drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2014 Broadcom Corporation
   4  */
   5
   6 /*******************************************************************************
   7  * Communicates with the dongle by using dcmd codes.
   8  * For certain dcmd codes, the dongle interprets string data from the host.
   9  ******************************************************************************/
  10
  11 #include <linux/types.h>
  12 #include <linux/netdevice.h>
  13 #include <linux/etherdevice.h>
  14
  15 #include <brcmu_utils.h>
  16 #include <brcmu_wifi.h>
  17
  18 #include "core.h"
  19 #include "debug.h"
  20 #include "proto.h"
  21 #include "msgbuf.h"
  22 #include "commonring.h"
  23 #include "flowring.h"
  24 #include "bus.h"
  25 #include "tracepoint.h"
  26
  27
  28 #define MSGBUF_IOCTL_RESP_TIMEOUT               msecs_to_jiffies(2000)
  29
  30 #define MSGBUF_TYPE_GEN_STATUS                  0x1
  31 #define MSGBUF_TYPE_RING_STATUS                 0x2
  32 #define MSGBUF_TYPE_FLOW_RING_CREATE            0x3
  33 #define MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT      0x4
  34 #define MSGBUF_TYPE_FLOW_RING_DELETE            0x5
  35 #define MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT      0x6
  36 #define MSGBUF_TYPE_FLOW_RING_FLUSH             0x7
  37 #define MSGBUF_TYPE_FLOW_RING_FLUSH_CMPLT       0x8
  38 #define MSGBUF_TYPE_IOCTLPTR_REQ                0x9
  39 #define MSGBUF_TYPE_IOCTLPTR_REQ_ACK            0xA
  40 #define MSGBUF_TYPE_IOCTLRESP_BUF_POST          0xB
  41 #define MSGBUF_TYPE_IOCTL_CMPLT                 0xC
  42 #define MSGBUF_TYPE_EVENT_BUF_POST              0xD
  43 #define MSGBUF_TYPE_WL_EVENT                    0xE
  44 #define MSGBUF_TYPE_TX_POST                     0xF
  45 #define MSGBUF_TYPE_TX_STATUS                   0x10
  46 #define MSGBUF_TYPE_RXBUF_POST                  0x11
  47 #define MSGBUF_TYPE_RX_CMPLT                    0x12
  48 #define MSGBUF_TYPE_LPBK_DMAXFER                0x13
  49 #define MSGBUF_TYPE_LPBK_DMAXFER_CMPLT          0x14
  50
  51 #define NR_TX_PKTIDS                            2048
  52 #define NR_RX_PKTIDS                            1024
  53
  54 #define BRCMF_IOCTL_REQ_PKTID                   0xFFFE
  55
  56 #define BRCMF_MSGBUF_MAX_PKT_SIZE               2048
  57 #define BRCMF_MSGBUF_MAX_CTL_PKT_SIZE           8192
  58 #define BRCMF_MSGBUF_RXBUFPOST_THRESHOLD        32
  59 #define BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST      8
  60 #define BRCMF_MSGBUF_MAX_EVENTBUF_POST          8
  61
  62 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3      0x01
  63 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11     0x02
  64 #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK       0x07
  65 #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT       5
  66
  67 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
  68 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
  69
  70 #define BRCMF_MSGBUF_DELAY_TXWORKER_THRS        96
  71 #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS      32
  72 #define BRCMF_MSGBUF_UPDATE_RX_PTR_THRS         48
  73
  74
  75 struct msgbuf_common_hdr {
  76         u8                              msgtype;
  77         u8                              ifidx;
  78         u8                              flags;
  79         u8                              rsvd0;
  80         __le32                          request_id;
  81 };
  82
  83 struct msgbuf_ioctl_req_hdr {
  84         struct msgbuf_common_hdr        msg;
  85         __le32                          cmd;
  86         __le16                          trans_id;
  87         __le16                          input_buf_len;
  88         __le16                          output_buf_len;
  89         __le16                          rsvd0[3];
  90         struct msgbuf_buf_addr          req_buf_addr;
  91         __le32                          rsvd1[2];
  92 };
  93
  94 struct msgbuf_tx_msghdr {
  95         struct msgbuf_common_hdr        msg;
  96         u8                              txhdr[ETH_HLEN];
  97         u8                              flags;
  98         u8                              seg_cnt;
  99         struct msgbuf_buf_addr          metadata_buf_addr;
 100         struct msgbuf_buf_addr          data_buf_addr;
 101         __le16                          metadata_buf_len;
 102         __le16                          data_len;
 103         __le32                          rsvd0;
 104 };
 105
 106 struct msgbuf_rx_bufpost {
 107         struct msgbuf_common_hdr        msg;
 108         __le16                          metadata_buf_len;
 109         __le16                          data_buf_len;
 110         __le32                          rsvd0;
 111         struct msgbuf_buf_addr          metadata_buf_addr;
 112         struct msgbuf_buf_addr          data_buf_addr;
 113 };
 114
 115 struct msgbuf_rx_ioctl_resp_or_event {
 116         struct msgbuf_common_hdr        msg;
 117         __le16                          host_buf_len;
 118         __le16                          rsvd0[3];
 119         struct msgbuf_buf_addr          host_buf_addr;
 120         __le32                          rsvd1[4];
 121 };
 122
 123 struct msgbuf_completion_hdr {
 124         __le16                          status;
 125         __le16                          flow_ring_id;
 126 };
 127
 128 /* Data struct for the MSGBUF_TYPE_GEN_STATUS */
 129 struct msgbuf_gen_status {
 130         struct msgbuf_common_hdr        msg;
 131         struct msgbuf_completion_hdr    compl_hdr;
 132         __le16                          write_idx;
 133         __le32                          rsvd0[3];
 134 };
 135
 136 /* Data struct for the MSGBUF_TYPE_RING_STATUS */
 137 struct msgbuf_ring_status {
 138         struct msgbuf_common_hdr        msg;
 139         struct msgbuf_completion_hdr    compl_hdr;
 140         __le16                          write_idx;
 141         __le16                          rsvd0[5];
 142 };
 143
 144 struct msgbuf_rx_event {
 145         struct msgbuf_common_hdr        msg;
 146         struct msgbuf_completion_hdr    compl_hdr;
 147         __le16                          event_data_len;
 148         __le16                          seqnum;
 149         __le16                          rsvd0[4];
 150 };
 151
 152 struct msgbuf_ioctl_resp_hdr {
 153         struct msgbuf_common_hdr        msg;
 154         struct msgbuf_completion_hdr    compl_hdr;
 155         __le16                          resp_len;
 156         __le16                          trans_id;
 157         __le32                          cmd;
 158         __le32                          rsvd0;
 159 };
 160
 161 struct msgbuf_tx_status {
 162         struct msgbuf_common_hdr        msg;
 163         struct msgbuf_completion_hdr    compl_hdr;
 164         __le16                          metadata_len;
 165         __le16                          tx_status;
 166 };
 167
 168 struct msgbuf_rx_complete {
 169         struct msgbuf_common_hdr        msg;
 170         struct msgbuf_completion_hdr    compl_hdr;
 171         __le16                          metadata_len;
 172         __le16                          data_len;
 173         __le16                          data_offset;
 174         __le16                          flags;
 175         __le32                          rx_status_0;
 176         __le32                          rx_status_1;
 177         __le32                          rsvd0;
 178 };
 179
 180 struct msgbuf_tx_flowring_create_req {
 181         struct msgbuf_common_hdr        msg;
 182         u8                              da[ETH_ALEN];
 183         u8                              sa[ETH_ALEN];
 184         u8                              tid;
 185         u8                              if_flags;
 186         __le16                          flow_ring_id;
 187         u8                              tc;
 188         u8                              priority;
 189         __le16                          int_vector;
 190         __le16                          max_items;
 191         __le16                          len_item;
 192         struct msgbuf_buf_addr          flow_ring_addr;
 193 };
 194
 195 struct msgbuf_tx_flowring_delete_req {
 196         struct msgbuf_common_hdr        msg;
 197         __le16                          flow_ring_id;
 198         __le16                          reason;
 199         __le32                          rsvd0[7];
 200 };
 201
 202 struct msgbuf_flowring_create_resp {
 203         struct msgbuf_common_hdr        msg;
 204         struct msgbuf_completion_hdr    compl_hdr;
 205         __le32                          rsvd0[3];
 206 };
 207
 208 struct msgbuf_flowring_delete_resp {
 209         struct msgbuf_common_hdr        msg;
 210         struct msgbuf_completion_hdr    compl_hdr;
 211         __le32                          rsvd0[3];
 212 };
 213
 214 struct msgbuf_flowring_flush_resp {
 215         struct msgbuf_common_hdr        msg;
 216         struct msgbuf_completion_hdr    compl_hdr;
 217         __le32                          rsvd0[3];
 218 };
 219
 220 struct brcmf_msgbuf_work_item {
 221         struct list_head queue;
 222         u32 flowid;
 223         int ifidx;
 224         u8 sa[ETH_ALEN];
 225         u8 da[ETH_ALEN];
 226 };
 227
 228 struct brcmf_msgbuf {
 229         struct brcmf_pub *drvr;
 230
 231         struct brcmf_commonring **commonrings;
 232         struct brcmf_commonring **flowrings;
 233         dma_addr_t *flowring_dma_handle;
 234
 235         u16 max_flowrings;
 236         u16 max_submissionrings;
 237         u16 max_completionrings;
 238
 239         u16 rx_dataoffset;
 240         u32 max_rxbufpost;
 241         u16 rx_metadata_offset;
 242         u32 rxbufpost;
 243
 244         u32 max_ioctlrespbuf;
 245         u32 cur_ioctlrespbuf;
 246         u32 max_eventbuf;
 247         u32 cur_eventbuf;
 248
 249         void *ioctbuf;
 250         dma_addr_t ioctbuf_handle;
 251         u32 ioctbuf_phys_hi;
 252         u32 ioctbuf_phys_lo;
 253         int ioctl_resp_status;
 254         u32 ioctl_resp_ret_len;
 255         u32 ioctl_resp_pktid;
 256
 257         u16 data_seq_no;
 258         u16 ioctl_seq_no;
 259         u32 reqid;
 260         wait_queue_head_t ioctl_resp_wait;
 261         bool ctl_completed;
 262
 263         struct brcmf_msgbuf_pktids *tx_pktids;
 264         struct brcmf_msgbuf_pktids *rx_pktids;
 265         struct brcmf_flowring *flow;
 266
 267         struct workqueue_struct *txflow_wq;
 268         struct work_struct txflow_work;
 269         unsigned long *flow_map;
 270         unsigned long *txstatus_done_map;
 271
 272         struct work_struct flowring_work;
 273         spinlock_t flowring_work_lock;
 274         struct list_head work_queue;
 275 };
 276
 277 struct brcmf_msgbuf_pktid {
 278         atomic_t  allocated;
 279         u16 data_offset;
 280         struct sk_buff *skb;
 281         dma_addr_t physaddr;
 282 };
 283
 284 struct brcmf_msgbuf_pktids {
 285         u32 array_size;
 286         u32 last_allocated_idx;
 287         enum dma_data_direction direction;
 288         struct brcmf_msgbuf_pktid *array;
 289 };
 290
 291 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf);
 292
 293
 294 static struct brcmf_msgbuf_pktids *
 295 brcmf_msgbuf_init_pktids(u32 nr_array_entries,
 296                          enum dma_data_direction direction)
 297 {
 298         struct brcmf_msgbuf_pktid *array;
 299         struct brcmf_msgbuf_pktids *pktids;
 300
 301         array = kcalloc(nr_array_entries, sizeof(*array), GFP_KERNEL);
 302         if (!array)
 303                 return NULL;
 304
 305         pktids = kzalloc(sizeof(*pktids), GFP_KERNEL);
 306         if (!pktids) {
 307                 kfree(array);
 308                 return NULL;
 309         }
 310         pktids->array = array;
 311         pktids->array_size = nr_array_entries;
 312
 313         return pktids;
 314 }
 315
 316
 317 static int
 318 brcmf_msgbuf_alloc_pktid(struct device *dev,
 319                          struct brcmf_msgbuf_pktids *pktids,
 320                          struct sk_buff *skb, u16 data_offset,
 321                          dma_addr_t *physaddr, u32 *idx)
 322 {
 323         struct brcmf_msgbuf_pktid *array;
 324         u32 count;
 325
 326         array = pktids->array;
 327
 328         *physaddr = dma_map_single(dev, skb->data + data_offset,
 329                                    skb->len - data_offset, pktids->direction);
 330
 331         if (dma_mapping_error(dev, *physaddr)) {
 332                 brcmf_err("dma_map_single failed !!\n");
 333                 return -ENOMEM;
 334         }
 335
 336         *idx = pktids->last_allocated_idx;
 337
 338         count = 0;
 339         do {
 340                 (*idx)++;
 341                 if (*idx == pktids->array_size)
 342                         *idx = 0;
 343                 if (array[*idx].allocated.counter == 0)
 344                         if (atomic_cmpxchg(&array[*idx].allocated, 0, 1) == 0)
 345                                 break;
 346                 count++;
 347         } while (count < pktids->array_size);
 348
 349         if (count == pktids->array_size)
 350                 return -ENOMEM;
 351
 352         array[*idx].data_offset = data_offset;
 353         array[*idx].physaddr = *physaddr;
 354         array[*idx].skb = skb;
 355
 356         pktids->last_allocated_idx = *idx;
 357
 358         return 0;
 359 }
 360
 361
 362 static struct sk_buff *
 363 brcmf_msgbuf_get_pktid(struct device *dev, struct brcmf_msgbuf_pktids *pktids,
 364                        u32 idx)
 365 {
 366         struct brcmf_msgbuf_pktid *pktid;
 367         struct sk_buff *skb;
 368
 369         if (idx >= pktids->array_size) {
 370                 brcmf_err("Invalid packet id %d (max %d)\n", idx,
 371                           pktids->array_size);
 372                 return NULL;
 373         }
 374         if (pktids->array[idx].allocated.counter) {
 375                 pktid = &pktids->array[idx];
 376                 dma_unmap_single(dev, pktid->physaddr,
 377                                  pktid->skb->len - pktid->data_offset,
 378                                  pktids->direction);
 379                 skb = pktid->skb;
 380                 pktid->allocated.counter = 0;
 381                 return skb;
 382         } else {
 383                 brcmf_err("Invalid packet id %d (not in use)\n", idx);
 384         }
 385
 386         return NULL;
 387 }
 388
 389
 390 static void
 391 brcmf_msgbuf_release_array(struct device *dev,
 392                            struct brcmf_msgbuf_pktids *pktids)
 393 {
 394         struct brcmf_msgbuf_pktid *array;
 395         struct brcmf_msgbuf_pktid *pktid;
 396         u32 count;
 397
 398         array = pktids->array;
 399         count = 0;
 400         do {
 401                 if (array[count].allocated.counter) {
 402                         pktid = &array[count];
 403                         dma_unmap_single(dev, pktid->physaddr,
 404                                          pktid->skb->len - pktid->data_offset,
 405                                          pktids->direction);
 406                         brcmu_pkt_buf_free_skb(pktid->skb);
 407                 }
 408                 count++;
 409         } while (count < pktids->array_size);
 410
 411         kfree(array);
 412         kfree(pktids);
 413 }
 414
 415
 416 static void brcmf_msgbuf_release_pktids(struct brcmf_msgbuf *msgbuf)
 417 {
 418         if (msgbuf->rx_pktids)
 419                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 420                                            msgbuf->rx_pktids);
 421         if (msgbuf->tx_pktids)
 422                 brcmf_msgbuf_release_array(msgbuf->drvr->bus_if->dev,
 423                                            msgbuf->tx_pktids);
 424 }
 425
 426
 427 static int brcmf_msgbuf_tx_ioctl(struct brcmf_pub *drvr, int ifidx,
 428                                  uint cmd, void *buf, uint len)
 429 {
 430         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 431         struct brcmf_commonring *commonring;
 432         struct msgbuf_ioctl_req_hdr *request;
 433         u16 buf_len;
 434         void *ret_ptr;
 435         int err;
 436
 437         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 438         brcmf_commonring_lock(commonring);
 439         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 440         if (!ret_ptr) {
 441                 bphy_err(drvr, "Failed to reserve space in commonring\n");
 442                 brcmf_commonring_unlock(commonring);
 443                 return -ENOMEM;
 444         }
 445
 446         msgbuf->reqid++;
 447
 448         request = (struct msgbuf_ioctl_req_hdr *)ret_ptr;
 449         request->msg.msgtype = MSGBUF_TYPE_IOCTLPTR_REQ;
 450         request->msg.ifidx = (u8)ifidx;
 451         request->msg.flags = 0;
 452         request->msg.request_id = cpu_to_le32(BRCMF_IOCTL_REQ_PKTID);
 453         request->cmd = cpu_to_le32(cmd);
 454         request->output_buf_len = cpu_to_le16(len);
 455         request->trans_id = cpu_to_le16(msgbuf->reqid);
 456
 457         buf_len = min_t(u16, len, BRCMF_TX_IOCTL_MAX_MSG_SIZE);
 458         request->input_buf_len = cpu_to_le16(buf_len);
 459         request->req_buf_addr.high_addr = cpu_to_le32(msgbuf->ioctbuf_phys_hi);
 460         request->req_buf_addr.low_addr = cpu_to_le32(msgbuf->ioctbuf_phys_lo);
 461         if (buf)
 462                 memcpy(msgbuf->ioctbuf, buf, buf_len);
 463         else
 464                 memset(msgbuf->ioctbuf, 0, buf_len);
 465
 466         err = brcmf_commonring_write_complete(commonring);
 467         brcmf_commonring_unlock(commonring);
 468
 469         return err;
 470 }
 471
 472
 473 static int brcmf_msgbuf_ioctl_resp_wait(struct brcmf_msgbuf *msgbuf)
 474 {
 475         return wait_event_timeout(msgbuf->ioctl_resp_wait,
 476                                   msgbuf->ctl_completed,
 477                                   MSGBUF_IOCTL_RESP_TIMEOUT);
 478 }
 479
 480
 481 static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
 482 {
 483         msgbuf->ctl_completed = true;
 484         wake_up(&msgbuf->ioctl_resp_wait);
 485 }
 486
 487
 488 static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 489                                    uint cmd, void *buf, uint len, int *fwerr)
 490 {
 491         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 492         struct sk_buff *skb = NULL;
 493         int timeout;
 494         int err;
 495
 496         brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
 497         *fwerr = 0;
 498         msgbuf->ctl_completed = false;
 499         err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
 500         if (err)
 501                 return err;
 502
 503         timeout = brcmf_msgbuf_ioctl_resp_wait(msgbuf);
 504         if (!timeout) {
 505                 bphy_err(drvr, "Timeout on response for query command\n");
 506                 return -EIO;
 507         }
 508
 509         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 510                                      msgbuf->rx_pktids,
 511                                      msgbuf->ioctl_resp_pktid);
 512         if (msgbuf->ioctl_resp_ret_len != 0) {
 513                 if (!skb)
 514                         return -EBADF;
 515
 516                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
 517                                        len : msgbuf->ioctl_resp_ret_len);
 518         }
 519         brcmu_pkt_buf_free_skb(skb);
 520
 521         *fwerr = msgbuf->ioctl_resp_status;
 522         return 0;
 523 }
 524
 525
 526 static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
 527                                  uint cmd, void *buf, uint len, int *fwerr)
 528 {
 529         return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
 530 }
 531
 532
 533 static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 534                                 struct sk_buff *skb, struct brcmf_if **ifp)
 535 {
 536         return -ENODEV;
 537 }
 538
 539 static void brcmf_msgbuf_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb,
 540                                    bool inirq)
 541 {
 542 }
 543
 544 static void
 545 brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
 546 {
 547         u32 dma_sz;
 548         void *dma_buf;
 549
 550         brcmf_dbg(MSGBUF, "Removing flowring %d\n", flowid);
 551
 552         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 553         dma_buf = msgbuf->flowrings[flowid]->buf_addr;
 554         dma_free_coherent(msgbuf->drvr->bus_if->dev, dma_sz, dma_buf,
 555                           msgbuf->flowring_dma_handle[flowid]);
 556
 557         brcmf_flowring_delete(msgbuf->flow, flowid);
 558 }
 559
 560
 561 static struct brcmf_msgbuf_work_item *
 562 brcmf_msgbuf_dequeue_work(struct brcmf_msgbuf *msgbuf)
 563 {
 564         struct brcmf_msgbuf_work_item *work = NULL;
 565         ulong flags;
 566
 567         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 568         if (!list_empty(&msgbuf->work_queue)) {
 569                 work = list_first_entry(&msgbuf->work_queue,
 570                                         struct brcmf_msgbuf_work_item, queue);
 571                 list_del(&work->queue);
 572         }
 573         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 574
 575         return work;
 576 }
 577
 578
 579 static u32
 580 brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
 581                                     struct brcmf_msgbuf_work_item *work)
 582 {
 583         struct brcmf_pub *drvr = msgbuf->drvr;
 584         struct msgbuf_tx_flowring_create_req *create;
 585         struct brcmf_commonring *commonring;
 586         void *ret_ptr;
 587         u32 flowid;
 588         void *dma_buf;
 589         u32 dma_sz;
 590         u64 address;
 591         int err;
 592
 593         flowid = work->flowid;
 594         dma_sz = BRCMF_H2D_TXFLOWRING_MAX_ITEM * BRCMF_H2D_TXFLOWRING_ITEMSIZE;
 595         dma_buf = dma_alloc_coherent(msgbuf->drvr->bus_if->dev, dma_sz,
 596                                      &msgbuf->flowring_dma_handle[flowid],
 597                                      GFP_KERNEL);
 598         if (!dma_buf) {
 599                 bphy_err(drvr, "dma_alloc_coherent failed\n");
 600                 brcmf_flowring_delete(msgbuf->flow, flowid);
 601                 return BRCMF_FLOWRING_INVALID_ID;
 602         }
 603
 604         brcmf_commonring_config(msgbuf->flowrings[flowid],
 605                                 BRCMF_H2D_TXFLOWRING_MAX_ITEM,
 606                                 BRCMF_H2D_TXFLOWRING_ITEMSIZE, dma_buf);
 607
 608         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
 609         brcmf_commonring_lock(commonring);
 610         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 611         if (!ret_ptr) {
 612                 bphy_err(drvr, "Failed to reserve space in commonring\n");
 613                 brcmf_commonring_unlock(commonring);
 614                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 615                 return BRCMF_FLOWRING_INVALID_ID;
 616         }
 617
 618         create = (struct msgbuf_tx_flowring_create_req *)ret_ptr;
 619         create->msg.msgtype = MSGBUF_TYPE_FLOW_RING_CREATE;
 620         create->msg.ifidx = work->ifidx;
 621         create->msg.request_id = 0;
 622         create->tid = brcmf_flowring_tid(msgbuf->flow, flowid);
 623         create->flow_ring_id = cpu_to_le16(flowid +
 624                                            BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
 625         memcpy(create->sa, work->sa, ETH_ALEN);
 626         memcpy(create->da, work->da, ETH_ALEN);
 627         address = (u64)msgbuf->flowring_dma_handle[flowid];
 628         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
 629         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
 630         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
 631         create->len_item = cpu_to_le16(BRCMF_H2D_TXFLOWRING_ITEMSIZE);
 632
 633         brcmf_dbg(MSGBUF, "Send Flow Create Req flow ID %d for peer %pM prio %d ifindex %d\n",
 634                   flowid, work->da, create->tid, work->ifidx);
 635
 636         err = brcmf_commonring_write_complete(commonring);
 637         brcmf_commonring_unlock(commonring);
 638         if (err) {
 639                 bphy_err(drvr, "Failed to write commonring\n");
 640                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
 641                 return BRCMF_FLOWRING_INVALID_ID;
 642         }
 643
 644         return flowid;
 645 }
 646
 647
 648 static void brcmf_msgbuf_flowring_worker(struct work_struct *work)
 649 {
 650         struct brcmf_msgbuf *msgbuf;
 651         struct brcmf_msgbuf_work_item *create;
 652
 653         msgbuf = container_of(work, struct brcmf_msgbuf, flowring_work);
 654
 655         while ((create = brcmf_msgbuf_dequeue_work(msgbuf))) {
 656                 brcmf_msgbuf_flowring_create_worker(msgbuf, create);
 657                 kfree(create);
 658         }
 659 }
 660
 661
 662 static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 663                                         struct sk_buff *skb)
 664 {
 665         struct brcmf_msgbuf_work_item *create;
 666         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 667         u32 flowid;
 668         ulong flags;
 669
 670         create = kzalloc(sizeof(*create), GFP_ATOMIC);
 671         if (create == NULL)
 672                 return BRCMF_FLOWRING_INVALID_ID;
 673
 674         flowid = brcmf_flowring_create(msgbuf->flow, eh->h_dest,
 675                                        skb->priority, ifidx);
 676         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 677                 kfree(create);
 678                 return flowid;
 679         }
 680
 681         create->flowid = flowid;
 682         create->ifidx = ifidx;
 683         memcpy(create->sa, eh->h_source, ETH_ALEN);
 684         memcpy(create->da, eh->h_dest, ETH_ALEN);
 685
 686         spin_lock_irqsave(&msgbuf->flowring_work_lock, flags);
 687         list_add_tail(&create->queue, &msgbuf->work_queue);
 688         spin_unlock_irqrestore(&msgbuf->flowring_work_lock, flags);
 689         schedule_work(&msgbuf->flowring_work);
 690
 691         return flowid;
 692 }
 693
 694
 695 static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
 696 {
 697         struct brcmf_flowring *flow = msgbuf->flow;
 698         struct brcmf_pub *drvr = msgbuf->drvr;
 699         struct brcmf_commonring *commonring;
 700         void *ret_ptr;
 701         u32 count;
 702         struct sk_buff *skb;
 703         dma_addr_t physaddr;
 704         u32 pktid;
 705         struct msgbuf_tx_msghdr *tx_msghdr;
 706         u64 address;
 707
 708         commonring = msgbuf->flowrings[flowid];
 709         if (!brcmf_commonring_write_available(commonring))
 710                 return;
 711
 712         brcmf_commonring_lock(commonring);
 713
 714         count = BRCMF_MSGBUF_TX_FLUSH_CNT2 - BRCMF_MSGBUF_TX_FLUSH_CNT1;
 715         while (brcmf_flowring_qlen(flow, flowid)) {
 716                 skb = brcmf_flowring_dequeue(flow, flowid);
 717                 if (skb == NULL) {
 718                         bphy_err(drvr, "No SKB, but qlen %d\n",
 719                                  brcmf_flowring_qlen(flow, flowid));
 720                         break;
 721                 }
 722                 skb_orphan(skb);
 723                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 724                                              msgbuf->tx_pktids, skb, ETH_HLEN,
 725                                              &physaddr, &pktid)) {
 726                         brcmf_flowring_reinsert(flow, flowid, skb);
 727                         bphy_err(drvr, "No PKTID available !!\n");
 728                         break;
 729                 }
 730                 ret_ptr = brcmf_commonring_reserve_for_write(commonring);
 731                 if (!ret_ptr) {
 732                         brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 733                                                msgbuf->tx_pktids, pktid);
 734                         brcmf_flowring_reinsert(flow, flowid, skb);
 735                         break;
 736                 }
 737                 count++;
 738
 739                 tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
 740
 741                 tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
 742                 tx_msghdr->msg.request_id = cpu_to_le32(pktid + 1);
 743                 tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
 744                 tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
 745                 tx_msghdr->flags |= (skb->priority & 0x07) <<
 746                                     BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT;
 747                 tx_msghdr->seg_cnt = 1;
 748                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
 749                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
 750                 address = (u64)physaddr;
 751                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
 752                 tx_msghdr->data_buf_addr.low_addr =
 753                         cpu_to_le32(address & 0xffffffff);
 754                 tx_msghdr->metadata_buf_len = 0;
 755                 tx_msghdr->metadata_buf_addr.high_addr = 0;
 756                 tx_msghdr->metadata_buf_addr.low_addr = 0;
 757                 atomic_inc(&commonring->outstanding_tx);
 758                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
 759                         brcmf_commonring_write_complete(commonring);
 760                         count = 0;
 761                 }
 762         }
 763         if (count)
 764                 brcmf_commonring_write_complete(commonring);
 765         brcmf_commonring_unlock(commonring);
 766 }
 767
 768
 769 static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 770 {
 771         struct brcmf_msgbuf *msgbuf;
 772         u32 flowid;
 773
 774         msgbuf = container_of(worker, struct brcmf_msgbuf, txflow_work);
 775         for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->max_flowrings) {
 776                 clear_bit(flowid, msgbuf->flow_map);
 777                 brcmf_msgbuf_txflow(msgbuf, flowid);
 778         }
 779 }
 780
 781
 782 static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid,
 783                                         bool force)
 784 {
 785         struct brcmf_commonring *commonring;
 786
 787         set_bit(flowid, msgbuf->flow_map);
 788         commonring = msgbuf->flowrings[flowid];
 789         if ((force) || (atomic_read(&commonring->outstanding_tx) <
 790                         BRCMF_MSGBUF_DELAY_TXWORKER_THRS))
 791                 queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 792
 793         return 0;
 794 }
 795
 796
 797 static int brcmf_msgbuf_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
 798                                       struct sk_buff *skb)
 799 {
 800         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 801         struct brcmf_flowring *flow = msgbuf->flow;
 802         struct ethhdr *eh = (struct ethhdr *)(skb->data);
 803         u32 flowid;
 804         u32 queue_count;
 805         bool force;
 806
 807         flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
 808         if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 809                 flowid = brcmf_msgbuf_flowring_create(msgbuf, ifidx, skb);
 810                 if (flowid == BRCMF_FLOWRING_INVALID_ID)
 811                         return -ENOMEM;
 812         }
 813         queue_count = brcmf_flowring_enqueue(flow, flowid, skb);
 814         force = ((queue_count % BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) == 0);
 815         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, force);
 816
 817         return 0;
 818 }
 819
 820
 821 static void
 822 brcmf_msgbuf_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
 823                                  enum proto_addr_mode addr_mode)
 824 {
 825         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 826
 827         brcmf_flowring_configure_addr_mode(msgbuf->flow, ifidx, addr_mode);
 828 }
 829
 830
 831 static void
 832 brcmf_msgbuf_delete_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 833 {
 834         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 835
 836         brcmf_flowring_delete_peer(msgbuf->flow, ifidx, peer);
 837 }
 838
 839
 840 static void
 841 brcmf_msgbuf_add_tdls_peer(struct brcmf_pub *drvr, int ifidx, u8 peer[ETH_ALEN])
 842 {
 843         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 844
 845         brcmf_flowring_add_tdls_peer(msgbuf->flow, ifidx, peer);
 846 }
 847
 848
 849 static void
 850 brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 851 {
 852         struct msgbuf_ioctl_resp_hdr *ioctl_resp;
 853
 854         ioctl_resp = (struct msgbuf_ioctl_resp_hdr *)buf;
 855
 856         msgbuf->ioctl_resp_status =
 857                         (s16)le16_to_cpu(ioctl_resp->compl_hdr.status);
 858         msgbuf->ioctl_resp_ret_len = le16_to_cpu(ioctl_resp->resp_len);
 859         msgbuf->ioctl_resp_pktid = le32_to_cpu(ioctl_resp->msg.request_id);
 860
 861         brcmf_msgbuf_ioctl_resp_wake(msgbuf);
 862
 863         if (msgbuf->cur_ioctlrespbuf)
 864                 msgbuf->cur_ioctlrespbuf--;
 865         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
 866 }
 867
 868
 869 static void
 870 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 871 {
 872         struct brcmf_commonring *commonring;
 873         struct msgbuf_tx_status *tx_status;
 874         u32 idx;
 875         struct sk_buff *skb;
 876         u16 flowid;
 877
 878         tx_status = (struct msgbuf_tx_status *)buf;
 879         idx = le32_to_cpu(tx_status->msg.request_id) - 1;
 880         flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
 881         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
 882         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 883                                      msgbuf->tx_pktids, idx);
 884         if (!skb)
 885                 return;
 886
 887         set_bit(flowid, msgbuf->txstatus_done_map);
 888         commonring = msgbuf->flowrings[flowid];
 889         atomic_dec(&commonring->outstanding_tx);
 890
 891         brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
 892                          skb, true);
 893 }
 894
 895
 896 static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
 897 {
 898         struct brcmf_pub *drvr = msgbuf->drvr;
 899         struct brcmf_commonring *commonring;
 900         void *ret_ptr;
 901         struct sk_buff *skb;
 902         u16 alloced;
 903         u32 pktlen;
 904         dma_addr_t physaddr;
 905         struct msgbuf_rx_bufpost *rx_bufpost;
 906         u64 address;
 907         u32 pktid;
 908         u32 i;
 909
 910         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
 911         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
 912                                                               count,
 913                                                               &alloced);
 914         if (!ret_ptr) {
 915                 brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
 916                 return 0;
 917         }
 918
 919         for (i = 0; i < alloced; i++) {
 920                 rx_bufpost = (struct msgbuf_rx_bufpost *)ret_ptr;
 921                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
 922
 923                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
 924
 925                 if (skb == NULL) {
 926                         bphy_err(drvr, "Failed to alloc SKB\n");
 927                         brcmf_commonring_write_cancel(commonring, alloced - i);
 928                         break;
 929                 }
 930
 931                 pktlen = skb->len;
 932                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
 933                                              msgbuf->rx_pktids, skb, 0,
 934                                              &physaddr, &pktid)) {
 935                         dev_kfree_skb_any(skb);
 936                         bphy_err(drvr, "No PKTID available !!\n");
 937                         brcmf_commonring_write_cancel(commonring, alloced - i);
 938                         break;
 939                 }
 940
 941                 if (msgbuf->rx_metadata_offset) {
 942                         address = (u64)physaddr;
 943                         rx_bufpost->metadata_buf_len =
 944                                 cpu_to_le16(msgbuf->rx_metadata_offset);
 945                         rx_bufpost->metadata_buf_addr.high_addr =
 946                                 cpu_to_le32(address >> 32);
 947                         rx_bufpost->metadata_buf_addr.low_addr =
 948                                 cpu_to_le32(address & 0xffffffff);
 949
 950                         skb_pull(skb, msgbuf->rx_metadata_offset);
 951                         pktlen = skb->len;
 952                         physaddr += msgbuf->rx_metadata_offset;
 953                 }
 954                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
 955                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 956
 957                 address = (u64)physaddr;
 958                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
 959                 rx_bufpost->data_buf_addr.high_addr =
 960                         cpu_to_le32(address >> 32);
 961                 rx_bufpost->data_buf_addr.low_addr =
 962                         cpu_to_le32(address & 0xffffffff);
 963
 964                 ret_ptr += brcmf_commonring_len_item(commonring);
 965         }
 966
 967         if (i)
 968                 brcmf_commonring_write_complete(commonring);
 969
 970         return i;
 971 }
 972
 973
 974 static void
 975 brcmf_msgbuf_rxbuf_data_fill(struct brcmf_msgbuf *msgbuf)
 976 {
 977         u32 fillbufs;
 978         u32 retcount;
 979
 980         fillbufs = msgbuf->max_rxbufpost - msgbuf->rxbufpost;
 981
 982         while (fillbufs) {
 983                 retcount = brcmf_msgbuf_rxbuf_data_post(msgbuf, fillbufs);
 984                 if (!retcount)
 985                         break;
 986                 msgbuf->rxbufpost += retcount;
 987                 fillbufs -= retcount;
 988         }
 989 }
 990
 991
 992 static void
 993 brcmf_msgbuf_update_rxbufpost_count(struct brcmf_msgbuf *msgbuf, u16 rxcnt)
 994 {
 995         msgbuf->rxbufpost -= rxcnt;
 996         if (msgbuf->rxbufpost <= (msgbuf->max_rxbufpost -
 997                                   BRCMF_MSGBUF_RXBUFPOST_THRESHOLD))
 998                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
 999 }
1000
1001
1002 static u32
1003 brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
1004                              u32 count)
1005 {
1006         struct brcmf_pub *drvr = msgbuf->drvr;
1007         struct brcmf_commonring *commonring;
1008         void *ret_ptr;
1009         struct sk_buff *skb;
1010         u16 alloced;
1011         u32 pktlen;
1012         dma_addr_t physaddr;
1013         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
1014         u64 address;
1015         u32 pktid;
1016         u32 i;
1017
1018         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1019         brcmf_commonring_lock(commonring);
1020         ret_ptr = brcmf_commonring_reserve_for_write_multiple(commonring,
1021                                                               count,
1022                                                               &alloced);
1023         if (!ret_ptr) {
1024                 bphy_err(drvr, "Failed to reserve space in commonring\n");
1025                 brcmf_commonring_unlock(commonring);
1026                 return 0;
1027         }
1028
1029         for (i = 0; i < alloced; i++) {
1030                 rx_bufpost = (struct msgbuf_rx_ioctl_resp_or_event *)ret_ptr;
1031                 memset(rx_bufpost, 0, sizeof(*rx_bufpost));
1032
1033                 skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_CTL_PKT_SIZE);
1034
1035                 if (skb == NULL) {
1036                         bphy_err(drvr, "Failed to alloc SKB\n");
1037                         brcmf_commonring_write_cancel(commonring, alloced - i);
1038                         break;
1039                 }
1040
1041                 pktlen = skb->len;
1042                 if (brcmf_msgbuf_alloc_pktid(msgbuf->drvr->bus_if->dev,
1043                                              msgbuf->rx_pktids, skb, 0,
1044                                              &physaddr, &pktid)) {
1045                         dev_kfree_skb_any(skb);
1046                         bphy_err(drvr, "No PKTID available !!\n");
1047                         brcmf_commonring_write_cancel(commonring, alloced - i);
1048                         break;
1049                 }
1050                 if (event_buf)
1051                         rx_bufpost->msg.msgtype = MSGBUF_TYPE_EVENT_BUF_POST;
1052                 else
1053                         rx_bufpost->msg.msgtype =
1054                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
1055                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
1056
1057                 address = (u64)physaddr;
1058                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
1059                 rx_bufpost->host_buf_addr.high_addr =
1060                         cpu_to_le32(address >> 32);
1061                 rx_bufpost->host_buf_addr.low_addr =
1062                         cpu_to_le32(address & 0xffffffff);
1063
1064                 ret_ptr += brcmf_commonring_len_item(commonring);
1065         }
1066
1067         if (i)
1068                 brcmf_commonring_write_complete(commonring);
1069
1070         brcmf_commonring_unlock(commonring);
1071
1072         return i;
1073 }
1074
1075
1076 static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf)
1077 {
1078         u32 count;
1079
1080         count = msgbuf->max_ioctlrespbuf - msgbuf->cur_ioctlrespbuf;
1081         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, false, count);
1082         msgbuf->cur_ioctlrespbuf += count;
1083 }
1084
1085
1086 static void brcmf_msgbuf_rxbuf_event_post(struct brcmf_msgbuf *msgbuf)
1087 {
1088         u32 count;
1089
1090         count = msgbuf->max_eventbuf - msgbuf->cur_eventbuf;
1091         count = brcmf_msgbuf_rxbuf_ctrl_post(msgbuf, true, count);
1092         msgbuf->cur_eventbuf += count;
1093 }
1094
1095
1096 static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
1097 {
1098         struct brcmf_pub *drvr = msgbuf->drvr;
1099         struct msgbuf_rx_event *event;
1100         u32 idx;
1101         u16 buflen;
1102         struct sk_buff *skb;
1103         struct brcmf_if *ifp;
1104
1105         event = (struct msgbuf_rx_event *)buf;
1106         idx = le32_to_cpu(event->msg.request_id);
1107         buflen = le16_to_cpu(event->event_data_len);
1108
1109         if (msgbuf->cur_eventbuf)
1110                 msgbuf->cur_eventbuf--;
1111         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1112
1113         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1114                                      msgbuf->rx_pktids, idx);
1115         if (!skb)
1116                 return;
1117
1118         if (msgbuf->rx_dataoffset)
1119                 skb_pull(skb, msgbuf->rx_dataoffset);
1120
1121         skb_trim(skb, buflen);
1122
1123         ifp = brcmf_get_ifp(msgbuf->drvr, event->msg.ifidx);
1124         if (!ifp || !ifp->ndev) {
1125                 bphy_err(drvr, "Received pkt for invalid ifidx %d\n",
1126                          event->msg.ifidx);
1127                 goto exit;
1128         }
1129
1130         skb->protocol = eth_type_trans(skb, ifp->ndev);
1131
1132         brcmf_fweh_process_skb(ifp->drvr, skb, 0, GFP_KERNEL);
1133
1134 exit:
1135         brcmu_pkt_buf_free_skb(skb);
1136 }
1137
1138
1139 static void
1140 brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
1141 {
1142         struct brcmf_pub *drvr = msgbuf->drvr;
1143         struct msgbuf_rx_complete *rx_complete;
1144         struct sk_buff *skb;
1145         u16 data_offset;
1146         u16 buflen;
1147         u16 flags;
1148         u32 idx;
1149         struct brcmf_if *ifp;
1150
1151         brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1);
1152
1153         rx_complete = (struct msgbuf_rx_complete *)buf;
1154         data_offset = le16_to_cpu(rx_complete->data_offset);
1155         buflen = le16_to_cpu(rx_complete->data_len);
1156         idx = le32_to_cpu(rx_complete->msg.request_id);
1157         flags = le16_to_cpu(rx_complete->flags);
1158
1159         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
1160                                      msgbuf->rx_pktids, idx);
1161         if (!skb)
1162                 return;
1163
1164         if (data_offset)
1165                 skb_pull(skb, data_offset);
1166         else if (msgbuf->rx_dataoffset)
1167                 skb_pull(skb, msgbuf->rx_dataoffset);
1168
1169         skb_trim(skb, buflen);
1170
1171         if ((flags & BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK) ==
1172             BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11) {
1173                 ifp = msgbuf->drvr->mon_if;
1174
1175                 if (!ifp) {
1176                         bphy_err(drvr, "Received unexpected monitor pkt\n");
1177                         brcmu_pkt_buf_free_skb(skb);
1178                         return;
1179                 }
1180
1181                 brcmf_netif_mon_rx(ifp, skb);
1182                 return;
1183         }
1184
1185         ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
1186         if (!ifp || !ifp->ndev) {
1187                 bphy_err(drvr, "Received pkt for invalid ifidx %d\n",
1188                          rx_complete->msg.ifidx);
1189                 brcmu_pkt_buf_free_skb(skb);
1190                 return;
1191         }
1192
1193         skb->protocol = eth_type_trans(skb, ifp->ndev);
1194         brcmf_netif_rx(ifp, skb, false);
1195 }
1196
1197 static void brcmf_msgbuf_process_gen_status(struct brcmf_msgbuf *msgbuf,
1198                                             void *buf)
1199 {
1200         struct msgbuf_gen_status *gen_status = buf;
1201         struct brcmf_pub *drvr = msgbuf->drvr;
1202         int err;
1203
1204         err = le16_to_cpu(gen_status->compl_hdr.status);
1205         if (err)
1206                 bphy_err(drvr, "Firmware reported general error: %d\n", err);
1207 }
1208
1209 static void brcmf_msgbuf_process_ring_status(struct brcmf_msgbuf *msgbuf,
1210                                              void *buf)
1211 {
1212         struct msgbuf_ring_status *ring_status = buf;
1213         struct brcmf_pub *drvr = msgbuf->drvr;
1214         int err;
1215
1216         err = le16_to_cpu(ring_status->compl_hdr.status);
1217         if (err) {
1218                 int ring = le16_to_cpu(ring_status->compl_hdr.flow_ring_id);
1219
1220                 bphy_err(drvr, "Firmware reported ring %d error: %d\n", ring,
1221                          err);
1222         }
1223 }
1224
1225 static void
1226 brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
1227                                                void *buf)
1228 {
1229         struct brcmf_pub *drvr = msgbuf->drvr;
1230         struct msgbuf_flowring_create_resp *flowring_create_resp;
1231         u16 status;
1232         u16 flowid;
1233
1234         flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
1235
1236         flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
1237         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
1238         status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
1239
1240         if (status) {
1241                 bphy_err(drvr, "Flowring creation failed, code %d\n", status);
1242                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1243                 return;
1244         }
1245         brcmf_dbg(MSGBUF, "Flowring %d Create response status %d\n", flowid,
1246                   status);
1247
1248         brcmf_flowring_open(msgbuf->flow, flowid);
1249
1250         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1251 }
1252
1253
1254 static void
1255 brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
1256                                                void *buf)
1257 {
1258         struct brcmf_pub *drvr = msgbuf->drvr;
1259         struct msgbuf_flowring_delete_resp *flowring_delete_resp;
1260         u16 status;
1261         u16 flowid;
1262
1263         flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
1264
1265         flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
1266         flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
1267         status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
1268
1269         if (status) {
1270                 bphy_err(drvr, "Flowring deletion failed, code %d\n", status);
1271                 brcmf_flowring_delete(msgbuf->flow, flowid);
1272                 return;
1273         }
1274         brcmf_dbg(MSGBUF, "Flowring %d Delete response status %d\n", flowid,
1275                   status);
1276
1277         brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1278 }
1279
1280
1281 static void brcmf_msgbuf_process_msgtype(struct brcmf_msgbuf *msgbuf, void *buf)
1282 {
1283         struct brcmf_pub *drvr = msgbuf->drvr;
1284         struct msgbuf_common_hdr *msg;
1285
1286         msg = (struct msgbuf_common_hdr *)buf;
1287         switch (msg->msgtype) {
1288         case MSGBUF_TYPE_GEN_STATUS:
1289                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_GEN_STATUS\n");
1290                 brcmf_msgbuf_process_gen_status(msgbuf, buf);
1291                 break;
1292         case MSGBUF_TYPE_RING_STATUS:
1293                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RING_STATUS\n");
1294                 brcmf_msgbuf_process_ring_status(msgbuf, buf);
1295                 break;
1296         case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
1297                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
1298                 brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);
1299                 break;
1300         case MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT:
1301                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_DELETE_CMPLT\n");
1302                 brcmf_msgbuf_process_flow_ring_delete_response(msgbuf, buf);
1303                 break;
1304         case MSGBUF_TYPE_IOCTLPTR_REQ_ACK:
1305                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTLPTR_REQ_ACK\n");
1306                 break;
1307         case MSGBUF_TYPE_IOCTL_CMPLT:
1308                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_IOCTL_CMPLT\n");
1309                 brcmf_msgbuf_process_ioctl_complete(msgbuf, buf);
1310                 break;
1311         case MSGBUF_TYPE_WL_EVENT:
1312                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_WL_EVENT\n");
1313                 brcmf_msgbuf_process_event(msgbuf, buf);
1314                 break;
1315         case MSGBUF_TYPE_TX_STATUS:
1316                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_TX_STATUS\n");
1317                 brcmf_msgbuf_process_txstatus(msgbuf, buf);
1318                 break;
1319         case MSGBUF_TYPE_RX_CMPLT:
1320                 brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RX_CMPLT\n");
1321                 brcmf_msgbuf_process_rx_complete(msgbuf, buf);
1322                 break;
1323         default:
1324                 bphy_err(drvr, "Unsupported msgtype %d\n", msg->msgtype);
1325                 break;
1326         }
1327 }
1328
1329
1330 static void brcmf_msgbuf_process_rx(struct brcmf_msgbuf *msgbuf,
1331                                     struct brcmf_commonring *commonring)
1332 {
1333         void *buf;
1334         u16 count;
1335         u16 processed;
1336
1337 again:
1338         buf = brcmf_commonring_get_read_ptr(commonring, &count);
1339         if (buf == NULL)
1340                 return;
1341
1342         processed = 0;
1343         while (count) {
1344                 brcmf_msgbuf_process_msgtype(msgbuf,
1345                                              buf + msgbuf->rx_dataoffset);
1346                 buf += brcmf_commonring_len_item(commonring);
1347                 processed++;
1348                 if (processed == BRCMF_MSGBUF_UPDATE_RX_PTR_THRS) {
1349                         brcmf_commonring_read_complete(commonring, processed);
1350                         processed = 0;
1351                 }
1352                 count--;
1353         }
1354         if (processed)
1355                 brcmf_commonring_read_complete(commonring, processed);
1356
1357         if (commonring->r_ptr == 0)
1358                 goto again;
1359 }
1360
1361
1362 int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
1363 {
1364         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1365         struct brcmf_pub *drvr = bus_if->drvr;
1366         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1367         struct brcmf_commonring *commonring;
1368         void *buf;
1369         u32 flowid;
1370         int qlen;
1371
1372         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1373         brcmf_msgbuf_process_rx(msgbuf, buf);
1374         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1375         brcmf_msgbuf_process_rx(msgbuf, buf);
1376         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1377         brcmf_msgbuf_process_rx(msgbuf, buf);
1378
1379         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
1380                          msgbuf->max_flowrings) {
1381                 clear_bit(flowid, msgbuf->txstatus_done_map);
1382                 commonring = msgbuf->flowrings[flowid];
1383                 qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
1384                 if ((qlen > BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) ||
1385                     ((qlen) && (atomic_read(&commonring->outstanding_tx) <
1386                                 BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS)))
1387                         brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
1388         }
1389
1390         return 0;
1391 }
1392
1393
1394 void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
1395 {
1396         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1397         struct msgbuf_tx_flowring_delete_req *delete;
1398         struct brcmf_commonring *commonring;
1399         void *ret_ptr;
1400         u8 ifidx;
1401         int err;
1402
1403         /* no need to submit if firmware can not be reached */
1404         if (drvr->bus_if->state != BRCMF_BUS_UP) {
1405                 brcmf_dbg(MSGBUF, "bus down, flowring will be removed\n");
1406                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1407                 return;
1408         }
1409
1410         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1411         brcmf_commonring_lock(commonring);
1412         ret_ptr = brcmf_commonring_reserve_for_write(commonring);
1413         if (!ret_ptr) {
1414                 bphy_err(drvr, "FW unaware, flowring will be removed !!\n");
1415                 brcmf_commonring_unlock(commonring);
1416                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1417                 return;
1418         }
1419
1420         delete = (struct msgbuf_tx_flowring_delete_req *)ret_ptr;
1421
1422         ifidx = brcmf_flowring_ifidx_get(msgbuf->flow, flowid);
1423
1424         delete->msg.msgtype = MSGBUF_TYPE_FLOW_RING_DELETE;
1425         delete->msg.ifidx = ifidx;
1426         delete->msg.request_id = 0;
1427
1428         delete->flow_ring_id = cpu_to_le16(flowid +
1429                                            BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
1430         delete->reason = 0;
1431
1432         brcmf_dbg(MSGBUF, "Send Flow Delete Req flow ID %d, ifindex %d\n",
1433                   flowid, ifidx);
1434
1435         err = brcmf_commonring_write_complete(commonring);
1436         brcmf_commonring_unlock(commonring);
1437         if (err) {
1438                 bphy_err(drvr, "Failed to submit RING_DELETE, flowring will be removed\n");
1439                 brcmf_msgbuf_remove_flowring(msgbuf, flowid);
1440         }
1441 }
1442
1443 #ifdef DEBUG
1444 static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
1445 {
1446         struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
1447         struct brcmf_pub *drvr = bus_if->drvr;
1448         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1449         struct brcmf_commonring *commonring;
1450         u16 i;
1451         struct brcmf_flowring_ring *ring;
1452         struct brcmf_flowring_hash *hash;
1453
1454         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
1455         seq_printf(seq, "h2d_ctl_submit: rp %4u, wp %4u, depth %4u\n",
1456                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1457         commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
1458         seq_printf(seq, "h2d_rx_submit:  rp %4u, wp %4u, depth %4u\n",
1459                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1460         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
1461         seq_printf(seq, "d2h_ctl_cmplt:  rp %4u, wp %4u, depth %4u\n",
1462                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1463         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
1464         seq_printf(seq, "d2h_tx_cmplt:   rp %4u, wp %4u, depth %4u\n",
1465                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1466         commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
1467         seq_printf(seq, "d2h_rx_cmplt:   rp %4u, wp %4u, depth %4u\n",
1468                    commonring->r_ptr, commonring->w_ptr, commonring->depth);
1469
1470         seq_printf(seq, "\nh2d_flowrings: depth %u\n",
1471                    BRCMF_H2D_TXFLOWRING_MAX_ITEM);
1472         seq_puts(seq, "Active flowrings:\n");
1473         for (i = 0; i < msgbuf->flow->nrofrings; i++) {
1474                 if (!msgbuf->flow->rings[i])
1475                         continue;
1476                 ring = msgbuf->flow->rings[i];
1477                 if (ring->status != RING_OPEN)
1478                         continue;
1479                 commonring = msgbuf->flowrings[i];
1480                 hash = &msgbuf->flow->hash[ring->hash_id];
1481                 seq_printf(seq, "id %3u: rp %4u, wp %4u, qlen %4u, blocked %u\n"
1482                                 "        ifidx %u, fifo %u, da %pM\n",
1483                                 i, commonring->r_ptr, commonring->w_ptr,
1484                                 skb_queue_len(&ring->skblist), ring->blocked,
1485                                 hash->ifidx, hash->fifo, hash->mac);
1486         }
1487
1488         return 0;
1489 }
1490 #else
1491 static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
1492 {
1493         return 0;
1494 }
1495 #endif
1496
1497 static void brcmf_msgbuf_debugfs_create(struct brcmf_pub *drvr)
1498 {
1499         brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
1500 }
1501
1502 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
1503 {
1504         struct brcmf_bus_msgbuf *if_msgbuf;
1505         struct brcmf_msgbuf *msgbuf;
1506         u64 address;
1507         u32 count;
1508
1509         if_msgbuf = drvr->bus_if->msgbuf;
1510
1511         if (if_msgbuf->max_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
1512                 bphy_err(drvr, "driver not configured for this many flowrings %d\n",
1513                          if_msgbuf->max_flowrings);
1514                 if_msgbuf->max_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
1515         }
1516
1517         msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
1518         if (!msgbuf)
1519                 goto fail;
1520
1521         msgbuf->txflow_wq = create_singlethread_workqueue("msgbuf_txflow");
1522         if (msgbuf->txflow_wq == NULL) {
1523                 bphy_err(drvr, "workqueue creation failed\n");
1524                 goto fail;
1525         }
1526         INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
1527         count = BITS_TO_LONGS(if_msgbuf->max_flowrings);
1528         count = count * sizeof(unsigned long);
1529         msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
1530         if (!msgbuf->flow_map)
1531                 goto fail;
1532
1533         msgbuf->txstatus_done_map = kzalloc(count, GFP_KERNEL);
1534         if (!msgbuf->txstatus_done_map)
1535                 goto fail;
1536
1537         msgbuf->drvr = drvr;
1538         msgbuf->ioctbuf = dma_alloc_coherent(drvr->bus_if->dev,
1539                                              BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1540                                              &msgbuf->ioctbuf_handle,
1541                                              GFP_KERNEL);
1542         if (!msgbuf->ioctbuf)
1543                 goto fail;
1544         address = (u64)msgbuf->ioctbuf_handle;
1545         msgbuf->ioctbuf_phys_hi = address >> 32;
1546         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
1547
1548         drvr->proto->hdrpull = brcmf_msgbuf_hdrpull;
1549         drvr->proto->query_dcmd = brcmf_msgbuf_query_dcmd;
1550         drvr->proto->set_dcmd = brcmf_msgbuf_set_dcmd;
1551         drvr->proto->tx_queue_data = brcmf_msgbuf_tx_queue_data;
1552         drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
1553         drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
1554         drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
1555         drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
1556         drvr->proto->debugfs_create = brcmf_msgbuf_debugfs_create;
1557         drvr->proto->pd = msgbuf;
1558
1559         init_waitqueue_head(&msgbuf->ioctl_resp_wait);
1560
1561         msgbuf->commonrings =
1562                 (struct brcmf_commonring **)if_msgbuf->commonrings;
1563         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
1564         msgbuf->max_flowrings = if_msgbuf->max_flowrings;
1565         msgbuf->flowring_dma_handle =
1566                 kcalloc(msgbuf->max_flowrings,
1567                         sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
1568         if (!msgbuf->flowring_dma_handle)
1569                 goto fail;
1570
1571         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
1572         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
1573
1574         msgbuf->max_ioctlrespbuf = BRCMF_MSGBUF_MAX_IOCTLRESPBUF_POST;
1575         msgbuf->max_eventbuf = BRCMF_MSGBUF_MAX_EVENTBUF_POST;
1576
1577         msgbuf->tx_pktids = brcmf_msgbuf_init_pktids(NR_TX_PKTIDS,
1578                                                      DMA_TO_DEVICE);
1579         if (!msgbuf->tx_pktids)
1580                 goto fail;
1581         msgbuf->rx_pktids = brcmf_msgbuf_init_pktids(NR_RX_PKTIDS,
1582                                                      DMA_FROM_DEVICE);
1583         if (!msgbuf->rx_pktids)
1584                 goto fail;
1585
1586         msgbuf->flow = brcmf_flowring_attach(drvr->bus_if->dev,
1587                                              if_msgbuf->max_flowrings);
1588         if (!msgbuf->flow)
1589                 goto fail;
1590
1591
1592         brcmf_dbg(MSGBUF, "Feeding buffers, rx data %d, rx event %d, rx ioctl resp %d\n",
1593                   msgbuf->max_rxbufpost, msgbuf->max_eventbuf,
1594                   msgbuf->max_ioctlrespbuf);
1595         count = 0;
1596         do {
1597                 brcmf_msgbuf_rxbuf_data_fill(msgbuf);
1598                 if (msgbuf->max_rxbufpost != msgbuf->rxbufpost)
1599                         msleep(10);
1600                 else
1601                         break;
1602                 count++;
1603         } while (count < 10);
1604         brcmf_msgbuf_rxbuf_event_post(msgbuf);
1605         brcmf_msgbuf_rxbuf_ioctlresp_post(msgbuf);
1606
1607         INIT_WORK(&msgbuf->flowring_work, brcmf_msgbuf_flowring_worker);
1608         spin_lock_init(&msgbuf->flowring_work_lock);
1609         INIT_LIST_HEAD(&msgbuf->work_queue);
1610
1611         return 0;
1612
1613 fail:
1614         if (msgbuf) {
1615                 kfree(msgbuf->flow_map);
1616                 kfree(msgbuf->txstatus_done_map);
1617                 brcmf_msgbuf_release_pktids(msgbuf);
1618                 kfree(msgbuf->flowring_dma_handle);
1619                 if (msgbuf->ioctbuf)
1620                         dma_free_coherent(drvr->bus_if->dev,
1621                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1622                                           msgbuf->ioctbuf,
1623                                           msgbuf->ioctbuf_handle);
1624                 if (msgbuf->txflow_wq)
1625                         destroy_workqueue(msgbuf->txflow_wq);
1626                 kfree(msgbuf);
1627         }
1628         return -ENOMEM;
1629 }
1630
1631
1632 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
1633 {
1634         struct brcmf_msgbuf *msgbuf;
1635         struct brcmf_msgbuf_work_item *work;
1636
1637         brcmf_dbg(TRACE, "Enter\n");
1638         if (drvr->proto->pd) {
1639                 msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
1640                 cancel_work_sync(&msgbuf->flowring_work);
1641                 while (!list_empty(&msgbuf->work_queue)) {
1642                         work = list_first_entry(&msgbuf->work_queue,
1643                                                 struct brcmf_msgbuf_work_item,
1644                                                 queue);
1645                         list_del(&work->queue);
1646                         kfree(work);
1647                 }
1648                 kfree(msgbuf->flow_map);
1649                 kfree(msgbuf->txstatus_done_map);
1650                 if (msgbuf->txflow_wq)
1651                         destroy_workqueue(msgbuf->txflow_wq);
1652
1653                 brcmf_flowring_detach(msgbuf->flow);
1654                 dma_free_coherent(drvr->bus_if->dev,
1655                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
1656                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
1657                 brcmf_msgbuf_release_pktids(msgbuf);
1658                 kfree(msgbuf->flowring_dma_handle);
1659                 kfree(msgbuf);
1660                 drvr->proto->pd = NULL;
1661         }
1662 }