drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

   1 /* Copyright (c) 2014 Broadcom Corporation
   2  *
   3  * Permission to use, copy, modify, and/or distribute this software for any
   4  * purpose with or without fee is hereby granted, provided that the above
   5  * copyright notice and this permission notice appear in all copies.
   6  *
   7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  14  */
  15
  16 /*******************************************************************************
  17  * Communicates with the dongle by using dcmd codes.
  18  * For certain dcmd codes, the dongle interprets string data from the host.
  19  ******************************************************************************/
  20
  21 #include <linux/types.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/etherdevice.h>
  24
  25 #include <brcmu_utils.h>
  26 #include <brcmu_wifi.h>
  27
  28 #include "core.h"
  29 #include "debug.h"
  30 #include "proto.h"
  31 #include "msgbuf.h"
  32 #include "commonring.h"
  33 #include "flowring.h"
  34 #include "bus.h"
  35 #include "tracepoint.h"
  36
  37
  38 #define MSGBUF_IOCTL_RESP_TIMEOUT               msecs_to_jiffies(2000)
  39
  40 #define MSGBUF_TYPE_GEN_STATUS                  0x1
  41 #define MSGBUF_TYPE_RING_STATUS                 0x2
  42 #define MSGBUF_TYPE_FLOW_RING_CREATE            0x3
  43 #define MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT      0x4
  44 #define MSGBUF_TYPE_FLOW_RING_DELETE            0x5
  45 #define MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT      0x6
  46 #define MSGBUF_TYPE_FLOW_RING_FLUSH             0x7
  47 #define MSGBUF_TYPE_FLOW_RING_FLUSH_CMPLT       0x8
  48 #define MSGBUF_TYPE_IOCTLPTR_REQ                0x9
  49 #define MSGBUF_TYPE_IOCTLPTR_REQ_ACK            0xA
  50 #define MSGBUF_TYPE_IOCTLRESP_BUF_POST          0xB
  51 #define MSGBUF_TYPE_IOCTL_CMPLT                 0xC
  52 #define MSGBUF_TYPE_EVENT_BUF_POST              0xD
  53 #define MSGBUF_TYPE_WL_EVENT                    0xE
  54 #define MSGBUF_TYPE_TX_POST                     0xF
  55 #define MSGBUF_TYPE_TX_STATUS                   0x10
  56 #define MSGBUF_TYPE_RXBUF_POST                  0x11
  57 #define MSGBUF_TYPE_RX_CMPLT                    0x12
  58 #define MSGBUF_TYPE_LPBK_DMAXFER                0x13
  59 #define MSGBUF_TYPE_LPBK_DMAXFER_CMPLT          0x14
  60
  61 #define NR_TX_PKTIDS                            2048
  62 #define NR_RX_PKTIDS                            1024
  63
  64 #define BRCMF_IOCTL_REQ_PKTID                   0xFFFE
  65
  66 #define BRCMF_MSGBUF_MAX_PKT_SIZE               2048
  67 #define BRCMF_MSGBUF_RXBUFPOST_THRESHOLD        32
  68 #define BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST      8
  69 #define BRCMF_MSGBUF_MAX_EVENTBUF_POST          8
  70
  71 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3      0x01
  72 #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT       5
  73
  74 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
  75 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
  76
  77 #define BRCMF_MSGBUF_DELAY_TXWORKER_THRS        96
  78 #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS      32
  79 #define BRCMF_MSGBUF_UPDATE_RX_PTR_THRS         48
  80
  81
  82 struct msgbuf_common_hdr {
  83         u8                              msgtype;
  84         u8                              ifidx;
  85         u8                              flags;
  86         u8                              rsvd0;
  87         __le32                          request_id;
  88 };
  89
  90 struct msgbuf_ioctl_req_hdr {
  91         struct msgbuf_common_hdr        msg;
  92         __le32                          cmd;
  93         __le16                          trans_id;
  94         __le16                          input_buf_len;
  95         __le16                          output_buf_len;
  96         __le16                          rsvd0[3];
  97         struct msgbuf_buf_addr          req_buf_addr;
  98         __le32                          rsvd1[2];
  99 };
 100
 101 struct msgbuf_tx_msghdr {
 102         struct msgbuf_common_hdr        msg;
 103         u8                              txhdr[ETH_HLEN];
 104         u8                              flags;
 105         u8                              seg_cnt;
 106         struct msgbuf_buf_addr          metadata_buf_addr;
 107         struct msgbuf_buf_addr          data_buf_addr;
 108         __le16                          metadata_buf_len;
 109         __le16                          data_len;
 110         __le32                          rsvd0;
 111 };
 112
 113 struct msgbuf_rx_bufpost {
 114         struct msgbuf_common_hdr        msg;
 115         __le16                          metadata_buf_len;
 116         __le16                          data_buf_len;
 117         __le32                          rsvd0;
 118         struct msgbuf_buf_addr          metadata_buf_addr;
 119         struct msgbuf_buf_addr          data_buf_addr;
 120 };
 121
 122 struct msgbuf_rx_ioctl_resp_or_event {
 123         struct msgbuf_common_hdr        msg;
 124         __le16                          host_buf_len;
 125         __le16                          rsvd0[3];
 126         struct msgbuf_buf_addr          host_buf_addr;
 127         __le32                          rsvd1[4];
 128 };
 129
 130 struct msgbuf_completion_hdr {
 131         __le16                          status;
 132         __le16                          flow_ring_id;
 133 };
 134
 135 struct msgbuf_rx_event {
 136         struct msgbuf_common_hdr        msg;
 137         struct msgbuf_completion_hdr    compl_hdr;
 138         __le16                          event_data_len;
 139         __le16                          seqnum;
 140         __le16                          rsvd0[4];
 141 };
 142
 143 struct msgbuf_ioctl_resp_hdr {
 144         struct msgbuf_common_hdr        msg;
 145         struct msgbuf_completion_hdr    compl_hdr;
 146         __le16                          resp_len;
 147         __le16                          trans_id;
 148         __le32                          cmd;
 149         __le32                          rsvd0;
 150 };
 151
 152 struct msgbuf_tx_status {
 153         struct msgbuf_common_hdr        msg;
 154         struct msgbuf_completion_hdr    compl_hdr;
 155         __le16                          metadata_len;
 156         __le16                          tx_status;
 157 };
 158
 159 struct msgbuf_rx_complete {
 160         struct msgbuf_common_hdr        msg;
 161         struct msgbuf_completion_hdr    compl_hdr;
 162         __le16                          metadata_len;
 163         __le16                          data_len;
 164         __le16                          data_offset;
 165         __le16                          flags;
 166         __le32                          rx_status_0;
 167         __le32                          rx_status_1;
 168         __le32                          rsvd0;
 169 };
 170
 171 struct msgbuf_tx_flowring_create_req {
 172         struct msgbuf_common_hdr        msg;
 173         u8                              da[ETH_ALEN];
 174         u8                              sa[ETH_ALEN];
 175         u8                              tid;
 176         u8                              if_flags;
 177         __le16                          flow_ring_id;
 178         u8                              tc;
 179         u8                              priority;
 180         __le16                          int_vector;
 181         __le16                          max_items;
 182         __le16                          len_item;
 183         struct msgbuf_buf_addr          flow_ring_addr;
 184 };
 185
 186 struct msgbuf_tx_flowring_delete_req {
 187         struct msgbuf_common_hdr        msg;
 188         __le16                          flow_ring_id;
 189         __le16                          reason;
 190         __le32                          rsvd0[7];
 191 };
 192
 193 struct msgbuf_flowring_create_resp {
 194         struct msgbuf_common_hdr        msg;
 195         struct msgbuf_completion_hdr    compl_hdr;
 196         __le32                          rsvd0[3];
 197 };
 198
 199 struct msgbuf_flowring_delete_resp {
 200         struct msgbuf_common_hdr        msg;
 201         struct msgbuf_completion_hdr    compl_hdr;
 202         __le32                          rsvd0[3];
 203 };
 204
 205 struct msgbuf_flowring_flush_resp {
 206         struct msgbuf_common_hdr        msg;
 207         struct msgbuf_completion_hdr    compl_hdr;
 208         __le32                          rsvd0[3];
 209 };
 210
 211 struct brcmf_msgbuf_work_item {
 212         struct list_head queue;
 213         u32 flowid;
 214         int ifidx;
 215         u8 sa[ETH_ALEN];
 216         u8 da[ETH_ALEN];
 217 };
 218
 219 struct brcmf_msgbuf {
 220         struct brcmf_pub *drvr;
 221
 222         struct brcmf_commonring **commonrings;
 223         struct brcmf_commonring **flowrings;
 224         dma_addr_t *flowring_dma_handle;
 225
 226         u16 max_flowrings;
 227         u16 max_submissionrings;
 228         u16 max_completionrings;
 229
 230         u16 rx_dataoffset;
 231         u32 max_rxbufpost;
 232         u16 rx_metadata_offset;
 233         u32 rxbufpost;
 234
 235         u32 max_ioctlrespbuf;
 236         u32 cur_ioctlrespbuf;
 237         u32 max_eventbuf;
 238         u32 cur_eventbuf;
 239
 240         void *ioctbuf;
 241         dma_addr_t ioctbuf_handle;
 242         u32 ioctbuf_phys_hi;
 243         u32 ioctbuf_phys_lo;
 244         int ioctl_resp_status;
 245         u32 ioctl_resp_ret_len;
 246         u32 ioctl_resp_pktid;
 247
 248         u16 data_seq_no;
 249         u16 ioctl_seq_no;
 250         u32 reqid;
 251         wait_queue_head_t ioctl_resp_wait;
 252         bool ctl_completed;
 253
 254         struct brcmf_msgbuf_pktids *tx_pktids;
 255         struct brcmf_msgbuf_pktids *rx_pktids;
 256         struct brcmf_flowring *flow;
 257
 258         struct workqueue_struct *txflow_wq;
 259         struct work_struct txflow_work;
 260         unsigned long *flow_map;
 261         unsigned long *txstatus_done_map;
 262
 263         struct work_struct flowring_work;
 264         spinlock_t flowring_work_lock;
 265         struct list_head work_queue;
 266 };
 267
 268 struct brcmf_msgbuf_pktid {
 269         atomic_t  allocated;
 270         u16 data_offset;
 271         struct sk_buff *skb;
 272         dma_addr_t physaddr;
 273 };
 274
 275 struct brcmf_msgbuf_pktids {
 276         u32 array_size;
 277         u32 last_allocated_idx;
 278         enum dma_data_direction direction;
 279         struct brcmf_msgbuf_pktid *array;
 280 };
 281
 282 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf);
 283
 284
 285 static struct brcmf_msgbuf_pktids *
 286 brcmf_msgbuf_init_pktids(u32 nr_array_entries,
 287                          enum dma_data_direction direction)
 288 {
 289         struct brcmf_msgbuf_pktid *array;
 290         struct brcmf_msgbuf_pktids *pktids;
 291
 292         array = kcalloc(nr_array_entries, sizeof(*array), GFP_KERNEL);
 293         if (!array)
 294                 return NULL;
 295
 296         pktids = kzalloc(sizeof(*pktids), GFP_KERNEL);
 297         if (!pktids) {
 298                 kfree(array);
 299                 return NULL;
 300         }
 301         pktids->array = array;
 302         pktids->array_size = nr_array_entries;
 303
 304         return pktids;
 305 }
 306
 307
 308 static int
 309 brcmf_msgbuf_alloc_pktid(struct device *dev,
 310                          struct brcmf_msgbuf_pktids *pktids,
 311                          struct sk_buff *skb, u16 data_offset,
 312                          dma_addr_t *physaddr, u32 *idx)
 313 {
 314         struct brcmf_msgbuf_pktid *array;
 315         u32 count;
 316
 317         array = pktids->array;
 318
 319         *physaddr = dma_map_single(dev, skb->data + data_offset,
 320                                    skb->len - data_offset, pktids->direction);
 321
 322         if (dma_mapping_error(dev, *physaddr)) {
 323                 brcmf_err("dma_map_single failed !!\n");
 324                 return -ENOMEM;
 325         }
 326
 327         *idx = pktids->last_allocated_idx;
 328
 329         count = 0;
 330         do {
 331                 (*idx)++;
 332                 if (*idx == pktids->array_size)
 333                         *idx = 0;
 334                 if (array[*idx].allocated.counter == 0)
 335                         if (atomic_cmpxchg(&array[*idx].allocated, 0, 1) == 0)
 336                                 break;
 337                 count++;
 338         } while (count < pktids->array_size);
 339
 340         if (count == pktids->array_size)
 341                 return -ENOMEM;
 342
 343         array[*idx].data_offset = data_offset;
 344         array[*idx].physaddr = *physaddr;
 345         array[*idx].skb = skb;
 346
 347         pktids->last_allocated_idx = *idx;
 348
 349         return 0;
 350 }
 351
 352
 353 static struct sk_buff *
 354 brcmf_msgbuf_get_pktid(struct device *dev, struct brcmf_msgbuf_pktids *pktids,
 355                        u32 idx)
 356 {
 357         struct brcmf_msgbuf_pktid *pktid;
 358         struct sk_buff *skb;
 359
 360         if (idx >= pktids->array_size) {
 361                 brcmf_err("Invalid packet id %d (max %d)\n", idx,
 362                           pktids->array_size);
 363                 return NULL;
 364         }
 365         if (pktids->array[idx].allocated.counter) {
 366                 pktid = &pktids->array[idx];
 367                 dma_unmap_single(dev, pktid->physaddr,
 368                                  pktid->skb->len - pktid->data_offset,
 369                                  pktids->direction);
 370                 skb = pktid->skb;
 371                 pktid->allocated.counter = 0;
 372                 return skb;
 373         } else {
 374                 brcmf_err("Invalid packet id %d (not in use)\n", idx);
 375         }
 376
 377         return NULL;
 378 }
 379
 380
 381 static void
 382 brcmf_msgbuf_release_array(struct device *dev,
 383                            struct brcmf_msgbuf_pktids *pktids)
 384 {
 385         struct brcmf_msgbuf_pktid *array;
 386         struct brcmf_msgbuf_pktid *pktid;
 387         u32 count;
 388
 389         array = pktids->array;
 390         count = 0;
 391         do {
 392                 if (array[count].allocated.counter) {
 393                         pktid = &array[count];
 394                         dma_unmap_single(dev, pktid->physaddr,
 395                                          pktid->skb->len - pktid->data_offset,
 396                                          pktids->direction);
 397                         brcmu_pkt_buf_free_skb(pktid->skb);
 398                 }
 399                 count++;
 400         } while (count < pktids->array_size);
 401
 402         kfree(array);
 403         kfree(pktids);
 404 }
 405
 406
 407 static void brcmf_msgbuf_release_pktids(struct brcmf_msgbuf *msgbuf)
 408 {
 409         if (msgbuf->rx_pktids)
 410                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 411                                            msgbuf->rx_pktids);
 412         if (msgbuf->tx_pktids)
 413                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 414                                            msgbuf->tx_pktids);
 415 }
 416
 417
 418 static int brcmf_msgbuf_tx_ioctl(struct brcmf_pub *drvr, int ifidx,
 419                                  uint cmd, void *buf, uint len)
 420 {
 421         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 422         struct brcmf_commonring *commonring;
 423         struct msgbuf_ioctl_req_hdr *request;
 424         u16 buf_len;
 425         void *ret_ptr;
 426         int err;
 427
 428         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 429         brcmf_commonring_lock(commonring);
 430         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 431         if (!ret_ptr) {
 432                 brcmf_err("Failed to reserve space in commonring\n");
 433                 brcmf_commonring_unlock(commonring);
 434                 return -ENOMEM;
 435         }
 436
 437         msgbuf->reqid++;
 438
 439         request = (struct msgbuf_ioctl_req_hdr *)ret_ptr;
 440         request->msg.msgtype = MSGBUF_TYPE_IOCTLPTR_REQ;
 441         request->msg.ifidx = (u8)ifidx;
 442         request->msg.flags = 0;
 443         request->msg.request_id = cpu_to_le32(BRCMF_IOCTL_REQ_PKTID);
 444         request->cmd = cpu_to_le32(cmd);
 445         request->output_buf_len = cpu_to_le16(len);
 446         request->trans_id = cpu_to_le16(msgbuf->reqid);
 447
 448         buf_len = min_t(u16, len, BRCMF_TX_IOCTL_MAX_MSG_SIZE);
 449         request->input_buf_len = cpu_to_le16(buf_len);
 450         request->req_buf_addr.high_addr = cpu_to_le32(msgbuf->ioctbuf_phys_hi);
 451         request->req_buf_addr.low_addr = cpu_to_le32(msgbuf->ioctbuf_phys_lo);
 452         if (buf)
 453                 memcpy(msgbuf->ioctbuf, buf, buf_len);
 454         else
 455                 memset(msgbuf->ioctbuf, 0, buf_len);
 456
 457         err = brcmf_commonring_write_complete(commonring);
 458         brcmf_commonring_unlock(commonring);
 459
 460         return err;
 461 }
 462
 463
 464 static int brcmf_msgbuf_ioctl_resp_wait(struct brcmf_msgbuf *msgbuf)
 465 {
 466         return wait_event_timeout(msgbuf->ioctl_resp_wait,
 467                                   msgbuf->ctl_completed,
 468                                   MSGBUF_IOCTL_RESP_TIMEOUT);
 469 }
 470
 471
 472 static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
 473 {
 474         msgbuf->ctl_completed = true;
 475         wake_up(&msgbuf->ioctl_resp_wait);
 476 }
 477
 478
 479 static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 480                                    uint cmd, void *buf, uint len, int *fwerr)
 481 {
 482         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 483         struct sk_buff *skb = NULL;
 484         int timeout;
 485         int err;
 486
 487         brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
 488         *fwerr = 0;
 489         msgbuf->ctl_completed = false;
 490         err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
 491         if (err)
 492                 return err;
 493
 494         timeout = brcmf_msgbuf_ioctl_resp_wait(msgbuf);
 495         if (!timeout) {
 496                 brcmf_err("Timeout on response for query command\n");
 497                 return -EIO;
 498         }
 499
 500         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 501                                      msgbuf->rx_pktids,
 502                                      msgbuf->ioctl_resp_pktid);
 503         if (msgbuf->ioctl_resp_ret_len != 0) {
 504                 if (!skb)
 505                         return -EBADF;
 506
 507                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
 508                                        len : msgbuf->ioctl_resp_ret_len);
 509         }
 510         brcmu_pkt_buf_free_skb(skb);
 511
 512         *fwerr = msgbuf->ioctl_resp_status;
 513         return 0;
 514 }
 515
 516
 517 static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
 518                                  uint cmd, void *buf, uint len, int *fwerr)
 519 {
 520         return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
 521 }
 522
 523
 524 static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 525                                 struct sk_buff *skb, struct brcmf_if **ifp)
 526 {
 527         return -ENODEV;
 528 }
 529
 530 static void brcmf_msgbuf_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb)
 531 {
 532 }
 533
 534 static void
 535 brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
 536 {
 537         u32 dma_sz;
 538         void *dma_buf;
 539
 540         brcmf_dbg(MSGBUF, "Removing flowring %d\n", flowid);
 541
 542         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 543         dma_buf = msgbuf->flowrings[flowid]->buf_addr;
 544         dma_free_coherent(msgbuf->drvr->bus_if->dev, dma_sz, dma_buf,
 545                           msgbuf->flowring_dma_handle[flowid]);
 546
 547         brcmf_flowring_delete(msgbuf->flow, flowid);
 548 }
 549
 550
 551 static struct brcmf_msgbuf_work_item *
 552 brcmf_msgbuf_dequeue_work(struct brcmf_msgbuf *msgbuf)
 553 {
 554         struct brcmf_msgbuf_work_item *work = NULL;
 555         ulong flags;
 556
 557         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 558         if (!list_empty(&msgbuf->work_queue)) {
 559                 work = list_first_entry(&msgbuf->work_queue,
 560                                         struct brcmf_msgbuf_work_item, queue);
 561                 list_del(&work->queue);
 562         }
 563         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 564
 565         return work;
 566 }
 567
 568
 569 static u32
 570 brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
 571                                     struct brcmf_msgbuf_work_item *work)
 572 {
 573         struct msgbuf_tx_flowring_create_req *create;
 574         struct brcmf_commonring *commonring;
 575         void *ret_ptr;
 576         u32 flowid;
 577         void *dma_buf;
 578         u32 dma_sz;
 579         u64 address;
 580         int err;
 581
 582         flowid = work->flowid;
 583         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 584         dma_buf = dma_alloc_coherent(msgbuf->drvr->bus_if->dev, dma_sz,
 585                                      &msgbuf->flowring_dma_handle[flowid],
 586                                      GFP_KERNEL);
 587         if (!dma_buf) {
 588                 brcmf_err("dma_alloc_coherent failed\n");
 589                 brcmf_flowring_delete(msgbuf->flow, flowid);
 590                 return BRCMF_FLOWRING_INVALID_ID;
 591         }
 592
 593         brcmf_commonring_config(msgbuf->flowrings[flowid],
 594                                 BRCMF_H2D_TXFLOWRING_MAX_ITEM,
 595                                 BRCMF_H2D_TXFLOWRING_ITEMSIZE, dma_buf);
 596
 597         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 598         brcmf_commonring_lock(commonring);
 599         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 600         if (!ret_ptr) {
 601                 brcmf_err("Failed to reserve space in commonring\n");
 602                 brcmf_commonring_unlock(commonring);
 603                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 604                 return BRCMF_FLOWRING_INVALID_ID;
 605         }
 606
 607         create = (struct msgbuf_tx_flowring_create_req *)ret_ptr;
 608         create->msg.msgtype = MSGBUF_TYPE_FLOW_RING_CREATE;
 609         create->msg.ifidx = work->ifidx;
 610         create->msg.request_id = 0;
 611         create->tid = brcmf_flowring_tid(msgbuf->flow, flowid);
 612         create->flow_ring_id = cpu_to_le16(flowid +
 613                                            BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
 614         memcpy(create->sa, work->sa, ETH_ALEN);
 615         memcpy(create->da, work->da, ETH_ALEN);
 616         address = (u64)msgbuf->flowring_dma_handle[flowid];
 617         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
 618         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
 619         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
 620         create->len_item = cpu_to_le16(BRCMF_H2D_TXFLOWRING_ITEMSIZE);
 621
 622         brcmf_dbg(MSGBUF, "Send Flow Create Req flow ID %d for peer %pM prio %d ifindex %d\n",
 623                   flowid, work->da, create->tid, work->ifidx);
 624
 625         err = brcmf_commonring_write_complete(commonring);
 626         brcmf_commonring_unlock(commonring);
 627         if (err) {
 628                 brcmf_err("Failed to write commonring\n");
 629                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 630                 return BRCMF_FLOWRING_INVALID_ID;
 631         }
 632
 633         return flowid;
 634 }
 635
 636
 637 static void brcmf_msgbuf_flowring_worker(struct work_struct *work)
 638 {
 639         struct brcmf_msgbuf *msgbuf;
 640         struct brcmf_msgbuf_work_item *create;
 641
 642         msgbuf = container_of(work, struct brcmf_msgbuf, flowring_work);
 643
 644         while ((create = brcmf_msgbuf_dequeue_work(msgbuf))) {
 645                 brcmf_msgbuf_flowring_create_worker(msgbuf, create);
 646                 kfree(create);
 647         }
 648 }
 649
 650
 651 static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 652                                         struct sk_buff *skb)
 653 {
 654         struct brcmf_msgbuf_work_item *create;
 655         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 656         u32 flowid;
 657         ulong flags;
 658
 659         create = kzalloc(sizeof(*create), GFP_ATOMIC);
 660         if (create == NULL)
 661                 return BRCMF_FLOWRING_INVALID_ID;
 662
 663         flowid = brcmf_flowring_create(msgbuf->flow, eh->h_dest,
 664                                        skb->priority, ifidx);
 665         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 666                 kfree(create);
 667                 return flowid;
 668         }
 669
 670         create->flowid = flowid;
 671         create->ifidx = ifidx;
 672         memcpy(create->sa, eh->h_source, ETH_ALEN);
 673         memcpy(create->da, eh->h_dest, ETH_ALEN);
 674
 675         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 676         list_add_tail(&create->queue, &msgbuf->work_queue);
 677         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 678         schedule_work(&msgbuf->flowring_work);
 679
 680         return flowid;
 681 }
 682
 683
 684 static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
 685 {
 686         struct brcmf_flowring *flow = msgbuf->flow;
 687         struct brcmf_commonring *commonring;
 688         void *ret_ptr;
 689         u32 count;
 690         struct sk_buff *skb;
 691         dma_addr_t physaddr;
 692         u32 pktid;
 693         struct msgbuf_tx_msghdr *tx_msghdr;
 694         u64 address;
 695
 696         commonring = msgbuf->flowrings[flowid];
 697         if (!brcmf_commonring_write_available(commonring))
 698                 return;
 699
 700         brcmf_commonring_lock(commonring);
 701
 702         count = BRCMF_MSGBUF_TX_FLUSH_CNT2 - BRCMF_MSGBUF_TX_FLUSH_CNT1;
 703         while (brcmf_flowring_qlen(flow, flowid)) {
 704                 skb = brcmf_flowring_dequeue(flow, flowid);
 705                 if (skb == NULL) {
 706                         brcmf_err("No SKB, but qlen %d\n",
 707                                   brcmf_flowring_qlen(flow, flowid));
 708                         break;
 709                 }
 710                 skb_orphan(skb);
 711                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 712                                              msgbuf->tx_pktids, skb, ETH_HLEN,
 713                                              &physaddr, &pktid)) {
 714                         brcmf_flowring_reinsert(flow, flowid, skb);
 715                         brcmf_err("No PKTID available !!\n");
 716                         break;
 717                 }
 718                 ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 719                 if (!ret_ptr) {
 720                         brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 721                                                msgbuf->tx_pktids, pktid);
 722                         brcmf_flowring_reinsert(flow, flowid, skb);
 723                         break;
 724                 }
 725                 count++;
 726
 727                 tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
 728
 729                 tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
 730                 tx_msghdr->msg.request_id = cpu_to_le32(pktid);
 731                 tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
 732                 tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
 733                 tx_msghdr->flags |= (skb->priority & 0x07) <<
 734                                     BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT;
 735                 tx_msghdr->seg_cnt = 1;
 736                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
 737                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
 738                 address = (u64)physaddr;
 739                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
 740                 tx_msghdr->data_buf_addr.low_addr =
 741                         cpu_to_le32(address & 0xffffffff);
 742                 tx_msghdr->metadata_buf_len = 0;
 743                 tx_msghdr->metadata_buf_addr.high_addr = 0;
 744                 tx_msghdr->metadata_buf_addr.low_addr = 0;
 745                 atomic_inc(&commonring->outstanding_tx);
 746                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
 747                         brcmf_commonring_write_complete(commonring);
 748                         count = 0;
 749                 }
 750         }
 751         if (count)
 752                 brcmf_commonring_write_complete(commonring);
 753         brcmf_commonring_unlock(commonring);
 754 }
 755
 756
 757 static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 758 {
 759         struct brcmf_msgbuf *msgbuf;
 760         u32 flowid;
 761
 762         msgbuf = container_of(worker, struct brcmf_msgbuf, txflow_work);
 763         for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->max_flowrings) {
 764                 clear_bit(flowid, msgbuf->flow_map);
 765                 brcmf_msgbuf_txflow(msgbuf, flowid);
 766         }
 767 }
 768
 769
 770 static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid,
 771                                         bool force)
 772 {
 773         struct brcmf_commonring *commonring;
 774
 775         set_bit(flowid, msgbuf->flow_map);
 776         commonring = msgbuf->flowrings[flowid];
 777         if ((force) || (atomic_read(&commonring->outstanding_tx) <
 778                         BRCMF_MSGBUF_DELAY_TXWORKER_THRS))
 779                 queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 780
 781         return 0;
 782 }
 783
 784
 785 static int brcmf_msgbuf_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
 786                                       struct sk_buff *skb)
 787 {
 788         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 789         struct brcmf_flowring *flow = msgbuf->flow;
 790         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 791         u32 flowid;
 792         u32 queue_count;
 793         bool force;
 794
 795         flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
 796         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 797                 flowid = brcmf_msgbuf_flowring_create(msgbuf, ifidx, skb);
 798                 if (flowid == BRCMF_FLOWRING_INVALID_ID)
 799                         return -ENOMEM;
 800         }
 801         queue_count = brcmf_flowring_enqueue(flow, flowid, skb);
 802         force = ((queue_count % BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) == 0);
 803         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, force);
 804
 805         return 0;
 806 }
 807
 808
 809 static void
 810 brcmf_msgbuf_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
 811                                  enum proto_addr_mode addr_mode)
 812 {
 813         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 814
 815         brcmf_flowring_configure_addr_mode(msgbuf->flow, ifidx, addr_mode);
 816 }
 817
 818
 819 static void
 820 brcmf_msgbuf_delete_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 821 {
 822         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 823
 824         brcmf_flowring_delete_peer(msgbuf->flow, ifidx, peer);
 825 }
 826
 827
 828 static void
 829 brcmf_msgbuf_add_tdls_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 830 {
 831         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 832
 833         brcmf_flowring_add_tdls_peer(msgbuf->flow, ifidx, peer);
 834 }
 835
 836
 837 static void
 838 brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 839 {
 840         struct msgbuf_ioctl_resp_hdr *ioctl_resp;
 841
 842         ioctl_resp = (struct msgbuf_ioctl_resp_hdr *)buf;
 843
 844         msgbuf->ioctl_resp_status =
 845                         (s16)le16_to_cpu(ioctl_resp->compl_hdr.status);
 846         msgbuf->ioctl_resp_ret_len = le16_to_cpu(ioctl_resp->resp_len);
 847         msgbuf->ioctl_resp_pktid = le32_to_cpu(ioctl_resp->msg.request_id);
 848
 849         brcmf_msgbuf_ioctl_resp_wake(msgbuf);
 850
 851         if (msgbuf->cur_ioctlrespbuf)
 852                 msgbuf->cur_ioctlrespbuf--;
 853         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
 854 }
 855
 856
 857 static void
 858 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 859 {
 860         struct brcmf_commonring *commonring;
 861         struct msgbuf_tx_status *tx_status;
 862         u32 idx;
 863         struct sk_buff *skb;
 864         u16 flowid;
 865
 866         tx_status = (struct msgbuf_tx_status *)buf;
 867         idx = le32_to_cpu(tx_status->msg.request_id);
 868         flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
 869         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
 870         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 871                                      msgbuf->tx_pktids, idx);
 872         if (!skb)
 873                 return;
 874
 875         set_bit(flowid, msgbuf->txstatus_done_map);
 876         commonring = msgbuf->flowrings[flowid];
 877         atomic_dec(&commonring->outstanding_tx);
 878
 879         brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
 880                          skb, true);
 881 }
 882
 883
 884 static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
 885 {
 886         struct brcmf_commonring *commonring;
 887         void *ret_ptr;
 888         struct sk_buff *skb;
 889         u16 alloced;
 890         u32 pktlen;
 891         dma_addr_t physaddr;
 892         struct msgbuf_rx_bufpost *rx_bufpost;
 893         u64 address;
 894         u32 pktid;
 895         u32 i;
 896
 897         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
 898         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
 899                                                               count,
 900                                                               &alloced);
 901         if (!ret_ptr) {
 902                 brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
 903                 return 0;
 904         }
 905
 906         for (i = 0; i < alloced; i++) {
 907                 rx_bufpost = (struct msgbuf_rx_bufpost *)ret_ptr;
 908                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
 909
 910                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
 911
 912                 if (skb == NULL) {
 913                         brcmf_err("Failed to alloc SKB\n");
 914                         brcmf_commonring_write_cancel(commonring, alloced - i);
 915                         break;
 916                 }
 917
 918                 pktlen = skb->len;
 919                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 920                                              msgbuf->rx_pktids, skb, 0,
 921                                              &physaddr, &pktid)) {
 922                         dev_kfree_skb_any(skb);
 923                         brcmf_err("No PKTID available !!\n");
 924                         brcmf_commonring_write_cancel(commonring, alloced - i);
 925                         break;
 926                 }
 927
 928                 if (msgbuf->rx_metadata_offset) {
 929                         address = (u64)physaddr;
 930                         rx_bufpost->metadata_buf_len =
 931                                 cpu_to_le16(msgbuf->rx_metadata_offset);
 932                         rx_bufpost->metadata_buf_addr.high_addr =
 933                                 cpu_to_le32(address >> 32);
 934                         rx_bufpost->metadata_buf_addr.low_addr =
 935                                 cpu_to_le32(address & 0xffffffff);
 936
 937                         skb_pull(skb, msgbuf->rx_metadata_offset);
 938                         pktlen = skb->len;
 939                         physaddr += msgbuf->rx_metadata_offset;
 940                 }
 941                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
 942                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 943
 944                 address = (u64)physaddr;
 945                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
 946                 rx_bufpost->data_buf_addr.high_addr =
 947                         cpu_to_le32(address >> 32);
 948                 rx_bufpost->data_buf_addr.low_addr =
 949                         cpu_to_le32(address & 0xffffffff);
 950
 951                 ret_ptr += brcmf_commonring_len_item(commonring);
 952         }
 953
 954         if (i)
 955                 brcmf_commonring_write_complete(commonring);
 956
 957         return i;
 958 }
 959
 960
 961 static void
 962 brcmf_msgbuf_rxbuf_data_fill(struct brcmf_msgbuf *msgbuf)
 963 {
 964         u32 fillbufs;
 965         u32 retcount;
 966
 967         fillbufs = msgbuf->max_rxbufpost - msgbuf->rxbufpost;
 968
 969         while (fillbufs) {
 970                 retcount = brcmf_msgbuf_rxbuf_data_post(msgbuf, fillbufs);
 971                 if (!retcount)
 972                         break;
 973                 msgbuf->rxbufpost += retcount;
 974                 fillbufs -= retcount;
 975         }
 976 }
 977
 978
 979 static void
 980 brcmf_msgbuf_update_rxbufpost_count(struct brcmf_msgbuf *msgbuf, u16 rxcnt)
 981 {
 982         msgbuf->rxbufpost -= rxcnt;
 983         if (msgbuf->rxbufpost <= (msgbuf->max_rxbufpost -
 984                                   BRCMF_MSGBUF_RXBUFPOST_THRESHOLD))
 985                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
 986 }
 987
 988
 989 static u32
 990 brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
 991                              u32 count)
 992 {
 993         struct brcmf_commonring *commonring;
 994         void *ret_ptr;
 995         struct sk_buff *skb;
 996         u16 alloced;
 997         u32 pktlen;
 998         dma_addr_t physaddr;
 999         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
1000         u64 address;
1001         u32 pktid;
1002         u32 i;
1003
1004         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1005         brcmf_commonring_lock(commonring);
1006         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
1007                                                               count,
1008                                                               &alloced);
1009         if (!ret_ptr) {
1010                 brcmf_err("Failed to reserve space in commonring\n");
1011                 brcmf_commonring_unlock(commonring);
1012                 return 0;
1013         }
1014
1015         for (i = 0; i < alloced; i++) {
1016                 rx_bufpost = (struct msgbuf_rx_ioctl_resp_or_event *)ret_ptr;
1017                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
1018
1019                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
1020
1021                 if (skb == NULL) {
1022                         brcmf_err("Failed to alloc SKB\n");
1023                         brcmf_commonring_write_cancel(commonring, alloced - i);
1024                         break;
1025                 }
1026
1027                 pktlen = skb->len;
1028                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
1029                                              msgbuf->rx_pktids, skb, 0,
1030                                              &physaddr, &pktid)) {
1031                         dev_kfree_skb_any(skb);
1032                         brcmf_err("No PKTID available !!\n");
1033                         brcmf_commonring_write_cancel(commonring, alloced - i);
1034                         break;
1035                 }
1036                 if (event_buf)
1037                         rx_bufpost->msg.msgtype = MSGBUF_TYPE_EVENT_BUF_POST;
1038                 else
1039                         rx_bufpost->msg.msgtype =
1040                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
1041                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
1042
1043                 address = (u64)physaddr;
1044                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
1045                 rx_bufpost->host_buf_addr.high_addr =
1046                         cpu_to_le32(address >> 32);
1047                 rx_bufpost->host_buf_addr.low_addr =
1048                         cpu_to_le32(address & 0xffffffff);
1049
1050                 ret_ptr += brcmf_commonring_len_item(commonring);
1051         }
1052
1053         if (i)
1054                 brcmf_commonring_write_complete(commonring);
1055
1056         brcmf_commonring_unlock(commonring);
1057
1058         return i;
1059 }
1060
1061
1062 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf)
1063 {
1064         u32 count;
1065
1066         count = msgbuf->max_ioctlrespbuf - msgbuf->cur_ioctlrespbuf;
1067         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, false, count);
1068         msgbuf->cur_ioctlrespbuf += count;
1069 }
1070
1071
1072 static void brcmf_msgbuf_rxbuf_event_post(struct brcmf_msgbuf *msgbuf)
1073 {
1074         u32 count;
1075
1076         count = msgbuf->max_eventbuf - msgbuf->cur_eventbuf;
1077         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, true, count);
1078         msgbuf->cur_eventbuf += count;
1079 }
1080
1081
1082 static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
1083 {
1084         struct msgbuf_rx_event *event;
1085         u32 idx;
1086         u16 buflen;
1087         struct sk_buff *skb;
1088         struct brcmf_if *ifp;
1089
1090         event = (struct msgbuf_rx_event *)buf;
1091         idx = le32_to_cpu(event->msg.request_id);
1092         buflen = le16_to_cpu(event->event_data_len);
1093
1094         if (msgbuf->cur_eventbuf)
1095                 msgbuf->cur_eventbuf--;
1096         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1097
1098         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1099                                      msgbuf->rx_pktids, idx);
1100         if (!skb)
1101                 return;
1102
1103         if (msgbuf->rx_dataoffset)
1104                 skb_pull(skb, msgbuf->rx_dataoffset);
1105
1106         skb_trim(skb, buflen);
1107
1108         ifp = brcmf_get_ifp(msgbuf->drvr, event->msg.ifidx);
1109         if (!ifp || !ifp->ndev) {
1110                 brcmf_err("Received pkt for invalid ifidx %d\n",
1111                           event->msg.ifidx);
1112                 goto exit;
1113         }
1114
1115         skb->protocol = eth_type_trans(skb, ifp->ndev);
1116
1117         brcmf_fweh_process_skb(ifp->drvr, skb);
1118
1119 exit:
1120         brcmu_pkt_buf_free_skb(skb);
1121 }
1122
1123
1124 static void
1125 brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
1126 {
1127         struct msgbuf_rx_complete *rx_complete;
1128         struct sk_buff *skb;
1129         u16 data_offset;
1130         u16 buflen;
1131         u32 idx;
1132         struct brcmf_if *ifp;
1133
1134         brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1);
1135
1136         rx_complete = (struct msgbuf_rx_complete *)buf;
1137         data_offset = le16_to_cpu(rx_complete->data_offset);
1138         buflen = le16_to_cpu(rx_complete->data_len);
1139         idx = le32_to_cpu(rx_complete->msg.request_id);
1140
1141         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1142                                      msgbuf->rx_pktids, idx);
1143         if (!skb)
1144                 return;
1145
1146         if (data_offset)
1147                 skb_pull(skb, data_offset);
1148         else if (msgbuf->rx_dataoffset)
1149                 skb_pull(skb, msgbuf->rx_dataoffset);
1150
1151         skb_trim(skb, buflen);
1152
1153         ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
1154         if (!ifp || !ifp->ndev) {
1155                 brcmf_err("Received pkt for invalid ifidx %d\n",
1156                           rx_complete->msg.ifidx);
1157                 brcmu_pkt_buf_free_skb(skb);
1158                 return;
1159         }
1160
1161         skb->protocol = eth_type_trans(skb, ifp->ndev);
1162         brcmf_netif_rx(ifp, skb);
1163 }
1164
1165
1166 static void
1167 brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
1168                                                void *buf)
1169 {
1170         struct msgbuf_flowring_create_resp *flowring_create_resp;
1171         u16 status;
1172         u16 flowid;
1173
1174         flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
1175
1176         flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
1177         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
1178         status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
1179
1180         if (status) {
1181                 brcmf_err("Flowring creation failed, code %d\n", status);
1182                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1183                 return;
1184         }
1185         brcmf_dbg(MSGBUF, "Flowring %d Create response status %d\n", flowid,
1186                   status);
1187
1188         brcmf_flowring_open(msgbuf->flow, flowid);
1189
1190         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1191 }
1192
1193
1194 static void
1195 brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
1196                                                void *buf)
1197 {
1198         struct msgbuf_flowring_delete_resp *flowring_delete_resp;
1199         u16 status;
1200         u16 flowid;
1201
1202         flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
1203
1204         flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
1205         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
1206         status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
1207
1208         if (status) {
1209                 brcmf_err("Flowring deletion failed, code %d\n", status);
1210                 brcmf_flowring_delete(msgbuf->flow, flowid);
1211                 return;
1212         }
1213         brcmf_dbg(MSGBUF, "Flowring %d Delete response status %d\n", flowid,
1214                   status);
1215
1216         brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1217 }
1218
1219
1220 static void brcmf_msgbuf_process_msgtype(struct brcmf_msgbuf *msgbuf, void *buf)
1221 {
1222         struct msgbuf_common_hdr *msg;
1223
1224         msg = (struct msgbuf_common_hdr *)buf;
1225         switch (msg->msgtype) {
1226         case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
1227                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
1228                 brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);
1229                 break;
1230         case MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT:
1231                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT\n");
1232                 brcmf_msgbuf_process_flow_ring_delete_response(msgbuf, buf);
1233                 break;
1234         case MSGBUF_TYPE_IOCTLPTR_REQ_ACK:
1235                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTLPTR_REQ_ACK\n");
1236                 break;
1237         case MSGBUF_TYPE_IOCTL_CMPLT:
1238                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTL_CMPLT\n");
1239                 brcmf_msgbuf_process_ioctl_complete(msgbuf, buf);
1240                 break;
1241         case MSGBUF_TYPE_WL_EVENT:
1242                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_WL_EVENT\n");
1243                 brcmf_msgbuf_process_event(msgbuf, buf);
1244                 break;
1245         case MSGBUF_TYPE_TX_STATUS:
1246                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_TX_STATUS\n");
1247                 brcmf_msgbuf_process_txstatus(msgbuf, buf);
1248                 break;
1249         case MSGBUF_TYPE_RX_CMPLT:
1250                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RX_CMPLT\n");
1251                 brcmf_msgbuf_process_rx_complete(msgbuf, buf);
1252                 break;
1253         default:
1254                 brcmf_err("Unsupported msgtype %d\n", msg->msgtype);
1255                 break;
1256         }
1257 }
1258
1259
1260 static void brcmf_msgbuf_process_rx(struct brcmf_msgbuf *msgbuf,
1261                                     struct brcmf_commonring *commonring)
1262 {
1263         void *buf;
1264         u16 count;
1265         u16 processed;
1266
1267 again:
1268         buf = brcmf_commonring_get_read_ptr(commonring, &count);
1269         if (buf == NULL)
1270                 return;
1271
1272         processed = 0;
1273         while (count) {
1274                 brcmf_msgbuf_process_msgtype(msgbuf,
1275                                              buf + msgbuf->rx_dataoffset);
1276                 buf += brcmf_commonring_len_item(commonring);
1277                 processed++;
1278                 if (processed == BRCMF_MSGBUF_UPDATE_RX_PTR_THRS) {
1279                         brcmf_commonring_read_complete(commonring, processed);
1280                         processed = 0;
1281                 }
1282                 count--;
1283         }
1284         if (processed)
1285                 brcmf_commonring_read_complete(commonring, processed);
1286
1287         if (commonring->r_ptr == 0)
1288                 goto again;
1289 }
1290
1291
1292 int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
1293 {
1294         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1295         struct brcmf_pub *drvr = bus_if->drvr;
1296         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1297         struct brcmf_commonring *commonring;
1298         void *buf;
1299         u32 flowid;
1300         int qlen;
1301
1302         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1303         brcmf_msgbuf_process_rx(msgbuf, buf);
1304         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1305         brcmf_msgbuf_process_rx(msgbuf, buf);
1306         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1307         brcmf_msgbuf_process_rx(msgbuf, buf);
1308
1309         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
1310                          msgbuf->max_flowrings) {
1311                 clear_bit(flowid, msgbuf->txstatus_done_map);
1312                 commonring = msgbuf->flowrings[flowid];
1313                 qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
1314                 if ((qlen > BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) ||
1315                     ((qlen) && (atomic_read(&commonring->outstanding_tx) <
1316                                 BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS)))
1317                         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1318         }
1319
1320         return 0;
1321 }
1322
1323
1324 void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
1325 {
1326         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1327         struct msgbuf_tx_flowring_delete_req *delete;
1328         struct brcmf_commonring *commonring;
1329         void *ret_ptr;
1330         u8 ifidx;
1331         int err;
1332
1333         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1334         brcmf_commonring_lock(commonring);
1335         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
1336         if (!ret_ptr) {
1337                 brcmf_err("FW unaware, flowring will be removed !!\n");
1338                 brcmf_commonring_unlock(commonring);
1339                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1340                 return;
1341         }
1342
1343         delete = (struct msgbuf_tx_flowring_delete_req *)ret_ptr;
1344
1345         ifidx = brcmf_flowring_ifidx_get(msgbuf->flow, flowid);
1346
1347         delete->msg.msgtype = MSGBUF_TYPE_FLOW_RING_DELETE;
1348         delete->msg.ifidx = ifidx;
1349         delete->msg.request_id = 0;
1350
1351         delete->flow_ring_id = cpu_to_le16(flowid +
1352                                            BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
1353         delete->reason = 0;
1354
1355         brcmf_dbg(MSGBUF, "Send Flow Delete Req flow ID %d, ifindex %d\n",
1356                   flowid, ifidx);
1357
1358         err = brcmf_commonring_write_complete(commonring);
1359         brcmf_commonring_unlock(commonring);
1360         if (err) {
1361                 brcmf_err("Failed to submit RING_DELETE, flowring will be removed\n");
1362                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1363         }
1364 }
1365
1366 #ifdef DEBUG
1367 static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
1368 {
1369         struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
1370         struct brcmf_pub *drvr = bus_if->drvr;
1371         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1372         struct brcmf_commonring *commonring;
1373         u16 i;
1374         struct brcmf_flowring_ring *ring;
1375         struct brcmf_flowring_hash *hash;
1376
1377         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1378         seq_printf(seq, "h2d_ctl_submit: rp %4u, wp %4u, depth %4u\n",
1379                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1380         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
1381         seq_printf(seq, "h2d_rx_submit:  rp %4u, wp %4u, depth %4u\n",
1382                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1383         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1384         seq_printf(seq, "d2h_ctl_cmplt:  rp %4u, wp %4u, depth %4u\n",
1385                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1386         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1387         seq_printf(seq, "d2h_tx_cmplt:   rp %4u, wp %4u, depth %4u\n",
1388                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1389         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1390         seq_printf(seq, "d2h_rx_cmplt:   rp %4u, wp %4u, depth %4u\n",
1391                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1392
1393         seq_printf(seq, "\nh2d_flowrings: depth %u\n",
1394                    BRCMF_H2D_TXFLOWRING_MAX_ITEM);
1395         seq_puts(seq, "Active flowrings:\n");
1396         hash = msgbuf->flow->hash;
1397         for (i = 0; i < msgbuf->flow->nrofrings; i++) {
1398                 if (!msgbuf->flow->rings[i])
1399                         continue;
1400                 ring = msgbuf->flow->rings[i];
1401                 if (ring->status != RING_OPEN)
1402                         continue;
1403                 commonring = msgbuf->flowrings[i];
1404                 hash = &msgbuf->flow->hash[ring->hash_id];
1405                 seq_printf(seq, "id %3u: rp %4u, wp %4u, qlen %4u, blocked %u\n"
1406                                 "        ifidx %u, fifo %u, da %pM\n",
1407                                 i, commonring->r_ptr, commonring->w_ptr,
1408                                 skb_queue_len(&ring->skblist), ring->blocked,
1409                                 hash->ifidx, hash->fifo, hash->mac);
1410         }
1411
1412         return 0;
1413 }
1414 #else
1415 static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
1416 {
1417         return 0;
1418 }
1419 #endif
1420
1421 static void brcmf_msgbuf_debugfs_create(struct brcmf_pub *drvr)
1422 {
1423         brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
1424 }
1425
1426 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
1427 {
1428         struct brcmf_bus_msgbuf *if_msgbuf;
1429         struct brcmf_msgbuf *msgbuf;
1430         u64 address;
1431         u32 count;
1432
1433         if_msgbuf = drvr->bus_if->msgbuf;
1434
1435         if (if_msgbuf->max_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
1436                 brcmf_err("driver not configured for this many flowrings %d\n",
1437                           if_msgbuf->max_flowrings);
1438                 if_msgbuf->max_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
1439         }
1440
1441         msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
1442         if (!msgbuf)
1443                 goto fail;
1444
1445         msgbuf->txflow_wq = create_singlethread_workqueue("msgbuf_txflow");
1446         if (msgbuf->txflow_wq == NULL) {
1447                 brcmf_err("workqueue creation failed\n");
1448                 goto fail;
1449         }
1450         INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
1451         count = BITS_TO_LONGS(if_msgbuf->max_flowrings);
1452         count = count * sizeof(unsigned long);
1453         msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
1454         if (!msgbuf->flow_map)
1455                 goto fail;
1456
1457         msgbuf->txstatus_done_map = kzalloc(count, GFP_KERNEL);
1458         if (!msgbuf->txstatus_done_map)
1459                 goto fail;
1460
1461         msgbuf->drvr = drvr;
1462         msgbuf->ioctbuf = dma_alloc_coherent(drvr->bus_if->dev,
1463                                              BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1464                                              &msgbuf->ioctbuf_handle,
1465                                              GFP_KERNEL);
1466         if (!msgbuf->ioctbuf)
1467                 goto fail;
1468         address = (u64)msgbuf->ioctbuf_handle;
1469         msgbuf->ioctbuf_phys_hi = address >> 32;
1470         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
1471
1472         drvr->proto->hdrpull = brcmf_msgbuf_hdrpull;
1473         drvr->proto->query_dcmd = brcmf_msgbuf_query_dcmd;
1474         drvr->proto->set_dcmd = brcmf_msgbuf_set_dcmd;
1475         drvr->proto->tx_queue_data = brcmf_msgbuf_tx_queue_data;
1476         drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
1477         drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
1478         drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
1479         drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
1480         drvr->proto->debugfs_create = brcmf_msgbuf_debugfs_create;
1481         drvr->proto->pd = msgbuf;
1482
1483         init_waitqueue_head(&msgbuf->ioctl_resp_wait);
1484
1485         msgbuf->commonrings =
1486                 (struct brcmf_commonring **)if_msgbuf->commonrings;
1487         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
1488         msgbuf->max_flowrings = if_msgbuf->max_flowrings;
1489         msgbuf->flowring_dma_handle =
1490                 kcalloc(msgbuf->max_flowrings,
1491                         sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
1492         if (!msgbuf->flowring_dma_handle)
1493                 goto fail;
1494
1495         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
1496         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
1497
1498         msgbuf->max_ioctlrespbuf = BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST;
1499         msgbuf->max_eventbuf = BRCMF_MSGBUF_MAX_EVENTBUF_POST;
1500
1501         msgbuf->tx_pktids = brcmf_msgbuf_init_pktids(NR_TX_PKTIDS,
1502                                                      DMA_TO_DEVICE);
1503         if (!msgbuf->tx_pktids)
1504                 goto fail;
1505         msgbuf->rx_pktids = brcmf_msgbuf_init_pktids(NR_RX_PKTIDS,
1506                                                      DMA_FROM_DEVICE);
1507         if (!msgbuf->rx_pktids)
1508                 goto fail;
1509
1510         msgbuf->flow = brcmf_flowring_attach(drvr->bus_if->dev,
1511                                              if_msgbuf->max_flowrings);
1512         if (!msgbuf->flow)
1513                 goto fail;
1514
1515
1516         brcmf_dbg(MSGBUF, "Feeding buffers, rx data %d, rx event %d, rx ioctl resp %d\n",
1517                   msgbuf->max_rxbufpost, msgbuf->max_eventbuf,
1518                   msgbuf->max_ioctlrespbuf);
1519         count = 0;
1520         do {
1521                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
1522                 if (msgbuf->max_rxbufpost != msgbuf->rxbufpost)
1523                         msleep(10);
1524                 else
1525                         break;
1526                 count++;
1527         } while (count < 10);
1528         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1529         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
1530
1531         INIT_WORK(&msgbuf->flowring_work, brcmf_msgbuf_flowring_worker);
1532         spin_lock_init(&msgbuf->flowring_work_lock);
1533         INIT_LIST_HEAD(&msgbuf->work_queue);
1534
1535         return 0;
1536
1537 fail:
1538         if (msgbuf) {
1539                 kfree(msgbuf->flow_map);
1540                 kfree(msgbuf->txstatus_done_map);
1541                 brcmf_msgbuf_release_pktids(msgbuf);
1542                 kfree(msgbuf->flowring_dma_handle);
1543                 if (msgbuf->ioctbuf)
1544                         dma_free_coherent(drvr->bus_if->dev,
1545                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1546                                           msgbuf->ioctbuf,
1547                                           msgbuf->ioctbuf_handle);
1548                 kfree(msgbuf);
1549         }
1550         return -ENOMEM;
1551 }
1552
1553
1554 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
1555 {
1556         struct brcmf_msgbuf *msgbuf;
1557         struct brcmf_msgbuf_work_item *work;
1558
1559         brcmf_dbg(TRACE, "Enter\n");
1560         if (drvr->proto->pd) {
1561                 msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1562                 cancel_work_sync(&msgbuf->flowring_work);
1563                 while (!list_empty(&msgbuf->work_queue)) {
1564                         work = list_first_entry(&msgbuf->work_queue,
1565                                                 struct brcmf_msgbuf_work_item,
1566                                                 queue);
1567                         list_del(&work->queue);
1568                         kfree(work);
1569                 }
1570                 kfree(msgbuf->flow_map);
1571                 kfree(msgbuf->txstatus_done_map);
1572                 if (msgbuf->txflow_wq)
1573                         destroy_workqueue(msgbuf->txflow_wq);
1574
1575                 brcmf_flowring_detach(msgbuf->flow);
1576                 dma_free_coherent(drvr->bus_if->dev,
1577                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1578                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
1579                 brcmf_msgbuf_release_pktids(msgbuf);
1580                 kfree(msgbuf->flowring_dma_handle);
1581                 kfree(msgbuf);
1582                 drvr->proto->pd = NULL;
1583         }
1584 }