drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c

   1 /* Copyright (c) 2014 Broadcom Corporation
   2  *
   3  * Permission to use, copy, modify, and/or distribute this software for any
   4  * purpose with or without fee is hereby granted, provided that the above
   5  * copyright notice and this permission notice appear in all copies.
   6  *
   7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  14  */
  15
  16 /*******************************************************************************
  17  * Communicates with the dongle by using dcmd codes.
  18  * For certain dcmd codes, the dongle interprets string data from the host.
  19  ******************************************************************************/
  20
  21 #include <linux/types.h>
  22 #include <linux/netdevice.h>
  23
  24 #include <brcmu_utils.h>
  25 #include <brcmu_wifi.h>
  26
  27 #include "dhd.h"
  28 #include "dhd_dbg.h"
  29 #include "proto.h"
  30 #include "msgbuf.h"
  31 #include "commonring.h"
  32 #include "flowring.h"
  33 #include "dhd_bus.h"
  34 #include "tracepoint.h"
  35
  36
  37 #define MSGBUF_IOCTL_RESP_TIMEOUT               2000
  38
  39 #define MSGBUF_TYPE_GEN_STATUS                  0x1
  40 #define MSGBUF_TYPE_RING_STATUS                 0x2
  41 #define MSGBUF_TYPE_FLOW_RING_CREATE            0x3
  42 #define MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT      0x4
  43 #define MSGBUF_TYPE_FLOW_RING_DELETE            0x5
  44 #define MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT      0x6
  45 #define MSGBUF_TYPE_FLOW_RING_FLUSH             0x7
  46 #define MSGBUF_TYPE_FLOW_RING_FLUSH_CMPLT       0x8
  47 #define MSGBUF_TYPE_IOCTLPTR_REQ                0x9
  48 #define MSGBUF_TYPE_IOCTLPTR_REQ_ACK            0xA
  49 #define MSGBUF_TYPE_IOCTLRESP_BUF_POST          0xB
  50 #define MSGBUF_TYPE_IOCTL_CMPLT                 0xC
  51 #define MSGBUF_TYPE_EVENT_BUF_POST              0xD
  52 #define MSGBUF_TYPE_WL_EVENT                    0xE
  53 #define MSGBUF_TYPE_TX_POST                     0xF
  54 #define MSGBUF_TYPE_TX_STATUS                   0x10
  55 #define MSGBUF_TYPE_RXBUF_POST                  0x11
  56 #define MSGBUF_TYPE_RX_CMPLT                    0x12
  57 #define MSGBUF_TYPE_LPBK_DMAXFER                0x13
  58 #define MSGBUF_TYPE_LPBK_DMAXFER_CMPLT          0x14
  59
  60 #define NR_TX_PKTIDS                            2048
  61 #define NR_RX_PKTIDS                            1024
  62
  63 #define BRCMF_IOCTL_REQ_PKTID                   0xFFFE
  64
  65 #define BRCMF_MSGBUF_MAX_PKT_SIZE               2048
  66 #define BRCMF_MSGBUF_RXBUFPOST_THRESHOLD        32
  67 #define BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST      8
  68 #define BRCMF_MSGBUF_MAX_EVENTBUF_POST          8
  69
  70 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3      0x01
  71 #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT       5
  72
  73 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
  74 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
  75
  76
  77 struct msgbuf_common_hdr {
  78         u8                              msgtype;
  79         u8                              ifidx;
  80         u8                              flags;
  81         u8                              rsvd0;
  82         __le32                          request_id;
  83 };
  84
  85 struct msgbuf_buf_addr {
  86         __le32                          low_addr;
  87         __le32                          high_addr;
  88 };
  89
  90 struct msgbuf_ioctl_req_hdr {
  91         struct msgbuf_common_hdr        msg;
  92         __le32                          cmd;
  93         __le16                          trans_id;
  94         __le16                          input_buf_len;
  95         __le16                          output_buf_len;
  96         __le16                          rsvd0[3];
  97         struct msgbuf_buf_addr          req_buf_addr;
  98         __le32                          rsvd1[2];
  99 };
 100
 101 struct msgbuf_tx_msghdr {
 102         struct msgbuf_common_hdr        msg;
 103         u8                              txhdr[ETH_HLEN];
 104         u8                              flags;
 105         u8                              seg_cnt;
 106         struct msgbuf_buf_addr          metadata_buf_addr;
 107         struct msgbuf_buf_addr          data_buf_addr;
 108         __le16                          metadata_buf_len;
 109         __le16                          data_len;
 110         __le32                          rsvd0;
 111 };
 112
 113 struct msgbuf_rx_bufpost {
 114         struct msgbuf_common_hdr        msg;
 115         __le16                          metadata_buf_len;
 116         __le16                          data_buf_len;
 117         __le32                          rsvd0;
 118         struct msgbuf_buf_addr          metadata_buf_addr;
 119         struct msgbuf_buf_addr          data_buf_addr;
 120 };
 121
 122 struct msgbuf_rx_ioctl_resp_or_event {
 123         struct msgbuf_common_hdr        msg;
 124         __le16                          host_buf_len;
 125         __le16                          rsvd0[3];
 126         struct msgbuf_buf_addr          host_buf_addr;
 127         __le32                          rsvd1[4];
 128 };
 129
 130 struct msgbuf_completion_hdr {
 131         __le16                          status;
 132         __le16                          flow_ring_id;
 133 };
 134
 135 struct msgbuf_rx_event {
 136         struct msgbuf_common_hdr        msg;
 137         struct msgbuf_completion_hdr    compl_hdr;
 138         __le16                          event_data_len;
 139         __le16                          seqnum;
 140         __le16                          rsvd0[4];
 141 };
 142
 143 struct msgbuf_ioctl_resp_hdr {
 144         struct msgbuf_common_hdr        msg;
 145         struct msgbuf_completion_hdr    compl_hdr;
 146         __le16                          resp_len;
 147         __le16                          trans_id;
 148         __le32                          cmd;
 149         __le32                          rsvd0;
 150 };
 151
 152 struct msgbuf_tx_status {
 153         struct msgbuf_common_hdr        msg;
 154         struct msgbuf_completion_hdr    compl_hdr;
 155         __le16                          metadata_len;
 156         __le16                          tx_status;
 157 };
 158
 159 struct msgbuf_rx_complete {
 160         struct msgbuf_common_hdr        msg;
 161         struct msgbuf_completion_hdr    compl_hdr;
 162         __le16                          metadata_len;
 163         __le16                          data_len;
 164         __le16                          data_offset;
 165         __le16                          flags;
 166         __le32                          rx_status_0;
 167         __le32                          rx_status_1;
 168         __le32                          rsvd0;
 169 };
 170
 171 struct msgbuf_tx_flowring_create_req {
 172         struct msgbuf_common_hdr        msg;
 173         u8                              da[ETH_ALEN];
 174         u8                              sa[ETH_ALEN];
 175         u8                              tid;
 176         u8                              if_flags;
 177         __le16                          flow_ring_id;
 178         u8                              tc;
 179         u8                              priority;
 180         __le16                          int_vector;
 181         __le16                          max_items;
 182         __le16                          len_item;
 183         struct msgbuf_buf_addr          flow_ring_addr;
 184 };
 185
 186 struct msgbuf_tx_flowring_delete_req {
 187         struct msgbuf_common_hdr        msg;
 188         __le16                          flow_ring_id;
 189         __le16                          reason;
 190         __le32                          rsvd0[7];
 191 };
 192
 193 struct msgbuf_flowring_create_resp {
 194         struct msgbuf_common_hdr        msg;
 195         struct msgbuf_completion_hdr    compl_hdr;
 196         __le32                          rsvd0[3];
 197 };
 198
 199 struct msgbuf_flowring_delete_resp {
 200         struct msgbuf_common_hdr        msg;
 201         struct msgbuf_completion_hdr    compl_hdr;
 202         __le32                          rsvd0[3];
 203 };
 204
 205 struct msgbuf_flowring_flush_resp {
 206         struct msgbuf_common_hdr        msg;
 207         struct msgbuf_completion_hdr    compl_hdr;
 208         __le32                          rsvd0[3];
 209 };
 210
 211 struct brcmf_msgbuf_work_item {
 212         struct list_head queue;
 213         u32 flowid;
 214         int ifidx;
 215         u8 sa[ETH_ALEN];
 216         u8 da[ETH_ALEN];
 217 };
 218
 219 struct brcmf_msgbuf {
 220         struct brcmf_pub *drvr;
 221
 222         struct brcmf_commonring **commonrings;
 223         struct brcmf_commonring **flowrings;
 224         dma_addr_t *flowring_dma_handle;
 225         u16 nrof_flowrings;
 226
 227         u16 rx_dataoffset;
 228         u32 max_rxbufpost;
 229         u16 rx_metadata_offset;
 230         u32 rxbufpost;
 231
 232         u32 max_ioctlrespbuf;
 233         u32 cur_ioctlrespbuf;
 234         u32 max_eventbuf;
 235         u32 cur_eventbuf;
 236
 237         void *ioctbuf;
 238         dma_addr_t ioctbuf_handle;
 239         u32 ioctbuf_phys_hi;
 240         u32 ioctbuf_phys_lo;
 241         int ioctl_resp_status;
 242         u32 ioctl_resp_ret_len;
 243         u32 ioctl_resp_pktid;
 244
 245         u16 data_seq_no;
 246         u16 ioctl_seq_no;
 247         u32 reqid;
 248         wait_queue_head_t ioctl_resp_wait;
 249         bool ctl_completed;
 250
 251         struct brcmf_msgbuf_pktids *tx_pktids;
 252         struct brcmf_msgbuf_pktids *rx_pktids;
 253         struct brcmf_flowring *flow;
 254
 255         struct workqueue_struct *txflow_wq;
 256         struct work_struct txflow_work;
 257         unsigned long *flow_map;
 258         unsigned long *txstatus_done_map;
 259
 260         struct work_struct flowring_work;
 261         spinlock_t flowring_work_lock;
 262         struct list_head work_queue;
 263 };
 264
 265 struct brcmf_msgbuf_pktid {
 266         atomic_t  allocated;
 267         u16 data_offset;
 268         struct sk_buff *skb;
 269         dma_addr_t physaddr;
 270 };
 271
 272 struct brcmf_msgbuf_pktids {
 273         u32 array_size;
 274         u32 last_allocated_idx;
 275         enum dma_data_direction direction;
 276         struct brcmf_msgbuf_pktid *array;
 277 };
 278
 279
 280 /* dma flushing needs implementation for mips and arm platforms. Should
 281  * be put in util. Note, this is not real flushing. It is virtual non
 282  * cached memory. Only write buffers should have to be drained. Though
 283  * this may be different depending on platform......
 284  */
 285 #define brcmf_dma_flush(addr, len)
 286 #define brcmf_dma_invalidate_cache(addr, len)
 287
 288
 289 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf);
 290
 291
 292 static struct brcmf_msgbuf_pktids *
 293 brcmf_msgbuf_init_pktids(u32 nr_array_entries,
 294                          enum dma_data_direction direction)
 295 {
 296         struct brcmf_msgbuf_pktid *array;
 297         struct brcmf_msgbuf_pktids *pktids;
 298
 299         array = kcalloc(nr_array_entries, sizeof(*array), GFP_KERNEL);
 300         if (!array)
 301                 return NULL;
 302
 303         pktids = kzalloc(sizeof(*pktids), GFP_KERNEL);
 304         if (!pktids) {
 305                 kfree(array);
 306                 return NULL;
 307         }
 308         pktids->array = array;
 309         pktids->array_size = nr_array_entries;
 310
 311         return pktids;
 312 }
 313
 314
 315 static int
 316 brcmf_msgbuf_alloc_pktid(struct device *dev,
 317                          struct brcmf_msgbuf_pktids *pktids,
 318                          struct sk_buff *skb, u16 data_offset,
 319                          dma_addr_t *physaddr, u32 *idx)
 320 {
 321         struct brcmf_msgbuf_pktid *array;
 322         u32 count;
 323
 324         array = pktids->array;
 325
 326         *physaddr = dma_map_single(dev, skb->data + data_offset,
 327                                    skb->len - data_offset, pktids->direction);
 328
 329         if (dma_mapping_error(dev, *physaddr)) {
 330                 brcmf_err("dma_map_single failed !!\n");
 331                 return -ENOMEM;
 332         }
 333
 334         *idx = pktids->last_allocated_idx;
 335
 336         count = 0;
 337         do {
 338                 (*idx)++;
 339                 if (*idx == pktids->array_size)
 340                         *idx = 0;
 341                 if (array[*idx].allocated.counter == 0)
 342                         if (atomic_cmpxchg(&array[*idx].allocated, 0, 1) == 0)
 343                                 break;
 344                 count++;
 345         } while (count < pktids->array_size);
 346
 347         if (count == pktids->array_size)
 348                 return -ENOMEM;
 349
 350         array[*idx].data_offset = data_offset;
 351         array[*idx].physaddr = *physaddr;
 352         array[*idx].skb = skb;
 353
 354         pktids->last_allocated_idx = *idx;
 355
 356         return 0;
 357 }
 358
 359
 360 static struct sk_buff *
 361 brcmf_msgbuf_get_pktid(struct device *dev, struct brcmf_msgbuf_pktids *pktids,
 362                        u32 idx)
 363 {
 364         struct brcmf_msgbuf_pktid *pktid;
 365         struct sk_buff *skb;
 366
 367         if (idx >= pktids->array_size) {
 368                 brcmf_err("Invalid packet id %d (max %d)\n", idx,
 369                           pktids->array_size);
 370                 return NULL;
 371         }
 372         if (pktids->array[idx].allocated.counter) {
 373                 pktid = &pktids->array[idx];
 374                 dma_unmap_single(dev, pktid->physaddr,
 375                                  pktid->skb->len - pktid->data_offset,
 376                                  pktids->direction);
 377                 skb = pktid->skb;
 378                 pktid->allocated.counter = 0;
 379                 return skb;
 380         } else {
 381                 brcmf_err("Invalid packet id %d (not in use)\n", idx);
 382         }
 383
 384         return NULL;
 385 }
 386
 387
 388 static void
 389 brcmf_msgbuf_release_array(struct device *dev,
 390                            struct brcmf_msgbuf_pktids *pktids)
 391 {
 392         struct brcmf_msgbuf_pktid *array;
 393         struct brcmf_msgbuf_pktid *pktid;
 394         u32 count;
 395
 396         array = pktids->array;
 397         count = 0;
 398         do {
 399                 if (array[count].allocated.counter) {
 400                         pktid = &array[count];
 401                         dma_unmap_single(dev, pktid->physaddr,
 402                                          pktid->skb->len - pktid->data_offset,
 403                                          pktids->direction);
 404                         brcmu_pkt_buf_free_skb(pktid->skb);
 405                 }
 406                 count++;
 407         } while (count < pktids->array_size);
 408
 409         kfree(array);
 410         kfree(pktids);
 411 }
 412
 413
 414 static void brcmf_msgbuf_release_pktids(struct brcmf_msgbuf *msgbuf)
 415 {
 416         if (msgbuf->rx_pktids)
 417                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 418                                            msgbuf->rx_pktids);
 419         if (msgbuf->tx_pktids)
 420                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 421                                            msgbuf->tx_pktids);
 422 }
 423
 424
 425 static int brcmf_msgbuf_tx_ioctl(struct brcmf_pub *drvr, int ifidx,
 426                                  uint cmd, void *buf, uint len)
 427 {
 428         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 429         struct brcmf_commonring *commonring;
 430         struct msgbuf_ioctl_req_hdr *request;
 431         u16 buf_len;
 432         void *ret_ptr;
 433         int err;
 434
 435         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 436         brcmf_commonring_lock(commonring);
 437         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 438         if (!ret_ptr) {
 439                 brcmf_err("Failed to reserve space in commonring\n");
 440                 brcmf_commonring_unlock(commonring);
 441                 return -ENOMEM;
 442         }
 443
 444         msgbuf->reqid++;
 445
 446         request = (struct msgbuf_ioctl_req_hdr *)ret_ptr;
 447         request->msg.msgtype = MSGBUF_TYPE_IOCTLPTR_REQ;
 448         request->msg.ifidx = (u8)ifidx;
 449         request->msg.flags = 0;
 450         request->msg.request_id = cpu_to_le32(BRCMF_IOCTL_REQ_PKTID);
 451         request->cmd = cpu_to_le32(cmd);
 452         request->output_buf_len = cpu_to_le16(len);
 453         request->trans_id = cpu_to_le16(msgbuf->reqid);
 454
 455         buf_len = min_t(u16, len, BRCMF_TX_IOCTL_MAX_MSG_SIZE);
 456         request->input_buf_len = cpu_to_le16(buf_len);
 457         request->req_buf_addr.high_addr = cpu_to_le32(msgbuf->ioctbuf_phys_hi);
 458         request->req_buf_addr.low_addr = cpu_to_le32(msgbuf->ioctbuf_phys_lo);
 459         if (buf)
 460                 memcpy(msgbuf->ioctbuf, buf, buf_len);
 461         else
 462                 memset(msgbuf->ioctbuf, 0, buf_len);
 463         brcmf_dma_flush(ioctl_buf, buf_len);
 464
 465         err = brcmf_commonring_write_complete(commonring);
 466         brcmf_commonring_unlock(commonring);
 467
 468         return err;
 469 }
 470
 471
 472 static int brcmf_msgbuf_ioctl_resp_wait(struct brcmf_msgbuf *msgbuf)
 473 {
 474         return wait_event_timeout(msgbuf->ioctl_resp_wait,
 475                                   msgbuf->ctl_completed,
 476                                   msecs_to_jiffies(MSGBUF_IOCTL_RESP_TIMEOUT));
 477 }
 478
 479
 480 static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
 481 {
 482         if (waitqueue_active(&msgbuf->ioctl_resp_wait)) {
 483                 msgbuf->ctl_completed = true;
 484                 wake_up(&msgbuf->ioctl_resp_wait);
 485         }
 486 }
 487
 488
 489 static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 490                                    uint cmd, void *buf, uint len)
 491 {
 492         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 493         struct sk_buff *skb = NULL;
 494         int timeout;
 495         int err;
 496
 497         brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
 498         msgbuf->ctl_completed = false;
 499         err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
 500         if (err)
 501                 return err;
 502
 503         timeout = brcmf_msgbuf_ioctl_resp_wait(msgbuf);
 504         if (!timeout) {
 505                 brcmf_err("Timeout on response for query command\n");
 506                 return -EIO;
 507         }
 508
 509         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 510                                      msgbuf->rx_pktids,
 511                                      msgbuf->ioctl_resp_pktid);
 512         if (msgbuf->ioctl_resp_ret_len != 0) {
 513                 if (!skb) {
 514                         brcmf_err("Invalid packet id idx recv'd %d\n",
 515                                   msgbuf->ioctl_resp_pktid);
 516                         return -EBADF;
 517                 }
 518                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
 519                                        len : msgbuf->ioctl_resp_ret_len);
 520         }
 521         if (skb)
 522                 brcmu_pkt_buf_free_skb(skb);
 523
 524         return msgbuf->ioctl_resp_status;
 525 }
 526
 527
 528 static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
 529                                  uint cmd, void *buf, uint len)
 530 {
 531         return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len);
 532 }
 533
 534
 535 static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 536                                 u8 *ifidx, struct sk_buff *skb)
 537 {
 538         return -ENODEV;
 539 }
 540
 541
 542 static void
 543 brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
 544 {
 545         u32 dma_sz;
 546         void *dma_buf;
 547
 548         brcmf_dbg(MSGBUF, "Removing flowring %d\n", flowid);
 549
 550         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 551         dma_buf = msgbuf->flowrings[flowid]->buf_addr;
 552         dma_free_coherent(msgbuf->drvr->bus_if->dev, dma_sz, dma_buf,
 553                           msgbuf->flowring_dma_handle[flowid]);
 554
 555         brcmf_flowring_delete(msgbuf->flow, flowid);
 556 }
 557
 558
 559 static struct brcmf_msgbuf_work_item *
 560 brcmf_msgbuf_dequeue_work(struct brcmf_msgbuf *msgbuf)
 561 {
 562         struct brcmf_msgbuf_work_item *work = NULL;
 563         ulong flags;
 564
 565         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 566         if (!list_empty(&msgbuf->work_queue)) {
 567                 work = list_first_entry(&msgbuf->work_queue,
 568                                         struct brcmf_msgbuf_work_item, queue);
 569                 list_del(&work->queue);
 570         }
 571         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 572
 573         return work;
 574 }
 575
 576
 577 static u32
 578 brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
 579                                     struct brcmf_msgbuf_work_item *work)
 580 {
 581         struct msgbuf_tx_flowring_create_req *create;
 582         struct brcmf_commonring *commonring;
 583         void *ret_ptr;
 584         u32 flowid;
 585         void *dma_buf;
 586         u32 dma_sz;
 587         long long address;
 588         int err;
 589
 590         flowid = work->flowid;
 591         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 592         dma_buf = dma_alloc_coherent(msgbuf->drvr->bus_if->dev, dma_sz,
 593                                      &msgbuf->flowring_dma_handle[flowid],
 594                                      GFP_KERNEL);
 595         if (!dma_buf) {
 596                 brcmf_err("dma_alloc_coherent failed\n");
 597                 brcmf_flowring_delete(msgbuf->flow, flowid);
 598                 return BRCMF_FLOWRING_INVALID_ID;
 599         }
 600
 601         brcmf_commonring_config(msgbuf->flowrings[flowid],
 602                                 BRCMF_H2D_TXFLOWRING_MAX_ITEM,
 603                                 BRCMF_H2D_TXFLOWRING_ITEMSIZE, dma_buf);
 604
 605         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 606         brcmf_commonring_lock(commonring);
 607         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 608         if (!ret_ptr) {
 609                 brcmf_err("Failed to reserve space in commonring\n");
 610                 brcmf_commonring_unlock(commonring);
 611                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 612                 return BRCMF_FLOWRING_INVALID_ID;
 613         }
 614
 615         create = (struct msgbuf_tx_flowring_create_req *)ret_ptr;
 616         create->msg.msgtype = MSGBUF_TYPE_FLOW_RING_CREATE;
 617         create->msg.ifidx = work->ifidx;
 618         create->msg.request_id = 0;
 619         create->tid = brcmf_flowring_tid(msgbuf->flow, flowid);
 620         create->flow_ring_id = cpu_to_le16(flowid +
 621                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
 622         memcpy(create->sa, work->sa, ETH_ALEN);
 623         memcpy(create->da, work->da, ETH_ALEN);
 624         address = (long long)(long)msgbuf->flowring_dma_handle[flowid];
 625         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
 626         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
 627         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
 628         create->len_item = cpu_to_le16(BRCMF_H2D_TXFLOWRING_ITEMSIZE);
 629
 630         brcmf_dbg(MSGBUF, "Send Flow Create Req flow ID %d for peer %pM prio %d ifindex %d\n",
 631                   flowid, work->da, create->tid, work->ifidx);
 632
 633         err = brcmf_commonring_write_complete(commonring);
 634         brcmf_commonring_unlock(commonring);
 635         if (err) {
 636                 brcmf_err("Failed to write commonring\n");
 637                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 638                 return BRCMF_FLOWRING_INVALID_ID;
 639         }
 640
 641         return flowid;
 642 }
 643
 644
 645 static void brcmf_msgbuf_flowring_worker(struct work_struct *work)
 646 {
 647         struct brcmf_msgbuf *msgbuf;
 648         struct brcmf_msgbuf_work_item *create;
 649
 650         msgbuf = container_of(work, struct brcmf_msgbuf, flowring_work);
 651
 652         while ((create = brcmf_msgbuf_dequeue_work(msgbuf))) {
 653                 brcmf_msgbuf_flowring_create_worker(msgbuf, create);
 654                 kfree(create);
 655         }
 656 }
 657
 658
 659 static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 660                                         struct sk_buff *skb)
 661 {
 662         struct brcmf_msgbuf_work_item *create;
 663         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 664         u32 flowid;
 665         ulong flags;
 666
 667         create = kzalloc(sizeof(*create), GFP_ATOMIC);
 668         if (create == NULL)
 669                 return BRCMF_FLOWRING_INVALID_ID;
 670
 671         flowid = brcmf_flowring_create(msgbuf->flow, eh->h_dest,
 672                                        skb->priority, ifidx);
 673         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 674                 kfree(create);
 675                 return flowid;
 676         }
 677
 678         create->flowid = flowid;
 679         create->ifidx = ifidx;
 680         memcpy(create->sa, eh->h_source, ETH_ALEN);
 681         memcpy(create->da, eh->h_dest, ETH_ALEN);
 682
 683         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 684         list_add_tail(&create->queue, &msgbuf->work_queue);
 685         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 686         schedule_work(&msgbuf->flowring_work);
 687
 688         return flowid;
 689 }
 690
 691
 692 static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
 693 {
 694         struct brcmf_flowring *flow = msgbuf->flow;
 695         struct brcmf_commonring *commonring;
 696         void *ret_ptr;
 697         u32 count;
 698         struct sk_buff *skb;
 699         dma_addr_t physaddr;
 700         u32 pktid;
 701         struct msgbuf_tx_msghdr *tx_msghdr;
 702         long long address;
 703
 704         commonring = msgbuf->flowrings[flowid];
 705         if (!brcmf_commonring_write_available(commonring))
 706                 return;
 707
 708         brcmf_commonring_lock(commonring);
 709
 710         count = BRCMF_MSGBUF_TX_FLUSH_CNT2 - BRCMF_MSGBUF_TX_FLUSH_CNT1;
 711         while (brcmf_flowring_qlen(flow, flowid)) {
 712                 skb = brcmf_flowring_dequeue(flow, flowid);
 713                 if (skb == NULL) {
 714                         brcmf_err("No SKB, but qlen %d\n",
 715                                   brcmf_flowring_qlen(flow, flowid));
 716                         break;
 717                 }
 718                 skb_orphan(skb);
 719                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 720                                              msgbuf->tx_pktids, skb, ETH_HLEN,
 721                                              &physaddr, &pktid)) {
 722                         brcmf_flowring_reinsert(flow, flowid, skb);
 723                         brcmf_err("No PKTID available !!\n");
 724                         break;
 725                 }
 726                 ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 727                 if (!ret_ptr) {
 728                         brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 729                                                msgbuf->tx_pktids, pktid);
 730                         brcmf_flowring_reinsert(flow, flowid, skb);
 731                         break;
 732                 }
 733                 count++;
 734
 735                 tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
 736
 737                 tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
 738                 tx_msghdr->msg.request_id = cpu_to_le32(pktid);
 739                 tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
 740                 tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
 741                 tx_msghdr->flags |= (skb->priority & 0x07) <<
 742                                     BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT;
 743                 tx_msghdr->seg_cnt = 1;
 744                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
 745                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
 746                 address = (long long)(long)physaddr;
 747                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
 748                 tx_msghdr->data_buf_addr.low_addr =
 749                         cpu_to_le32(address & 0xffffffff);
 750                 tx_msghdr->metadata_buf_len = 0;
 751                 tx_msghdr->metadata_buf_addr.high_addr = 0;
 752                 tx_msghdr->metadata_buf_addr.low_addr = 0;
 753                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
 754                         brcmf_commonring_write_complete(commonring);
 755                         count = 0;
 756                 }
 757         }
 758         if (count)
 759                 brcmf_commonring_write_complete(commonring);
 760         brcmf_commonring_unlock(commonring);
 761 }
 762
 763
 764 static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 765 {
 766         struct brcmf_msgbuf *msgbuf;
 767         u32 flowid;
 768
 769         msgbuf = container_of(worker, struct brcmf_msgbuf, txflow_work);
 770         for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->nrof_flowrings) {
 771                 clear_bit(flowid, msgbuf->flow_map);
 772                 brcmf_msgbuf_txflow(msgbuf, flowid);
 773         }
 774 }
 775
 776
 777 static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid)
 778 {
 779         set_bit(flowid, msgbuf->flow_map);
 780         queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 781
 782         return 0;
 783 }
 784
 785
 786 static int brcmf_msgbuf_txdata(struct brcmf_pub *drvr, int ifidx,
 787                                u8 offset, struct sk_buff *skb)
 788 {
 789         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 790         struct brcmf_flowring *flow = msgbuf->flow;
 791         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 792         u32 flowid;
 793
 794         flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
 795         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 796                 flowid = brcmf_msgbuf_flowring_create(msgbuf, ifidx, skb);
 797                 if (flowid == BRCMF_FLOWRING_INVALID_ID)
 798                         return -ENOMEM;
 799         }
 800         brcmf_flowring_enqueue(flow, flowid, skb);
 801         brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
 802
 803         return 0;
 804 }
 805
 806
 807 static void
 808 brcmf_msgbuf_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
 809                                  enum proto_addr_mode addr_mode)
 810 {
 811         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 812
 813         brcmf_flowring_configure_addr_mode(msgbuf->flow, ifidx, addr_mode);
 814 }
 815
 816
 817 static void
 818 brcmf_msgbuf_delete_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 819 {
 820         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 821
 822         brcmf_flowring_delete_peer(msgbuf->flow, ifidx, peer);
 823 }
 824
 825
 826 static void
 827 brcmf_msgbuf_add_tdls_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 828 {
 829         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 830
 831         brcmf_flowring_add_tdls_peer(msgbuf->flow, ifidx, peer);
 832 }
 833
 834
 835 static void
 836 brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 837 {
 838         struct msgbuf_ioctl_resp_hdr *ioctl_resp;
 839
 840         ioctl_resp = (struct msgbuf_ioctl_resp_hdr *)buf;
 841
 842         msgbuf->ioctl_resp_status =
 843                         (s16)le16_to_cpu(ioctl_resp->compl_hdr.status);
 844         msgbuf->ioctl_resp_ret_len = le16_to_cpu(ioctl_resp->resp_len);
 845         msgbuf->ioctl_resp_pktid = le32_to_cpu(ioctl_resp->msg.request_id);
 846
 847         brcmf_msgbuf_ioctl_resp_wake(msgbuf);
 848
 849         if (msgbuf->cur_ioctlrespbuf)
 850                 msgbuf->cur_ioctlrespbuf--;
 851         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
 852 }
 853
 854
 855 static void
 856 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 857 {
 858         struct msgbuf_tx_status *tx_status;
 859         u32 idx;
 860         struct sk_buff *skb;
 861         u16 flowid;
 862
 863         tx_status = (struct msgbuf_tx_status *)buf;
 864         idx = le32_to_cpu(tx_status->msg.request_id);
 865         flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
 866         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
 867         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 868                                      msgbuf->tx_pktids, idx);
 869         if (!skb) {
 870                 brcmf_err("Invalid packet id idx recv'd %d\n", idx);
 871                 return;
 872         }
 873
 874         set_bit(flowid, msgbuf->txstatus_done_map);
 875
 876         brcmf_txfinalize(msgbuf->drvr, skb, tx_status->msg.ifidx, true);
 877 }
 878
 879
 880 static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
 881 {
 882         struct brcmf_commonring *commonring;
 883         void *ret_ptr;
 884         struct sk_buff *skb;
 885         u16 alloced;
 886         u32 pktlen;
 887         dma_addr_t physaddr;
 888         struct msgbuf_rx_bufpost *rx_bufpost;
 889         long long address;
 890         u32 pktid;
 891         u32 i;
 892
 893         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
 894         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
 895                                                               count,
 896                                                               &alloced);
 897         if (!ret_ptr) {
 898                 brcmf_err("Failed to reserve space in commonring\n");
 899                 return 0;
 900         }
 901
 902         for (i = 0; i < alloced; i++) {
 903                 rx_bufpost = (struct msgbuf_rx_bufpost *)ret_ptr;
 904                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
 905
 906                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
 907
 908                 if (skb == NULL) {
 909                         brcmf_err("Failed to alloc SKB\n");
 910                         brcmf_commonring_write_cancel(commonring, alloced - i);
 911                         break;
 912                 }
 913
 914                 pktlen = skb->len;
 915                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 916                                              msgbuf->rx_pktids, skb, 0,
 917                                              &physaddr, &pktid)) {
 918                         dev_kfree_skb_any(skb);
 919                         brcmf_err("No PKTID available !!\n");
 920                         brcmf_commonring_write_cancel(commonring, alloced - i);
 921                         break;
 922                 }
 923
 924                 if (msgbuf->rx_metadata_offset) {
 925                         address = (long long)(long)physaddr;
 926                         rx_bufpost->metadata_buf_len =
 927                                 cpu_to_le16(msgbuf->rx_metadata_offset);
 928                         rx_bufpost->metadata_buf_addr.high_addr =
 929                                 cpu_to_le32(address >> 32);
 930                         rx_bufpost->metadata_buf_addr.low_addr =
 931                                 cpu_to_le32(address & 0xffffffff);
 932
 933                         skb_pull(skb, msgbuf->rx_metadata_offset);
 934                         pktlen = skb->len;
 935                         physaddr += msgbuf->rx_metadata_offset;
 936                 }
 937                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
 938                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 939
 940                 address = (long long)(long)physaddr;
 941                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
 942                 rx_bufpost->data_buf_addr.high_addr =
 943                         cpu_to_le32(address >> 32);
 944                 rx_bufpost->data_buf_addr.low_addr =
 945                         cpu_to_le32(address & 0xffffffff);
 946
 947                 ret_ptr += brcmf_commonring_len_item(commonring);
 948         }
 949
 950         if (i)
 951                 brcmf_commonring_write_complete(commonring);
 952
 953         return i;
 954 }
 955
 956
 957 static void
 958 brcmf_msgbuf_rxbuf_data_fill(struct brcmf_msgbuf *msgbuf)
 959 {
 960         u32 fillbufs;
 961         u32 retcount;
 962
 963         fillbufs = msgbuf->max_rxbufpost - msgbuf->rxbufpost;
 964
 965         while (fillbufs) {
 966                 retcount = brcmf_msgbuf_rxbuf_data_post(msgbuf, fillbufs);
 967                 if (!retcount)
 968                         break;
 969                 msgbuf->rxbufpost += retcount;
 970                 fillbufs -= retcount;
 971         }
 972 }
 973
 974
 975 static void
 976 brcmf_msgbuf_update_rxbufpost_count(struct brcmf_msgbuf *msgbuf, u16 rxcnt)
 977 {
 978         msgbuf->rxbufpost -= rxcnt;
 979         if (msgbuf->rxbufpost <= (msgbuf->max_rxbufpost -
 980                                   BRCMF_MSGBUF_RXBUFPOST_THRESHOLD))
 981                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
 982 }
 983
 984
 985 static u32
 986 brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
 987                              u32 count)
 988 {
 989         struct brcmf_commonring *commonring;
 990         void *ret_ptr;
 991         struct sk_buff *skb;
 992         u16 alloced;
 993         u32 pktlen;
 994         dma_addr_t physaddr;
 995         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
 996         long long address;
 997         u32 pktid;
 998         u32 i;
 999
1000         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1001         brcmf_commonring_lock(commonring);
1002         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
1003                                                               count,
1004                                                               &alloced);
1005         if (!ret_ptr) {
1006                 brcmf_err("Failed to reserve space in commonring\n");
1007                 brcmf_commonring_unlock(commonring);
1008                 return 0;
1009         }
1010
1011         for (i = 0; i < alloced; i++) {
1012                 rx_bufpost = (struct msgbuf_rx_ioctl_resp_or_event *)ret_ptr;
1013                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
1014
1015                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
1016
1017                 if (skb == NULL) {
1018                         brcmf_err("Failed to alloc SKB\n");
1019                         brcmf_commonring_write_cancel(commonring, alloced - i);
1020                         break;
1021                 }
1022
1023                 pktlen = skb->len;
1024                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
1025                                              msgbuf->rx_pktids, skb, 0,
1026                                              &physaddr, &pktid)) {
1027                         dev_kfree_skb_any(skb);
1028                         brcmf_err("No PKTID available !!\n");
1029                         brcmf_commonring_write_cancel(commonring, alloced - i);
1030                         break;
1031                 }
1032                 if (event_buf)
1033                         rx_bufpost->msg.msgtype = MSGBUF_TYPE_EVENT_BUF_POST;
1034                 else
1035                         rx_bufpost->msg.msgtype =
1036                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
1037                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
1038
1039                 address = (long long)(long)physaddr;
1040                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
1041                 rx_bufpost->host_buf_addr.high_addr =
1042                         cpu_to_le32(address >> 32);
1043                 rx_bufpost->host_buf_addr.low_addr =
1044                         cpu_to_le32(address & 0xffffffff);
1045
1046                 ret_ptr += brcmf_commonring_len_item(commonring);
1047         }
1048
1049         if (i)
1050                 brcmf_commonring_write_complete(commonring);
1051
1052         brcmf_commonring_unlock(commonring);
1053
1054         return i;
1055 }
1056
1057
1058 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf)
1059 {
1060         u32 count;
1061
1062         count = msgbuf->max_ioctlrespbuf - msgbuf->cur_ioctlrespbuf;
1063         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, false, count);
1064         msgbuf->cur_ioctlrespbuf += count;
1065 }
1066
1067
1068 static void brcmf_msgbuf_rxbuf_event_post(struct brcmf_msgbuf *msgbuf)
1069 {
1070         u32 count;
1071
1072         count = msgbuf->max_eventbuf - msgbuf->cur_eventbuf;
1073         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, true, count);
1074         msgbuf->cur_eventbuf += count;
1075 }
1076
1077
1078 static void
1079 brcmf_msgbuf_rx_skb(struct brcmf_msgbuf *msgbuf, struct sk_buff *skb,
1080                     u8 ifidx)
1081 {
1082         struct brcmf_if *ifp;
1083
1084         ifp = msgbuf->drvr->iflist[ifidx];
1085         if (!ifp || !ifp->ndev) {
1086                 brcmu_pkt_buf_free_skb(skb);
1087                 return;
1088         }
1089         brcmf_netif_rx(ifp, skb);
1090 }
1091
1092
1093 static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
1094 {
1095         struct msgbuf_rx_event *event;
1096         u32 idx;
1097         u16 buflen;
1098         struct sk_buff *skb;
1099
1100         event = (struct msgbuf_rx_event *)buf;
1101         idx = le32_to_cpu(event->msg.request_id);
1102         buflen = le16_to_cpu(event->event_data_len);
1103
1104         if (msgbuf->cur_eventbuf)
1105                 msgbuf->cur_eventbuf--;
1106         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1107
1108         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1109                                      msgbuf->rx_pktids, idx);
1110         if (!skb)
1111                 return;
1112
1113         if (msgbuf->rx_dataoffset)
1114                 skb_pull(skb, msgbuf->rx_dataoffset);
1115
1116         skb_trim(skb, buflen);
1117
1118         brcmf_msgbuf_rx_skb(msgbuf, skb, event->msg.ifidx);
1119 }
1120
1121
1122 static void
1123 brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
1124 {
1125         struct msgbuf_rx_complete *rx_complete;
1126         struct sk_buff *skb;
1127         u16 data_offset;
1128         u16 buflen;
1129         u32 idx;
1130
1131         brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1);
1132
1133         rx_complete = (struct msgbuf_rx_complete *)buf;
1134         data_offset = le16_to_cpu(rx_complete->data_offset);
1135         buflen = le16_to_cpu(rx_complete->data_len);
1136         idx = le32_to_cpu(rx_complete->msg.request_id);
1137
1138         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1139                                      msgbuf->rx_pktids, idx);
1140
1141         if (data_offset)
1142                 skb_pull(skb, data_offset);
1143         else if (msgbuf->rx_dataoffset)
1144                 skb_pull(skb, msgbuf->rx_dataoffset);
1145
1146         skb_trim(skb, buflen);
1147
1148         brcmf_msgbuf_rx_skb(msgbuf, skb, rx_complete->msg.ifidx);
1149 }
1150
1151
1152 static void
1153 brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
1154                                                void *buf)
1155 {
1156         struct msgbuf_flowring_create_resp *flowring_create_resp;
1157         u16 status;
1158         u16 flowid;
1159
1160         flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
1161
1162         flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
1163         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
1164         status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
1165
1166         if (status) {
1167                 brcmf_err("Flowring creation failed, code %d\n", status);
1168                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1169                 return;
1170         }
1171         brcmf_dbg(MSGBUF, "Flowring %d Create response status %d\n", flowid,
1172                   status);
1173
1174         brcmf_flowring_open(msgbuf->flow, flowid);
1175
1176         brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
1177 }
1178
1179
1180 static void
1181 brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
1182                                                void *buf)
1183 {
1184         struct msgbuf_flowring_delete_resp *flowring_delete_resp;
1185         u16 status;
1186         u16 flowid;
1187
1188         flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
1189
1190         flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
1191         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
1192         status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
1193
1194         if (status) {
1195                 brcmf_err("Flowring deletion failed, code %d\n", status);
1196                 brcmf_flowring_delete(msgbuf->flow, flowid);
1197                 return;
1198         }
1199         brcmf_dbg(MSGBUF, "Flowring %d Delete response status %d\n", flowid,
1200                   status);
1201
1202         brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1203 }
1204
1205
1206 static void brcmf_msgbuf_process_msgtype(struct brcmf_msgbuf *msgbuf, void *buf)
1207 {
1208         struct msgbuf_common_hdr *msg;
1209
1210         msg = (struct msgbuf_common_hdr *)buf;
1211         switch (msg->msgtype) {
1212         case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
1213                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
1214                 brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);
1215                 break;
1216         case MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT:
1217                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT\n");
1218                 brcmf_msgbuf_process_flow_ring_delete_response(msgbuf, buf);
1219                 break;
1220         case MSGBUF_TYPE_IOCTLPTR_REQ_ACK:
1221                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTLPTR_REQ_ACK\n");
1222                 break;
1223         case MSGBUF_TYPE_IOCTL_CMPLT:
1224                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTL_CMPLT\n");
1225                 brcmf_msgbuf_process_ioctl_complete(msgbuf, buf);
1226                 break;
1227         case MSGBUF_TYPE_WL_EVENT:
1228                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_WL_EVENT\n");
1229                 brcmf_msgbuf_process_event(msgbuf, buf);
1230                 break;
1231         case MSGBUF_TYPE_TX_STATUS:
1232                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_TX_STATUS\n");
1233                 brcmf_msgbuf_process_txstatus(msgbuf, buf);
1234                 break;
1235         case MSGBUF_TYPE_RX_CMPLT:
1236                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RX_CMPLT\n");
1237                 brcmf_msgbuf_process_rx_complete(msgbuf, buf);
1238                 break;
1239         default:
1240                 brcmf_err("Unsupported msgtype %d\n", msg->msgtype);
1241                 break;
1242         }
1243 }
1244
1245
1246 static void brcmf_msgbuf_process_rx(struct brcmf_msgbuf *msgbuf,
1247                                     struct brcmf_commonring *commonring)
1248 {
1249         void *buf;
1250         u16 count;
1251
1252 again:
1253         buf = brcmf_commonring_get_read_ptr(commonring, &count);
1254         if (buf == NULL)
1255                 return;
1256
1257         while (count) {
1258                 brcmf_msgbuf_process_msgtype(msgbuf,
1259                                              buf + msgbuf->rx_dataoffset);
1260                 buf += brcmf_commonring_len_item(commonring);
1261                 count--;
1262         }
1263         brcmf_commonring_read_complete(commonring);
1264
1265         if (commonring->r_ptr == 0)
1266                 goto again;
1267 }
1268
1269
1270 int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
1271 {
1272         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1273         struct brcmf_pub *drvr = bus_if->drvr;
1274         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1275         void *buf;
1276         u32 flowid;
1277
1278         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1279         brcmf_msgbuf_process_rx(msgbuf, buf);
1280         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1281         brcmf_msgbuf_process_rx(msgbuf, buf);
1282         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1283         brcmf_msgbuf_process_rx(msgbuf, buf);
1284
1285         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
1286                          msgbuf->nrof_flowrings) {
1287                 clear_bit(flowid, msgbuf->txstatus_done_map);
1288                 if (brcmf_flowring_qlen(msgbuf->flow, flowid))
1289                         brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
1290         }
1291
1292         return 0;
1293 }
1294
1295
1296 void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
1297 {
1298         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1299         struct msgbuf_tx_flowring_delete_req *delete;
1300         struct brcmf_commonring *commonring;
1301         void *ret_ptr;
1302         u8 ifidx;
1303         int err;
1304
1305         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1306         brcmf_commonring_lock(commonring);
1307         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
1308         if (!ret_ptr) {
1309                 brcmf_err("FW unaware, flowring will be removed !!\n");
1310                 brcmf_commonring_unlock(commonring);
1311                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1312                 return;
1313         }
1314
1315         delete = (struct msgbuf_tx_flowring_delete_req *)ret_ptr;
1316
1317         ifidx = brcmf_flowring_ifidx_get(msgbuf->flow, flowid);
1318
1319         delete->msg.msgtype = MSGBUF_TYPE_FLOW_RING_DELETE;
1320         delete->msg.ifidx = ifidx;
1321         delete->msg.request_id = 0;
1322
1323         delete->flow_ring_id = cpu_to_le16(flowid +
1324                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
1325         delete->reason = 0;
1326
1327         brcmf_dbg(MSGBUF, "Send Flow Delete Req flow ID %d, ifindex %d\n",
1328                   flowid, ifidx);
1329
1330         err = brcmf_commonring_write_complete(commonring);
1331         brcmf_commonring_unlock(commonring);
1332         if (err) {
1333                 brcmf_err("Failed to submit RING_DELETE, flowring will be removed\n");
1334                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1335         }
1336 }
1337
1338
1339 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
1340 {
1341         struct brcmf_bus_msgbuf *if_msgbuf;
1342         struct brcmf_msgbuf *msgbuf;
1343         long long address;
1344         u32 count;
1345
1346         if_msgbuf = drvr->bus_if->msgbuf;
1347         msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
1348         if (!msgbuf)
1349                 goto fail;
1350
1351         msgbuf->txflow_wq = create_singlethread_workqueue("msgbuf_txflow");
1352         if (msgbuf->txflow_wq == NULL) {
1353                 brcmf_err("workqueue creation failed\n");
1354                 goto fail;
1355         }
1356         INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
1357         count = BITS_TO_LONGS(if_msgbuf->nrof_flowrings);
1358         msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
1359         if (!msgbuf->flow_map)
1360                 goto fail;
1361
1362         msgbuf->txstatus_done_map = kzalloc(count, GFP_KERNEL);
1363         if (!msgbuf->txstatus_done_map)
1364                 goto fail;
1365
1366         msgbuf->drvr = drvr;
1367         msgbuf->ioctbuf = dma_alloc_coherent(drvr->bus_if->dev,
1368                                              BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1369                                              &msgbuf->ioctbuf_handle,
1370                                              GFP_KERNEL);
1371         if (!msgbuf->ioctbuf)
1372                 goto fail;
1373         address = (long long)(long)msgbuf->ioctbuf_handle;
1374         msgbuf->ioctbuf_phys_hi = address >> 32;
1375         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
1376
1377         drvr->proto->hdrpull = brcmf_msgbuf_hdrpull;
1378         drvr->proto->query_dcmd = brcmf_msgbuf_query_dcmd;
1379         drvr->proto->set_dcmd = brcmf_msgbuf_set_dcmd;
1380         drvr->proto->txdata = brcmf_msgbuf_txdata;
1381         drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
1382         drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
1383         drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
1384         drvr->proto->pd = msgbuf;
1385
1386         init_waitqueue_head(&msgbuf->ioctl_resp_wait);
1387
1388         msgbuf->commonrings =
1389                 (struct brcmf_commonring **)if_msgbuf->commonrings;
1390         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
1391         msgbuf->nrof_flowrings = if_msgbuf->nrof_flowrings;
1392         msgbuf->flowring_dma_handle = kzalloc(msgbuf->nrof_flowrings *
1393                 sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
1394         if (!msgbuf->flowring_dma_handle)
1395                 goto fail;
1396
1397         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
1398         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
1399
1400         msgbuf->max_ioctlrespbuf = BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST;
1401         msgbuf->max_eventbuf = BRCMF_MSGBUF_MAX_EVENTBUF_POST;
1402
1403         msgbuf->tx_pktids = brcmf_msgbuf_init_pktids(NR_TX_PKTIDS,
1404                                                      DMA_TO_DEVICE);
1405         if (!msgbuf->tx_pktids)
1406                 goto fail;
1407         msgbuf->rx_pktids = brcmf_msgbuf_init_pktids(NR_RX_PKTIDS,
1408                                                      DMA_FROM_DEVICE);
1409         if (!msgbuf->rx_pktids)
1410                 goto fail;
1411
1412         msgbuf->flow = brcmf_flowring_attach(drvr->bus_if->dev,
1413                                              if_msgbuf->nrof_flowrings);
1414         if (!msgbuf->flow)
1415                 goto fail;
1416
1417
1418         brcmf_dbg(MSGBUF, "Feeding buffers, rx data %d, rx event %d, rx ioctl resp %d\n",
1419                   msgbuf->max_rxbufpost, msgbuf->max_eventbuf,
1420                   msgbuf->max_ioctlrespbuf);
1421         count = 0;
1422         do {
1423                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
1424                 if (msgbuf->max_rxbufpost != msgbuf->rxbufpost)
1425                         msleep(10);
1426                 else
1427                         break;
1428                 count++;
1429         } while (count < 10);
1430         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1431         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
1432
1433         INIT_WORK(&msgbuf->flowring_work, brcmf_msgbuf_flowring_worker);
1434         spin_lock_init(&msgbuf->flowring_work_lock);
1435         INIT_LIST_HEAD(&msgbuf->work_queue);
1436
1437         return 0;
1438
1439 fail:
1440         if (msgbuf) {
1441                 kfree(msgbuf->flow_map);
1442                 kfree(msgbuf->txstatus_done_map);
1443                 brcmf_msgbuf_release_pktids(msgbuf);
1444                 kfree(msgbuf->flowring_dma_handle);
1445                 if (msgbuf->ioctbuf)
1446                         dma_free_coherent(drvr->bus_if->dev,
1447                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1448                                           msgbuf->ioctbuf,
1449                                           msgbuf->ioctbuf_handle);
1450                 kfree(msgbuf);
1451         }
1452         return -ENOMEM;
1453 }
1454
1455
1456 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
1457 {
1458         struct brcmf_msgbuf *msgbuf;
1459         struct brcmf_msgbuf_work_item *work;
1460
1461         brcmf_dbg(TRACE, "Enter\n");
1462         if (drvr->proto->pd) {
1463                 msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1464                 cancel_work_sync(&msgbuf->flowring_work);
1465                 while (!list_empty(&msgbuf->work_queue)) {
1466                         work = list_first_entry(&msgbuf->work_queue,
1467                                                 struct brcmf_msgbuf_work_item,
1468                                                 queue);
1469                         list_del(&work->queue);
1470                         kfree(work);
1471                 }
1472                 kfree(msgbuf->flow_map);
1473                 kfree(msgbuf->txstatus_done_map);
1474                 if (msgbuf->txflow_wq)
1475                         destroy_workqueue(msgbuf->txflow_wq);
1476
1477                 brcmf_flowring_detach(msgbuf->flow);
1478                 dma_free_coherent(drvr->bus_if->dev,
1479                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1480                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
1481                 brcmf_msgbuf_release_pktids(msgbuf);
1482                 kfree(msgbuf->flowring_dma_handle);
1483                 kfree(msgbuf);
1484                 drvr->proto->pd = NULL;
1485         }
1486 }