Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Intel Wireless WiMAX Connection 2400m |
| 3 | * Handle incoming traffic and deliver it to the control or data planes |
| 4 | * |
| 5 | * |
| 6 | * Copyright (C) 2007-2008 Intel Corporation. All rights reserved. |
| 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions |
| 10 | * are met: |
| 11 | * |
| 12 | * * Redistributions of source code must retain the above copyright |
| 13 | * notice, this list of conditions and the following disclaimer. |
| 14 | * * Redistributions in binary form must reproduce the above copyright |
| 15 | * notice, this list of conditions and the following disclaimer in |
| 16 | * the documentation and/or other materials provided with the |
| 17 | * distribution. |
| 18 | * * Neither the name of Intel Corporation nor the names of its |
| 19 | * contributors may be used to endorse or promote products derived |
| 20 | * from this software without specific prior written permission. |
| 21 | * |
| 22 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 23 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 24 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 25 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| 26 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 27 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| 28 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 29 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 30 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 31 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 32 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 33 | * |
| 34 | * |
| 35 | * Intel Corporation <linux-wimax@intel.com> |
| 36 | * Yanir Lubetkin <yanirx.lubetkin@intel.com> |
| 37 | * - Initial implementation |
| 38 | * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> |
| 39 | * - Use skb_clone(), break up processing in chunks |
| 40 | * - Split transport/device specific |
| 41 | * - Make buffer size dynamic to exert less memory pressure |
| 42 | * |
| 43 | * |
| 44 | * This handles the RX path. |
| 45 | * |
| 46 | * We receive an RX message from the bus-specific driver, which |
| 47 | * contains one or more payloads that have potentially different |
| 48 | * destinataries (data or control paths). |
| 49 | * |
| 50 | * So we just take that payload from the transport specific code in |
| 51 | * the form of an skb, break it up in chunks (a cloned skb each in the |
| 52 | * case of network packets) and pass it to netdev or to the |
| 53 | * command/ack handler (and from there to the WiMAX stack). |
| 54 | * |
| 55 | * PROTOCOL FORMAT |
| 56 | * |
| 57 | * The format of the buffer is: |
| 58 | * |
| 59 | * HEADER (struct i2400m_msg_hdr) |
| 60 | * PAYLOAD DESCRIPTOR 0 (struct i2400m_pld) |
| 61 | * PAYLOAD DESCRIPTOR 1 |
| 62 | * ... |
| 63 | * PAYLOAD DESCRIPTOR N |
| 64 | * PAYLOAD 0 (raw bytes) |
| 65 | * PAYLOAD 1 |
| 66 | * ... |
| 67 | * PAYLOAD N |
| 68 | * |
| 69 | * See tx.c for a deeper description on alignment requirements and |
| 70 | * other fun facts of it. |
| 71 | * |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 72 | * DATA PACKETS |
| 73 | * |
| 74 | * In firmwares <= v1.3, data packets have no header for RX, but they |
| 75 | * do for TX (currently unused). |
| 76 | * |
| 77 | * In firmware >= 1.4, RX packets have an extended header (16 |
| 78 | * bytes). This header conveys information for management of host |
| 79 | * reordering of packets (the device offloads storage of the packets |
| 80 | * for reordering to the host). |
| 81 | * |
| 82 | * Currently this information is not used as the current code doesn't |
| 83 | * enable host reordering. |
| 84 | * |
| 85 | * The header is used as dummy space to emulate an ethernet header and |
| 86 | * thus be able to act as an ethernet device without having to reallocate. |
| 87 | * |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 88 | * ROADMAP |
| 89 | * |
| 90 | * i2400m_rx |
| 91 | * i2400m_rx_msg_hdr_check |
| 92 | * i2400m_rx_pl_descr_check |
| 93 | * i2400m_rx_payload |
| 94 | * i2400m_net_rx |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 95 | * i2400m_rx_edata |
| 96 | * i2400m_net_erx |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 97 | * i2400m_rx_ctl |
| 98 | * i2400m_msg_size_check |
| 99 | * i2400m_report_hook_work [in a workqueue] |
| 100 | * i2400m_report_hook |
| 101 | * wimax_msg_to_user |
| 102 | * i2400m_rx_ctl_ack |
| 103 | * wimax_msg_to_user_alloc |
| 104 | * i2400m_rx_trace |
| 105 | * i2400m_msg_size_check |
| 106 | * wimax_msg |
| 107 | */ |
| 108 | #include <linux/kernel.h> |
| 109 | #include <linux/if_arp.h> |
| 110 | #include <linux/netdevice.h> |
| 111 | #include <linux/workqueue.h> |
| 112 | #include "i2400m.h" |
| 113 | |
| 114 | |
| 115 | #define D_SUBMODULE rx |
| 116 | #include "debug-levels.h" |
| 117 | |
| 118 | struct i2400m_report_hook_args { |
| 119 | struct sk_buff *skb_rx; |
| 120 | const struct i2400m_l3l4_hdr *l3l4_hdr; |
| 121 | size_t size; |
| 122 | }; |
| 123 | |
| 124 | |
| 125 | /* |
| 126 | * Execute i2400m_report_hook in a workqueue |
| 127 | * |
| 128 | * Unpacks arguments from the deferred call, executes it and then |
| 129 | * drops the references. |
| 130 | * |
| 131 | * Obvious NOTE: References are needed because we are a separate |
| 132 | * thread; otherwise the buffer changes under us because it is |
| 133 | * released by the original caller. |
| 134 | */ |
| 135 | static |
| 136 | void i2400m_report_hook_work(struct work_struct *ws) |
| 137 | { |
| 138 | struct i2400m_work *iw = |
| 139 | container_of(ws, struct i2400m_work, ws); |
| 140 | struct i2400m_report_hook_args *args = (void *) iw->pl; |
| 141 | i2400m_report_hook(iw->i2400m, args->l3l4_hdr, args->size); |
| 142 | kfree_skb(args->skb_rx); |
| 143 | i2400m_put(iw->i2400m); |
| 144 | kfree(iw); |
| 145 | } |
| 146 | |
| 147 | |
| 148 | /* |
| 149 | * Process an ack to a command |
| 150 | * |
| 151 | * @i2400m: device descriptor |
| 152 | * @payload: pointer to message |
| 153 | * @size: size of the message |
| 154 | * |
| 155 | * Pass the acknodledgment (in an skb) to the thread that is waiting |
| 156 | * for it in i2400m->msg_completion. |
| 157 | * |
| 158 | * We need to coordinate properly with the thread waiting for the |
| 159 | * ack. Check if it is waiting or if it is gone. We loose the spinlock |
| 160 | * to avoid allocating on atomic contexts (yeah, could use GFP_ATOMIC, |
| 161 | * but this is not so speed critical). |
| 162 | */ |
| 163 | static |
| 164 | void i2400m_rx_ctl_ack(struct i2400m *i2400m, |
| 165 | const void *payload, size_t size) |
| 166 | { |
| 167 | struct device *dev = i2400m_dev(i2400m); |
| 168 | struct wimax_dev *wimax_dev = &i2400m->wimax_dev; |
| 169 | unsigned long flags; |
| 170 | struct sk_buff *ack_skb; |
| 171 | |
| 172 | /* Anyone waiting for an answer? */ |
| 173 | spin_lock_irqsave(&i2400m->rx_lock, flags); |
| 174 | if (i2400m->ack_skb != ERR_PTR(-EINPROGRESS)) { |
| 175 | dev_err(dev, "Huh? reply to command with no waiters\n"); |
| 176 | goto error_no_waiter; |
| 177 | } |
| 178 | spin_unlock_irqrestore(&i2400m->rx_lock, flags); |
| 179 | |
| 180 | ack_skb = wimax_msg_alloc(wimax_dev, NULL, payload, size, GFP_KERNEL); |
| 181 | |
| 182 | /* Check waiter didn't time out waiting for the answer... */ |
| 183 | spin_lock_irqsave(&i2400m->rx_lock, flags); |
| 184 | if (i2400m->ack_skb != ERR_PTR(-EINPROGRESS)) { |
| 185 | d_printf(1, dev, "Huh? waiter for command reply cancelled\n"); |
| 186 | goto error_waiter_cancelled; |
| 187 | } |
| 188 | if (ack_skb == NULL) { |
| 189 | dev_err(dev, "CMD/GET/SET ack: cannot allocate SKB\n"); |
| 190 | i2400m->ack_skb = ERR_PTR(-ENOMEM); |
| 191 | } else |
| 192 | i2400m->ack_skb = ack_skb; |
| 193 | spin_unlock_irqrestore(&i2400m->rx_lock, flags); |
| 194 | complete(&i2400m->msg_completion); |
| 195 | return; |
| 196 | |
| 197 | error_waiter_cancelled: |
Wei Yongjun | c71a269 | 2009-02-25 00:20:29 +0000 | [diff] [blame] | 198 | kfree_skb(ack_skb); |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 199 | error_no_waiter: |
| 200 | spin_unlock_irqrestore(&i2400m->rx_lock, flags); |
| 201 | return; |
| 202 | } |
| 203 | |
| 204 | |
| 205 | /* |
| 206 | * Receive and process a control payload |
| 207 | * |
| 208 | * @i2400m: device descriptor |
| 209 | * @skb_rx: skb that contains the payload (for reference counting) |
| 210 | * @payload: pointer to message |
| 211 | * @size: size of the message |
| 212 | * |
| 213 | * There are two types of control RX messages: reports (asynchronous, |
| 214 | * like your every day interrupts) and 'acks' (reponses to a command, |
| 215 | * get or set request). |
| 216 | * |
| 217 | * If it is a report, we run hooks on it (to extract information for |
| 218 | * things we need to do in the driver) and then pass it over to the |
| 219 | * WiMAX stack to send it to user space. |
| 220 | * |
| 221 | * NOTE: report processing is done in a workqueue specific to the |
| 222 | * generic driver, to avoid deadlocks in the system. |
| 223 | * |
| 224 | * If it is not a report, it is an ack to a previously executed |
| 225 | * command, set or get, so wake up whoever is waiting for it from |
| 226 | * i2400m_msg_to_dev(). i2400m_rx_ctl_ack() takes care of that. |
| 227 | * |
| 228 | * Note that the sizes we pass to other functions from here are the |
| 229 | * sizes of the _l3l4_hdr + payload, not full buffer sizes, as we have |
| 230 | * verified in _msg_size_check() that they are congruent. |
| 231 | * |
| 232 | * For reports: We can't clone the original skb where the data is |
| 233 | * because we need to send this up via netlink; netlink has to add |
| 234 | * headers and we can't overwrite what's preceeding the payload...as |
| 235 | * it is another message. So we just dup them. |
| 236 | */ |
| 237 | static |
| 238 | void i2400m_rx_ctl(struct i2400m *i2400m, struct sk_buff *skb_rx, |
| 239 | const void *payload, size_t size) |
| 240 | { |
| 241 | int result; |
| 242 | struct device *dev = i2400m_dev(i2400m); |
| 243 | const struct i2400m_l3l4_hdr *l3l4_hdr = payload; |
| 244 | unsigned msg_type; |
| 245 | |
| 246 | result = i2400m_msg_size_check(i2400m, l3l4_hdr, size); |
| 247 | if (result < 0) { |
| 248 | dev_err(dev, "HW BUG? device sent a bad message: %d\n", |
| 249 | result); |
| 250 | goto error_check; |
| 251 | } |
| 252 | msg_type = le16_to_cpu(l3l4_hdr->type); |
| 253 | d_printf(1, dev, "%s 0x%04x: %zu bytes\n", |
| 254 | msg_type & I2400M_MT_REPORT_MASK ? "REPORT" : "CMD/SET/GET", |
| 255 | msg_type, size); |
| 256 | d_dump(2, dev, l3l4_hdr, size); |
| 257 | if (msg_type & I2400M_MT_REPORT_MASK) { |
| 258 | /* These hooks have to be ran serialized; as well, the |
| 259 | * handling might force the execution of commands, and |
| 260 | * that might cause reentrancy issues with |
| 261 | * bus-specific subdrivers and workqueues. So we run |
| 262 | * it in a separate workqueue. */ |
| 263 | struct i2400m_report_hook_args args = { |
| 264 | .skb_rx = skb_rx, |
| 265 | .l3l4_hdr = l3l4_hdr, |
| 266 | .size = size |
| 267 | }; |
| 268 | if (unlikely(i2400m->ready == 0)) /* only send if up */ |
| 269 | return; |
| 270 | skb_get(skb_rx); |
| 271 | i2400m_queue_work(i2400m, i2400m_report_hook_work, |
| 272 | GFP_KERNEL, &args, sizeof(args)); |
| 273 | result = wimax_msg(&i2400m->wimax_dev, NULL, l3l4_hdr, size, |
| 274 | GFP_KERNEL); |
| 275 | if (result < 0) |
| 276 | dev_err(dev, "error sending report to userspace: %d\n", |
| 277 | result); |
| 278 | } else /* an ack to a CMD, GET or SET */ |
| 279 | i2400m_rx_ctl_ack(i2400m, payload, size); |
| 280 | error_check: |
| 281 | return; |
| 282 | } |
| 283 | |
| 284 | |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 285 | /* |
| 286 | * Receive and send up a trace |
| 287 | * |
| 288 | * @i2400m: device descriptor |
| 289 | * @skb_rx: skb that contains the trace (for reference counting) |
| 290 | * @payload: pointer to trace message inside the skb |
| 291 | * @size: size of the message |
| 292 | * |
| 293 | * THe i2400m might produce trace information (diagnostics) and we |
| 294 | * send them through a different kernel-to-user pipe (to avoid |
| 295 | * clogging it). |
| 296 | * |
| 297 | * As in i2400m_rx_ctl(), we can't clone the original skb where the |
| 298 | * data is because we need to send this up via netlink; netlink has to |
| 299 | * add headers and we can't overwrite what's preceeding the |
| 300 | * payload...as it is another message. So we just dup them. |
| 301 | */ |
| 302 | static |
| 303 | void i2400m_rx_trace(struct i2400m *i2400m, |
| 304 | const void *payload, size_t size) |
| 305 | { |
| 306 | int result; |
| 307 | struct device *dev = i2400m_dev(i2400m); |
| 308 | struct wimax_dev *wimax_dev = &i2400m->wimax_dev; |
| 309 | const struct i2400m_l3l4_hdr *l3l4_hdr = payload; |
| 310 | unsigned msg_type; |
| 311 | |
| 312 | result = i2400m_msg_size_check(i2400m, l3l4_hdr, size); |
| 313 | if (result < 0) { |
| 314 | dev_err(dev, "HW BUG? device sent a bad trace message: %d\n", |
| 315 | result); |
| 316 | goto error_check; |
| 317 | } |
| 318 | msg_type = le16_to_cpu(l3l4_hdr->type); |
| 319 | d_printf(1, dev, "Trace %s 0x%04x: %zu bytes\n", |
| 320 | msg_type & I2400M_MT_REPORT_MASK ? "REPORT" : "CMD/SET/GET", |
| 321 | msg_type, size); |
| 322 | d_dump(2, dev, l3l4_hdr, size); |
| 323 | if (unlikely(i2400m->ready == 0)) /* only send if up */ |
| 324 | return; |
| 325 | result = wimax_msg(wimax_dev, "trace", l3l4_hdr, size, GFP_KERNEL); |
| 326 | if (result < 0) |
| 327 | dev_err(dev, "error sending trace to userspace: %d\n", |
| 328 | result); |
| 329 | error_check: |
| 330 | return; |
| 331 | } |
| 332 | |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 333 | /* |
| 334 | * Receive and send up an extended data packet |
| 335 | * |
| 336 | * @i2400m: device descriptor |
| 337 | * @skb_rx: skb that contains the extended data packet |
| 338 | * @single_last: 1 if the payload is the only one or the last one of |
| 339 | * the skb. |
| 340 | * @payload: pointer to the packet's data inside the skb |
| 341 | * @size: size of the payload |
| 342 | * |
| 343 | * Starting in v1.4 of the i2400m's firmware, the device can send data |
| 344 | * packets to the host in an extended format that; this incudes a 16 |
| 345 | * byte header (struct i2400m_pl_edata_hdr). Using this header's space |
| 346 | * we can fake ethernet headers for ethernet device emulation without |
| 347 | * having to copy packets around. |
| 348 | * |
| 349 | * This function handles said path. |
| 350 | */ |
| 351 | static |
| 352 | void i2400m_rx_edata(struct i2400m *i2400m, struct sk_buff *skb_rx, |
| 353 | unsigned single_last, const void *payload, size_t size) |
| 354 | { |
| 355 | struct device *dev = i2400m_dev(i2400m); |
| 356 | const struct i2400m_pl_edata_hdr *hdr = payload; |
| 357 | struct net_device *net_dev = i2400m->wimax_dev.net_dev; |
| 358 | struct sk_buff *skb; |
| 359 | enum i2400m_cs cs; |
| 360 | unsigned reorder_needed; |
| 361 | |
| 362 | d_fnstart(4, dev, "(i2400m %p skb_rx %p single %u payload %p " |
| 363 | "size %zu)\n", i2400m, skb_rx, single_last, payload, size); |
| 364 | if (size < sizeof(*hdr)) { |
| 365 | dev_err(dev, "ERX: HW BUG? message with short header (%zu " |
| 366 | "vs %zu bytes expected)\n", size, sizeof(*hdr)); |
| 367 | goto error; |
| 368 | } |
| 369 | reorder_needed = le32_to_cpu(hdr->reorder & I2400M_REORDER_NEEDED); |
| 370 | cs = hdr->cs; |
| 371 | if (reorder_needed) { |
| 372 | dev_err(dev, "ERX: HW BUG? reorder needed, it was disabled\n"); |
| 373 | goto error; |
| 374 | } |
| 375 | /* ok, so now decide if we want to clone or reuse the skb, |
| 376 | * pull and trim it so the beginning is the space for the eth |
| 377 | * header and pass it to i2400m_net_erx() for the stack */ |
| 378 | if (single_last) { |
| 379 | skb = skb_get(skb_rx); |
| 380 | d_printf(3, dev, "ERX: reusing single payload skb %p\n", skb); |
| 381 | } else { |
| 382 | skb = skb_clone(skb_rx, GFP_KERNEL); |
| 383 | d_printf(3, dev, "ERX: cloning %p\n", skb); |
| 384 | if (skb == NULL) { |
| 385 | dev_err(dev, "ERX: no memory to clone skb\n"); |
| 386 | net_dev->stats.rx_dropped++; |
| 387 | goto error_skb_clone; |
| 388 | } |
| 389 | } |
| 390 | /* now we have to pull and trim so that the skb points to the |
| 391 | * beginning of the IP packet; the netdev part will add the |
| 392 | * ethernet header as needed. */ |
| 393 | BUILD_BUG_ON(ETH_HLEN > sizeof(*hdr)); |
| 394 | skb_pull(skb, payload + sizeof(*hdr) - (void *) skb->data); |
| 395 | skb_trim(skb, (void *) skb_end_pointer(skb) - payload + sizeof(*hdr)); |
| 396 | i2400m_net_erx(i2400m, skb, cs); |
| 397 | error_skb_clone: |
| 398 | error: |
| 399 | d_fnend(4, dev, "(i2400m %p skb_rx %p single %u payload %p " |
| 400 | "size %zu) = void\n", i2400m, skb_rx, single_last, payload, size); |
| 401 | return; |
| 402 | } |
| 403 | |
| 404 | |
| 405 | |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 406 | |
| 407 | /* |
| 408 | * Act on a received payload |
| 409 | * |
| 410 | * @i2400m: device instance |
| 411 | * @skb_rx: skb where the transaction was received |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 412 | * @single_last: 1 this is the only payload or the last one (so the |
| 413 | * skb can be reused instead of cloned). |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 414 | * @pld: payload descriptor |
| 415 | * @payload: payload data |
| 416 | * |
| 417 | * Upon reception of a payload, look at its guts in the payload |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 418 | * descriptor and decide what to do with it. If it is a single payload |
| 419 | * skb or if the last skb is a data packet, the skb will be referenced |
| 420 | * and modified (so it doesn't have to be cloned). |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 421 | */ |
| 422 | static |
| 423 | void i2400m_rx_payload(struct i2400m *i2400m, struct sk_buff *skb_rx, |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 424 | unsigned single_last, const struct i2400m_pld *pld, |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 425 | const void *payload) |
| 426 | { |
| 427 | struct device *dev = i2400m_dev(i2400m); |
| 428 | size_t pl_size = i2400m_pld_size(pld); |
| 429 | enum i2400m_pt pl_type = i2400m_pld_type(pld); |
| 430 | |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 431 | d_printf(7, dev, "RX: received payload type %u, %zu bytes\n", |
| 432 | pl_type, pl_size); |
| 433 | d_dump(8, dev, payload, pl_size); |
| 434 | |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 435 | switch (pl_type) { |
| 436 | case I2400M_PT_DATA: |
| 437 | d_printf(3, dev, "RX: data payload %zu bytes\n", pl_size); |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 438 | i2400m_net_rx(i2400m, skb_rx, single_last, payload, pl_size); |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 439 | break; |
| 440 | case I2400M_PT_CTRL: |
| 441 | i2400m_rx_ctl(i2400m, skb_rx, payload, pl_size); |
| 442 | break; |
| 443 | case I2400M_PT_TRACE: |
| 444 | i2400m_rx_trace(i2400m, payload, pl_size); |
| 445 | break; |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 446 | case I2400M_PT_EDATA: |
| 447 | d_printf(3, dev, "ERX: data payload %zu bytes\n", pl_size); |
| 448 | i2400m_rx_edata(i2400m, skb_rx, single_last, payload, pl_size); |
| 449 | break; |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 450 | default: /* Anything else shouldn't come to the host */ |
| 451 | if (printk_ratelimit()) |
| 452 | dev_err(dev, "RX: HW BUG? unexpected payload type %u\n", |
| 453 | pl_type); |
| 454 | } |
| 455 | } |
| 456 | |
| 457 | |
| 458 | /* |
| 459 | * Check a received transaction's message header |
| 460 | * |
| 461 | * @i2400m: device descriptor |
| 462 | * @msg_hdr: message header |
| 463 | * @buf_size: size of the received buffer |
| 464 | * |
| 465 | * Check that the declarations done by a RX buffer message header are |
| 466 | * sane and consistent with the amount of data that was received. |
| 467 | */ |
| 468 | static |
| 469 | int i2400m_rx_msg_hdr_check(struct i2400m *i2400m, |
| 470 | const struct i2400m_msg_hdr *msg_hdr, |
| 471 | size_t buf_size) |
| 472 | { |
| 473 | int result = -EIO; |
| 474 | struct device *dev = i2400m_dev(i2400m); |
| 475 | if (buf_size < sizeof(*msg_hdr)) { |
| 476 | dev_err(dev, "RX: HW BUG? message with short header (%zu " |
| 477 | "vs %zu bytes expected)\n", buf_size, sizeof(*msg_hdr)); |
| 478 | goto error; |
| 479 | } |
| 480 | if (msg_hdr->barker != cpu_to_le32(I2400M_D2H_MSG_BARKER)) { |
| 481 | dev_err(dev, "RX: HW BUG? message received with unknown " |
| 482 | "barker 0x%08x (buf_size %zu bytes)\n", |
| 483 | le32_to_cpu(msg_hdr->barker), buf_size); |
| 484 | goto error; |
| 485 | } |
| 486 | if (msg_hdr->num_pls == 0) { |
| 487 | dev_err(dev, "RX: HW BUG? zero payload packets in message\n"); |
| 488 | goto error; |
| 489 | } |
| 490 | if (le16_to_cpu(msg_hdr->num_pls) > I2400M_MAX_PLS_IN_MSG) { |
| 491 | dev_err(dev, "RX: HW BUG? message contains more payload " |
| 492 | "than maximum; ignoring.\n"); |
| 493 | goto error; |
| 494 | } |
| 495 | result = 0; |
| 496 | error: |
| 497 | return result; |
| 498 | } |
| 499 | |
| 500 | |
| 501 | /* |
| 502 | * Check a payload descriptor against the received data |
| 503 | * |
| 504 | * @i2400m: device descriptor |
| 505 | * @pld: payload descriptor |
| 506 | * @pl_itr: offset (in bytes) in the received buffer the payload is |
| 507 | * located |
| 508 | * @buf_size: size of the received buffer |
| 509 | * |
| 510 | * Given a payload descriptor (part of a RX buffer), check it is sane |
| 511 | * and that the data it declares fits in the buffer. |
| 512 | */ |
| 513 | static |
| 514 | int i2400m_rx_pl_descr_check(struct i2400m *i2400m, |
| 515 | const struct i2400m_pld *pld, |
| 516 | size_t pl_itr, size_t buf_size) |
| 517 | { |
| 518 | int result = -EIO; |
| 519 | struct device *dev = i2400m_dev(i2400m); |
| 520 | size_t pl_size = i2400m_pld_size(pld); |
| 521 | enum i2400m_pt pl_type = i2400m_pld_type(pld); |
| 522 | |
| 523 | if (pl_size > i2400m->bus_pl_size_max) { |
| 524 | dev_err(dev, "RX: HW BUG? payload @%zu: size %zu is " |
| 525 | "bigger than maximum %zu; ignoring message\n", |
| 526 | pl_itr, pl_size, i2400m->bus_pl_size_max); |
| 527 | goto error; |
| 528 | } |
| 529 | if (pl_itr + pl_size > buf_size) { /* enough? */ |
| 530 | dev_err(dev, "RX: HW BUG? payload @%zu: size %zu " |
| 531 | "goes beyond the received buffer " |
| 532 | "size (%zu bytes); ignoring message\n", |
| 533 | pl_itr, pl_size, buf_size); |
| 534 | goto error; |
| 535 | } |
| 536 | if (pl_type >= I2400M_PT_ILLEGAL) { |
| 537 | dev_err(dev, "RX: HW BUG? illegal payload type %u; " |
| 538 | "ignoring message\n", pl_type); |
| 539 | goto error; |
| 540 | } |
| 541 | result = 0; |
| 542 | error: |
| 543 | return result; |
| 544 | } |
| 545 | |
| 546 | |
| 547 | /** |
| 548 | * i2400m_rx - Receive a buffer of data from the device |
| 549 | * |
| 550 | * @i2400m: device descriptor |
| 551 | * @skb: skbuff where the data has been received |
| 552 | * |
| 553 | * Parse in a buffer of data that contains an RX message sent from the |
| 554 | * device. See the file header for the format. Run all checks on the |
| 555 | * buffer header, then run over each payload's descriptors, verify |
| 556 | * their consistency and act on each payload's contents. If |
| 557 | * everything is succesful, update the device's statistics. |
| 558 | * |
| 559 | * Note: You need to set the skb to contain only the length of the |
| 560 | * received buffer; for that, use skb_trim(skb, RECEIVED_SIZE). |
| 561 | * |
| 562 | * Returns: |
| 563 | * |
| 564 | * 0 if ok, < 0 errno on error |
| 565 | * |
| 566 | * If ok, this function owns now the skb and the caller DOESN'T have |
| 567 | * to run kfree_skb() on it. However, on error, the caller still owns |
| 568 | * the skb and it is responsible for releasing it. |
| 569 | */ |
| 570 | int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb) |
| 571 | { |
| 572 | int i, result; |
| 573 | struct device *dev = i2400m_dev(i2400m); |
| 574 | const struct i2400m_msg_hdr *msg_hdr; |
| 575 | size_t pl_itr, pl_size, skb_len; |
| 576 | unsigned long flags; |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 577 | unsigned num_pls, single_last; |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 578 | |
| 579 | skb_len = skb->len; |
| 580 | d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n", |
| 581 | i2400m, skb, skb_len); |
| 582 | result = -EIO; |
| 583 | msg_hdr = (void *) skb->data; |
| 584 | result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len); |
| 585 | if (result < 0) |
| 586 | goto error_msg_hdr_check; |
| 587 | result = -EIO; |
| 588 | num_pls = le16_to_cpu(msg_hdr->num_pls); |
| 589 | pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */ |
| 590 | num_pls * sizeof(msg_hdr->pld[0]); |
| 591 | pl_itr = ALIGN(pl_itr, I2400M_PL_PAD); |
| 592 | if (pl_itr > skb->len) { /* got all the payload descriptors? */ |
| 593 | dev_err(dev, "RX: HW BUG? message too short (%u bytes) for " |
| 594 | "%u payload descriptors (%zu each, total %zu)\n", |
| 595 | skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr); |
| 596 | goto error_pl_descr_short; |
| 597 | } |
| 598 | /* Walk each payload payload--check we really got it */ |
| 599 | for (i = 0; i < num_pls; i++) { |
| 600 | /* work around old gcc warnings */ |
| 601 | pl_size = i2400m_pld_size(&msg_hdr->pld[i]); |
| 602 | result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i], |
| 603 | pl_itr, skb->len); |
| 604 | if (result < 0) |
| 605 | goto error_pl_descr_check; |
Inaky Perez-Gonzalez | fd5c565 | 2009-02-28 23:42:52 +0000 | [diff] [blame^] | 606 | single_last = num_pls == 1 || i == num_pls - 1; |
| 607 | i2400m_rx_payload(i2400m, skb, single_last, &msg_hdr->pld[i], |
Inaky Perez-Gonzalez | aa5a7ac | 2008-12-20 16:57:47 -0800 | [diff] [blame] | 608 | skb->data + pl_itr); |
| 609 | pl_itr += ALIGN(pl_size, I2400M_PL_PAD); |
| 610 | cond_resched(); /* Don't monopolize */ |
| 611 | } |
| 612 | kfree_skb(skb); |
| 613 | /* Update device statistics */ |
| 614 | spin_lock_irqsave(&i2400m->rx_lock, flags); |
| 615 | i2400m->rx_pl_num += i; |
| 616 | if (i > i2400m->rx_pl_max) |
| 617 | i2400m->rx_pl_max = i; |
| 618 | if (i < i2400m->rx_pl_min) |
| 619 | i2400m->rx_pl_min = i; |
| 620 | i2400m->rx_num++; |
| 621 | i2400m->rx_size_acc += skb->len; |
| 622 | if (skb->len < i2400m->rx_size_min) |
| 623 | i2400m->rx_size_min = skb->len; |
| 624 | if (skb->len > i2400m->rx_size_max) |
| 625 | i2400m->rx_size_max = skb->len; |
| 626 | spin_unlock_irqrestore(&i2400m->rx_lock, flags); |
| 627 | error_pl_descr_check: |
| 628 | error_pl_descr_short: |
| 629 | error_msg_hdr_check: |
| 630 | d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n", |
| 631 | i2400m, skb, skb_len, result); |
| 632 | return result; |
| 633 | } |
| 634 | EXPORT_SYMBOL_GPL(i2400m_rx); |