2 * PCBIT-D interface with isdn4linux
4 * Copyright (C) 1996 Universidade de Lisboa
6 * Written by Pedro Roque Marques (roque@di.fc.ul.pt)
8 * This software may be used and distributed according to the terms of
9 * the GNU General Public License, incorporated herein by reference.
15 * Nuno Grilo <l38486@alfa.ist.utl.pt>
16 * fixed msn_list NULL pointer dereference.
20 #include <linux/module.h>
23 #include <linux/kernel.h>
25 #include <linux/types.h>
26 #include <linux/sched.h>
27 #include <linux/slab.h>
29 #include <linux/interrupt.h>
30 #include <linux/string.h>
31 #include <linux/skbuff.h>
33 #include <linux/isdnif.h>
34 #include <asm/string.h>
36 #include <linux/ioport.h>
44 extern ushort last_ref_num;
46 static int pcbit_ioctl(isdn_ctrl *ctl);
48 static char *pcbit_devname[MAX_PCBIT_CARDS] = {
59 static int pcbit_command(isdn_ctrl *ctl);
60 static int pcbit_stat(u_char __user *buf, int len, int, int);
61 static int pcbit_xmit(int driver, int chan, int ack, struct sk_buff *skb);
62 static int pcbit_writecmd(const u_char __user *, int, int, int);
64 static int set_protocol_running(struct pcbit_dev *dev);
66 static void pcbit_clear_msn(struct pcbit_dev *dev);
67 static void pcbit_set_msn(struct pcbit_dev *dev, char *list);
68 static int pcbit_check_msn(struct pcbit_dev *dev, char *msn);
71 int pcbit_init_dev(int board, int mem_base, int irq)
73 struct pcbit_dev *dev;
76 if ((dev = kzalloc(sizeof(struct pcbit_dev), GFP_KERNEL)) == NULL)
78 printk("pcbit_init: couldn't malloc pcbit_dev struct\n");
82 dev_pcbit[board] = dev;
83 init_waitqueue_head(&dev->set_running_wq);
84 spin_lock_init(&dev->lock);
86 if (mem_base >= 0xA0000 && mem_base <= 0xFFFFF) {
87 dev->ph_mem = mem_base;
88 if (!request_mem_region(dev->ph_mem, 4096, "PCBIT mem")) {
90 "PCBIT: memory region %lx-%lx already in use\n",
91 dev->ph_mem, dev->ph_mem + 4096);
93 dev_pcbit[board] = NULL;
96 dev->sh_mem = ioremap(dev->ph_mem, 4096);
100 printk("memory address invalid");
102 dev_pcbit[board] = NULL;
106 dev->b1 = kzalloc(sizeof(struct pcbit_chan), GFP_KERNEL);
108 printk("pcbit_init: couldn't malloc pcbit_chan struct\n");
109 iounmap(dev->sh_mem);
110 release_mem_region(dev->ph_mem, 4096);
115 dev->b2 = kzalloc(sizeof(struct pcbit_chan), GFP_KERNEL);
117 printk("pcbit_init: couldn't malloc pcbit_chan struct\n");
119 iounmap(dev->sh_mem);
120 release_mem_region(dev->ph_mem, 4096);
127 INIT_WORK(&dev->qdelivery, pcbit_deliver);
133 if (request_irq(irq, &pcbit_irq_handler, 0, pcbit_devname[board], dev) != 0)
137 iounmap(dev->sh_mem);
138 release_mem_region(dev->ph_mem, 4096);
140 dev_pcbit[board] = NULL;
146 /* next frame to be received */
153 dev_if = kmalloc(sizeof(isdn_if), GFP_KERNEL);
159 iounmap(dev->sh_mem);
160 release_mem_region(dev->ph_mem, 4096);
162 dev_pcbit[board] = NULL;
166 dev->dev_if = dev_if;
168 dev_if->owner = THIS_MODULE;
170 dev_if->channels = 2;
172 dev_if->features = (ISDN_FEATURE_P_EURO | ISDN_FEATURE_L3_TRANS |
173 ISDN_FEATURE_L2_HDLC | ISDN_FEATURE_L2_TRANS);
175 dev_if->writebuf_skb = pcbit_xmit;
176 dev_if->hl_hdrlen = 16;
178 dev_if->maxbufsize = MAXBUFSIZE;
179 dev_if->command = pcbit_command;
181 dev_if->writecmd = pcbit_writecmd;
182 dev_if->readstat = pcbit_stat;
185 strcpy(dev_if->id, pcbit_devname[board]);
187 if (!register_isdn(dev_if)) {
191 iounmap(dev->sh_mem);
192 release_mem_region(dev->ph_mem, 4096);
194 dev_pcbit[board] = NULL;
198 dev->id = dev_if->channels;
201 dev->l2_state = L2_DOWN;
205 * set_protocol_running(dev);
212 void pcbit_terminate(int board)
214 struct pcbit_dev *dev;
216 dev = dev_pcbit[board];
219 /* unregister_isdn(dev->dev_if); */
220 free_irq(dev->irq, dev);
221 pcbit_clear_msn(dev);
223 if (dev->b1->fsm_timer.function)
224 del_timer(&dev->b1->fsm_timer);
225 if (dev->b2->fsm_timer.function)
226 del_timer(&dev->b2->fsm_timer);
229 iounmap(dev->sh_mem);
230 release_mem_region(dev->ph_mem, 4096);
236 static int pcbit_command(isdn_ctrl *ctl)
238 struct pcbit_dev *dev;
239 struct pcbit_chan *chan;
240 struct callb_data info;
242 dev = finddev(ctl->driver);
246 printk("pcbit_command: unknown device\n");
250 chan = (ctl->arg & 0x0F) ? dev->b2 : dev->b1;
253 switch (ctl->command) {
255 return pcbit_ioctl(ctl);
258 info.type = EV_USR_SETUP_REQ;
259 info.data.setup.CalledPN = (char *) &ctl->parm.setup.phone;
260 pcbit_fsm_event(dev, chan, EV_USR_SETUP_REQ, &info);
262 case ISDN_CMD_ACCEPTD:
263 pcbit_fsm_event(dev, chan, EV_USR_SETUP_RESP, NULL);
265 case ISDN_CMD_ACCEPTB:
266 printk("ISDN_CMD_ACCEPTB - not really needed\n");
268 case ISDN_CMD_HANGUP:
269 pcbit_fsm_event(dev, chan, EV_USR_RELEASE_REQ, NULL);
272 chan->proto = (ctl->arg >> 8);
274 case ISDN_CMD_CLREAZ:
275 pcbit_clear_msn(dev);
277 case ISDN_CMD_SETEAZ:
278 pcbit_set_msn(dev, ctl->parm.num);
281 if ((ctl->arg >> 8) != ISDN_PROTO_L3_TRANS)
282 printk(KERN_DEBUG "L3 protocol unknown\n");
285 printk(KERN_DEBUG "pcbit_command: unknown command\n");
294 * on some conditions the board stops sending TDATA_CONFs
295 * let's see if we can turn around the problem
299 static void pcbit_block_timer(unsigned long data)
301 struct pcbit_chan *chan;
302 struct pcbit_dev *dev;
305 chan = (struct pcbit_chan *)data;
307 dev = chan2dev(chan);
310 printk(KERN_DEBUG "pcbit: chan2dev failed\n");
314 del_timer(&chan->block_timer);
315 chan->block_timer.function = NULL;
318 printk(KERN_DEBUG "pcbit_block_timer\n");
321 ictl.driver = dev->id;
322 ictl.command = ISDN_STAT_BSENT;
324 dev->dev_if->statcallb(&ictl);
328 static int pcbit_xmit(int driver, int chnum, int ack, struct sk_buff *skb)
332 struct pcbit_chan *chan;
333 struct pcbit_dev *dev;
335 dev = finddev(driver);
338 printk("finddev returned NULL");
342 chan = chnum ? dev->b2 : dev->b1;
345 if (chan->fsm_state != ST_ACTIVE)
348 if (chan->queued >= MAX_QUEUED)
352 "pcbit: %d packets already in queue - write fails\n",
356 * packet stays on the head of the device queue
357 * since dev_start_xmit will fail
361 if (chan->block_timer.function == NULL) {
362 setup_timer(&chan->block_timer, &pcbit_block_timer,
364 mod_timer(&chan->block_timer, jiffies + 1 * HZ);
375 hdrlen = capi_tdata_req(chan, skb);
377 refnum = last_ref_num++ & 0x7fffU;
378 chan->s_refnum = refnum;
380 pcbit_l2_write(dev, MSG_TDATA_REQ, refnum, skb, hdrlen);
385 static int pcbit_writecmd(const u_char __user *buf, int len, int driver, int channel)
387 struct pcbit_dev *dev;
389 const u_char *loadbuf;
395 dev = finddev(driver);
399 printk("pcbit_writecmd: couldn't find device");
403 switch (dev->l2_state) {
405 /* check (size <= rdp_size); write buf into board */
406 if (len < 0 || len > BANK4 + 1 || len > 1024)
408 printk("pcbit_writecmd: invalid length %d\n", len);
412 cbuf = memdup_user(buf, len);
414 return PTR_ERR(cbuf);
416 memcpy_toio(dev->sh_mem, cbuf, len);
420 /* this is the hard part */
422 /* get it into kernel space */
423 if ((ptr = kmalloc(len, GFP_KERNEL)) == NULL)
425 if (copy_from_user(ptr, buf, len)) {
433 for (i = 0; i < len; i++)
435 for (j = 0; j < LOAD_RETRY; j++)
436 if (!(readb(dev->sh_mem + dev->loadptr)))
442 printk("TIMEOUT i=%d\n", i);
445 writeb(loadbuf[i], dev->sh_mem + dev->loadptr + 1);
446 writeb(0x01, dev->sh_mem + dev->loadptr);
449 if (dev->loadptr > LOAD_ZONE_END)
450 dev->loadptr = LOAD_ZONE_START;
454 return errstat ? errstat : len;
461 * demultiplexing of messages
465 void pcbit_l3_receive(struct pcbit_dev *dev, ulong msg,
467 ushort hdr_len, ushort refnum)
469 struct pcbit_chan *chan;
470 struct sk_buff *skb2;
472 struct callb_data cbdata;
479 if (!(chan = capi_channel(dev, skb))) {
481 "CAPI header: unknown channel id\n");
484 chan->r_refnum = skb->data[7];
487 dev->dev_if->rcvcallb_skb(dev->id, chan->id, skb);
489 if (capi_tdata_resp(chan, &skb2) > 0)
490 pcbit_l2_write(dev, MSG_TDATA_RESP, refnum,
495 if (!(chan = capi_channel(dev, skb))) {
497 "CAPI header: unknown channel id\n");
502 if ((*((ushort *)(skb->data + 2))) != 0) {
503 printk(KERN_DEBUG "TDATA_CONF error\n");
507 if (chan->queued == MAX_QUEUED) {
508 del_timer(&chan->block_timer);
509 chan->block_timer.function = NULL;
515 ictl.driver = dev->id;
516 ictl.command = ISDN_STAT_BSENT;
518 dev->dev_if->statcallb(&ictl);
523 * channel: 1st not used will do
524 * if both are used we're in trouble
527 if (!dev->b1->fsm_state)
529 else if (!dev->b2->fsm_state)
533 "Incoming connection: no channels available");
535 if ((len = capi_disc_req(*(ushort *)(skb->data), &skb2, CAUSE_NOCHAN)) > 0)
536 pcbit_l2_write(dev, MSG_DISC_REQ, refnum, skb2, len);
540 cbdata.data.setup.CalledPN = NULL;
541 cbdata.data.setup.CallingPN = NULL;
543 capi_decode_conn_ind(chan, skb, &cbdata);
544 cbdata.type = EV_NET_SETUP;
546 pcbit_fsm_event(dev, chan, EV_NET_SETUP, NULL);
548 if (pcbit_check_msn(dev, cbdata.data.setup.CallingPN))
549 pcbit_fsm_event(dev, chan, EV_USR_PROCED_REQ, &cbdata);
551 pcbit_fsm_event(dev, chan, EV_USR_RELEASE_REQ, NULL);
553 kfree(cbdata.data.setup.CalledPN);
554 kfree(cbdata.data.setup.CallingPN);
559 * We should be able to find the channel by the message
560 * reference number. The current version of the firmware
561 * doesn't sent the ref number correctly.
564 printk(KERN_DEBUG "refnum=%04x b1=%04x b2=%04x\n", refnum,
568 /* We just try to find a channel in the right state */
570 if (dev->b1->fsm_state == ST_CALL_INIT)
573 if (dev->b2->s_refnum == ST_CALL_INIT)
577 printk(KERN_WARNING "Connection Confirm - no channel in Call Init state\n");
581 if (capi_decode_conn_conf(chan, skb, &complete)) {
582 printk(KERN_DEBUG "conn_conf indicates error\n");
583 pcbit_fsm_event(dev, chan, EV_ERROR, NULL);
587 pcbit_fsm_event(dev, chan, EV_NET_CALL_PROC, NULL);
589 pcbit_fsm_event(dev, chan, EV_NET_SETUP_ACK, NULL);
591 case MSG_CONN_ACTV_IND:
593 if (!(chan = capi_channel(dev, skb))) {
595 "CAPI header: unknown channel id\n");
599 if (capi_decode_conn_actv_ind(chan, skb)) {
600 printk("error in capi_decode_conn_actv_ind\n");
601 /* pcbit_fsm_event(dev, chan, EV_ERROR, NULL); */
604 chan->r_refnum = refnum;
605 pcbit_fsm_event(dev, chan, EV_NET_CONN, NULL);
607 case MSG_CONN_ACTV_CONF:
609 if (!(chan = capi_channel(dev, skb))) {
611 "CAPI header: unknown channel id\n");
615 if (capi_decode_conn_actv_conf(chan, skb) == 0)
616 pcbit_fsm_event(dev, chan, EV_NET_CONN_ACK, NULL);
619 printk(KERN_DEBUG "decode_conn_actv_conf failed\n");
624 if (!(chan = capi_channel(dev, skb))) {
626 "CAPI header: unknown channel id\n");
630 if (!(err = capi_decode_sel_proto_conf(chan, skb)))
631 pcbit_fsm_event(dev, chan, EV_NET_SELP_RESP, NULL);
634 printk("error %d - capi_decode_sel_proto_conf\n", err);
637 case MSG_ACT_TRANSP_CONF:
638 if (!(chan = capi_channel(dev, skb))) {
640 "CAPI header: unknown channel id\n");
644 if (!capi_decode_actv_trans_conf(chan, skb))
645 pcbit_fsm_event(dev, chan, EV_NET_ACTV_RESP, NULL);
650 if (!(chan = capi_channel(dev, skb))) {
652 "CAPI header: unknown channel id\n");
656 if (!capi_decode_disc_ind(chan, skb))
657 pcbit_fsm_event(dev, chan, EV_NET_DISC, NULL);
659 printk(KERN_WARNING "capi_decode_disc_ind - error\n");
662 if (!(chan = capi_channel(dev, skb))) {
664 "CAPI header: unknown channel id\n");
668 if (!capi_decode_disc_ind(chan, skb))
669 pcbit_fsm_event(dev, chan, EV_NET_RELEASE, NULL);
671 printk(KERN_WARNING "capi_decode_disc_conf - error\n");
675 printk(KERN_DEBUG "received Info Indication - discarded\n");
680 capi_decode_debug_188(skb->data, skb->len);
684 printk(KERN_DEBUG "pcbit_l3_receive: unknown message %08lx\n",
696 * should be a statbuf per device
699 static char statbuf[STATBUF_LEN];
703 static int pcbit_stat(u_char __user *buf, int len, int driver, int channel)
706 stat_count = stat_end - stat_st;
709 stat_count = STATBUF_LEN - stat_st + stat_end;
711 /* FIXME: should we sleep and wait for more cookies ? */
712 if (len > stat_count)
715 if (stat_st < stat_end)
717 if (copy_to_user(buf, statbuf + stat_st, len))
723 if (len > STATBUF_LEN - stat_st)
725 if (copy_to_user(buf, statbuf + stat_st,
726 STATBUF_LEN - stat_st))
728 if (copy_to_user(buf, statbuf,
729 len - (STATBUF_LEN - stat_st)))
732 stat_st = len - (STATBUF_LEN - stat_st);
736 if (copy_to_user(buf, statbuf + stat_st, len))
741 if (stat_st == STATBUF_LEN)
746 if (stat_st == stat_end)
747 stat_st = stat_end = 0;
752 static void pcbit_logstat(struct pcbit_dev *dev, char *str)
757 for (i = stat_end; i < strlen(str); i++)
760 stat_end = (stat_end + 1) % STATBUF_LEN;
761 if (stat_end == stat_st)
762 stat_st = (stat_st + 1) % STATBUF_LEN;
765 ictl.command = ISDN_STAT_STAVAIL;
766 ictl.driver = dev->id;
767 ictl.arg = strlen(str);
768 dev->dev_if->statcallb(&ictl);
771 void pcbit_state_change(struct pcbit_dev *dev, struct pcbit_chan *chan,
772 unsigned short i, unsigned short ev, unsigned short f)
776 sprintf(buf, "change on device: %d channel:%d\n%s -> %s -> %s\n",
778 isdn_state_table[i], strisdnevent(ev), isdn_state_table[f]
785 pcbit_logstat(dev, buf);
788 static void set_running_timeout(unsigned long ptr)
790 struct pcbit_dev *dev;
793 printk(KERN_DEBUG "set_running_timeout\n");
795 dev = (struct pcbit_dev *) ptr;
797 dev->l2_state = L2_DOWN;
798 wake_up_interruptible(&dev->set_running_wq);
801 static int set_protocol_running(struct pcbit_dev *dev)
805 setup_timer(&dev->set_running_timer, &set_running_timeout, (ulong)dev);
809 dev->l2_state = L2_STARTING;
811 writeb((0x80U | ((dev->rcv_seq & 0x07) << 3) | (dev->send_seq & 0x07)),
812 dev->sh_mem + BANK4);
814 mod_timer(&dev->set_running_timer, jiffies + SET_RUN_TIMEOUT);
816 wait_event(dev->set_running_wq, dev->l2_state == L2_RUNNING ||
817 dev->l2_state == L2_DOWN);
819 del_timer(&dev->set_running_timer);
821 if (dev->l2_state == L2_RUNNING)
823 printk(KERN_DEBUG "pcbit: running\n");
825 dev->unack_seq = dev->send_seq;
827 dev->writeptr = dev->sh_mem;
828 dev->readptr = dev->sh_mem + BANK2;
830 /* tell the good news to the upper layer */
831 ctl.driver = dev->id;
832 ctl.command = ISDN_STAT_RUN;
834 dev->dev_if->statcallb(&ctl);
838 printk(KERN_DEBUG "pcbit: initialization failed\n");
839 printk(KERN_DEBUG "pcbit: firmware not loaded\n");
842 printk(KERN_DEBUG "Bank3 = %02x\n",
843 readb(dev->sh_mem + BANK3));
845 writeb(0x40, dev->sh_mem + BANK4);
847 /* warn the upper layer */
848 ctl.driver = dev->id;
849 ctl.command = ISDN_STAT_STOP;
851 dev->dev_if->statcallb(&ctl);
853 return -EL2HLT; /* Level 2 halted */
859 static int pcbit_ioctl(isdn_ctrl *ctl)
861 struct pcbit_dev *dev;
862 struct pcbit_ioctl *cmd;
864 dev = finddev(ctl->driver);
868 printk(KERN_DEBUG "pcbit_ioctl: unknown device\n");
872 cmd = (struct pcbit_ioctl *) ctl->parm.num;
875 case PCBIT_IOCTL_GETSTAT:
876 cmd->info.l2_status = dev->l2_state;
879 case PCBIT_IOCTL_STRLOAD:
880 if (dev->l2_state == L2_RUNNING)
883 dev->unack_seq = dev->send_seq = dev->rcv_seq = 0;
885 dev->writeptr = dev->sh_mem;
886 dev->readptr = dev->sh_mem + BANK2;
888 dev->l2_state = L2_LOADING;
891 case PCBIT_IOCTL_LWMODE:
892 if (dev->l2_state != L2_LOADING)
895 dev->l2_state = L2_LWMODE;
898 case PCBIT_IOCTL_FWMODE:
899 if (dev->l2_state == L2_RUNNING)
901 dev->loadptr = LOAD_ZONE_START;
902 dev->l2_state = L2_FWMODE;
905 case PCBIT_IOCTL_ENDLOAD:
906 if (dev->l2_state == L2_RUNNING)
908 dev->l2_state = L2_DOWN;
911 case PCBIT_IOCTL_SETBYTE:
912 if (dev->l2_state == L2_RUNNING)
916 if (cmd->info.rdp_byte.addr > BANK4)
919 writeb(cmd->info.rdp_byte.value, dev->sh_mem + cmd->info.rdp_byte.addr);
921 case PCBIT_IOCTL_GETBYTE:
922 if (dev->l2_state == L2_RUNNING)
927 if (cmd->info.rdp_byte.addr > BANK4)
929 printk("getbyte: invalid addr %04x\n", cmd->info.rdp_byte.addr);
933 cmd->info.rdp_byte.value = readb(dev->sh_mem + cmd->info.rdp_byte.addr);
935 case PCBIT_IOCTL_RUNNING:
936 if (dev->l2_state == L2_RUNNING)
938 return set_protocol_running(dev);
940 case PCBIT_IOCTL_WATCH188:
941 if (dev->l2_state != L2_LOADING)
943 pcbit_l2_write(dev, MSG_WATCH188, 0x0001, NULL, 0);
945 case PCBIT_IOCTL_PING188:
946 if (dev->l2_state != L2_LOADING)
948 pcbit_l2_write(dev, MSG_PING188_REQ, 0x0001, NULL, 0);
950 case PCBIT_IOCTL_APION:
951 if (dev->l2_state != L2_LOADING)
953 pcbit_l2_write(dev, MSG_API_ON, 0x0001, NULL, 0);
955 case PCBIT_IOCTL_STOP:
956 dev->l2_state = L2_DOWN;
957 writeb(0x40, dev->sh_mem + BANK4);
963 printk("error: unknown ioctl\n");
972 * if null reject all calls
973 * if first entry has null MSN accept all calls
976 static void pcbit_clear_msn(struct pcbit_dev *dev)
978 struct msn_entry *ptr, *back;
980 for (ptr = dev->msn_list; ptr;)
987 dev->msn_list = NULL;
990 static void pcbit_set_msn(struct pcbit_dev *dev, char *list)
992 struct msn_entry *ptr;
993 struct msn_entry *back = NULL;
997 if (strlen(list) == 0) {
998 ptr = kmalloc(sizeof(struct msn_entry), GFP_ATOMIC);
1000 printk(KERN_WARNING "kmalloc failed\n");
1006 ptr->next = dev->msn_list;
1007 dev->msn_list = ptr;
1013 for (back = dev->msn_list; back->next; back = back->next);
1018 cp = strchr(sp, ',');
1024 ptr = kmalloc(sizeof(struct msn_entry), GFP_ATOMIC);
1027 printk(KERN_WARNING "kmalloc failed\n");
1032 ptr->msn = kmalloc(len + 1, GFP_ATOMIC);
1034 printk(KERN_WARNING "kmalloc failed\n");
1039 memcpy(ptr->msn, sp, len);
1043 printk(KERN_DEBUG "msn: %s\n", ptr->msn);
1045 if (dev->msn_list == NULL)
1046 dev->msn_list = ptr;
1055 * check if we do signal or reject an incoming call
1057 static int pcbit_check_msn(struct pcbit_dev *dev, char *msn)
1059 struct msn_entry *ptr;
1061 for (ptr = dev->msn_list; ptr; ptr = ptr->next) {
1063 if (ptr->msn == NULL)
1066 if (strcmp(ptr->msn, msn) == 0)