1 /*
2 * Copyright (C) 2002 Intersil Americas Inc.
3 * Copyright 2004 Jens Maurer <Jens.Maurer@gmx.net>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17 *
18 */
19
20 #include <linux/netdevice.h>
21 #include <linux/module.h>
22 #include <linux/pci.h>
23 #include <linux/sched.h>
24 #include <linux/slab.h>
25
26 #include <asm/io.h>
27 #include <linux/if_arp.h>
28
29 #include "prismcompat.h"
30 #include "isl_38xx.h"
31 #include "islpci_mgt.h"
32 #include "isl_oid.h" /* additional types and defs for isl38xx fw */
33 #include "isl_ioctl.h"
34
35 #include <net/iw_handler.h>
36
37 /******************************************************************************
38 Global variable definition section
39 ******************************************************************************/
40 int pc_debug = VERBOSE;
41 module_param(pc_debug, int, 0);
42
43 /******************************************************************************
44 Driver general functions
45 ******************************************************************************/
46 #if VERBOSE > SHOW_ERROR_MESSAGES
47 void
display_buffer(char * buffer,int length)48 display_buffer(char *buffer, int length)
49 {
50 if ((pc_debug & SHOW_BUFFER_CONTENTS) == 0)
51 return;
52
53 while (length > 0) {
54 printk("[%02x]", *buffer & 255);
55 length--;
56 buffer++;
57 }
58
59 printk("\n");
60 }
61 #endif
62
63 /*****************************************************************************
64 Queue handling for management frames
65 ******************************************************************************/
66
67 /*
68 * Helper function to create a PIMFOR management frame header.
69 */
70 static void
pimfor_encode_header(int operation,u32 oid,u32 length,pimfor_header_t * h)71 pimfor_encode_header(int operation, u32 oid, u32 length, pimfor_header_t *h)
72 {
73 h->version = PIMFOR_VERSION;
74 h->operation = operation;
75 h->device_id = PIMFOR_DEV_ID_MHLI_MIB;
76 h->flags = 0;
77 h->oid = cpu_to_be32(oid);
78 h->length = cpu_to_be32(length);
79 }
80
81 /*
82 * Helper function to analyze a PIMFOR management frame header.
83 */
84 static pimfor_header_t *
pimfor_decode_header(void * data,int len)85 pimfor_decode_header(void *data, int len)
86 {
87 pimfor_header_t *h = data;
88
89 while ((void *) h < data + len) {
90 if (h->flags & PIMFOR_FLAG_LITTLE_ENDIAN) {
91 le32_to_cpus(&h->oid);
92 le32_to_cpus(&h->length);
93 } else {
94 be32_to_cpus(&h->oid);
95 be32_to_cpus(&h->length);
96 }
97 if (h->oid != OID_INL_TUNNEL)
98 return h;
99 h++;
100 }
101 return NULL;
102 }
103
104 /*
105 * Fill the receive queue for management frames with fresh buffers.
106 */
107 int
islpci_mgmt_rx_fill(struct net_device * ndev)108 islpci_mgmt_rx_fill(struct net_device *ndev)
109 {
110 islpci_private *priv = netdev_priv(ndev);
111 isl38xx_control_block *cb = /* volatile not needed */
112 (isl38xx_control_block *) priv->control_block;
113 u32 curr = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_RX_MGMTQ]);
114
115 #if VERBOSE > SHOW_ERROR_MESSAGES
116 DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgmt_rx_fill\n");
117 #endif
118
119 while (curr - priv->index_mgmt_rx < ISL38XX_CB_MGMT_QSIZE) {
120 u32 index = curr % ISL38XX_CB_MGMT_QSIZE;
121 struct islpci_membuf *buf = &priv->mgmt_rx[index];
122 isl38xx_fragment *frag = &cb->rx_data_mgmt[index];
123
124 if (buf->mem == NULL) {
125 buf->mem = kmalloc(MGMT_FRAME_SIZE, GFP_ATOMIC);
126 if (!buf->mem)
127 return -ENOMEM;
128 buf->size = MGMT_FRAME_SIZE;
129 }
130 if (buf->pci_addr == 0) {
131 buf->pci_addr = pci_map_single(priv->pdev, buf->mem,
132 MGMT_FRAME_SIZE,
133 PCI_DMA_FROMDEVICE);
134 if (!buf->pci_addr) {
135 printk(KERN_WARNING
136 "Failed to make memory DMA'able.\n");
137 return -ENOMEM;
138 }
139 }
140
141 /* be safe: always reset control block information */
142 frag->size = cpu_to_le16(MGMT_FRAME_SIZE);
143 frag->flags = 0;
144 frag->address = cpu_to_le32(buf->pci_addr);
145 curr++;
146
147 /* The fragment address in the control block must have
148 * been written before announcing the frame buffer to
149 * device */
150 wmb();
151 cb->driver_curr_frag[ISL38XX_CB_RX_MGMTQ] = cpu_to_le32(curr);
152 }
153 return 0;
154 }
155
156 /*
157 * Create and transmit a management frame using "operation" and "oid",
158 * with arguments data/length.
159 * We either return an error and free the frame, or we return 0 and
160 * islpci_mgt_cleanup_transmit() frees the frame in the tx-done
161 * interrupt.
162 */
163 static int
islpci_mgt_transmit(struct net_device * ndev,int operation,unsigned long oid,void * data,int length)164 islpci_mgt_transmit(struct net_device *ndev, int operation, unsigned long oid,
165 void *data, int length)
166 {
167 islpci_private *priv = netdev_priv(ndev);
168 isl38xx_control_block *cb =
169 (isl38xx_control_block *) priv->control_block;
170 void *p;
171 int err = -EINVAL;
172 unsigned long flags;
173 isl38xx_fragment *frag;
174 struct islpci_membuf buf;
175 u32 curr_frag;
176 int index;
177 int frag_len = length + PIMFOR_HEADER_SIZE;
178
179 #if VERBOSE > SHOW_ERROR_MESSAGES
180 DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_transmit\n");
181 #endif
182
183 if (frag_len > MGMT_FRAME_SIZE) {
184 printk(KERN_DEBUG "%s: mgmt frame too large %d\n",
185 ndev->name, frag_len);
186 goto error;
187 }
188
189 err = -ENOMEM;
190 p = buf.mem = kmalloc(frag_len, GFP_KERNEL);
191 if (!buf.mem)
192 goto error;
193
194 buf.size = frag_len;
195
196 /* create the header directly in the fragment data area */
197 pimfor_encode_header(operation, oid, length, (pimfor_header_t *) p);
198 p += PIMFOR_HEADER_SIZE;
199
200 if (data)
201 memcpy(p, data, length);
202 else
203 memset(p, 0, length);
204
205 #if VERBOSE > SHOW_ERROR_MESSAGES
206 {
207 pimfor_header_t *h = buf.mem;
208 DEBUG(SHOW_PIMFOR_FRAMES,
209 "PIMFOR: op %i, oid 0x%08lx, device %i, flags 0x%x length 0x%x\n",
210 h->operation, oid, h->device_id, h->flags, length);
211
212 /* display the buffer contents for debugging */
213 display_buffer((char *) h, sizeof (pimfor_header_t));
214 display_buffer(p, length);
215 }
216 #endif
217
218 err = -ENOMEM;
219 buf.pci_addr = pci_map_single(priv->pdev, buf.mem, frag_len,
220 PCI_DMA_TODEVICE);
221 if (!buf.pci_addr) {
222 printk(KERN_WARNING "%s: cannot map PCI memory for mgmt\n",
223 ndev->name);
224 goto error_free;
225 }
226
227 /* Protect the control block modifications against interrupts. */
228 spin_lock_irqsave(&priv->slock, flags);
229 curr_frag = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_TX_MGMTQ]);
230 if (curr_frag - priv->index_mgmt_tx >= ISL38XX_CB_MGMT_QSIZE) {
231 printk(KERN_WARNING "%s: mgmt tx queue is still full\n",
232 ndev->name);
233 goto error_unlock;
234 }
235
236 /* commit the frame to the tx device queue */
237 index = curr_frag % ISL38XX_CB_MGMT_QSIZE;
238 priv->mgmt_tx[index] = buf;
239 frag = &cb->tx_data_mgmt[index];
240 frag->size = cpu_to_le16(frag_len);
241 frag->flags = 0; /* for any other than the last fragment, set to 1 */
242 frag->address = cpu_to_le32(buf.pci_addr);
243
244 /* The fragment address in the control block must have
245 * been written before announcing the frame buffer to
246 * device */
247 wmb();
248 cb->driver_curr_frag[ISL38XX_CB_TX_MGMTQ] = cpu_to_le32(curr_frag + 1);
249 spin_unlock_irqrestore(&priv->slock, flags);
250
251 /* trigger the device */
252 islpci_trigger(priv);
253 return 0;
254
255 error_unlock:
256 spin_unlock_irqrestore(&priv->slock, flags);
257 error_free:
258 kfree(buf.mem);
259 error:
260 return err;
261 }
262
263 /*
264 * Receive a management frame from the device.
265 * This can be an arbitrary number of traps, and at most one response
266 * frame for a previous request sent via islpci_mgt_transmit().
267 */
268 int
islpci_mgt_receive(struct net_device * ndev)269 islpci_mgt_receive(struct net_device *ndev)
270 {
271 islpci_private *priv = netdev_priv(ndev);
272 isl38xx_control_block *cb =
273 (isl38xx_control_block *) priv->control_block;
274 u32 curr_frag;
275
276 #if VERBOSE > SHOW_ERROR_MESSAGES
277 DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_receive\n");
278 #endif
279
280 /* Only once per interrupt, determine fragment range to
281 * process. This avoids an endless loop (i.e. lockup) if
282 * frames come in faster than we can process them. */
283 curr_frag = le32_to_cpu(cb->device_curr_frag[ISL38XX_CB_RX_MGMTQ]);
284 barrier();
285
286 for (; priv->index_mgmt_rx < curr_frag; priv->index_mgmt_rx++) {
287 pimfor_header_t *header;
288 u32 index = priv->index_mgmt_rx % ISL38XX_CB_MGMT_QSIZE;
289 struct islpci_membuf *buf = &priv->mgmt_rx[index];
290 u16 frag_len;
291 int size;
292 struct islpci_mgmtframe *frame;
293
294 /* I have no idea (and no documentation) if flags != 0
295 * is possible. Drop the frame, reuse the buffer. */
296 if (le16_to_cpu(cb->rx_data_mgmt[index].flags) != 0) {
297 printk(KERN_WARNING "%s: unknown flags 0x%04x\n",
298 ndev->name,
299 le16_to_cpu(cb->rx_data_mgmt[index].flags));
300 continue;
301 }
302
303 /* The device only returns the size of the header(s) here. */
304 frag_len = le16_to_cpu(cb->rx_data_mgmt[index].size);
305
306 /*
307 * We appear to have no way to tell the device the
308 * size of a receive buffer. Thus, if this check
309 * triggers, we likely have kernel heap corruption. */
310 if (frag_len > MGMT_FRAME_SIZE) {
311 printk(KERN_WARNING
312 "%s: Bogus packet size of %d (%#x).\n",
313 ndev->name, frag_len, frag_len);
314 frag_len = MGMT_FRAME_SIZE;
315 }
316
317 /* Ensure the results of device DMA are visible to the CPU. */
318 pci_dma_sync_single_for_cpu(priv->pdev, buf->pci_addr,
319 buf->size, PCI_DMA_FROMDEVICE);
320
321 /* Perform endianess conversion for PIMFOR header in-place. */
322 header = pimfor_decode_header(buf->mem, frag_len);
323 if (!header) {
324 printk(KERN_WARNING "%s: no PIMFOR header found\n",
325 ndev->name);
326 continue;
327 }
328
329 /* The device ID from the PIMFOR packet received from
330 * the MVC is always 0. We forward a sensible device_id.
331 * Not that anyone upstream would care... */
332 header->device_id = priv->ndev->ifindex;
333
334 #if VERBOSE > SHOW_ERROR_MESSAGES
335 DEBUG(SHOW_PIMFOR_FRAMES,
336 "PIMFOR: op %i, oid 0x%08x, device %i, flags 0x%x length 0x%x\n",
337 header->operation, header->oid, header->device_id,
338 header->flags, header->length);
339
340 /* display the buffer contents for debugging */
341 display_buffer((char *) header, PIMFOR_HEADER_SIZE);
342 display_buffer((char *) header + PIMFOR_HEADER_SIZE,
343 header->length);
344 #endif
345
346 /* nobody sends these */
347 if (header->flags & PIMFOR_FLAG_APPLIC_ORIGIN) {
348 printk(KERN_DEBUG
349 "%s: errant PIMFOR application frame\n",
350 ndev->name);
351 continue;
352 }
353
354 /* Determine frame size, skipping OID_INL_TUNNEL headers. */
355 size = PIMFOR_HEADER_SIZE + header->length;
356 frame = kmalloc(sizeof(struct islpci_mgmtframe) + size,
357 GFP_ATOMIC);
358 if (!frame)
359 continue;
360
361 frame->ndev = ndev;
362 memcpy(&frame->buf, header, size);
363 frame->header = (pimfor_header_t *) frame->buf;
364 frame->data = frame->buf + PIMFOR_HEADER_SIZE;
365
366 #if VERBOSE > SHOW_ERROR_MESSAGES
367 DEBUG(SHOW_PIMFOR_FRAMES,
368 "frame: header: %p, data: %p, size: %d\n",
369 frame->header, frame->data, size);
370 #endif
371
372 if (header->operation == PIMFOR_OP_TRAP) {
373 #if VERBOSE > SHOW_ERROR_MESSAGES
374 printk(KERN_DEBUG
375 "TRAP: oid 0x%x, device %i, flags 0x%x length %i\n",
376 header->oid, header->device_id, header->flags,
377 header->length);
378 #endif
379
380 /* Create work to handle trap out of interrupt
381 * context. */
382 INIT_WORK(&frame->ws, prism54_process_trap);
383 schedule_work(&frame->ws);
384
385 } else {
386 /* Signal the one waiting process that a response
387 * has been received. */
388 if ((frame = xchg(&priv->mgmt_received, frame)) != NULL) {
389 printk(KERN_WARNING
390 "%s: mgmt response not collected\n",
391 ndev->name);
392 kfree(frame);
393 }
394 #if VERBOSE > SHOW_ERROR_MESSAGES
395 DEBUG(SHOW_TRACING, "Wake up Mgmt Queue\n");
396 #endif
397 wake_up(&priv->mgmt_wqueue);
398 }
399
400 }
401
402 return 0;
403 }
404
405 /*
406 * Cleanup the transmit queue by freeing all frames handled by the device.
407 */
408 void
islpci_mgt_cleanup_transmit(struct net_device * ndev)409 islpci_mgt_cleanup_transmit(struct net_device *ndev)
410 {
411 islpci_private *priv = netdev_priv(ndev);
412 isl38xx_control_block *cb = /* volatile not needed */
413 (isl38xx_control_block *) priv->control_block;
414 u32 curr_frag;
415
416 #if VERBOSE > SHOW_ERROR_MESSAGES
417 DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_cleanup_transmit\n");
418 #endif
419
420 /* Only once per cleanup, determine fragment range to
421 * process. This avoids an endless loop (i.e. lockup) if
422 * the device became confused, incrementing device_curr_frag
423 * rapidly. */
424 curr_frag = le32_to_cpu(cb->device_curr_frag[ISL38XX_CB_TX_MGMTQ]);
425 barrier();
426
427 for (; priv->index_mgmt_tx < curr_frag; priv->index_mgmt_tx++) {
428 int index = priv->index_mgmt_tx % ISL38XX_CB_MGMT_QSIZE;
429 struct islpci_membuf *buf = &priv->mgmt_tx[index];
430 pci_unmap_single(priv->pdev, buf->pci_addr, buf->size,
431 PCI_DMA_TODEVICE);
432 buf->pci_addr = 0;
433 kfree(buf->mem);
434 buf->mem = NULL;
435 buf->size = 0;
436 }
437 }
438
439 /*
440 * Perform one request-response transaction to the device.
441 */
442 int
islpci_mgt_transaction(struct net_device * ndev,int operation,unsigned long oid,void * senddata,int sendlen,struct islpci_mgmtframe ** recvframe)443 islpci_mgt_transaction(struct net_device *ndev,
444 int operation, unsigned long oid,
445 void *senddata, int sendlen,
446 struct islpci_mgmtframe **recvframe)
447 {
448 islpci_private *priv = netdev_priv(ndev);
449 const long wait_cycle_jiffies = msecs_to_jiffies(ISL38XX_WAIT_CYCLE * 10);
450 long timeout_left = ISL38XX_MAX_WAIT_CYCLES * wait_cycle_jiffies;
451 int err;
452 DEFINE_WAIT(wait);
453
454 *recvframe = NULL;
455
456 if (mutex_lock_interruptible(&priv->mgmt_lock))
457 return -ERESTARTSYS;
458
459 prepare_to_wait(&priv->mgmt_wqueue, &wait, TASK_UNINTERRUPTIBLE);
460 err = islpci_mgt_transmit(ndev, operation, oid, senddata, sendlen);
461 if (err)
462 goto out;
463
464 err = -ETIMEDOUT;
465 while (timeout_left > 0) {
466 int timeleft;
467 struct islpci_mgmtframe *frame;
468
469 timeleft = schedule_timeout_uninterruptible(wait_cycle_jiffies);
470 frame = xchg(&priv->mgmt_received, NULL);
471 if (frame) {
472 if (frame->header->oid == oid) {
473 *recvframe = frame;
474 err = 0;
475 goto out;
476 } else {
477 printk(KERN_DEBUG
478 "%s: expecting oid 0x%x, received 0x%x.\n",
479 ndev->name, (unsigned int) oid,
480 frame->header->oid);
481 kfree(frame);
482 frame = NULL;
483 }
484 }
485 if (timeleft == 0) {
486 printk(KERN_DEBUG
487 "%s: timeout waiting for mgmt response %lu, "
488 "triggering device\n",
489 ndev->name, timeout_left);
490 islpci_trigger(priv);
491 }
492 timeout_left += timeleft - wait_cycle_jiffies;
493 }
494 printk(KERN_WARNING "%s: timeout waiting for mgmt response\n",
495 ndev->name);
496
497 /* TODO: we should reset the device here */
498 out:
499 finish_wait(&priv->mgmt_wqueue, &wait);
500 mutex_unlock(&priv->mgmt_lock);
501 return err;
502 }
503
504