drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

   1 /* Copyright (c) 2014 Broadcom Corporation
   2  *
   3  * Permission to use, copy, modify, and/or distribute this software for any
   4  * purpose with or without fee is hereby granted, provided that the above
   5  * copyright notice and this permission notice appear in all copies.
   6  *
   7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  14  */
  15
  16 /*******************************************************************************
  17  * Communicates with the dongle by using dcmd codes.
  18  * For certain dcmd codes, the dongle interprets string data from the host.
  19  ******************************************************************************/
  20
  21 #include <linux/types.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/etherdevice.h>
  24
  25 #include <brcmu_utils.h>
  26 #include <brcmu_wifi.h>
  27
  28 #include "core.h"
  29 #include "debug.h"
  30 #include "proto.h"
  31 #include "msgbuf.h"
  32 #include "commonring.h"
  33 #include "flowring.h"
  34 #include "bus.h"
  35 #include "tracepoint.h"
  36
  37
  38 #define MSGBUF_IOCTL_RESP_TIMEOUT               msecs_to_jiffies(2000)
  39
  40 #define MSGBUF_TYPE_GEN_STATUS                  0x1
  41 #define MSGBUF_TYPE_RING_STATUS                 0x2
  42 #define MSGBUF_TYPE_FLOW_RING_CREATE            0x3
  43 #define MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT      0x4
  44 #define MSGBUF_TYPE_FLOW_RING_DELETE            0x5
  45 #define MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT      0x6
  46 #define MSGBUF_TYPE_FLOW_RING_FLUSH             0x7
  47 #define MSGBUF_TYPE_FLOW_RING_FLUSH_CMPLT       0x8
  48 #define MSGBUF_TYPE_IOCTLPTR_REQ                0x9
  49 #define MSGBUF_TYPE_IOCTLPTR_REQ_ACK            0xA
  50 #define MSGBUF_TYPE_IOCTLRESP_BUF_POST          0xB
  51 #define MSGBUF_TYPE_IOCTL_CMPLT                 0xC
  52 #define MSGBUF_TYPE_EVENT_BUF_POST              0xD
  53 #define MSGBUF_TYPE_WL_EVENT                    0xE
  54 #define MSGBUF_TYPE_TX_POST                     0xF
  55 #define MSGBUF_TYPE_TX_STATUS                   0x10
  56 #define MSGBUF_TYPE_RXBUF_POST                  0x11
  57 #define MSGBUF_TYPE_RX_CMPLT                    0x12
  58 #define MSGBUF_TYPE_LPBK_DMAXFER                0x13
  59 #define MSGBUF_TYPE_LPBK_DMAXFER_CMPLT          0x14
  60
  61 #define NR_TX_PKTIDS                            2048
  62 #define NR_RX_PKTIDS                            1024
  63
  64 #define BRCMF_IOCTL_REQ_PKTID                   0xFFFE
  65
  66 #define BRCMF_MSGBUF_MAX_PKT_SIZE               2048
  67 #define BRCMF_MSGBUF_RXBUFPOST_THRESHOLD        32
  68 #define BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST      8
  69 #define BRCMF_MSGBUF_MAX_EVENTBUF_POST          8
  70
  71 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3      0x01
  72 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11     0x02
  73 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK       0x07
  74 #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT       5
  75
  76 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
  77 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
  78
  79 #define BRCMF_MSGBUF_DELAY_TXWORKER_THRS        96
  80 #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS      32
  81 #define BRCMF_MSGBUF_UPDATE_RX_PTR_THRS         48
  82
  83
  84 struct msgbuf_common_hdr {
  85         u8                              msgtype;
  86         u8                              ifidx;
  87         u8                              flags;
  88         u8                              rsvd0;
  89         __le32                          request_id;
  90 };
  91
  92 struct msgbuf_ioctl_req_hdr {
  93         struct msgbuf_common_hdr        msg;
  94         __le32                          cmd;
  95         __le16                          trans_id;
  96         __le16                          input_buf_len;
  97         __le16                          output_buf_len;
  98         __le16                          rsvd0[3];
  99         struct msgbuf_buf_addr          req_buf_addr;
 100         __le32                          rsvd1[2];
 101 };
 102
 103 struct msgbuf_tx_msghdr {
 104         struct msgbuf_common_hdr        msg;
 105         u8                              txhdr[ETH_HLEN];
 106         u8                              flags;
 107         u8                              seg_cnt;
 108         struct msgbuf_buf_addr          metadata_buf_addr;
 109         struct msgbuf_buf_addr          data_buf_addr;
 110         __le16                          metadata_buf_len;
 111         __le16                          data_len;
 112         __le32                          rsvd0;
 113 };
 114
 115 struct msgbuf_rx_bufpost {
 116         struct msgbuf_common_hdr        msg;
 117         __le16                          metadata_buf_len;
 118         __le16                          data_buf_len;
 119         __le32                          rsvd0;
 120         struct msgbuf_buf_addr          metadata_buf_addr;
 121         struct msgbuf_buf_addr          data_buf_addr;
 122 };
 123
 124 struct msgbuf_rx_ioctl_resp_or_event {
 125         struct msgbuf_common_hdr        msg;
 126         __le16                          host_buf_len;
 127         __le16                          rsvd0[3];
 128         struct msgbuf_buf_addr          host_buf_addr;
 129         __le32                          rsvd1[4];
 130 };
 131
 132 struct msgbuf_completion_hdr {
 133         __le16                          status;
 134         __le16                          flow_ring_id;
 135 };
 136
 137 struct msgbuf_rx_event {
 138         struct msgbuf_common_hdr        msg;
 139         struct msgbuf_completion_hdr    compl_hdr;
 140         __le16                          event_data_len;
 141         __le16                          seqnum;
 142         __le16                          rsvd0[4];
 143 };
 144
 145 struct msgbuf_ioctl_resp_hdr {
 146         struct msgbuf_common_hdr        msg;
 147         struct msgbuf_completion_hdr    compl_hdr;
 148         __le16                          resp_len;
 149         __le16                          trans_id;
 150         __le32                          cmd;
 151         __le32                          rsvd0;
 152 };
 153
 154 struct msgbuf_tx_status {
 155         struct msgbuf_common_hdr        msg;
 156         struct msgbuf_completion_hdr    compl_hdr;
 157         __le16                          metadata_len;
 158         __le16                          tx_status;
 159 };
 160
 161 struct msgbuf_rx_complete {
 162         struct msgbuf_common_hdr        msg;
 163         struct msgbuf_completion_hdr    compl_hdr;
 164         __le16                          metadata_len;
 165         __le16                          data_len;
 166         __le16                          data_offset;
 167         __le16                          flags;
 168         __le32                          rx_status_0;
 169         __le32                          rx_status_1;
 170         __le32                          rsvd0;
 171 };
 172
 173 struct msgbuf_tx_flowring_create_req {
 174         struct msgbuf_common_hdr        msg;
 175         u8                              da[ETH_ALEN];
 176         u8                              sa[ETH_ALEN];
 177         u8                              tid;
 178         u8                              if_flags;
 179         __le16                          flow_ring_id;
 180         u8                              tc;
 181         u8                              priority;
 182         __le16                          int_vector;
 183         __le16                          max_items;
 184         __le16                          len_item;
 185         struct msgbuf_buf_addr          flow_ring_addr;
 186 };
 187
 188 struct msgbuf_tx_flowring_delete_req {
 189         struct msgbuf_common_hdr        msg;
 190         __le16                          flow_ring_id;
 191         __le16                          reason;
 192         __le32                          rsvd0[7];
 193 };
 194
 195 struct msgbuf_flowring_create_resp {
 196         struct msgbuf_common_hdr        msg;
 197         struct msgbuf_completion_hdr    compl_hdr;
 198         __le32                          rsvd0[3];
 199 };
 200
 201 struct msgbuf_flowring_delete_resp {
 202         struct msgbuf_common_hdr        msg;
 203         struct msgbuf_completion_hdr    compl_hdr;
 204         __le32                          rsvd0[3];
 205 };
 206
 207 struct msgbuf_flowring_flush_resp {
 208         struct msgbuf_common_hdr        msg;
 209         struct msgbuf_completion_hdr    compl_hdr;
 210         __le32                          rsvd0[3];
 211 };
 212
 213 struct brcmf_msgbuf_work_item {
 214         struct list_head queue;
 215         u32 flowid;
 216         int ifidx;
 217         u8 sa[ETH_ALEN];
 218         u8 da[ETH_ALEN];
 219 };
 220
 221 struct brcmf_msgbuf {
 222         struct brcmf_pub *drvr;
 223
 224         struct brcmf_commonring **commonrings;
 225         struct brcmf_commonring **flowrings;
 226         dma_addr_t *flowring_dma_handle;
 227
 228         u16 max_flowrings;
 229         u16 max_submissionrings;
 230         u16 max_completionrings;
 231
 232         u16 rx_dataoffset;
 233         u32 max_rxbufpost;
 234         u16 rx_metadata_offset;
 235         u32 rxbufpost;
 236
 237         u32 max_ioctlrespbuf;
 238         u32 cur_ioctlrespbuf;
 239         u32 max_eventbuf;
 240         u32 cur_eventbuf;
 241
 242         void *ioctbuf;
 243         dma_addr_t ioctbuf_handle;
 244         u32 ioctbuf_phys_hi;
 245         u32 ioctbuf_phys_lo;
 246         int ioctl_resp_status;
 247         u32 ioctl_resp_ret_len;
 248         u32 ioctl_resp_pktid;
 249
 250         u16 data_seq_no;
 251         u16 ioctl_seq_no;
 252         u32 reqid;
 253         wait_queue_head_t ioctl_resp_wait;
 254         bool ctl_completed;
 255
 256         struct brcmf_msgbuf_pktids *tx_pktids;
 257         struct brcmf_msgbuf_pktids *rx_pktids;
 258         struct brcmf_flowring *flow;
 259
 260         struct workqueue_struct *txflow_wq;
 261         struct work_struct txflow_work;
 262         unsigned long *flow_map;
 263         unsigned long *txstatus_done_map;
 264
 265         struct work_struct flowring_work;
 266         spinlock_t flowring_work_lock;
 267         struct list_head work_queue;
 268 };
 269
 270 struct brcmf_msgbuf_pktid {
 271         atomic_t  allocated;
 272         u16 data_offset;
 273         struct sk_buff *skb;
 274         dma_addr_t physaddr;
 275 };
 276
 277 struct brcmf_msgbuf_pktids {
 278         u32 array_size;
 279         u32 last_allocated_idx;
 280         enum dma_data_direction direction;
 281         struct brcmf_msgbuf_pktid *array;
 282 };
 283
 284 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf);
 285
 286
 287 static struct brcmf_msgbuf_pktids *
 288 brcmf_msgbuf_init_pktids(u32 nr_array_entries,
 289                          enum dma_data_direction direction)
 290 {
 291         struct brcmf_msgbuf_pktid *array;
 292         struct brcmf_msgbuf_pktids *pktids;
 293
 294         array = kcalloc(nr_array_entries, sizeof(*array), GFP_KERNEL);
 295         if (!array)
 296                 return NULL;
 297
 298         pktids = kzalloc(sizeof(*pktids), GFP_KERNEL);
 299         if (!pktids) {
 300                 kfree(array);
 301                 return NULL;
 302         }
 303         pktids->array = array;
 304         pktids->array_size = nr_array_entries;
 305
 306         return pktids;
 307 }
 308
 309
 310 static int
 311 brcmf_msgbuf_alloc_pktid(struct device *dev,
 312                          struct brcmf_msgbuf_pktids *pktids,
 313                          struct sk_buff *skb, u16 data_offset,
 314                          dma_addr_t *physaddr, u32 *idx)
 315 {
 316         struct brcmf_msgbuf_pktid *array;
 317         u32 count;
 318
 319         array = pktids->array;
 320
 321         *physaddr = dma_map_single(dev, skb->data + data_offset,
 322                                    skb->len - data_offset, pktids->direction);
 323
 324         if (dma_mapping_error(dev, *physaddr)) {
 325                 brcmf_err("dma_map_single failed !!\n");
 326                 return -ENOMEM;
 327         }
 328
 329         *idx = pktids->last_allocated_idx;
 330
 331         count = 0;
 332         do {
 333                 (*idx)++;
 334                 if (*idx == pktids->array_size)
 335                         *idx = 0;
 336                 if (array[*idx].allocated.counter == 0)
 337                         if (atomic_cmpxchg(&array[*idx].allocated, 0, 1) == 0)
 338                                 break;
 339                 count++;
 340         } while (count < pktids->array_size);
 341
 342         if (count == pktids->array_size) {
 343                 dma_unmap_single(dev, *physaddr, skb->len - data_offset,
 344                                  pktids->direction);
 345                 return -ENOMEM;
 346         }
 347
 348         array[*idx].data_offset = data_offset;
 349         array[*idx].physaddr = *physaddr;
 350         array[*idx].skb = skb;
 351
 352         pktids->last_allocated_idx = *idx;
 353
 354         return 0;
 355 }
 356
 357
 358 static struct sk_buff *
 359 brcmf_msgbuf_get_pktid(struct device *dev, struct brcmf_msgbuf_pktids *pktids,
 360                        u32 idx)
 361 {
 362         struct brcmf_msgbuf_pktid *pktid;
 363         struct sk_buff *skb;
 364
 365         if (idx >= pktids->array_size) {
 366                 brcmf_err("Invalid packet id %d (max %d)\n", idx,
 367                           pktids->array_size);
 368                 return NULL;
 369         }
 370         if (pktids->array[idx].allocated.counter) {
 371                 pktid = &pktids->array[idx];
 372                 dma_unmap_single(dev, pktid->physaddr,
 373                                  pktid->skb->len - pktid->data_offset,
 374                                  pktids->direction);
 375                 skb = pktid->skb;
 376                 pktid->allocated.counter = 0;
 377                 return skb;
 378         } else {
 379                 brcmf_err("Invalid packet id %d (not in use)\n", idx);
 380         }
 381
 382         return NULL;
 383 }
 384
 385
 386 static void
 387 brcmf_msgbuf_release_array(struct device *dev,
 388                            struct brcmf_msgbuf_pktids *pktids)
 389 {
 390         struct brcmf_msgbuf_pktid *array;
 391         struct brcmf_msgbuf_pktid *pktid;
 392         u32 count;
 393
 394         array = pktids->array;
 395         count = 0;
 396         do {
 397                 if (array[count].allocated.counter) {
 398                         pktid = &array[count];
 399                         dma_unmap_single(dev, pktid->physaddr,
 400                                          pktid->skb->len - pktid->data_offset,
 401                                          pktids->direction);
 402                         brcmu_pkt_buf_free_skb(pktid->skb);
 403                 }
 404                 count++;
 405         } while (count < pktids->array_size);
 406
 407         kfree(array);
 408         kfree(pktids);
 409 }
 410
 411
 412 static void brcmf_msgbuf_release_pktids(struct brcmf_msgbuf *msgbuf)
 413 {
 414         if (msgbuf->rx_pktids)
 415                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 416                                            msgbuf->rx_pktids);
 417         if (msgbuf->tx_pktids)
 418                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 419                                            msgbuf->tx_pktids);
 420 }
 421
 422
 423 static int brcmf_msgbuf_tx_ioctl(struct brcmf_pub *drvr, int ifidx,
 424                                  uint cmd, void *buf, uint len)
 425 {
 426         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 427         struct brcmf_commonring *commonring;
 428         struct msgbuf_ioctl_req_hdr *request;
 429         u16 buf_len;
 430         void *ret_ptr;
 431         int err;
 432
 433         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 434         brcmf_commonring_lock(commonring);
 435         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 436         if (!ret_ptr) {
 437                 brcmf_err("Failed to reserve space in commonring\n");
 438                 brcmf_commonring_unlock(commonring);
 439                 return -ENOMEM;
 440         }
 441
 442         msgbuf->reqid++;
 443
 444         request = (struct msgbuf_ioctl_req_hdr *)ret_ptr;
 445         request->msg.msgtype = MSGBUF_TYPE_IOCTLPTR_REQ;
 446         request->msg.ifidx = (u8)ifidx;
 447         request->msg.flags = 0;
 448         request->msg.request_id = cpu_to_le32(BRCMF_IOCTL_REQ_PKTID);
 449         request->cmd = cpu_to_le32(cmd);
 450         request->output_buf_len = cpu_to_le16(len);
 451         request->trans_id = cpu_to_le16(msgbuf->reqid);
 452
 453         buf_len = min_t(u16, len, BRCMF_TX_IOCTL_MAX_MSG_SIZE);
 454         request->input_buf_len = cpu_to_le16(buf_len);
 455         request->req_buf_addr.high_addr = cpu_to_le32(msgbuf->ioctbuf_phys_hi);
 456         request->req_buf_addr.low_addr = cpu_to_le32(msgbuf->ioctbuf_phys_lo);
 457         if (buf)
 458                 memcpy(msgbuf->ioctbuf, buf, buf_len);
 459         else
 460                 memset(msgbuf->ioctbuf, 0, buf_len);
 461
 462         err = brcmf_commonring_write_complete(commonring);
 463         brcmf_commonring_unlock(commonring);
 464
 465         return err;
 466 }
 467
 468
 469 static int brcmf_msgbuf_ioctl_resp_wait(struct brcmf_msgbuf *msgbuf)
 470 {
 471         return wait_event_timeout(msgbuf->ioctl_resp_wait,
 472                                   msgbuf->ctl_completed,
 473                                   MSGBUF_IOCTL_RESP_TIMEOUT);
 474 }
 475
 476
 477 static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
 478 {
 479         msgbuf->ctl_completed = true;
 480         wake_up(&msgbuf->ioctl_resp_wait);
 481 }
 482
 483
 484 static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 485                                    uint cmd, void *buf, uint len, int *fwerr)
 486 {
 487         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 488         struct sk_buff *skb = NULL;
 489         int timeout;
 490         int err;
 491
 492         brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
 493         *fwerr = 0;
 494         msgbuf->ctl_completed = false;
 495         err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
 496         if (err)
 497                 return err;
 498
 499         timeout = brcmf_msgbuf_ioctl_resp_wait(msgbuf);
 500         if (!timeout) {
 501                 brcmf_err("Timeout on response for query command\n");
 502                 return -EIO;
 503         }
 504
 505         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 506                                      msgbuf->rx_pktids,
 507                                      msgbuf->ioctl_resp_pktid);
 508         if (msgbuf->ioctl_resp_ret_len != 0) {
 509                 if (!skb)
 510                         return -EBADF;
 511
 512                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
 513                                        len : msgbuf->ioctl_resp_ret_len);
 514         }
 515         brcmu_pkt_buf_free_skb(skb);
 516
 517         *fwerr = msgbuf->ioctl_resp_status;
 518         return 0;
 519 }
 520
 521
 522 static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
 523                                  uint cmd, void *buf, uint len, int *fwerr)
 524 {
 525         return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
 526 }
 527
 528
 529 static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 530                                 struct sk_buff *skb, struct brcmf_if **ifp)
 531 {
 532         return -ENODEV;
 533 }
 534
 535 static void brcmf_msgbuf_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb)
 536 {
 537 }
 538
 539 static void
 540 brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
 541 {
 542         u32 dma_sz;
 543         void *dma_buf;
 544
 545         brcmf_dbg(MSGBUF, "Removing flowring %d\n", flowid);
 546
 547         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 548         dma_buf = msgbuf->flowrings[flowid]->buf_addr;
 549         dma_free_coherent(msgbuf->drvr->bus_if->dev, dma_sz, dma_buf,
 550                           msgbuf->flowring_dma_handle[flowid]);
 551
 552         brcmf_flowring_delete(msgbuf->flow, flowid);
 553 }
 554
 555
 556 static struct brcmf_msgbuf_work_item *
 557 brcmf_msgbuf_dequeue_work(struct brcmf_msgbuf *msgbuf)
 558 {
 559         struct brcmf_msgbuf_work_item *work = NULL;
 560         ulong flags;
 561
 562         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 563         if (!list_empty(&msgbuf->work_queue)) {
 564                 work = list_first_entry(&msgbuf->work_queue,
 565                                         struct brcmf_msgbuf_work_item, queue);
 566                 list_del(&work->queue);
 567         }
 568         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 569
 570         return work;
 571 }
 572
 573
 574 static u32
 575 brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
 576                                     struct brcmf_msgbuf_work_item *work)
 577 {
 578         struct msgbuf_tx_flowring_create_req *create;
 579         struct brcmf_commonring *commonring;
 580         void *ret_ptr;
 581         u32 flowid;
 582         void *dma_buf;
 583         u32 dma_sz;
 584         u64 address;
 585         int err;
 586
 587         flowid = work->flowid;
 588         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 589         dma_buf = dma_alloc_coherent(msgbuf->drvr->bus_if->dev, dma_sz,
 590                                      &msgbuf->flowring_dma_handle[flowid],
 591                                      GFP_KERNEL);
 592         if (!dma_buf) {
 593                 brcmf_err("dma_alloc_coherent failed\n");
 594                 brcmf_flowring_delete(msgbuf->flow, flowid);
 595                 return BRCMF_FLOWRING_INVALID_ID;
 596         }
 597
 598         brcmf_commonring_config(msgbuf->flowrings[flowid],
 599                                 BRCMF_H2D_TXFLOWRING_MAX_ITEM,
 600                                 BRCMF_H2D_TXFLOWRING_ITEMSIZE, dma_buf);
 601
 602         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 603         brcmf_commonring_lock(commonring);
 604         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 605         if (!ret_ptr) {
 606                 brcmf_err("Failed to reserve space in commonring\n");
 607                 brcmf_commonring_unlock(commonring);
 608                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 609                 return BRCMF_FLOWRING_INVALID_ID;
 610         }
 611
 612         create = (struct msgbuf_tx_flowring_create_req *)ret_ptr;
 613         create->msg.msgtype = MSGBUF_TYPE_FLOW_RING_CREATE;
 614         create->msg.ifidx = work->ifidx;
 615         create->msg.request_id = 0;
 616         create->tid = brcmf_flowring_tid(msgbuf->flow, flowid);
 617         create->flow_ring_id = cpu_to_le16(flowid +
 618                                            BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
 619         memcpy(create->sa, work->sa, ETH_ALEN);
 620         memcpy(create->da, work->da, ETH_ALEN);
 621         address = (u64)msgbuf->flowring_dma_handle[flowid];
 622         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
 623         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
 624         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
 625         create->len_item = cpu_to_le16(BRCMF_H2D_TXFLOWRING_ITEMSIZE);
 626
 627         brcmf_dbg(MSGBUF, "Send Flow Create Req flow ID %d for peer %pM prio %d ifindex %d\n",
 628                   flowid, work->da, create->tid, work->ifidx);
 629
 630         err = brcmf_commonring_write_complete(commonring);
 631         brcmf_commonring_unlock(commonring);
 632         if (err) {
 633                 brcmf_err("Failed to write commonring\n");
 634                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 635                 return BRCMF_FLOWRING_INVALID_ID;
 636         }
 637
 638         return flowid;
 639 }
 640
 641
 642 static void brcmf_msgbuf_flowring_worker(struct work_struct *work)
 643 {
 644         struct brcmf_msgbuf *msgbuf;
 645         struct brcmf_msgbuf_work_item *create;
 646
 647         msgbuf = container_of(work, struct brcmf_msgbuf, flowring_work);
 648
 649         while ((create = brcmf_msgbuf_dequeue_work(msgbuf))) {
 650                 brcmf_msgbuf_flowring_create_worker(msgbuf, create);
 651                 kfree(create);
 652         }
 653 }
 654
 655
 656 static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 657                                         struct sk_buff *skb)
 658 {
 659         struct brcmf_msgbuf_work_item *create;
 660         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 661         u32 flowid;
 662         ulong flags;
 663
 664         create = kzalloc(sizeof(*create), GFP_ATOMIC);
 665         if (create == NULL)
 666                 return BRCMF_FLOWRING_INVALID_ID;
 667
 668         flowid = brcmf_flowring_create(msgbuf->flow, eh->h_dest,
 669                                        skb->priority, ifidx);
 670         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 671                 kfree(create);
 672                 return flowid;
 673         }
 674
 675         create->flowid = flowid;
 676         create->ifidx = ifidx;
 677         memcpy(create->sa, eh->h_source, ETH_ALEN);
 678         memcpy(create->da, eh->h_dest, ETH_ALEN);
 679
 680         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 681         list_add_tail(&create->queue, &msgbuf->work_queue);
 682         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 683         schedule_work(&msgbuf->flowring_work);
 684
 685         return flowid;
 686 }
 687
 688
 689 static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
 690 {
 691         struct brcmf_flowring *flow = msgbuf->flow;
 692         struct brcmf_commonring *commonring;
 693         void *ret_ptr;
 694         u32 count;
 695         struct sk_buff *skb;
 696         dma_addr_t physaddr;
 697         u32 pktid;
 698         struct msgbuf_tx_msghdr *tx_msghdr;
 699         u64 address;
 700
 701         commonring = msgbuf->flowrings[flowid];
 702         if (!brcmf_commonring_write_available(commonring))
 703                 return;
 704
 705         brcmf_commonring_lock(commonring);
 706
 707         count = BRCMF_MSGBUF_TX_FLUSH_CNT2 - BRCMF_MSGBUF_TX_FLUSH_CNT1;
 708         while (brcmf_flowring_qlen(flow, flowid)) {
 709                 skb = brcmf_flowring_dequeue(flow, flowid);
 710                 if (skb == NULL) {
 711                         brcmf_err("No SKB, but qlen %d\n",
 712                                   brcmf_flowring_qlen(flow, flowid));
 713                         break;
 714                 }
 715                 skb_orphan(skb);
 716                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 717                                              msgbuf->tx_pktids, skb, ETH_HLEN,
 718                                              &physaddr, &pktid)) {
 719                         brcmf_flowring_reinsert(flow, flowid, skb);
 720                         brcmf_err("No PKTID available !!\n");
 721                         break;
 722                 }
 723                 ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 724                 if (!ret_ptr) {
 725                         brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 726                                                msgbuf->tx_pktids, pktid);
 727                         brcmf_flowring_reinsert(flow, flowid, skb);
 728                         break;
 729                 }
 730                 count++;
 731
 732                 tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
 733
 734                 tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
 735                 tx_msghdr->msg.request_id = cpu_to_le32(pktid);
 736                 tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
 737                 tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
 738                 tx_msghdr->flags |= (skb->priority & 0x07) <<
 739                                     BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT;
 740                 tx_msghdr->seg_cnt = 1;
 741                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
 742                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
 743                 address = (u64)physaddr;
 744                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
 745                 tx_msghdr->data_buf_addr.low_addr =
 746                         cpu_to_le32(address & 0xffffffff);
 747                 tx_msghdr->metadata_buf_len = 0;
 748                 tx_msghdr->metadata_buf_addr.high_addr = 0;
 749                 tx_msghdr->metadata_buf_addr.low_addr = 0;
 750                 atomic_inc(&commonring->outstanding_tx);
 751                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
 752                         brcmf_commonring_write_complete(commonring);
 753                         count = 0;
 754                 }
 755         }
 756         if (count)
 757                 brcmf_commonring_write_complete(commonring);
 758         brcmf_commonring_unlock(commonring);
 759 }
 760
 761
 762 static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 763 {
 764         struct brcmf_msgbuf *msgbuf;
 765         u32 flowid;
 766
 767         msgbuf = container_of(worker, struct brcmf_msgbuf, txflow_work);
 768         for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->max_flowrings) {
 769                 clear_bit(flowid, msgbuf->flow_map);
 770                 brcmf_msgbuf_txflow(msgbuf, flowid);
 771         }
 772 }
 773
 774
 775 static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid,
 776                                         bool force)
 777 {
 778         struct brcmf_commonring *commonring;
 779
 780         set_bit(flowid, msgbuf->flow_map);
 781         commonring = msgbuf->flowrings[flowid];
 782         if ((force) || (atomic_read(&commonring->outstanding_tx) <
 783                         BRCMF_MSGBUF_DELAY_TXWORKER_THRS))
 784                 queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 785
 786         return 0;
 787 }
 788
 789
 790 static int brcmf_msgbuf_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
 791                                       struct sk_buff *skb)
 792 {
 793         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 794         struct brcmf_flowring *flow = msgbuf->flow;
 795         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 796         u32 flowid;
 797         u32 queue_count;
 798         bool force;
 799
 800         flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
 801         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 802                 flowid = brcmf_msgbuf_flowring_create(msgbuf, ifidx, skb);
 803                 if (flowid == BRCMF_FLOWRING_INVALID_ID)
 804                         return -ENOMEM;
 805         }
 806         queue_count = brcmf_flowring_enqueue(flow, flowid, skb);
 807         force = ((queue_count % BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) == 0);
 808         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, force);
 809
 810         return 0;
 811 }
 812
 813
 814 static void
 815 brcmf_msgbuf_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
 816                                  enum proto_addr_mode addr_mode)
 817 {
 818         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 819
 820         brcmf_flowring_configure_addr_mode(msgbuf->flow, ifidx, addr_mode);
 821 }
 822
 823
 824 static void
 825 brcmf_msgbuf_delete_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 826 {
 827         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 828
 829         brcmf_flowring_delete_peer(msgbuf->flow, ifidx, peer);
 830 }
 831
 832
 833 static void
 834 brcmf_msgbuf_add_tdls_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 835 {
 836         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 837
 838         brcmf_flowring_add_tdls_peer(msgbuf->flow, ifidx, peer);
 839 }
 840
 841
 842 static void
 843 brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 844 {
 845         struct msgbuf_ioctl_resp_hdr *ioctl_resp;
 846
 847         ioctl_resp = (struct msgbuf_ioctl_resp_hdr *)buf;
 848
 849         msgbuf->ioctl_resp_status =
 850                         (s16)le16_to_cpu(ioctl_resp->compl_hdr.status);
 851         msgbuf->ioctl_resp_ret_len = le16_to_cpu(ioctl_resp->resp_len);
 852         msgbuf->ioctl_resp_pktid = le32_to_cpu(ioctl_resp->msg.request_id);
 853
 854         brcmf_msgbuf_ioctl_resp_wake(msgbuf);
 855
 856         if (msgbuf->cur_ioctlrespbuf)
 857                 msgbuf->cur_ioctlrespbuf--;
 858         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
 859 }
 860
 861
 862 static void
 863 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 864 {
 865         struct brcmf_commonring *commonring;
 866         struct msgbuf_tx_status *tx_status;
 867         u32 idx;
 868         struct sk_buff *skb;
 869         u16 flowid;
 870
 871         tx_status = (struct msgbuf_tx_status *)buf;
 872         idx = le32_to_cpu(tx_status->msg.request_id);
 873         flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
 874         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
 875         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 876                                      msgbuf->tx_pktids, idx);
 877         if (!skb)
 878                 return;
 879
 880         set_bit(flowid, msgbuf->txstatus_done_map);
 881         commonring = msgbuf->flowrings[flowid];
 882         atomic_dec(&commonring->outstanding_tx);
 883
 884         brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
 885                          skb, true);
 886 }
 887
 888
 889 static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
 890 {
 891         struct brcmf_commonring *commonring;
 892         void *ret_ptr;
 893         struct sk_buff *skb;
 894         u16 alloced;
 895         u32 pktlen;
 896         dma_addr_t physaddr;
 897         struct msgbuf_rx_bufpost *rx_bufpost;
 898         u64 address;
 899         u32 pktid;
 900         u32 i;
 901
 902         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
 903         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
 904                                                               count,
 905                                                               &alloced);
 906         if (!ret_ptr) {
 907                 brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
 908                 return 0;
 909         }
 910
 911         for (i = 0; i < alloced; i++) {
 912                 rx_bufpost = (struct msgbuf_rx_bufpost *)ret_ptr;
 913                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
 914
 915                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
 916
 917                 if (skb == NULL) {
 918                         brcmf_err("Failed to alloc SKB\n");
 919                         brcmf_commonring_write_cancel(commonring, alloced - i);
 920                         break;
 921                 }
 922
 923                 pktlen = skb->len;
 924                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 925                                              msgbuf->rx_pktids, skb, 0,
 926                                              &physaddr, &pktid)) {
 927                         dev_kfree_skb_any(skb);
 928                         brcmf_err("No PKTID available !!\n");
 929                         brcmf_commonring_write_cancel(commonring, alloced - i);
 930                         break;
 931                 }
 932
 933                 if (msgbuf->rx_metadata_offset) {
 934                         address = (u64)physaddr;
 935                         rx_bufpost->metadata_buf_len =
 936                                 cpu_to_le16(msgbuf->rx_metadata_offset);
 937                         rx_bufpost->metadata_buf_addr.high_addr =
 938                                 cpu_to_le32(address >> 32);
 939                         rx_bufpost->metadata_buf_addr.low_addr =
 940                                 cpu_to_le32(address & 0xffffffff);
 941
 942                         skb_pull(skb, msgbuf->rx_metadata_offset);
 943                         pktlen = skb->len;
 944                         physaddr += msgbuf->rx_metadata_offset;
 945                 }
 946                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
 947                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 948
 949                 address = (u64)physaddr;
 950                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
 951                 rx_bufpost->data_buf_addr.high_addr =
 952                         cpu_to_le32(address >> 32);
 953                 rx_bufpost->data_buf_addr.low_addr =
 954                         cpu_to_le32(address & 0xffffffff);
 955
 956                 ret_ptr += brcmf_commonring_len_item(commonring);
 957         }
 958
 959         if (i)
 960                 brcmf_commonring_write_complete(commonring);
 961
 962         return i;
 963 }
 964
 965
 966 static void
 967 brcmf_msgbuf_rxbuf_data_fill(struct brcmf_msgbuf *msgbuf)
 968 {
 969         u32 fillbufs;
 970         u32 retcount;
 971
 972         fillbufs = msgbuf->max_rxbufpost - msgbuf->rxbufpost;
 973
 974         while (fillbufs) {
 975                 retcount = brcmf_msgbuf_rxbuf_data_post(msgbuf, fillbufs);
 976                 if (!retcount)
 977                         break;
 978                 msgbuf->rxbufpost += retcount;
 979                 fillbufs -= retcount;
 980         }
 981 }
 982
 983
 984 static void
 985 brcmf_msgbuf_update_rxbufpost_count(struct brcmf_msgbuf *msgbuf, u16 rxcnt)
 986 {
 987         msgbuf->rxbufpost -= rxcnt;
 988         if (msgbuf->rxbufpost <= (msgbuf->max_rxbufpost -
 989                                   BRCMF_MSGBUF_RXBUFPOST_THRESHOLD))
 990                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
 991 }
 992
 993
 994 static u32
 995 brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
 996                              u32 count)
 997 {
 998         struct brcmf_commonring *commonring;
 999         void *ret_ptr;
1000         struct sk_buff *skb;
1001         u16 alloced;
1002         u32 pktlen;
1003         dma_addr_t physaddr;
1004         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
1005         u64 address;
1006         u32 pktid;
1007         u32 i;
1008
1009         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1010         brcmf_commonring_lock(commonring);
1011         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
1012                                                               count,
1013                                                               &alloced);
1014         if (!ret_ptr) {
1015                 brcmf_err("Failed to reserve space in commonring\n");
1016                 brcmf_commonring_unlock(commonring);
1017                 return 0;
1018         }
1019
1020         for (i = 0; i < alloced; i++) {
1021                 rx_bufpost = (struct msgbuf_rx_ioctl_resp_or_event *)ret_ptr;
1022                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
1023
1024                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
1025
1026                 if (skb == NULL) {
1027                         brcmf_err("Failed to alloc SKB\n");
1028                         brcmf_commonring_write_cancel(commonring, alloced - i);
1029                         break;
1030                 }
1031
1032                 pktlen = skb->len;
1033                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
1034                                              msgbuf->rx_pktids, skb, 0,
1035                                              &physaddr, &pktid)) {
1036                         dev_kfree_skb_any(skb);
1037                         brcmf_err("No PKTID available !!\n");
1038                         brcmf_commonring_write_cancel(commonring, alloced - i);
1039                         break;
1040                 }
1041                 if (event_buf)
1042                         rx_bufpost->msg.msgtype = MSGBUF_TYPE_EVENT_BUF_POST;
1043                 else
1044                         rx_bufpost->msg.msgtype =
1045                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
1046                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
1047
1048                 address = (u64)physaddr;
1049                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
1050                 rx_bufpost->host_buf_addr.high_addr =
1051                         cpu_to_le32(address >> 32);
1052                 rx_bufpost->host_buf_addr.low_addr =
1053                         cpu_to_le32(address & 0xffffffff);
1054
1055                 ret_ptr += brcmf_commonring_len_item(commonring);
1056         }
1057
1058         if (i)
1059                 brcmf_commonring_write_complete(commonring);
1060
1061         brcmf_commonring_unlock(commonring);
1062
1063         return i;
1064 }
1065
1066
1067 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf)
1068 {
1069         u32 count;
1070
1071         count = msgbuf->max_ioctlrespbuf - msgbuf->cur_ioctlrespbuf;
1072         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, false, count);
1073         msgbuf->cur_ioctlrespbuf += count;
1074 }
1075
1076
1077 static void brcmf_msgbuf_rxbuf_event_post(struct brcmf_msgbuf *msgbuf)
1078 {
1079         u32 count;
1080
1081         count = msgbuf->max_eventbuf - msgbuf->cur_eventbuf;
1082         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, true, count);
1083         msgbuf->cur_eventbuf += count;
1084 }
1085
1086
1087 static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
1088 {
1089         struct msgbuf_rx_event *event;
1090         u32 idx;
1091         u16 buflen;
1092         struct sk_buff *skb;
1093         struct brcmf_if *ifp;
1094
1095         event = (struct msgbuf_rx_event *)buf;
1096         idx = le32_to_cpu(event->msg.request_id);
1097         buflen = le16_to_cpu(event->event_data_len);
1098
1099         if (msgbuf->cur_eventbuf)
1100                 msgbuf->cur_eventbuf--;
1101         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1102
1103         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1104                                      msgbuf->rx_pktids, idx);
1105         if (!skb)
1106                 return;
1107
1108         if (msgbuf->rx_dataoffset)
1109                 skb_pull(skb, msgbuf->rx_dataoffset);
1110
1111         skb_trim(skb, buflen);
1112
1113         ifp = brcmf_get_ifp(msgbuf->drvr, event->msg.ifidx);
1114         if (!ifp || !ifp->ndev) {
1115                 brcmf_err("Received pkt for invalid ifidx %d\n",
1116                           event->msg.ifidx);
1117                 goto exit;
1118         }
1119
1120         skb->protocol = eth_type_trans(skb, ifp->ndev);
1121
1122         brcmf_fweh_process_skb(ifp->drvr, skb, 0);
1123
1124 exit:
1125         brcmu_pkt_buf_free_skb(skb);
1126 }
1127
1128
1129 static void
1130 brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
1131 {
1132         struct msgbuf_rx_complete *rx_complete;
1133         struct sk_buff *skb;
1134         u16 data_offset;
1135         u16 buflen;
1136         u16 flags;
1137         u32 idx;
1138         struct brcmf_if *ifp;
1139
1140         brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1);
1141
1142         rx_complete = (struct msgbuf_rx_complete *)buf;
1143         data_offset = le16_to_cpu(rx_complete->data_offset);
1144         buflen = le16_to_cpu(rx_complete->data_len);
1145         idx = le32_to_cpu(rx_complete->msg.request_id);
1146         flags = le16_to_cpu(rx_complete->flags);
1147
1148         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1149                                      msgbuf->rx_pktids, idx);
1150         if (!skb)
1151                 return;
1152
1153         if (data_offset)
1154                 skb_pull(skb, data_offset);
1155         else if (msgbuf->rx_dataoffset)
1156                 skb_pull(skb, msgbuf->rx_dataoffset);
1157
1158         skb_trim(skb, buflen);
1159
1160         if ((flags & BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK) ==
1161             BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11) {
1162                 ifp = msgbuf->drvr->mon_if;
1163
1164                 if (!ifp) {
1165                         brcmf_err("Received unexpected monitor pkt\n");
1166                         brcmu_pkt_buf_free_skb(skb);
1167                         return;
1168                 }
1169
1170                 brcmf_netif_mon_rx(ifp, skb);
1171                 return;
1172         }
1173
1174         ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
1175         if (!ifp || !ifp->ndev) {
1176                 brcmf_err("Received pkt for invalid ifidx %d\n",
1177                           rx_complete->msg.ifidx);
1178                 brcmu_pkt_buf_free_skb(skb);
1179                 return;
1180         }
1181
1182         skb->protocol = eth_type_trans(skb, ifp->ndev);
1183         brcmf_netif_rx(ifp, skb);
1184 }
1185
1186
1187 static void
1188 brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
1189                                                void *buf)
1190 {
1191         struct msgbuf_flowring_create_resp *flowring_create_resp;
1192         u16 status;
1193         u16 flowid;
1194
1195         flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
1196
1197         flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
1198         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
1199         status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
1200
1201         if (status) {
1202                 brcmf_err("Flowring creation failed, code %d\n", status);
1203                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1204                 return;
1205         }
1206         brcmf_dbg(MSGBUF, "Flowring %d Create response status %d\n", flowid,
1207                   status);
1208
1209         brcmf_flowring_open(msgbuf->flow, flowid);
1210
1211         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1212 }
1213
1214
1215 static void
1216 brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
1217                                                void *buf)
1218 {
1219         struct msgbuf_flowring_delete_resp *flowring_delete_resp;
1220         u16 status;
1221         u16 flowid;
1222
1223         flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
1224
1225         flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
1226         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
1227         status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
1228
1229         if (status) {
1230                 brcmf_err("Flowring deletion failed, code %d\n", status);
1231                 brcmf_flowring_delete(msgbuf->flow, flowid);
1232                 return;
1233         }
1234         brcmf_dbg(MSGBUF, "Flowring %d Delete response status %d\n", flowid,
1235                   status);
1236
1237         brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1238 }
1239
1240
1241 static void brcmf_msgbuf_process_msgtype(struct brcmf_msgbuf *msgbuf, void *buf)
1242 {
1243         struct msgbuf_common_hdr *msg;
1244
1245         msg = (struct msgbuf_common_hdr *)buf;
1246         switch (msg->msgtype) {
1247         case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
1248                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
1249                 brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);
1250                 break;
1251         case MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT:
1252                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT\n");
1253                 brcmf_msgbuf_process_flow_ring_delete_response(msgbuf, buf);
1254                 break;
1255         case MSGBUF_TYPE_IOCTLPTR_REQ_ACK:
1256                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTLPTR_REQ_ACK\n");
1257                 break;
1258         case MSGBUF_TYPE_IOCTL_CMPLT:
1259                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTL_CMPLT\n");
1260                 brcmf_msgbuf_process_ioctl_complete(msgbuf, buf);
1261                 break;
1262         case MSGBUF_TYPE_WL_EVENT:
1263                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_WL_EVENT\n");
1264                 brcmf_msgbuf_process_event(msgbuf, buf);
1265                 break;
1266         case MSGBUF_TYPE_TX_STATUS:
1267                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_TX_STATUS\n");
1268                 brcmf_msgbuf_process_txstatus(msgbuf, buf);
1269                 break;
1270         case MSGBUF_TYPE_RX_CMPLT:
1271                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RX_CMPLT\n");
1272                 brcmf_msgbuf_process_rx_complete(msgbuf, buf);
1273                 break;
1274         default:
1275                 brcmf_err("Unsupported msgtype %d\n", msg->msgtype);
1276                 break;
1277         }
1278 }
1279
1280
1281 static void brcmf_msgbuf_process_rx(struct brcmf_msgbuf *msgbuf,
1282                                     struct brcmf_commonring *commonring)
1283 {
1284         void *buf;
1285         u16 count;
1286         u16 processed;
1287
1288 again:
1289         buf = brcmf_commonring_get_read_ptr(commonring, &count);
1290         if (buf == NULL)
1291                 return;
1292
1293         processed = 0;
1294         while (count) {
1295                 brcmf_msgbuf_process_msgtype(msgbuf,
1296                                              buf + msgbuf->rx_dataoffset);
1297                 buf += brcmf_commonring_len_item(commonring);
1298                 processed++;
1299                 if (processed == BRCMF_MSGBUF_UPDATE_RX_PTR_THRS) {
1300                         brcmf_commonring_read_complete(commonring, processed);
1301                         processed = 0;
1302                 }
1303                 count--;
1304         }
1305         if (processed)
1306                 brcmf_commonring_read_complete(commonring, processed);
1307
1308         if (commonring->r_ptr == 0)
1309                 goto again;
1310 }
1311
1312
1313 int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
1314 {
1315         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1316         struct brcmf_pub *drvr = bus_if->drvr;
1317         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1318         struct brcmf_commonring *commonring;
1319         void *buf;
1320         u32 flowid;
1321         int qlen;
1322
1323         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1324         brcmf_msgbuf_process_rx(msgbuf, buf);
1325         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1326         brcmf_msgbuf_process_rx(msgbuf, buf);
1327         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1328         brcmf_msgbuf_process_rx(msgbuf, buf);
1329
1330         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
1331                          msgbuf->max_flowrings) {
1332                 clear_bit(flowid, msgbuf->txstatus_done_map);
1333                 commonring = msgbuf->flowrings[flowid];
1334                 qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
1335                 if ((qlen > BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) ||
1336                     ((qlen) && (atomic_read(&commonring->outstanding_tx) <
1337                                 BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS)))
1338                         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1339         }
1340
1341         return 0;
1342 }
1343
1344
1345 void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
1346 {
1347         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1348         struct msgbuf_tx_flowring_delete_req *delete;
1349         struct brcmf_commonring *commonring;
1350         void *ret_ptr;
1351         u8 ifidx;
1352         int err;
1353
1354         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1355         brcmf_commonring_lock(commonring);
1356         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
1357         if (!ret_ptr) {
1358                 brcmf_err("FW unaware, flowring will be removed !!\n");
1359                 brcmf_commonring_unlock(commonring);
1360                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1361                 return;
1362         }
1363
1364         delete = (struct msgbuf_tx_flowring_delete_req *)ret_ptr;
1365
1366         ifidx = brcmf_flowring_ifidx_get(msgbuf->flow, flowid);
1367
1368         delete->msg.msgtype = MSGBUF_TYPE_FLOW_RING_DELETE;
1369         delete->msg.ifidx = ifidx;
1370         delete->msg.request_id = 0;
1371
1372         delete->flow_ring_id = cpu_to_le16(flowid +
1373                                            BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
1374         delete->reason = 0;
1375
1376         brcmf_dbg(MSGBUF, "Send Flow Delete Req flow ID %d, ifindex %d\n",
1377                   flowid, ifidx);
1378
1379         err = brcmf_commonring_write_complete(commonring);
1380         brcmf_commonring_unlock(commonring);
1381         if (err) {
1382                 brcmf_err("Failed to submit RING_DELETE, flowring will be removed\n");
1383                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1384         }
1385 }
1386
1387 #ifdef DEBUG
1388 static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
1389 {
1390         struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
1391         struct brcmf_pub *drvr = bus_if->drvr;
1392         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1393         struct brcmf_commonring *commonring;
1394         u16 i;
1395         struct brcmf_flowring_ring *ring;
1396         struct brcmf_flowring_hash *hash;
1397
1398         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1399         seq_printf(seq, "h2d_ctl_submit: rp %4u, wp %4u, depth %4u\n",
1400                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1401         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
1402         seq_printf(seq, "h2d_rx_submit:  rp %4u, wp %4u, depth %4u\n",
1403                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1404         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1405         seq_printf(seq, "d2h_ctl_cmplt:  rp %4u, wp %4u, depth %4u\n",
1406                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1407         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1408         seq_printf(seq, "d2h_tx_cmplt:   rp %4u, wp %4u, depth %4u\n",
1409                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1410         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1411         seq_printf(seq, "d2h_rx_cmplt:   rp %4u, wp %4u, depth %4u\n",
1412                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1413
1414         seq_printf(seq, "\nh2d_flowrings: depth %u\n",
1415                    BRCMF_H2D_TXFLOWRING_MAX_ITEM);
1416         seq_puts(seq, "Active flowrings:\n");
1417         hash = msgbuf->flow->hash;
1418         for (i = 0; i < msgbuf->flow->nrofrings; i++) {
1419                 if (!msgbuf->flow->rings[i])
1420                         continue;
1421                 ring = msgbuf->flow->rings[i];
1422                 if (ring->status != RING_OPEN)
1423                         continue;
1424                 commonring = msgbuf->flowrings[i];
1425                 hash = &msgbuf->flow->hash[ring->hash_id];
1426                 seq_printf(seq, "id %3u: rp %4u, wp %4u, qlen %4u, blocked %u\n"
1427                                 "        ifidx %u, fifo %u, da %pM\n",
1428                                 i, commonring->r_ptr, commonring->w_ptr,
1429                                 skb_queue_len(&ring->skblist), ring->blocked,
1430                                 hash->ifidx, hash->fifo, hash->mac);
1431         }
1432
1433         return 0;
1434 }
1435 #else
1436 static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
1437 {
1438         return 0;
1439 }
1440 #endif
1441
1442 static void brcmf_msgbuf_debugfs_create(struct brcmf_pub *drvr)
1443 {
1444         brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
1445 }
1446
1447 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
1448 {
1449         struct brcmf_bus_msgbuf *if_msgbuf;
1450         struct brcmf_msgbuf *msgbuf;
1451         u64 address;
1452         u32 count;
1453
1454         if_msgbuf = drvr->bus_if->msgbuf;
1455
1456         if (if_msgbuf->max_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
1457                 brcmf_err("driver not configured for this many flowrings %d\n",
1458                           if_msgbuf->max_flowrings);
1459                 if_msgbuf->max_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
1460         }
1461
1462         msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
1463         if (!msgbuf)
1464                 goto fail;
1465
1466         msgbuf->txflow_wq = create_singlethread_workqueue("msgbuf_txflow");
1467         if (msgbuf->txflow_wq == NULL) {
1468                 brcmf_err("workqueue creation failed\n");
1469                 goto fail;
1470         }
1471         INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
1472         count = BITS_TO_LONGS(if_msgbuf->max_flowrings);
1473         count = count * sizeof(unsigned long);
1474         msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
1475         if (!msgbuf->flow_map)
1476                 goto fail;
1477
1478         msgbuf->txstatus_done_map = kzalloc(count, GFP_KERNEL);
1479         if (!msgbuf->txstatus_done_map)
1480                 goto fail;
1481
1482         msgbuf->drvr = drvr;
1483         msgbuf->ioctbuf = dma_alloc_coherent(drvr->bus_if->dev,
1484                                              BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1485                                              &msgbuf->ioctbuf_handle,
1486                                              GFP_KERNEL);
1487         if (!msgbuf->ioctbuf)
1488                 goto fail;
1489         address = (u64)msgbuf->ioctbuf_handle;
1490         msgbuf->ioctbuf_phys_hi = address >> 32;
1491         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
1492
1493         drvr->proto->hdrpull = brcmf_msgbuf_hdrpull;
1494         drvr->proto->query_dcmd = brcmf_msgbuf_query_dcmd;
1495         drvr->proto->set_dcmd = brcmf_msgbuf_set_dcmd;
1496         drvr->proto->tx_queue_data = brcmf_msgbuf_tx_queue_data;
1497         drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
1498         drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
1499         drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
1500         drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
1501         drvr->proto->debugfs_create = brcmf_msgbuf_debugfs_create;
1502         drvr->proto->pd = msgbuf;
1503
1504         init_waitqueue_head(&msgbuf->ioctl_resp_wait);
1505
1506         msgbuf->commonrings =
1507                 (struct brcmf_commonring **)if_msgbuf->commonrings;
1508         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
1509         msgbuf->max_flowrings = if_msgbuf->max_flowrings;
1510         msgbuf->flowring_dma_handle =
1511                 kcalloc(msgbuf->max_flowrings,
1512                         sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
1513         if (!msgbuf->flowring_dma_handle)
1514                 goto fail;
1515
1516         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
1517         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
1518
1519         msgbuf->max_ioctlrespbuf = BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST;
1520         msgbuf->max_eventbuf = BRCMF_MSGBUF_MAX_EVENTBUF_POST;
1521
1522         msgbuf->tx_pktids = brcmf_msgbuf_init_pktids(NR_TX_PKTIDS,
1523                                                      DMA_TO_DEVICE);
1524         if (!msgbuf->tx_pktids)
1525                 goto fail;
1526         msgbuf->rx_pktids = brcmf_msgbuf_init_pktids(NR_RX_PKTIDS,
1527                                                      DMA_FROM_DEVICE);
1528         if (!msgbuf->rx_pktids)
1529                 goto fail;
1530
1531         msgbuf->flow = brcmf_flowring_attach(drvr->bus_if->dev,
1532                                              if_msgbuf->max_flowrings);
1533         if (!msgbuf->flow)
1534                 goto fail;
1535
1536
1537         brcmf_dbg(MSGBUF, "Feeding buffers, rx data %d, rx event %d, rx ioctl resp %d\n",
1538                   msgbuf->max_rxbufpost, msgbuf->max_eventbuf,
1539                   msgbuf->max_ioctlrespbuf);
1540         count = 0;
1541         do {
1542                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
1543                 if (msgbuf->max_rxbufpost != msgbuf->rxbufpost)
1544                         msleep(10);
1545                 else
1546                         break;
1547                 count++;
1548         } while (count < 10);
1549         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1550         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
1551
1552         INIT_WORK(&msgbuf->flowring_work, brcmf_msgbuf_flowring_worker);
1553         spin_lock_init(&msgbuf->flowring_work_lock);
1554         INIT_LIST_HEAD(&msgbuf->work_queue);
1555
1556         return 0;
1557
1558 fail:
1559         if (msgbuf) {
1560                 kfree(msgbuf->flow_map);
1561                 kfree(msgbuf->txstatus_done_map);
1562                 brcmf_msgbuf_release_pktids(msgbuf);
1563                 kfree(msgbuf->flowring_dma_handle);
1564                 if (msgbuf->ioctbuf)
1565                         dma_free_coherent(drvr->bus_if->dev,
1566                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1567                                           msgbuf->ioctbuf,
1568                                           msgbuf->ioctbuf_handle);
1569                 if (msgbuf->txflow_wq)
1570                         destroy_workqueue(msgbuf->txflow_wq);
1571                 kfree(msgbuf);
1572         }
1573         return -ENOMEM;
1574 }
1575
1576
1577 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
1578 {
1579         struct brcmf_msgbuf *msgbuf;
1580         struct brcmf_msgbuf_work_item *work;
1581
1582         brcmf_dbg(TRACE, "Enter\n");
1583         if (drvr->proto->pd) {
1584                 msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1585                 cancel_work_sync(&msgbuf->flowring_work);
1586                 while (!list_empty(&msgbuf->work_queue)) {
1587                         work = list_first_entry(&msgbuf->work_queue,
1588                                                 struct brcmf_msgbuf_work_item,
1589                                                 queue);
1590                         list_del(&work->queue);
1591                         kfree(work);
1592                 }
1593                 kfree(msgbuf->flow_map);
1594                 kfree(msgbuf->txstatus_done_map);
1595                 if (msgbuf->txflow_wq)
1596                         destroy_workqueue(msgbuf->txflow_wq);
1597
1598                 brcmf_flowring_detach(msgbuf->flow);
1599                 dma_free_coherent(drvr->bus_if->dev,
1600                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1601                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
1602                 brcmf_msgbuf_release_pktids(msgbuf);
1603                 kfree(msgbuf->flowring_dma_handle);
1604                 kfree(msgbuf);
1605                 drvr->proto->pd = NULL;
1606         }
1607 }