drivers/net/wireless/ath/ath6kl/htc_pipe.c

   1 /*
   2  * Copyright (c) 2007-2011 Atheros Communications Inc.
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include "core.h"
  18 #include "debug.h"
  19 #include "hif-ops.h"
  20
  21 #define HTC_PACKET_CONTAINER_ALLOCATION 32
  22 #define HTC_CONTROL_BUFFER_SIZE (HTC_MAX_CTRL_MSG_LEN + HTC_HDR_LENGTH)
  23
  24 static int ath6kl_htc_pipe_tx(struct htc_target *handle,
  25                               struct htc_packet *packet);
  26 static void ath6kl_htc_pipe_cleanup(struct htc_target *handle);
  27
  28 /* htc pipe tx path */
  29 static inline void restore_tx_packet(struct htc_packet *packet)
  30 {
  31         if (packet->info.tx.flags & HTC_FLAGS_TX_FIXUP_NETBUF) {
  32                 skb_pull(packet->skb, sizeof(struct htc_frame_hdr));
  33                 packet->info.tx.flags &= ~HTC_FLAGS_TX_FIXUP_NETBUF;
  34         }
  35 }
  36
  37 static void do_send_completion(struct htc_endpoint *ep,
  38                                struct list_head *queue_to_indicate)
  39 {
  40         struct htc_packet *packet;
  41
  42         if (list_empty(queue_to_indicate)) {
  43                 /* nothing to indicate */
  44                 return;
  45         }
  46
  47         if (ep->ep_cb.tx_comp_multi != NULL) {
  48                 ath6kl_dbg(ATH6KL_DBG_HTC,
  49                            "%s: calling ep %d, send complete multiple callback (%d pkts)\n",
  50                            __func__, ep->eid,
  51                            get_queue_depth(queue_to_indicate));
  52                 /*
  53                  * a multiple send complete handler is being used,
  54                  * pass the queue to the handler
  55                  */
  56                 ep->ep_cb.tx_comp_multi(ep->target, queue_to_indicate);
  57                 /*
  58                  * all packets are now owned by the callback,
  59                  * reset queue to be safe
  60                  */
  61                 INIT_LIST_HEAD(queue_to_indicate);
  62         } else {
  63                 /* using legacy EpTxComplete */
  64                 do {
  65                         packet = list_first_entry(queue_to_indicate,
  66                                                   struct htc_packet, list);
  67
  68                         list_del(&packet->list);
  69                         ath6kl_dbg(ATH6KL_DBG_HTC,
  70                                    "%s: calling ep %d send complete callback on packet 0x%p\n",
  71                                    __func__, ep->eid, packet);
  72                         ep->ep_cb.tx_complete(ep->target, packet);
  73                 } while (!list_empty(queue_to_indicate));
  74         }
  75 }
  76
  77 static void send_packet_completion(struct htc_target *target,
  78                                    struct htc_packet *packet)
  79 {
  80         struct htc_endpoint *ep = &target->endpoint[packet->endpoint];
  81         struct list_head container;
  82
  83         restore_tx_packet(packet);
  84         INIT_LIST_HEAD(&container);
  85         list_add_tail(&packet->list, &container);
  86
  87         /* do completion */
  88         do_send_completion(ep, &container);
  89 }
  90
  91 static void get_htc_packet_credit_based(struct htc_target *target,
  92                                         struct htc_endpoint *ep,
  93                                         struct list_head *queue)
  94 {
  95         int credits_required;
  96         int remainder;
  97         u8 send_flags;
  98         struct htc_packet *packet;
  99         unsigned int transfer_len;
 100
 101         /* NOTE : the TX lock is held when this function is called */
 102
 103         /* loop until we can grab as many packets out of the queue as we can */
 104         while (true) {
 105                 send_flags = 0;
 106                 if (list_empty(&ep->txq))
 107                         break;
 108
 109                 /* get packet at head, but don't remove it */
 110                 packet = list_first_entry(&ep->txq, struct htc_packet, list);
 111
 112                 ath6kl_dbg(ATH6KL_DBG_HTC,
 113                            "%s: got head packet:0x%p , queue depth: %d\n",
 114                            __func__, packet, get_queue_depth(&ep->txq));
 115
 116                 transfer_len = packet->act_len + HTC_HDR_LENGTH;
 117
 118                 if (transfer_len <= target->tgt_cred_sz) {
 119                         credits_required = 1;
 120                 } else {
 121                         /* figure out how many credits this message requires */
 122                         credits_required = transfer_len / target->tgt_cred_sz;
 123                         remainder = transfer_len % target->tgt_cred_sz;
 124
 125                         if (remainder)
 126                                 credits_required++;
 127                 }
 128
 129                 ath6kl_dbg(ATH6KL_DBG_HTC, "%s: creds required:%d got:%d\n",
 130                            __func__, credits_required, ep->cred_dist.credits);
 131
 132                 if (ep->eid == ENDPOINT_0) {
 133                         /*
 134                          * endpoint 0 is special, it always has a credit and
 135                          * does not require credit based flow control
 136                          */
 137                         credits_required = 0;
 138
 139                 } else {
 140
 141                         if (ep->cred_dist.credits < credits_required)
 142                                 break;
 143
 144                         ep->cred_dist.credits -= credits_required;
 145                         ep->ep_st.cred_cosumd += credits_required;
 146
 147                         /* check if we need credits back from the target */
 148                         if (ep->cred_dist.credits <
 149                                         ep->cred_dist.cred_per_msg) {
 150                                 /* tell the target we need credits ASAP! */
 151                                 send_flags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
 152                                 ep->ep_st.cred_low_indicate += 1;
 153                                 ath6kl_dbg(ATH6KL_DBG_HTC,
 154                                            "%s: host needs credits\n",
 155                                            __func__);
 156                         }
 157                 }
 158
 159                 /* now we can fully dequeue */
 160                 packet = list_first_entry(&ep->txq, struct htc_packet, list);
 161
 162                 list_del(&packet->list);
 163                 /* save the number of credits this packet consumed */
 164                 packet->info.tx.cred_used = credits_required;
 165                 /* save send flags */
 166                 packet->info.tx.flags = send_flags;
 167                 packet->info.tx.seqno = ep->seqno;
 168                 ep->seqno++;
 169                 /* queue this packet into the caller's queue */
 170                 list_add_tail(&packet->list, queue);
 171         }
 172
 173 }
 174
 175 static void get_htc_packet(struct htc_target *target,
 176                            struct htc_endpoint *ep,
 177                            struct list_head *queue, int resources)
 178 {
 179         struct htc_packet *packet;
 180
 181         /* NOTE : the TX lock is held when this function is called */
 182
 183         /* loop until we can grab as many packets out of the queue as we can */
 184         while (resources) {
 185                 if (list_empty(&ep->txq))
 186                         break;
 187
 188                 packet = list_first_entry(&ep->txq, struct htc_packet, list);
 189                 list_del(&packet->list);
 190
 191                 ath6kl_dbg(ATH6KL_DBG_HTC,
 192                            "%s: got packet:0x%p , new queue depth: %d\n",
 193                            __func__, packet, get_queue_depth(&ep->txq));
 194                 packet->info.tx.seqno = ep->seqno;
 195                 packet->info.tx.flags = 0;
 196                 packet->info.tx.cred_used = 0;
 197                 ep->seqno++;
 198
 199                 /* queue this packet into the caller's queue */
 200                 list_add_tail(&packet->list, queue);
 201                 resources--;
 202         }
 203 }
 204
 205 static int htc_issue_packets(struct htc_target *target,
 206                              struct htc_endpoint *ep,
 207                              struct list_head *pkt_queue)
 208 {
 209         int status = 0;
 210         u16 payload_len;
 211         struct sk_buff *skb;
 212         struct htc_frame_hdr *htc_hdr;
 213         struct htc_packet *packet;
 214
 215         ath6kl_dbg(ATH6KL_DBG_HTC,
 216                    "%s: queue: 0x%p, pkts %d\n", __func__,
 217                    pkt_queue, get_queue_depth(pkt_queue));
 218
 219         while (!list_empty(pkt_queue)) {
 220                 packet = list_first_entry(pkt_queue, struct htc_packet, list);
 221                 list_del(&packet->list);
 222
 223                 skb = packet->skb;
 224                 if (!skb) {
 225                         WARN_ON_ONCE(1);
 226                         status = -EINVAL;
 227                         break;
 228                 }
 229
 230                 payload_len = packet->act_len;
 231
 232                 /* setup HTC frame header */
 233                 htc_hdr = (struct htc_frame_hdr *) skb_push(skb,
 234                                                             sizeof(*htc_hdr));
 235                 if (!htc_hdr) {
 236                         WARN_ON_ONCE(1);
 237                         status = -EINVAL;
 238                         break;
 239                 }
 240
 241                 packet->info.tx.flags |= HTC_FLAGS_TX_FIXUP_NETBUF;
 242
 243                 /* Endianess? */
 244                 put_unaligned((u16) payload_len, &htc_hdr->payld_len);
 245                 htc_hdr->flags = packet->info.tx.flags;
 246                 htc_hdr->eid = (u8) packet->endpoint;
 247                 htc_hdr->ctrl[0] = 0;
 248                 htc_hdr->ctrl[1] = (u8) packet->info.tx.seqno;
 249
 250                 spin_lock_bh(&target->tx_lock);
 251
 252                 /* store in look up queue to match completions */
 253                 list_add_tail(&packet->list, &ep->pipe.tx_lookup_queue);
 254                 ep->ep_st.tx_issued += 1;
 255                 spin_unlock_bh(&target->tx_lock);
 256
 257                 status = ath6kl_hif_pipe_send(target->dev->ar,
 258                                               ep->pipe.pipeid_ul, NULL, skb);
 259
 260                 if (status != 0) {
 261                         if (status != -ENOMEM) {
 262                                 /* TODO: if more than 1 endpoint maps to the
 263                                  * same PipeID, it is possible to run out of
 264                                  * resources in the HIF layer.
 265                                  * Don't emit the error
 266                                  */
 267                                 ath6kl_dbg(ATH6KL_DBG_HTC,
 268                                            "%s: failed status:%d\n",
 269                                            __func__, status);
 270                         }
 271                         spin_lock_bh(&target->tx_lock);
 272                         list_del(&packet->list);
 273
 274                         /* reclaim credits */
 275                         ep->cred_dist.credits += packet->info.tx.cred_used;
 276                         spin_unlock_bh(&target->tx_lock);
 277
 278                         /* put it back into the callers queue */
 279                         list_add(&packet->list, pkt_queue);
 280                         break;
 281                 }
 282
 283         }
 284
 285         if (status != 0) {
 286                 while (!list_empty(pkt_queue)) {
 287                         if (status != -ENOMEM) {
 288                                 ath6kl_dbg(ATH6KL_DBG_HTC,
 289                                            "%s: failed pkt:0x%p status:%d\n",
 290                                            __func__, packet, status);
 291                         }
 292
 293                         packet = list_first_entry(pkt_queue,
 294                                                   struct htc_packet, list);
 295                         list_del(&packet->list);
 296                         packet->status = status;
 297                         send_packet_completion(target, packet);
 298                 }
 299         }
 300
 301         return status;
 302 }
 303
 304 static enum htc_send_queue_result htc_try_send(struct htc_target *target,
 305                                                struct htc_endpoint *ep,
 306                                                struct list_head *txq)
 307 {
 308         struct list_head send_queue;    /* temp queue to hold packets */
 309         struct htc_packet *packet, *tmp_pkt;
 310         struct ath6kl *ar = target->dev->ar;
 311         enum htc_send_full_action action;
 312         int tx_resources, overflow, txqueue_depth, i, good_pkts;
 313         u8 pipeid;
 314
 315         ath6kl_dbg(ATH6KL_DBG_HTC, "%s: (queue:0x%p depth:%d)\n",
 316                    __func__, txq,
 317                    (txq == NULL) ? 0 : get_queue_depth(txq));
 318
 319         /* init the local send queue */
 320         INIT_LIST_HEAD(&send_queue);
 321
 322         /*
 323          * txq equals to NULL means
 324          * caller didn't provide a queue, just wants us to
 325          * check queues and send
 326          */
 327         if (txq != NULL) {
 328                 if (list_empty(txq)) {
 329                         /* empty queue */
 330                         return HTC_SEND_QUEUE_DROP;
 331                 }
 332
 333                 spin_lock_bh(&target->tx_lock);
 334                 txqueue_depth = get_queue_depth(&ep->txq);
 335                 spin_unlock_bh(&target->tx_lock);
 336
 337                 if (txqueue_depth >= ep->max_txq_depth) {
 338                         /* we've already overflowed */
 339                         overflow = get_queue_depth(txq);
 340                 } else {
 341                         /* get how much we will overflow by */
 342                         overflow = txqueue_depth;
 343                         overflow += get_queue_depth(txq);
 344                         /* get how much we will overflow the TX queue by */
 345                         overflow -= ep->max_txq_depth;
 346                 }
 347
 348                 /* if overflow is negative or zero, we are okay */
 349                 if (overflow > 0) {
 350                         ath6kl_dbg(ATH6KL_DBG_HTC,
 351                                    "%s: Endpoint %d, TX queue will overflow :%d, Tx Depth:%d, Max:%d\n",
 352                                    __func__, ep->eid, overflow, txqueue_depth,
 353                                    ep->max_txq_depth);
 354                 }
 355                 if ((overflow <= 0) ||
 356                     (ep->ep_cb.tx_full == NULL)) {
 357                         /*
 358                          * all packets will fit or caller did not provide send
 359                          * full indication handler -- just move all of them
 360                          * to the local send_queue object
 361                          */
 362                         list_splice_tail_init(txq, &send_queue);
 363                 } else {
 364                         good_pkts = get_queue_depth(txq) - overflow;
 365                         if (good_pkts < 0) {
 366                                 WARN_ON_ONCE(1);
 367                                 return HTC_SEND_QUEUE_DROP;
 368                         }
 369
 370                         /* we have overflowed, and a callback is provided */
 371                         /* dequeue all non-overflow packets to the sendqueue */
 372                         for (i = 0; i < good_pkts; i++) {
 373                                 /* pop off caller's queue */
 374                                 packet = list_first_entry(txq,
 375                                                           struct htc_packet,
 376                                                           list);
 377                                 /* move to local queue */
 378                                 list_move_tail(&packet->list, &send_queue);
 379                         }
 380
 381                         /*
 382                          * the caller's queue has all the packets that won't fit
 383                          * walk through the caller's queue and indicate each to
 384                          * the send full handler
 385                          */
 386                         list_for_each_entry_safe(packet, tmp_pkt,
 387                                                  txq, list) {
 388
 389                                 ath6kl_dbg(ATH6KL_DBG_HTC,
 390                                            "%s: Indicat overflowed TX pkts: %p\n",
 391                                            __func__, packet);
 392                                 action = ep->ep_cb.tx_full(ep->target, packet);
 393                                 if (action == HTC_SEND_FULL_DROP) {
 394                                         /* callback wants the packet dropped */
 395                                         ep->ep_st.tx_dropped += 1;
 396
 397                                         /* leave this one in the caller's queue
 398                                          * for cleanup */
 399                                 } else {
 400                                         /* callback wants to keep this packet,
 401                                          * move from caller's queue to the send
 402                                          * queue */
 403                                         list_move_tail(&packet->list,
 404                                                        &send_queue);
 405                                 }
 406
 407                         }
 408
 409                         if (list_empty(&send_queue)) {
 410                                 /* no packets made it in, caller will cleanup */
 411                                 return HTC_SEND_QUEUE_DROP;
 412                         }
 413                 }
 414         }
 415
 416         if (!ep->pipe.tx_credit_flow_enabled) {
 417                 tx_resources =
 418                     ath6kl_hif_pipe_get_free_queue_number(ar,
 419                                                           ep->pipe.pipeid_ul);
 420         } else {
 421                 tx_resources = 0;
 422         }
 423
 424         spin_lock_bh(&target->tx_lock);
 425         if (!list_empty(&send_queue)) {
 426                 /* transfer packets to tail */
 427                 list_splice_tail_init(&send_queue, &ep->txq);
 428                 if (!list_empty(&send_queue)) {
 429                         WARN_ON_ONCE(1);
 430                         spin_unlock_bh(&target->tx_lock);
 431                         return HTC_SEND_QUEUE_DROP;
 432                 }
 433                 INIT_LIST_HEAD(&send_queue);
 434         }
 435
 436         /* increment tx processing count on entry */
 437         ep->tx_proc_cnt++;
 438
 439         if (ep->tx_proc_cnt > 1) {
 440                 /*
 441                  * Another thread or task is draining the TX queues on this
 442                  * endpoint that thread will reset the tx processing count
 443                  * when the queue is drained.
 444                  */
 445                 ep->tx_proc_cnt--;
 446                 spin_unlock_bh(&target->tx_lock);
 447                 return HTC_SEND_QUEUE_OK;
 448         }
 449
 450         /***** beyond this point only 1 thread may enter ******/
 451
 452         /*
 453          * Now drain the endpoint TX queue for transmission as long as we have
 454          * enough transmit resources.
 455          */
 456         while (true) {
 457
 458                 if (get_queue_depth(&ep->txq) == 0)
 459                         break;
 460
 461                 if (ep->pipe.tx_credit_flow_enabled) {
 462                         /*
 463                          * Credit based mechanism provides flow control
 464                          * based on target transmit resource availability,
 465                          * we assume that the HIF layer will always have
 466                          * bus resources greater than target transmit
 467                          * resources.
 468                          */
 469                         get_htc_packet_credit_based(target, ep, &send_queue);
 470                 } else {
 471                         /*
 472                          * Get all packets for this endpoint that we can
 473                          * for this pass.
 474                          */
 475                         get_htc_packet(target, ep, &send_queue, tx_resources);
 476                 }
 477
 478                 if (get_queue_depth(&send_queue) == 0) {
 479                         /*
 480                          * Didn't get packets due to out of resources or TX
 481                          * queue was drained.
 482                          */
 483                         break;
 484                 }
 485
 486                 spin_unlock_bh(&target->tx_lock);
 487
 488                 /* send what we can */
 489                 htc_issue_packets(target, ep, &send_queue);
 490
 491                 if (!ep->pipe.tx_credit_flow_enabled) {
 492                         pipeid = ep->pipe.pipeid_ul;
 493                         tx_resources =
 494                             ath6kl_hif_pipe_get_free_queue_number(ar, pipeid);
 495                 }
 496
 497                 spin_lock_bh(&target->tx_lock);
 498
 499         }
 500         /* done with this endpoint, we can clear the count */
 501         ep->tx_proc_cnt = 0;
 502         spin_unlock_bh(&target->tx_lock);
 503
 504         return HTC_SEND_QUEUE_OK;
 505 }
 506
 507 /* htc control packet manipulation */
 508 static void destroy_htc_txctrl_packet(struct htc_packet *packet)
 509 {
 510         struct sk_buff *skb;
 511         skb = packet->skb;
 512         dev_kfree_skb(skb);
 513         kfree(packet);
 514 }
 515
 516 static struct htc_packet *build_htc_txctrl_packet(void)
 517 {
 518         struct htc_packet *packet = NULL;
 519         struct sk_buff *skb;
 520
 521         packet = kzalloc(sizeof(struct htc_packet), GFP_KERNEL);
 522         if (packet == NULL)
 523                 return NULL;
 524
 525         skb = __dev_alloc_skb(HTC_CONTROL_BUFFER_SIZE, GFP_KERNEL);
 526
 527         if (skb == NULL) {
 528                 kfree(packet);
 529                 return NULL;
 530         }
 531         packet->skb = skb;
 532
 533         return packet;
 534 }
 535
 536 static void htc_free_txctrl_packet(struct htc_target *target,
 537                                    struct htc_packet *packet)
 538 {
 539         destroy_htc_txctrl_packet(packet);
 540 }
 541
 542 static struct htc_packet *htc_alloc_txctrl_packet(struct htc_target *target)
 543 {
 544         return build_htc_txctrl_packet();
 545 }
 546
 547 static void htc_txctrl_complete(struct htc_target *target,
 548                                 struct htc_packet *packet)
 549 {
 550         htc_free_txctrl_packet(target, packet);
 551 }
 552
 553 #define MAX_MESSAGE_SIZE 1536
 554
 555 static int htc_setup_target_buffer_assignments(struct htc_target *target)
 556 {
 557         int status, credits, credit_per_maxmsg, i;
 558         struct htc_pipe_txcredit_alloc *entry;
 559         unsigned int hif_usbaudioclass = 0;
 560
 561         credit_per_maxmsg = MAX_MESSAGE_SIZE / target->tgt_cred_sz;
 562         if (MAX_MESSAGE_SIZE % target->tgt_cred_sz)
 563                 credit_per_maxmsg++;
 564
 565         /* TODO, this should be configured by the caller! */
 566
 567         credits = target->tgt_creds;
 568         entry = &target->pipe.txcredit_alloc[0];
 569
 570         status = -ENOMEM;
 571
 572         /* FIXME: hif_usbaudioclass is always zero */
 573         if (hif_usbaudioclass) {
 574                 ath6kl_dbg(ATH6KL_DBG_HTC,
 575                            "%s: For USB Audio Class- Total:%d\n",
 576                            __func__, credits);
 577                 entry++;
 578                 entry++;
 579                 /* Setup VO Service To have Max Credits */
 580                 entry->service_id = WMI_DATA_VO_SVC;
 581                 entry->credit_alloc = (credits - 6);
 582                 if (entry->credit_alloc == 0)
 583                         entry->credit_alloc++;
 584
 585                 credits -= (int) entry->credit_alloc;
 586                 if (credits <= 0)
 587                         return status;
 588
 589                 entry++;
 590                 entry->service_id = WMI_CONTROL_SVC;
 591                 entry->credit_alloc = credit_per_maxmsg;
 592                 credits -= (int) entry->credit_alloc;
 593                 if (credits <= 0)
 594                         return status;
 595
 596                 /* leftovers go to best effort */
 597                 entry++;
 598                 entry++;
 599                 entry->service_id = WMI_DATA_BE_SVC;
 600                 entry->credit_alloc = (u8) credits;
 601                 status = 0;
 602         } else {
 603                 entry++;
 604                 entry->service_id = WMI_DATA_VI_SVC;
 605                 entry->credit_alloc = credits / 4;
 606                 if (entry->credit_alloc == 0)
 607                         entry->credit_alloc++;
 608
 609                 credits -= (int) entry->credit_alloc;
 610                 if (credits <= 0)
 611                         return status;
 612
 613                 entry++;
 614                 entry->service_id = WMI_DATA_VO_SVC;
 615                 entry->credit_alloc = credits / 4;
 616                 if (entry->credit_alloc == 0)
 617                         entry->credit_alloc++;
 618
 619                 credits -= (int) entry->credit_alloc;
 620                 if (credits <= 0)
 621                         return status;
 622
 623                 entry++;
 624                 entry->service_id = WMI_CONTROL_SVC;
 625                 entry->credit_alloc = credit_per_maxmsg;
 626                 credits -= (int) entry->credit_alloc;
 627                 if (credits <= 0)
 628                         return status;
 629
 630                 entry++;
 631                 entry->service_id = WMI_DATA_BK_SVC;
 632                 entry->credit_alloc = credit_per_maxmsg;
 633                 credits -= (int) entry->credit_alloc;
 634                 if (credits <= 0)
 635                         return status;
 636
 637                 /* leftovers go to best effort */
 638                 entry++;
 639                 entry->service_id = WMI_DATA_BE_SVC;
 640                 entry->credit_alloc = (u8) credits;
 641                 status = 0;
 642         }
 643
 644         if (status == 0) {
 645                 for (i = 0; i < ENDPOINT_MAX; i++) {
 646                         if (target->pipe.txcredit_alloc[i].service_id != 0) {
 647                                 ath6kl_dbg(ATH6KL_DBG_HTC,
 648                                            "HTC Service Index : %d TX : 0x%2.2X : alloc:%d\n",
 649                                            i,
 650                                            target->pipe.txcredit_alloc[i].
 651                                            service_id,
 652                                            target->pipe.txcredit_alloc[i].
 653                                            credit_alloc);
 654                         }
 655                 }
 656         }
 657         return status;
 658 }
 659
 660 /* process credit reports and call distribution function */
 661 static void htc_process_credit_report(struct htc_target *target,
 662                                       struct htc_credit_report *rpt,
 663                                       int num_entries,
 664                                       enum htc_endpoint_id from_ep)
 665 {
 666         int total_credits = 0, i;
 667         struct htc_endpoint *ep;
 668
 669         /* lock out TX while we update credits */
 670         spin_lock_bh(&target->tx_lock);
 671
 672         for (i = 0; i < num_entries; i++, rpt++) {
 673                 if (rpt->eid >= ENDPOINT_MAX) {
 674                         WARN_ON_ONCE(1);
 675                         spin_unlock_bh(&target->tx_lock);
 676                         return;
 677                 }
 678
 679                 ep = &target->endpoint[rpt->eid];
 680                 ep->cred_dist.credits += rpt->credits;
 681
 682                 if (ep->cred_dist.credits && get_queue_depth(&ep->txq)) {
 683                         spin_unlock_bh(&target->tx_lock);
 684                         htc_try_send(target, ep, NULL);
 685                         spin_lock_bh(&target->tx_lock);
 686                 }
 687
 688                 total_credits += rpt->credits;
 689         }
 690         ath6kl_dbg(ATH6KL_DBG_HTC,
 691                    "Report indicated %d credits to distribute\n",
 692                    total_credits);
 693
 694         spin_unlock_bh(&target->tx_lock);
 695 }
 696
 697 /* flush endpoint TX queue */
 698 static void htc_flush_tx_endpoint(struct htc_target *target,
 699                                   struct htc_endpoint *ep, u16 tag)
 700 {
 701         struct htc_packet *packet;
 702
 703         spin_lock_bh(&target->tx_lock);
 704         while (get_queue_depth(&ep->txq)) {
 705                 packet = list_first_entry(&ep->txq, struct htc_packet, list);
 706                 list_del(&packet->list);
 707                 packet->status = 0;
 708                 send_packet_completion(target, packet);
 709         }
 710         spin_unlock_bh(&target->tx_lock);
 711 }
 712
 713 /*
 714  * In the adapted HIF layer, struct sk_buff * are passed between HIF and HTC,
 715  * since upper layers expects struct htc_packet containers we use the completed
 716  * skb and lookup it's corresponding HTC packet buffer from a lookup list.
 717  * This is extra overhead that can be fixed by re-aligning HIF interfaces with
 718  * HTC.
 719  */
 720 static struct htc_packet *htc_lookup_tx_packet(struct htc_target *target,
 721                                                struct htc_endpoint *ep,
 722                                                struct sk_buff *skb)
 723 {
 724         struct htc_packet *packet, *tmp_pkt, *found_packet = NULL;
 725
 726         spin_lock_bh(&target->tx_lock);
 727
 728         /*
 729          * interate from the front of tx lookup queue
 730          * this lookup should be fast since lower layers completes in-order and
 731          * so the completed packet should be at the head of the list generally
 732          */
 733         list_for_each_entry_safe(packet, tmp_pkt, &ep->pipe.tx_lookup_queue,
 734                                  list) {
 735                 /* check for removal */
 736                 if (skb == packet->skb) {
 737                         /* found it */
 738                         list_del(&packet->list);
 739                         found_packet = packet;
 740                         break;
 741                 }
 742         }
 743
 744         spin_unlock_bh(&target->tx_lock);
 745
 746         return found_packet;
 747 }
 748
 749 static int ath6kl_htc_pipe_tx_complete(struct ath6kl *ar, struct sk_buff *skb)
 750 {
 751         struct htc_target *target = ar->htc_target;
 752         struct htc_frame_hdr *htc_hdr;
 753         struct htc_endpoint *ep;
 754         struct htc_packet *packet;
 755         u8 ep_id, *netdata;
 756         u32 netlen;
 757
 758         netdata = skb->data;
 759         netlen = skb->len;
 760
 761         htc_hdr = (struct htc_frame_hdr *) netdata;
 762
 763         ep_id = htc_hdr->eid;
 764         ep = &target->endpoint[ep_id];
 765
 766         packet = htc_lookup_tx_packet(target, ep, skb);
 767         if (packet == NULL) {
 768                 /* may have already been flushed and freed */
 769                 ath6kl_err("HTC TX lookup failed!\n");
 770         } else {
 771                 /* will be giving this buffer back to upper layers */
 772                 packet->status = 0;
 773                 send_packet_completion(target, packet);
 774         }
 775         skb = NULL;
 776
 777         if (!ep->pipe.tx_credit_flow_enabled) {
 778                 /*
 779                  * note: when using TX credit flow, the re-checking of queues
 780                  * happens when credits flow back from the target. in the
 781                  * non-TX credit case, we recheck after the packet completes
 782                  */
 783                 htc_try_send(target, ep, NULL);
 784         }
 785
 786         return 0;
 787 }
 788
 789 static int htc_send_packets_multiple(struct htc_target *target,
 790                                      struct list_head *pkt_queue)
 791 {
 792         struct htc_endpoint *ep;
 793         struct htc_packet *packet, *tmp_pkt;
 794
 795         if (list_empty(pkt_queue))
 796                 return -EINVAL;
 797
 798         /* get first packet to find out which ep the packets will go into */
 799         packet = list_first_entry(pkt_queue, struct htc_packet, list);
 800
 801         if (packet->endpoint >= ENDPOINT_MAX) {
 802                 WARN_ON_ONCE(1);
 803                 return -EINVAL;
 804         }
 805         ep = &target->endpoint[packet->endpoint];
 806
 807         htc_try_send(target, ep, pkt_queue);
 808
 809         /* do completion on any packets that couldn't get in */
 810         if (!list_empty(pkt_queue)) {
 811                 list_for_each_entry_safe(packet, tmp_pkt, pkt_queue, list) {
 812                         packet->status = -ENOMEM;
 813                 }
 814
 815                 do_send_completion(ep, pkt_queue);
 816         }
 817
 818         return 0;
 819 }
 820
 821 /* htc pipe rx path */
 822 static struct htc_packet *alloc_htc_packet_container(struct htc_target *target)
 823 {
 824         struct htc_packet *packet;
 825         spin_lock_bh(&target->rx_lock);
 826
 827         if (target->pipe.htc_packet_pool == NULL) {
 828                 spin_unlock_bh(&target->rx_lock);
 829                 return NULL;
 830         }
 831
 832         packet = target->pipe.htc_packet_pool;
 833         target->pipe.htc_packet_pool = (struct htc_packet *) packet->list.next;
 834
 835         spin_unlock_bh(&target->rx_lock);
 836
 837         packet->list.next = NULL;
 838         return packet;
 839 }
 840
 841 static void free_htc_packet_container(struct htc_target *target,
 842                                       struct htc_packet *packet)
 843 {
 844         struct list_head *lh;
 845
 846         spin_lock_bh(&target->rx_lock);
 847
 848         if (target->pipe.htc_packet_pool == NULL) {
 849                 target->pipe.htc_packet_pool = packet;
 850                 packet->list.next = NULL;
 851         } else {
 852                 lh = (struct list_head *) target->pipe.htc_packet_pool;
 853                 packet->list.next = lh;
 854                 target->pipe.htc_packet_pool = packet;
 855         }
 856
 857         spin_unlock_bh(&target->rx_lock);
 858 }
 859
 860 static int htc_process_trailer(struct htc_target *target, u8 *buffer,
 861                                int len, enum htc_endpoint_id from_ep)
 862 {
 863         struct htc_credit_report *report;
 864         struct htc_record_hdr *record;
 865         u8 *record_buf, *orig_buf;
 866         int orig_len, status;
 867
 868         orig_buf = buffer;
 869         orig_len = len;
 870         status = 0;
 871
 872         while (len > 0) {
 873                 if (len < sizeof(struct htc_record_hdr)) {
 874                         status = -EINVAL;
 875                         break;
 876                 }
 877
 878                 /* these are byte aligned structs */
 879                 record = (struct htc_record_hdr *) buffer;
 880                 len -= sizeof(struct htc_record_hdr);
 881                 buffer += sizeof(struct htc_record_hdr);
 882
 883                 if (record->len > len) {
 884                         /* no room left in buffer for record */
 885                         ath6kl_dbg(ATH6KL_DBG_HTC,
 886                                    "invalid length: %d (id:%d) buffer has: %d bytes left\n",
 887                                    record->len, record->rec_id, len);
 888                         status = -EINVAL;
 889                         break;
 890                 }
 891
 892                 /* start of record follows the header */
 893                 record_buf = buffer;
 894
 895                 switch (record->rec_id) {
 896                 case HTC_RECORD_CREDITS:
 897                         if (record->len < sizeof(struct htc_credit_report)) {
 898                                 WARN_ON_ONCE(1);
 899                                 return -EINVAL;
 900                         }
 901
 902                         report = (struct htc_credit_report *) record_buf;
 903                         htc_process_credit_report(target, report,
 904                                                   record->len / sizeof(*report),
 905                                                   from_ep);
 906                         break;
 907                 default:
 908                         ath6kl_dbg(ATH6KL_DBG_HTC,
 909                                    "unhandled record: id:%d length:%d\n",
 910                                    record->rec_id, record->len);
 911                         break;
 912                 }
 913
 914                 if (status != 0)
 915                         break;
 916
 917                 /* advance buffer past this record for next time around */
 918                 buffer += record->len;
 919                 len -= record->len;
 920         }
 921
 922         return status;
 923 }
 924
 925 static void do_recv_completion(struct htc_endpoint *ep,
 926                                struct list_head *queue_to_indicate)
 927 {
 928         struct htc_packet *packet;
 929
 930         if (list_empty(queue_to_indicate)) {
 931                 /* nothing to indicate */
 932                 return;
 933         }
 934
 935         /* using legacy EpRecv */
 936         while (!list_empty(queue_to_indicate)) {
 937                 packet = list_first_entry(queue_to_indicate,
 938                                           struct htc_packet, list);
 939                 list_del(&packet->list);
 940                 ep->ep_cb.rx(ep->target, packet);
 941         }
 942
 943         return;
 944 }
 945
 946 static void recv_packet_completion(struct htc_target *target,
 947                                    struct htc_endpoint *ep,
 948                                    struct htc_packet *packet)
 949 {
 950         struct list_head container;
 951         INIT_LIST_HEAD(&container);
 952         list_add_tail(&packet->list, &container);
 953
 954         /* do completion */
 955         do_recv_completion(ep, &container);
 956 }
 957
 958 static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
 959                                        u8 pipeid)
 960 {
 961         struct htc_target *target = ar->htc_target;
 962         u8 *netdata, *trailer, hdr_info;
 963         struct htc_frame_hdr *htc_hdr;
 964         u32 netlen, trailerlen = 0;
 965         struct htc_packet *packet;
 966         struct htc_endpoint *ep;
 967         u16 payload_len;
 968         int status = 0;
 969
 970         /*
 971          * ar->htc_target can be NULL due to a race condition that can occur
 972          * during driver initialization(we do 'ath6kl_hif_power_on' before
 973          * initializing 'ar->htc_target' via 'ath6kl_htc_create').
 974          * 'ath6kl_hif_power_on' assigns 'ath6kl_recv_complete' as
 975          * usb_complete_t/callback function for 'usb_fill_bulk_urb'.
 976          * Thus the possibility of ar->htc_target being NULL
 977          * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
 978          */
 979         if (WARN_ON_ONCE(!target)) {
 980                 ath6kl_err("Target not yet initialized\n");
 981                 status = -EINVAL;
 982                 goto free_skb;
 983         }
 984
 985
 986         netdata = skb->data;
 987         netlen = skb->len;
 988
 989         htc_hdr = (struct htc_frame_hdr *) netdata;
 990
 991         ep = &target->endpoint[htc_hdr->eid];
 992
 993         if (htc_hdr->eid >= ENDPOINT_MAX) {
 994                 ath6kl_dbg(ATH6KL_DBG_HTC,
 995                            "HTC Rx: invalid EndpointID=%d\n",
 996                            htc_hdr->eid);
 997                 status = -EINVAL;
 998                 goto free_skb;
 999         }
1000
1001         payload_len = le16_to_cpu(get_unaligned(&htc_hdr->payld_len));
1002
1003         if (netlen < (payload_len + HTC_HDR_LENGTH)) {
1004                 ath6kl_dbg(ATH6KL_DBG_HTC,
1005                            "HTC Rx: insufficient length, got:%d expected =%u\n",
1006                            netlen, payload_len + HTC_HDR_LENGTH);
1007                 status = -EINVAL;
1008                 goto free_skb;
1009         }
1010
1011         /* get flags to check for trailer */
1012         hdr_info = htc_hdr->flags;
1013         if (hdr_info & HTC_FLG_RX_TRAILER) {
1014                 /* extract the trailer length */
1015                 hdr_info = htc_hdr->ctrl[0];
1016                 if ((hdr_info < sizeof(struct htc_record_hdr)) ||
1017                     (hdr_info > payload_len)) {
1018                         ath6kl_dbg(ATH6KL_DBG_HTC,
1019                                    "invalid header: payloadlen should be %d, CB[0]: %d\n",
1020                                    payload_len, hdr_info);
1021                         status = -EINVAL;
1022                         goto free_skb;
1023                 }
1024
1025                 trailerlen = hdr_info;
1026                 /* process trailer after hdr/apps payload */
1027                 trailer = (u8 *) htc_hdr + HTC_HDR_LENGTH +
1028                         payload_len - hdr_info;
1029                 status = htc_process_trailer(target, trailer, hdr_info,
1030                                              htc_hdr->eid);
1031                 if (status != 0)
1032                         goto free_skb;
1033         }
1034
1035         if (((int) payload_len - (int) trailerlen) <= 0) {
1036                 /* zero length packet with trailer, just drop these */
1037                 goto free_skb;
1038         }
1039
1040         if (htc_hdr->eid == ENDPOINT_0) {
1041                 /* handle HTC control message */
1042                 if (target->htc_flags & HTC_OP_STATE_SETUP_COMPLETE) {
1043                         /*
1044                          * fatal: target should not send unsolicited
1045                          * messageson the endpoint 0
1046                          */
1047                         ath6kl_dbg(ATH6KL_DBG_HTC,
1048                                    "HTC ignores Rx Ctrl after setup complete\n");
1049                         status = -EINVAL;
1050                         goto free_skb;
1051                 }
1052
1053                 /* remove HTC header */
1054                 skb_pull(skb, HTC_HDR_LENGTH);
1055
1056                 netdata = skb->data;
1057                 netlen = skb->len;
1058
1059                 spin_lock_bh(&target->rx_lock);
1060
1061                 target->pipe.ctrl_response_valid = true;
1062                 target->pipe.ctrl_response_len = min_t(int, netlen,
1063                                                        HTC_MAX_CTRL_MSG_LEN);
1064                 memcpy(target->pipe.ctrl_response_buf, netdata,
1065                        target->pipe.ctrl_response_len);
1066
1067                 spin_unlock_bh(&target->rx_lock);
1068
1069                 dev_kfree_skb(skb);
1070                 skb = NULL;
1071
1072                 goto free_skb;
1073         }
1074
1075         /*
1076          * TODO: the message based HIF architecture allocates net bufs
1077          * for recv packets since it bridges that HIF to upper layers,
1078          * which expects HTC packets, we form the packets here
1079          */
1080         packet = alloc_htc_packet_container(target);
1081         if (packet == NULL) {
1082                 status = -ENOMEM;
1083                 goto free_skb;
1084         }
1085
1086         packet->status = 0;
1087         packet->endpoint = htc_hdr->eid;
1088         packet->pkt_cntxt = skb;
1089
1090         /* TODO: for backwards compatibility */
1091         packet->buf = skb_push(skb, 0) + HTC_HDR_LENGTH;
1092         packet->act_len = netlen - HTC_HDR_LENGTH - trailerlen;
1093
1094         /*
1095          * TODO: this is a hack because the driver layer will set the
1096          * actual len of the skb again which will just double the len
1097          */
1098         skb_trim(skb, 0);
1099
1100         recv_packet_completion(target, ep, packet);
1101
1102         /* recover the packet container */
1103         free_htc_packet_container(target, packet);
1104         skb = NULL;
1105
1106 free_skb:
1107         dev_kfree_skb(skb);
1108
1109         return status;
1110
1111 }
1112
1113 static void htc_flush_rx_queue(struct htc_target *target,
1114                                struct htc_endpoint *ep)
1115 {
1116         struct list_head container;
1117         struct htc_packet *packet;
1118
1119         spin_lock_bh(&target->rx_lock);
1120
1121         while (1) {
1122                 if (list_empty(&ep->rx_bufq))
1123                         break;
1124
1125                 packet = list_first_entry(&ep->rx_bufq,
1126                                           struct htc_packet, list);
1127                 list_del(&packet->list);
1128
1129                 spin_unlock_bh(&target->rx_lock);
1130                 packet->status = -ECANCELED;
1131                 packet->act_len = 0;
1132
1133                 ath6kl_dbg(ATH6KL_DBG_HTC,
1134                            "Flushing RX packet:0x%p, length:%d, ep:%d\n",
1135                            packet, packet->buf_len,
1136                            packet->endpoint);
1137
1138                 INIT_LIST_HEAD(&container);
1139                 list_add_tail(&packet->list, &container);
1140
1141                 /* give the packet back */
1142                 do_recv_completion(ep, &container);
1143                 spin_lock_bh(&target->rx_lock);
1144         }
1145
1146         spin_unlock_bh(&target->rx_lock);
1147 }
1148
1149 /* polling routine to wait for a control packet to be received */
1150 static int htc_wait_recv_ctrl_message(struct htc_target *target)
1151 {
1152         int count = HTC_TARGET_RESPONSE_POLL_COUNT;
1153
1154         while (count > 0) {
1155                 spin_lock_bh(&target->rx_lock);
1156
1157                 if (target->pipe.ctrl_response_valid) {
1158                         target->pipe.ctrl_response_valid = false;
1159                         spin_unlock_bh(&target->rx_lock);
1160                         break;
1161                 }
1162
1163                 spin_unlock_bh(&target->rx_lock);
1164
1165                 count--;
1166
1167                 msleep_interruptible(HTC_TARGET_RESPONSE_POLL_WAIT);
1168         }
1169
1170         if (count <= 0) {
1171                 ath6kl_dbg(ATH6KL_DBG_HTC, "%s: Timeout!\n", __func__);
1172                 return -ECOMM;
1173         }
1174
1175         return 0;
1176 }
1177
1178 static void htc_rxctrl_complete(struct htc_target *context,
1179                                 struct htc_packet *packet)
1180 {
1181         /* TODO, can't really receive HTC control messages yet.... */
1182         ath6kl_dbg(ATH6KL_DBG_HTC, "%s: invalid call function\n", __func__);
1183 }
1184
1185 /* htc pipe initialization */
1186 static void reset_endpoint_states(struct htc_target *target)
1187 {
1188         struct htc_endpoint *ep;
1189         int i;
1190
1191         for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
1192                 ep = &target->endpoint[i];
1193                 ep->svc_id = 0;
1194                 ep->len_max = 0;
1195                 ep->max_txq_depth = 0;
1196                 ep->eid = i;
1197                 INIT_LIST_HEAD(&ep->txq);
1198                 INIT_LIST_HEAD(&ep->pipe.tx_lookup_queue);
1199                 INIT_LIST_HEAD(&ep->rx_bufq);
1200                 ep->target = target;
1201                 ep->pipe.tx_credit_flow_enabled = true;
1202         }
1203 }
1204
1205 /* start HTC, this is called after all services are connected */
1206 static int htc_config_target_hif_pipe(struct htc_target *target)
1207 {
1208         return 0;
1209 }
1210
1211 /* htc service functions */
1212 static u8 htc_get_credit_alloc(struct htc_target *target, u16 service_id)
1213 {
1214         u8 allocation = 0;
1215         int i;
1216
1217         for (i = 0; i < ENDPOINT_MAX; i++) {
1218                 if (target->pipe.txcredit_alloc[i].service_id == service_id)
1219                         allocation =
1220                                 target->pipe.txcredit_alloc[i].credit_alloc;
1221         }
1222
1223         if (allocation == 0) {
1224                 ath6kl_dbg(ATH6KL_DBG_HTC,
1225                            "HTC Service TX : 0x%2.2X : allocation is zero!\n",
1226                            service_id);
1227         }
1228
1229         return allocation;
1230 }
1231
1232 static int ath6kl_htc_pipe_conn_service(struct htc_target *target,
1233                      struct htc_service_connect_req *conn_req,
1234                      struct htc_service_connect_resp *conn_resp)
1235 {
1236         struct ath6kl *ar = target->dev->ar;
1237         struct htc_packet *packet = NULL;
1238         struct htc_conn_service_resp *resp_msg;
1239         struct htc_conn_service_msg *conn_msg;
1240         enum htc_endpoint_id assigned_epid = ENDPOINT_MAX;
1241         bool disable_credit_flowctrl = false;
1242         unsigned int max_msg_size = 0;
1243         struct htc_endpoint *ep;
1244         int length, status = 0;
1245         struct sk_buff *skb;
1246         u8 tx_alloc;
1247         u16 flags;
1248
1249         if (conn_req->svc_id == 0) {
1250                 WARN_ON_ONCE(1);
1251                 status = -EINVAL;
1252                 goto free_packet;
1253         }
1254
1255         if (conn_req->svc_id == HTC_CTRL_RSVD_SVC) {
1256                 /* special case for pseudo control service */
1257                 assigned_epid = ENDPOINT_0;
1258                 max_msg_size = HTC_MAX_CTRL_MSG_LEN;
1259                 tx_alloc = 0;
1260
1261         } else {
1262
1263                 tx_alloc = htc_get_credit_alloc(target, conn_req->svc_id);
1264                 if (tx_alloc == 0) {
1265                         status = -ENOMEM;
1266                         goto free_packet;
1267                 }
1268
1269                 /* allocate a packet to send to the target */
1270                 packet = htc_alloc_txctrl_packet(target);
1271
1272                 if (packet == NULL) {
1273                         WARN_ON_ONCE(1);
1274                         status = -ENOMEM;
1275                         goto free_packet;
1276                 }
1277
1278                 skb = packet->skb;
1279                 length = sizeof(struct htc_conn_service_msg);
1280
1281                 /* assemble connect service message */
1282                 conn_msg = (struct htc_conn_service_msg *) skb_put(skb,
1283                                                                    length);
1284                 if (conn_msg == NULL) {
1285                         WARN_ON_ONCE(1);
1286                         status = -EINVAL;
1287                         goto free_packet;
1288                 }
1289
1290                 memset(conn_msg, 0,
1291                        sizeof(struct htc_conn_service_msg));
1292                 conn_msg->msg_id = cpu_to_le16(HTC_MSG_CONN_SVC_ID);
1293                 conn_msg->svc_id = cpu_to_le16(conn_req->svc_id);
1294                 conn_msg->conn_flags = cpu_to_le16(conn_req->conn_flags &
1295                                         ~HTC_CONN_FLGS_SET_RECV_ALLOC_MASK);
1296
1297                 /* tell target desired recv alloc for this ep */
1298                 flags = tx_alloc << HTC_CONN_FLGS_SET_RECV_ALLOC_SHIFT;
1299                 conn_msg->conn_flags |= cpu_to_le16(flags);
1300
1301                 if (conn_req->conn_flags &
1302                     HTC_CONN_FLGS_DISABLE_CRED_FLOW_CTRL) {
1303                         disable_credit_flowctrl = true;
1304                 }
1305
1306                 set_htc_pkt_info(packet, NULL, (u8 *) conn_msg,
1307                                  length,
1308                                  ENDPOINT_0, HTC_SERVICE_TX_PACKET_TAG);
1309
1310                 status = ath6kl_htc_pipe_tx(target, packet);
1311
1312                 /* we don't own it anymore */
1313                 packet = NULL;
1314                 if (status != 0)
1315                         goto free_packet;
1316
1317                 /* wait for response */
1318                 status = htc_wait_recv_ctrl_message(target);
1319                 if (status != 0)
1320                         goto free_packet;
1321
1322                 /* we controlled the buffer creation so it has to be
1323                  * properly aligned
1324                  */
1325                 resp_msg = (struct htc_conn_service_resp *)
1326                     target->pipe.ctrl_response_buf;
1327
1328                 if (resp_msg->msg_id != cpu_to_le16(HTC_MSG_CONN_SVC_RESP_ID) ||
1329                     (target->pipe.ctrl_response_len < sizeof(*resp_msg))) {
1330                         /* this message is not valid */
1331                         WARN_ON_ONCE(1);
1332                         status = -EINVAL;
1333                         goto free_packet;
1334                 }
1335
1336                 ath6kl_dbg(ATH6KL_DBG_TRC,
1337                            "%s: service 0x%X conn resp: status: %d ep: %d\n",
1338                            __func__, resp_msg->svc_id, resp_msg->status,
1339                            resp_msg->eid);
1340
1341                 conn_resp->resp_code = resp_msg->status;
1342                 /* check response status */
1343                 if (resp_msg->status != HTC_SERVICE_SUCCESS) {
1344                         ath6kl_dbg(ATH6KL_DBG_HTC,
1345                                    "Target failed service 0x%X connect request (status:%d)\n",
1346                                    resp_msg->svc_id, resp_msg->status);
1347                         status = -EINVAL;
1348                         goto free_packet;
1349                 }
1350
1351                 assigned_epid = (enum htc_endpoint_id) resp_msg->eid;
1352                 max_msg_size = le16_to_cpu(resp_msg->max_msg_sz);
1353         }
1354
1355         /* the rest are parameter checks so set the error status */
1356         status = -EINVAL;
1357
1358         if (assigned_epid >= ENDPOINT_MAX) {
1359                 WARN_ON_ONCE(1);
1360                 goto free_packet;
1361         }
1362
1363         if (max_msg_size == 0) {
1364                 WARN_ON_ONCE(1);
1365                 goto free_packet;
1366         }
1367
1368         ep = &target->endpoint[assigned_epid];
1369         ep->eid = assigned_epid;
1370         if (ep->svc_id != 0) {
1371                 /* endpoint already in use! */
1372                 WARN_ON_ONCE(1);
1373                 goto free_packet;
1374         }
1375
1376         /* return assigned endpoint to caller */
1377         conn_resp->endpoint = assigned_epid;
1378         conn_resp->len_max = max_msg_size;
1379
1380         /* setup the endpoint */
1381         ep->svc_id = conn_req->svc_id; /* this marks ep in use */
1382         ep->max_txq_depth = conn_req->max_txq_depth;
1383         ep->len_max = max_msg_size;
1384         ep->cred_dist.credits = tx_alloc;
1385         ep->cred_dist.cred_sz = target->tgt_cred_sz;
1386         ep->cred_dist.cred_per_msg = max_msg_size / target->tgt_cred_sz;
1387         if (max_msg_size % target->tgt_cred_sz)
1388                 ep->cred_dist.cred_per_msg++;
1389
1390         /* copy all the callbacks */
1391         ep->ep_cb = conn_req->ep_cb;
1392
1393         /* initialize tx_drop_packet_threshold */
1394         ep->tx_drop_packet_threshold = MAX_HI_COOKIE_NUM;
1395
1396         status = ath6kl_hif_pipe_map_service(ar, ep->svc_id,
1397                                              &ep->pipe.pipeid_ul,
1398                                              &ep->pipe.pipeid_dl);
1399         if (status != 0)
1400                 goto free_packet;
1401
1402         ath6kl_dbg(ATH6KL_DBG_HTC,
1403                    "SVC Ready: 0x%4.4X: ULpipe:%d DLpipe:%d id:%d\n",
1404                    ep->svc_id, ep->pipe.pipeid_ul,
1405                    ep->pipe.pipeid_dl, ep->eid);
1406
1407         if (disable_credit_flowctrl && ep->pipe.tx_credit_flow_enabled) {
1408                 ep->pipe.tx_credit_flow_enabled = false;
1409                 ath6kl_dbg(ATH6KL_DBG_HTC,
1410                            "SVC: 0x%4.4X ep:%d TX flow control off\n",
1411                            ep->svc_id, assigned_epid);
1412         }
1413
1414 free_packet:
1415         if (packet != NULL)
1416                 htc_free_txctrl_packet(target, packet);
1417         return status;
1418 }
1419
1420 /* htc export functions */
1421 static void *ath6kl_htc_pipe_create(struct ath6kl *ar)
1422 {
1423         int status = 0;
1424         struct htc_endpoint *ep = NULL;
1425         struct htc_target *target = NULL;
1426         struct htc_packet *packet;
1427         int i;
1428
1429         target = kzalloc(sizeof(struct htc_target), GFP_KERNEL);
1430         if (target == NULL) {
1431                 ath6kl_err("htc create unable to allocate memory\n");
1432                 status = -ENOMEM;
1433                 goto fail_htc_create;
1434         }
1435
1436         spin_lock_init(&target->htc_lock);
1437         spin_lock_init(&target->rx_lock);
1438         spin_lock_init(&target->tx_lock);
1439
1440         reset_endpoint_states(target);
1441
1442         for (i = 0; i < HTC_PACKET_CONTAINER_ALLOCATION; i++) {
1443                 packet = kzalloc(sizeof(struct htc_packet), GFP_KERNEL);
1444
1445                 if (packet != NULL)
1446                         free_htc_packet_container(target, packet);
1447         }
1448
1449         target->dev = kzalloc(sizeof(*target->dev), GFP_KERNEL);
1450         if (!target->dev) {
1451                 ath6kl_err("unable to allocate memory\n");
1452                 status = -ENOMEM;
1453                 goto fail_htc_create;
1454         }
1455         target->dev->ar = ar;
1456         target->dev->htc_cnxt = target;
1457
1458         /* Get HIF default pipe for HTC message exchange */
1459         ep = &target->endpoint[ENDPOINT_0];
1460
1461         ath6kl_hif_pipe_get_default(ar, &ep->pipe.pipeid_ul,
1462                                     &ep->pipe.pipeid_dl);
1463
1464         return target;
1465
1466 fail_htc_create:
1467         if (status != 0) {
1468                 if (target != NULL)
1469                         ath6kl_htc_pipe_cleanup(target);
1470
1471                 target = NULL;
1472         }
1473         return target;
1474 }
1475
1476 /* cleanup the HTC instance */
1477 static void ath6kl_htc_pipe_cleanup(struct htc_target *target)
1478 {
1479         struct htc_packet *packet;
1480
1481         while (true) {
1482                 packet = alloc_htc_packet_container(target);
1483                 if (packet == NULL)
1484                         break;
1485                 kfree(packet);
1486         }
1487
1488         kfree(target->dev);
1489
1490         /* kfree our instance */
1491         kfree(target);
1492 }
1493
1494 static int ath6kl_htc_pipe_start(struct htc_target *target)
1495 {
1496         struct sk_buff *skb;
1497         struct htc_setup_comp_ext_msg *setup;
1498         struct htc_packet *packet;
1499
1500         htc_config_target_hif_pipe(target);
1501
1502         /* allocate a buffer to send */
1503         packet = htc_alloc_txctrl_packet(target);
1504         if (packet == NULL) {
1505                 WARN_ON_ONCE(1);
1506                 return -ENOMEM;
1507         }
1508
1509         skb = packet->skb;
1510
1511         /* assemble setup complete message */
1512         setup = (struct htc_setup_comp_ext_msg *) skb_put(skb,
1513                                                           sizeof(*setup));
1514         memset(setup, 0, sizeof(struct htc_setup_comp_ext_msg));
1515         setup->msg_id = cpu_to_le16(HTC_MSG_SETUP_COMPLETE_EX_ID);
1516
1517         ath6kl_dbg(ATH6KL_DBG_HTC, "HTC using TX credit flow control\n");
1518
1519         set_htc_pkt_info(packet, NULL, (u8 *) setup,
1520                          sizeof(struct htc_setup_comp_ext_msg),
1521                          ENDPOINT_0, HTC_SERVICE_TX_PACKET_TAG);
1522
1523         target->htc_flags |= HTC_OP_STATE_SETUP_COMPLETE;
1524
1525         return ath6kl_htc_pipe_tx(target, packet);
1526 }
1527
1528 static void ath6kl_htc_pipe_stop(struct htc_target *target)
1529 {
1530         int i;
1531         struct htc_endpoint *ep;
1532
1533         /* cleanup endpoints */
1534         for (i = 0; i < ENDPOINT_MAX; i++) {
1535                 ep = &target->endpoint[i];
1536                 htc_flush_rx_queue(target, ep);
1537                 htc_flush_tx_endpoint(target, ep, HTC_TX_PACKET_TAG_ALL);
1538         }
1539
1540         reset_endpoint_states(target);
1541         target->htc_flags &= ~HTC_OP_STATE_SETUP_COMPLETE;
1542 }
1543
1544 static int ath6kl_htc_pipe_get_rxbuf_num(struct htc_target *target,
1545                                          enum htc_endpoint_id endpoint)
1546 {
1547         int num;
1548
1549         spin_lock_bh(&target->rx_lock);
1550         num = get_queue_depth(&(target->endpoint[endpoint].rx_bufq));
1551         spin_unlock_bh(&target->rx_lock);
1552
1553         return num;
1554 }
1555
1556 static int ath6kl_htc_pipe_tx(struct htc_target *target,
1557                               struct htc_packet *packet)
1558 {
1559         struct list_head queue;
1560
1561         ath6kl_dbg(ATH6KL_DBG_HTC,
1562                    "%s: endPointId: %d, buffer: 0x%p, length: %d\n",
1563                    __func__, packet->endpoint, packet->buf,
1564                    packet->act_len);
1565
1566         INIT_LIST_HEAD(&queue);
1567         list_add_tail(&packet->list, &queue);
1568
1569         return htc_send_packets_multiple(target, &queue);
1570 }
1571
1572 static int ath6kl_htc_pipe_wait_target(struct htc_target *target)
1573 {
1574         struct htc_ready_ext_msg *ready_msg;
1575         struct htc_service_connect_req connect;
1576         struct htc_service_connect_resp resp;
1577         int status = 0;
1578
1579         status = htc_wait_recv_ctrl_message(target);
1580
1581         if (status != 0)
1582                 return status;
1583
1584         if (target->pipe.ctrl_response_len < sizeof(*ready_msg)) {
1585                 ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg len:%d!\n",
1586                            target->pipe.ctrl_response_len);
1587                 return -ECOMM;
1588         }
1589
1590         ready_msg = (struct htc_ready_ext_msg *) target->pipe.ctrl_response_buf;
1591
1592         if (ready_msg->ver2_0_info.msg_id != cpu_to_le16(HTC_MSG_READY_ID)) {
1593                 ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg : 0x%X !\n",
1594                            ready_msg->ver2_0_info.msg_id);
1595                 return -ECOMM;
1596         }
1597
1598         ath6kl_dbg(ATH6KL_DBG_HTC,
1599                    "Target Ready! : transmit resources : %d size:%d\n",
1600                    ready_msg->ver2_0_info.cred_cnt,
1601                    ready_msg->ver2_0_info.cred_sz);
1602
1603         target->tgt_creds = le16_to_cpu(ready_msg->ver2_0_info.cred_cnt);
1604         target->tgt_cred_sz = le16_to_cpu(ready_msg->ver2_0_info.cred_sz);
1605
1606         if ((target->tgt_creds == 0) || (target->tgt_cred_sz == 0))
1607                 return -ECOMM;
1608
1609         htc_setup_target_buffer_assignments(target);
1610
1611         /* setup our pseudo HTC control endpoint connection */
1612         memset(&connect, 0, sizeof(connect));
1613         memset(&resp, 0, sizeof(resp));
1614         connect.ep_cb.tx_complete = htc_txctrl_complete;
1615         connect.ep_cb.rx = htc_rxctrl_complete;
1616         connect.max_txq_depth = NUM_CONTROL_TX_BUFFERS;
1617         connect.svc_id = HTC_CTRL_RSVD_SVC;
1618
1619         /* connect fake service */
1620         status = ath6kl_htc_pipe_conn_service(target, &connect, &resp);
1621
1622         return status;
1623 }
1624
1625 static void ath6kl_htc_pipe_flush_txep(struct htc_target *target,
1626                                        enum htc_endpoint_id endpoint, u16 tag)
1627 {
1628         struct htc_endpoint *ep = &target->endpoint[endpoint];
1629
1630         if (ep->svc_id == 0) {
1631                 WARN_ON_ONCE(1);
1632                 /* not in use.. */
1633                 return;
1634         }
1635
1636         htc_flush_tx_endpoint(target, ep, tag);
1637 }
1638
1639 static int ath6kl_htc_pipe_add_rxbuf_multiple(struct htc_target *target,
1640                                               struct list_head *pkt_queue)
1641 {
1642         struct htc_packet *packet, *tmp_pkt, *first;
1643         struct htc_endpoint *ep;
1644         int status = 0;
1645
1646         if (list_empty(pkt_queue))
1647                 return -EINVAL;
1648
1649         first = list_first_entry(pkt_queue, struct htc_packet, list);
1650
1651         if (first->endpoint >= ENDPOINT_MAX) {
1652                 WARN_ON_ONCE(1);
1653                 return -EINVAL;
1654         }
1655
1656         ath6kl_dbg(ATH6KL_DBG_HTC, "%s: epid: %d, cnt:%d, len: %d\n",
1657                    __func__, first->endpoint, get_queue_depth(pkt_queue),
1658                    first->buf_len);
1659
1660         ep = &target->endpoint[first->endpoint];
1661
1662         spin_lock_bh(&target->rx_lock);
1663
1664         /* store receive packets */
1665         list_splice_tail_init(pkt_queue, &ep->rx_bufq);
1666
1667         spin_unlock_bh(&target->rx_lock);
1668
1669         if (status != 0) {
1670                 /* walk through queue and mark each one canceled */
1671                 list_for_each_entry_safe(packet, tmp_pkt, pkt_queue, list) {
1672                         packet->status = -ECANCELED;
1673                 }
1674
1675                 do_recv_completion(ep, pkt_queue);
1676         }
1677
1678         return status;
1679 }
1680
1681 static void ath6kl_htc_pipe_activity_changed(struct htc_target *target,
1682                                              enum htc_endpoint_id ep,
1683                                              bool active)
1684 {
1685         /* TODO */
1686 }
1687
1688 static void ath6kl_htc_pipe_flush_rx_buf(struct htc_target *target)
1689 {
1690         /* TODO */
1691 }
1692
1693 static int ath6kl_htc_pipe_credit_setup(struct htc_target *target,
1694                                         struct ath6kl_htc_credit_info *info)
1695 {
1696         return 0;
1697 }
1698
1699 static const struct ath6kl_htc_ops ath6kl_htc_pipe_ops = {
1700         .create = ath6kl_htc_pipe_create,
1701         .wait_target = ath6kl_htc_pipe_wait_target,
1702         .start = ath6kl_htc_pipe_start,
1703         .conn_service = ath6kl_htc_pipe_conn_service,
1704         .tx = ath6kl_htc_pipe_tx,
1705         .stop = ath6kl_htc_pipe_stop,
1706         .cleanup = ath6kl_htc_pipe_cleanup,
1707         .flush_txep = ath6kl_htc_pipe_flush_txep,
1708         .flush_rx_buf = ath6kl_htc_pipe_flush_rx_buf,
1709         .activity_changed = ath6kl_htc_pipe_activity_changed,
1710         .get_rxbuf_num = ath6kl_htc_pipe_get_rxbuf_num,
1711         .add_rxbuf_multiple = ath6kl_htc_pipe_add_rxbuf_multiple,
1712         .credit_setup = ath6kl_htc_pipe_credit_setup,
1713         .tx_complete = ath6kl_htc_pipe_tx_complete,
1714         .rx_complete = ath6kl_htc_pipe_rx_complete,
1715 };
1716
1717 void ath6kl_htc_pipe_attach(struct ath6kl *ar)
1718 {
1719         ar->htc_ops = &ath6kl_htc_pipe_ops;
1720 }