i2400m: RX and TX data/control paths

Handling of TX/RX data to/from the i2400m device (IP packets, control
and diagnostics). On RX, this parses the received read transaction
from the device, breaks it in chunks and passes it to the
corresponding subsystems (network and control).

Transmission to the device is done through a software FIFO, as
data/control frames can be coalesced (while the device is reading the
previous tx transaction, others accumulate). A FIFO is used because at
the end it is resource-cheaper that scatter/gather over USB. As well,
most traffic is going to be download (vs upload).

Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 534 insertions, 0 deletions

diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
new file mode 100644
index 000000000000..6922022710ac
--- /dev/null
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -0,0 +1,534 @@
+/*
+ * Intel Wireless WiMAX Connection 2400m
+ * Handle incoming traffic and deliver it to the control or data planes
+ *
+ *
+ * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *   * Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in
+ *     the documentation and/or other materials provided with the
+ *     distribution.
+ *   * Neither the name of Intel Corporation nor the names of its
+ *     contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *
+ * Intel Corporation <linux-wimax@intel.com>
+ * Yanir Lubetkin <yanirx.lubetkin@intel.com>
+ *  - Initial implementation
+ * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
+ *  - Use skb_clone(), break up processing in chunks
+ *  - Split transport/device specific
+ *  - Make buffer size dynamic to exert less memory pressure
+ *
+ *
+ * This handles the RX path.
+ *
+ * We receive an RX message from the bus-specific driver, which
+ * contains one or more payloads that have potentially different
+ * destinataries (data or control paths).
+ *
+ * So we just take that payload from the transport specific code in
+ * the form of an skb, break it up in chunks (a cloned skb each in the
+ * case of network packets) and pass it to netdev or to the
+ * command/ack handler (and from there to the WiMAX stack).
+ *
+ * PROTOCOL FORMAT
+ *
+ * The format of the buffer is:
+ *
+ * HEADER                      (struct i2400m_msg_hdr)
+ * PAYLOAD DESCRIPTOR 0        (struct i2400m_pld)
+ * PAYLOAD DESCRIPTOR 1
+ * ...
+ * PAYLOAD DESCRIPTOR N
+ * PAYLOAD 0                   (raw bytes)
+ * PAYLOAD 1
+ * ...
+ * PAYLOAD N
+ *
+ * See tx.c for a deeper description on alignment requirements and
+ * other fun facts of it.
+ *
+ * ROADMAP
+ *
+ * i2400m_rx
+ *   i2400m_rx_msg_hdr_check
+ *   i2400m_rx_pl_descr_check
+ *   i2400m_rx_payload
+ *     i2400m_net_rx
+ *     i2400m_rx_ctl
+ *       i2400m_msg_size_check
+ *       i2400m_report_hook_work    [in a workqueue]
+ *         i2400m_report_hook
+ *       wimax_msg_to_user
+ *       i2400m_rx_ctl_ack
+ *         wimax_msg_to_user_alloc
+ *     i2400m_rx_trace
+ *       i2400m_msg_size_check
+ *       wimax_msg
+ */
+#include <linux/kernel.h>
+#include <linux/if_arp.h>
+#include <linux/netdevice.h>
+#include <linux/workqueue.h>
+#include "i2400m.h"
+
+
+#define D_SUBMODULE rx
+#include "debug-levels.h"
+
+struct i2400m_report_hook_args {
+        struct sk_buff *skb_rx;
+        const struct i2400m_l3l4_hdr *l3l4_hdr;
+        size_t size;
+};
+
+
+/*
+ * Execute i2400m_report_hook in a workqueue
+ *
+ * Unpacks arguments from the deferred call, executes it and then
+ * drops the references.
+ *
+ * Obvious NOTE: References are needed because we are a separate
+ *     thread; otherwise the buffer changes under us because it is
+ *     released by the original caller.
+ */
+static
+void i2400m_report_hook_work(struct work_struct *ws)
+{
+        struct i2400m_work *iw =
+                container_of(ws, struct i2400m_work, ws);
+        struct i2400m_report_hook_args *args = (void *) iw->pl;
+        i2400m_report_hook(iw->i2400m, args->l3l4_hdr, args->size);
+        kfree_skb(args->skb_rx);
+        i2400m_put(iw->i2400m);
+        kfree(iw);
+}
+
+
+/*
+ * Process an ack to a command
+ *
+ * @i2400m: device descriptor
+ * @payload: pointer to message
+ * @size: size of the message
+ *
+ * Pass the acknodledgment (in an skb) to the thread that is waiting
+ * for it in i2400m->msg_completion.
+ *
+ * We need to coordinate properly with the thread waiting for the
+ * ack. Check if it is waiting or if it is gone. We loose the spinlock
+ * to avoid allocating on atomic contexts (yeah, could use GFP_ATOMIC,
+ * but this is not so speed critical).
+ */
+static
+void i2400m_rx_ctl_ack(struct i2400m *i2400m,
+                       const void *payload, size_t size)
+{
+        struct device *dev = i2400m_dev(i2400m);
+        struct wimax_dev *wimax_dev = &i2400m->wimax_dev;
+        unsigned long flags;
+        struct sk_buff *ack_skb;
+
+        /* Anyone waiting for an answer? */
+        spin_lock_irqsave(&i2400m->rx_lock, flags);
+        if (i2400m->ack_skb != ERR_PTR(-EINPROGRESS)) {
+                dev_err(dev, "Huh? reply to command with no waiters\n");
+                goto error_no_waiter;
+        }
+        spin_unlock_irqrestore(&i2400m->rx_lock, flags);
+
+        ack_skb = wimax_msg_alloc(wimax_dev, NULL, payload, size, GFP_KERNEL);
+
+        /* Check waiter didn't time out waiting for the answer... */
+        spin_lock_irqsave(&i2400m->rx_lock, flags);
+        if (i2400m->ack_skb != ERR_PTR(-EINPROGRESS)) {
+                d_printf(1, dev, "Huh? waiter for command reply cancelled\n");
+                goto error_waiter_cancelled;
+        }
+        if (ack_skb == NULL) {
+                dev_err(dev, "CMD/GET/SET ack: cannot allocate SKB\n");
+                i2400m->ack_skb = ERR_PTR(-ENOMEM);
+        } else
+                i2400m->ack_skb = ack_skb;
+        spin_unlock_irqrestore(&i2400m->rx_lock, flags);
+        complete(&i2400m->msg_completion);
+        return;
+
+error_waiter_cancelled:
+        if (ack_skb)
+                kfree_skb(ack_skb);
+error_no_waiter:
+        spin_unlock_irqrestore(&i2400m->rx_lock, flags);
+        return;
+}
+
+
+/*
+ * Receive and process a control payload
+ *
+ * @i2400m: device descriptor
+ * @skb_rx: skb that contains the payload (for reference counting)
+ * @payload: pointer to message
+ * @size: size of the message
+ *
+ * There are two types of control RX messages: reports (asynchronous,
+ * like your every day interrupts) and 'acks' (reponses to a command,
+ * get or set request).
+ *
+ * If it is a report, we run hooks on it (to extract information for
+ * things we need to do in the driver) and then pass it over to the
+ * WiMAX stack to send it to user space.
+ *
+ * NOTE: report processing is done in a workqueue specific to the
+ *     generic driver, to avoid deadlocks in the system.
+ *
+ * If it is not a report, it is an ack to a previously executed
+ * command, set or get, so wake up whoever is waiting for it from
+ * i2400m_msg_to_dev(). i2400m_rx_ctl_ack() takes care of that.
+ *
+ * Note that the sizes we pass to other functions from here are the
+ * sizes of the _l3l4_hdr + payload, not full buffer sizes, as we have
+ * verified in _msg_size_check() that they are congruent.
+ *
+ * For reports: We can't clone the original skb where the data is
+ * because we need to send this up via netlink; netlink has to add
+ * headers and we can't overwrite what's preceeding the payload...as
+ * it is another message. So we just dup them.
+ */
+static
+void i2400m_rx_ctl(struct i2400m *i2400m, struct sk_buff *skb_rx,
+                   const void *payload, size_t size)
+{
+        int result;
+        struct device *dev = i2400m_dev(i2400m);
+        const struct i2400m_l3l4_hdr *l3l4_hdr = payload;
+        unsigned msg_type;
+
+        result = i2400m_msg_size_check(i2400m, l3l4_hdr, size);
+        if (result < 0) {
+                dev_err(dev, "HW BUG? device sent a bad message: %d\n",
+                        result);
+                goto error_check;
+        }
+        msg_type = le16_to_cpu(l3l4_hdr->type);
+        d_printf(1, dev, "%s 0x%04x: %zu bytes\n",
+                 msg_type & I2400M_MT_REPORT_MASK ? "REPORT" : "CMD/SET/GET",
+                 msg_type, size);
+        d_dump(2, dev, l3l4_hdr, size);
+        if (msg_type & I2400M_MT_REPORT_MASK) {
+                /* These hooks have to be ran serialized; as well, the
+                 * handling might force the execution of commands, and
+                 * that might cause reentrancy issues with
+                 * bus-specific subdrivers and workqueues. So we run
+                 * it in a separate workqueue. */
+                struct i2400m_report_hook_args args = {
+                        .skb_rx = skb_rx,
+                        .l3l4_hdr = l3l4_hdr,
+                        .size = size
+                };
+                if (unlikely(i2400m->ready == 0))       /* only send if up */
+                        return;
+                skb_get(skb_rx);
+                i2400m_queue_work(i2400m, i2400m_report_hook_work,
+                                  GFP_KERNEL, &args, sizeof(args));
+                result = wimax_msg(&i2400m->wimax_dev, NULL, l3l4_hdr, size,
+                                   GFP_KERNEL);
+                if (result < 0)
+                        dev_err(dev, "error sending report to userspace: %d\n",
+                                result);
+        } else          /* an ack to a CMD, GET or SET */
+                i2400m_rx_ctl_ack(i2400m, payload, size);
+error_check:
+        return;
+}
+
+
+
+
+/*
+ * Receive and send up a trace
+ *
+ * @i2400m: device descriptor
+ * @skb_rx: skb that contains the trace (for reference counting)
+ * @payload: pointer to trace message inside the skb
+ * @size: size of the message
+ *
+ * THe i2400m might produce trace information (diagnostics) and we
+ * send them through a different kernel-to-user pipe (to avoid
+ * clogging it).
+ *
+ * As in i2400m_rx_ctl(), we can't clone the original skb where the
+ * data is because we need to send this up via netlink; netlink has to
+ * add headers and we can't overwrite what's preceeding the
+ * payload...as it is another message. So we just dup them.
+ */
+static
+void i2400m_rx_trace(struct i2400m *i2400m,
+                     const void *payload, size_t size)
+{
+        int result;
+        struct device *dev = i2400m_dev(i2400m);
+        struct wimax_dev *wimax_dev = &i2400m->wimax_dev;
+        const struct i2400m_l3l4_hdr *l3l4_hdr = payload;
+        unsigned msg_type;
+
+        result = i2400m_msg_size_check(i2400m, l3l4_hdr, size);
+        if (result < 0) {
+                dev_err(dev, "HW BUG? device sent a bad trace message: %d\n",
+                        result);
+                goto error_check;
+        }
+        msg_type = le16_to_cpu(l3l4_hdr->type);
+        d_printf(1, dev, "Trace %s 0x%04x: %zu bytes\n",
+                 msg_type & I2400M_MT_REPORT_MASK ? "REPORT" : "CMD/SET/GET",
+                 msg_type, size);
+        d_dump(2, dev, l3l4_hdr, size);
+        if (unlikely(i2400m->ready == 0))       /* only send if up */
+                return;
+        result = wimax_msg(wimax_dev, "trace", l3l4_hdr, size, GFP_KERNEL);
+        if (result < 0)
+                dev_err(dev, "error sending trace to userspace: %d\n",
+                        result);
+error_check:
+        return;
+}
+
+
+/*
+ * Act on a received payload
+ *
+ * @i2400m: device instance
+ * @skb_rx: skb where the transaction was received
+ * @single: 1 if there is only one payload, 0 otherwise
+ * @pld: payload descriptor
+ * @payload: payload data
+ *
+ * Upon reception of a payload, look at its guts in the payload
+ * descriptor and decide what to do with it.
+ */
+static
+void i2400m_rx_payload(struct i2400m *i2400m, struct sk_buff *skb_rx,
+                       unsigned single, const struct i2400m_pld *pld,
+                       const void *payload)
+{
+        struct device *dev = i2400m_dev(i2400m);
+        size_t pl_size = i2400m_pld_size(pld);
+        enum i2400m_pt pl_type = i2400m_pld_type(pld);
+
+        switch (pl_type) {
+        case I2400M_PT_DATA:
+                d_printf(3, dev, "RX: data payload %zu bytes\n", pl_size);
+                i2400m_net_rx(i2400m, skb_rx, single, payload, pl_size);
+                break;
+        case I2400M_PT_CTRL:
+                i2400m_rx_ctl(i2400m, skb_rx, payload, pl_size);
+                break;
+        case I2400M_PT_TRACE:
+                i2400m_rx_trace(i2400m, payload, pl_size);
+                break;
+        default:        /* Anything else shouldn't come to the host */
+                if (printk_ratelimit())
+                        dev_err(dev, "RX: HW BUG? unexpected payload type %u\n",
+                                pl_type);
+        }
+}
+
+
+/*
+ * Check a received transaction's message header
+ *
+ * @i2400m: device descriptor
+ * @msg_hdr: message header
+ * @buf_size: size of the received buffer
+ *
+ * Check that the declarations done by a RX buffer message header are
+ * sane and consistent with the amount of data that was received.
+ */
+static
+int i2400m_rx_msg_hdr_check(struct i2400m *i2400m,
+                            const struct i2400m_msg_hdr *msg_hdr,
+                            size_t buf_size)
+{
+        int result = -EIO;
+        struct device *dev = i2400m_dev(i2400m);
+        if (buf_size < sizeof(*msg_hdr)) {
+                dev_err(dev, "RX: HW BUG? message with short header (%zu "
+                        "vs %zu bytes expected)\n", buf_size, sizeof(*msg_hdr));
+                goto error;
+        }
+        if (msg_hdr->barker != cpu_to_le32(I2400M_D2H_MSG_BARKER)) {
+                dev_err(dev, "RX: HW BUG? message received with unknown "
+                        "barker 0x%08x (buf_size %zu bytes)\n",
+                        le32_to_cpu(msg_hdr->barker), buf_size);
+                goto error;
+        }
+        if (msg_hdr->num_pls == 0) {
+                dev_err(dev, "RX: HW BUG? zero payload packets in message\n");
+                goto error;
+        }
+        if (le16_to_cpu(msg_hdr->num_pls) > I2400M_MAX_PLS_IN_MSG) {
+                dev_err(dev, "RX: HW BUG? message contains more payload "
+                        "than maximum; ignoring.\n");
+                goto error;
+        }
+        result = 0;
+error:
+        return result;
+}
+
+
+/*
+ * Check a payload descriptor against the received data
+ *
+ * @i2400m: device descriptor
+ * @pld: payload descriptor
+ * @pl_itr: offset (in bytes) in the received buffer the payload is
+ *          located
+ * @buf_size: size of the received buffer
+ *
+ * Given a payload descriptor (part of a RX buffer), check it is sane
+ * and that the data it declares fits in the buffer.
+ */
+static
+int i2400m_rx_pl_descr_check(struct i2400m *i2400m,
+                              const struct i2400m_pld *pld,
+                              size_t pl_itr, size_t buf_size)
+{
+        int result = -EIO;
+        struct device *dev = i2400m_dev(i2400m);
+        size_t pl_size = i2400m_pld_size(pld);
+        enum i2400m_pt pl_type = i2400m_pld_type(pld);
+
+        if (pl_size > i2400m->bus_pl_size_max) {
+                dev_err(dev, "RX: HW BUG? payload @%zu: size %zu is "
+                        "bigger than maximum %zu; ignoring message\n",
+                        pl_itr, pl_size, i2400m->bus_pl_size_max);
+                goto error;
+        }
+        if (pl_itr + pl_size > buf_size) {      /* enough? */
+                dev_err(dev, "RX: HW BUG? payload @%zu: size %zu "
+                        "goes beyond the received buffer "
+                        "size (%zu bytes); ignoring message\n",
+                        pl_itr, pl_size, buf_size);
+                goto error;
+        }
+        if (pl_type >= I2400M_PT_ILLEGAL) {
+                dev_err(dev, "RX: HW BUG? illegal payload type %u; "
+                        "ignoring message\n", pl_type);
+                goto error;
+        }
+        result = 0;
+error:
+        return result;
+}
+
+
+/**
+ * i2400m_rx - Receive a buffer of data from the device
+ *
+ * @i2400m: device descriptor
+ * @skb: skbuff where the data has been received
+ *
+ * Parse in a buffer of data that contains an RX message sent from the
+ * device. See the file header for the format. Run all checks on the
+ * buffer header, then run over each payload's descriptors, verify
+ * their consistency and act on each payload's contents.  If
+ * everything is succesful, update the device's statistics.
+ *
+ * Note: You need to set the skb to contain only the length of the
+ * received buffer; for that, use skb_trim(skb, RECEIVED_SIZE).
+ *
+ * Returns:
+ *
+ * 0 if ok, < 0 errno on error
+ *
+ * If ok, this function owns now the skb and the caller DOESN'T have
+ * to run kfree_skb() on it. However, on error, the caller still owns
+ * the skb and it is responsible for releasing it.
+ */
+int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
+{
+        int i, result;
+        struct device *dev = i2400m_dev(i2400m);
+        const struct i2400m_msg_hdr *msg_hdr;
+        size_t pl_itr, pl_size, skb_len;
+        unsigned long flags;
+        unsigned num_pls;
+
+        skb_len = skb->len;
+        d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
+                  i2400m, skb, skb_len);
+        result = -EIO;
+        msg_hdr = (void *) skb->data;
+        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
+        if (result < 0)
+                goto error_msg_hdr_check;
+        result = -EIO;
+        num_pls = le16_to_cpu(msg_hdr->num_pls);
+        pl_itr = sizeof(*msg_hdr) +     /* Check payload descriptor(s) */
+                num_pls * sizeof(msg_hdr->pld[0]);
+        pl_itr = ALIGN(pl_itr, I2400M_PL_PAD);
+        if (pl_itr > skb->len) {        /* got all the payload descriptors? */
+                dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
+                        "%u payload descriptors (%zu each, total %zu)\n",
+                        skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
+                goto error_pl_descr_short;
+        }
+        /* Walk each payload payload--check we really got it */
+        for (i = 0; i < num_pls; i++) {
+                /* work around old gcc warnings */
+                pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
+                result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
+                                                  pl_itr, skb->len);
+                if (result < 0)
+                        goto error_pl_descr_check;
+                i2400m_rx_payload(i2400m, skb, num_pls == 1, &msg_hdr->pld[i],
+                                  skb->data + pl_itr);
+                pl_itr += ALIGN(pl_size, I2400M_PL_PAD);
+                cond_resched();         /* Don't monopolize */
+        }
+        kfree_skb(skb);
+        /* Update device statistics */
+        spin_lock_irqsave(&i2400m->rx_lock, flags);
+        i2400m->rx_pl_num += i;
+        if (i > i2400m->rx_pl_max)
+                i2400m->rx_pl_max = i;
+        if (i < i2400m->rx_pl_min)
+                i2400m->rx_pl_min = i;
+        i2400m->rx_num++;
+        i2400m->rx_size_acc += skb->len;
+        if (skb->len < i2400m->rx_size_min)
+                i2400m->rx_size_min = skb->len;
+        if (skb->len > i2400m->rx_size_max)
+                i2400m->rx_size_max = skb->len;
+        spin_unlock_irqrestore(&i2400m->rx_lock, flags);
+error_pl_descr_check:
+error_pl_descr_short:
+error_msg_hdr_check:
+        d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
+                i2400m, skb, skb_len, result);
+        return result;
+}
+EXPORT_SYMBOL_GPL(i2400m_rx);