drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c

   1 /* Copyright (c) 2014 Broadcom Corporation
   2  *
   3  * Permission to use, copy, modify, and/or distribute this software for any
   4  * purpose with or without fee is hereby granted, provided that the above
   5  * copyright notice and this permission notice appear in all copies.
   6  *
   7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  14  */
  15
  16 /*******************************************************************************
  17  * Communicates with the dongle by using dcmd codes.
  18  * For certain dcmd codes, the dongle interprets string data from the host.
  19  ******************************************************************************/
  20
  21 #include <linux/types.h>
  22 #include <linux/netdevice.h>
  23
  24 #include <brcmu_utils.h>
  25 #include <brcmu_wifi.h>
  26
  27 #include "core.h"
  28 #include "debug.h"
  29 #include "proto.h"
  30 #include "msgbuf.h"
  31 #include "commonring.h"
  32 #include "flowring.h"
  33 #include "bus.h"
  34 #include "tracepoint.h"
  35
  36
  37 #define MSGBUF_IOCTL_RESP_TIMEOUT               2000
  38
  39 #define MSGBUF_TYPE_GEN_STATUS                  0x1
  40 #define MSGBUF_TYPE_RING_STATUS                 0x2
  41 #define MSGBUF_TYPE_FLOW_RING_CREATE            0x3
  42 #define MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT      0x4
  43 #define MSGBUF_TYPE_FLOW_RING_DELETE            0x5
  44 #define MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT      0x6
  45 #define MSGBUF_TYPE_FLOW_RING_FLUSH             0x7
  46 #define MSGBUF_TYPE_FLOW_RING_FLUSH_CMPLT       0x8
  47 #define MSGBUF_TYPE_IOCTLPTR_REQ                0x9
  48 #define MSGBUF_TYPE_IOCTLPTR_REQ_ACK            0xA
  49 #define MSGBUF_TYPE_IOCTLRESP_BUF_POST          0xB
  50 #define MSGBUF_TYPE_IOCTL_CMPLT                 0xC
  51 #define MSGBUF_TYPE_EVENT_BUF_POST              0xD
  52 #define MSGBUF_TYPE_WL_EVENT                    0xE
  53 #define MSGBUF_TYPE_TX_POST                     0xF
  54 #define MSGBUF_TYPE_TX_STATUS                   0x10
  55 #define MSGBUF_TYPE_RXBUF_POST                  0x11
  56 #define MSGBUF_TYPE_RX_CMPLT                    0x12
  57 #define MSGBUF_TYPE_LPBK_DMAXFER                0x13
  58 #define MSGBUF_TYPE_LPBK_DMAXFER_CMPLT          0x14
  59
  60 #define NR_TX_PKTIDS                            2048
  61 #define NR_RX_PKTIDS                            1024
  62
  63 #define BRCMF_IOCTL_REQ_PKTID                   0xFFFE
  64
  65 #define BRCMF_MSGBUF_MAX_PKT_SIZE               2048
  66 #define BRCMF_MSGBUF_RXBUFPOST_THRESHOLD        32
  67 #define BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST      8
  68 #define BRCMF_MSGBUF_MAX_EVENTBUF_POST          8
  69
  70 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3      0x01
  71 #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT       5
  72
  73 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
  74 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
  75
  76 #define BRCMF_MSGBUF_DELAY_TXWORKER_THRS        96
  77 #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS      32
  78
  79 struct msgbuf_common_hdr {
  80         u8                              msgtype;
  81         u8                              ifidx;
  82         u8                              flags;
  83         u8                              rsvd0;
  84         __le32                          request_id;
  85 };
  86
  87 struct msgbuf_buf_addr {
  88         __le32                          low_addr;
  89         __le32                          high_addr;
  90 };
  91
  92 struct msgbuf_ioctl_req_hdr {
  93         struct msgbuf_common_hdr        msg;
  94         __le32                          cmd;
  95         __le16                          trans_id;
  96         __le16                          input_buf_len;
  97         __le16                          output_buf_len;
  98         __le16                          rsvd0[3];
  99         struct msgbuf_buf_addr          req_buf_addr;
 100         __le32                          rsvd1[2];
 101 };
 102
 103 struct msgbuf_tx_msghdr {
 104         struct msgbuf_common_hdr        msg;
 105         u8                              txhdr[ETH_HLEN];
 106         u8                              flags;
 107         u8                              seg_cnt;
 108         struct msgbuf_buf_addr          metadata_buf_addr;
 109         struct msgbuf_buf_addr          data_buf_addr;
 110         __le16                          metadata_buf_len;
 111         __le16                          data_len;
 112         __le32                          rsvd0;
 113 };
 114
 115 struct msgbuf_rx_bufpost {
 116         struct msgbuf_common_hdr        msg;
 117         __le16                          metadata_buf_len;
 118         __le16                          data_buf_len;
 119         __le32                          rsvd0;
 120         struct msgbuf_buf_addr          metadata_buf_addr;
 121         struct msgbuf_buf_addr          data_buf_addr;
 122 };
 123
 124 struct msgbuf_rx_ioctl_resp_or_event {
 125         struct msgbuf_common_hdr        msg;
 126         __le16                          host_buf_len;
 127         __le16                          rsvd0[3];
 128         struct msgbuf_buf_addr          host_buf_addr;
 129         __le32                          rsvd1[4];
 130 };
 131
 132 struct msgbuf_completion_hdr {
 133         __le16                          status;
 134         __le16                          flow_ring_id;
 135 };
 136
 137 struct msgbuf_rx_event {
 138         struct msgbuf_common_hdr        msg;
 139         struct msgbuf_completion_hdr    compl_hdr;
 140         __le16                          event_data_len;
 141         __le16                          seqnum;
 142         __le16                          rsvd0[4];
 143 };
 144
 145 struct msgbuf_ioctl_resp_hdr {
 146         struct msgbuf_common_hdr        msg;
 147         struct msgbuf_completion_hdr    compl_hdr;
 148         __le16                          resp_len;
 149         __le16                          trans_id;
 150         __le32                          cmd;
 151         __le32                          rsvd0;
 152 };
 153
 154 struct msgbuf_tx_status {
 155         struct msgbuf_common_hdr        msg;
 156         struct msgbuf_completion_hdr    compl_hdr;
 157         __le16                          metadata_len;
 158         __le16                          tx_status;
 159 };
 160
 161 struct msgbuf_rx_complete {
 162         struct msgbuf_common_hdr        msg;
 163         struct msgbuf_completion_hdr    compl_hdr;
 164         __le16                          metadata_len;
 165         __le16                          data_len;
 166         __le16                          data_offset;
 167         __le16                          flags;
 168         __le32                          rx_status_0;
 169         __le32                          rx_status_1;
 170         __le32                          rsvd0;
 171 };
 172
 173 struct msgbuf_tx_flowring_create_req {
 174         struct msgbuf_common_hdr        msg;
 175         u8                              da[ETH_ALEN];
 176         u8                              sa[ETH_ALEN];
 177         u8                              tid;
 178         u8                              if_flags;
 179         __le16                          flow_ring_id;
 180         u8                              tc;
 181         u8                              priority;
 182         __le16                          int_vector;
 183         __le16                          max_items;
 184         __le16                          len_item;
 185         struct msgbuf_buf_addr          flow_ring_addr;
 186 };
 187
 188 struct msgbuf_tx_flowring_delete_req {
 189         struct msgbuf_common_hdr        msg;
 190         __le16                          flow_ring_id;
 191         __le16                          reason;
 192         __le32                          rsvd0[7];
 193 };
 194
 195 struct msgbuf_flowring_create_resp {
 196         struct msgbuf_common_hdr        msg;
 197         struct msgbuf_completion_hdr    compl_hdr;
 198         __le32                          rsvd0[3];
 199 };
 200
 201 struct msgbuf_flowring_delete_resp {
 202         struct msgbuf_common_hdr        msg;
 203         struct msgbuf_completion_hdr    compl_hdr;
 204         __le32                          rsvd0[3];
 205 };
 206
 207 struct msgbuf_flowring_flush_resp {
 208         struct msgbuf_common_hdr        msg;
 209         struct msgbuf_completion_hdr    compl_hdr;
 210         __le32                          rsvd0[3];
 211 };
 212
 213 struct brcmf_msgbuf_work_item {
 214         struct list_head queue;
 215         u32 flowid;
 216         int ifidx;
 217         u8 sa[ETH_ALEN];
 218         u8 da[ETH_ALEN];
 219 };
 220
 221 struct brcmf_msgbuf {
 222         struct brcmf_pub *drvr;
 223
 224         struct brcmf_commonring **commonrings;
 225         struct brcmf_commonring **flowrings;
 226         dma_addr_t *flowring_dma_handle;
 227         u16 nrof_flowrings;
 228
 229         u16 rx_dataoffset;
 230         u32 max_rxbufpost;
 231         u16 rx_metadata_offset;
 232         u32 rxbufpost;
 233
 234         u32 max_ioctlrespbuf;
 235         u32 cur_ioctlrespbuf;
 236         u32 max_eventbuf;
 237         u32 cur_eventbuf;
 238
 239         void *ioctbuf;
 240         dma_addr_t ioctbuf_handle;
 241         u32 ioctbuf_phys_hi;
 242         u32 ioctbuf_phys_lo;
 243         int ioctl_resp_status;
 244         u32 ioctl_resp_ret_len;
 245         u32 ioctl_resp_pktid;
 246
 247         u16 data_seq_no;
 248         u16 ioctl_seq_no;
 249         u32 reqid;
 250         wait_queue_head_t ioctl_resp_wait;
 251         bool ctl_completed;
 252
 253         struct brcmf_msgbuf_pktids *tx_pktids;
 254         struct brcmf_msgbuf_pktids *rx_pktids;
 255         struct brcmf_flowring *flow;
 256
 257         struct workqueue_struct *txflow_wq;
 258         struct work_struct txflow_work;
 259         unsigned long *flow_map;
 260         unsigned long *txstatus_done_map;
 261
 262         struct work_struct flowring_work;
 263         spinlock_t flowring_work_lock;
 264         struct list_head work_queue;
 265 };
 266
 267 struct brcmf_msgbuf_pktid {
 268         atomic_t  allocated;
 269         u16 data_offset;
 270         struct sk_buff *skb;
 271         dma_addr_t physaddr;
 272 };
 273
 274 struct brcmf_msgbuf_pktids {
 275         u32 array_size;
 276         u32 last_allocated_idx;
 277         enum dma_data_direction direction;
 278         struct brcmf_msgbuf_pktid *array;
 279 };
 280
 281 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf);
 282
 283
 284 static struct brcmf_msgbuf_pktids *
 285 brcmf_msgbuf_init_pktids(u32 nr_array_entries,
 286                          enum dma_data_direction direction)
 287 {
 288         struct brcmf_msgbuf_pktid *array;
 289         struct brcmf_msgbuf_pktids *pktids;
 290
 291         array = kcalloc(nr_array_entries, sizeof(*array), GFP_KERNEL);
 292         if (!array)
 293                 return NULL;
 294
 295         pktids = kzalloc(sizeof(*pktids), GFP_KERNEL);
 296         if (!pktids) {
 297                 kfree(array);
 298                 return NULL;
 299         }
 300         pktids->array = array;
 301         pktids->array_size = nr_array_entries;
 302
 303         return pktids;
 304 }
 305
 306
 307 static int
 308 brcmf_msgbuf_alloc_pktid(struct device *dev,
 309                          struct brcmf_msgbuf_pktids *pktids,
 310                          struct sk_buff *skb, u16 data_offset,
 311                          dma_addr_t *physaddr, u32 *idx)
 312 {
 313         struct brcmf_msgbuf_pktid *array;
 314         u32 count;
 315
 316         array = pktids->array;
 317
 318         *physaddr = dma_map_single(dev, skb->data + data_offset,
 319                                    skb->len - data_offset, pktids->direction);
 320
 321         if (dma_mapping_error(dev, *physaddr)) {
 322                 brcmf_err("dma_map_single failed !!\n");
 323                 return -ENOMEM;
 324         }
 325
 326         *idx = pktids->last_allocated_idx;
 327
 328         count = 0;
 329         do {
 330                 (*idx)++;
 331                 if (*idx == pktids->array_size)
 332                         *idx = 0;
 333                 if (array[*idx].allocated.counter == 0)
 334                         if (atomic_cmpxchg(&array[*idx].allocated, 0, 1) == 0)
 335                                 break;
 336                 count++;
 337         } while (count < pktids->array_size);
 338
 339         if (count == pktids->array_size)
 340                 return -ENOMEM;
 341
 342         array[*idx].data_offset = data_offset;
 343         array[*idx].physaddr = *physaddr;
 344         array[*idx].skb = skb;
 345
 346         pktids->last_allocated_idx = *idx;
 347
 348         return 0;
 349 }
 350
 351
 352 static struct sk_buff *
 353 brcmf_msgbuf_get_pktid(struct device *dev, struct brcmf_msgbuf_pktids *pktids,
 354                        u32 idx)
 355 {
 356         struct brcmf_msgbuf_pktid *pktid;
 357         struct sk_buff *skb;
 358
 359         if (idx >= pktids->array_size) {
 360                 brcmf_err("Invalid packet id %d (max %d)\n", idx,
 361                           pktids->array_size);
 362                 return NULL;
 363         }
 364         if (pktids->array[idx].allocated.counter) {
 365                 pktid = &pktids->array[idx];
 366                 dma_unmap_single(dev, pktid->physaddr,
 367                                  pktid->skb->len - pktid->data_offset,
 368                                  pktids->direction);
 369                 skb = pktid->skb;
 370                 pktid->allocated.counter = 0;
 371                 return skb;
 372         } else {
 373                 brcmf_err("Invalid packet id %d (not in use)\n", idx);
 374         }
 375
 376         return NULL;
 377 }
 378
 379
 380 static void
 381 brcmf_msgbuf_release_array(struct device *dev,
 382                            struct brcmf_msgbuf_pktids *pktids)
 383 {
 384         struct brcmf_msgbuf_pktid *array;
 385         struct brcmf_msgbuf_pktid *pktid;
 386         u32 count;
 387
 388         array = pktids->array;
 389         count = 0;
 390         do {
 391                 if (array[count].allocated.counter) {
 392                         pktid = &array[count];
 393                         dma_unmap_single(dev, pktid->physaddr,
 394                                          pktid->skb->len - pktid->data_offset,
 395                                          pktids->direction);
 396                         brcmu_pkt_buf_free_skb(pktid->skb);
 397                 }
 398                 count++;
 399         } while (count < pktids->array_size);
 400
 401         kfree(array);
 402         kfree(pktids);
 403 }
 404
 405
 406 static void brcmf_msgbuf_release_pktids(struct brcmf_msgbuf *msgbuf)
 407 {
 408         if (msgbuf->rx_pktids)
 409                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 410                                            msgbuf->rx_pktids);
 411         if (msgbuf->tx_pktids)
 412                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 413                                            msgbuf->tx_pktids);
 414 }
 415
 416
 417 static int brcmf_msgbuf_tx_ioctl(struct brcmf_pub *drvr, int ifidx,
 418                                  uint cmd, void *buf, uint len)
 419 {
 420         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 421         struct brcmf_commonring *commonring;
 422         struct msgbuf_ioctl_req_hdr *request;
 423         u16 buf_len;
 424         void *ret_ptr;
 425         int err;
 426
 427         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 428         brcmf_commonring_lock(commonring);
 429         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 430         if (!ret_ptr) {
 431                 brcmf_err("Failed to reserve space in commonring\n");
 432                 brcmf_commonring_unlock(commonring);
 433                 return -ENOMEM;
 434         }
 435
 436         msgbuf->reqid++;
 437
 438         request = (struct msgbuf_ioctl_req_hdr *)ret_ptr;
 439         request->msg.msgtype = MSGBUF_TYPE_IOCTLPTR_REQ;
 440         request->msg.ifidx = (u8)ifidx;
 441         request->msg.flags = 0;
 442         request->msg.request_id = cpu_to_le32(BRCMF_IOCTL_REQ_PKTID);
 443         request->cmd = cpu_to_le32(cmd);
 444         request->output_buf_len = cpu_to_le16(len);
 445         request->trans_id = cpu_to_le16(msgbuf->reqid);
 446
 447         buf_len = min_t(u16, len, BRCMF_TX_IOCTL_MAX_MSG_SIZE);
 448         request->input_buf_len = cpu_to_le16(buf_len);
 449         request->req_buf_addr.high_addr = cpu_to_le32(msgbuf->ioctbuf_phys_hi);
 450         request->req_buf_addr.low_addr = cpu_to_le32(msgbuf->ioctbuf_phys_lo);
 451         if (buf)
 452                 memcpy(msgbuf->ioctbuf, buf, buf_len);
 453         else
 454                 memset(msgbuf->ioctbuf, 0, buf_len);
 455
 456         err = brcmf_commonring_write_complete(commonring);
 457         brcmf_commonring_unlock(commonring);
 458
 459         return err;
 460 }
 461
 462
 463 static int brcmf_msgbuf_ioctl_resp_wait(struct brcmf_msgbuf *msgbuf)
 464 {
 465         return wait_event_timeout(msgbuf->ioctl_resp_wait,
 466                                   msgbuf->ctl_completed,
 467                                   msecs_to_jiffies(MSGBUF_IOCTL_RESP_TIMEOUT));
 468 }
 469
 470
 471 static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
 472 {
 473         msgbuf->ctl_completed = true;
 474         if (waitqueue_active(&msgbuf->ioctl_resp_wait))
 475                 wake_up(&msgbuf->ioctl_resp_wait);
 476 }
 477
 478
 479 static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 480                                    uint cmd, void *buf, uint len)
 481 {
 482         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 483         struct sk_buff *skb = NULL;
 484         int timeout;
 485         int err;
 486
 487         brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
 488         msgbuf->ctl_completed = false;
 489         err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
 490         if (err)
 491                 return err;
 492
 493         timeout = brcmf_msgbuf_ioctl_resp_wait(msgbuf);
 494         if (!timeout) {
 495                 brcmf_err("Timeout on response for query command\n");
 496                 return -EIO;
 497         }
 498
 499         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 500                                      msgbuf->rx_pktids,
 501                                      msgbuf->ioctl_resp_pktid);
 502         if (msgbuf->ioctl_resp_ret_len != 0) {
 503                 if (!skb)
 504                         return -EBADF;
 505
 506                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
 507                                        len : msgbuf->ioctl_resp_ret_len);
 508         }
 509         brcmu_pkt_buf_free_skb(skb);
 510
 511         return msgbuf->ioctl_resp_status;
 512 }
 513
 514
 515 static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
 516                                  uint cmd, void *buf, uint len)
 517 {
 518         return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len);
 519 }
 520
 521
 522 static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 523                                 u8 *ifidx, struct sk_buff *skb)
 524 {
 525         return -ENODEV;
 526 }
 527
 528
 529 static void
 530 brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
 531 {
 532         u32 dma_sz;
 533         void *dma_buf;
 534
 535         brcmf_dbg(MSGBUF, "Removing flowring %d\n", flowid);
 536
 537         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 538         dma_buf = msgbuf->flowrings[flowid]->buf_addr;
 539         dma_free_coherent(msgbuf->drvr->bus_if->dev, dma_sz, dma_buf,
 540                           msgbuf->flowring_dma_handle[flowid]);
 541
 542         brcmf_flowring_delete(msgbuf->flow, flowid);
 543 }
 544
 545
 546 static struct brcmf_msgbuf_work_item *
 547 brcmf_msgbuf_dequeue_work(struct brcmf_msgbuf *msgbuf)
 548 {
 549         struct brcmf_msgbuf_work_item *work = NULL;
 550         ulong flags;
 551
 552         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 553         if (!list_empty(&msgbuf->work_queue)) {
 554                 work = list_first_entry(&msgbuf->work_queue,
 555                                         struct brcmf_msgbuf_work_item, queue);
 556                 list_del(&work->queue);
 557         }
 558         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 559
 560         return work;
 561 }
 562
 563
 564 static u32
 565 brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
 566                                     struct brcmf_msgbuf_work_item *work)
 567 {
 568         struct msgbuf_tx_flowring_create_req *create;
 569         struct brcmf_commonring *commonring;
 570         void *ret_ptr;
 571         u32 flowid;
 572         void *dma_buf;
 573         u32 dma_sz;
 574         u64 address;
 575         int err;
 576
 577         flowid = work->flowid;
 578         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 579         dma_buf = dma_alloc_coherent(msgbuf->drvr->bus_if->dev, dma_sz,
 580                                      &msgbuf->flowring_dma_handle[flowid],
 581                                      GFP_KERNEL);
 582         if (!dma_buf) {
 583                 brcmf_err("dma_alloc_coherent failed\n");
 584                 brcmf_flowring_delete(msgbuf->flow, flowid);
 585                 return BRCMF_FLOWRING_INVALID_ID;
 586         }
 587
 588         brcmf_commonring_config(msgbuf->flowrings[flowid],
 589                                 BRCMF_H2D_TXFLOWRING_MAX_ITEM,
 590                                 BRCMF_H2D_TXFLOWRING_ITEMSIZE, dma_buf);
 591
 592         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 593         brcmf_commonring_lock(commonring);
 594         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 595         if (!ret_ptr) {
 596                 brcmf_err("Failed to reserve space in commonring\n");
 597                 brcmf_commonring_unlock(commonring);
 598                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 599                 return BRCMF_FLOWRING_INVALID_ID;
 600         }
 601
 602         create = (struct msgbuf_tx_flowring_create_req *)ret_ptr;
 603         create->msg.msgtype = MSGBUF_TYPE_FLOW_RING_CREATE;
 604         create->msg.ifidx = work->ifidx;
 605         create->msg.request_id = 0;
 606         create->tid = brcmf_flowring_tid(msgbuf->flow, flowid);
 607         create->flow_ring_id = cpu_to_le16(flowid +
 608                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
 609         memcpy(create->sa, work->sa, ETH_ALEN);
 610         memcpy(create->da, work->da, ETH_ALEN);
 611         address = (u64)msgbuf->flowring_dma_handle[flowid];
 612         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
 613         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
 614         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
 615         create->len_item = cpu_to_le16(BRCMF_H2D_TXFLOWRING_ITEMSIZE);
 616
 617         brcmf_dbg(MSGBUF, "Send Flow Create Req flow ID %d for peer %pM prio %d ifindex %d\n",
 618                   flowid, work->da, create->tid, work->ifidx);
 619
 620         err = brcmf_commonring_write_complete(commonring);
 621         brcmf_commonring_unlock(commonring);
 622         if (err) {
 623                 brcmf_err("Failed to write commonring\n");
 624                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 625                 return BRCMF_FLOWRING_INVALID_ID;
 626         }
 627
 628         return flowid;
 629 }
 630
 631
 632 static void brcmf_msgbuf_flowring_worker(struct work_struct *work)
 633 {
 634         struct brcmf_msgbuf *msgbuf;
 635         struct brcmf_msgbuf_work_item *create;
 636
 637         msgbuf = container_of(work, struct brcmf_msgbuf, flowring_work);
 638
 639         while ((create = brcmf_msgbuf_dequeue_work(msgbuf))) {
 640                 brcmf_msgbuf_flowring_create_worker(msgbuf, create);
 641                 kfree(create);
 642         }
 643 }
 644
 645
 646 static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 647                                         struct sk_buff *skb)
 648 {
 649         struct brcmf_msgbuf_work_item *create;
 650         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 651         u32 flowid;
 652         ulong flags;
 653
 654         create = kzalloc(sizeof(*create), GFP_ATOMIC);
 655         if (create == NULL)
 656                 return BRCMF_FLOWRING_INVALID_ID;
 657
 658         flowid = brcmf_flowring_create(msgbuf->flow, eh->h_dest,
 659                                        skb->priority, ifidx);
 660         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 661                 kfree(create);
 662                 return flowid;
 663         }
 664
 665         create->flowid = flowid;
 666         create->ifidx = ifidx;
 667         memcpy(create->sa, eh->h_source, ETH_ALEN);
 668         memcpy(create->da, eh->h_dest, ETH_ALEN);
 669
 670         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 671         list_add_tail(&create->queue, &msgbuf->work_queue);
 672         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 673         schedule_work(&msgbuf->flowring_work);
 674
 675         return flowid;
 676 }
 677
 678
 679 static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
 680 {
 681         struct brcmf_flowring *flow = msgbuf->flow;
 682         struct brcmf_commonring *commonring;
 683         void *ret_ptr;
 684         u32 count;
 685         struct sk_buff *skb;
 686         dma_addr_t physaddr;
 687         u32 pktid;
 688         struct msgbuf_tx_msghdr *tx_msghdr;
 689         u64 address;
 690
 691         commonring = msgbuf->flowrings[flowid];
 692         if (!brcmf_commonring_write_available(commonring))
 693                 return;
 694
 695         brcmf_commonring_lock(commonring);
 696
 697         count = BRCMF_MSGBUF_TX_FLUSH_CNT2 - BRCMF_MSGBUF_TX_FLUSH_CNT1;
 698         while (brcmf_flowring_qlen(flow, flowid)) {
 699                 skb = brcmf_flowring_dequeue(flow, flowid);
 700                 if (skb == NULL) {
 701                         brcmf_err("No SKB, but qlen %d\n",
 702                                   brcmf_flowring_qlen(flow, flowid));
 703                         break;
 704                 }
 705                 skb_orphan(skb);
 706                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 707                                              msgbuf->tx_pktids, skb, ETH_HLEN,
 708                                              &physaddr, &pktid)) {
 709                         brcmf_flowring_reinsert(flow, flowid, skb);
 710                         brcmf_err("No PKTID available !!\n");
 711                         break;
 712                 }
 713                 ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 714                 if (!ret_ptr) {
 715                         brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 716                                                msgbuf->tx_pktids, pktid);
 717                         brcmf_flowring_reinsert(flow, flowid, skb);
 718                         break;
 719                 }
 720                 count++;
 721
 722                 tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
 723
 724                 tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
 725                 tx_msghdr->msg.request_id = cpu_to_le32(pktid);
 726                 tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
 727                 tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
 728                 tx_msghdr->flags |= (skb->priority & 0x07) <<
 729                                     BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT;
 730                 tx_msghdr->seg_cnt = 1;
 731                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
 732                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
 733                 address = (u64)physaddr;
 734                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
 735                 tx_msghdr->data_buf_addr.low_addr =
 736                         cpu_to_le32(address & 0xffffffff);
 737                 tx_msghdr->metadata_buf_len = 0;
 738                 tx_msghdr->metadata_buf_addr.high_addr = 0;
 739                 tx_msghdr->metadata_buf_addr.low_addr = 0;
 740                 atomic_inc(&commonring->outstanding_tx);
 741                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
 742                         brcmf_commonring_write_complete(commonring);
 743                         count = 0;
 744                 }
 745         }
 746         if (count)
 747                 brcmf_commonring_write_complete(commonring);
 748         brcmf_commonring_unlock(commonring);
 749 }
 750
 751
 752 static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 753 {
 754         struct brcmf_msgbuf *msgbuf;
 755         u32 flowid;
 756
 757         msgbuf = container_of(worker, struct brcmf_msgbuf, txflow_work);
 758         for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->nrof_flowrings) {
 759                 clear_bit(flowid, msgbuf->flow_map);
 760                 brcmf_msgbuf_txflow(msgbuf, flowid);
 761         }
 762 }
 763
 764
 765 static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid,
 766                                         bool force)
 767 {
 768         struct brcmf_commonring *commonring;
 769
 770         set_bit(flowid, msgbuf->flow_map);
 771         commonring = msgbuf->flowrings[flowid];
 772         if ((force) || (atomic_read(&commonring->outstanding_tx) <
 773                         BRCMF_MSGBUF_DELAY_TXWORKER_THRS))
 774                 queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 775
 776         return 0;
 777 }
 778
 779
 780 static int brcmf_msgbuf_txdata(struct brcmf_pub *drvr, int ifidx,
 781                                u8 offset, struct sk_buff *skb)
 782 {
 783         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 784         struct brcmf_flowring *flow = msgbuf->flow;
 785         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 786         u32 flowid;
 787         u32 queue_count;
 788         bool force;
 789
 790         flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
 791         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 792                 flowid = brcmf_msgbuf_flowring_create(msgbuf, ifidx, skb);
 793                 if (flowid == BRCMF_FLOWRING_INVALID_ID)
 794                         return -ENOMEM;
 795         }
 796         queue_count = brcmf_flowring_enqueue(flow, flowid, skb);
 797         force = ((queue_count % BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) == 0);
 798         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, force);
 799
 800         return 0;
 801 }
 802
 803
 804 static void
 805 brcmf_msgbuf_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
 806                                  enum proto_addr_mode addr_mode)
 807 {
 808         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 809
 810         brcmf_flowring_configure_addr_mode(msgbuf->flow, ifidx, addr_mode);
 811 }
 812
 813
 814 static void
 815 brcmf_msgbuf_delete_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 816 {
 817         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 818
 819         brcmf_flowring_delete_peer(msgbuf->flow, ifidx, peer);
 820 }
 821
 822
 823 static void
 824 brcmf_msgbuf_add_tdls_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 825 {
 826         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 827
 828         brcmf_flowring_add_tdls_peer(msgbuf->flow, ifidx, peer);
 829 }
 830
 831
 832 static void
 833 brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 834 {
 835         struct msgbuf_ioctl_resp_hdr *ioctl_resp;
 836
 837         ioctl_resp = (struct msgbuf_ioctl_resp_hdr *)buf;
 838
 839         msgbuf->ioctl_resp_status =
 840                         (s16)le16_to_cpu(ioctl_resp->compl_hdr.status);
 841         msgbuf->ioctl_resp_ret_len = le16_to_cpu(ioctl_resp->resp_len);
 842         msgbuf->ioctl_resp_pktid = le32_to_cpu(ioctl_resp->msg.request_id);
 843
 844         brcmf_msgbuf_ioctl_resp_wake(msgbuf);
 845
 846         if (msgbuf->cur_ioctlrespbuf)
 847                 msgbuf->cur_ioctlrespbuf--;
 848         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
 849 }
 850
 851
 852 static void
 853 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 854 {
 855         struct brcmf_commonring *commonring;
 856         struct msgbuf_tx_status *tx_status;
 857         u32 idx;
 858         struct sk_buff *skb;
 859         u16 flowid;
 860
 861         tx_status = (struct msgbuf_tx_status *)buf;
 862         idx = le32_to_cpu(tx_status->msg.request_id);
 863         flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
 864         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
 865         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 866                                      msgbuf->tx_pktids, idx);
 867         if (!skb)
 868                 return;
 869
 870         set_bit(flowid, msgbuf->txstatus_done_map);
 871         commonring = msgbuf->flowrings[flowid];
 872         atomic_dec(&commonring->outstanding_tx);
 873
 874         brcmf_txfinalize(msgbuf->drvr, skb, tx_status->msg.ifidx, true);
 875 }
 876
 877
 878 static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
 879 {
 880         struct brcmf_commonring *commonring;
 881         void *ret_ptr;
 882         struct sk_buff *skb;
 883         u16 alloced;
 884         u32 pktlen;
 885         dma_addr_t physaddr;
 886         struct msgbuf_rx_bufpost *rx_bufpost;
 887         u64 address;
 888         u32 pktid;
 889         u32 i;
 890
 891         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
 892         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
 893                                                               count,
 894                                                               &alloced);
 895         if (!ret_ptr) {
 896                 brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
 897                 return 0;
 898         }
 899
 900         for (i = 0; i < alloced; i++) {
 901                 rx_bufpost = (struct msgbuf_rx_bufpost *)ret_ptr;
 902                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
 903
 904                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
 905
 906                 if (skb == NULL) {
 907                         brcmf_err("Failed to alloc SKB\n");
 908                         brcmf_commonring_write_cancel(commonring, alloced - i);
 909                         break;
 910                 }
 911
 912                 pktlen = skb->len;
 913                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 914                                              msgbuf->rx_pktids, skb, 0,
 915                                              &physaddr, &pktid)) {
 916                         dev_kfree_skb_any(skb);
 917                         brcmf_err("No PKTID available !!\n");
 918                         brcmf_commonring_write_cancel(commonring, alloced - i);
 919                         break;
 920                 }
 921
 922                 if (msgbuf->rx_metadata_offset) {
 923                         address = (u64)physaddr;
 924                         rx_bufpost->metadata_buf_len =
 925                                 cpu_to_le16(msgbuf->rx_metadata_offset);
 926                         rx_bufpost->metadata_buf_addr.high_addr =
 927                                 cpu_to_le32(address >> 32);
 928                         rx_bufpost->metadata_buf_addr.low_addr =
 929                                 cpu_to_le32(address & 0xffffffff);
 930
 931                         skb_pull(skb, msgbuf->rx_metadata_offset);
 932                         pktlen = skb->len;
 933                         physaddr += msgbuf->rx_metadata_offset;
 934                 }
 935                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
 936                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 937
 938                 address = (u64)physaddr;
 939                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
 940                 rx_bufpost->data_buf_addr.high_addr =
 941                         cpu_to_le32(address >> 32);
 942                 rx_bufpost->data_buf_addr.low_addr =
 943                         cpu_to_le32(address & 0xffffffff);
 944
 945                 ret_ptr += brcmf_commonring_len_item(commonring);
 946         }
 947
 948         if (i)
 949                 brcmf_commonring_write_complete(commonring);
 950
 951         return i;
 952 }
 953
 954
 955 static void
 956 brcmf_msgbuf_rxbuf_data_fill(struct brcmf_msgbuf *msgbuf)
 957 {
 958         u32 fillbufs;
 959         u32 retcount;
 960
 961         fillbufs = msgbuf->max_rxbufpost - msgbuf->rxbufpost;
 962
 963         while (fillbufs) {
 964                 retcount = brcmf_msgbuf_rxbuf_data_post(msgbuf, fillbufs);
 965                 if (!retcount)
 966                         break;
 967                 msgbuf->rxbufpost += retcount;
 968                 fillbufs -= retcount;
 969         }
 970 }
 971
 972
 973 static void
 974 brcmf_msgbuf_update_rxbufpost_count(struct brcmf_msgbuf *msgbuf, u16 rxcnt)
 975 {
 976         msgbuf->rxbufpost -= rxcnt;
 977         if (msgbuf->rxbufpost <= (msgbuf->max_rxbufpost -
 978                                   BRCMF_MSGBUF_RXBUFPOST_THRESHOLD))
 979                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
 980 }
 981
 982
 983 static u32
 984 brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
 985                              u32 count)
 986 {
 987         struct brcmf_commonring *commonring;
 988         void *ret_ptr;
 989         struct sk_buff *skb;
 990         u16 alloced;
 991         u32 pktlen;
 992         dma_addr_t physaddr;
 993         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
 994         u64 address;
 995         u32 pktid;
 996         u32 i;
 997
 998         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 999         brcmf_commonring_lock(commonring);
1000         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
1001                                                               count,
1002                                                               &alloced);
1003         if (!ret_ptr) {
1004                 brcmf_err("Failed to reserve space in commonring\n");
1005                 brcmf_commonring_unlock(commonring);
1006                 return 0;
1007         }
1008
1009         for (i = 0; i < alloced; i++) {
1010                 rx_bufpost = (struct msgbuf_rx_ioctl_resp_or_event *)ret_ptr;
1011                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
1012
1013                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
1014
1015                 if (skb == NULL) {
1016                         brcmf_err("Failed to alloc SKB\n");
1017                         brcmf_commonring_write_cancel(commonring, alloced - i);
1018                         break;
1019                 }
1020
1021                 pktlen = skb->len;
1022                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
1023                                              msgbuf->rx_pktids, skb, 0,
1024                                              &physaddr, &pktid)) {
1025                         dev_kfree_skb_any(skb);
1026                         brcmf_err("No PKTID available !!\n");
1027                         brcmf_commonring_write_cancel(commonring, alloced - i);
1028                         break;
1029                 }
1030                 if (event_buf)
1031                         rx_bufpost->msg.msgtype = MSGBUF_TYPE_EVENT_BUF_POST;
1032                 else
1033                         rx_bufpost->msg.msgtype =
1034                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
1035                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
1036
1037                 address = (u64)physaddr;
1038                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
1039                 rx_bufpost->host_buf_addr.high_addr =
1040                         cpu_to_le32(address >> 32);
1041                 rx_bufpost->host_buf_addr.low_addr =
1042                         cpu_to_le32(address & 0xffffffff);
1043
1044                 ret_ptr += brcmf_commonring_len_item(commonring);
1045         }
1046
1047         if (i)
1048                 brcmf_commonring_write_complete(commonring);
1049
1050         brcmf_commonring_unlock(commonring);
1051
1052         return i;
1053 }
1054
1055
1056 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf)
1057 {
1058         u32 count;
1059
1060         count = msgbuf->max_ioctlrespbuf - msgbuf->cur_ioctlrespbuf;
1061         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, false, count);
1062         msgbuf->cur_ioctlrespbuf += count;
1063 }
1064
1065
1066 static void brcmf_msgbuf_rxbuf_event_post(struct brcmf_msgbuf *msgbuf)
1067 {
1068         u32 count;
1069
1070         count = msgbuf->max_eventbuf - msgbuf->cur_eventbuf;
1071         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, true, count);
1072         msgbuf->cur_eventbuf += count;
1073 }
1074
1075
1076 static void
1077 brcmf_msgbuf_rx_skb(struct brcmf_msgbuf *msgbuf, struct sk_buff *skb,
1078                     u8 ifidx)
1079 {
1080         struct brcmf_if *ifp;
1081
1082         /* The ifidx is the idx to map to matching netdev/ifp. When receiving
1083          * events this is easy because it contains the bssidx which maps
1084          * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
1085          * bssidx 1 is used for p2p0 and no data can be received or
1086          * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
1087          */
1088         if (ifidx)
1089                 (ifidx)++;
1090         ifp = msgbuf->drvr->iflist[ifidx];
1091         if (!ifp || !ifp->ndev) {
1092                 brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
1093                 brcmu_pkt_buf_free_skb(skb);
1094                 return;
1095         }
1096         brcmf_netif_rx(ifp, skb);
1097 }
1098
1099
1100 static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
1101 {
1102         struct msgbuf_rx_event *event;
1103         u32 idx;
1104         u16 buflen;
1105         struct sk_buff *skb;
1106
1107         event = (struct msgbuf_rx_event *)buf;
1108         idx = le32_to_cpu(event->msg.request_id);
1109         buflen = le16_to_cpu(event->event_data_len);
1110
1111         if (msgbuf->cur_eventbuf)
1112                 msgbuf->cur_eventbuf--;
1113         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1114
1115         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1116                                      msgbuf->rx_pktids, idx);
1117         if (!skb)
1118                 return;
1119
1120         if (msgbuf->rx_dataoffset)
1121                 skb_pull(skb, msgbuf->rx_dataoffset);
1122
1123         skb_trim(skb, buflen);
1124
1125         brcmf_msgbuf_rx_skb(msgbuf, skb, event->msg.ifidx);
1126 }
1127
1128
1129 static void
1130 brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
1131 {
1132         struct msgbuf_rx_complete *rx_complete;
1133         struct sk_buff *skb;
1134         u16 data_offset;
1135         u16 buflen;
1136         u32 idx;
1137
1138         brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1);
1139
1140         rx_complete = (struct msgbuf_rx_complete *)buf;
1141         data_offset = le16_to_cpu(rx_complete->data_offset);
1142         buflen = le16_to_cpu(rx_complete->data_len);
1143         idx = le32_to_cpu(rx_complete->msg.request_id);
1144
1145         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1146                                      msgbuf->rx_pktids, idx);
1147         if (!skb)
1148                 return;
1149
1150         if (data_offset)
1151                 skb_pull(skb, data_offset);
1152         else if (msgbuf->rx_dataoffset)
1153                 skb_pull(skb, msgbuf->rx_dataoffset);
1154
1155         skb_trim(skb, buflen);
1156
1157         brcmf_msgbuf_rx_skb(msgbuf, skb, rx_complete->msg.ifidx);
1158 }
1159
1160
1161 static void
1162 brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
1163                                                void *buf)
1164 {
1165         struct msgbuf_flowring_create_resp *flowring_create_resp;
1166         u16 status;
1167         u16 flowid;
1168
1169         flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
1170
1171         flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
1172         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
1173         status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
1174
1175         if (status) {
1176                 brcmf_err("Flowring creation failed, code %d\n", status);
1177                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1178                 return;
1179         }
1180         brcmf_dbg(MSGBUF, "Flowring %d Create response status %d\n", flowid,
1181                   status);
1182
1183         brcmf_flowring_open(msgbuf->flow, flowid);
1184
1185         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1186 }
1187
1188
1189 static void
1190 brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
1191                                                void *buf)
1192 {
1193         struct msgbuf_flowring_delete_resp *flowring_delete_resp;
1194         u16 status;
1195         u16 flowid;
1196
1197         flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
1198
1199         flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
1200         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
1201         status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
1202
1203         if (status) {
1204                 brcmf_err("Flowring deletion failed, code %d\n", status);
1205                 brcmf_flowring_delete(msgbuf->flow, flowid);
1206                 return;
1207         }
1208         brcmf_dbg(MSGBUF, "Flowring %d Delete response status %d\n", flowid,
1209                   status);
1210
1211         brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1212 }
1213
1214
1215 static void brcmf_msgbuf_process_msgtype(struct brcmf_msgbuf *msgbuf, void *buf)
1216 {
1217         struct msgbuf_common_hdr *msg;
1218
1219         msg = (struct msgbuf_common_hdr *)buf;
1220         switch (msg->msgtype) {
1221         case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
1222                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
1223                 brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);
1224                 break;
1225         case MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT:
1226                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT\n");
1227                 brcmf_msgbuf_process_flow_ring_delete_response(msgbuf, buf);
1228                 break;
1229         case MSGBUF_TYPE_IOCTLPTR_REQ_ACK:
1230                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTLPTR_REQ_ACK\n");
1231                 break;
1232         case MSGBUF_TYPE_IOCTL_CMPLT:
1233                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTL_CMPLT\n");
1234                 brcmf_msgbuf_process_ioctl_complete(msgbuf, buf);
1235                 break;
1236         case MSGBUF_TYPE_WL_EVENT:
1237                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_WL_EVENT\n");
1238                 brcmf_msgbuf_process_event(msgbuf, buf);
1239                 break;
1240         case MSGBUF_TYPE_TX_STATUS:
1241                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_TX_STATUS\n");
1242                 brcmf_msgbuf_process_txstatus(msgbuf, buf);
1243                 break;
1244         case MSGBUF_TYPE_RX_CMPLT:
1245                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RX_CMPLT\n");
1246                 brcmf_msgbuf_process_rx_complete(msgbuf, buf);
1247                 break;
1248         default:
1249                 brcmf_err("Unsupported msgtype %d\n", msg->msgtype);
1250                 break;
1251         }
1252 }
1253
1254
1255 static void brcmf_msgbuf_process_rx(struct brcmf_msgbuf *msgbuf,
1256                                     struct brcmf_commonring *commonring)
1257 {
1258         void *buf;
1259         u16 count;
1260
1261 again:
1262         buf = brcmf_commonring_get_read_ptr(commonring, &count);
1263         if (buf == NULL)
1264                 return;
1265
1266         while (count) {
1267                 brcmf_msgbuf_process_msgtype(msgbuf,
1268                                              buf + msgbuf->rx_dataoffset);
1269                 buf += brcmf_commonring_len_item(commonring);
1270                 count--;
1271         }
1272         brcmf_commonring_read_complete(commonring);
1273
1274         if (commonring->r_ptr == 0)
1275                 goto again;
1276 }
1277
1278
1279 int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
1280 {
1281         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1282         struct brcmf_pub *drvr = bus_if->drvr;
1283         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1284         struct brcmf_commonring *commonring;
1285         void *buf;
1286         u32 flowid;
1287         int qlen;
1288
1289         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1290         brcmf_msgbuf_process_rx(msgbuf, buf);
1291         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1292         brcmf_msgbuf_process_rx(msgbuf, buf);
1293         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1294         brcmf_msgbuf_process_rx(msgbuf, buf);
1295
1296         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
1297                          msgbuf->nrof_flowrings) {
1298                 clear_bit(flowid, msgbuf->txstatus_done_map);
1299                 commonring = msgbuf->flowrings[flowid];
1300                 qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
1301                 if ((qlen > BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) ||
1302                     ((qlen) && (atomic_read(&commonring->outstanding_tx) <
1303                                 BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS)))
1304                         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1305         }
1306
1307         return 0;
1308 }
1309
1310
1311 void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
1312 {
1313         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1314         struct msgbuf_tx_flowring_delete_req *delete;
1315         struct brcmf_commonring *commonring;
1316         void *ret_ptr;
1317         u8 ifidx;
1318         int err;
1319
1320         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1321         brcmf_commonring_lock(commonring);
1322         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
1323         if (!ret_ptr) {
1324                 brcmf_err("FW unaware, flowring will be removed !!\n");
1325                 brcmf_commonring_unlock(commonring);
1326                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1327                 return;
1328         }
1329
1330         delete = (struct msgbuf_tx_flowring_delete_req *)ret_ptr;
1331
1332         ifidx = brcmf_flowring_ifidx_get(msgbuf->flow, flowid);
1333
1334         delete->msg.msgtype = MSGBUF_TYPE_FLOW_RING_DELETE;
1335         delete->msg.ifidx = ifidx;
1336         delete->msg.request_id = 0;
1337
1338         delete->flow_ring_id = cpu_to_le16(flowid +
1339                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
1340         delete->reason = 0;
1341
1342         brcmf_dbg(MSGBUF, "Send Flow Delete Req flow ID %d, ifindex %d\n",
1343                   flowid, ifidx);
1344
1345         err = brcmf_commonring_write_complete(commonring);
1346         brcmf_commonring_unlock(commonring);
1347         if (err) {
1348                 brcmf_err("Failed to submit RING_DELETE, flowring will be removed\n");
1349                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1350         }
1351 }
1352
1353
1354 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
1355 {
1356         struct brcmf_bus_msgbuf *if_msgbuf;
1357         struct brcmf_msgbuf *msgbuf;
1358         u64 address;
1359         u32 count;
1360
1361         if_msgbuf = drvr->bus_if->msgbuf;
1362         msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
1363         if (!msgbuf)
1364                 goto fail;
1365
1366         msgbuf->txflow_wq = create_singlethread_workqueue("msgbuf_txflow");
1367         if (msgbuf->txflow_wq == NULL) {
1368                 brcmf_err("workqueue creation failed\n");
1369                 goto fail;
1370         }
1371         INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
1372         count = BITS_TO_LONGS(if_msgbuf->nrof_flowrings);
1373         count = count * sizeof(unsigned long);
1374         msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
1375         if (!msgbuf->flow_map)
1376                 goto fail;
1377
1378         msgbuf->txstatus_done_map = kzalloc(count, GFP_KERNEL);
1379         if (!msgbuf->txstatus_done_map)
1380                 goto fail;
1381
1382         msgbuf->drvr = drvr;
1383         msgbuf->ioctbuf = dma_alloc_coherent(drvr->bus_if->dev,
1384                                              BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1385                                              &msgbuf->ioctbuf_handle,
1386                                              GFP_KERNEL);
1387         if (!msgbuf->ioctbuf)
1388                 goto fail;
1389         address = (u64)msgbuf->ioctbuf_handle;
1390         msgbuf->ioctbuf_phys_hi = address >> 32;
1391         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
1392
1393         drvr->proto->hdrpull = brcmf_msgbuf_hdrpull;
1394         drvr->proto->query_dcmd = brcmf_msgbuf_query_dcmd;
1395         drvr->proto->set_dcmd = brcmf_msgbuf_set_dcmd;
1396         drvr->proto->txdata = brcmf_msgbuf_txdata;
1397         drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
1398         drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
1399         drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
1400         drvr->proto->pd = msgbuf;
1401
1402         init_waitqueue_head(&msgbuf->ioctl_resp_wait);
1403
1404         msgbuf->commonrings =
1405                 (struct brcmf_commonring **)if_msgbuf->commonrings;
1406         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
1407         msgbuf->nrof_flowrings = if_msgbuf->nrof_flowrings;
1408         msgbuf->flowring_dma_handle = kzalloc(msgbuf->nrof_flowrings *
1409                 sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
1410         if (!msgbuf->flowring_dma_handle)
1411                 goto fail;
1412
1413         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
1414         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
1415
1416         msgbuf->max_ioctlrespbuf = BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST;
1417         msgbuf->max_eventbuf = BRCMF_MSGBUF_MAX_EVENTBUF_POST;
1418
1419         msgbuf->tx_pktids = brcmf_msgbuf_init_pktids(NR_TX_PKTIDS,
1420                                                      DMA_TO_DEVICE);
1421         if (!msgbuf->tx_pktids)
1422                 goto fail;
1423         msgbuf->rx_pktids = brcmf_msgbuf_init_pktids(NR_RX_PKTIDS,
1424                                                      DMA_FROM_DEVICE);
1425         if (!msgbuf->rx_pktids)
1426                 goto fail;
1427
1428         msgbuf->flow = brcmf_flowring_attach(drvr->bus_if->dev,
1429                                              if_msgbuf->nrof_flowrings);
1430         if (!msgbuf->flow)
1431                 goto fail;
1432
1433
1434         brcmf_dbg(MSGBUF, "Feeding buffers, rx data %d, rx event %d, rx ioctl resp %d\n",
1435                   msgbuf->max_rxbufpost, msgbuf->max_eventbuf,
1436                   msgbuf->max_ioctlrespbuf);
1437         count = 0;
1438         do {
1439                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
1440                 if (msgbuf->max_rxbufpost != msgbuf->rxbufpost)
1441                         msleep(10);
1442                 else
1443                         break;
1444                 count++;
1445         } while (count < 10);
1446         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1447         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
1448
1449         INIT_WORK(&msgbuf->flowring_work, brcmf_msgbuf_flowring_worker);
1450         spin_lock_init(&msgbuf->flowring_work_lock);
1451         INIT_LIST_HEAD(&msgbuf->work_queue);
1452
1453         return 0;
1454
1455 fail:
1456         if (msgbuf) {
1457                 kfree(msgbuf->flow_map);
1458                 kfree(msgbuf->txstatus_done_map);
1459                 brcmf_msgbuf_release_pktids(msgbuf);
1460                 kfree(msgbuf->flowring_dma_handle);
1461                 if (msgbuf->ioctbuf)
1462                         dma_free_coherent(drvr->bus_if->dev,
1463                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1464                                           msgbuf->ioctbuf,
1465                                           msgbuf->ioctbuf_handle);
1466                 kfree(msgbuf);
1467         }
1468         return -ENOMEM;
1469 }
1470
1471
1472 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
1473 {
1474         struct brcmf_msgbuf *msgbuf;
1475         struct brcmf_msgbuf_work_item *work;
1476
1477         brcmf_dbg(TRACE, "Enter\n");
1478         if (drvr->proto->pd) {
1479                 msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1480                 cancel_work_sync(&msgbuf->flowring_work);
1481                 while (!list_empty(&msgbuf->work_queue)) {
1482                         work = list_first_entry(&msgbuf->work_queue,
1483                                                 struct brcmf_msgbuf_work_item,
1484                                                 queue);
1485                         list_del(&work->queue);
1486                         kfree(work);
1487                 }
1488                 kfree(msgbuf->flow_map);
1489                 kfree(msgbuf->txstatus_done_map);
1490                 if (msgbuf->txflow_wq)
1491                         destroy_workqueue(msgbuf->txflow_wq);
1492
1493                 brcmf_flowring_detach(msgbuf->flow);
1494                 dma_free_coherent(drvr->bus_if->dev,
1495                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1496                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
1497                 brcmf_msgbuf_release_pktids(msgbuf);
1498                 kfree(msgbuf->flowring_dma_handle);
1499                 kfree(msgbuf);
1500                 drvr->proto->pd = NULL;
1501         }
1502 }