1/*
2 * Copyright (c) 2005-2011 Atheros Communications Inc.
3 * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <linux/etherdevice.h>
19#include "htt.h"
20#include "mac.h"
21#include "hif.h"
22#include "txrx.h"
23#include "debug.h"
24
25void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt)
26{
27	htt->num_pending_tx--;
28	if (htt->num_pending_tx == htt->max_num_pending_tx - 1)
29		ieee80211_wake_queues(htt->ar->hw);
30}
31
32static void ath10k_htt_tx_dec_pending(struct ath10k_htt *htt)
33{
34	spin_lock_bh(&htt->tx_lock);
35	__ath10k_htt_tx_dec_pending(htt);
36	spin_unlock_bh(&htt->tx_lock);
37}
38
39static int ath10k_htt_tx_inc_pending(struct ath10k_htt *htt)
40{
41	int ret = 0;
42
43	spin_lock_bh(&htt->tx_lock);
44
45	if (htt->num_pending_tx >= htt->max_num_pending_tx) {
46		ret = -EBUSY;
47		goto exit;
48	}
49
50	htt->num_pending_tx++;
51	if (htt->num_pending_tx == htt->max_num_pending_tx)
52		ieee80211_stop_queues(htt->ar->hw);
53
54exit:
55	spin_unlock_bh(&htt->tx_lock);
56	return ret;
57}
58
59int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt)
60{
61	struct ath10k *ar = htt->ar;
62	int msdu_id;
63
64	lockdep_assert_held(&htt->tx_lock);
65
66	msdu_id = find_first_zero_bit(htt->used_msdu_ids,
67				      htt->max_num_pending_tx);
68	if (msdu_id == htt->max_num_pending_tx)
69		return -ENOBUFS;
70
71	ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx alloc msdu_id %d\n", msdu_id);
72	__set_bit(msdu_id, htt->used_msdu_ids);
73	return msdu_id;
74}
75
76void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
77{
78	struct ath10k *ar = htt->ar;
79
80	lockdep_assert_held(&htt->tx_lock);
81
82	if (!test_bit(msdu_id, htt->used_msdu_ids))
83		ath10k_warn(ar, "trying to free unallocated msdu_id %d\n",
84			    msdu_id);
85
86	ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx free msdu_id %hu\n", msdu_id);
87	__clear_bit(msdu_id, htt->used_msdu_ids);
88}
89
90int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
91{
92	struct ath10k *ar = htt->ar;
93
94	spin_lock_init(&htt->tx_lock);
95	init_waitqueue_head(&htt->empty_tx_wq);
96
97	if (test_bit(ATH10K_FW_FEATURE_WMI_10X, htt->ar->fw_features))
98		htt->max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
99	else
100		htt->max_num_pending_tx = TARGET_NUM_MSDU_DESC;
101
102	ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
103		   htt->max_num_pending_tx);
104
105	htt->pending_tx = kzalloc(sizeof(*htt->pending_tx) *
106				  htt->max_num_pending_tx, GFP_KERNEL);
107	if (!htt->pending_tx)
108		return -ENOMEM;
109
110	htt->used_msdu_ids = kzalloc(sizeof(unsigned long) *
111				     BITS_TO_LONGS(htt->max_num_pending_tx),
112				     GFP_KERNEL);
113	if (!htt->used_msdu_ids) {
114		kfree(htt->pending_tx);
115		return -ENOMEM;
116	}
117
118	htt->tx_pool = dma_pool_create("ath10k htt tx pool", htt->ar->dev,
119				       sizeof(struct ath10k_htt_txbuf), 4, 0);
120	if (!htt->tx_pool) {
121		kfree(htt->used_msdu_ids);
122		kfree(htt->pending_tx);
123		return -ENOMEM;
124	}
125
126	return 0;
127}
128
129static void ath10k_htt_tx_free_pending(struct ath10k_htt *htt)
130{
131	struct ath10k *ar = htt->ar;
132	struct htt_tx_done tx_done = {0};
133	int msdu_id;
134
135	spin_lock_bh(&htt->tx_lock);
136	for (msdu_id = 0; msdu_id < htt->max_num_pending_tx; msdu_id++) {
137		if (!test_bit(msdu_id, htt->used_msdu_ids))
138			continue;
139
140		ath10k_dbg(ar, ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n",
141			   msdu_id);
142
143		tx_done.discard = 1;
144		tx_done.msdu_id = msdu_id;
145
146		ath10k_txrx_tx_unref(htt, &tx_done);
147	}
148	spin_unlock_bh(&htt->tx_lock);
149}
150
151void ath10k_htt_tx_free(struct ath10k_htt *htt)
152{
153	ath10k_htt_tx_free_pending(htt);
154	kfree(htt->pending_tx);
155	kfree(htt->used_msdu_ids);
156	dma_pool_destroy(htt->tx_pool);
157}
158
159void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
160{
161	dev_kfree_skb_any(skb);
162}
163
164int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt)
165{
166	struct ath10k *ar = htt->ar;
167	struct sk_buff *skb;
168	struct htt_cmd *cmd;
169	int len = 0;
170	int ret;
171
172	len += sizeof(cmd->hdr);
173	len += sizeof(cmd->ver_req);
174
175	skb = ath10k_htc_alloc_skb(ar, len);
176	if (!skb)
177		return -ENOMEM;
178
179	skb_put(skb, len);
180	cmd = (struct htt_cmd *)skb->data;
181	cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_VERSION_REQ;
182
183	ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
184	if (ret) {
185		dev_kfree_skb_any(skb);
186		return ret;
187	}
188
189	return 0;
190}
191
192int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie)
193{
194	struct ath10k *ar = htt->ar;
195	struct htt_stats_req *req;
196	struct sk_buff *skb;
197	struct htt_cmd *cmd;
198	int len = 0, ret;
199
200	len += sizeof(cmd->hdr);
201	len += sizeof(cmd->stats_req);
202
203	skb = ath10k_htc_alloc_skb(ar, len);
204	if (!skb)
205		return -ENOMEM;
206
207	skb_put(skb, len);
208	cmd = (struct htt_cmd *)skb->data;
209	cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_STATS_REQ;
210
211	req = &cmd->stats_req;
212
213	memset(req, 0, sizeof(*req));
214
215	/* currently we support only max 8 bit masks so no need to worry
216	 * about endian support */
217	req->upload_types[0] = mask;
218	req->reset_types[0] = mask;
219	req->stat_type = HTT_STATS_REQ_CFG_STAT_TYPE_INVALID;
220	req->cookie_lsb = cpu_to_le32(cookie & 0xffffffff);
221	req->cookie_msb = cpu_to_le32((cookie & 0xffffffff00000000ULL) >> 32);
222
223	ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
224	if (ret) {
225		ath10k_warn(ar, "failed to send htt type stats request: %d",
226			    ret);
227		dev_kfree_skb_any(skb);
228		return ret;
229	}
230
231	return 0;
232}
233
234int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
235{
236	struct ath10k *ar = htt->ar;
237	struct sk_buff *skb;
238	struct htt_cmd *cmd;
239	struct htt_rx_ring_setup_ring *ring;
240	const int num_rx_ring = 1;
241	u16 flags;
242	u32 fw_idx;
243	int len;
244	int ret;
245
246	/*
247	 * the HW expects the buffer to be an integral number of 4-byte
248	 * "words"
249	 */
250	BUILD_BUG_ON(!IS_ALIGNED(HTT_RX_BUF_SIZE, 4));
251	BUILD_BUG_ON((HTT_RX_BUF_SIZE & HTT_MAX_CACHE_LINE_SIZE_MASK) != 0);
252
253	len = sizeof(cmd->hdr) + sizeof(cmd->rx_setup.hdr)
254	    + (sizeof(*ring) * num_rx_ring);
255	skb = ath10k_htc_alloc_skb(ar, len);
256	if (!skb)
257		return -ENOMEM;
258
259	skb_put(skb, len);
260
261	cmd = (struct htt_cmd *)skb->data;
262	ring = &cmd->rx_setup.rings[0];
263
264	cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_RX_RING_CFG;
265	cmd->rx_setup.hdr.num_rings = 1;
266
267	/* FIXME: do we need all of this? */
268	flags = 0;
269	flags |= HTT_RX_RING_FLAGS_MAC80211_HDR;
270	flags |= HTT_RX_RING_FLAGS_MSDU_PAYLOAD;
271	flags |= HTT_RX_RING_FLAGS_PPDU_START;
272	flags |= HTT_RX_RING_FLAGS_PPDU_END;
273	flags |= HTT_RX_RING_FLAGS_MPDU_START;
274	flags |= HTT_RX_RING_FLAGS_MPDU_END;
275	flags |= HTT_RX_RING_FLAGS_MSDU_START;
276	flags |= HTT_RX_RING_FLAGS_MSDU_END;
277	flags |= HTT_RX_RING_FLAGS_RX_ATTENTION;
278	flags |= HTT_RX_RING_FLAGS_FRAG_INFO;
279	flags |= HTT_RX_RING_FLAGS_UNICAST_RX;
280	flags |= HTT_RX_RING_FLAGS_MULTICAST_RX;
281	flags |= HTT_RX_RING_FLAGS_CTRL_RX;
282	flags |= HTT_RX_RING_FLAGS_MGMT_RX;
283	flags |= HTT_RX_RING_FLAGS_NULL_RX;
284	flags |= HTT_RX_RING_FLAGS_PHY_DATA_RX;
285
286	fw_idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
287
288	ring->fw_idx_shadow_reg_paddr =
289		__cpu_to_le32(htt->rx_ring.alloc_idx.paddr);
290	ring->rx_ring_base_paddr = __cpu_to_le32(htt->rx_ring.base_paddr);
291	ring->rx_ring_len = __cpu_to_le16(htt->rx_ring.size);
292	ring->rx_ring_bufsize = __cpu_to_le16(HTT_RX_BUF_SIZE);
293	ring->flags = __cpu_to_le16(flags);
294	ring->fw_idx_init_val = __cpu_to_le16(fw_idx);
295
296#define desc_offset(x) (offsetof(struct htt_rx_desc, x) / 4)
297
298	ring->mac80211_hdr_offset = __cpu_to_le16(desc_offset(rx_hdr_status));
299	ring->msdu_payload_offset = __cpu_to_le16(desc_offset(msdu_payload));
300	ring->ppdu_start_offset = __cpu_to_le16(desc_offset(ppdu_start));
301	ring->ppdu_end_offset = __cpu_to_le16(desc_offset(ppdu_end));
302	ring->mpdu_start_offset = __cpu_to_le16(desc_offset(mpdu_start));
303	ring->mpdu_end_offset = __cpu_to_le16(desc_offset(mpdu_end));
304	ring->msdu_start_offset = __cpu_to_le16(desc_offset(msdu_start));
305	ring->msdu_end_offset = __cpu_to_le16(desc_offset(msdu_end));
306	ring->rx_attention_offset = __cpu_to_le16(desc_offset(attention));
307	ring->frag_info_offset = __cpu_to_le16(desc_offset(frag_info));
308
309#undef desc_offset
310
311	ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
312	if (ret) {
313		dev_kfree_skb_any(skb);
314		return ret;
315	}
316
317	return 0;
318}
319
320int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
321				u8 max_subfrms_ampdu,
322				u8 max_subfrms_amsdu)
323{
324	struct ath10k *ar = htt->ar;
325	struct htt_aggr_conf *aggr_conf;
326	struct sk_buff *skb;
327	struct htt_cmd *cmd;
328	int len;
329	int ret;
330
331	/* Firmware defaults are: amsdu = 3 and ampdu = 64 */
332
333	if (max_subfrms_ampdu == 0 || max_subfrms_ampdu > 64)
334		return -EINVAL;
335
336	if (max_subfrms_amsdu == 0 || max_subfrms_amsdu > 31)
337		return -EINVAL;
338
339	len = sizeof(cmd->hdr);
340	len += sizeof(cmd->aggr_conf);
341
342	skb = ath10k_htc_alloc_skb(ar, len);
343	if (!skb)
344		return -ENOMEM;
345
346	skb_put(skb, len);
347	cmd = (struct htt_cmd *)skb->data;
348	cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_AGGR_CFG;
349
350	aggr_conf = &cmd->aggr_conf;
351	aggr_conf->max_num_ampdu_subframes = max_subfrms_ampdu;
352	aggr_conf->max_num_amsdu_subframes = max_subfrms_amsdu;
353
354	ath10k_dbg(ar, ATH10K_DBG_HTT, "htt h2t aggr cfg msg amsdu %d ampdu %d",
355		   aggr_conf->max_num_amsdu_subframes,
356		   aggr_conf->max_num_ampdu_subframes);
357
358	ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
359	if (ret) {
360		dev_kfree_skb_any(skb);
361		return ret;
362	}
363
364	return 0;
365}
366
367int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
368{
369	struct ath10k *ar = htt->ar;
370	struct device *dev = ar->dev;
371	struct sk_buff *txdesc = NULL;
372	struct htt_cmd *cmd;
373	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
374	u8 vdev_id = skb_cb->vdev_id;
375	int len = 0;
376	int msdu_id = -1;
377	int res;
378
379	res = ath10k_htt_tx_inc_pending(htt);
380	if (res)
381		goto err;
382
383	len += sizeof(cmd->hdr);
384	len += sizeof(cmd->mgmt_tx);
385
386	spin_lock_bh(&htt->tx_lock);
387	res = ath10k_htt_tx_alloc_msdu_id(htt);
388	if (res < 0) {
389		spin_unlock_bh(&htt->tx_lock);
390		goto err_tx_dec;
391	}
392	msdu_id = res;
393	htt->pending_tx[msdu_id] = msdu;
394	spin_unlock_bh(&htt->tx_lock);
395
396	txdesc = ath10k_htc_alloc_skb(ar, len);
397	if (!txdesc) {
398		res = -ENOMEM;
399		goto err_free_msdu_id;
400	}
401
402	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
403				       DMA_TO_DEVICE);
404	res = dma_mapping_error(dev, skb_cb->paddr);
405	if (res)
406		goto err_free_txdesc;
407
408	skb_put(txdesc, len);
409	cmd = (struct htt_cmd *)txdesc->data;
410	cmd->hdr.msg_type         = HTT_H2T_MSG_TYPE_MGMT_TX;
411	cmd->mgmt_tx.msdu_paddr = __cpu_to_le32(ATH10K_SKB_CB(msdu)->paddr);
412	cmd->mgmt_tx.len        = __cpu_to_le32(msdu->len);
413	cmd->mgmt_tx.desc_id    = __cpu_to_le32(msdu_id);
414	cmd->mgmt_tx.vdev_id    = __cpu_to_le32(vdev_id);
415	memcpy(cmd->mgmt_tx.hdr, msdu->data,
416	       min_t(int, msdu->len, HTT_MGMT_FRM_HDR_DOWNLOAD_LEN));
417
418	skb_cb->htt.txbuf = NULL;
419
420	res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
421	if (res)
422		goto err_unmap_msdu;
423
424	return 0;
425
426err_unmap_msdu:
427	dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
428err_free_txdesc:
429	dev_kfree_skb_any(txdesc);
430err_free_msdu_id:
431	spin_lock_bh(&htt->tx_lock);
432	htt->pending_tx[msdu_id] = NULL;
433	ath10k_htt_tx_free_msdu_id(htt, msdu_id);
434	spin_unlock_bh(&htt->tx_lock);
435err_tx_dec:
436	ath10k_htt_tx_dec_pending(htt);
437err:
438	return res;
439}
440
441int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
442{
443	struct ath10k *ar = htt->ar;
444	struct device *dev = ar->dev;
445	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
446	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
447	struct ath10k_hif_sg_item sg_items[2];
448	struct htt_data_tx_desc_frag *frags;
449	u8 vdev_id = skb_cb->vdev_id;
450	u8 tid = skb_cb->htt.tid;
451	int prefetch_len;
452	int res;
453	u8 flags0 = 0;
454	u16 msdu_id, flags1 = 0;
455	dma_addr_t paddr;
456	u32 frags_paddr;
457	bool use_frags;
458
459	res = ath10k_htt_tx_inc_pending(htt);
460	if (res)
461		goto err;
462
463	spin_lock_bh(&htt->tx_lock);
464	res = ath10k_htt_tx_alloc_msdu_id(htt);
465	if (res < 0) {
466		spin_unlock_bh(&htt->tx_lock);
467		goto err_tx_dec;
468	}
469	msdu_id = res;
470	htt->pending_tx[msdu_id] = msdu;
471	spin_unlock_bh(&htt->tx_lock);
472
473	prefetch_len = min(htt->prefetch_len, msdu->len);
474	prefetch_len = roundup(prefetch_len, 4);
475
476	/* Since HTT 3.0 there is no separate mgmt tx command. However in case
477	 * of mgmt tx using TX_FRM there is not tx fragment list. Instead of tx
478	 * fragment list host driver specifies directly frame pointer. */
479	use_frags = htt->target_version_major < 3 ||
480		    !ieee80211_is_mgmt(hdr->frame_control);
481
482	skb_cb->htt.txbuf = dma_pool_alloc(htt->tx_pool, GFP_ATOMIC,
483					   &paddr);
484	if (!skb_cb->htt.txbuf)
485		goto err_free_msdu_id;
486	skb_cb->htt.txbuf_paddr = paddr;
487
488	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
489				       DMA_TO_DEVICE);
490	res = dma_mapping_error(dev, skb_cb->paddr);
491	if (res)
492		goto err_free_txbuf;
493
494	if (likely(use_frags)) {
495		frags = skb_cb->htt.txbuf->frags;
496
497		frags[0].paddr = __cpu_to_le32(skb_cb->paddr);
498		frags[0].len = __cpu_to_le32(msdu->len);
499		frags[1].paddr = 0;
500		frags[1].len = 0;
501
502		flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
503			     HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
504
505		frags_paddr = skb_cb->htt.txbuf_paddr;
506	} else {
507		flags0 |= SM(ATH10K_HW_TXRX_MGMT,
508			     HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
509
510		frags_paddr = skb_cb->paddr;
511	}
512
513	/* Normally all commands go through HTC which manages tx credits for
514	 * each endpoint and notifies when tx is completed.
515	 *
516	 * HTT endpoint is creditless so there's no need to care about HTC
517	 * flags. In that case it is trivial to fill the HTC header here.
518	 *
519	 * MSDU transmission is considered completed upon HTT event. This
520	 * implies no relevant resources can be freed until after the event is
521	 * received. That's why HTC tx completion handler itself is ignored by
522	 * setting NULL to transfer_context for all sg items.
523	 *
524	 * There is simply no point in pushing HTT TX_FRM through HTC tx path
525	 * as it's a waste of resources. By bypassing HTC it is possible to
526	 * avoid extra memory allocations, compress data structures and thus
527	 * improve performance. */
528
529	skb_cb->htt.txbuf->htc_hdr.eid = htt->eid;
530	skb_cb->htt.txbuf->htc_hdr.len = __cpu_to_le16(
531			sizeof(skb_cb->htt.txbuf->cmd_hdr) +
532			sizeof(skb_cb->htt.txbuf->cmd_tx) +
533			prefetch_len);
534	skb_cb->htt.txbuf->htc_hdr.flags = 0;
535
536	if (!ieee80211_has_protected(hdr->frame_control))
537		flags0 |= HTT_DATA_TX_DESC_FLAGS0_NO_ENCRYPT;
538
539	flags0 |= HTT_DATA_TX_DESC_FLAGS0_MAC_HDR_PRESENT;
540
541	flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
542	flags1 |= SM((u16)tid, HTT_DATA_TX_DESC_FLAGS1_EXT_TID);
543	flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
544	flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
545
546	/* Prevent firmware from sending up tx inspection requests. There's
547	 * nothing ath10k can do with frames requested for inspection so force
548	 * it to simply rely a regular tx completion with discard status.
549	 */
550	flags1 |= HTT_DATA_TX_DESC_FLAGS1_POSTPONED;
551
552	skb_cb->htt.txbuf->cmd_hdr.msg_type = HTT_H2T_MSG_TYPE_TX_FRM;
553	skb_cb->htt.txbuf->cmd_tx.flags0 = flags0;
554	skb_cb->htt.txbuf->cmd_tx.flags1 = __cpu_to_le16(flags1);
555	skb_cb->htt.txbuf->cmd_tx.len = __cpu_to_le16(msdu->len);
556	skb_cb->htt.txbuf->cmd_tx.id = __cpu_to_le16(msdu_id);
557	skb_cb->htt.txbuf->cmd_tx.frags_paddr = __cpu_to_le32(frags_paddr);
558	skb_cb->htt.txbuf->cmd_tx.peerid = __cpu_to_le32(HTT_INVALID_PEERID);
559
560	ath10k_dbg(ar, ATH10K_DBG_HTT,
561		   "htt tx flags0 %hhu flags1 %hu len %d id %hu frags_paddr %08x, msdu_paddr %08x vdev %hhu tid %hhu\n",
562		   flags0, flags1, msdu->len, msdu_id, frags_paddr,
563		   (u32)skb_cb->paddr, vdev_id, tid);
564	ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt tx msdu: ",
565			msdu->data, msdu->len);
566
567	sg_items[0].transfer_id = 0;
568	sg_items[0].transfer_context = NULL;
569	sg_items[0].vaddr = &skb_cb->htt.txbuf->htc_hdr;
570	sg_items[0].paddr = skb_cb->htt.txbuf_paddr +
571			    sizeof(skb_cb->htt.txbuf->frags);
572	sg_items[0].len = sizeof(skb_cb->htt.txbuf->htc_hdr) +
573			  sizeof(skb_cb->htt.txbuf->cmd_hdr) +
574			  sizeof(skb_cb->htt.txbuf->cmd_tx);
575
576	sg_items[1].transfer_id = 0;
577	sg_items[1].transfer_context = NULL;
578	sg_items[1].vaddr = msdu->data;
579	sg_items[1].paddr = skb_cb->paddr;
580	sg_items[1].len = prefetch_len;
581
582	res = ath10k_hif_tx_sg(htt->ar,
583			       htt->ar->htc.endpoint[htt->eid].ul_pipe_id,
584			       sg_items, ARRAY_SIZE(sg_items));
585	if (res)
586		goto err_unmap_msdu;
587
588	return 0;
589
590err_unmap_msdu:
591	dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
592err_free_txbuf:
593	dma_pool_free(htt->tx_pool,
594		      skb_cb->htt.txbuf,
595		      skb_cb->htt.txbuf_paddr);
596err_free_msdu_id:
597	spin_lock_bh(&htt->tx_lock);
598	htt->pending_tx[msdu_id] = NULL;
599	ath10k_htt_tx_free_msdu_id(htt, msdu_id);
600	spin_unlock_bh(&htt->tx_lock);
601err_tx_dec:
602	ath10k_htt_tx_dec_pending(htt);
603err:
604	return res;
605}
606