1 /*
2  * Copyright (c) 2010 Broadcom Corporation
3  *
4  * Permission to use, copy, modify, and/or distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 #include <linux/types.h>
17 #include <linux/module.h>
18 #include <linux/if_ether.h>
19 #include <linux/spinlock.h>
20 #include <linux/skbuff.h>
21 #include <linux/netdevice.h>
22 #include <linux/etherdevice.h>
23 #include <linux/err.h>
24 #include <linux/jiffies.h>
25 #include <net/cfg80211.h>
26 
27 #include <brcmu_utils.h>
28 #include <brcmu_wifi.h>
29 #include "core.h"
30 #include "debug.h"
31 #include "bus.h"
32 #include "fwil.h"
33 #include "fwil_types.h"
34 #include "fweh.h"
35 #include "fwsignal.h"
36 #include "p2p.h"
37 #include "cfg80211.h"
38 #include "proto.h"
39 #include "bcdc.h"
40 #include "common.h"
41 
42 /**
43  * DOC: Firmware Signalling
44  *
45  * Firmware can send signals to host and vice versa, which are passed in the
46  * data packets using TLV based header. This signalling layer is on top of the
47  * BDC bus protocol layer.
48  */
49 
50 /*
51  * single definition for firmware-driver flow control tlv's.
52  *
53  * each tlv is specified by BRCMF_FWS_TLV_DEF(name, ID, length).
54  * A length value 0 indicates variable length tlv.
55  */
56 #define BRCMF_FWS_TLV_DEFLIST \
57 	BRCMF_FWS_TLV_DEF(MAC_OPEN, 1, 1) \
58 	BRCMF_FWS_TLV_DEF(MAC_CLOSE, 2, 1) \
59 	BRCMF_FWS_TLV_DEF(MAC_REQUEST_CREDIT, 3, 2) \
60 	BRCMF_FWS_TLV_DEF(TXSTATUS, 4, 4) \
61 	BRCMF_FWS_TLV_DEF(PKTTAG, 5, 4) \
62 	BRCMF_FWS_TLV_DEF(MACDESC_ADD,	6, 8) \
63 	BRCMF_FWS_TLV_DEF(MACDESC_DEL, 7, 8) \
64 	BRCMF_FWS_TLV_DEF(RSSI, 8, 1) \
65 	BRCMF_FWS_TLV_DEF(INTERFACE_OPEN, 9, 1) \
66 	BRCMF_FWS_TLV_DEF(INTERFACE_CLOSE, 10, 1) \
67 	BRCMF_FWS_TLV_DEF(FIFO_CREDITBACK, 11, 6) \
68 	BRCMF_FWS_TLV_DEF(PENDING_TRAFFIC_BMP, 12, 2) \
69 	BRCMF_FWS_TLV_DEF(MAC_REQUEST_PACKET, 13, 3) \
70 	BRCMF_FWS_TLV_DEF(HOST_REORDER_RXPKTS, 14, 10) \
71 	BRCMF_FWS_TLV_DEF(TRANS_ID, 18, 6) \
72 	BRCMF_FWS_TLV_DEF(COMP_TXSTATUS, 19, 1) \
73 	BRCMF_FWS_TLV_DEF(FILLER, 255, 0)
74 
75 /*
76  * enum brcmf_fws_tlv_type - definition of tlv identifiers.
77  */
78 #define BRCMF_FWS_TLV_DEF(name, id, len) \
79 	BRCMF_FWS_TYPE_ ## name =  id,
80 enum brcmf_fws_tlv_type {
81 	BRCMF_FWS_TLV_DEFLIST
82 	BRCMF_FWS_TYPE_INVALID
83 };
84 #undef BRCMF_FWS_TLV_DEF
85 
86 /*
87  * enum brcmf_fws_tlv_len - definition of tlv lengths.
88  */
89 #define BRCMF_FWS_TLV_DEF(name, id, len) \
90 	BRCMF_FWS_TYPE_ ## name ## _LEN = (len),
91 enum brcmf_fws_tlv_len {
92 	BRCMF_FWS_TLV_DEFLIST
93 };
94 #undef BRCMF_FWS_TLV_DEF
95 
96 /* AMPDU rx reordering definitions */
97 #define BRCMF_RXREORDER_FLOWID_OFFSET		0
98 #define BRCMF_RXREORDER_MAXIDX_OFFSET		2
99 #define BRCMF_RXREORDER_FLAGS_OFFSET		4
100 #define BRCMF_RXREORDER_CURIDX_OFFSET		6
101 #define BRCMF_RXREORDER_EXPIDX_OFFSET		8
102 
103 #define BRCMF_RXREORDER_DEL_FLOW		0x01
104 #define BRCMF_RXREORDER_FLUSH_ALL		0x02
105 #define BRCMF_RXREORDER_CURIDX_VALID		0x04
106 #define BRCMF_RXREORDER_EXPIDX_VALID		0x08
107 #define BRCMF_RXREORDER_NEW_HOLE		0x10
108 
109 #ifdef DEBUG
110 /*
111  * brcmf_fws_tlv_names - array of tlv names.
112  */
113 #define BRCMF_FWS_TLV_DEF(name, id, len) \
114 	{ id, #name },
115 static struct {
116 	enum brcmf_fws_tlv_type id;
117 	const char *name;
118 } brcmf_fws_tlv_names[] = {
119 	BRCMF_FWS_TLV_DEFLIST
120 };
121 #undef BRCMF_FWS_TLV_DEF
122 
123 
124 static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
125 {
126 	int i;
127 
128 	for (i = 0; i < ARRAY_SIZE(brcmf_fws_tlv_names); i++)
129 		if (brcmf_fws_tlv_names[i].id == id)
130 			return brcmf_fws_tlv_names[i].name;
131 
132 	return "INVALID";
133 }
134 #else
135 static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
136 {
137 	return "NODEBUG";
138 }
139 #endif /* DEBUG */
140 
141 /*
142  * The PKTTAG tlv has additional bytes when firmware-signalling
143  * mode has REUSESEQ flag set.
144  */
145 #define BRCMF_FWS_TYPE_SEQ_LEN				2
146 
147 /*
148  * flags used to enable tlv signalling from firmware.
149  */
150 #define BRCMF_FWS_FLAGS_RSSI_SIGNALS			0x0001
151 #define BRCMF_FWS_FLAGS_XONXOFF_SIGNALS			0x0002
152 #define BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS		0x0004
153 #define BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE	0x0008
154 #define BRCMF_FWS_FLAGS_PSQ_GENERATIONFSM_ENABLE	0x0010
155 #define BRCMF_FWS_FLAGS_PSQ_ZERO_BUFFER_ENABLE		0x0020
156 #define BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE		0x0040
157 
158 #define BRCMF_FWS_MAC_DESC_TABLE_SIZE			32
159 #define BRCMF_FWS_MAC_DESC_ID_INVALID			0xff
160 
161 #define BRCMF_FWS_HOSTIF_FLOWSTATE_OFF			0
162 #define BRCMF_FWS_HOSTIF_FLOWSTATE_ON			1
163 #define BRCMF_FWS_FLOWCONTROL_HIWATER			128
164 #define BRCMF_FWS_FLOWCONTROL_LOWATER			64
165 
166 #define BRCMF_FWS_PSQ_PREC_COUNT		((BRCMF_FWS_FIFO_COUNT + 1) * 2)
167 #define BRCMF_FWS_PSQ_LEN				256
168 
169 #define BRCMF_FWS_HTOD_FLAG_PKTFROMHOST			0x01
170 #define BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED		0x02
171 
172 #define BRCMF_FWS_RET_OK_NOSCHEDULE			0
173 #define BRCMF_FWS_RET_OK_SCHEDULE			1
174 
175 #define BRCMF_FWS_MODE_REUSESEQ_SHIFT			3	/* seq reuse */
176 #define BRCMF_FWS_MODE_SET_REUSESEQ(x, val)	((x) = \
177 		((x) & ~(1 << BRCMF_FWS_MODE_REUSESEQ_SHIFT)) | \
178 		(((val) & 1) << BRCMF_FWS_MODE_REUSESEQ_SHIFT))
179 #define BRCMF_FWS_MODE_GET_REUSESEQ(x)	\
180 		(((x) >> BRCMF_FWS_MODE_REUSESEQ_SHIFT) & 1)
181 
182 /**
183  * enum brcmf_fws_skb_state - indicates processing state of skb.
184  *
185  * @BRCMF_FWS_SKBSTATE_NEW: sk_buff is newly arrived in the driver.
186  * @BRCMF_FWS_SKBSTATE_DELAYED: sk_buff had to wait on queue.
187  * @BRCMF_FWS_SKBSTATE_SUPPRESSED: sk_buff has been suppressed by firmware.
188  * @BRCMF_FWS_SKBSTATE_TIM: allocated for TIM update info.
189  */
190 enum brcmf_fws_skb_state {
191 	BRCMF_FWS_SKBSTATE_NEW,
192 	BRCMF_FWS_SKBSTATE_DELAYED,
193 	BRCMF_FWS_SKBSTATE_SUPPRESSED,
194 	BRCMF_FWS_SKBSTATE_TIM
195 };
196 
197 /**
198  * struct brcmf_skbuff_cb - control buffer associated with skbuff.
199  *
200  * @bus_flags: 2 bytes reserved for bus specific parameters
201  * @if_flags: holds interface index and packet related flags.
202  * @htod: host to device packet identifier (used in PKTTAG tlv).
203  * @htod_seq: this 16-bit is original seq number for every suppress packet.
204  * @state: transmit state of the packet.
205  * @mac: descriptor related to destination for this packet.
206  *
207  * This information is stored in control buffer struct sk_buff::cb, which
208  * provides 48 bytes of storage so this structure should not exceed that.
209  */
210 struct brcmf_skbuff_cb {
211 	u16 bus_flags;
212 	u16 if_flags;
213 	u32 htod;
214 	u16 htod_seq;
215 	enum brcmf_fws_skb_state state;
216 	struct brcmf_fws_mac_descriptor *mac;
217 };
218 
219 /*
220  * macro casting skbuff control buffer to struct brcmf_skbuff_cb.
221  */
222 #define brcmf_skbcb(skb)	((struct brcmf_skbuff_cb *)((skb)->cb))
223 
224 /*
225  * sk_buff control if flags
226  *
227  *	b[11]  - packet sent upon firmware request.
228  *	b[10]  - packet only contains signalling data.
229  *	b[9]   - packet is a tx packet.
230  *	b[8]   - packet used requested credit
231  *	b[7]   - interface in AP mode.
232  *	b[3:0] - interface index.
233  */
234 #define BRCMF_SKB_IF_FLAGS_REQUESTED_MASK	0x0800
235 #define BRCMF_SKB_IF_FLAGS_REQUESTED_SHIFT	11
236 #define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_MASK	0x0400
237 #define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_SHIFT	10
238 #define BRCMF_SKB_IF_FLAGS_TRANSMIT_MASK        0x0200
239 #define BRCMF_SKB_IF_FLAGS_TRANSMIT_SHIFT	9
240 #define BRCMF_SKB_IF_FLAGS_REQ_CREDIT_MASK	0x0100
241 #define BRCMF_SKB_IF_FLAGS_REQ_CREDIT_SHIFT	8
242 #define BRCMF_SKB_IF_FLAGS_IF_AP_MASK		0x0080
243 #define BRCMF_SKB_IF_FLAGS_IF_AP_SHIFT		7
244 #define BRCMF_SKB_IF_FLAGS_INDEX_MASK		0x000f
245 #define BRCMF_SKB_IF_FLAGS_INDEX_SHIFT		0
246 
247 #define brcmf_skb_if_flags_set_field(skb, field, value) \
248 	brcmu_maskset16(&(brcmf_skbcb(skb)->if_flags), \
249 			BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
250 			BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT, (value))
251 #define brcmf_skb_if_flags_get_field(skb, field) \
252 	brcmu_maskget16(brcmf_skbcb(skb)->if_flags, \
253 			BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
254 			BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT)
255 
256 /*
257  * sk_buff control packet identifier
258  *
259  * 32-bit packet identifier used in PKTTAG tlv from host to dongle.
260  *
261  * - Generated at the host (e.g. dhd)
262  * - Seen as a generic sequence number by firmware except for the flags field.
263  *
264  * Generation	: b[31]	=> generation number for this packet [host->fw]
265  *			   OR, current generation number [fw->host]
266  * Flags	: b[30:27] => command, status flags
267  * FIFO-AC	: b[26:24] => AC-FIFO id
268  * h-slot	: b[23:8] => hanger-slot
269  * freerun	: b[7:0] => A free running counter
270  */
271 #define BRCMF_SKB_HTOD_TAG_GENERATION_MASK		0x80000000
272 #define BRCMF_SKB_HTOD_TAG_GENERATION_SHIFT		31
273 #define BRCMF_SKB_HTOD_TAG_FLAGS_MASK			0x78000000
274 #define BRCMF_SKB_HTOD_TAG_FLAGS_SHIFT			27
275 #define BRCMF_SKB_HTOD_TAG_FIFO_MASK			0x07000000
276 #define BRCMF_SKB_HTOD_TAG_FIFO_SHIFT			24
277 #define BRCMF_SKB_HTOD_TAG_HSLOT_MASK			0x00ffff00
278 #define BRCMF_SKB_HTOD_TAG_HSLOT_SHIFT			8
279 #define BRCMF_SKB_HTOD_TAG_FREERUN_MASK			0x000000ff
280 #define BRCMF_SKB_HTOD_TAG_FREERUN_SHIFT		0
281 
282 #define brcmf_skb_htod_tag_set_field(skb, field, value) \
283 	brcmu_maskset32(&(brcmf_skbcb(skb)->htod), \
284 			BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
285 			BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT, (value))
286 #define brcmf_skb_htod_tag_get_field(skb, field) \
287 	brcmu_maskget32(brcmf_skbcb(skb)->htod, \
288 			BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
289 			BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT)
290 
291 #define BRCMF_SKB_HTOD_SEQ_FROMFW_MASK			0x2000
292 #define BRCMF_SKB_HTOD_SEQ_FROMFW_SHIFT			13
293 #define BRCMF_SKB_HTOD_SEQ_FROMDRV_MASK			0x1000
294 #define BRCMF_SKB_HTOD_SEQ_FROMDRV_SHIFT		12
295 #define BRCMF_SKB_HTOD_SEQ_NR_MASK			0x0fff
296 #define BRCMF_SKB_HTOD_SEQ_NR_SHIFT			0
297 
298 #define brcmf_skb_htod_seq_set_field(skb, field, value) \
299 	brcmu_maskset16(&(brcmf_skbcb(skb)->htod_seq), \
300 			BRCMF_SKB_HTOD_SEQ_ ## field ## _MASK, \
301 			BRCMF_SKB_HTOD_SEQ_ ## field ## _SHIFT, (value))
302 #define brcmf_skb_htod_seq_get_field(skb, field) \
303 	brcmu_maskget16(brcmf_skbcb(skb)->htod_seq, \
304 			BRCMF_SKB_HTOD_SEQ_ ## field ## _MASK, \
305 			BRCMF_SKB_HTOD_SEQ_ ## field ## _SHIFT)
306 
307 #define BRCMF_FWS_TXSTAT_GENERATION_MASK	0x80000000
308 #define BRCMF_FWS_TXSTAT_GENERATION_SHIFT	31
309 #define BRCMF_FWS_TXSTAT_FLAGS_MASK		0x78000000
310 #define BRCMF_FWS_TXSTAT_FLAGS_SHIFT		27
311 #define BRCMF_FWS_TXSTAT_FIFO_MASK		0x07000000
312 #define BRCMF_FWS_TXSTAT_FIFO_SHIFT		24
313 #define BRCMF_FWS_TXSTAT_HSLOT_MASK		0x00FFFF00
314 #define BRCMF_FWS_TXSTAT_HSLOT_SHIFT		8
315 #define BRCMF_FWS_TXSTAT_FREERUN_MASK		0x000000FF
316 #define BRCMF_FWS_TXSTAT_FREERUN_SHIFT		0
317 
318 #define brcmf_txstatus_get_field(txs, field) \
319 	brcmu_maskget32(txs, BRCMF_FWS_TXSTAT_ ## field ## _MASK, \
320 			BRCMF_FWS_TXSTAT_ ## field ## _SHIFT)
321 
322 /* How long to defer borrowing in jiffies */
323 #define BRCMF_FWS_BORROW_DEFER_PERIOD		(HZ / 10)
324 
325 /**
326  * enum brcmf_fws_fifo - fifo indices used by dongle firmware.
327  *
328  * @BRCMF_FWS_FIFO_FIRST: first fifo, ie. background.
329  * @BRCMF_FWS_FIFO_AC_BK: fifo for background traffic.
330  * @BRCMF_FWS_FIFO_AC_BE: fifo for best-effort traffic.
331  * @BRCMF_FWS_FIFO_AC_VI: fifo for video traffic.
332  * @BRCMF_FWS_FIFO_AC_VO: fifo for voice traffic.
333  * @BRCMF_FWS_FIFO_BCMC: fifo for broadcast/multicast (AP only).
334  * @BRCMF_FWS_FIFO_ATIM: fifo for ATIM (AP only).
335  * @BRCMF_FWS_FIFO_COUNT: number of fifos.
336  */
337 enum brcmf_fws_fifo {
338 	BRCMF_FWS_FIFO_FIRST,
339 	BRCMF_FWS_FIFO_AC_BK = BRCMF_FWS_FIFO_FIRST,
340 	BRCMF_FWS_FIFO_AC_BE,
341 	BRCMF_FWS_FIFO_AC_VI,
342 	BRCMF_FWS_FIFO_AC_VO,
343 	BRCMF_FWS_FIFO_BCMC,
344 	BRCMF_FWS_FIFO_ATIM,
345 	BRCMF_FWS_FIFO_COUNT
346 };
347 
348 /**
349  * enum brcmf_fws_txstatus - txstatus flag values.
350  *
351  * @BRCMF_FWS_TXSTATUS_DISCARD:
352  *	host is free to discard the packet.
353  * @BRCMF_FWS_TXSTATUS_CORE_SUPPRESS:
354  *	802.11 core suppressed the packet.
355  * @BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS:
356  *	firmware suppress the packet as device is already in PS mode.
357  * @BRCMF_FWS_TXSTATUS_FW_TOSSED:
358  *	firmware tossed the packet.
359  * @BRCMF_FWS_TXSTATUS_HOST_TOSSED:
360  *	host tossed the packet.
361  */
362 enum brcmf_fws_txstatus {
363 	BRCMF_FWS_TXSTATUS_DISCARD,
364 	BRCMF_FWS_TXSTATUS_CORE_SUPPRESS,
365 	BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS,
366 	BRCMF_FWS_TXSTATUS_FW_TOSSED,
367 	BRCMF_FWS_TXSTATUS_HOST_TOSSED
368 };
369 
370 enum brcmf_fws_fcmode {
371 	BRCMF_FWS_FCMODE_NONE,
372 	BRCMF_FWS_FCMODE_IMPLIED_CREDIT,
373 	BRCMF_FWS_FCMODE_EXPLICIT_CREDIT
374 };
375 
376 enum brcmf_fws_mac_desc_state {
377 	BRCMF_FWS_STATE_OPEN = 1,
378 	BRCMF_FWS_STATE_CLOSE
379 };
380 
381 /**
382  * struct brcmf_fws_mac_descriptor - firmware signalling data per node/interface
383  *
384  * @occupied: slot is in use.
385  * @mac_handle: handle for mac entry determined by firmware.
386  * @interface_id: interface index.
387  * @state: current state.
388  * @suppressed: mac entry is suppressed.
389  * @generation: generation bit.
390  * @ac_bitmap: ac queue bitmap.
391  * @requested_credit: credits requested by firmware.
392  * @ea: ethernet address.
393  * @seq: per-node free-running sequence.
394  * @psq: power-save queue.
395  * @transit_count: packet in transit to firmware.
396  */
397 struct brcmf_fws_mac_descriptor {
398 	char name[16];
399 	u8 occupied;
400 	u8 mac_handle;
401 	u8 interface_id;
402 	u8 state;
403 	bool suppressed;
404 	u8 generation;
405 	u8 ac_bitmap;
406 	u8 requested_credit;
407 	u8 requested_packet;
408 	u8 ea[ETH_ALEN];
409 	u8 seq[BRCMF_FWS_FIFO_COUNT];
410 	struct pktq psq;
411 	int transit_count;
412 	int suppr_transit_count;
413 	bool send_tim_signal;
414 	u8 traffic_pending_bmp;
415 	u8 traffic_lastreported_bmp;
416 };
417 
418 #define BRCMF_FWS_HANGER_MAXITEMS	1024
419 
420 /**
421  * enum brcmf_fws_hanger_item_state - state of hanger item.
422  *
423  * @BRCMF_FWS_HANGER_ITEM_STATE_FREE: item is free for use.
424  * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE: item is in use.
425  * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED: item was suppressed.
426  */
427 enum brcmf_fws_hanger_item_state {
428 	BRCMF_FWS_HANGER_ITEM_STATE_FREE = 1,
429 	BRCMF_FWS_HANGER_ITEM_STATE_INUSE,
430 	BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED
431 };
432 
433 
434 /**
435  * struct brcmf_fws_hanger_item - single entry for tx pending packet.
436  *
437  * @state: entry is either free or occupied.
438  * @pkt: packet itself.
439  */
440 struct brcmf_fws_hanger_item {
441 	enum brcmf_fws_hanger_item_state state;
442 	struct sk_buff *pkt;
443 };
444 
445 /**
446  * struct brcmf_fws_hanger - holds packets awaiting firmware txstatus.
447  *
448  * @pushed: packets pushed to await txstatus.
449  * @popped: packets popped upon handling txstatus.
450  * @failed_to_push: packets that could not be pushed.
451  * @failed_to_pop: packets that could not be popped.
452  * @failed_slotfind: packets for which failed to find an entry.
453  * @slot_pos: last returned item index for a free entry.
454  * @items: array of hanger items.
455  */
456 struct brcmf_fws_hanger {
457 	u32 pushed;
458 	u32 popped;
459 	u32 failed_to_push;
460 	u32 failed_to_pop;
461 	u32 failed_slotfind;
462 	u32 slot_pos;
463 	struct brcmf_fws_hanger_item items[BRCMF_FWS_HANGER_MAXITEMS];
464 };
465 
466 struct brcmf_fws_macdesc_table {
467 	struct brcmf_fws_mac_descriptor nodes[BRCMF_FWS_MAC_DESC_TABLE_SIZE];
468 	struct brcmf_fws_mac_descriptor iface[BRCMF_MAX_IFS];
469 	struct brcmf_fws_mac_descriptor other;
470 };
471 
472 struct brcmf_fws_stats {
473 	u32 tlv_parse_failed;
474 	u32 tlv_invalid_type;
475 	u32 header_only_pkt;
476 	u32 header_pulls;
477 	u32 pkt2bus;
478 	u32 send_pkts[5];
479 	u32 requested_sent[5];
480 	u32 generic_error;
481 	u32 mac_update_failed;
482 	u32 mac_ps_update_failed;
483 	u32 if_update_failed;
484 	u32 packet_request_failed;
485 	u32 credit_request_failed;
486 	u32 rollback_success;
487 	u32 rollback_failed;
488 	u32 delayq_full_error;
489 	u32 supprq_full_error;
490 	u32 txs_indicate;
491 	u32 txs_discard;
492 	u32 txs_supp_core;
493 	u32 txs_supp_ps;
494 	u32 txs_tossed;
495 	u32 txs_host_tossed;
496 	u32 bus_flow_block;
497 	u32 fws_flow_block;
498 };
499 
500 struct brcmf_fws_info {
501 	struct brcmf_pub *drvr;
502 	spinlock_t spinlock;
503 	ulong flags;
504 	struct brcmf_fws_stats stats;
505 	struct brcmf_fws_hanger hanger;
506 	enum brcmf_fws_fcmode fcmode;
507 	bool fw_signals;
508 	bool bcmc_credit_check;
509 	struct brcmf_fws_macdesc_table desc;
510 	struct workqueue_struct *fws_wq;
511 	struct work_struct fws_dequeue_work;
512 	u32 fifo_enqpkt[BRCMF_FWS_FIFO_COUNT];
513 	int fifo_credit[BRCMF_FWS_FIFO_COUNT];
514 	int init_fifo_credit[BRCMF_FWS_FIFO_COUNT];
515 	int credits_borrowed[BRCMF_FWS_FIFO_AC_VO + 1];
516 	int deq_node_pos[BRCMF_FWS_FIFO_COUNT];
517 	u32 fifo_credit_map;
518 	u32 fifo_delay_map;
519 	unsigned long borrow_defer_timestamp;
520 	bool bus_flow_blocked;
521 	bool creditmap_received;
522 	u8 mode;
523 	bool avoid_queueing;
524 };
525 
526 /*
527  * brcmf_fws_prio2fifo - mapping from 802.1d priority to firmware fifo index.
528  */
529 static const int brcmf_fws_prio2fifo[] = {
530 	BRCMF_FWS_FIFO_AC_BE,
531 	BRCMF_FWS_FIFO_AC_BK,
532 	BRCMF_FWS_FIFO_AC_BK,
533 	BRCMF_FWS_FIFO_AC_BE,
534 	BRCMF_FWS_FIFO_AC_VI,
535 	BRCMF_FWS_FIFO_AC_VI,
536 	BRCMF_FWS_FIFO_AC_VO,
537 	BRCMF_FWS_FIFO_AC_VO
538 };
539 
540 #define BRCMF_FWS_TLV_DEF(name, id, len) \
541 	case BRCMF_FWS_TYPE_ ## name: \
542 		return len;
543 
544 /**
545  * brcmf_fws_get_tlv_len() - returns defined length for given tlv id.
546  *
547  * @fws: firmware-signalling information.
548  * @id: identifier of the TLV.
549  *
550  * Return: the specified length for the given TLV; Otherwise -EINVAL.
551  */
552 static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
553 				 enum brcmf_fws_tlv_type id)
554 {
555 	switch (id) {
556 	BRCMF_FWS_TLV_DEFLIST
557 	default:
558 		fws->stats.tlv_invalid_type++;
559 		break;
560 	}
561 	return -EINVAL;
562 }
563 #undef BRCMF_FWS_TLV_DEF
564 
565 static void brcmf_fws_lock(struct brcmf_fws_info *fws)
566 		__acquires(&fws->spinlock)
567 {
568 	spin_lock_irqsave(&fws->spinlock, fws->flags);
569 }
570 
571 static void brcmf_fws_unlock(struct brcmf_fws_info *fws)
572 		__releases(&fws->spinlock)
573 {
574 	spin_unlock_irqrestore(&fws->spinlock, fws->flags);
575 }
576 
577 static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
578 {
579 	u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
580 	return ifidx == *(int *)arg;
581 }
582 
583 static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
584 				int ifidx)
585 {
586 	bool (*matchfn)(struct sk_buff *, void *) = NULL;
587 	struct sk_buff *skb;
588 	int prec;
589 
590 	if (ifidx != -1)
591 		matchfn = brcmf_fws_ifidx_match;
592 	for (prec = 0; prec < q->num_prec; prec++) {
593 		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
594 		while (skb) {
595 			brcmu_pkt_buf_free_skb(skb);
596 			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
597 		}
598 	}
599 }
600 
601 static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
602 {
603 	int i;
604 
605 	memset(hanger, 0, sizeof(*hanger));
606 	for (i = 0; i < ARRAY_SIZE(hanger->items); i++)
607 		hanger->items[i].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
608 }
609 
610 static u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
611 {
612 	u32 i;
613 
614 	i = (h->slot_pos + 1) % BRCMF_FWS_HANGER_MAXITEMS;
615 
616 	while (i != h->slot_pos) {
617 		if (h->items[i].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
618 			h->slot_pos = i;
619 			goto done;
620 		}
621 		i++;
622 		if (i == BRCMF_FWS_HANGER_MAXITEMS)
623 			i = 0;
624 	}
625 	brcmf_err("all slots occupied\n");
626 	h->failed_slotfind++;
627 	i = BRCMF_FWS_HANGER_MAXITEMS;
628 done:
629 	return i;
630 }
631 
632 static int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
633 				    struct sk_buff *pkt, u32 slot_id)
634 {
635 	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
636 		return -ENOENT;
637 
638 	if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
639 		brcmf_err("slot is not free\n");
640 		h->failed_to_push++;
641 		return -EINVAL;
642 	}
643 
644 	h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE;
645 	h->items[slot_id].pkt = pkt;
646 	h->pushed++;
647 	return 0;
648 }
649 
650 static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
651 					  u32 slot_id, struct sk_buff **pktout,
652 					  bool remove_item)
653 {
654 	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
655 		return -ENOENT;
656 
657 	if (h->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
658 		brcmf_err("entry not in use\n");
659 		h->failed_to_pop++;
660 		return -EINVAL;
661 	}
662 
663 	*pktout = h->items[slot_id].pkt;
664 	if (remove_item) {
665 		h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
666 		h->items[slot_id].pkt = NULL;
667 		h->popped++;
668 	}
669 	return 0;
670 }
671 
672 static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
673 					    u32 slot_id)
674 {
675 	if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
676 		return -ENOENT;
677 
678 	if (h->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
679 		brcmf_err("entry not in use\n");
680 		return -EINVAL;
681 	}
682 
683 	h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
684 	return 0;
685 }
686 
687 static void brcmf_fws_hanger_cleanup(struct brcmf_fws_info *fws,
688 				     bool (*fn)(struct sk_buff *, void *),
689 				     int ifidx)
690 {
691 	struct brcmf_fws_hanger *h = &fws->hanger;
692 	struct sk_buff *skb;
693 	int i;
694 	enum brcmf_fws_hanger_item_state s;
695 
696 	for (i = 0; i < ARRAY_SIZE(h->items); i++) {
697 		s = h->items[i].state;
698 		if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE ||
699 		    s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
700 			skb = h->items[i].pkt;
701 			if (fn == NULL || fn(skb, &ifidx)) {
702 				/* suppress packets freed from psq */
703 				if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE)
704 					brcmu_pkt_buf_free_skb(skb);
705 				h->items[i].state =
706 					BRCMF_FWS_HANGER_ITEM_STATE_FREE;
707 			}
708 		}
709 	}
710 }
711 
712 static void brcmf_fws_macdesc_set_name(struct brcmf_fws_info *fws,
713 				       struct brcmf_fws_mac_descriptor *desc)
714 {
715 	if (desc == &fws->desc.other)
716 		strlcpy(desc->name, "MAC-OTHER", sizeof(desc->name));
717 	else if (desc->mac_handle)
718 		scnprintf(desc->name, sizeof(desc->name), "MAC-%d:%d",
719 			  desc->mac_handle, desc->interface_id);
720 	else
721 		scnprintf(desc->name, sizeof(desc->name), "MACIF:%d",
722 			  desc->interface_id);
723 }
724 
725 static void brcmf_fws_macdesc_init(struct brcmf_fws_mac_descriptor *desc,
726 				   u8 *addr, u8 ifidx)
727 {
728 	brcmf_dbg(TRACE,
729 		  "enter: desc %p ea=%pM, ifidx=%u\n", desc, addr, ifidx);
730 	desc->occupied = 1;
731 	desc->state = BRCMF_FWS_STATE_OPEN;
732 	desc->requested_credit = 0;
733 	desc->requested_packet = 0;
734 	/* depending on use may need ifp->bsscfgidx instead */
735 	desc->interface_id = ifidx;
736 	desc->ac_bitmap = 0xff; /* update this when handling APSD */
737 	if (addr)
738 		memcpy(&desc->ea[0], addr, ETH_ALEN);
739 }
740 
741 static
742 void brcmf_fws_macdesc_deinit(struct brcmf_fws_mac_descriptor *desc)
743 {
744 	brcmf_dbg(TRACE,
745 		  "enter: ea=%pM, ifidx=%u\n", desc->ea, desc->interface_id);
746 	desc->occupied = 0;
747 	desc->state = BRCMF_FWS_STATE_CLOSE;
748 	desc->requested_credit = 0;
749 	desc->requested_packet = 0;
750 }
751 
752 static struct brcmf_fws_mac_descriptor *
753 brcmf_fws_macdesc_lookup(struct brcmf_fws_info *fws, u8 *ea)
754 {
755 	struct brcmf_fws_mac_descriptor *entry;
756 	int i;
757 
758 	if (ea == NULL)
759 		return ERR_PTR(-EINVAL);
760 
761 	entry = &fws->desc.nodes[0];
762 	for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++) {
763 		if (entry->occupied && !memcmp(entry->ea, ea, ETH_ALEN))
764 			return entry;
765 		entry++;
766 	}
767 
768 	return ERR_PTR(-ENOENT);
769 }
770 
771 static struct brcmf_fws_mac_descriptor*
772 brcmf_fws_macdesc_find(struct brcmf_fws_info *fws, struct brcmf_if *ifp, u8 *da)
773 {
774 	struct brcmf_fws_mac_descriptor *entry = &fws->desc.other;
775 	bool multicast;
776 
777 	multicast = is_multicast_ether_addr(da);
778 
779 	/* Multicast destination, STA and P2P clients get the interface entry.
780 	 * STA/GC gets the Mac Entry for TDLS destinations, TDLS destinations
781 	 * have their own entry.
782 	 */
783 	if (multicast && ifp->fws_desc) {
784 		entry = ifp->fws_desc;
785 		goto done;
786 	}
787 
788 	entry = brcmf_fws_macdesc_lookup(fws, da);
789 	if (IS_ERR(entry))
790 		entry = ifp->fws_desc;
791 
792 done:
793 	return entry;
794 }
795 
796 static bool brcmf_fws_macdesc_closed(struct brcmf_fws_info *fws,
797 				     struct brcmf_fws_mac_descriptor *entry,
798 				     int fifo)
799 {
800 	struct brcmf_fws_mac_descriptor *if_entry;
801 	bool closed;
802 
803 	/* for unique destination entries the related interface
804 	 * may be closed.
805 	 */
806 	if (entry->mac_handle) {
807 		if_entry = &fws->desc.iface[entry->interface_id];
808 		if (if_entry->state == BRCMF_FWS_STATE_CLOSE)
809 			return true;
810 	}
811 	/* an entry is closed when the state is closed and
812 	 * the firmware did not request anything.
813 	 */
814 	closed = entry->state == BRCMF_FWS_STATE_CLOSE &&
815 		 !entry->requested_credit && !entry->requested_packet;
816 
817 	/* Or firmware does not allow traffic for given fifo */
818 	return closed || !(entry->ac_bitmap & BIT(fifo));
819 }
820 
821 static void brcmf_fws_macdesc_cleanup(struct brcmf_fws_info *fws,
822 				      struct brcmf_fws_mac_descriptor *entry,
823 				      int ifidx)
824 {
825 	if (entry->occupied && (ifidx == -1 || ifidx == entry->interface_id)) {
826 		brcmf_fws_psq_flush(fws, &entry->psq, ifidx);
827 		entry->occupied = !!(entry->psq.len);
828 	}
829 }
830 
831 static void brcmf_fws_bus_txq_cleanup(struct brcmf_fws_info *fws,
832 				      bool (*fn)(struct sk_buff *, void *),
833 				      int ifidx)
834 {
835 	struct brcmf_fws_hanger_item *hi;
836 	struct pktq *txq;
837 	struct sk_buff *skb;
838 	int prec;
839 	u32 hslot;
840 
841 	txq = brcmf_bus_gettxq(fws->drvr->bus_if);
842 	if (IS_ERR(txq)) {
843 		brcmf_dbg(TRACE, "no txq to clean up\n");
844 		return;
845 	}
846 
847 	for (prec = 0; prec < txq->num_prec; prec++) {
848 		skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
849 		while (skb) {
850 			hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
851 			hi = &fws->hanger.items[hslot];
852 			WARN_ON(skb != hi->pkt);
853 			hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
854 			brcmu_pkt_buf_free_skb(skb);
855 			skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
856 		}
857 	}
858 }
859 
860 static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
861 {
862 	int i;
863 	struct brcmf_fws_mac_descriptor *table;
864 	bool (*matchfn)(struct sk_buff *, void *) = NULL;
865 
866 	if (fws == NULL)
867 		return;
868 
869 	if (ifidx != -1)
870 		matchfn = brcmf_fws_ifidx_match;
871 
872 	/* cleanup individual nodes */
873 	table = &fws->desc.nodes[0];
874 	for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++)
875 		brcmf_fws_macdesc_cleanup(fws, &table[i], ifidx);
876 
877 	brcmf_fws_macdesc_cleanup(fws, &fws->desc.other, ifidx);
878 	brcmf_fws_bus_txq_cleanup(fws, matchfn, ifidx);
879 	brcmf_fws_hanger_cleanup(fws, matchfn, ifidx);
880 }
881 
882 static u8 brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
883 {
884 	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
885 	u8 *wlh;
886 	u16 data_offset = 0;
887 	u8 fillers;
888 	__le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
889 	__le16 pktseq = cpu_to_le16(brcmf_skbcb(skb)->htod_seq);
890 
891 	brcmf_dbg(TRACE, "enter: %s, idx=%d hslot=%d htod %X seq %X\n",
892 		  entry->name, brcmf_skb_if_flags_get_field(skb, INDEX),
893 		  (le32_to_cpu(pkttag) >> 8) & 0xffff,
894 		  brcmf_skbcb(skb)->htod, brcmf_skbcb(skb)->htod_seq);
895 	if (entry->send_tim_signal)
896 		data_offset += 2 + BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
897 	if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
898 		data_offset += BRCMF_FWS_TYPE_SEQ_LEN;
899 	/* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
900 	data_offset += 2 + BRCMF_FWS_TYPE_PKTTAG_LEN;
901 	fillers = round_up(data_offset, 4) - data_offset;
902 	data_offset += fillers;
903 
904 	skb_push(skb, data_offset);
905 	wlh = skb->data;
906 
907 	wlh[0] = BRCMF_FWS_TYPE_PKTTAG;
908 	wlh[1] = BRCMF_FWS_TYPE_PKTTAG_LEN;
909 	memcpy(&wlh[2], &pkttag, sizeof(pkttag));
910 	if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
911 		wlh[1] += BRCMF_FWS_TYPE_SEQ_LEN;
912 		memcpy(&wlh[2 + BRCMF_FWS_TYPE_PKTTAG_LEN], &pktseq,
913 		       sizeof(pktseq));
914 	}
915 	wlh += wlh[1] + 2;
916 
917 	if (entry->send_tim_signal) {
918 		entry->send_tim_signal = 0;
919 		wlh[0] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP;
920 		wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
921 		wlh[2] = entry->mac_handle;
922 		wlh[3] = entry->traffic_pending_bmp;
923 		brcmf_dbg(TRACE, "adding TIM info: handle %d bmp 0x%X\n",
924 			  entry->mac_handle, entry->traffic_pending_bmp);
925 		wlh += BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2;
926 		entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
927 	}
928 	if (fillers)
929 		memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers);
930 
931 	return (u8)(data_offset >> 2);
932 }
933 
934 static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
935 				 struct brcmf_fws_mac_descriptor *entry,
936 				 int fifo, bool send_immediately)
937 {
938 	struct sk_buff *skb;
939 	struct brcmf_skbuff_cb *skcb;
940 	s32 err;
941 	u32 len;
942 	u8 data_offset;
943 	int ifidx;
944 
945 	/* check delayedQ and suppressQ in one call using bitmap */
946 	if (brcmu_pktq_mlen(&entry->psq, 3 << (fifo * 2)) == 0)
947 		entry->traffic_pending_bmp &= ~NBITVAL(fifo);
948 	else
949 		entry->traffic_pending_bmp |= NBITVAL(fifo);
950 
951 	entry->send_tim_signal = false;
952 	if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp)
953 		entry->send_tim_signal = true;
954 	if (send_immediately && entry->send_tim_signal &&
955 	    entry->state == BRCMF_FWS_STATE_CLOSE) {
956 		/* create a dummy packet and sent that. The traffic          */
957 		/* bitmap info will automatically be attached to that packet */
958 		len = BRCMF_FWS_TYPE_PKTTAG_LEN + 2 +
959 		      BRCMF_FWS_TYPE_SEQ_LEN +
960 		      BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
961 		      4 + fws->drvr->hdrlen;
962 		skb = brcmu_pkt_buf_get_skb(len);
963 		if (skb == NULL)
964 			return false;
965 		skb_pull(skb, len);
966 		skcb = brcmf_skbcb(skb);
967 		skcb->mac = entry;
968 		skcb->state = BRCMF_FWS_SKBSTATE_TIM;
969 		skcb->htod = 0;
970 		skcb->htod_seq = 0;
971 		data_offset = brcmf_fws_hdrpush(fws, skb);
972 		ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
973 		brcmf_fws_unlock(fws);
974 		err = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb);
975 		brcmf_fws_lock(fws);
976 		if (err)
977 			brcmu_pkt_buf_free_skb(skb);
978 		return true;
979 	}
980 	return false;
981 }
982 
983 static void
984 brcmf_fws_flow_control_check(struct brcmf_fws_info *fws, struct pktq *pq,
985 			     u8 if_id)
986 {
987 	struct brcmf_if *ifp = brcmf_get_ifp(fws->drvr, if_id);
988 
989 	if (WARN_ON(!ifp))
990 		return;
991 
992 	if ((ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
993 	    pq->len <= BRCMF_FWS_FLOWCONTROL_LOWATER)
994 		brcmf_txflowblock_if(ifp,
995 				     BRCMF_NETIF_STOP_REASON_FWS_FC, false);
996 	if (!(ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
997 	    pq->len >= BRCMF_FWS_FLOWCONTROL_HIWATER) {
998 		fws->stats.fws_flow_block++;
999 		brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FWS_FC, true);
1000 	}
1001 	return;
1002 }
1003 
1004 static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
1005 {
1006 	brcmf_dbg(CTL, "rssi %d\n", rssi);
1007 	return 0;
1008 }
1009 
1010 static
1011 int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
1012 {
1013 	struct brcmf_fws_mac_descriptor *entry, *existing;
1014 	u8 mac_handle;
1015 	u8 ifidx;
1016 	u8 *addr;
1017 
1018 	mac_handle = *data++;
1019 	ifidx = *data++;
1020 	addr = data;
1021 
1022 	entry = &fws->desc.nodes[mac_handle & 0x1F];
1023 	if (type == BRCMF_FWS_TYPE_MACDESC_DEL) {
1024 		if (entry->occupied) {
1025 			brcmf_dbg(TRACE, "deleting %s mac %pM\n",
1026 				  entry->name, addr);
1027 			brcmf_fws_lock(fws);
1028 			brcmf_fws_macdesc_cleanup(fws, entry, -1);
1029 			brcmf_fws_macdesc_deinit(entry);
1030 			brcmf_fws_unlock(fws);
1031 		} else
1032 			fws->stats.mac_update_failed++;
1033 		return 0;
1034 	}
1035 
1036 	existing = brcmf_fws_macdesc_lookup(fws, addr);
1037 	if (IS_ERR(existing)) {
1038 		if (!entry->occupied) {
1039 			brcmf_fws_lock(fws);
1040 			entry->mac_handle = mac_handle;
1041 			brcmf_fws_macdesc_init(entry, addr, ifidx);
1042 			brcmf_fws_macdesc_set_name(fws, entry);
1043 			brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
1044 					BRCMF_FWS_PSQ_LEN);
1045 			brcmf_fws_unlock(fws);
1046 			brcmf_dbg(TRACE, "add %s mac %pM\n", entry->name, addr);
1047 		} else {
1048 			fws->stats.mac_update_failed++;
1049 		}
1050 	} else {
1051 		if (entry != existing) {
1052 			brcmf_dbg(TRACE, "copy mac %s\n", existing->name);
1053 			brcmf_fws_lock(fws);
1054 			memcpy(entry, existing,
1055 			       offsetof(struct brcmf_fws_mac_descriptor, psq));
1056 			entry->mac_handle = mac_handle;
1057 			brcmf_fws_macdesc_deinit(existing);
1058 			brcmf_fws_macdesc_set_name(fws, entry);
1059 			brcmf_fws_unlock(fws);
1060 			brcmf_dbg(TRACE, "relocate %s mac %pM\n", entry->name,
1061 				  addr);
1062 		} else {
1063 			brcmf_dbg(TRACE, "use existing\n");
1064 			WARN_ON(entry->mac_handle != mac_handle);
1065 			/* TODO: what should we do here: continue, reinit, .. */
1066 		}
1067 	}
1068 	return 0;
1069 }
1070 
1071 static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
1072 					    u8 type, u8 *data)
1073 {
1074 	struct brcmf_fws_mac_descriptor *entry;
1075 	u8 mac_handle;
1076 	int ret;
1077 
1078 	mac_handle = data[0];
1079 	entry = &fws->desc.nodes[mac_handle & 0x1F];
1080 	if (!entry->occupied) {
1081 		fws->stats.mac_ps_update_failed++;
1082 		return -ESRCH;
1083 	}
1084 	brcmf_fws_lock(fws);
1085 	/* a state update should wipe old credits */
1086 	entry->requested_credit = 0;
1087 	entry->requested_packet = 0;
1088 	if (type == BRCMF_FWS_TYPE_MAC_OPEN) {
1089 		entry->state = BRCMF_FWS_STATE_OPEN;
1090 		ret = BRCMF_FWS_RET_OK_SCHEDULE;
1091 	} else {
1092 		entry->state = BRCMF_FWS_STATE_CLOSE;
1093 		brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_BK, false);
1094 		brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_BE, false);
1095 		brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VI, false);
1096 		brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VO, true);
1097 		ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
1098 	}
1099 	brcmf_fws_unlock(fws);
1100 	return ret;
1101 }
1102 
1103 static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
1104 					      u8 type, u8 *data)
1105 {
1106 	struct brcmf_fws_mac_descriptor *entry;
1107 	u8 ifidx;
1108 	int ret;
1109 
1110 	ifidx = data[0];
1111 
1112 	if (ifidx >= BRCMF_MAX_IFS) {
1113 		ret = -ERANGE;
1114 		goto fail;
1115 	}
1116 
1117 	entry = &fws->desc.iface[ifidx];
1118 	if (!entry->occupied) {
1119 		ret = -ESRCH;
1120 		goto fail;
1121 	}
1122 
1123 	brcmf_dbg(TRACE, "%s (%d): %s\n", brcmf_fws_get_tlv_name(type), type,
1124 		  entry->name);
1125 	brcmf_fws_lock(fws);
1126 	switch (type) {
1127 	case BRCMF_FWS_TYPE_INTERFACE_OPEN:
1128 		entry->state = BRCMF_FWS_STATE_OPEN;
1129 		ret = BRCMF_FWS_RET_OK_SCHEDULE;
1130 		break;
1131 	case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
1132 		entry->state = BRCMF_FWS_STATE_CLOSE;
1133 		ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
1134 		break;
1135 	default:
1136 		ret = -EINVAL;
1137 		brcmf_fws_unlock(fws);
1138 		goto fail;
1139 	}
1140 	brcmf_fws_unlock(fws);
1141 	return ret;
1142 
1143 fail:
1144 	fws->stats.if_update_failed++;
1145 	return ret;
1146 }
1147 
1148 static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
1149 				      u8 *data)
1150 {
1151 	struct brcmf_fws_mac_descriptor *entry;
1152 
1153 	entry = &fws->desc.nodes[data[1] & 0x1F];
1154 	if (!entry->occupied) {
1155 		if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
1156 			fws->stats.credit_request_failed++;
1157 		else
1158 			fws->stats.packet_request_failed++;
1159 		return -ESRCH;
1160 	}
1161 
1162 	brcmf_dbg(TRACE, "%s (%d): %s cnt %d bmp %d\n",
1163 		  brcmf_fws_get_tlv_name(type), type, entry->name,
1164 		  data[0], data[2]);
1165 	brcmf_fws_lock(fws);
1166 	if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
1167 		entry->requested_credit = data[0];
1168 	else
1169 		entry->requested_packet = data[0];
1170 
1171 	entry->ac_bitmap = data[2];
1172 	brcmf_fws_unlock(fws);
1173 	return BRCMF_FWS_RET_OK_SCHEDULE;
1174 }
1175 
1176 static void
1177 brcmf_fws_macdesc_use_req_credit(struct brcmf_fws_mac_descriptor *entry,
1178 				 struct sk_buff *skb)
1179 {
1180 	if (entry->requested_credit > 0) {
1181 		entry->requested_credit--;
1182 		brcmf_skb_if_flags_set_field(skb, REQUESTED, 1);
1183 		brcmf_skb_if_flags_set_field(skb, REQ_CREDIT, 1);
1184 		if (entry->state != BRCMF_FWS_STATE_CLOSE)
1185 			brcmf_err("requested credit set while mac not closed!\n");
1186 	} else if (entry->requested_packet > 0) {
1187 		entry->requested_packet--;
1188 		brcmf_skb_if_flags_set_field(skb, REQUESTED, 1);
1189 		brcmf_skb_if_flags_set_field(skb, REQ_CREDIT, 0);
1190 		if (entry->state != BRCMF_FWS_STATE_CLOSE)
1191 			brcmf_err("requested packet set while mac not closed!\n");
1192 	} else {
1193 		brcmf_skb_if_flags_set_field(skb, REQUESTED, 0);
1194 		brcmf_skb_if_flags_set_field(skb, REQ_CREDIT, 0);
1195 	}
1196 }
1197 
1198 static void brcmf_fws_macdesc_return_req_credit(struct sk_buff *skb)
1199 {
1200 	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
1201 
1202 	if ((brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) &&
1203 	    (entry->state == BRCMF_FWS_STATE_CLOSE))
1204 		entry->requested_credit++;
1205 }
1206 
1207 static void brcmf_fws_return_credits(struct brcmf_fws_info *fws,
1208 				     u8 fifo, u8 credits)
1209 {
1210 	int lender_ac;
1211 	int *borrowed;
1212 	int *fifo_credit;
1213 
1214 	if (!credits)
1215 		return;
1216 
1217 	fws->fifo_credit_map |= 1 << fifo;
1218 
1219 	if ((fifo == BRCMF_FWS_FIFO_AC_BE) &&
1220 	    (fws->credits_borrowed[0])) {
1221 		for (lender_ac = BRCMF_FWS_FIFO_AC_VO; lender_ac >= 0;
1222 		     lender_ac--) {
1223 			borrowed = &fws->credits_borrowed[lender_ac];
1224 			if (*borrowed) {
1225 				fws->fifo_credit_map |= (1 << lender_ac);
1226 				fifo_credit = &fws->fifo_credit[lender_ac];
1227 				if (*borrowed >= credits) {
1228 					*borrowed -= credits;
1229 					*fifo_credit += credits;
1230 					return;
1231 				} else {
1232 					credits -= *borrowed;
1233 					*fifo_credit += *borrowed;
1234 					*borrowed = 0;
1235 				}
1236 			}
1237 		}
1238 	}
1239 
1240 	fws->fifo_credit[fifo] += credits;
1241 	if (fws->fifo_credit[fifo] > fws->init_fifo_credit[fifo])
1242 		fws->fifo_credit[fifo] = fws->init_fifo_credit[fifo];
1243 
1244 }
1245 
1246 static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
1247 {
1248 	/* only schedule dequeue when there are credits for delayed traffic */
1249 	if ((fws->fifo_credit_map & fws->fifo_delay_map) ||
1250 	    (!brcmf_fws_fc_active(fws) && fws->fifo_delay_map))
1251 		queue_work(fws->fws_wq, &fws->fws_dequeue_work);
1252 }
1253 
1254 static int brcmf_fws_enq(struct brcmf_fws_info *fws,
1255 			 enum brcmf_fws_skb_state state, int fifo,
1256 			 struct sk_buff *p)
1257 {
1258 	int prec = 2 * fifo;
1259 	u32 *qfull_stat = &fws->stats.delayq_full_error;
1260 	struct brcmf_fws_mac_descriptor *entry;
1261 	struct pktq *pq;
1262 	struct sk_buff_head *queue;
1263 	struct sk_buff *p_head;
1264 	struct sk_buff *p_tail;
1265 	u32 fr_new;
1266 	u32 fr_compare;
1267 
1268 	entry = brcmf_skbcb(p)->mac;
1269 	if (entry == NULL) {
1270 		brcmf_err("no mac descriptor found for skb %p\n", p);
1271 		return -ENOENT;
1272 	}
1273 
1274 	brcmf_dbg(DATA, "enter: fifo %d skb %p\n", fifo, p);
1275 	if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
1276 		prec += 1;
1277 		qfull_stat = &fws->stats.supprq_full_error;
1278 
1279 		/* Fix out of order delivery of frames. Dont assume frame    */
1280 		/* can be inserted at the end, but look for correct position */
1281 		pq = &entry->psq;
1282 		if (pktq_full(pq) || pktq_pfull(pq, prec)) {
1283 			*qfull_stat += 1;
1284 			return -ENFILE;
1285 		}
1286 		queue = &pq->q[prec].skblist;
1287 
1288 		p_head = skb_peek(queue);
1289 		p_tail = skb_peek_tail(queue);
1290 		fr_new = brcmf_skb_htod_tag_get_field(p, FREERUN);
1291 
1292 		while (p_head != p_tail) {
1293 			fr_compare = brcmf_skb_htod_tag_get_field(p_tail,
1294 								  FREERUN);
1295 			/* be sure to handle wrap of 256 */
1296 			if (((fr_new > fr_compare) &&
1297 			     ((fr_new - fr_compare) < 128)) ||
1298 			    ((fr_new < fr_compare) &&
1299 			     ((fr_compare - fr_new) > 128)))
1300 				break;
1301 			p_tail = skb_queue_prev(queue, p_tail);
1302 		}
1303 		/* Position found. Determine what to do */
1304 		if (p_tail == NULL) {
1305 			/* empty list */
1306 			__skb_queue_tail(queue, p);
1307 		} else {
1308 			fr_compare = brcmf_skb_htod_tag_get_field(p_tail,
1309 								  FREERUN);
1310 			if (((fr_new > fr_compare) &&
1311 			     ((fr_new - fr_compare) < 128)) ||
1312 			    ((fr_new < fr_compare) &&
1313 			     ((fr_compare - fr_new) > 128))) {
1314 				/* After tail */
1315 				__skb_queue_after(queue, p_tail, p);
1316 			} else {
1317 				/* Before tail */
1318 				__skb_insert(p, p_tail->prev, p_tail, queue);
1319 			}
1320 		}
1321 
1322 		/* Complete the counters and statistics */
1323 		pq->len++;
1324 		if (pq->hi_prec < prec)
1325 			pq->hi_prec = (u8) prec;
1326 	} else if (brcmu_pktq_penq(&entry->psq, prec, p) == NULL) {
1327 		*qfull_stat += 1;
1328 		return -ENFILE;
1329 	}
1330 
1331 	/* increment total enqueued packet count */
1332 	fws->fifo_delay_map |= 1 << fifo;
1333 	fws->fifo_enqpkt[fifo]++;
1334 
1335 	/* update the sk_buff state */
1336 	brcmf_skbcb(p)->state = state;
1337 
1338 	/*
1339 	 * A packet has been pushed so update traffic
1340 	 * availability bitmap, if applicable
1341 	 */
1342 	brcmf_fws_tim_update(fws, entry, fifo, true);
1343 	brcmf_fws_flow_control_check(fws, &entry->psq,
1344 				     brcmf_skb_if_flags_get_field(p, INDEX));
1345 	return 0;
1346 }
1347 
1348 static struct sk_buff *brcmf_fws_deq(struct brcmf_fws_info *fws, int fifo)
1349 {
1350 	struct brcmf_fws_mac_descriptor *table;
1351 	struct brcmf_fws_mac_descriptor *entry;
1352 	struct sk_buff *p;
1353 	int num_nodes;
1354 	int node_pos;
1355 	int prec_out;
1356 	int pmsk;
1357 	int i;
1358 
1359 	table = (struct brcmf_fws_mac_descriptor *)&fws->desc;
1360 	num_nodes = sizeof(fws->desc) / sizeof(struct brcmf_fws_mac_descriptor);
1361 	node_pos = fws->deq_node_pos[fifo];
1362 
1363 	for (i = 0; i < num_nodes; i++) {
1364 		entry = &table[(node_pos + i) % num_nodes];
1365 		if (!entry->occupied ||
1366 		    brcmf_fws_macdesc_closed(fws, entry, fifo))
1367 			continue;
1368 
1369 		if (entry->suppressed)
1370 			pmsk = 2;
1371 		else
1372 			pmsk = 3;
1373 		p = brcmu_pktq_mdeq(&entry->psq, pmsk << (fifo * 2), &prec_out);
1374 		if (p == NULL) {
1375 			if (entry->suppressed) {
1376 				if (entry->suppr_transit_count)
1377 					continue;
1378 				entry->suppressed = false;
1379 				p = brcmu_pktq_mdeq(&entry->psq,
1380 						    1 << (fifo * 2), &prec_out);
1381 			}
1382 		}
1383 		if  (p == NULL)
1384 			continue;
1385 
1386 		brcmf_fws_macdesc_use_req_credit(entry, p);
1387 
1388 		/* move dequeue position to ensure fair round-robin */
1389 		fws->deq_node_pos[fifo] = (node_pos + i + 1) % num_nodes;
1390 		brcmf_fws_flow_control_check(fws, &entry->psq,
1391 					     brcmf_skb_if_flags_get_field(p,
1392 									  INDEX)
1393 					     );
1394 		/*
1395 		 * A packet has been picked up, update traffic
1396 		 * availability bitmap, if applicable
1397 		 */
1398 		brcmf_fws_tim_update(fws, entry, fifo, false);
1399 
1400 		/*
1401 		 * decrement total enqueued fifo packets and
1402 		 * clear delay bitmap if done.
1403 		 */
1404 		fws->fifo_enqpkt[fifo]--;
1405 		if (fws->fifo_enqpkt[fifo] == 0)
1406 			fws->fifo_delay_map &= ~(1 << fifo);
1407 		goto done;
1408 	}
1409 	p = NULL;
1410 done:
1411 	brcmf_dbg(DATA, "exit: fifo %d skb %p\n", fifo, p);
1412 	return p;
1413 }
1414 
1415 static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
1416 					 struct sk_buff *skb,
1417 					 u32 genbit, u16 seq)
1418 {
1419 	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
1420 	u32 hslot;
1421 	int ret;
1422 
1423 	hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
1424 
1425 	/* this packet was suppressed */
1426 	if (!entry->suppressed) {
1427 		entry->suppressed = true;
1428 		entry->suppr_transit_count = entry->transit_count;
1429 		brcmf_dbg(DATA, "suppress %s: transit %d\n",
1430 			  entry->name, entry->transit_count);
1431 	}
1432 
1433 	entry->generation = genbit;
1434 
1435 	brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
1436 	brcmf_skbcb(skb)->htod_seq = seq;
1437 	if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
1438 		brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
1439 		brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
1440 	} else {
1441 		brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
1442 	}
1443 	ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
1444 
1445 	if (ret != 0) {
1446 		/* suppress q is full drop this packet */
1447 		brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, true);
1448 	} else {
1449 		/* Mark suppressed to avoid a double free during wlfc cleanup */
1450 		brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot);
1451 	}
1452 
1453 	return ret;
1454 }
1455 
1456 static int
1457 brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
1458 		      u32 genbit, u16 seq, u8 compcnt)
1459 {
1460 	u32 fifo;
1461 	u8 cnt = 0;
1462 	int ret;
1463 	bool remove_from_hanger = true;
1464 	struct sk_buff *skb;
1465 	struct brcmf_skbuff_cb *skcb;
1466 	struct brcmf_fws_mac_descriptor *entry = NULL;
1467 	struct brcmf_if *ifp;
1468 
1469 	brcmf_dbg(DATA, "flags %d\n", flags);
1470 
1471 	if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
1472 		fws->stats.txs_discard += compcnt;
1473 	else if (flags == BRCMF_FWS_TXSTATUS_CORE_SUPPRESS) {
1474 		fws->stats.txs_supp_core += compcnt;
1475 		remove_from_hanger = false;
1476 	} else if (flags == BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS) {
1477 		fws->stats.txs_supp_ps += compcnt;
1478 		remove_from_hanger = false;
1479 	} else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
1480 		fws->stats.txs_tossed += compcnt;
1481 	else if (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)
1482 		fws->stats.txs_host_tossed += compcnt;
1483 	else
1484 		brcmf_err("unexpected txstatus\n");
1485 
1486 	while (cnt < compcnt) {
1487 		ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
1488 					      remove_from_hanger);
1489 		if (ret != 0) {
1490 			brcmf_err("no packet in hanger slot: hslot=%d\n",
1491 				  hslot);
1492 			goto cont;
1493 		}
1494 
1495 		skcb = brcmf_skbcb(skb);
1496 		entry = skcb->mac;
1497 		if (WARN_ON(!entry)) {
1498 			brcmu_pkt_buf_free_skb(skb);
1499 			goto cont;
1500 		}
1501 		entry->transit_count--;
1502 		if (entry->suppressed && entry->suppr_transit_count)
1503 			entry->suppr_transit_count--;
1504 
1505 		brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name,
1506 			  flags, skcb->htod, seq);
1507 
1508 		/* pick up the implicit credit from this packet */
1509 		fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
1510 		if (fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT ||
1511 		    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
1512 		    flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED) {
1513 			brcmf_fws_return_credits(fws, fifo, 1);
1514 			brcmf_fws_schedule_deq(fws);
1515 		}
1516 		brcmf_fws_macdesc_return_req_credit(skb);
1517 
1518 		ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
1519 		if (ret) {
1520 			brcmu_pkt_buf_free_skb(skb);
1521 			goto cont;
1522 		}
1523 		if (!remove_from_hanger)
1524 			ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
1525 							    genbit, seq);
1526 		if (remove_from_hanger || ret)
1527 			brcmf_txfinalize(ifp, skb, true);
1528 
1529 cont:
1530 		hslot = (hslot + 1) & (BRCMF_FWS_TXSTAT_HSLOT_MASK >>
1531 				       BRCMF_FWS_TXSTAT_HSLOT_SHIFT);
1532 		if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
1533 			seq = (seq + 1) & BRCMF_SKB_HTOD_SEQ_NR_MASK;
1534 
1535 		cnt++;
1536 	}
1537 
1538 	return 0;
1539 }
1540 
1541 static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
1542 					     u8 *data)
1543 {
1544 	int i;
1545 
1546 	if (fws->fcmode != BRCMF_FWS_FCMODE_EXPLICIT_CREDIT) {
1547 		brcmf_dbg(INFO, "ignored\n");
1548 		return BRCMF_FWS_RET_OK_NOSCHEDULE;
1549 	}
1550 
1551 	brcmf_dbg(DATA, "enter: data %pM\n", data);
1552 	brcmf_fws_lock(fws);
1553 	for (i = 0; i < BRCMF_FWS_FIFO_COUNT; i++)
1554 		brcmf_fws_return_credits(fws, i, data[i]);
1555 
1556 	brcmf_dbg(DATA, "map: credit %x delay %x\n", fws->fifo_credit_map,
1557 		  fws->fifo_delay_map);
1558 	brcmf_fws_unlock(fws);
1559 	return BRCMF_FWS_RET_OK_SCHEDULE;
1560 }
1561 
1562 static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 type,
1563 				       u8 *data)
1564 {
1565 	__le32 status_le;
1566 	__le16 seq_le;
1567 	u32 status;
1568 	u32 hslot;
1569 	u32 genbit;
1570 	u8 flags;
1571 	u16 seq;
1572 	u8 compcnt;
1573 	u8 compcnt_offset = BRCMF_FWS_TYPE_TXSTATUS_LEN;
1574 
1575 	memcpy(&status_le, data, sizeof(status_le));
1576 	status = le32_to_cpu(status_le);
1577 	flags = brcmf_txstatus_get_field(status, FLAGS);
1578 	hslot = brcmf_txstatus_get_field(status, HSLOT);
1579 	genbit = brcmf_txstatus_get_field(status, GENERATION);
1580 	if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
1581 		memcpy(&seq_le, &data[BRCMF_FWS_TYPE_TXSTATUS_LEN],
1582 		       sizeof(seq_le));
1583 		seq = le16_to_cpu(seq_le);
1584 		compcnt_offset += BRCMF_FWS_TYPE_SEQ_LEN;
1585 	} else {
1586 		seq = 0;
1587 	}
1588 
1589 	if (type == BRCMF_FWS_TYPE_COMP_TXSTATUS)
1590 		compcnt = data[compcnt_offset];
1591 	else
1592 		compcnt = 1;
1593 	fws->stats.txs_indicate += compcnt;
1594 
1595 	brcmf_fws_lock(fws);
1596 	brcmf_fws_txs_process(fws, flags, hslot, genbit, seq, compcnt);
1597 	brcmf_fws_unlock(fws);
1598 	return BRCMF_FWS_RET_OK_NOSCHEDULE;
1599 }
1600 
1601 static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
1602 {
1603 	__le32 timestamp;
1604 
1605 	memcpy(&timestamp, &data[2], sizeof(timestamp));
1606 	brcmf_dbg(CTL, "received: seq %d, timestamp %d\n", data[1],
1607 		  le32_to_cpu(timestamp));
1608 	return 0;
1609 }
1610 
1611 static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
1612 				       const struct brcmf_event_msg *e,
1613 				       void *data)
1614 {
1615 	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
1616 	int i;
1617 	u8 *credits = data;
1618 
1619 	if (e->datalen < BRCMF_FWS_FIFO_COUNT) {
1620 		brcmf_err("event payload too small (%d)\n", e->datalen);
1621 		return -EINVAL;
1622 	}
1623 
1624 	fws->creditmap_received = true;
1625 
1626 	brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
1627 	brcmf_fws_lock(fws);
1628 	for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
1629 		fws->fifo_credit[i] += credits[i] - fws->init_fifo_credit[i];
1630 		fws->init_fifo_credit[i] = credits[i];
1631 		if (fws->fifo_credit[i] > 0)
1632 			fws->fifo_credit_map |= 1 << i;
1633 		else
1634 			fws->fifo_credit_map &= ~(1 << i);
1635 		WARN_ONCE(fws->fifo_credit[i] < 0,
1636 			  "fifo_credit[%d] is negative(%d)\n", i,
1637 			  fws->fifo_credit[i]);
1638 	}
1639 	brcmf_fws_schedule_deq(fws);
1640 	brcmf_fws_unlock(fws);
1641 	return 0;
1642 }
1643 
1644 static int brcmf_fws_notify_bcmc_credit_support(struct brcmf_if *ifp,
1645 						const struct brcmf_event_msg *e,
1646 						void *data)
1647 {
1648 	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
1649 
1650 	if (fws) {
1651 		brcmf_fws_lock(fws);
1652 		fws->bcmc_credit_check = true;
1653 		brcmf_fws_unlock(fws);
1654 	}
1655 	return 0;
1656 }
1657 
1658 static void brcmf_rxreorder_get_skb_list(struct brcmf_ampdu_rx_reorder *rfi,
1659 					 u8 start, u8 end,
1660 					 struct sk_buff_head *skb_list)
1661 {
1662 	/* initialize return list */
1663 	__skb_queue_head_init(skb_list);
1664 
1665 	if (rfi->pend_pkts == 0) {
1666 		brcmf_dbg(INFO, "no packets in reorder queue\n");
1667 		return;
1668 	}
1669 
1670 	do {
1671 		if (rfi->pktslots[start]) {
1672 			__skb_queue_tail(skb_list, rfi->pktslots[start]);
1673 			rfi->pktslots[start] = NULL;
1674 		}
1675 		start++;
1676 		if (start > rfi->max_idx)
1677 			start = 0;
1678 	} while (start != end);
1679 	rfi->pend_pkts -= skb_queue_len(skb_list);
1680 }
1681 
1682 void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *pkt)
1683 {
1684 	u8 *reorder_data;
1685 	u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
1686 	struct brcmf_ampdu_rx_reorder *rfi;
1687 	struct sk_buff_head reorder_list;
1688 	struct sk_buff *pnext;
1689 	u8 flags;
1690 	u32 buf_size;
1691 
1692 	reorder_data = ((struct brcmf_skb_reorder_data *)pkt->cb)->reorder;
1693 	flow_id = reorder_data[BRCMF_RXREORDER_FLOWID_OFFSET];
1694 	flags = reorder_data[BRCMF_RXREORDER_FLAGS_OFFSET];
1695 
1696 	/* validate flags and flow id */
1697 	if (flags == 0xFF) {
1698 		brcmf_err("invalid flags...so ignore this packet\n");
1699 		brcmf_netif_rx(ifp, pkt);
1700 		return;
1701 	}
1702 
1703 	rfi = ifp->drvr->reorder_flows[flow_id];
1704 	if (flags & BRCMF_RXREORDER_DEL_FLOW) {
1705 		brcmf_dbg(INFO, "flow-%d: delete\n",
1706 			  flow_id);
1707 
1708 		if (rfi == NULL) {
1709 			brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
1710 				  flow_id);
1711 			brcmf_netif_rx(ifp, pkt);
1712 			return;
1713 		}
1714 
1715 		brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, rfi->exp_idx,
1716 					     &reorder_list);
1717 		/* add the last packet */
1718 		__skb_queue_tail(&reorder_list, pkt);
1719 		kfree(rfi);
1720 		ifp->drvr->reorder_flows[flow_id] = NULL;
1721 		goto netif_rx;
1722 	}
1723 	/* from here on we need a flow reorder instance */
1724 	if (rfi == NULL) {
1725 		buf_size = sizeof(*rfi);
1726 		max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
1727 
1728 		buf_size += (max_idx + 1) * sizeof(pkt);
1729 
1730 		/* allocate space for flow reorder info */
1731 		brcmf_dbg(INFO, "flow-%d: start, maxidx %d\n",
1732 			  flow_id, max_idx);
1733 		rfi = kzalloc(buf_size, GFP_ATOMIC);
1734 		if (rfi == NULL) {
1735 			brcmf_err("failed to alloc buffer\n");
1736 			brcmf_netif_rx(ifp, pkt);
1737 			return;
1738 		}
1739 
1740 		ifp->drvr->reorder_flows[flow_id] = rfi;
1741 		rfi->pktslots = (struct sk_buff **)(rfi + 1);
1742 		rfi->max_idx = max_idx;
1743 	}
1744 	if (flags & BRCMF_RXREORDER_NEW_HOLE)  {
1745 		if (rfi->pend_pkts) {
1746 			brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx,
1747 						     rfi->exp_idx,
1748 						     &reorder_list);
1749 			WARN_ON(rfi->pend_pkts);
1750 		} else {
1751 			__skb_queue_head_init(&reorder_list);
1752 		}
1753 		rfi->cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
1754 		rfi->exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
1755 		rfi->max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
1756 		rfi->pktslots[rfi->cur_idx] = pkt;
1757 		rfi->pend_pkts++;
1758 		brcmf_dbg(DATA, "flow-%d: new hole %d (%d), pending %d\n",
1759 			  flow_id, rfi->cur_idx, rfi->exp_idx, rfi->pend_pkts);
1760 	} else if (flags & BRCMF_RXREORDER_CURIDX_VALID) {
1761 		cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
1762 		exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
1763 
1764 		if ((exp_idx == rfi->exp_idx) && (cur_idx != rfi->exp_idx)) {
1765 			/* still in the current hole */
1766 			/* enqueue the current on the buffer chain */
1767 			if (rfi->pktslots[cur_idx] != NULL) {
1768 				brcmf_dbg(INFO, "HOLE: ERROR buffer pending..free it\n");
1769 				brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
1770 				rfi->pktslots[cur_idx] = NULL;
1771 			}
1772 			rfi->pktslots[cur_idx] = pkt;
1773 			rfi->pend_pkts++;
1774 			rfi->cur_idx = cur_idx;
1775 			brcmf_dbg(DATA, "flow-%d: store pkt %d (%d), pending %d\n",
1776 				  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
1777 
1778 			/* can return now as there is no reorder
1779 			 * list to process.
1780 			 */
1781 			return;
1782 		}
1783 		if (rfi->exp_idx == cur_idx) {
1784 			if (rfi->pktslots[cur_idx] != NULL) {
1785 				brcmf_dbg(INFO, "error buffer pending..free it\n");
1786 				brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
1787 				rfi->pktslots[cur_idx] = NULL;
1788 			}
1789 			rfi->pktslots[cur_idx] = pkt;
1790 			rfi->pend_pkts++;
1791 
1792 			/* got the expected one. flush from current to expected
1793 			 * and update expected
1794 			 */
1795 			brcmf_dbg(DATA, "flow-%d: expected %d (%d), pending %d\n",
1796 				  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
1797 
1798 			rfi->cur_idx = cur_idx;
1799 			rfi->exp_idx = exp_idx;
1800 
1801 			brcmf_rxreorder_get_skb_list(rfi, cur_idx, exp_idx,
1802 						     &reorder_list);
1803 			brcmf_dbg(DATA, "flow-%d: freeing buffers %d, pending %d\n",
1804 				  flow_id, skb_queue_len(&reorder_list),
1805 				  rfi->pend_pkts);
1806 		} else {
1807 			u8 end_idx;
1808 
1809 			brcmf_dbg(DATA, "flow-%d (0x%x): both moved, old %d/%d, new %d/%d\n",
1810 				  flow_id, flags, rfi->cur_idx, rfi->exp_idx,
1811 				  cur_idx, exp_idx);
1812 			if (flags & BRCMF_RXREORDER_FLUSH_ALL)
1813 				end_idx = rfi->exp_idx;
1814 			else
1815 				end_idx = exp_idx;
1816 
1817 			/* flush pkts first */
1818 			brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
1819 						     &reorder_list);
1820 
1821 			if (exp_idx == ((cur_idx + 1) % (rfi->max_idx + 1))) {
1822 				__skb_queue_tail(&reorder_list, pkt);
1823 			} else {
1824 				rfi->pktslots[cur_idx] = pkt;
1825 				rfi->pend_pkts++;
1826 			}
1827 			rfi->exp_idx = exp_idx;
1828 			rfi->cur_idx = cur_idx;
1829 		}
1830 	} else {
1831 		/* explicity window move updating the expected index */
1832 		exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
1833 
1834 		brcmf_dbg(DATA, "flow-%d (0x%x): change expected: %d -> %d\n",
1835 			  flow_id, flags, rfi->exp_idx, exp_idx);
1836 		if (flags & BRCMF_RXREORDER_FLUSH_ALL)
1837 			end_idx =  rfi->exp_idx;
1838 		else
1839 			end_idx =  exp_idx;
1840 
1841 		brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
1842 					     &reorder_list);
1843 		__skb_queue_tail(&reorder_list, pkt);
1844 		/* set the new expected idx */
1845 		rfi->exp_idx = exp_idx;
1846 	}
1847 netif_rx:
1848 	skb_queue_walk_safe(&reorder_list, pkt, pnext) {
1849 		__skb_unlink(pkt, &reorder_list);
1850 		brcmf_netif_rx(ifp, pkt);
1851 	}
1852 }
1853 
1854 void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
1855 {
1856 	struct brcmf_skb_reorder_data *rd;
1857 	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
1858 	u8 *signal_data;
1859 	s16 data_len;
1860 	u8 type;
1861 	u8 len;
1862 	u8 *data;
1863 	s32 status;
1864 	s32 err;
1865 
1866 	brcmf_dbg(HDRS, "enter: ifidx %d, skblen %u, sig %d\n",
1867 		  ifp->ifidx, skb->len, siglen);
1868 
1869 	WARN_ON(siglen > skb->len);
1870 
1871 	if (!siglen)
1872 		return;
1873 	/* if flow control disabled, skip to packet data and leave */
1874 	if ((!fws) || (!fws->fw_signals)) {
1875 		skb_pull(skb, siglen);
1876 		return;
1877 	}
1878 
1879 	fws->stats.header_pulls++;
1880 	data_len = siglen;
1881 	signal_data = skb->data;
1882 
1883 	status = BRCMF_FWS_RET_OK_NOSCHEDULE;
1884 	while (data_len > 0) {
1885 		/* extract tlv info */
1886 		type = signal_data[0];
1887 
1888 		/* FILLER type is actually not a TLV, but
1889 		 * a single byte that can be skipped.
1890 		 */
1891 		if (type == BRCMF_FWS_TYPE_FILLER) {
1892 			signal_data += 1;
1893 			data_len -= 1;
1894 			continue;
1895 		}
1896 		len = signal_data[1];
1897 		data = signal_data + 2;
1898 
1899 		brcmf_dbg(HDRS, "tlv type=%s (%d), len=%d (%d)\n",
1900 			  brcmf_fws_get_tlv_name(type), type, len,
1901 			  brcmf_fws_get_tlv_len(fws, type));
1902 
1903 		/* abort parsing when length invalid */
1904 		if (data_len < len + 2)
1905 			break;
1906 
1907 		if (len < brcmf_fws_get_tlv_len(fws, type))
1908 			break;
1909 
1910 		err = BRCMF_FWS_RET_OK_NOSCHEDULE;
1911 		switch (type) {
1912 		case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
1913 			rd = (struct brcmf_skb_reorder_data *)skb->cb;
1914 			rd->reorder = data;
1915 			break;
1916 		case BRCMF_FWS_TYPE_MACDESC_ADD:
1917 		case BRCMF_FWS_TYPE_MACDESC_DEL:
1918 			brcmf_fws_macdesc_indicate(fws, type, data);
1919 			break;
1920 		case BRCMF_FWS_TYPE_MAC_OPEN:
1921 		case BRCMF_FWS_TYPE_MAC_CLOSE:
1922 			err = brcmf_fws_macdesc_state_indicate(fws, type, data);
1923 			break;
1924 		case BRCMF_FWS_TYPE_INTERFACE_OPEN:
1925 		case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
1926 			err = brcmf_fws_interface_state_indicate(fws, type,
1927 								 data);
1928 			break;
1929 		case BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT:
1930 		case BRCMF_FWS_TYPE_MAC_REQUEST_PACKET:
1931 			err = brcmf_fws_request_indicate(fws, type, data);
1932 			break;
1933 		case BRCMF_FWS_TYPE_TXSTATUS:
1934 		case BRCMF_FWS_TYPE_COMP_TXSTATUS:
1935 			brcmf_fws_txstatus_indicate(fws, type, data);
1936 			break;
1937 		case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
1938 			err = brcmf_fws_fifocreditback_indicate(fws, data);
1939 			break;
1940 		case BRCMF_FWS_TYPE_RSSI:
1941 			brcmf_fws_rssi_indicate(fws, *data);
1942 			break;
1943 		case BRCMF_FWS_TYPE_TRANS_ID:
1944 			brcmf_fws_dbg_seqnum_check(fws, data);
1945 			break;
1946 		case BRCMF_FWS_TYPE_PKTTAG:
1947 		case BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP:
1948 		default:
1949 			fws->stats.tlv_invalid_type++;
1950 			break;
1951 		}
1952 		if (err == BRCMF_FWS_RET_OK_SCHEDULE)
1953 			status = BRCMF_FWS_RET_OK_SCHEDULE;
1954 		signal_data += len + 2;
1955 		data_len -= len + 2;
1956 	}
1957 
1958 	if (data_len != 0)
1959 		fws->stats.tlv_parse_failed++;
1960 
1961 	if (status == BRCMF_FWS_RET_OK_SCHEDULE)
1962 		brcmf_fws_schedule_deq(fws);
1963 
1964 	/* signalling processing result does
1965 	 * not affect the actual ethernet packet.
1966 	 */
1967 	skb_pull(skb, siglen);
1968 
1969 	/* this may be a signal-only packet
1970 	 */
1971 	if (skb->len == 0)
1972 		fws->stats.header_only_pkt++;
1973 }
1974 
1975 static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
1976 				   struct sk_buff *p)
1977 {
1978 	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
1979 	struct brcmf_fws_mac_descriptor *entry = skcb->mac;
1980 	u8 flags;
1981 
1982 	if (skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED)
1983 		brcmf_skb_htod_tag_set_field(p, GENERATION, entry->generation);
1984 	flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
1985 	if (brcmf_skb_if_flags_get_field(p, REQUESTED)) {
1986 		/*
1987 		 * Indicate that this packet is being sent in response to an
1988 		 * explicit request from the firmware side.
1989 		 */
1990 		flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
1991 	}
1992 	brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
1993 	return brcmf_fws_hdrpush(fws, p);
1994 }
1995 
1996 static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
1997 				   struct sk_buff *skb, int fifo)
1998 {
1999 	struct brcmf_fws_mac_descriptor *entry;
2000 	struct sk_buff *pktout;
2001 	int qidx, hslot;
2002 	int rc = 0;
2003 
2004 	entry = brcmf_skbcb(skb)->mac;
2005 	if (entry->occupied) {
2006 		qidx = 2 * fifo;
2007 		if (brcmf_skbcb(skb)->state == BRCMF_FWS_SKBSTATE_SUPPRESSED)
2008 			qidx++;
2009 
2010 		pktout = brcmu_pktq_penq_head(&entry->psq, qidx, skb);
2011 		if (pktout == NULL) {
2012 			brcmf_err("%s queue %d full\n", entry->name, qidx);
2013 			rc = -ENOSPC;
2014 		}
2015 	} else {
2016 		brcmf_err("%s entry removed\n", entry->name);
2017 		rc = -ENOENT;
2018 	}
2019 
2020 	if (rc) {
2021 		fws->stats.rollback_failed++;
2022 		hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
2023 		brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED,
2024 				      hslot, 0, 0, 1);
2025 	} else {
2026 		fws->stats.rollback_success++;
2027 		brcmf_fws_return_credits(fws, fifo, 1);
2028 		brcmf_fws_macdesc_return_req_credit(skb);
2029 	}
2030 }
2031 
2032 static int brcmf_fws_borrow_credit(struct brcmf_fws_info *fws)
2033 {
2034 	int lender_ac;
2035 
2036 	if (time_after(fws->borrow_defer_timestamp, jiffies)) {
2037 		fws->fifo_credit_map &= ~(1 << BRCMF_FWS_FIFO_AC_BE);
2038 		return -ENAVAIL;
2039 	}
2040 
2041 	for (lender_ac = 0; lender_ac <= BRCMF_FWS_FIFO_AC_VO; lender_ac++) {
2042 		if (fws->fifo_credit[lender_ac] > 0) {
2043 			fws->credits_borrowed[lender_ac]++;
2044 			fws->fifo_credit[lender_ac]--;
2045 			if (fws->fifo_credit[lender_ac] == 0)
2046 				fws->fifo_credit_map &= ~(1 << lender_ac);
2047 			fws->fifo_credit_map |= (1 << BRCMF_FWS_FIFO_AC_BE);
2048 			brcmf_dbg(DATA, "borrow credit from: %d\n", lender_ac);
2049 			return 0;
2050 		}
2051 	}
2052 	fws->fifo_credit_map &= ~(1 << BRCMF_FWS_FIFO_AC_BE);
2053 	return -ENAVAIL;
2054 }
2055 
2056 static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
2057 				struct sk_buff *skb)
2058 {
2059 	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
2060 	struct brcmf_fws_mac_descriptor *entry;
2061 	int rc;
2062 	u8 ifidx;
2063 	u8 data_offset;
2064 
2065 	entry = skcb->mac;
2066 	if (IS_ERR(entry))
2067 		return PTR_ERR(entry);
2068 
2069 	data_offset = brcmf_fws_precommit_skb(fws, fifo, skb);
2070 	entry->transit_count++;
2071 	if (entry->suppressed)
2072 		entry->suppr_transit_count++;
2073 	ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
2074 	brcmf_fws_unlock(fws);
2075 	rc = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb);
2076 	brcmf_fws_lock(fws);
2077 	brcmf_dbg(DATA, "%s flags %X htod %X bus_tx %d\n", entry->name,
2078 		  skcb->if_flags, skcb->htod, rc);
2079 	if (rc < 0) {
2080 		entry->transit_count--;
2081 		if (entry->suppressed)
2082 			entry->suppr_transit_count--;
2083 		(void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL);
2084 		goto rollback;
2085 	}
2086 
2087 	fws->stats.pkt2bus++;
2088 	fws->stats.send_pkts[fifo]++;
2089 	if (brcmf_skb_if_flags_get_field(skb, REQUESTED))
2090 		fws->stats.requested_sent[fifo]++;
2091 
2092 	return rc;
2093 
2094 rollback:
2095 	brcmf_fws_rollback_toq(fws, skb, fifo);
2096 	return rc;
2097 }
2098 
2099 static int brcmf_fws_assign_htod(struct brcmf_fws_info *fws, struct sk_buff *p,
2100 				  int fifo)
2101 {
2102 	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
2103 	int rc, hslot;
2104 
2105 	skcb->htod = 0;
2106 	skcb->htod_seq = 0;
2107 	hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
2108 	brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
2109 	brcmf_skb_htod_tag_set_field(p, FREERUN, skcb->mac->seq[fifo]);
2110 	brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
2111 	rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
2112 	if (!rc)
2113 		skcb->mac->seq[fifo]++;
2114 	else
2115 		fws->stats.generic_error++;
2116 	return rc;
2117 }
2118 
2119 int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
2120 {
2121 	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
2122 	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
2123 	struct ethhdr *eh = (struct ethhdr *)(skb->data);
2124 	int fifo = BRCMF_FWS_FIFO_BCMC;
2125 	bool multicast = is_multicast_ether_addr(eh->h_dest);
2126 	int rc = 0;
2127 
2128 	brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
2129 
2130 	/* set control buffer information */
2131 	skcb->if_flags = 0;
2132 	skcb->state = BRCMF_FWS_SKBSTATE_NEW;
2133 	brcmf_skb_if_flags_set_field(skb, INDEX, ifp->ifidx);
2134 	if (!multicast)
2135 		fifo = brcmf_fws_prio2fifo[skb->priority];
2136 
2137 	brcmf_fws_lock(fws);
2138 	if (fifo != BRCMF_FWS_FIFO_AC_BE && fifo < BRCMF_FWS_FIFO_BCMC)
2139 		fws->borrow_defer_timestamp = jiffies +
2140 					      BRCMF_FWS_BORROW_DEFER_PERIOD;
2141 
2142 	skcb->mac = brcmf_fws_macdesc_find(fws, ifp, eh->h_dest);
2143 	brcmf_dbg(DATA, "%s mac %pM multi %d fifo %d\n", skcb->mac->name,
2144 		  eh->h_dest, multicast, fifo);
2145 	if (!brcmf_fws_assign_htod(fws, skb, fifo)) {
2146 		brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
2147 		brcmf_fws_schedule_deq(fws);
2148 	} else {
2149 		brcmf_err("drop skb: no hanger slot\n");
2150 		brcmf_txfinalize(ifp, skb, false);
2151 		rc = -ENOMEM;
2152 	}
2153 	brcmf_fws_unlock(fws);
2154 
2155 	return rc;
2156 }
2157 
2158 void brcmf_fws_reset_interface(struct brcmf_if *ifp)
2159 {
2160 	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
2161 
2162 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
2163 	if (!entry)
2164 		return;
2165 
2166 	brcmf_fws_macdesc_init(entry, ifp->mac_addr, ifp->ifidx);
2167 }
2168 
2169 void brcmf_fws_add_interface(struct brcmf_if *ifp)
2170 {
2171 	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
2172 	struct brcmf_fws_mac_descriptor *entry;
2173 
2174 	if (!ifp->ndev || !brcmf_fws_queue_skbs(fws))
2175 		return;
2176 
2177 	entry = &fws->desc.iface[ifp->ifidx];
2178 	ifp->fws_desc = entry;
2179 	brcmf_fws_macdesc_init(entry, ifp->mac_addr, ifp->ifidx);
2180 	brcmf_fws_macdesc_set_name(fws, entry);
2181 	brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
2182 			BRCMF_FWS_PSQ_LEN);
2183 	brcmf_dbg(TRACE, "added %s\n", entry->name);
2184 }
2185 
2186 void brcmf_fws_del_interface(struct brcmf_if *ifp)
2187 {
2188 	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
2189 	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
2190 
2191 	if (!entry)
2192 		return;
2193 
2194 	brcmf_fws_lock(fws);
2195 	ifp->fws_desc = NULL;
2196 	brcmf_dbg(TRACE, "deleting %s\n", entry->name);
2197 	brcmf_fws_macdesc_deinit(entry);
2198 	brcmf_fws_cleanup(fws, ifp->ifidx);
2199 	brcmf_fws_unlock(fws);
2200 }
2201 
2202 static void brcmf_fws_dequeue_worker(struct work_struct *worker)
2203 {
2204 	struct brcmf_fws_info *fws;
2205 	struct brcmf_pub *drvr;
2206 	struct sk_buff *skb;
2207 	int fifo;
2208 	u32 hslot;
2209 	u32 ifidx;
2210 	int ret;
2211 
2212 	fws = container_of(worker, struct brcmf_fws_info, fws_dequeue_work);
2213 	drvr = fws->drvr;
2214 
2215 	brcmf_fws_lock(fws);
2216 	for (fifo = BRCMF_FWS_FIFO_BCMC; fifo >= 0 && !fws->bus_flow_blocked;
2217 	     fifo--) {
2218 		if (!brcmf_fws_fc_active(fws)) {
2219 			while ((skb = brcmf_fws_deq(fws, fifo)) != NULL) {
2220 				hslot = brcmf_skb_htod_tag_get_field(skb,
2221 								     HSLOT);
2222 				brcmf_fws_hanger_poppkt(&fws->hanger, hslot,
2223 							&skb, true);
2224 				ifidx = brcmf_skb_if_flags_get_field(skb,
2225 								     INDEX);
2226 				/* Use proto layer to send data frame */
2227 				brcmf_fws_unlock(fws);
2228 				ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
2229 				brcmf_fws_lock(fws);
2230 				if (ret < 0)
2231 					brcmf_txfinalize(brcmf_get_ifp(drvr,
2232 								       ifidx),
2233 							 skb, false);
2234 				if (fws->bus_flow_blocked)
2235 					break;
2236 			}
2237 			continue;
2238 		}
2239 		while ((fws->fifo_credit[fifo] > 0) ||
2240 		       ((!fws->bcmc_credit_check) &&
2241 			(fifo == BRCMF_FWS_FIFO_BCMC))) {
2242 			skb = brcmf_fws_deq(fws, fifo);
2243 			if (!skb)
2244 				break;
2245 			fws->fifo_credit[fifo]--;
2246 			if (brcmf_fws_commit_skb(fws, fifo, skb))
2247 				break;
2248 			if (fws->bus_flow_blocked)
2249 				break;
2250 		}
2251 		if ((fifo == BRCMF_FWS_FIFO_AC_BE) &&
2252 		    (fws->fifo_credit[fifo] <= 0) &&
2253 		    (!fws->bus_flow_blocked)) {
2254 			while (brcmf_fws_borrow_credit(fws) == 0) {
2255 				skb = brcmf_fws_deq(fws, fifo);
2256 				if (!skb) {
2257 					brcmf_fws_return_credits(fws, fifo, 1);
2258 					break;
2259 				}
2260 				if (brcmf_fws_commit_skb(fws, fifo, skb))
2261 					break;
2262 				if (fws->bus_flow_blocked)
2263 					break;
2264 			}
2265 		}
2266 	}
2267 	brcmf_fws_unlock(fws);
2268 }
2269 
2270 #ifdef DEBUG
2271 static int brcmf_debugfs_fws_stats_read(struct seq_file *seq, void *data)
2272 {
2273 	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
2274 	struct brcmf_fws_stats *fwstats = &(drvr_to_fws(bus_if->drvr)->stats);
2275 
2276 	seq_printf(seq,
2277 		   "header_pulls:      %u\n"
2278 		   "header_only_pkt:   %u\n"
2279 		   "tlv_parse_failed:  %u\n"
2280 		   "tlv_invalid_type:  %u\n"
2281 		   "mac_update_fails:  %u\n"
2282 		   "ps_update_fails:   %u\n"
2283 		   "if_update_fails:   %u\n"
2284 		   "pkt2bus:           %u\n"
2285 		   "generic_error:     %u\n"
2286 		   "rollback_success:  %u\n"
2287 		   "rollback_failed:   %u\n"
2288 		   "delayq_full:       %u\n"
2289 		   "supprq_full:       %u\n"
2290 		   "txs_indicate:      %u\n"
2291 		   "txs_discard:       %u\n"
2292 		   "txs_suppr_core:    %u\n"
2293 		   "txs_suppr_ps:      %u\n"
2294 		   "txs_tossed:        %u\n"
2295 		   "txs_host_tossed:   %u\n"
2296 		   "bus_flow_block:    %u\n"
2297 		   "fws_flow_block:    %u\n"
2298 		   "send_pkts:         BK:%u BE:%u VO:%u VI:%u BCMC:%u\n"
2299 		   "requested_sent:    BK:%u BE:%u VO:%u VI:%u BCMC:%u\n",
2300 		   fwstats->header_pulls,
2301 		   fwstats->header_only_pkt,
2302 		   fwstats->tlv_parse_failed,
2303 		   fwstats->tlv_invalid_type,
2304 		   fwstats->mac_update_failed,
2305 		   fwstats->mac_ps_update_failed,
2306 		   fwstats->if_update_failed,
2307 		   fwstats->pkt2bus,
2308 		   fwstats->generic_error,
2309 		   fwstats->rollback_success,
2310 		   fwstats->rollback_failed,
2311 		   fwstats->delayq_full_error,
2312 		   fwstats->supprq_full_error,
2313 		   fwstats->txs_indicate,
2314 		   fwstats->txs_discard,
2315 		   fwstats->txs_supp_core,
2316 		   fwstats->txs_supp_ps,
2317 		   fwstats->txs_tossed,
2318 		   fwstats->txs_host_tossed,
2319 		   fwstats->bus_flow_block,
2320 		   fwstats->fws_flow_block,
2321 		   fwstats->send_pkts[0], fwstats->send_pkts[1],
2322 		   fwstats->send_pkts[2], fwstats->send_pkts[3],
2323 		   fwstats->send_pkts[4],
2324 		   fwstats->requested_sent[0],
2325 		   fwstats->requested_sent[1],
2326 		   fwstats->requested_sent[2],
2327 		   fwstats->requested_sent[3],
2328 		   fwstats->requested_sent[4]);
2329 
2330 	return 0;
2331 }
2332 #else
2333 static int brcmf_debugfs_fws_stats_read(struct seq_file *seq, void *data)
2334 {
2335 	return 0;
2336 }
2337 #endif
2338 
2339 struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr)
2340 {
2341 	struct brcmf_fws_info *fws;
2342 	struct brcmf_if *ifp;
2343 	u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
2344 	int rc;
2345 	u32 mode;
2346 
2347 	fws = kzalloc(sizeof(*fws), GFP_KERNEL);
2348 	if (!fws) {
2349 		rc = -ENOMEM;
2350 		goto fail;
2351 	}
2352 
2353 	spin_lock_init(&fws->spinlock);
2354 
2355 	/* store drvr reference */
2356 	fws->drvr = drvr;
2357 	fws->fcmode = drvr->settings->fcmode;
2358 
2359 	if ((drvr->bus_if->always_use_fws_queue == false) &&
2360 	    (fws->fcmode == BRCMF_FWS_FCMODE_NONE)) {
2361 		fws->avoid_queueing = true;
2362 		brcmf_dbg(INFO, "FWS queueing will be avoided\n");
2363 		return fws;
2364 	}
2365 
2366 	fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
2367 	if (fws->fws_wq == NULL) {
2368 		brcmf_err("workqueue creation failed\n");
2369 		rc = -EBADF;
2370 		goto fail;
2371 	}
2372 	INIT_WORK(&fws->fws_dequeue_work, brcmf_fws_dequeue_worker);
2373 
2374 	/* enable firmware signalling if fcmode active */
2375 	if (fws->fcmode != BRCMF_FWS_FCMODE_NONE)
2376 		tlv |= BRCMF_FWS_FLAGS_XONXOFF_SIGNALS |
2377 		       BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS |
2378 		       BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE |
2379 		       BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE;
2380 
2381 	rc = brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
2382 				 brcmf_fws_notify_credit_map);
2383 	if (rc < 0) {
2384 		brcmf_err("register credit map handler failed\n");
2385 		goto fail;
2386 	}
2387 	rc = brcmf_fweh_register(drvr, BRCMF_E_BCMC_CREDIT_SUPPORT,
2388 				 brcmf_fws_notify_bcmc_credit_support);
2389 	if (rc < 0) {
2390 		brcmf_err("register bcmc credit handler failed\n");
2391 		brcmf_fweh_unregister(drvr, BRCMF_E_FIFO_CREDIT_MAP);
2392 		goto fail;
2393 	}
2394 
2395 	/* Setting the iovar may fail if feature is unsupported
2396 	 * so leave the rc as is so driver initialization can
2397 	 * continue. Set mode back to none indicating not enabled.
2398 	 */
2399 	fws->fw_signals = true;
2400 	ifp = brcmf_get_ifp(drvr, 0);
2401 	if (brcmf_fil_iovar_int_set(ifp, "tlv", tlv)) {
2402 		brcmf_err("failed to set bdcv2 tlv signaling\n");
2403 		fws->fcmode = BRCMF_FWS_FCMODE_NONE;
2404 		fws->fw_signals = false;
2405 	}
2406 
2407 	if (brcmf_fil_iovar_int_set(ifp, "ampdu_hostreorder", 1))
2408 		brcmf_dbg(INFO, "enabling AMPDU host-reorder failed\n");
2409 
2410 	/* Enable seq number reuse, if supported */
2411 	if (brcmf_fil_iovar_int_get(ifp, "wlfc_mode", &mode) == 0) {
2412 		if (BRCMF_FWS_MODE_GET_REUSESEQ(mode)) {
2413 			mode = 0;
2414 			BRCMF_FWS_MODE_SET_REUSESEQ(mode, 1);
2415 			if (brcmf_fil_iovar_int_set(ifp,
2416 						    "wlfc_mode", mode) == 0) {
2417 				BRCMF_FWS_MODE_SET_REUSESEQ(fws->mode, 1);
2418 			}
2419 		}
2420 	}
2421 
2422 	brcmf_fws_hanger_init(&fws->hanger);
2423 	brcmf_fws_macdesc_init(&fws->desc.other, NULL, 0);
2424 	brcmf_fws_macdesc_set_name(fws, &fws->desc.other);
2425 	brcmf_dbg(INFO, "added %s\n", fws->desc.other.name);
2426 	brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
2427 			BRCMF_FWS_PSQ_LEN);
2428 
2429 	brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
2430 		  fws->fw_signals ? "enabled" : "disabled", tlv);
2431 	return fws;
2432 
2433 fail:
2434 	brcmf_fws_detach(fws);
2435 	return ERR_PTR(rc);
2436 }
2437 
2438 void brcmf_fws_detach(struct brcmf_fws_info *fws)
2439 {
2440 	if (!fws)
2441 		return;
2442 
2443 	if (fws->fws_wq)
2444 		destroy_workqueue(fws->fws_wq);
2445 
2446 	/* cleanup */
2447 	brcmf_fws_lock(fws);
2448 	brcmf_fws_cleanup(fws, -1);
2449 	brcmf_fws_unlock(fws);
2450 
2451 	/* free top structure */
2452 	kfree(fws);
2453 }
2454 
2455 void brcmf_fws_debugfs_create(struct brcmf_pub *drvr)
2456 {
2457 	/* create debugfs file for statistics */
2458 	brcmf_debugfs_add_entry(drvr, "fws_stats",
2459 				brcmf_debugfs_fws_stats_read);
2460 }
2461 
2462 bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws)
2463 {
2464 	return !fws->avoid_queueing;
2465 }
2466 
2467 bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
2468 {
2469 	if (!fws->creditmap_received)
2470 		return false;
2471 
2472 	return fws->fcmode != BRCMF_FWS_FCMODE_NONE;
2473 }
2474 
2475 void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
2476 {
2477 	u32 hslot;
2478 
2479 	if (brcmf_skbcb(skb)->state == BRCMF_FWS_SKBSTATE_TIM) {
2480 		brcmu_pkt_buf_free_skb(skb);
2481 		return;
2482 	}
2483 	brcmf_fws_lock(fws);
2484 	hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
2485 	brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0,
2486 			      1);
2487 	brcmf_fws_unlock(fws);
2488 }
2489 
2490 void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
2491 {
2492 	struct brcmf_fws_info *fws = drvr_to_fws(drvr);
2493 	struct brcmf_if *ifp;
2494 	int i;
2495 
2496 	if (fws->avoid_queueing) {
2497 		for (i = 0; i < BRCMF_MAX_IFS; i++) {
2498 			ifp = drvr->iflist[i];
2499 			if (!ifp || !ifp->ndev)
2500 				continue;
2501 			brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
2502 					     flow_blocked);
2503 		}
2504 	} else {
2505 		fws->bus_flow_blocked = flow_blocked;
2506 		if (!flow_blocked)
2507 			brcmf_fws_schedule_deq(fws);
2508 		else
2509 			fws->stats.bus_flow_block++;
2510 	}
2511 }
2512