ret = -EIO;
664 		goto fail;
665 	}
666 
667 	/* set incoming address */
668 	hc->sin_local.sin_family = AF_INET;
669 	hc->sin_local.sin_addr.s_addr = INADDR_ANY;
670 	hc->sin_local.sin_port = htons((unsigned short)hc->localport);
671 
672 	/* set outgoing address */
673 	hc->sin_remote.sin_family = AF_INET;
674 	hc->sin_remote.sin_addr.s_addr = htonl(hc->remoteip);
675 	hc->sin_remote.sin_port = htons((unsigned short)hc->remoteport);
676 
677 	/* bind to incoming port */
678 	if (socket->ops->bind(socket, (struct sockaddr *)&hc->sin_local,
679 			      sizeof(hc->sin_local))) {
680 		printk(KERN_ERR "%s: Failed to bind socket to port %d.\n",
681 		       __func__, hc->localport);
682 		ret = -EINVAL;
683 		goto fail;
684 	}
685 
686 	/* check sk */
687 	if (socket->sk == NULL) {
688 		printk(KERN_ERR "%s: socket->sk == NULL\n", __func__);
689 		ret = -EIO;
690 		goto fail;
691 	}
692 
693 	/* build send message */
694 	hc->sendmsg.msg_name = &hc->sin_remote;
695 	hc->sendmsg.msg_namelen = sizeof(hc->sin_remote);
696 	hc->sendmsg.msg_control = NULL;
697 	hc->sendmsg.msg_controllen = 0;
698 
699 	/* give away socket */
700 	spin_lock(&hc->socket_lock);
701 	hc->socket = socket;
702 	spin_unlock(&hc->socket_lock);
703 
704 	/* read loop */
705 	if (debug & DEBUG_L1OIP_SOCKET)
706 		printk(KERN_DEBUG "%s: socket created and open\n",
707 		       __func__);
708 	while (!signal_pending(current)) {
709 		iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, recvbuf_size);
710 		recvlen = sock_recvmsg(socket, &msg, 0);
711 		if (recvlen > 0) {
712 			l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen);
713 		} else {
714 			if (debug & DEBUG_L1OIP_SOCKET)
715 				printk(KERN_WARNING
716 				       "%s: broken pipe on socket\n", __func__);
717 		}
718 	}
719 
720 	/* get socket back, check first if in use, maybe by send function */
721 	spin_lock(&hc->socket_lock);
722 	/* if hc->socket is NULL, it is in use until it is given back */
723 	while (!hc->socket) {
724 		spin_unlock(&hc->socket_lock);
725 		schedule_timeout(HZ / 10);
726 		spin_lock(&hc->socket_lock);
727 	}
728 	hc->socket = NULL;
729 	spin_unlock(&hc->socket_lock);
730 
731 	if (debug & DEBUG_L1OIP_SOCKET)
732 		printk(KERN_DEBUG "%s: socket thread terminating\n",
733 		       __func__);
734 
735 fail:
736 	/* free recvbuf */
737 	kfree(recvbuf);
738 
739 	/* close socket */
740 	if (socket)
741 		sock_release(socket);
742 
743 	/* if we got killed, signal completion */
744 	complete(&hc->socket_complete);
745 	hc->socket_thread = NULL; /* show termination of thread */
746 
747 	if (debug & DEBUG_L1OIP_SOCKET)
748 		printk(KERN_DEBUG "%s: socket thread terminated\n",
749 		       __func__);
750 	return ret;
751 }
752 
753 static void
754 l1oip_socket_close(struct l1oip *hc)
755 {
756 	struct dchannel *dch = hc->chan[hc->d_idx].dch;
757 
758 	/* kill thread */
759 	if (hc->socket_thread) {
760 		if (debug & DEBUG_L1OIP_SOCKET)
761 			printk(KERN_DEBUG "%s: socket thread exists, "
762 			       "killing...\n", __func__);
763 		send_sig(SIGTERM, hc->socket_thread, 0);
764 		wait_for_completion(&hc->socket_complete);
765 	}
766 
767 	/* if active, we send up a PH_DEACTIVATE and deactivate */
768 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
769 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
770 			printk(KERN_DEBUG "%s: interface become deactivated "
771 			       "due to timeout\n", __func__);
772 		test_and_clear_bit(FLG_ACTIVE, &dch->Flags);
773 		_queue_data(&dch->dev.D, PH_DEACTIVATE_IND, MISDN_ID_ANY, 0,
774 			    NULL, GFP_ATOMIC);
775 	}
776 }
777 
778 static int
779 l1oip_socket_open(struct l1oip *hc)
780 {
781 	/* in case of reopen, we need to close first */
782 	l1oip_socket_close(hc);
783 
784 	init_completion(&hc->socket_complete);
785 
786 	/* create receive process */
787 	hc->socket_thread = kthread_run(l1oip_socket_thread, hc, "l1oip_%s",
788 					hc->name);
789 	if (IS_ERR(hc->socket_thread)) {
790 		int err = PTR_ERR(hc->socket_thread);
791 		printk(KERN_ERR "%s: Failed (%d) to create socket process.\n",
792 		       __func__, err);
793 		hc->socket_thread = NULL;
794 		sock_release(hc->socket);
795 		return err;
796 	}
797 	if (debug & DEBUG_L1OIP_SOCKET)
798 		printk(KERN_DEBUG "%s: socket thread created\n", __func__);
799 
800 	return 0;
801 }
802 
803 
804 static void
805 l1oip_send_bh(struct work_struct *work)
806 {
807 	struct l1oip *hc = container_of(work, struct l1oip, workq);
808 
809 	if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
810 		printk(KERN_DEBUG "%s: keepalive timer expired, sending empty "
811 		       "frame on dchannel\n", __func__);
812 
813 	/* send an empty l1oip frame at D-channel */
814 	l1oip_socket_send(hc, 0, hc->d_idx, 0, 0, NULL, 0);
815 }
816 
817 
818 /*
819  * timer stuff
820  */
821 static void
822 l1oip_keepalive(struct timer_list *t)
823 {
824 	struct l1oip *hc = from_timer(hc, t, keep_tl);
825 
826 	schedule_work(&hc->workq);
827 }
828 
829 static void
830 l1oip_timeout(struct timer_list *t)
831 {
832 	struct l1oip			*hc = from_timer(hc, t,
833 								  timeout_tl);
834 	struct dchannel		*dch = hc->chan[hc->d_idx].dch;
835 
836 	if (debug & DEBUG_L1OIP_MSG)
837 		printk(KERN_DEBUG "%s: timeout timer expired, turn layer one "
838 		       "down.\n", __func__);
839 
840 	hc->timeout_on = 0; /* state that timer must be initialized next time */
841 
842 	/* if timeout, we send up a PH_DEACTIVATE and deactivate */
843 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
844 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
845 			printk(KERN_DEBUG "%s: interface become deactivated "
846 			       "due to timeout\n", __func__);
847 		test_and_clear_bit(FLG_ACTIVE, &dch->Flags);
848 		_queue_data(&dch->dev.D, PH_DEACTIVATE_IND, MISDN_ID_ANY, 0,
849 			    NULL, GFP_ATOMIC);
850 	}
851 
852 	/* if we have ondemand set, we remove ip address */
853 	if (hc->ondemand) {
854 		if (debug & DEBUG_L1OIP_MSG)
855 			printk(KERN_DEBUG "%s: on demand causes ip address to "
856 			       "be removed\n", __func__);
857 		hc->sin_remote.sin_addr.s_addr = 0;
858 	}
859 }
860 
861 
862 /*
863  * message handling
864  */
865 static int
866 handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
867 {
868 	struct mISDNdevice	*dev = container_of(ch, struct mISDNdevice, D);
869 	struct dchannel		*dch = container_of(dev, struct dchannel, dev);
870 	struct l1oip			*hc = dch->hw;
871 	struct mISDNhead	*hh = mISDN_HEAD_P(skb);
872 	int			ret = -EINVAL;
873 	int			l, ll;
874 	unsigned char		*p;
875 
876 	switch (hh->prim) {
877 	case PH_DATA_REQ:
878 		if (skb->len < 1) {
879 			printk(KERN_WARNING "%s: skb too small\n",
880 			       __func__);
881 			break;
882 		}
883 		if (skb->len > MAX_DFRAME_LEN_L1 || skb->len > L1OIP_MAX_LEN) {
884 			printk(KERN_WARNING "%s: skb too large\n",
885 			       __func__);
886 			break;
887 		}
888 		/* send frame */
889 		p = skb->data;
890 		l = skb->len;
891 		while (l) {
892 			/*
893 			 * This is technically bounded by L1OIP_MAX_PERFRAME but
894 			 * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
895 			 */
896 			ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
897 			l1oip_socket_send(hc, 0, dch->slot, 0,
898 					  hc->chan[dch->slot].tx_counter++, p, ll);
899 			p += ll;
900 			l -= ll;
901 		}
902 		skb_trim(skb, 0);
903 		queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
904 		return 0;
905 	case PH_ACTIVATE_REQ:
906 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
907 			printk(KERN_DEBUG "%s: PH_ACTIVATE channel %d (1..%d)\n"
908 			       , __func__, dch->slot, hc->b_num + 1);
909 		skb_trim(skb, 0);
910 		if (test_bit(FLG_ACTIVE, &dch->Flags))
911 			queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
912 		else
913 			queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
914 		return 0;
915 	case PH_DEACTIVATE_REQ:
916 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
917 			printk(KERN_DEBUG "%s: PH_DEACTIVATE channel %d "
918 			       "(1..%d)\n", __func__, dch->slot,
919 			       hc->b_num + 1);
920 		skb_trim(skb, 0);
921 		if (test_bit(FLG_ACTIVE, &dch->Flags))
922 			queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
923 		else
924 			queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
925 		return 0;
926 	}
927 	if (!ret)
928 		dev_kfree_skb(skb);
929 	return ret;
930 }
931 
932 static int
933 channel_dctrl(struct dchannel *dch, struct mISDN_ctrl_req *cq)
934 {
935 	int	ret = 0;
936 	struct l1oip	*hc = dch->hw;
937 
938 	switch (cq->op) {
939 	case MISDN_CTRL_GETOP:
940 		cq->op = MISDN_CTRL_SETPEER | MISDN_CTRL_UNSETPEER
941 			| MISDN_CTRL_GETPEER;
942 		break;
943 	case MISDN_CTRL_SETPEER:
944 		hc->remoteip = (u32)cq->p1;
945 		hc->remoteport = cq->p2 & 0xffff;
946 		hc->localport = cq->p2 >> 16;
947 		if (!hc->remoteport)
948 			hc->remoteport = hc->localport;
949 		if (debug & DEBUG_L1OIP_SOCKET)
950 			printk(KERN_DEBUG "%s: got new ip address from user "
951 			       "space.\n", __func__);
952 		l1oip_socket_open(hc);
953 		break;
954 	case MISDN_CTRL_UNSETPEER:
955 		if (debug & DEBUG_L1OIP_SOCKET)
956 			printk(KERN_DEBUG "%s: removing ip address.\n",
957 			       __func__);
958 		hc->remoteip = 0;
959 		l1oip_socket_open(hc);
960 		break;
961 	case MISDN_CTRL_GETPEER:
962 		if (debug & DEBUG_L1OIP_SOCKET)
963 			printk(KERN_DEBUG "%s: getting ip address.\n",
964 			       __func__);
965 		cq->p1 = hc->remoteip;
966 		cq->p2 = hc->remoteport | (hc->localport << 16);
967 		break;
968 	default:
969 		printk(KERN_WARNING "%s: unknown Op %x\n",
970 		       __func__, cq->op);
971 		ret = -EINVAL;
972 		break;
973 	}
974 	return ret;
975 }
976 
977 static int
978 open_dchannel(struct l1oip *hc, struct dchannel *dch, struct channel_req *rq)
979 {
980 	if (debug & DEBUG_HW_OPEN)
981 		printk(KERN_DEBUG "%s: dev(%d) open from %p\n", __func__,
982 		       dch->dev.id, __builtin_return_address(0));
983 	if (rq->protocol == ISDN_P_NONE)
984 		return -EINVAL;
985 	if ((dch->dev.D.protocol != ISDN_P_NONE) &&
986 	    (dch->dev.D.protocol != rq->protocol)) {
987 		if (debug & DEBUG_HW_OPEN)
988 			printk(KERN_WARNING "%s: change protocol %x to %x\n",
989 			       __func__, dch->dev.D.protocol, rq->protocol);
990 	}
991 	if (dch->dev.D.protocol != rq->protocol)
992 		dch->dev.D.protocol = rq->protocol;
993 
994 	if (test_bit(FLG_ACTIVE, &dch->Flags)) {
995 		_queue_data(&dch->dev.D, PH_ACTIVATE_IND, MISDN_ID_ANY,
996 			    0, NULL, GFP_KERNEL);
997 	}
998 	rq->ch = &dch->dev.D;
999 	if (!try_module_get(THIS_MODULE))
1000 		printk(KERN_WARNING "%s:cannot get module\n", __func__);
1001 	return 0;
1002 }
1003 
1004 static int
1005 open_bchannel(struct l1oip *hc, struct dchannel *dch, struct channel_req *rq)
1006 {
1007 	struct bchannel	*bch;
1008 	int		ch;
1009 
1010 	if (!test_channelmap(rq->adr.channel, dch->dev.channelmap))
1011 		return -EINVAL;
1012 	if (rq->protocol == ISDN_P_NONE)
1013 		return -EINVAL;
1014 	ch = rq->adr.channel; /* BRI: 1=B1 2=B2  PRI: 1..15,17.. */
1015 	bch = hc->chan[ch].bch;
1016 	if (!bch) {
1017 		printk(KERN_ERR "%s:internal error ch %d has no bch\n",
1018 		       __func__, ch);
1019 		return -EINVAL;
1020 	}
1021 	if (test_and_set_bit(FLG_OPEN, &bch->Flags))
1022 		return -EBUSY; /* b-channel can be only open once */
1023 	bch->ch.protocol = rq->protocol;
1024 	rq->ch = &bch->ch;
1025 	if (!try_module_get(THIS_MODULE))
1026 		printk(KERN_WARNING "%s:cannot get module\n", __func__);
1027 	return 0;
1028 }
1029 
1030 static int
1031 l1oip_dctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
1032 {
1033 	struct mISDNdevice	*dev = container_of(ch, struct mISDNdevice, D);
1034 	struct dchannel		*dch = container_of(dev, struct dchannel, dev);
1035 	struct l1oip			*hc = dch->hw;
1036 	struct channel_req	*rq;
1037 	int			err = 0;
1038 
1039 	if (dch->debug & DEBUG_HW)
1040 		printk(KERN_DEBUG "%s: cmd:%x %p\n",
1041 		       __func__, cmd, arg);
1042 	switch (cmd) {
1043 	case OPEN_CHANNEL:
1044 		rq = arg;
1045 		switch (rq->protocol) {
1046 		case ISDN_P_TE_S0:
1047 		case ISDN_P_NT_S0:
1048 			if (hc->pri) {
1049 				err = -EINVAL;
1050 				break;
1051 			}
1052 			err = open_dchannel(hc, dch, rq);
1053 			break;
1054 		case ISDN_P_TE_E1:
1055 		case ISDN_P_NT_E1:
1056 			if (!hc->pri) {
1057 				err = -EINVAL;
1058 				break;
1059 			}
1060 			err = open_dchannel(hc, dch, rq);
1061 			break;
1062 		default:
1063 			err = open_bchannel(hc, dch, rq);
1064 		}
1065 		break;
1066 	case CLOSE_CHANNEL:
1067 		if (debug & DEBUG_HW_OPEN)
1068 			printk(KERN_DEBUG "%s: dev(%d) close from %p\n",
1069 			       __func__, dch->dev.id,
1070 			       __builtin_return_address(0));
1071 		module_put(THIS_MODULE);
1072 		break;
1073 	case CONTROL_CHANNEL:
1074 		err = channel_dctrl(dch, arg);
1075 		break;
1076 	default:
1077 		if (dch->debug & DEBUG_HW)
1078 			printk(KERN_DEBUG "%s: unknown command %x\n",
1079 			       __func__, cmd);
1080 		err = -EINVAL;
1081 	}
1082 	return err;
1083 }
1084 
1085 static int
1086 handle_bmsg(struct mISDNchannel *ch, struct sk_buff *skb)
1087 {
1088 	struct bchannel		*bch = container_of(ch, struct bchannel, ch);
1089 	struct l1oip			*hc = bch->hw;
1090 	int			ret = -EINVAL;
1091 	struct mISDNhead	*hh = mISDN_HEAD_P(skb);
1092 	int			l, ll;
1093 	unsigned char		*p;
1094 
1095 	switch (hh->prim) {
1096 	case PH_DATA_REQ:
1097 		if (skb->len <= 0) {
1098 			printk(KERN_WARNING "%s: skb too small\n",
1099 			       __func__);
1100 			break;
1101 		}
1102 		if (skb->len > MAX_DFRAME_LEN_L1 || skb->len > L1OIP_MAX_LEN) {
1103 			printk(KERN_WARNING "%s: skb too large\n",
1104 			       __func__);
1105 			break;
1106 		}
1107 		/* check for AIS / ulaw-silence */
1108 		l = skb->len;
1109 		if (!memchr_inv(skb->data, 0xff, l)) {
1110 			if (debug & DEBUG_L1OIP_MSG)
1111 				printk(KERN_DEBUG "%s: got AIS, not sending, "
1112 				       "but counting\n", __func__);
1113 			hc->chan[bch->slot].tx_counter += l;
1114 			skb_trim(skb, 0);
1115 			queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1116 			return 0;
1117 		}
1118 		/* check for silence */
1119 		l = skb->len;
1120 		if (!memchr_inv(skb->data, 0x2a, l)) {
1121 			if (debug & DEBUG_L1OIP_MSG)
1122 				printk(KERN_DEBUG "%s: got silence, not sending"
1123 				       ", but counting\n", __func__);
1124 			hc->chan[bch->slot].tx_counter += l;
1125 			skb_trim(skb, 0);
1126 			queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1127 			return 0;
1128 		}
1129 
1130 		/* send frame */
1131 		p = skb->data;
1132 		l = skb->len;
1133 		while (l) {
1134 			/*
1135 			 * This is technically bounded by L1OIP_MAX_PERFRAME but
1136 			 * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
1137 			 */
1138 			ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
1139 			l1oip_socket_send(hc, hc->codec, bch->slot, 0,
1140 					  hc->chan[bch->slot].tx_counter, p, ll);
1141 			hc->chan[bch->slot].tx_counter += ll;
1142 			p += ll;
1143 			l -= ll;
1144 		}
1145 		skb_trim(skb, 0);
1146 		queue_ch_frame(ch, PH_DATA_CNF, hh->id, skb);
1147 		return 0;
1148 	case PH_ACTIVATE_REQ:
1149 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
1150 			printk(KERN_DEBUG "%s: PH_ACTIVATE channel %d (1..%d)\n"
1151 			       , __func__, bch->slot, hc->b_num + 1);
1152 		hc->chan[bch->slot].codecstate = 0;
1153 		test_and_set_bit(FLG_ACTIVE, &bch->Flags);
1154 		skb_trim(skb, 0);
1155 		queue_ch_frame(ch, PH_ACTIVATE_IND, hh->id, skb);
1156 		return 0;
1157 	case PH_DEACTIVATE_REQ:
1158 		if (debug & (DEBUG_L1OIP_MSG | DEBUG_L1OIP_SOCKET))
1159 			printk(KERN_DEBUG "%s: PH_DEACTIVATE channel %d "
1160 			       "(1..%d)\n", __func__, bch->slot,
1161 			       hc->b_num + 1);
1162 		test_and_clear_bit(FLG_ACTIVE, &bch->Flags);
1163 		skb_trim(skb, 0);
1164 		queue_ch_frame(ch, PH_DEACTIVATE_IND, hh->id, skb);
1165 		return 0;
1166 	}
1167 	if (!ret)
1168 		dev_kfree_skb(skb);
1169 	return ret;
1170 }
1171 
1172 static int
1173 channel_bctrl(struct bchannel *bch, struct mISDN_ctrl_req *cq)
1174 {
1175 	int			ret = 0;
1176 	struct dsp_features	*features =
1177 		(struct dsp_features *)(*((u_long *)&cq->p1));
1178 
1179 	switch (cq->op) {
1180 	case MISDN_CTRL_GETOP:
1181 		cq->op = MISDN_CTRL_HW_FEATURES_OP;
1182 		break;
1183 	case MISDN_CTRL_HW_FEATURES: /* fill features structure */
1184 		if (debug & DEBUG_L1OIP_MSG)
1185 			printk(KERN_DEBUG "%s: HW_FEATURE request\n",
1186 			       __func__);
1187 		/* create confirm */
1188 		features->unclocked = 1;
1189 		features->unordered = 1;
1190 		break;
1191 	default:
1192 		printk(KERN_WARNING "%s: unknown Op %x\n",
1193 		       __func__, cq->op);
1194 		ret = -EINVAL;
1195 		break;
1196 	}
1197 	return ret;
1198 }
1199 
1200 static int
1201 l1oip_bctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
1202 {
1203 	struct bchannel	*bch = container_of(ch, struct bchannel, ch);
1204 	int		err = -EINVAL;
1205 
1206 	if (bch->debug & DEBUG_HW)
1207 		printk(KERN_DEBUG "%s: cmd:%x %p\n",
1208 		       __func__, cmd, arg);
1209 	switch (cmd) {
1210 	case CLOSE_CHANNEL:
1211 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
1212 		test_and_clear_bit(FLG_ACTIVE, &bch->Flags);
1213 		ch->protocol = ISDN_P_NONE;
1214 		ch->peer = NULL;
1215 		module_put(THIS_MODULE);
1216 		err = 0;
1217 		break;
1218 	case CONTROL_CHANNEL:
1219 		err = channel_bctrl(bch, arg);
1220 		break;
1221 	default:
1222 		printk(KERN_WARNING "%s: unknown prim(%x)\n",
1223 		       __func__, cmd);
1224 	}
1225 	return err;
1226 }
1227 
1228 
1229 /*
1230  * cleanup module and stack
1231  */
1232 static void
1233 release_card(struct l1oip *hc)
1234 {
1235 	int	ch;
1236 
1237 	hc->shutdown = true;
1238 
1239 	timer_shutdown_sync(&hc->keep_tl);
1240 	timer_shutdown_sync(&hc->timeout_tl);
1241 
1242 	cancel_work_sync(&hc->workq);
1243 
1244 	if (hc->socket_thread)
1245 		l1oip_socket_close(hc);
1246 
1247 	if (hc->registered && hc->chan[hc->d_idx].dch)
1248 		mISDN_unregister_device(&hc->chan[hc->d_idx].dch->dev);
1249 	for (ch = 0; ch < 128; ch++) {
1250 		if (hc->chan[ch].dch) {
1251 			mISDN_freedchannel(hc->chan[ch].dch);
1252 			kfree(hc->chan[ch].dch);
1253 		}
1254 		if (hc->chan[ch].bch) {
1255 			mISDN_freebchannel(hc->chan[ch].bch);
1256 			kfree(hc->chan[ch].bch);
1257 #ifdef REORDER_DEBUG
1258 			dev_kfree_skb(hc->chan[ch].disorder_skb);
1259 #endif
1260 		}
1261 	}
1262 
1263 	spin_lock(&l1oip_lock);
1264 	list_del(&hc->list);
1265 	spin_unlock(&l1oip_lock);
1266 
1267 	kfree(hc);
1268 }
1269 
1270 static void
1271 l1oip_cleanup(void)
1272 {
1273 	struct l1oip *hc, *next;
1274 
1275 	list_for_each_entry_safe(hc, next, &l1oip_ilist, list)
1276 		release_card(hc);
1277 
1278 	l1oip_4bit_free();
1279 }
1280 
1281 
1282 /*
1283  * module and stack init
1284  */
1285 static int
1286 init_card(struct l1oip *hc, int pri, int bundle)
1287 {
1288 	struct dchannel	*dch;
1289 	struct bchannel	*bch;
1290 	int		ret;
1291 	int		i, ch;
1292 
1293 	spin_lock_init(&hc->socket_lock);
1294 	hc->idx = l1oip_cnt;
1295 	hc->pri = pri;
1296 	hc->d_idx = pri ? 16 : 3;
1297 	hc->b_num = pri ? 30 : 2;
1298 	hc->bundle = bundle;
1299 	if (hc->pri)
1300 		sprintf(hc->name, "l1oip-e1.%d", l1oip_cnt + 1);
1301 	else
1302 		sprintf(hc->name, "l1oip-s0.%d", l1oip_cnt + 1);
1303 
1304 	switch (codec[l1oip_cnt]) {
1305 	case 0: /* as is */
1306 	case 1: /* alaw */
1307 	case 2: /* ulaw */
1308 	case 3: /* 4bit */
1309 		break;
1310 	default:
1311 		printk(KERN_ERR "Codec(%d) not supported.\n",
1312 		       codec[l1oip_cnt]);
1313 		return -EINVAL;
1314 	}
1315 	hc->codec = codec[l1oip_cnt];
1316 	if (debug & DEBUG_L1OIP_INIT)
1317 		printk(KERN_DEBUG "%s: using codec %d\n",
1318 		       __func__, hc->codec);
1319 
1320 	if (id[l1oip_cnt] == 0) {
1321 		printk(KERN_WARNING "Warning: No 'id' value given or "
1322 		       "0, this is highly unsecure. Please use 32 "
1323 		       "bit random number 0x...\n");
1324 	}
1325 	hc->id = id[l1oip_cnt];
1326 	if (debug & DEBUG_L1OIP_INIT)
1327 		printk(KERN_DEBUG "%s: using id 0x%x\n", __func__, hc->id);
1328 
1329 	hc->ondemand = ondemand[l1oip_cnt];
1330 	if (hc->ondemand && !hc->id) {
1331 		printk(KERN_ERR "%s: ondemand option only allowed in "
1332 		       "conjunction with non 0 ID\n", __func__);
1333 		return -EINVAL;
1334 	}
1335 
1336 	if (limit[l1oip_cnt])
1337 		hc->b_num = limit[l1oip_cnt];
1338 	if (!pri && hc->b_num > 2) {
1339 		printk(KERN_ERR "Maximum limit for BRI interface is 2 "
1340 		       "channels.\n");
1341 		return -EINVAL;
1342 	}
1343 	if (pri && hc->b_num > 126) {
1344 		printk(KERN_ERR "Maximum limit for PRI interface is 126 "
1345 		       "channels.\n");
1346 		return -EINVAL;
1347 	}
1348 	if (pri && hc->b_num > 30) {
1349 		printk(KERN_WARNING "Maximum limit for BRI interface is 30 "
1350 		       "channels.\n");
1351 		printk(KERN_WARNING "Your selection of %d channels must be "
1352 		       "supported by application.\n", hc->limit);
1353 	}
1354 
1355 	hc->remoteip = ip[l1oip_cnt << 2] << 24
1356 		| ip[(l1oip_cnt << 2) + 1] << 16
1357 		| ip[(l1oip_cnt << 2) + 2] << 8
1358 		| ip[(l1oip_cnt << 2) + 3];
1359 	hc->localport = port[l1oip_cnt]?:(L1OIP_DEFAULTPORT + l1oip_cnt);
1360 	if (remoteport[l1oip_cnt])
1361 		hc->remoteport = remoteport[l1oip_cnt];
1362 	else
1363 		hc->remoteport = hc->localport;
1364 	if (debug & DEBUG_L1OIP_INIT)
1365 		printk(KERN_DEBUG "%s: using local port %d remote ip "
1366 		       "%d.%d.%d.%d port %d ondemand %d\n", __func__,
1367 		       hc->localport, hc->remoteip >> 24,
1368 		       (hc->remoteip >> 16) & 0xff,
1369 		       (hc->remoteip >> 8) & 0xff, hc->remoteip & 0xff,
1370 		       hc->remoteport, hc->ondemand);
1371 
1372 	dch = kzalloc(sizeof(struct dchannel), GFP_KERNEL);
1373 	if (!dch)
1374 		return -ENOMEM;
1375 	dch->debug = debug;
1376 	mISDN_initdchannel(dch, MAX_DFRAME_LEN_L1, NULL);
1377 	dch->hw = hc;
1378 	if (pri)
1379 		dch->dev.Dprotocols = (1 << ISDN_P_TE_E1) | (1 << ISDN_P_NT_E1);
1380 	else
1381 		dch->dev.Dprotocols = (1 << ISDN_P_TE_S0) | (1 << ISDN_P_NT_S0);
1382 	dch->dev.Bprotocols = (1 << (ISDN_P_B_RAW & ISDN_P_B_MASK)) |
1383 		(1 << (ISDN_P_B_HDLC & ISDN_P_B_MASK));
1384 	dch->dev.D.send = handle_dmsg;
1385 	dch->dev.D.ctrl = l1oip_dctrl;
1386 	dch->dev.nrbchan = hc->b_num;
1387 	dch->slot = hc->d_idx;
1388 	hc->chan[hc->d_idx].dch = dch;
1389 	i = 1;
1390 	for (ch = 0; ch < dch->dev.nrbchan; ch++) {
1391 		if (ch == 15)
1392 			i++;
1393 		bch = kzalloc(sizeof(struct bchannel), GFP_KERNEL);
1394 		if (!bch) {
1395 			printk(KERN_ERR "%s: no memory for bchannel\n",
1396 			       __func__);
1397 			return -ENOMEM;
1398 		}
1399 		bch->nr = i + ch;
1400 		bch->slot = i + ch;
1401 		bch->debug = debug;
1402 		mISDN_initbchannel(bch, MAX_DATA_MEM, 0);
1403 		bch->hw = hc;
1404 		bch->ch.send = handle_bmsg;
1405 		bch->ch.ctrl = l1oip_bctrl;
1406 		bch->ch.nr = i + ch;
1407 		list_add(&bch->ch.list, &dch->dev.bchannels);
1408 		hc->chan[i + ch].bch = bch;
1409 		set_channelmap(bch->nr, dch->dev.channelmap);
1410 	}
1411 	/* TODO: create a parent device for this driver */
1412 	ret = mISDN_register_device(&dch->dev, NULL, hc->name);
1413 	if (ret)
1414 		return ret;
1415 	hc->registered = 1;
1416 
1417 	if (debug & DEBUG_L1OIP_INIT)
1418 		printk(KERN_DEBUG "%s: Setting up network card(%d)\n",
1419 		       __func__, l1oip_cnt + 1);
1420 	ret = l1oip_socket_open(hc);
1421 	if (ret)
1422 		return ret;
1423 
1424 	timer_setup(&hc->keep_tl, l1oip_keepalive, 0);
1425 	hc->keep_tl.expires = jiffies + 2 * HZ; /* two seconds first time */
1426 	add_timer(&hc->keep_tl);
1427 
1428 	timer_setup(&hc->timeout_tl, l1oip_timeout, 0);
1429 	hc->timeout_on = 0; /* state that we have timer off */
1430 
1431 	return 0;
1432 }
1433 
1434 static int __init
1435 l1oip_init(void)
1436 {
1437 	int		pri, bundle;
1438 	struct l1oip		*hc;
1439 	int		ret;
1440 
1441 	printk(KERN_INFO "mISDN: Layer-1-over-IP driver Rev. %s\n",
1442 	       l1oip_revision);
1443 
1444 	if (l1oip_4bit_alloc(ulaw))
1445 		return -ENOMEM;
1446 
1447 	l1oip_cnt = 0;
1448 	while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
1449 		switch (type[l1oip_cnt] & 0xff) {
1450 		case 1:
1451 			pri = 0;
1452 			bundle = 0;
1453 			break;
1454 		case 2:
1455 			pri = 1;
1456 			bundle = 0;
1457 			break;
1458 		case 3:
1459 			pri = 0;
1460 			bundle = 1;
1461 			break;
1462 		case 4:
1463 			pri = 1;
1464 			bundle = 1;
1465 			break;
1466 		default:
1467 			printk(KERN_ERR "Card type(%d) not supported.\n",
1468 			       type[l1oip_cnt] & 0xff);
1469 			l1oip_cleanup();
1470 			return -EINVAL;
1471 		}
1472 
1473 		if (debug & DEBUG_L1OIP_INIT)
1474 			printk(KERN_DEBUG "%s: interface %d is %s with %s.\n",
1475 			       __func__, l1oip_cnt, pri ? "PRI" : "BRI",
1476 			       bundle ? "bundled IP packet for all B-channels" :
1477 			       "separate IP packets for every B-channel");
1478 
1479 		hc = kzalloc(sizeof(struct l1oip), GFP_ATOMIC);
1480 		if (!hc) {
1481 			printk(KERN_ERR "No kmem for L1-over-IP driver.\n");
1482 			l1oip_cleanup();
1483 			return -ENOMEM;
1484 		}
1485 		INIT_WORK(&hc->workq, (void *)l1oip_send_bh);
1486 
1487 		spin_lock(&l1oip_lock);
1488 		list_add_tail(&hc->list, &l1oip_ilist);
1489 		spin_unlock(&l1oip_lock);
1490 
1491 		ret = init_card(hc, pri, bundle);
1492 		if (ret) {
1493 			l1oip_cleanup();
1494 			return ret;
1495 		}
1496 
1497 		l1oip_cnt++;
1498 	}
1499 	printk(KERN_INFO "%d virtual devices registered\n", l1oip_cnt);
1500 	return 0;
1501 }
1502 
1503 module_init(l1oip_init);
1504 module_exit(l1oip_cleanup);
1505