fwsignal.c revision a7965fbb9108aef004829caf7a80129e452f76de
1/*
2 * Copyright (c) 2010 Broadcom Corporation
3 *
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16#include <linux/types.h>
17#include <linux/module.h>
18#include <linux/if_ether.h>
19#include <linux/spinlock.h>
20#include <linux/skbuff.h>
21#include <linux/netdevice.h>
22#include <linux/etherdevice.h>
23#include <linux/err.h>
24#include <uapi/linux/nl80211.h>
25#include <net/cfg80211.h>
26
27#include <brcmu_utils.h>
28#include <brcmu_wifi.h>
29#include "dhd.h"
30#include "dhd_proto.h"
31#include "dhd_dbg.h"
32#include "dhd_bus.h"
33#include "fwil.h"
34#include "fwil_types.h"
35#include "fweh.h"
36#include "fwsignal.h"
37#include "p2p.h"
38#include "wl_cfg80211.h"
39
40/**
41 * DOC: Firmware Signalling
42 *
43 * Firmware can send signals to host and vice versa, which are passed in the
44 * data packets using TLV based header. This signalling layer is on top of the
45 * BDC bus protocol layer.
46 */
47
48/*
49 * single definition for firmware-driver flow control tlv's.
50 *
51 * each tlv is specified by BRCMF_FWS_TLV_DEF(name, ID, length).
52 * A length value 0 indicates variable length tlv.
53 */
54#define BRCMF_FWS_TLV_DEFLIST \
55	BRCMF_FWS_TLV_DEF(MAC_OPEN, 1, 1) \
56	BRCMF_FWS_TLV_DEF(MAC_CLOSE, 2, 1) \
57	BRCMF_FWS_TLV_DEF(MAC_REQUEST_CREDIT, 3, 2) \
58	BRCMF_FWS_TLV_DEF(TXSTATUS, 4, 4) \
59	BRCMF_FWS_TLV_DEF(PKTTAG, 5, 4) \
60	BRCMF_FWS_TLV_DEF(MACDESC_ADD,	6, 8) \
61	BRCMF_FWS_TLV_DEF(MACDESC_DEL, 7, 8) \
62	BRCMF_FWS_TLV_DEF(RSSI, 8, 1) \
63	BRCMF_FWS_TLV_DEF(INTERFACE_OPEN, 9, 1) \
64	BRCMF_FWS_TLV_DEF(INTERFACE_CLOSE, 10, 1) \
65	BRCMF_FWS_TLV_DEF(FIFO_CREDITBACK, 11, 6) \
66	BRCMF_FWS_TLV_DEF(PENDING_TRAFFIC_BMP, 12, 2) \
67	BRCMF_FWS_TLV_DEF(MAC_REQUEST_PACKET, 13, 3) \
68	BRCMF_FWS_TLV_DEF(HOST_REORDER_RXPKTS, 14, 10) \
69	BRCMF_FWS_TLV_DEF(TRANS_ID, 18, 6) \
70	BRCMF_FWS_TLV_DEF(COMP_TXSTATUS, 19, 1) \
71	BRCMF_FWS_TLV_DEF(FILLER, 255, 0)
72
73/*
74 * enum brcmf_fws_tlv_type - definition of tlv identifiers.
75 */
76#define BRCMF_FWS_TLV_DEF(name, id, len) \
77	BRCMF_FWS_TYPE_ ## name =  id,
78enum brcmf_fws_tlv_type {
79	BRCMF_FWS_TLV_DEFLIST
80	BRCMF_FWS_TYPE_INVALID
81};
82#undef BRCMF_FWS_TLV_DEF
83
84/*
85 * enum brcmf_fws_tlv_len - definition of tlv lengths.
86 */
87#define BRCMF_FWS_TLV_DEF(name, id, len) \
88	BRCMF_FWS_TYPE_ ## name ## _LEN = (len),
89enum brcmf_fws_tlv_len {
90	BRCMF_FWS_TLV_DEFLIST
91};
92#undef BRCMF_FWS_TLV_DEF
93
94#ifdef DEBUG
95/*
96 * brcmf_fws_tlv_names - array of tlv names.
97 */
98#define BRCMF_FWS_TLV_DEF(name, id, len) \
99	{ id, #name },
100static struct {
101	enum brcmf_fws_tlv_type id;
102	const char *name;
103} brcmf_fws_tlv_names[] = {
104	BRCMF_FWS_TLV_DEFLIST
105};
106#undef BRCMF_FWS_TLV_DEF
107
108static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
109{
110	int i;
111
112	for (i = 0; i < ARRAY_SIZE(brcmf_fws_tlv_names); i++)
113		if (brcmf_fws_tlv_names[i].id == id)
114			return brcmf_fws_tlv_names[i].name;
115
116	return "INVALID";
117}
118#else
119static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
120{
121	return "NODEBUG";
122}
123#endif /* DEBUG */
124
125/*
126 * flags used to enable tlv signalling from firmware.
127 */
128#define BRCMF_FWS_FLAGS_RSSI_SIGNALS			0x0001
129#define BRCMF_FWS_FLAGS_XONXOFF_SIGNALS			0x0002
130#define BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS		0x0004
131#define BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE	0x0008
132#define BRCMF_FWS_FLAGS_PSQ_GENERATIONFSM_ENABLE	0x0010
133#define BRCMF_FWS_FLAGS_PSQ_ZERO_BUFFER_ENABLE		0x0020
134#define BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE		0x0040
135
136#define BRCMF_FWS_MAC_DESC_TABLE_SIZE			32
137#define BRCMF_FWS_MAC_DESC_ID_INVALID			0xff
138
139#define BRCMF_FWS_HOSTIF_FLOWSTATE_OFF			0
140#define BRCMF_FWS_HOSTIF_FLOWSTATE_ON			1
141#define BRCMF_FWS_FLOWCONTROL_HIWATER			128
142#define BRCMF_FWS_FLOWCONTROL_LOWATER			64
143
144#define BRCMF_FWS_PSQ_PREC_COUNT		((NL80211_NUM_ACS + 1) * 2)
145#define BRCMF_FWS_PSQ_LEN				256
146
147#define BRCMF_FWS_HTOD_FLAG_PKTFROMHOST			0x01
148#define BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED		0x02
149
150/**
151 * enum brcmf_fws_skb_state - indicates processing state of skb.
152 *
153 * @BRCMF_FWS_SKBSTATE_NEW: sk_buff is newly arrived in the driver.
154 * @BRCMF_FWS_SKBSTATE_DELAYED: sk_buff had to wait on queue.
155 * @BRCMF_FWS_SKBSTATE_SUPPRESSED: sk_buff has been suppressed by firmware.
156 */
157enum brcmf_fws_skb_state {
158	BRCMF_FWS_SKBSTATE_NEW,
159	BRCMF_FWS_SKBSTATE_DELAYED,
160	BRCMF_FWS_SKBSTATE_SUPPRESSED
161};
162
163/**
164 * struct brcmf_skbuff_cb - control buffer associated with skbuff.
165 *
166 * @if_flags: holds interface index and packet related flags.
167 * @htod: host to device packet identifier (used in PKTTAG tlv).
168 * @state: transmit state of the packet.
169 * @mac: descriptor related to destination for this packet.
170 *
171 * This information is stored in control buffer struct sk_buff::cb, which
172 * provides 48 bytes of storage so this structure should not exceed that.
173 */
174struct brcmf_skbuff_cb {
175	u16 if_flags;
176	u32 htod;
177	enum brcmf_fws_skb_state state;
178	struct brcmf_fws_mac_descriptor *mac;
179};
180
181/*
182 * macro casting skbuff control buffer to struct brcmf_skbuff_cb.
183 */
184#define brcmf_skbcb(skb)	((struct brcmf_skbuff_cb *)((skb)->cb))
185
186/*
187 * sk_buff control if flags
188 *
189 *	b[11]  - packet sent upon firmware request.
190 *	b[10]  - packet only contains signalling data.
191 *	b[9]   - packet is a tx packet.
192 *	b[8]   - packet uses FIFO credit (non-pspoll).
193 *	b[7]   - interface in AP mode.
194 *	b[6:4] - AC FIFO number.
195 *	b[3:0] - interface index.
196 */
197#define BRCMF_SKB_IF_FLAGS_REQUESTED_MASK	0x0800
198#define BRCMF_SKB_IF_FLAGS_REQUESTED_SHIFT	11
199#define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_MASK	0x0400
200#define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_SHIFT	10
201#define BRCMF_SKB_IF_FLAGS_TRANSMIT_MASK        0x0200
202#define BRCMF_SKB_IF_FLAGS_TRANSMIT_SHIFT	9
203#define BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK	0x0100
204#define BRCMF_SKB_IF_FLAGS_CREDITCHECK_SHIFT	8
205#define BRCMF_SKB_IF_FLAGS_IF_AP_MASK		0x0080
206#define BRCMF_SKB_IF_FLAGS_IF_AP_SHIFT		7
207#define BRCMF_SKB_IF_FLAGS_FIFO_MASK		0x0070
208#define BRCMF_SKB_IF_FLAGS_FIFO_SHIFT		4
209#define BRCMF_SKB_IF_FLAGS_INDEX_MASK		0x000f
210#define BRCMF_SKB_IF_FLAGS_INDEX_SHIFT		0
211
212#define brcmf_skb_if_flags_set_field(skb, field, value) \
213	brcmu_maskset16(&(brcmf_skbcb(skb)->if_flags), \
214			BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
215			BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT, (value))
216#define brcmf_skb_if_flags_get_field(skb, field) \
217	brcmu_maskget16(brcmf_skbcb(skb)->if_flags, \
218			BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
219			BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT)
220
221/*
222 * sk_buff control packet identifier
223 *
224 * 32-bit packet identifier used in PKTTAG tlv from host to dongle.
225 *
226 * - Generated at the host (e.g. dhd)
227 * - Seen as a generic sequence number by firmware except for the flags field.
228 *
229 * Generation	: b[31]	=> generation number for this packet [host->fw]
230 *			   OR, current generation number [fw->host]
231 * Flags	: b[30:27] => command, status flags
232 * FIFO-AC	: b[26:24] => AC-FIFO id
233 * h-slot	: b[23:8] => hanger-slot
234 * freerun	: b[7:0] => A free running counter
235 */
236#define BRCMF_SKB_HTOD_TAG_GENERATION_MASK		0x80000000
237#define BRCMF_SKB_HTOD_TAG_GENERATION_SHIFT		31
238#define BRCMF_SKB_HTOD_TAG_FLAGS_MASK			0x78000000
239#define BRCMF_SKB_HTOD_TAG_FLAGS_SHIFT			27
240#define BRCMF_SKB_HTOD_TAG_FIFO_MASK			0x07000000
241#define BRCMF_SKB_HTOD_TAG_FIFO_SHIFT			24
242#define BRCMF_SKB_HTOD_TAG_HSLOT_MASK			0x00ffff00
243#define BRCMF_SKB_HTOD_TAG_HSLOT_SHIFT			8
244#define BRCMF_SKB_HTOD_TAG_FREERUN_MASK			0x000000ff
245#define BRCMF_SKB_HTOD_TAG_FREERUN_SHIFT			0
246
247#define brcmf_skb_htod_tag_set_field(skb, field, value) \
248	brcmu_maskset32(&(brcmf_skbcb(skb)->htod), \
249			BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
250			BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT, (value))
251#define brcmf_skb_htod_tag_get_field(skb, field) \
252	brcmu_maskget32(brcmf_skbcb(skb)->htod, \
253			BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
254			BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT)
255
256#define BRCMF_FWS_TXSTAT_GENERATION_MASK	0x80000000
257#define BRCMF_FWS_TXSTAT_GENERATION_SHIFT	31
258#define BRCMF_FWS_TXSTAT_FLAGS_MASK		0x78000000
259#define BRCMF_FWS_TXSTAT_FLAGS_SHIFT		27
260#define BRCMF_FWS_TXSTAT_FIFO_MASK		0x07000000
261#define BRCMF_FWS_TXSTAT_FIFO_SHIFT		24
262#define BRCMF_FWS_TXSTAT_HSLOT_MASK		0x00FFFF00
263#define BRCMF_FWS_TXSTAT_HSLOT_SHIFT		8
264#define BRCMF_FWS_TXSTAT_PKTID_MASK		0x00FFFFFF
265#define BRCMF_FWS_TXSTAT_PKTID_SHIFT		0
266
267#define brcmf_txstatus_get_field(txs, field) \
268	brcmu_maskget32(txs, BRCMF_FWS_TXSTAT_ ## field ## _MASK, \
269			BRCMF_FWS_TXSTAT_ ## field ## _SHIFT)
270
271/**
272 * enum brcmf_fws_fifo - fifo indices used by dongle firmware.
273 *
274 * @BRCMF_FWS_FIFO_AC_BK: fifo for background traffic.
275 * @BRCMF_FWS_FIFO_AC_BE: fifo for best-effort traffic.
276 * @BRCMF_FWS_FIFO_AC_VI: fifo for video traffic.
277 * @BRCMF_FWS_FIFO_AC_VO: fifo for voice traffic.
278 * @BRCMF_FWS_FIFO_BCMC: fifo for broadcast/multicast (AP only).
279 * @BRCMF_FWS_FIFO_ATIM: fifo for ATIM (AP only).
280 * @BRCMF_FWS_FIFO_COUNT: number of fifos.
281 */
282enum brcmf_fws_fifo {
283	BRCMF_FWS_FIFO_AC_BK,
284	BRCMF_FWS_FIFO_AC_BE,
285	BRCMF_FWS_FIFO_AC_VI,
286	BRCMF_FWS_FIFO_AC_VO,
287	BRCMF_FWS_FIFO_BCMC,
288	BRCMF_FWS_FIFO_ATIM,
289	BRCMF_FWS_FIFO_COUNT
290};
291
292/**
293 * enum brcmf_fws_txstatus - txstatus flag values.
294 *
295 * @BRCMF_FWS_TXSTATUS_DISCARD:
296 *	host is free to discard the packet.
297 * @BRCMF_FWS_TXSTATUS_CORE_SUPPRESS:
298 *	802.11 core suppressed the packet.
299 * @BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS:
300 *	firmware suppress the packet as device is already in PS mode.
301 * @BRCMF_FWS_TXSTATUS_FW_TOSSED:
302 *	firmware tossed the packet.
303 */
304enum brcmf_fws_txstatus {
305	BRCMF_FWS_TXSTATUS_DISCARD,
306	BRCMF_FWS_TXSTATUS_CORE_SUPPRESS,
307	BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS,
308	BRCMF_FWS_TXSTATUS_FW_TOSSED
309};
310
311enum brcmf_fws_fcmode {
312	BRCMF_FWS_FCMODE_NONE,
313	BRCMF_FWS_FCMODE_IMPLIED_CREDIT,
314	BRCMF_FWS_FCMODE_EXPLICIT_CREDIT
315};
316
317enum brcmf_fws_mac_desc_state {
318	BRCMF_FWS_STATE_OPEN = 1,
319	BRCMF_FWS_STATE_CLOSE
320};
321
322/**
323 * struct brcmf_fws_mac_descriptor - firmware signalling data per node/interface
324 *
325 * @occupied: slot is in use.
326 * @mac_handle: handle for mac entry determined by firmware.
327 * @interface_id: interface index.
328 * @state: current state.
329 * @suppressed: mac entry is suppressed.
330 * @generation: generation bit.
331 * @ac_bitmap: ac queue bitmap.
332 * @requested_credit: credits requested by firmware.
333 * @ea: ethernet address.
334 * @seq: per-node free-running sequence.
335 * @psq: power-save queue.
336 * @transit_count: packet in transit to firmware.
337 */
338struct brcmf_fws_mac_descriptor {
339	u8 occupied;
340	u8 mac_handle;
341	u8 interface_id;
342	u8 state;
343	bool suppressed;
344	u8 generation;
345	u8 ac_bitmap;
346	u8 requested_credit;
347	u8 requested_packet;
348	u8 ea[ETH_ALEN];
349	u8 seq[BRCMF_FWS_FIFO_COUNT];
350	struct pktq psq;
351	int transit_count;
352	int suppress_count;
353	int suppr_transit_count;
354	bool send_tim_signal;
355	u8 traffic_pending_bmp;
356	u8 traffic_lastreported_bmp;
357};
358
359#define BRCMF_FWS_HANGER_MAXITEMS	1024
360
361/**
362 * enum brcmf_fws_hanger_item_state - state of hanger item.
363 *
364 * @BRCMF_FWS_HANGER_ITEM_STATE_FREE: item is free for use.
365 * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE: item is in use.
366 * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED: item was suppressed.
367 */
368enum brcmf_fws_hanger_item_state {
369	BRCMF_FWS_HANGER_ITEM_STATE_FREE = 1,
370	BRCMF_FWS_HANGER_ITEM_STATE_INUSE,
371	BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED
372};
373
374
375/**
376 * struct brcmf_fws_hanger_item - single entry for tx pending packet.
377 *
378 * @state: entry is either free or occupied.
379 * @gen: generation.
380 * @pkt: packet itself.
381 */
382struct brcmf_fws_hanger_item {
383	enum brcmf_fws_hanger_item_state state;
384	u8 gen;
385	struct sk_buff *pkt;
386};
387
388/**
389 * struct brcmf_fws_hanger - holds packets awaiting firmware txstatus.
390 *
391 * @pushed: packets pushed to await txstatus.
392 * @popped: packets popped upon handling txstatus.
393 * @failed_to_push: packets that could not be pushed.
394 * @failed_to_pop: packets that could not be popped.
395 * @failed_slotfind: packets for which failed to find an entry.
396 * @slot_pos: last returned item index for a free entry.
397 * @items: array of hanger items.
398 */
399struct brcmf_fws_hanger {
400	u32 pushed;
401	u32 popped;
402	u32 failed_to_push;
403	u32 failed_to_pop;
404	u32 failed_slotfind;
405	u32 slot_pos;
406	struct brcmf_fws_hanger_item items[BRCMF_FWS_HANGER_MAXITEMS];
407};
408
409struct brcmf_fws_macdesc_table {
410	struct brcmf_fws_mac_descriptor nodes[BRCMF_FWS_MAC_DESC_TABLE_SIZE];
411	struct brcmf_fws_mac_descriptor iface[BRCMF_MAX_IFS];
412	struct brcmf_fws_mac_descriptor other;
413};
414
415struct brcmf_fws_info {
416	struct brcmf_pub *drvr;
417	struct brcmf_fws_stats stats;
418	struct brcmf_fws_hanger hanger;
419	enum brcmf_fws_fcmode fcmode;
420	struct brcmf_fws_macdesc_table desc;
421	struct workqueue_struct *fws_wq;
422	struct work_struct fws_dequeue_work;
423	u32 fifo_enqpkt[BRCMF_FWS_FIFO_COUNT];
424	int fifo_credit[BRCMF_FWS_FIFO_COUNT];
425	int deq_node_pos[BRCMF_FWS_FIFO_COUNT];
426	u32 fifo_credit_map;
427	u32 fifo_delay_map;
428};
429
430/*
431 * brcmf_fws_prio2fifo - mapping from 802.1d priority to firmware fifo index.
432 */
433static const int brcmf_fws_prio2fifo[] = {
434	BRCMF_FWS_FIFO_AC_BE,
435	BRCMF_FWS_FIFO_AC_BK,
436	BRCMF_FWS_FIFO_AC_BK,
437	BRCMF_FWS_FIFO_AC_BE,
438	BRCMF_FWS_FIFO_AC_VI,
439	BRCMF_FWS_FIFO_AC_VI,
440	BRCMF_FWS_FIFO_AC_VO,
441	BRCMF_FWS_FIFO_AC_VO
442};
443
444static int fcmode;
445module_param(fcmode, int, S_IRUSR);
446MODULE_PARM_DESC(fcmode, "mode of firmware signalled flow control");
447
448#define BRCMF_FWS_TLV_DEF(name, id, len) \
449	case BRCMF_FWS_TYPE_ ## name: \
450		return len;
451
452/**
453 * brcmf_fws_get_tlv_len() - returns defined length for given tlv id.
454 *
455 * @fws: firmware-signalling information.
456 * @id: identifier of the TLV.
457 *
458 * Return: the specified length for the given TLV; Otherwise -EINVAL.
459 */
460static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
461				 enum brcmf_fws_tlv_type id)
462{
463	switch (id) {
464	BRCMF_FWS_TLV_DEFLIST
465	default:
466		fws->stats.tlv_invalid_type++;
467		break;
468	}
469	return -EINVAL;
470}
471#undef BRCMF_FWS_TLV_DEF
472
473static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
474{
475	u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
476	return ifidx == *(int *)arg;
477}
478
479static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
480				int ifidx)
481{
482	bool (*matchfn)(struct sk_buff *, void *) = NULL;
483	struct sk_buff *skb;
484	int prec;
485
486	if (ifidx != -1)
487		matchfn = brcmf_fws_ifidx_match;
488	for (prec = 0; prec < q->num_prec; prec++) {
489		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
490		while (skb) {
491			brcmu_pkt_buf_free_skb(skb);
492			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
493		}
494	}
495}
496
497static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
498{
499	int i;
500
501	brcmf_dbg(TRACE, "enter\n");
502	memset(hanger, 0, sizeof(*hanger));
503	for (i = 0; i < ARRAY_SIZE(hanger->items); i++)
504		hanger->items[i].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
505}
506
507static u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
508{
509	u32 i;
510
511	brcmf_dbg(TRACE, "enter\n");
512	i = (h->slot_pos + 1) % BRCMF_FWS_HANGER_MAXITEMS;
513
514	while (i != h->slot_pos) {
515		if (h->items[i].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
516			h->slot_pos = i;
517			goto done;
518		}
519		i++;
520		if (i == BRCMF_FWS_HANGER_MAXITEMS)
521			i = 0;
522	}
523	brcmf_err("all slots occupied\n");
524	h->failed_slotfind++;
525	i = BRCMF_FWS_HANGER_MAXITEMS;
526done:
527	brcmf_dbg(TRACE, "exit: %d\n", i);
528	return i;
529}
530
531static int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
532					   struct sk_buff *pkt, u32 slot_id)
533{
534	brcmf_dbg(TRACE, "enter\n");
535	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
536		return -ENOENT;
537
538	if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
539		brcmf_err("slot is not free\n");
540		h->failed_to_push++;
541		return -EINVAL;
542	}
543
544	h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE;
545	h->items[slot_id].pkt = pkt;
546	h->pushed++;
547	return 0;
548}
549
550static int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
551					  u32 slot_id, struct sk_buff **pktout,
552					  bool remove_item)
553{
554	brcmf_dbg(TRACE, "enter\n");
555	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
556		return -ENOENT;
557
558	if (h->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
559		brcmf_err("entry not in use\n");
560		h->failed_to_pop++;
561		return -EINVAL;
562	}
563
564	*pktout = h->items[slot_id].pkt;
565	if (remove_item) {
566		h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
567		h->items[slot_id].pkt = NULL;
568		h->items[slot_id].gen = 0xff;
569		h->popped++;
570	}
571	return 0;
572}
573
574static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
575						   u32 slot_id, u8 gen)
576{
577	brcmf_dbg(TRACE, "enter\n");
578
579	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
580		return -ENOENT;
581
582	h->items[slot_id].gen = gen;
583
584	if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_INUSE) {
585		brcmf_err("entry not in use\n");
586		return -EINVAL;
587	}
588
589	h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
590	return 0;
591}
592
593static int brcmf_fws_hanger_get_genbit(struct brcmf_fws_hanger *hanger,
594					      struct sk_buff *pkt, u32 slot_id,
595					      int *gen)
596{
597	brcmf_dbg(TRACE, "enter\n");
598	*gen = 0xff;
599
600	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
601		return -ENOENT;
602
603	if (hanger->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
604		brcmf_err("slot not in use\n");
605		return -EINVAL;
606	}
607
608	*gen = hanger->items[slot_id].gen;
609	return 0;
610}
611
612static void brcmf_fws_hanger_cleanup(struct brcmf_fws_info *fws,
613				     bool (*fn)(struct sk_buff *, void *),
614				     int ifidx)
615{
616	struct brcmf_fws_hanger *h = &fws->hanger;
617	struct sk_buff *skb;
618	int i;
619	enum brcmf_fws_hanger_item_state s;
620
621	brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
622	for (i = 0; i < ARRAY_SIZE(h->items); i++) {
623		s = h->items[i].state;
624		if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE ||
625		    s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
626			skb = h->items[i].pkt;
627			if (fn == NULL || fn(skb, &ifidx)) {
628				/* suppress packets freed from psq */
629				if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE)
630					brcmu_pkt_buf_free_skb(skb);
631				h->items[i].state =
632					BRCMF_FWS_HANGER_ITEM_STATE_FREE;
633			}
634		}
635	}
636}
637
638static void brcmf_fws_init_mac_descriptor(struct brcmf_fws_mac_descriptor *desc,
639					  u8 *addr, u8 ifidx)
640{
641	brcmf_dbg(TRACE,
642		  "enter: desc %p ea=%pM, ifidx=%u\n", desc, addr, ifidx);
643	desc->occupied = 1;
644	desc->state = BRCMF_FWS_STATE_OPEN;
645	desc->requested_credit = 0;
646	/* depending on use may need ifp->bssidx instead */
647	desc->interface_id = ifidx;
648	desc->ac_bitmap = 0xff; /* update this when handling APSD */
649	if (addr)
650		memcpy(&desc->ea[0], addr, ETH_ALEN);
651}
652
653static
654void brcmf_fws_clear_mac_descriptor(struct brcmf_fws_mac_descriptor *desc)
655{
656	brcmf_dbg(TRACE,
657		  "enter: ea=%pM, ifidx=%u\n", desc->ea, desc->interface_id);
658	desc->occupied = 0;
659	desc->state = BRCMF_FWS_STATE_CLOSE;
660	desc->requested_credit = 0;
661}
662
663static struct brcmf_fws_mac_descriptor *
664brcmf_fws_mac_descriptor_lookup(struct brcmf_fws_info *fws, u8 *ea)
665{
666	struct brcmf_fws_mac_descriptor *entry;
667	int i;
668
669	brcmf_dbg(TRACE, "enter: ea=%pM\n", ea);
670	if (ea == NULL)
671		return ERR_PTR(-EINVAL);
672
673	entry = &fws->desc.nodes[0];
674	for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++) {
675		if (entry->occupied && !memcmp(entry->ea, ea, ETH_ALEN))
676			return entry;
677		entry++;
678	}
679
680	return ERR_PTR(-ENOENT);
681}
682
683static struct brcmf_fws_mac_descriptor*
684brcmf_fws_find_mac_desc(struct brcmf_fws_info *fws, int ifidx, u8 *da)
685{
686	struct brcmf_fws_mac_descriptor *entry = &fws->desc.other;
687	struct brcmf_if *ifp;
688	bool multicast;
689	enum nl80211_iftype iftype;
690	brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
691
692	multicast = is_multicast_ether_addr(da);
693	ifp = fws->drvr->iflist[ifidx ? ifidx + 1 : 0];
694	if (WARN_ON(!ifp))
695		goto done;
696
697	iftype = brcmf_cfg80211_get_iftype(ifp);
698
699	/* Multicast destination and P2P clients get the interface entry.
700	 * STA gets the interface entry if there is no exact match. For
701	 * example, TDLS destinations have their own entry.
702	 */
703	entry = NULL;
704	if ((multicast || iftype == NL80211_IFTYPE_STATION ||
705	     iftype == NL80211_IFTYPE_P2P_CLIENT) && ifp->fws_desc)
706		entry = ifp->fws_desc;
707
708	if (entry != NULL && iftype != NL80211_IFTYPE_STATION)
709		goto done;
710
711	entry = brcmf_fws_mac_descriptor_lookup(fws, da);
712	if (IS_ERR(entry))
713		entry = &fws->desc.other;
714
715done:
716	brcmf_dbg(TRACE, "exit: entry=%p\n", entry);
717	return entry;
718}
719
720static bool brcmf_fws_mac_desc_ready(struct brcmf_fws_mac_descriptor *entry,
721				     int fifo)
722{
723	bool ready;
724
725	/*
726	 * destination entry is ready when firmware says it is OPEN
727	 * and there are no packets enqueued for it.
728	 */
729	ready = entry->state == BRCMF_FWS_STATE_OPEN &&
730		!entry->suppressed &&
731		brcmu_pktq_mlen(&entry->psq, 3 << (fifo * 2)) == 0;
732
733	/*
734	 * Or when the destination entry is CLOSED, but firmware has
735	 * specifically requested packets for this entry.
736	 */
737	ready = ready || (entry->state == BRCMF_FWS_STATE_CLOSE &&
738		(entry->requested_credit + entry->requested_packet));
739	return ready;
740}
741
742static void brcmf_fws_mac_desc_cleanup(struct brcmf_fws_info *fws,
743				       struct brcmf_fws_mac_descriptor *entry,
744				       int ifidx)
745{
746	brcmf_dbg(TRACE, "enter: entry=(ea=%pM, ifid=%d), ifidx=%d\n",
747		  entry->ea, entry->interface_id, ifidx);
748	if (entry->occupied && (ifidx == -1 || ifidx == entry->interface_id)) {
749		brcmf_dbg(TRACE, "flush psq: ifidx=%d, qlen=%d\n",
750			  ifidx, entry->psq.len);
751		brcmf_fws_psq_flush(fws, &entry->psq, ifidx);
752		entry->occupied = !!(entry->psq.len);
753	}
754}
755
756static void brcmf_fws_bus_txq_cleanup(struct brcmf_fws_info *fws,
757				      bool (*fn)(struct sk_buff *, void *),
758				      int ifidx)
759{
760	struct brcmf_fws_hanger_item *hi;
761	struct pktq *txq;
762	struct sk_buff *skb;
763	int prec;
764	u32 hslot;
765
766	brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
767	txq = brcmf_bus_gettxq(fws->drvr->bus_if);
768	if (IS_ERR(txq)) {
769		brcmf_dbg(TRACE, "no txq to clean up\n");
770		return;
771	}
772
773	for (prec = 0; prec < txq->num_prec; prec++) {
774		skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
775		while (skb) {
776			hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
777			hi = &fws->hanger.items[hslot];
778			WARN_ON(skb != hi->pkt);
779			hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
780			brcmu_pkt_buf_free_skb(skb);
781			skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
782		}
783	}
784}
785
786static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
787{
788	int i;
789	struct brcmf_fws_mac_descriptor *table;
790	bool (*matchfn)(struct sk_buff *, void *) = NULL;
791
792	brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
793	if (fws == NULL)
794		return;
795
796	if (ifidx != -1)
797		matchfn = brcmf_fws_ifidx_match;
798
799	/* cleanup individual nodes */
800	table = &fws->desc.nodes[0];
801	for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++)
802		brcmf_fws_mac_desc_cleanup(fws, &table[i], ifidx);
803
804	brcmf_fws_mac_desc_cleanup(fws, &fws->desc.other, ifidx);
805	brcmf_fws_bus_txq_cleanup(fws, matchfn, ifidx);
806	brcmf_fws_hanger_cleanup(fws, matchfn, ifidx);
807}
808
809static void brcmf_fws_tim_update(struct brcmf_fws_info *ctx,
810				 struct brcmf_fws_mac_descriptor *entry,
811				 int prec)
812{
813	brcmf_dbg(TRACE, "enter: ea=%pM\n", entry->ea);
814	if (entry->state == BRCMF_FWS_STATE_CLOSE) {
815		/* check delayedQ and suppressQ in one call using bitmap */
816		if (brcmu_pktq_mlen(&entry->psq, 3 << (prec * 2)) == 0)
817			entry->traffic_pending_bmp =
818				entry->traffic_pending_bmp & ~NBITVAL(prec);
819		else
820			entry->traffic_pending_bmp =
821				entry->traffic_pending_bmp | NBITVAL(prec);
822	}
823	/* request a TIM update to firmware at the next piggyback opportunity */
824	if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp)
825		entry->send_tim_signal = true;
826}
827
828static void
829brcmf_fws_flow_control_check(struct brcmf_fws_info *fws, struct pktq *pq,
830			     u8 if_id)
831{
832	struct brcmf_if *ifp = fws->drvr->iflist[if_id];
833
834	brcmf_dbg(TRACE,
835		  "enter: bssidx=%d, ifidx=%d\n", ifp->bssidx, ifp->ifidx);
836	if (WARN_ON(!ifp))
837		return;
838
839	if ((ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
840	    pq->len <= BRCMF_FWS_FLOWCONTROL_LOWATER)
841		brcmf_txflowblock_if(ifp,
842				     BRCMF_NETIF_STOP_REASON_FWS_FC, false);
843	if (!(ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
844	    pq->len >= BRCMF_FWS_FLOWCONTROL_HIWATER)
845		brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FWS_FC, true);
846	return;
847}
848
849static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
850{
851	brcmf_dbg(CTL, "rssi %d\n", rssi);
852	return 0;
853}
854
855static
856int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
857{
858	struct brcmf_fws_mac_descriptor *entry, *existing;
859	u8 mac_handle;
860	u8 ifidx;
861	u8 *addr;
862
863	mac_handle = *data++;
864	ifidx = *data++;
865	addr = data;
866
867	entry = &fws->desc.nodes[mac_handle & 0x1F];
868	if (type == BRCMF_FWS_TYPE_MACDESC_DEL) {
869		brcmf_dbg(TRACE, "deleting mac %pM idx %d\n", addr, ifidx);
870		if (entry->occupied)
871			brcmf_fws_clear_mac_descriptor(entry);
872		else
873			fws->stats.mac_update_failed++;
874		return 0;
875	}
876
877	brcmf_dbg(TRACE,
878		  "add mac %pM handle %u idx %d\n", addr, mac_handle, ifidx);
879	existing = brcmf_fws_mac_descriptor_lookup(fws, addr);
880	if (IS_ERR(existing)) {
881		if (!entry->occupied) {
882			entry->mac_handle = mac_handle;
883			brcmf_fws_init_mac_descriptor(entry, addr, ifidx);
884			brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
885					BRCMF_FWS_PSQ_LEN);
886		} else {
887			fws->stats.mac_update_failed++;
888		}
889	} else {
890		if (entry != existing) {
891			brcmf_dbg(TRACE, "relocate mac\n");
892			memcpy(entry, existing,
893			       offsetof(struct brcmf_fws_mac_descriptor, psq));
894			entry->mac_handle = mac_handle;
895			brcmf_fws_clear_mac_descriptor(existing);
896		} else {
897			brcmf_dbg(TRACE, "use existing\n");
898			WARN_ON(entry->mac_handle != mac_handle);
899			/* TODO: what should we do here: continue, reinit, .. */
900		}
901	}
902	return 0;
903}
904
905static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
906					    u8 type, u8 *data)
907{
908	struct brcmf_fws_mac_descriptor *entry;
909	u8 mac_handle;
910	int i;
911
912	mac_handle = data[0];
913	entry = &fws->desc.nodes[mac_handle & 0x1F];
914	if (!entry->occupied) {
915		fws->stats.mac_ps_update_failed++;
916		return -ESRCH;
917	}
918
919	/* a state update should wipe old credits? */
920	entry->requested_credit = 0;
921	if (type == BRCMF_FWS_TYPE_MAC_OPEN) {
922		entry->state = BRCMF_FWS_STATE_OPEN;
923	} else {
924		entry->state = BRCMF_FWS_STATE_CLOSE;
925		for (i = BRCMF_FWS_FIFO_AC_BE; i < NL80211_NUM_ACS; i++)
926			brcmf_fws_tim_update(fws, entry, i);
927	}
928	return 0;
929}
930
931static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
932					      u8 type, u8 *data)
933{
934	struct brcmf_fws_mac_descriptor *entry;
935	u8 ifidx;
936	int ret;
937
938	ifidx = data[0];
939
940	brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
941	if (ifidx >= BRCMF_MAX_IFS) {
942		ret = -ERANGE;
943		goto fail;
944	}
945
946	entry = &fws->desc.iface[ifidx];
947	if (!entry->occupied) {
948		ret = -ESRCH;
949		goto fail;
950	}
951
952	switch (type) {
953	case BRCMF_FWS_TYPE_INTERFACE_OPEN:
954		entry->state = BRCMF_FWS_STATE_OPEN;
955		return 0;
956	case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
957		entry->state = BRCMF_FWS_STATE_CLOSE;
958		return 0;
959	default:
960		ret = -EINVAL;
961		break;
962	}
963fail:
964	fws->stats.if_update_failed++;
965	return ret;
966}
967
968static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
969				      u8 *data)
970{
971	struct brcmf_fws_mac_descriptor *entry;
972
973	entry = &fws->desc.nodes[data[1] & 0x1F];
974	if (!entry->occupied) {
975		if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
976			fws->stats.credit_request_failed++;
977		else
978			fws->stats.packet_request_failed++;
979		return -ESRCH;
980	}
981
982	if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
983		entry->requested_credit = data[0];
984	else
985		entry->requested_packet = data[0];
986
987	entry->ac_bitmap = data[2];
988	return 0;
989}
990
991static void brcmf_fws_return_credits(struct brcmf_fws_info *fws,
992				     u8 fifo, u8 credits)
993{
994	if (!credits)
995		return;
996
997	fws->fifo_credit_map |= 1 << fifo;
998	fws->fifo_credit[fifo] += credits;
999}
1000
1001static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
1002{
1003	/* only schedule dequeue when there are credits for delayed traffic */
1004	if (fws->fifo_credit_map & fws->fifo_delay_map)
1005		queue_work(fws->fws_wq, &fws->fws_dequeue_work);
1006}
1007
1008static void brcmf_skb_pick_up_credit(struct brcmf_fws_info *fws, int fifo,
1009				     struct sk_buff *p)
1010{
1011	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(p)->mac;
1012
1013	if (brcmf_skbcb(p)->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK) {
1014		if (fws->fcmode != BRCMF_FWS_FCMODE_IMPLIED_CREDIT)
1015			return;
1016		brcmf_fws_return_credits(fws, fifo, 1);
1017	} else {
1018		/*
1019		 * if this packet did not count against FIFO credit, it
1020		 * must have taken a requested_credit from the destination
1021		 * entry (for pspoll etc.)
1022		 */
1023		if (!brcmf_skb_if_flags_get_field(p, REQUESTED))
1024			entry->requested_credit++;
1025	}
1026	brcmf_fws_schedule_deq(fws);
1027}
1028
1029static int brcmf_fws_enq(struct brcmf_fws_info *fws,
1030			 enum brcmf_fws_skb_state state, int fifo,
1031			 struct sk_buff *p)
1032{
1033	int prec = 2 * fifo;
1034	u32 *qfull_stat = &fws->stats.delayq_full_error;
1035
1036	struct brcmf_fws_mac_descriptor *entry;
1037
1038	entry = brcmf_skbcb(p)->mac;
1039	if (entry == NULL) {
1040		brcmf_err("no mac descriptor found for skb %p\n", p);
1041		return -ENOENT;
1042	}
1043
1044	brcmf_dbg(TRACE, "enter: ea=%pM, qlen=%d\n", entry->ea, entry->psq.len);
1045	if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
1046		prec += 1;
1047		qfull_stat = &fws->stats.supprq_full_error;
1048	}
1049
1050	if (brcmu_pktq_penq(&entry->psq, prec, p) == NULL) {
1051		*qfull_stat += 1;
1052		return -ENFILE;
1053	}
1054
1055	/* increment total enqueued packet count */
1056	fws->fifo_delay_map |= 1 << fifo;
1057	fws->fifo_enqpkt[fifo]++;
1058
1059	/* update the sk_buff state */
1060	brcmf_skbcb(p)->state = state;
1061	if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED)
1062		entry->suppress_count++;
1063
1064	/*
1065	 * A packet has been pushed so update traffic
1066	 * availability bitmap, if applicable
1067	 */
1068	brcmf_fws_tim_update(fws, entry, fifo);
1069	brcmf_fws_flow_control_check(fws, &entry->psq,
1070				     brcmf_skb_if_flags_get_field(p, INDEX));
1071	return 0;
1072}
1073
1074static struct sk_buff *brcmf_fws_deq(struct brcmf_fws_info *fws, int fifo)
1075{
1076	struct brcmf_fws_mac_descriptor *table;
1077	struct brcmf_fws_mac_descriptor *entry;
1078	struct sk_buff *p;
1079	int use_credit = 1;
1080	int num_nodes;
1081	int node_pos;
1082	int prec_out;
1083	int pmsk = 3;
1084	int i;
1085
1086	table = (struct brcmf_fws_mac_descriptor *)&fws->desc;
1087	num_nodes = sizeof(fws->desc) / sizeof(struct brcmf_fws_mac_descriptor);
1088	node_pos = fws->deq_node_pos[fifo];
1089
1090	for (i = 0; i < num_nodes; i++) {
1091		entry = &table[(node_pos + i) % num_nodes];
1092		if (!entry->occupied)
1093			continue;
1094
1095		if (entry->suppressed)
1096			pmsk = 2;
1097		p = brcmu_pktq_mdeq(&entry->psq, pmsk << (fifo * 2), &prec_out);
1098		if (p == NULL) {
1099			if (entry->suppressed) {
1100				if (entry->suppr_transit_count >
1101				    entry->suppress_count)
1102					return NULL;
1103				entry->suppressed = false;
1104				p = brcmu_pktq_mdeq(&entry->psq,
1105						    1 << (fifo * 2), &prec_out);
1106			}
1107		}
1108		if  (p == NULL)
1109			continue;
1110
1111		/* did the packet come from suppress sub-queue? */
1112		if (entry->requested_credit > 0) {
1113			entry->requested_credit--;
1114			/*
1115			 * if the packet was pulled out while destination is in
1116			 * closed state but had a non-zero packets requested,
1117			 * then this should not count against the FIFO credit.
1118			 * That is due to the fact that the firmware will
1119			 * most likely hold onto this packet until a suitable
1120			 * time later to push it to the appropriate AC FIFO.
1121			 */
1122			if (entry->state == BRCMF_FWS_STATE_CLOSE)
1123				use_credit = 0;
1124		} else if (entry->requested_packet > 0) {
1125			entry->requested_packet--;
1126			brcmf_skb_if_flags_set_field(p, REQUESTED, 1);
1127			if (entry->state == BRCMF_FWS_STATE_CLOSE)
1128				use_credit = 0;
1129		}
1130		brcmf_skb_if_flags_set_field(p, CREDITCHECK, use_credit);
1131
1132		/* move dequeue position to ensure fair round-robin */
1133		fws->deq_node_pos[fifo] = (node_pos + i + 1) % num_nodes;
1134		brcmf_fws_flow_control_check(fws, &entry->psq,
1135					     brcmf_skb_if_flags_get_field(p,
1136									  INDEX)
1137					     );
1138		/*
1139		 * A packet has been picked up, update traffic
1140		 * availability bitmap, if applicable
1141		 */
1142		brcmf_fws_tim_update(fws, entry, fifo);
1143
1144		/*
1145		 * decrement total enqueued fifo packets and
1146		 * clear delay bitmap if done.
1147		 */
1148		fws->fifo_enqpkt[fifo]--;
1149		if (fws->fifo_enqpkt[fifo] == 0)
1150			fws->fifo_delay_map &= ~(1 << fifo);
1151		goto done;
1152	}
1153	p = NULL;
1154done:
1155	brcmf_dbg(TRACE, "exit: fifo %d skb %p\n", fifo, p);
1156	return p;
1157}
1158
1159static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
1160					 struct sk_buff *skb, u32 genbit)
1161{
1162	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
1163	u32 hslot;
1164	int ret;
1165
1166	hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
1167
1168	/* this packet was suppressed */
1169	if (!entry->suppressed || entry->generation != genbit) {
1170		entry->suppressed = true;
1171		entry->suppress_count = brcmu_pktq_mlen(&entry->psq,
1172							1 << (fifo * 2 + 1));
1173		entry->suppr_transit_count = entry->transit_count;
1174	}
1175
1176	entry->generation = genbit;
1177
1178	ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
1179	if (ret != 0) {
1180		/* suppress q is full, drop this packet */
1181		brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
1182					true);
1183	} else {
1184		/*
1185		 * Mark suppressed to avoid a double free during
1186		 * wlfc cleanup
1187		 */
1188		brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot,
1189						 genbit);
1190		entry->suppress_count++;
1191	}
1192
1193	return ret;
1194}
1195
1196static int
1197brcmf_fws_txstatus_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
1198			   u32 genbit)
1199{
1200	u32 fifo;
1201	int ret;
1202	bool remove_from_hanger = true;
1203	struct sk_buff *skb;
1204	struct brcmf_fws_mac_descriptor *entry = NULL;
1205
1206	brcmf_dbg(TRACE, "status: flags=0x%X, hslot=%d\n",
1207		  flags, hslot);
1208
1209	if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
1210		fws->stats.txs_discard++;
1211	else if (flags == BRCMF_FWS_TXSTATUS_CORE_SUPPRESS) {
1212		fws->stats.txs_supp_core++;
1213		remove_from_hanger = false;
1214	} else if (flags == BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS) {
1215		fws->stats.txs_supp_ps++;
1216		remove_from_hanger = false;
1217	} else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
1218		fws->stats.txs_tossed++;
1219	else
1220		brcmf_err("unexpected txstatus\n");
1221
1222	ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
1223				      remove_from_hanger);
1224	if (ret != 0) {
1225		brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
1226		return ret;
1227	}
1228
1229	entry = brcmf_skbcb(skb)->mac;
1230	if (WARN_ON(!entry)) {
1231		brcmu_pkt_buf_free_skb(skb);
1232		return -EINVAL;
1233	}
1234
1235	/* pick up the implicit credit from this packet */
1236	fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
1237	brcmf_skb_pick_up_credit(fws, fifo, skb);
1238
1239	if (!remove_from_hanger)
1240		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit);
1241
1242	if (remove_from_hanger || ret) {
1243		entry->transit_count--;
1244		if (entry->suppressed)
1245			entry->suppr_transit_count--;
1246
1247		brcmf_txfinalize(fws->drvr, skb, true);
1248	}
1249	return 0;
1250}
1251
1252static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
1253					     u8 *data)
1254{
1255	int i;
1256
1257	if (fws->fcmode != BRCMF_FWS_FCMODE_EXPLICIT_CREDIT) {
1258		brcmf_dbg(INFO, "ignored\n");
1259		return 0;
1260	}
1261
1262	brcmf_dbg(TRACE, "enter: data %pM\n", data);
1263	for (i = 0; i < BRCMF_FWS_FIFO_COUNT; i++)
1264		brcmf_fws_return_credits(fws, i, data[i]);
1265
1266	brcmf_dbg(INFO, "map: credit %x delay %x\n", fws->fifo_credit_map,
1267		  fws->fifo_delay_map);
1268	brcmf_fws_schedule_deq(fws);
1269	return 0;
1270}
1271
1272static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
1273{
1274	__le32 status_le;
1275	u32 status;
1276	u32 hslot;
1277	u32 genbit;
1278	u8 flags;
1279
1280	fws->stats.txs_indicate++;
1281	memcpy(&status_le, data, sizeof(status_le));
1282	status = le32_to_cpu(status_le);
1283	flags = brcmf_txstatus_get_field(status, FLAGS);
1284	hslot = brcmf_txstatus_get_field(status, HSLOT);
1285	genbit = brcmf_txstatus_get_field(status, GENERATION);
1286
1287	return brcmf_fws_txstatus_process(fws, flags, hslot, genbit);
1288}
1289
1290static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
1291{
1292	__le32 timestamp;
1293
1294	memcpy(&timestamp, &data[2], sizeof(timestamp));
1295	brcmf_dbg(INFO, "received: seq %d, timestamp %d\n", data[1],
1296		  le32_to_cpu(timestamp));
1297	return 0;
1298}
1299
1300/* using macro so sparse checking does not complain
1301 * about locking imbalance.
1302 */
1303#define brcmf_fws_lock(drvr, flags)				\
1304do {								\
1305	flags = 0;						\
1306	spin_lock_irqsave(&((drvr)->fws_spinlock), (flags));	\
1307} while (0)
1308
1309/* using macro so sparse checking does not complain
1310 * about locking imbalance.
1311 */
1312#define brcmf_fws_unlock(drvr, flags) \
1313	spin_unlock_irqrestore(&((drvr)->fws_spinlock), (flags))
1314
1315static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
1316				       const struct brcmf_event_msg *e,
1317				       void *data)
1318{
1319	struct brcmf_fws_info *fws = ifp->drvr->fws;
1320	int i;
1321	ulong flags;
1322	u8 *credits = data;
1323
1324	if (e->datalen < BRCMF_FWS_FIFO_COUNT) {
1325		brcmf_err("event payload too small (%d)\n", e->datalen);
1326		return -EINVAL;
1327	}
1328
1329	brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
1330	brcmf_fws_lock(ifp->drvr, flags);
1331	for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
1332		if (*credits)
1333			fws->fifo_credit_map |= 1 << i;
1334		else
1335			fws->fifo_credit_map &= ~(1 << i);
1336		fws->fifo_credit[i] = *credits++;
1337	}
1338	brcmf_fws_schedule_deq(fws);
1339	brcmf_fws_unlock(ifp->drvr, flags);
1340	return 0;
1341}
1342
1343int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
1344		      struct sk_buff *skb)
1345{
1346	struct brcmf_fws_info *fws = drvr->fws;
1347	ulong flags;
1348	u8 *signal_data;
1349	s16 data_len;
1350	u8 type;
1351	u8 len;
1352	u8 *data;
1353
1354	brcmf_dbg(TRACE, "enter: ifidx %d, skblen %u, sig %d\n",
1355		  ifidx, skb->len, signal_len);
1356
1357	WARN_ON(signal_len > skb->len);
1358
1359	/* if flow control disabled, skip to packet data and leave */
1360	if (!signal_len || !drvr->fw_signals) {
1361		skb_pull(skb, signal_len);
1362		return 0;
1363	}
1364
1365	/* lock during tlv parsing */
1366	brcmf_fws_lock(drvr, flags);
1367
1368	fws->stats.header_pulls++;
1369	data_len = signal_len;
1370	signal_data = skb->data;
1371
1372	while (data_len > 0) {
1373		/* extract tlv info */
1374		type = signal_data[0];
1375
1376		/* FILLER type is actually not a TLV, but
1377		 * a single byte that can be skipped.
1378		 */
1379		if (type == BRCMF_FWS_TYPE_FILLER) {
1380			signal_data += 1;
1381			data_len -= 1;
1382			continue;
1383		}
1384		len = signal_data[1];
1385		data = signal_data + 2;
1386
1387		brcmf_dbg(INFO, "tlv type=%d (%s), len=%d, data[0]=%d\n", type,
1388			  brcmf_fws_get_tlv_name(type), len, *data);
1389
1390		/* abort parsing when length invalid */
1391		if (data_len < len + 2)
1392			break;
1393
1394		if (len != brcmf_fws_get_tlv_len(fws, type))
1395			break;
1396
1397		switch (type) {
1398		case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
1399		case BRCMF_FWS_TYPE_COMP_TXSTATUS:
1400			break;
1401		case BRCMF_FWS_TYPE_MACDESC_ADD:
1402		case BRCMF_FWS_TYPE_MACDESC_DEL:
1403			brcmf_fws_macdesc_indicate(fws, type, data);
1404			break;
1405		case BRCMF_FWS_TYPE_MAC_OPEN:
1406		case BRCMF_FWS_TYPE_MAC_CLOSE:
1407			brcmf_fws_macdesc_state_indicate(fws, type, data);
1408			break;
1409		case BRCMF_FWS_TYPE_INTERFACE_OPEN:
1410		case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
1411			brcmf_fws_interface_state_indicate(fws, type, data);
1412			break;
1413		case BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT:
1414		case BRCMF_FWS_TYPE_MAC_REQUEST_PACKET:
1415			brcmf_fws_request_indicate(fws, type, data);
1416			break;
1417		case BRCMF_FWS_TYPE_TXSTATUS:
1418			brcmf_fws_txstatus_indicate(fws, data);
1419			break;
1420		case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
1421			brcmf_fws_fifocreditback_indicate(fws, data);
1422			break;
1423		case BRCMF_FWS_TYPE_RSSI:
1424			brcmf_fws_rssi_indicate(fws, *data);
1425			break;
1426		case BRCMF_FWS_TYPE_TRANS_ID:
1427			brcmf_fws_dbg_seqnum_check(fws, data);
1428			break;
1429		case BRCMF_FWS_TYPE_PKTTAG:
1430		case BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP:
1431		default:
1432			fws->stats.tlv_invalid_type++;
1433			break;
1434		}
1435
1436		signal_data += len + 2;
1437		data_len -= len + 2;
1438	}
1439
1440	if (data_len != 0)
1441		fws->stats.tlv_parse_failed++;
1442
1443	/* signalling processing result does
1444	 * not affect the actual ethernet packet.
1445	 */
1446	skb_pull(skb, signal_len);
1447
1448	/* this may be a signal-only packet
1449	 */
1450	if (skb->len == 0)
1451		fws->stats.header_only_pkt++;
1452
1453	brcmf_fws_unlock(drvr, flags);
1454	return 0;
1455}
1456
1457static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
1458{
1459	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
1460	u8 *wlh;
1461	u16 data_offset = 0;
1462	u8 fillers;
1463	__le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
1464
1465	brcmf_dbg(TRACE, "enter: ea=%pM, ifidx=%u, pkttag=0x%08X\n",
1466		  entry->ea, entry->interface_id, le32_to_cpu(pkttag));
1467	if (entry->send_tim_signal)
1468		data_offset += 2 + BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
1469
1470	/* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
1471	data_offset += 2 + BRCMF_FWS_TYPE_PKTTAG_LEN;
1472	fillers = round_up(data_offset, 4) - data_offset;
1473	data_offset += fillers;
1474
1475	skb_push(skb, data_offset);
1476	wlh = skb->data;
1477
1478	wlh[0] = BRCMF_FWS_TYPE_PKTTAG;
1479	wlh[1] = BRCMF_FWS_TYPE_PKTTAG_LEN;
1480	memcpy(&wlh[2], &pkttag, sizeof(pkttag));
1481	wlh += BRCMF_FWS_TYPE_PKTTAG_LEN + 2;
1482
1483	if (entry->send_tim_signal) {
1484		entry->send_tim_signal = 0;
1485		wlh[0] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP;
1486		wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
1487		wlh[2] = entry->mac_handle;
1488		wlh[3] = entry->traffic_pending_bmp;
1489		wlh += BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2;
1490		entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
1491	}
1492	if (fillers)
1493		memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers);
1494
1495	brcmf_proto_hdrpush(fws->drvr, brcmf_skb_if_flags_get_field(skb, INDEX),
1496			    data_offset >> 2, skb);
1497	return 0;
1498}
1499
1500static int brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
1501				   struct sk_buff *p)
1502{
1503	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
1504	struct brcmf_fws_mac_descriptor *entry = skcb->mac;
1505	int rc = 0;
1506	bool header_needed;
1507	int hslot = BRCMF_FWS_HANGER_MAXITEMS;
1508	u8 free_ctr;
1509	u8 ifidx;
1510	u8 flags;
1511
1512	header_needed = skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED;
1513
1514	if (header_needed) {
1515		/* obtaining free slot may fail, but that will be caught
1516		 * by the hanger push. This assures the packet has a BDC
1517		 * header upon return.
1518		 */
1519		hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
1520		free_ctr = entry->seq[fifo];
1521		brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
1522		brcmf_skb_htod_tag_set_field(p, FREERUN, free_ctr);
1523		brcmf_skb_htod_tag_set_field(p, GENERATION, 1);
1524		entry->transit_count++;
1525	}
1526	brcmf_skb_if_flags_set_field(p, TRANSMIT, 1);
1527	brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
1528
1529	flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
1530	if (!(skcb->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK)) {
1531		/*
1532		Indicate that this packet is being sent in response to an
1533		explicit request from the firmware side.
1534		*/
1535		flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
1536	}
1537	brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
1538	if (header_needed) {
1539		brcmf_fws_hdrpush(fws, p);
1540		rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
1541		if (rc)
1542			brcmf_err("hanger push failed: rc=%d\n", rc);
1543	} else {
1544		int gen;
1545
1546		/* remove old header */
1547		rc = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, p);
1548		if (rc == 0) {
1549			hslot = brcmf_skb_htod_tag_get_field(p, HSLOT);
1550			brcmf_fws_hanger_get_genbit(&fws->hanger, p,
1551						    hslot, &gen);
1552			brcmf_skb_htod_tag_set_field(p, GENERATION, gen);
1553
1554			/* push new header */
1555			brcmf_fws_hdrpush(fws, p);
1556		}
1557	}
1558
1559	return rc;
1560}
1561
1562static int
1563brcmf_fws_rollback_toq(struct brcmf_fws_info *fws, struct sk_buff *skb)
1564{
1565	/*
1566	put the packet back to the head of queue
1567
1568	- suppressed packet goes back to suppress sub-queue
1569	- pull out the header, if new or delayed packet
1570
1571	Note: hslot is used only when header removal is done.
1572	*/
1573	struct brcmf_fws_mac_descriptor *entry;
1574	enum brcmf_fws_skb_state state;
1575	struct sk_buff *pktout;
1576	int rc = 0;
1577	int fifo;
1578	int hslot;
1579	u8 ifidx;
1580
1581	fifo = brcmf_skb_if_flags_get_field(skb, FIFO);
1582	state = brcmf_skbcb(skb)->state;
1583	entry = brcmf_skbcb(skb)->mac;
1584
1585	if (entry != NULL) {
1586		if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
1587			/* wl-header is saved for suppressed packets */
1588			pktout = brcmu_pktq_penq_head(&entry->psq, 2 * fifo + 1,
1589						      skb);
1590			if (pktout == NULL) {
1591				brcmf_err("suppress queue full\n");
1592				rc = -ENOSPC;
1593			}
1594		} else {
1595			hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
1596
1597			/* remove header first */
1598			rc = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
1599			if (rc) {
1600				brcmf_err("header removal failed\n");
1601				/* free the hanger slot */
1602				brcmf_fws_hanger_poppkt(&fws->hanger, hslot,
1603							&pktout, true);
1604				brcmf_txfinalize(fws->drvr, skb, false);
1605				rc = -EINVAL;
1606				goto fail;
1607			}
1608
1609			/* delay-q packets are going to delay-q */
1610			pktout = brcmu_pktq_penq_head(&entry->psq,
1611						      2 * fifo, skb);
1612			if (pktout == NULL) {
1613				brcmf_err("delay queue full\n");
1614				rc = -ENOSPC;
1615			}
1616
1617			/* free the hanger slot */
1618			brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &pktout,
1619						true);
1620
1621			/* decrement sequence count */
1622			entry->seq[fifo]--;
1623		}
1624		/*
1625		if this packet did not count against FIFO credit, it must have
1626		taken a requested_credit from the firmware (for pspoll etc.)
1627		*/
1628		if (!(brcmf_skbcb(skb)->if_flags &
1629		      BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK))
1630			entry->requested_credit++;
1631	} else {
1632		brcmf_err("no mac entry linked\n");
1633		rc = -ENOENT;
1634	}
1635
1636
1637fail:
1638	if (rc)
1639		fws->stats.rollback_failed++;
1640	else
1641		fws->stats.rollback_success++;
1642	return rc;
1643}
1644
1645static int brcmf_fws_consume_credit(struct brcmf_fws_info *fws, int fifo,
1646				    struct sk_buff *skb)
1647{
1648	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
1649	int *credit = &fws->fifo_credit[fifo];
1650	int use_credit = 1;
1651
1652	brcmf_dbg(TRACE, "enter: ac=%d, credits=%d\n", fifo, *credit);
1653
1654	if (entry->requested_credit > 0) {
1655		/*
1656		 * if the packet was pulled out while destination is in
1657		 * closed state but had a non-zero packets requested,
1658		 * then this should not count against the FIFO credit.
1659		 * That is due to the fact that the firmware will
1660		 * most likely hold onto this packet until a suitable
1661		 * time later to push it to the appropriate AC FIFO.
1662		 */
1663		entry->requested_credit--;
1664		if (entry->state == BRCMF_FWS_STATE_CLOSE)
1665			use_credit = 0;
1666	} else if (entry->requested_packet > 0) {
1667		entry->requested_packet--;
1668		brcmf_skb_if_flags_set_field(skb, REQUESTED, 1);
1669		if (entry->state == BRCMF_FWS_STATE_CLOSE)
1670			use_credit = 0;
1671	}
1672	brcmf_skb_if_flags_set_field(skb, CREDITCHECK, use_credit);
1673	if (!use_credit) {
1674		brcmf_dbg(TRACE, "exit: no creditcheck set\n");
1675		return 0;
1676	}
1677
1678	if (!(*credit)) {
1679		brcmf_dbg(TRACE, "exit: credits depleted\n");
1680		return -ENAVAIL;
1681	}
1682	(*credit)--;
1683	if (!(*credit))
1684		fws->fifo_credit_map &= ~(1 << fifo);
1685	brcmf_dbg(TRACE, "exit: ac=%d, credits=%d\n", fifo, *credit);
1686	return 0;
1687}
1688
1689static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
1690				struct sk_buff *skb)
1691{
1692	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
1693	struct brcmf_fws_mac_descriptor *entry;
1694	struct brcmf_bus *bus = fws->drvr->bus_if;
1695	int rc;
1696
1697	entry = skcb->mac;
1698	if (IS_ERR(entry))
1699		return PTR_ERR(entry);
1700
1701	rc = brcmf_fws_precommit_skb(fws, fifo, skb);
1702	if (rc < 0) {
1703		fws->stats.generic_error++;
1704		goto rollback;
1705	}
1706
1707	rc = brcmf_bus_txdata(bus, skb);
1708	if (rc < 0)
1709		goto rollback;
1710
1711	entry->seq[fifo]++;
1712	fws->stats.pkt2bus++;
1713	if (brcmf_skbcb(skb)->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK) {
1714		fws->stats.send_pkts[fifo]++;
1715		fws->stats.fifo_credits_sent[fifo]++;
1716	}
1717
1718	return rc;
1719
1720rollback:
1721	rc = brcmf_fws_rollback_toq(fws, skb);
1722	return rc;
1723}
1724
1725int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
1726{
1727	struct brcmf_pub *drvr = ifp->drvr;
1728	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
1729	struct ethhdr *eh = (struct ethhdr *)(skb->data);
1730	ulong flags;
1731	u8 ifidx = ifp->ifidx;
1732	int fifo = BRCMF_FWS_FIFO_BCMC;
1733	bool multicast = is_multicast_ether_addr(eh->h_dest);
1734
1735	/* determine the priority */
1736	if (!skb->priority)
1737		skb->priority = cfg80211_classify8021d(skb);
1738
1739	drvr->tx_multicast += !!multicast;
1740	if (ntohs(eh->h_proto) == ETH_P_PAE)
1741		atomic_inc(&ifp->pend_8021x_cnt);
1742
1743	if (!brcmf_fws_fc_active(drvr->fws)) {
1744		/* If the protocol uses a data header, apply it */
1745		brcmf_proto_hdrpush(drvr, ifidx, 0, skb);
1746
1747		/* Use bus module to send data frame */
1748		return brcmf_bus_txdata(drvr->bus_if, skb);
1749	}
1750
1751	/* set control buffer information */
1752	skcb->if_flags = 0;
1753	skcb->mac = brcmf_fws_find_mac_desc(drvr->fws, ifidx, eh->h_dest);
1754	skcb->state = BRCMF_FWS_SKBSTATE_NEW;
1755	brcmf_skb_if_flags_set_field(skb, INDEX, ifidx);
1756	if (!multicast)
1757		fifo = brcmf_fws_prio2fifo[skb->priority];
1758	brcmf_skb_if_flags_set_field(skb, FIFO, fifo);
1759
1760	brcmf_dbg(TRACE, "ea=%pM, multi=%d, fifo=%d\n", eh->h_dest,
1761		  multicast, fifo);
1762
1763	brcmf_fws_lock(drvr, flags);
1764	if (!brcmf_fws_mac_desc_ready(skcb->mac, fifo) ||
1765	    (!multicast &&
1766	     brcmf_fws_consume_credit(drvr->fws, fifo, skb) < 0)) {
1767		/* enqueue the packet in delayQ */
1768		drvr->fws->fifo_delay_map |= 1 << fifo;
1769		brcmf_fws_enq(drvr->fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
1770	} else {
1771		brcmf_fws_commit_skb(drvr->fws, fifo, skb);
1772	}
1773	brcmf_fws_unlock(drvr, flags);
1774	return 0;
1775}
1776
1777void brcmf_fws_reset_interface(struct brcmf_if *ifp)
1778{
1779	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
1780
1781	brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
1782	if (!entry)
1783		return;
1784
1785	brcmf_fws_init_mac_descriptor(entry, ifp->mac_addr, ifp->ifidx);
1786}
1787
1788void brcmf_fws_add_interface(struct brcmf_if *ifp)
1789{
1790	struct brcmf_fws_info *fws = ifp->drvr->fws;
1791	struct brcmf_fws_mac_descriptor *entry;
1792
1793	brcmf_dbg(TRACE, "enter: idx=%d, mac=%pM\n",
1794		  ifp->bssidx, ifp->mac_addr);
1795	if (!ifp->ndev || !ifp->drvr->fw_signals)
1796		return;
1797
1798	entry = &fws->desc.iface[ifp->ifidx];
1799	ifp->fws_desc = entry;
1800	brcmf_fws_init_mac_descriptor(entry, ifp->mac_addr, ifp->ifidx);
1801	brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
1802			BRCMF_FWS_PSQ_LEN);
1803}
1804
1805void brcmf_fws_del_interface(struct brcmf_if *ifp)
1806{
1807	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
1808
1809	brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
1810	if (!entry)
1811		return;
1812
1813	ifp->fws_desc = NULL;
1814	brcmf_fws_clear_mac_descriptor(entry);
1815	brcmf_fws_cleanup(ifp->drvr->fws, ifp->ifidx);
1816}
1817
1818static void brcmf_fws_dequeue_worker(struct work_struct *worker)
1819{
1820	struct brcmf_fws_info *fws;
1821	struct sk_buff *skb;
1822	ulong flags;
1823	int fifo;
1824	int credit;
1825
1826	fws = container_of(worker, struct brcmf_fws_info, fws_dequeue_work);
1827
1828	brcmf_dbg(TRACE, "enter: fws=%p\n", fws);
1829	brcmf_fws_lock(fws->drvr, flags);
1830	for (fifo = NL80211_NUM_ACS; fifo >= 0; fifo--) {
1831		brcmf_dbg(TRACE, "fifo %d credit %d\n", fifo,
1832			  fws->fifo_credit[fifo]);
1833		for (credit = 0; credit < fws->fifo_credit[fifo]; /* nop */) {
1834			skb = brcmf_fws_deq(fws, fifo);
1835			if (!skb)
1836				break;
1837			if (!brcmf_fws_commit_skb(fws, fifo, skb) &&
1838			    brcmf_skbcb(skb)->if_flags &
1839			    BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK)
1840				credit++;
1841		}
1842		fws->fifo_credit[fifo] -= credit;
1843	}
1844	brcmf_fws_unlock(fws->drvr, flags);
1845}
1846
1847int brcmf_fws_init(struct brcmf_pub *drvr)
1848{
1849	u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
1850	int rc;
1851
1852	if (!drvr->fw_signals)
1853		return 0;
1854
1855	spin_lock_init(&drvr->fws_spinlock);
1856
1857	drvr->fws = kzalloc(sizeof(*(drvr->fws)), GFP_KERNEL);
1858	if (!drvr->fws) {
1859		rc = -ENOMEM;
1860		goto fail;
1861	}
1862
1863	/* set linkage back */
1864	drvr->fws->drvr = drvr;
1865	drvr->fws->fcmode = fcmode;
1866
1867	drvr->fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
1868	if (drvr->fws->fws_wq == NULL) {
1869		brcmf_err("workqueue creation failed\n");
1870		rc = -EBADF;
1871		goto fail;
1872	}
1873	INIT_WORK(&drvr->fws->fws_dequeue_work, brcmf_fws_dequeue_worker);
1874
1875	/* enable firmware signalling if fcmode active */
1876	if (drvr->fws->fcmode != BRCMF_FWS_FCMODE_NONE)
1877		tlv |= BRCMF_FWS_FLAGS_XONXOFF_SIGNALS |
1878		       BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS |
1879		       BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE;
1880
1881	rc = brcmf_fil_iovar_int_set(drvr->iflist[0], "tlv", tlv);
1882	if (rc < 0) {
1883		brcmf_err("failed to set bdcv2 tlv signaling\n");
1884		goto fail;
1885	}
1886
1887	if (brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
1888				brcmf_fws_notify_credit_map)) {
1889		brcmf_err("register credit map handler failed\n");
1890		goto fail;
1891	}
1892
1893	brcmf_fws_hanger_init(&drvr->fws->hanger);
1894	brcmf_fws_init_mac_descriptor(&drvr->fws->desc.other, NULL, 0);
1895	brcmu_pktq_init(&drvr->fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
1896			BRCMF_FWS_PSQ_LEN);
1897
1898	/* create debugfs file for statistics */
1899	brcmf_debugfs_create_fws_stats(drvr, &drvr->fws->stats);
1900
1901	/* TODO: remove upon feature delivery */
1902	brcmf_err("%s bdcv2 tlv signaling [%x]\n",
1903		  drvr->fw_signals ? "enabled" : "disabled", tlv);
1904	return 0;
1905
1906fail:
1907	/* disable flow control entirely */
1908	drvr->fw_signals = false;
1909	brcmf_fws_deinit(drvr);
1910	return rc;
1911}
1912
1913void brcmf_fws_deinit(struct brcmf_pub *drvr)
1914{
1915	struct brcmf_fws_info *fws = drvr->fws;
1916	ulong flags;
1917
1918	if (!fws)
1919		return;
1920
1921	/* cleanup */
1922	brcmf_fws_lock(drvr, flags);
1923	brcmf_fws_cleanup(fws, -1);
1924	drvr->fws = NULL;
1925	brcmf_fws_unlock(drvr, flags);
1926
1927	/* free top structure */
1928	kfree(fws);
1929}
1930
1931bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
1932{
1933	if (!fws)
1934		return false;
1935
1936	brcmf_dbg(TRACE, "enter: mode=%d\n", fws->fcmode);
1937	return fws->fcmode != BRCMF_FWS_FCMODE_NONE;
1938}
1939
1940void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
1941{
1942	ulong flags;
1943
1944	brcmf_fws_lock(fws->drvr, flags);
1945	brcmf_fws_txstatus_process(fws, BRCMF_FWS_TXSTATUS_FW_TOSSED,
1946				   brcmf_skb_htod_tag_get_field(skb, HSLOT), 0);
1947	/* the packet never reached firmware so reclaim credit */
1948	if (fws->fcmode == BRCMF_FWS_FCMODE_EXPLICIT_CREDIT &&
1949	    brcmf_skbcb(skb)->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK) {
1950		brcmf_fws_return_credits(fws,
1951					 brcmf_skb_htod_tag_get_field(skb,
1952								      FIFO),
1953					 1);
1954		brcmf_fws_schedule_deq(fws);
1955	}
1956	brcmf_fws_unlock(fws->drvr, flags);
1957}
1958