blob: c62b8c564161b566995484470100de6773244467 [file] [log] [blame]
Inaky Perez-Gonzalezaa5a7ac2008-12-20 16:57:47 -08001/*
2 * Intel Wireless WiMAX Connection 2400m
3 * Handle incoming traffic and deliver it to the control or data planes
4 *
5 *
6 * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * * Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 * * Neither the name of Intel Corporation nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 *
35 * Intel Corporation <linux-wimax@intel.com>
36 * Yanir Lubetkin <yanirx.lubetkin@intel.com>
37 * - Initial implementation
38 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
39 * - Use skb_clone(), break up processing in chunks
40 * - Split transport/device specific
41 * - Make buffer size dynamic to exert less memory pressure
42 *
43 *
44 * This handles the RX path.
45 *
46 * We receive an RX message from the bus-specific driver, which
47 * contains one or more payloads that have potentially different
48 * destinataries (data or control paths).
49 *
50 * So we just take that payload from the transport specific code in
51 * the form of an skb, break it up in chunks (a cloned skb each in the
52 * case of network packets) and pass it to netdev or to the
53 * command/ack handler (and from there to the WiMAX stack).
54 *
55 * PROTOCOL FORMAT
56 *
57 * The format of the buffer is:
58 *
59 * HEADER (struct i2400m_msg_hdr)
60 * PAYLOAD DESCRIPTOR 0 (struct i2400m_pld)
61 * PAYLOAD DESCRIPTOR 1
62 * ...
63 * PAYLOAD DESCRIPTOR N
64 * PAYLOAD 0 (raw bytes)
65 * PAYLOAD 1
66 * ...
67 * PAYLOAD N
68 *
69 * See tx.c for a deeper description on alignment requirements and
70 * other fun facts of it.
71 *
72 * ROADMAP
73 *
74 * i2400m_rx
75 * i2400m_rx_msg_hdr_check
76 * i2400m_rx_pl_descr_check
77 * i2400m_rx_payload
78 * i2400m_net_rx
79 * i2400m_rx_ctl
80 * i2400m_msg_size_check
81 * i2400m_report_hook_work [in a workqueue]
82 * i2400m_report_hook
83 * wimax_msg_to_user
84 * i2400m_rx_ctl_ack
85 * wimax_msg_to_user_alloc
86 * i2400m_rx_trace
87 * i2400m_msg_size_check
88 * wimax_msg
89 */
90#include <linux/kernel.h>
91#include <linux/if_arp.h>
92#include <linux/netdevice.h>
93#include <linux/workqueue.h>
94#include "i2400m.h"
95
96
97#define D_SUBMODULE rx
98#include "debug-levels.h"
99
100struct i2400m_report_hook_args {
101 struct sk_buff *skb_rx;
102 const struct i2400m_l3l4_hdr *l3l4_hdr;
103 size_t size;
104};
105
106
107/*
108 * Execute i2400m_report_hook in a workqueue
109 *
110 * Unpacks arguments from the deferred call, executes it and then
111 * drops the references.
112 *
113 * Obvious NOTE: References are needed because we are a separate
114 * thread; otherwise the buffer changes under us because it is
115 * released by the original caller.
116 */
117static
118void i2400m_report_hook_work(struct work_struct *ws)
119{
120 struct i2400m_work *iw =
121 container_of(ws, struct i2400m_work, ws);
122 struct i2400m_report_hook_args *args = (void *) iw->pl;
123 i2400m_report_hook(iw->i2400m, args->l3l4_hdr, args->size);
124 kfree_skb(args->skb_rx);
125 i2400m_put(iw->i2400m);
126 kfree(iw);
127}
128
129
130/*
131 * Process an ack to a command
132 *
133 * @i2400m: device descriptor
134 * @payload: pointer to message
135 * @size: size of the message
136 *
137 * Pass the acknodledgment (in an skb) to the thread that is waiting
138 * for it in i2400m->msg_completion.
139 *
140 * We need to coordinate properly with the thread waiting for the
141 * ack. Check if it is waiting or if it is gone. We loose the spinlock
142 * to avoid allocating on atomic contexts (yeah, could use GFP_ATOMIC,
143 * but this is not so speed critical).
144 */
145static
146void i2400m_rx_ctl_ack(struct i2400m *i2400m,
147 const void *payload, size_t size)
148{
149 struct device *dev = i2400m_dev(i2400m);
150 struct wimax_dev *wimax_dev = &i2400m->wimax_dev;
151 unsigned long flags;
152 struct sk_buff *ack_skb;
153
154 /* Anyone waiting for an answer? */
155 spin_lock_irqsave(&i2400m->rx_lock, flags);
156 if (i2400m->ack_skb != ERR_PTR(-EINPROGRESS)) {
157 dev_err(dev, "Huh? reply to command with no waiters\n");
158 goto error_no_waiter;
159 }
160 spin_unlock_irqrestore(&i2400m->rx_lock, flags);
161
162 ack_skb = wimax_msg_alloc(wimax_dev, NULL, payload, size, GFP_KERNEL);
163
164 /* Check waiter didn't time out waiting for the answer... */
165 spin_lock_irqsave(&i2400m->rx_lock, flags);
166 if (i2400m->ack_skb != ERR_PTR(-EINPROGRESS)) {
167 d_printf(1, dev, "Huh? waiter for command reply cancelled\n");
168 goto error_waiter_cancelled;
169 }
170 if (ack_skb == NULL) {
171 dev_err(dev, "CMD/GET/SET ack: cannot allocate SKB\n");
172 i2400m->ack_skb = ERR_PTR(-ENOMEM);
173 } else
174 i2400m->ack_skb = ack_skb;
175 spin_unlock_irqrestore(&i2400m->rx_lock, flags);
176 complete(&i2400m->msg_completion);
177 return;
178
179error_waiter_cancelled:
Wei Yongjunc71a2692009-02-25 00:20:29 +0000180 kfree_skb(ack_skb);
Inaky Perez-Gonzalezaa5a7ac2008-12-20 16:57:47 -0800181error_no_waiter:
182 spin_unlock_irqrestore(&i2400m->rx_lock, flags);
183 return;
184}
185
186
187/*
188 * Receive and process a control payload
189 *
190 * @i2400m: device descriptor
191 * @skb_rx: skb that contains the payload (for reference counting)
192 * @payload: pointer to message
193 * @size: size of the message
194 *
195 * There are two types of control RX messages: reports (asynchronous,
196 * like your every day interrupts) and 'acks' (reponses to a command,
197 * get or set request).
198 *
199 * If it is a report, we run hooks on it (to extract information for
200 * things we need to do in the driver) and then pass it over to the
201 * WiMAX stack to send it to user space.
202 *
203 * NOTE: report processing is done in a workqueue specific to the
204 * generic driver, to avoid deadlocks in the system.
205 *
206 * If it is not a report, it is an ack to a previously executed
207 * command, set or get, so wake up whoever is waiting for it from
208 * i2400m_msg_to_dev(). i2400m_rx_ctl_ack() takes care of that.
209 *
210 * Note that the sizes we pass to other functions from here are the
211 * sizes of the _l3l4_hdr + payload, not full buffer sizes, as we have
212 * verified in _msg_size_check() that they are congruent.
213 *
214 * For reports: We can't clone the original skb where the data is
215 * because we need to send this up via netlink; netlink has to add
216 * headers and we can't overwrite what's preceeding the payload...as
217 * it is another message. So we just dup them.
218 */
219static
220void i2400m_rx_ctl(struct i2400m *i2400m, struct sk_buff *skb_rx,
221 const void *payload, size_t size)
222{
223 int result;
224 struct device *dev = i2400m_dev(i2400m);
225 const struct i2400m_l3l4_hdr *l3l4_hdr = payload;
226 unsigned msg_type;
227
228 result = i2400m_msg_size_check(i2400m, l3l4_hdr, size);
229 if (result < 0) {
230 dev_err(dev, "HW BUG? device sent a bad message: %d\n",
231 result);
232 goto error_check;
233 }
234 msg_type = le16_to_cpu(l3l4_hdr->type);
235 d_printf(1, dev, "%s 0x%04x: %zu bytes\n",
236 msg_type & I2400M_MT_REPORT_MASK ? "REPORT" : "CMD/SET/GET",
237 msg_type, size);
238 d_dump(2, dev, l3l4_hdr, size);
239 if (msg_type & I2400M_MT_REPORT_MASK) {
240 /* These hooks have to be ran serialized; as well, the
241 * handling might force the execution of commands, and
242 * that might cause reentrancy issues with
243 * bus-specific subdrivers and workqueues. So we run
244 * it in a separate workqueue. */
245 struct i2400m_report_hook_args args = {
246 .skb_rx = skb_rx,
247 .l3l4_hdr = l3l4_hdr,
248 .size = size
249 };
250 if (unlikely(i2400m->ready == 0)) /* only send if up */
251 return;
252 skb_get(skb_rx);
253 i2400m_queue_work(i2400m, i2400m_report_hook_work,
254 GFP_KERNEL, &args, sizeof(args));
255 result = wimax_msg(&i2400m->wimax_dev, NULL, l3l4_hdr, size,
256 GFP_KERNEL);
257 if (result < 0)
258 dev_err(dev, "error sending report to userspace: %d\n",
259 result);
260 } else /* an ack to a CMD, GET or SET */
261 i2400m_rx_ctl_ack(i2400m, payload, size);
262error_check:
263 return;
264}
265
266
267
268
269/*
270 * Receive and send up a trace
271 *
272 * @i2400m: device descriptor
273 * @skb_rx: skb that contains the trace (for reference counting)
274 * @payload: pointer to trace message inside the skb
275 * @size: size of the message
276 *
277 * THe i2400m might produce trace information (diagnostics) and we
278 * send them through a different kernel-to-user pipe (to avoid
279 * clogging it).
280 *
281 * As in i2400m_rx_ctl(), we can't clone the original skb where the
282 * data is because we need to send this up via netlink; netlink has to
283 * add headers and we can't overwrite what's preceeding the
284 * payload...as it is another message. So we just dup them.
285 */
286static
287void i2400m_rx_trace(struct i2400m *i2400m,
288 const void *payload, size_t size)
289{
290 int result;
291 struct device *dev = i2400m_dev(i2400m);
292 struct wimax_dev *wimax_dev = &i2400m->wimax_dev;
293 const struct i2400m_l3l4_hdr *l3l4_hdr = payload;
294 unsigned msg_type;
295
296 result = i2400m_msg_size_check(i2400m, l3l4_hdr, size);
297 if (result < 0) {
298 dev_err(dev, "HW BUG? device sent a bad trace message: %d\n",
299 result);
300 goto error_check;
301 }
302 msg_type = le16_to_cpu(l3l4_hdr->type);
303 d_printf(1, dev, "Trace %s 0x%04x: %zu bytes\n",
304 msg_type & I2400M_MT_REPORT_MASK ? "REPORT" : "CMD/SET/GET",
305 msg_type, size);
306 d_dump(2, dev, l3l4_hdr, size);
307 if (unlikely(i2400m->ready == 0)) /* only send if up */
308 return;
309 result = wimax_msg(wimax_dev, "trace", l3l4_hdr, size, GFP_KERNEL);
310 if (result < 0)
311 dev_err(dev, "error sending trace to userspace: %d\n",
312 result);
313error_check:
314 return;
315}
316
317
318/*
319 * Act on a received payload
320 *
321 * @i2400m: device instance
322 * @skb_rx: skb where the transaction was received
323 * @single: 1 if there is only one payload, 0 otherwise
324 * @pld: payload descriptor
325 * @payload: payload data
326 *
327 * Upon reception of a payload, look at its guts in the payload
328 * descriptor and decide what to do with it.
329 */
330static
331void i2400m_rx_payload(struct i2400m *i2400m, struct sk_buff *skb_rx,
332 unsigned single, const struct i2400m_pld *pld,
333 const void *payload)
334{
335 struct device *dev = i2400m_dev(i2400m);
336 size_t pl_size = i2400m_pld_size(pld);
337 enum i2400m_pt pl_type = i2400m_pld_type(pld);
338
339 switch (pl_type) {
340 case I2400M_PT_DATA:
341 d_printf(3, dev, "RX: data payload %zu bytes\n", pl_size);
342 i2400m_net_rx(i2400m, skb_rx, single, payload, pl_size);
343 break;
344 case I2400M_PT_CTRL:
345 i2400m_rx_ctl(i2400m, skb_rx, payload, pl_size);
346 break;
347 case I2400M_PT_TRACE:
348 i2400m_rx_trace(i2400m, payload, pl_size);
349 break;
350 default: /* Anything else shouldn't come to the host */
351 if (printk_ratelimit())
352 dev_err(dev, "RX: HW BUG? unexpected payload type %u\n",
353 pl_type);
354 }
355}
356
357
358/*
359 * Check a received transaction's message header
360 *
361 * @i2400m: device descriptor
362 * @msg_hdr: message header
363 * @buf_size: size of the received buffer
364 *
365 * Check that the declarations done by a RX buffer message header are
366 * sane and consistent with the amount of data that was received.
367 */
368static
369int i2400m_rx_msg_hdr_check(struct i2400m *i2400m,
370 const struct i2400m_msg_hdr *msg_hdr,
371 size_t buf_size)
372{
373 int result = -EIO;
374 struct device *dev = i2400m_dev(i2400m);
375 if (buf_size < sizeof(*msg_hdr)) {
376 dev_err(dev, "RX: HW BUG? message with short header (%zu "
377 "vs %zu bytes expected)\n", buf_size, sizeof(*msg_hdr));
378 goto error;
379 }
380 if (msg_hdr->barker != cpu_to_le32(I2400M_D2H_MSG_BARKER)) {
381 dev_err(dev, "RX: HW BUG? message received with unknown "
382 "barker 0x%08x (buf_size %zu bytes)\n",
383 le32_to_cpu(msg_hdr->barker), buf_size);
384 goto error;
385 }
386 if (msg_hdr->num_pls == 0) {
387 dev_err(dev, "RX: HW BUG? zero payload packets in message\n");
388 goto error;
389 }
390 if (le16_to_cpu(msg_hdr->num_pls) > I2400M_MAX_PLS_IN_MSG) {
391 dev_err(dev, "RX: HW BUG? message contains more payload "
392 "than maximum; ignoring.\n");
393 goto error;
394 }
395 result = 0;
396error:
397 return result;
398}
399
400
401/*
402 * Check a payload descriptor against the received data
403 *
404 * @i2400m: device descriptor
405 * @pld: payload descriptor
406 * @pl_itr: offset (in bytes) in the received buffer the payload is
407 * located
408 * @buf_size: size of the received buffer
409 *
410 * Given a payload descriptor (part of a RX buffer), check it is sane
411 * and that the data it declares fits in the buffer.
412 */
413static
414int i2400m_rx_pl_descr_check(struct i2400m *i2400m,
415 const struct i2400m_pld *pld,
416 size_t pl_itr, size_t buf_size)
417{
418 int result = -EIO;
419 struct device *dev = i2400m_dev(i2400m);
420 size_t pl_size = i2400m_pld_size(pld);
421 enum i2400m_pt pl_type = i2400m_pld_type(pld);
422
423 if (pl_size > i2400m->bus_pl_size_max) {
424 dev_err(dev, "RX: HW BUG? payload @%zu: size %zu is "
425 "bigger than maximum %zu; ignoring message\n",
426 pl_itr, pl_size, i2400m->bus_pl_size_max);
427 goto error;
428 }
429 if (pl_itr + pl_size > buf_size) { /* enough? */
430 dev_err(dev, "RX: HW BUG? payload @%zu: size %zu "
431 "goes beyond the received buffer "
432 "size (%zu bytes); ignoring message\n",
433 pl_itr, pl_size, buf_size);
434 goto error;
435 }
436 if (pl_type >= I2400M_PT_ILLEGAL) {
437 dev_err(dev, "RX: HW BUG? illegal payload type %u; "
438 "ignoring message\n", pl_type);
439 goto error;
440 }
441 result = 0;
442error:
443 return result;
444}
445
446
447/**
448 * i2400m_rx - Receive a buffer of data from the device
449 *
450 * @i2400m: device descriptor
451 * @skb: skbuff where the data has been received
452 *
453 * Parse in a buffer of data that contains an RX message sent from the
454 * device. See the file header for the format. Run all checks on the
455 * buffer header, then run over each payload's descriptors, verify
456 * their consistency and act on each payload's contents. If
457 * everything is succesful, update the device's statistics.
458 *
459 * Note: You need to set the skb to contain only the length of the
460 * received buffer; for that, use skb_trim(skb, RECEIVED_SIZE).
461 *
462 * Returns:
463 *
464 * 0 if ok, < 0 errno on error
465 *
466 * If ok, this function owns now the skb and the caller DOESN'T have
467 * to run kfree_skb() on it. However, on error, the caller still owns
468 * the skb and it is responsible for releasing it.
469 */
470int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
471{
472 int i, result;
473 struct device *dev = i2400m_dev(i2400m);
474 const struct i2400m_msg_hdr *msg_hdr;
475 size_t pl_itr, pl_size, skb_len;
476 unsigned long flags;
477 unsigned num_pls;
478
479 skb_len = skb->len;
480 d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
481 i2400m, skb, skb_len);
482 result = -EIO;
483 msg_hdr = (void *) skb->data;
484 result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
485 if (result < 0)
486 goto error_msg_hdr_check;
487 result = -EIO;
488 num_pls = le16_to_cpu(msg_hdr->num_pls);
489 pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */
490 num_pls * sizeof(msg_hdr->pld[0]);
491 pl_itr = ALIGN(pl_itr, I2400M_PL_PAD);
492 if (pl_itr > skb->len) { /* got all the payload descriptors? */
493 dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
494 "%u payload descriptors (%zu each, total %zu)\n",
495 skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
496 goto error_pl_descr_short;
497 }
498 /* Walk each payload payload--check we really got it */
499 for (i = 0; i < num_pls; i++) {
500 /* work around old gcc warnings */
501 pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
502 result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
503 pl_itr, skb->len);
504 if (result < 0)
505 goto error_pl_descr_check;
506 i2400m_rx_payload(i2400m, skb, num_pls == 1, &msg_hdr->pld[i],
507 skb->data + pl_itr);
508 pl_itr += ALIGN(pl_size, I2400M_PL_PAD);
509 cond_resched(); /* Don't monopolize */
510 }
511 kfree_skb(skb);
512 /* Update device statistics */
513 spin_lock_irqsave(&i2400m->rx_lock, flags);
514 i2400m->rx_pl_num += i;
515 if (i > i2400m->rx_pl_max)
516 i2400m->rx_pl_max = i;
517 if (i < i2400m->rx_pl_min)
518 i2400m->rx_pl_min = i;
519 i2400m->rx_num++;
520 i2400m->rx_size_acc += skb->len;
521 if (skb->len < i2400m->rx_size_min)
522 i2400m->rx_size_min = skb->len;
523 if (skb->len > i2400m->rx_size_max)
524 i2400m->rx_size_max = skb->len;
525 spin_unlock_irqrestore(&i2400m->rx_lock, flags);
526error_pl_descr_check:
527error_pl_descr_short:
528error_msg_hdr_check:
529 d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
530 i2400m, skb, skb_len, result);
531 return result;
532}
533EXPORT_SYMBOL_GPL(i2400m_rx);