brcmfmac: enable tx status signalling

Enabling the tx status signalling, which requires packet tagging
before sending to the firmware and handling the tx status signal.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 418 insertions, 67 deletions

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index cb1414d93a67..9389bf7b7696 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -19,12 +19,15 @@
 #include <linux/spinlock.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/err.h>
 #include <uapi/linux/nl80211.h>
+#include <net/cfg80211.h>
 
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 #include "dhd.h"
+#include "dhd_proto.h"
 #include "dhd_dbg.h"
 #include "dhd_bus.h"
 #include "fwil.h"
@@ -64,7 +67,7 @@
 	BRCMF_FWS_TLV_DEF(COMP_TXSTATUS, 19, 1) \
 	BRCMF_FWS_TLV_DEF(FILLER, 255, 0)
 
-/**
+/*
  * enum brcmf_fws_tlv_type - definition of tlv identifiers.
  */
 #define BRCMF_FWS_TLV_DEF(name, id, len) \
@@ -75,8 +78,18 @@ enum brcmf_fws_tlv_type {
 };
 #undef BRCMF_FWS_TLV_DEF
 
+/*
+ * enum brcmf_fws_tlv_len - definition of tlv lengths.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+	BRCMF_FWS_TYPE_ ## name ## _LEN = (len),
+enum brcmf_fws_tlv_len {
+	BRCMF_FWS_TLV_DEFLIST
+};
+#undef BRCMF_FWS_TLV_DEF
+
 #ifdef DEBUG
-/**
+/*
  * brcmf_fws_tlv_names - array of tlv names.
  */
 #define BRCMF_FWS_TLV_DEF(name, id, len) \
@@ -106,7 +119,7 @@ static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
 }
 #endif /* DEBUG */
 
-/**
+/*
  * flags used to enable tlv signalling from firmware.
  */
 #define BRCMF_FWS_FLAGS_RSSI_SIGNALS			0x0001
@@ -117,11 +130,6 @@ static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
 #define BRCMF_FWS_FLAGS_PSQ_ZERO_BUFFER_ENABLE		0x0020
 #define BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE		0x0040
 
-#define BRCMF_FWS_HANGER_MAXITEMS			1024
-#define BRCMF_FWS_HANGER_ITEM_STATE_FREE		1
-#define BRCMF_FWS_HANGER_ITEM_STATE_INUSE		2
-#define BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED	3
-
 #define BRCMF_FWS_STATE_OPEN				1
 #define BRCMF_FWS_STATE_CLOSE				2
 
@@ -135,23 +143,27 @@ static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
 #define BRCMF_FWS_PSQ_PREC_COUNT		((NL80211_NUM_ACS + 1) * 2)
 #define BRCMF_FWS_PSQ_LEN				256
 
+#define BRCMF_FWS_HTOD_FLAG_PKTFROMHOST			0x01
+#define BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED		0x02
+
 /**
  * enum brcmf_fws_skb_state - indicates processing state of skb.
+ *
+ * @BRCMF_FWS_SKBSTATE_NEW: sk_buff is newly arrived in the driver.
+ * @BRCMF_FWS_SKBSTATE_DELAYED: sk_buff had to wait on queue.
+ * @BRCMF_FWS_SKBSTATE_SUPPRESSED: sk_buff has been suppressed by firmware.
  */
 enum brcmf_fws_skb_state {
-	WLFC_PKTTYPE_NEW,
-	WLFC_PKTTYPE_DELAYED,
-	WLFC_PKTTYPE_SUPPRESSED,
-	WLFC_PKTTYPE_MAX
+	BRCMF_FWS_SKBSTATE_NEW,
+	BRCMF_FWS_SKBSTATE_DELAYED,
+	BRCMF_FWS_SKBSTATE_SUPPRESSED
 };
 
 /**
  * struct brcmf_skbuff_cb - control buffer associated with skbuff.
  *
  * @if_flags: holds interface index and packet related flags.
- * @da: destination MAC address extracted from skbuff once.
  * @htod: host to device packet identifier (used in PKTTAG tlv).
- * @needs_hdr: the packet does not yet have a BDC header.
  * @state: transmit state of the packet.
  * @mac: descriptor related to destination for this packet.
  *
@@ -160,19 +172,17 @@ enum brcmf_fws_skb_state {
  */
 struct brcmf_skbuff_cb {
 	u16 if_flags;
-	u8 da[ETH_ALEN];
 	u32 htod;
-	u8 needs_hdr;
 	enum brcmf_fws_skb_state state;
 	struct brcmf_fws_mac_descriptor *mac;
 };
 
-/**
+/*
  * macro casting skbuff control buffer to struct brcmf_skbuff_cb.
  */
 #define brcmf_skbcb(skb)	((struct brcmf_skbuff_cb *)((skb)->cb))
 
-/**
+/*
  * sk_buff control if flags
  *
  *	b[11]  - packet sent upon firmware request.
@@ -207,7 +217,7 @@ struct brcmf_skbuff_cb {
 			BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
 			BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT)
 
-/**
+/*
  * sk_buff control packet identifier
  *
  * 32-bit packet identifier used in PKTTAG tlv from host to dongle.
@@ -242,6 +252,61 @@ struct brcmf_skbuff_cb {
 			BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
 			BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT)
 
+#define BRCMF_FWS_TXSTAT_GENERATION_MASK	0x80000000
+#define BRCMF_FWS_TXSTAT_GENERATION_SHIFT	31
+#define BRCMF_FWS_TXSTAT_FLAGS_MASK		0x78000000
+#define BRCMF_FWS_TXSTAT_FLAGS_SHIFT		27
+#define BRCMF_FWS_TXSTAT_FIFO_MASK		0x07000000
+#define BRCMF_FWS_TXSTAT_FIFO_SHIFT		24
+#define BRCMF_FWS_TXSTAT_HSLOT_MASK		0x00FFFF00
+#define BRCMF_FWS_TXSTAT_HSLOT_SHIFT		8
+#define BRCMF_FWS_TXSTAT_PKTID_MASK		0x00FFFFFF
+#define BRCMF_FWS_TXSTAT_PKTID_SHIFT		0
+
+#define brcmf_txstatus_get_field(txs, field) \
+	brcmu_maskget32(txs, BRCMF_FWS_TXSTAT_ ## field ## _MASK, \
+			BRCMF_FWS_TXSTAT_ ## field ## _SHIFT)
+
+/**
+ * enum brcmf_fws_fifo - fifo indices used by dongle firmware.
+ *
+ * @BRCMF_FWS_FIFO_AC_BK: fifo for background traffic.
+ * @BRCMF_FWS_FIFO_AC_BE: fifo for best-effort traffic.
+ * @BRCMF_FWS_FIFO_AC_VI: fifo for video traffic.
+ * @BRCMF_FWS_FIFO_AC_VO: fifo for voice traffic.
+ * @BRCMF_FWS_FIFO_BCMC: fifo for broadcast/multicast (AP only).
+ * @BRCMF_FWS_FIFO_ATIM: fifo for ATIM (AP only).
+ * @BRCMF_FWS_FIFO_COUNT: number of fifos.
+ */
+enum brcmf_fws_fifo {
+	BRCMF_FWS_FIFO_AC_BK,
+	BRCMF_FWS_FIFO_AC_BE,
+	BRCMF_FWS_FIFO_AC_VI,
+	BRCMF_FWS_FIFO_AC_VO,
+	BRCMF_FWS_FIFO_BCMC,
+	BRCMF_FWS_FIFO_ATIM,
+	BRCMF_FWS_FIFO_COUNT
+};
+
+/**
+ * enum brcmf_fws_txstatus - txstatus flag values.
+ *
+ * @BRCMF_FWS_TXSTATUS_DISCARD:
+ *	host is free to discard the packet.
+ * @BRCMF_FWS_TXSTATUS_CORE_SUPPRESS:
+ *	802.11 core suppressed the packet.
+ * @BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS:
+ *	firmware suppress the packet as device is already in PS mode.
+ * @BRCMF_FWS_TXSTATUS_FW_TOSSED:
+ *	firmware tossed the packet.
+ */
+enum brcmf_fws_txstatus {
+	BRCMF_FWS_TXSTATUS_DISCARD,
+	BRCMF_FWS_TXSTATUS_CORE_SUPPRESS,
+	BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS,
+	BRCMF_FWS_TXSTATUS_FW_TOSSED
+};
+
 enum brcmf_fws_fcmode {
 	BRCMF_FWS_FCMODE_NONE,
 	BRCMF_FWS_FCMODE_IMPLIED_CREDIT,
@@ -255,20 +320,28 @@ enum brcmf_fws_fcmode {
  * @mac_handle: handle for mac entry determined by firmware.
  * @interface_id: interface index.
  * @state: current state.
+ * @suppressed: mac entry is suppressed.
+ * @generation: generation bit.
  * @ac_bitmap: ac queue bitmap.
  * @requested_credit: credits requested by firmware.
  * @ea: ethernet address.
+ * @seq: per-node free-running sequence.
  * @psq: power-save queue.
+ * @transit_count: packet in transit to firmware.
  */
 struct brcmf_fws_mac_descriptor {
 	u8 occupied;
 	u8 mac_handle;
 	u8 interface_id;
 	u8 state;
+	bool suppressed;
+	u8 generation;
 	u8 ac_bitmap;
 	u8 requested_credit;
 	u8 ea[ETH_ALEN];
+	u8 seq[BRCMF_FWS_FIFO_COUNT];
 	struct pktq psq;
+	int transit_count;
 };
 
 #define BRCMF_FWS_HANGER_MAXITEMS	1024
@@ -276,14 +349,14 @@ struct brcmf_fws_mac_descriptor {
 /**
  * enum brcmf_fws_hanger_item_state - state of hanger item.
  *
- * @WLFC_HANGER_ITEM_STATE_FREE: item is free for use.
- * @WLFC_HANGER_ITEM_STATE_INUSE: item is in use.
- * @WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED: item was suppressed.
+ * @BRCMF_FWS_HANGER_ITEM_STATE_FREE: item is free for use.
+ * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE: item is in use.
+ * @BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED: item was suppressed.
  */
 enum brcmf_fws_hanger_item_state {
-	WLFC_HANGER_ITEM_STATE_FREE = 1,
-	WLFC_HANGER_ITEM_STATE_INUSE,
-	WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED
+	BRCMF_FWS_HANGER_ITEM_STATE_FREE = 1,
+	BRCMF_FWS_HANGER_ITEM_STATE_INUSE,
+	BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED
 };
 
 
@@ -292,21 +365,17 @@ enum brcmf_fws_hanger_item_state {
  *
  * @state: entry is either free or occupied.
  * @gen: generation.
- * @identifier: packet identifier.
  * @pkt: packet itself.
  */
 struct brcmf_fws_hanger_item {
 	enum brcmf_fws_hanger_item_state state;
 	u8 gen;
-	u8 pad[2];
-	u32 identifier;
 	struct sk_buff *pkt;
 };
 
 /**
  * struct brcmf_fws_hanger - holds packets awaiting firmware txstatus.
  *
- * @max_items: number of packets it can hold.
  * @pushed: packets pushed to await txstatus.
  * @popped: packets popped upon handling txstatus.
  * @failed_to_push: packets that could not be pushed.
@@ -332,20 +401,39 @@ struct brcmf_fws_info {
 	struct brcmf_fws_mac_descriptor nodes[BRCMF_FWS_MAC_DESC_TABLE_SIZE];
 	struct brcmf_fws_mac_descriptor other;
 	enum brcmf_fws_fcmode fcmode;
-	int fifo_credit[NL80211_NUM_ACS+1+1];
+	int fifo_credit[BRCMF_FWS_FIFO_COUNT];
+};
+
+/*
+ * brcmf_fws_prio2fifo - mapping from 802.1d priority to firmware fifo index.
+ */
+static const int brcmf_fws_prio2fifo[] = {
+	BRCMF_FWS_FIFO_AC_BE,
+	BRCMF_FWS_FIFO_AC_BK,
+	BRCMF_FWS_FIFO_AC_BK,
+	BRCMF_FWS_FIFO_AC_BE,
+	BRCMF_FWS_FIFO_AC_VI,
+	BRCMF_FWS_FIFO_AC_VI,
+	BRCMF_FWS_FIFO_AC_VO,
+	BRCMF_FWS_FIFO_AC_VO
 };
 
 static int fcmode;
 module_param(fcmode, int, S_IRUSR);
 MODULE_PARM_DESC(fcmode, "mode of firmware signalled flow control");
 
-/**
- * brcmf_fws_get_tlv_len() - returns defined length for given tlv id.
- */
 #define BRCMF_FWS_TLV_DEF(name, id, len) \
 	case BRCMF_FWS_TYPE_ ## name: \
 		return len;
 
+/**
+ * brcmf_fws_get_tlv_len() - returns defined length for given tlv id.
+ *
+ * @fws: firmware-signalling information.
+ * @id: identifier of the TLV.
+ *
+ * Return: the specified length for the given TLV; Otherwise -EINVAL.
+ */
 static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
 				 enum brcmf_fws_tlv_type id)
 {
@@ -360,6 +448,30 @@ static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
 }
 #undef BRCMF_FWS_TLV_DEF
 
+static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
+{
+	u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
+	return ifidx == *(int *)arg;
+}
+
+static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+				int ifidx)
+{
+	bool (*matchfn)(struct sk_buff *, void *) = NULL;
+	struct sk_buff *skb;
+	int prec;
+
+	if (ifidx != -1)
+		matchfn = brcmf_fws_ifidx_match;
+	for (prec = 0; prec < q->num_prec; prec++) {
+		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+		while (skb) {
+			brcmf_txfinalize(fws->drvr, skb, false);
+			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+		}
+	}
+}
+
 static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
 {
 	int i;
@@ -367,10 +479,10 @@ static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
 	brcmf_dbg(TRACE, "enter\n");
 	memset(hanger, 0, sizeof(*hanger));
 	for (i = 0; i < ARRAY_SIZE(hanger->items); i++)
-		hanger->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+		hanger->items[i].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
 }
 
-static __used u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
+static u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
 {
 	u32 i;
 
@@ -378,7 +490,7 @@ static __used u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
 	i = (h->slot_pos + 1) % BRCMF_FWS_HANGER_MAXITEMS;
 
 	while (i != h->slot_pos) {
-		if (h->items[i].state == WLFC_HANGER_ITEM_STATE_FREE) {
+		if (h->items[i].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
 			h->slot_pos = i;
 			return i;
 		}
@@ -391,7 +503,7 @@ static __used u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
 	return BRCMF_FWS_HANGER_MAXITEMS;
 }
 
-static __used int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
+static int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
 					   struct sk_buff *pkt, u32 slot_id)
 {
 	brcmf_dbg(TRACE, "enter\n");
@@ -406,12 +518,11 @@ static __used int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
 
 	h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE;
 	h->items[slot_id].pkt = pkt;
-	h->items[slot_id].identifier = slot_id;
 	h->pushed++;
 	return 0;
 }
 
-static __used int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
+static int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
 					  u32 slot_id, struct sk_buff **pktout,
 					  bool remove_item)
 {
@@ -429,7 +540,6 @@ static __used int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
 	if (remove_item) {
 		h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
 		h->items[slot_id].pkt = NULL;
-		h->items[slot_id].identifier = 0;
 		h->items[slot_id].gen = 0xff;
 		h->popped++;
 	}
@@ -446,16 +556,16 @@ static __used int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
 
 	h->items[slot_id].gen = gen;
 
-	if (h->items[slot_id].state != WLFC_HANGER_ITEM_STATE_INUSE) {
+	if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_INUSE) {
 		brcmf_err("entry not in use\n");
 		return -EINVAL;
 	}
 
-	h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
+	h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
 	return 0;
 }
 
-static __used int brcmf_fws_hanger_get_genbit(struct brcmf_fws_hanger *hanger,
+static int brcmf_fws_hanger_get_genbit(struct brcmf_fws_hanger *hanger,
 					      struct sk_buff *pkt, u32 slot_id,
 					      int *gen)
 {
@@ -542,17 +652,50 @@ brcmf_fws_mac_descriptor_lookup(struct brcmf_fws_info *fws, u8 *ea)
 	return ERR_PTR(-ENOENT);
 }
 
-static void brcmf_fws_mac_desc_cleanup(struct brcmf_fws_mac_descriptor *entry,
-				       bool (*fn)(struct sk_buff *, void *),
+static struct brcmf_fws_mac_descriptor*
+brcmf_fws_find_mac_desc(struct brcmf_fws_info *fws, int ifidx, u8 *da)
+{
+	struct brcmf_fws_mac_descriptor *entry = &fws->other;
+	struct brcmf_if *ifp;
+	bool multicast;
+
+	brcmf_dbg(TRACE, "enter: ifidx=%d\n", ifidx);
+
+	multicast = is_multicast_ether_addr(da);
+	ifp = fws->drvr->iflist[ifidx ? ifidx + 1 : 0];
+	if (WARN_ON(!ifp))
+		goto done;
+
+	/* Multicast destination and P2P clients get the interface entry.
+	 * STA gets the interface entry if there is no exact match. For
+	 * example, TDLS destinations have their own entry.
+	 */
+	entry = NULL;
+	if ((/* ifp->iftype == 0 ||*/ multicast) && ifp->fws_desc)
+		entry = ifp->fws_desc;
+
+	if (entry != NULL && multicast)
+		goto done;
+
+	entry = brcmf_fws_mac_descriptor_lookup(fws, da);
+	if (IS_ERR(entry))
+		entry = &fws->other;
+
+done:
+	brcmf_dbg(TRACE, "exit: entry=%p\n", entry);
+	return entry;
+}
+
+static void brcmf_fws_mac_desc_cleanup(struct brcmf_fws_info *fws,
+				       struct brcmf_fws_mac_descriptor *entry,
 				       int ifidx)
 {
-	brcmf_dbg(TRACE, "enter: entry=(ea=%pM,ifid=%d), ifidx=%d\n",
+	brcmf_dbg(TRACE, "enter: entry=(ea=%pM, ifid=%d), ifidx=%d\n",
 		  entry->ea, entry->interface_id, ifidx);
-	if (entry->occupied && (fn == NULL || (ifidx == entry->interface_id))) {
-		brcmf_dbg(TRACE, "flush delayQ: ifidx=%d, qlen=%d\n",
+	if (entry->occupied && (ifidx == -1 || ifidx == entry->interface_id)) {
+		brcmf_dbg(TRACE, "flush psq: ifidx=%d, qlen=%d\n",
 			  ifidx, entry->psq.len);
-		/* release packets held in DELAYQ */
-		brcmu_pktq_flush(&entry->psq, true, fn, &ifidx);
+		brcmf_fws_psq_flush(fws, &entry->psq, ifidx);
 		entry->occupied = !!(entry->psq.len);
 	}
 }
@@ -587,12 +730,6 @@ static void brcmf_fws_bus_txq_cleanup(struct brcmf_fws_info *fws,
 	}
 }
 
-static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
-{
-	u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
-	return ifidx == *(int *)arg;
-}
-
 static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
 {
 	int i;
@@ -609,9 +746,9 @@ static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
 	/* cleanup individual nodes */
 	table = &fws->nodes[0];
 	for (i = 0; i < ARRAY_SIZE(fws->nodes); i++)
-		brcmf_fws_mac_desc_cleanup(&table[i], matchfn, ifidx);
+		brcmf_fws_mac_desc_cleanup(fws, &table[i], ifidx);
 
-	brcmf_fws_mac_desc_cleanup(&fws->other, matchfn, ifidx);
+	brcmf_fws_mac_desc_cleanup(fws, &fws->other, ifidx);
 	brcmf_fws_bus_txq_cleanup(fws, matchfn, ifidx);
 	brcmf_fws_hanger_cleanup(&fws->hanger, matchfn, ifidx);
 }
@@ -637,17 +774,15 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
 	entry = &fws->nodes[mac_handle & 0x1F];
 	if (type == BRCMF_FWS_TYPE_MACDESC_DEL) {
 		brcmf_dbg(TRACE, "deleting mac %pM idx %d\n", addr, ifidx);
-		if (entry->occupied) {
-			entry->occupied = 0;
-			entry->state = BRCMF_FWS_STATE_CLOSE;
-			entry->requested_credit = 0;
-		} else {
+		if (entry->occupied)
+			brcmf_fws_clear_mac_descriptor(entry);
+		else
 			fws->stats.mac_update_failed++;
-		}
 		return 0;
 	}
 
-	brcmf_dbg(TRACE, "add mac %pM idx %d\n", addr, ifidx);
+	brcmf_dbg(TRACE,
+		  "add mac %pM handle %u idx %d\n", addr, mac_handle, ifidx);
 	existing = brcmf_fws_mac_descriptor_lookup(fws, addr);
 	if (IS_ERR(existing)) {
 		if (!entry->occupied) {
@@ -674,6 +809,51 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
 	return 0;
 }
 
+static int
+brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
+{
+	u8 flags;
+	u32 status;
+	u32 hslot;
+	int ret;
+	struct sk_buff *skb;
+	struct brcmf_fws_mac_descriptor *entry = NULL;
+
+	status = le32_to_cpu(*(__le32 *)data);
+	flags = brcmf_txstatus_get_field(status, FLAGS);
+	hslot = brcmf_txstatus_get_field(status, HSLOT);
+	fws->stats.txs_indicate++;
+
+	brcmf_dbg(TRACE, "status: flags=0x%X, hslot=%d\n",
+		  flags, hslot);
+
+	if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
+		fws->stats.txs_discard++;
+	else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
+		fws->stats.txs_tossed++;
+	else
+		brcmf_err("unexpected txstatus\n");
+
+	ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+				      true);
+	if (ret != 0) {
+		brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
+		return ret;
+	}
+
+	entry = brcmf_skbcb(skb)->mac;
+	if (WARN_ON(!entry)) {
+		ret = -EINVAL;
+		goto done;
+	}
+
+	entry->transit_count--;
+
+done:
+	brcmf_txfinalize(fws->drvr, skb, true);
+	return ret;
+}
+
 static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
 {
 	__le32 timestamp;
@@ -723,7 +903,8 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
 	/* enable rssi signals */
 	if (drvr->fw_signals)
 		tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS |
-		      BRCMF_FWS_FLAGS_XONXOFF_SIGNALS;
+		      BRCMF_FWS_FLAGS_XONXOFF_SIGNALS |
+		      BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS;
 
 	spin_lock_init(&drvr->fws_spinlock);
 
@@ -839,7 +1020,6 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
 		case BRCMF_FWS_TYPE_MAC_OPEN:
 		case BRCMF_FWS_TYPE_MAC_CLOSE:
 		case BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT:
-		case BRCMF_FWS_TYPE_TXSTATUS:
 		case BRCMF_FWS_TYPE_PKTTAG:
 		case BRCMF_FWS_TYPE_INTERFACE_OPEN:
 		case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
@@ -853,6 +1033,9 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
 		case BRCMF_FWS_TYPE_MACDESC_DEL:
 			brcmf_fws_macdesc_indicate(fws, type, data);
 			break;
+		case BRCMF_FWS_TYPE_TXSTATUS:
+			brcmf_fws_txstatus_indicate(fws, data);
+			break;
 		case BRCMF_FWS_TYPE_RSSI:
 			brcmf_fws_rssi_indicate(fws, *data);
 			break;
@@ -885,6 +1068,174 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
 	return 0;
 }
 
+static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
+{
+	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
+	u8 *wlh;
+	u16 data_offset;
+	u8 fillers;
+	__le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
+
+	brcmf_dbg(TRACE, "enter: ea=%pM, ifidx=%u, pkttag=0x%08X\n",
+		  entry->ea, entry->interface_id, le32_to_cpu(pkttag));
+	/* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
+	data_offset = 2 + BRCMF_FWS_TYPE_PKTTAG_LEN;
+	fillers = round_up(data_offset, 4) - data_offset;
+	data_offset += fillers;
+
+	skb_push(skb, data_offset);
+	wlh = skb->data;
+
+	wlh[0] = BRCMF_FWS_TYPE_PKTTAG;
+	wlh[1] = BRCMF_FWS_TYPE_PKTTAG_LEN;
+	memcpy(&wlh[2], &pkttag, sizeof(pkttag));
+	wlh += BRCMF_FWS_TYPE_PKTTAG_LEN + 2;
+
+	if (fillers)
+		memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers);
+
+	brcmf_proto_hdrpush(fws->drvr, brcmf_skb_if_flags_get_field(skb, INDEX),
+			    data_offset >> 2, skb);
+	return 0;
+}
+
+static int brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
+				   struct sk_buff *p)
+{
+	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
+	struct brcmf_fws_mac_descriptor *entry = skcb->mac;
+	int rc = 0;
+	bool header_needed;
+	int hslot = BRCMF_FWS_HANGER_MAXITEMS;
+	u8 free_ctr;
+	u8 ifidx;
+	u8 flags;
+
+	header_needed = skcb->state == BRCMF_FWS_SKBSTATE_NEW;
+
+	if (header_needed) {
+		/* obtaining free slot may fail, but that will be caught
+		 * by the hanger push. This assures the packet has a BDC
+		 * header upon return.
+		 */
+		hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
+		free_ctr = entry->seq[fifo];
+		brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
+		brcmf_skb_htod_tag_set_field(p, FREERUN, free_ctr);
+		brcmf_skb_htod_tag_set_field(p, GENERATION, 1);
+		entry->transit_count++;
+	}
+	brcmf_skb_if_flags_set_field(p, TRANSMIT, 1);
+	brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
+
+	flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
+	if (!(skcb->if_flags & BRCMF_SKB_IF_FLAGS_CREDITCHECK_MASK)) {
+		/*
+		Indicate that this packet is being sent in response to an
+		explicit request from the firmware side.
+		*/
+		flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
+	}
+	brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
+	if (header_needed) {
+		brcmf_fws_hdrpush(fws, p);
+		rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
+		if (rc)
+			brcmf_err("hanger push failed: rc=%d\n", rc);
+	} else {
+		int gen;
+
+		/* remove old header */
+		rc = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, p);
+		if (rc == 0) {
+			hslot = brcmf_skb_htod_tag_get_field(p, HSLOT);
+			brcmf_fws_hanger_get_genbit(&fws->hanger, p,
+						    hslot, &gen);
+			brcmf_skb_htod_tag_set_field(p, GENERATION, gen);
+
+			/* push new header */
+			brcmf_fws_hdrpush(fws, p);
+		}
+	}
+
+	return rc;
+}
+
+static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
+				struct sk_buff *skb)
+{
+	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
+	struct brcmf_fws_mac_descriptor *entry;
+	struct brcmf_bus *bus = fws->drvr->bus_if;
+	int rc;
+
+	entry = skcb->mac;
+	if (IS_ERR(entry))
+		return PTR_ERR(entry);
+
+	rc = brcmf_fws_precommit_skb(fws, fifo, skb);
+	if (rc < 0) {
+		fws->stats.generic_error++;
+		goto done;
+	}
+
+	rc = brcmf_bus_txdata(bus, skb);
+	if (rc < 0)
+		goto done;
+
+	entry->seq[fifo]++;
+	fws->stats.pkt2bus++;
+	return rc;
+
+done:
+	brcmf_txfinalize(fws->drvr, skb, false);
+	return rc;
+}
+
+int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
+{
+	struct brcmf_pub *drvr = ifp->drvr;
+	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
+	struct ethhdr *eh = (struct ethhdr *)(skb->data);
+	ulong flags;
+	u8 ifidx = ifp->ifidx;
+	int fifo = BRCMF_FWS_FIFO_BCMC;
+	bool multicast = is_multicast_ether_addr(eh->h_dest);
+
+	/* determine the priority */
+	if (!skb->priority)
+		skb->priority = cfg80211_classify8021d(skb);
+
+	drvr->tx_multicast += !!multicast;
+	if (ntohs(eh->h_proto) == ETH_P_PAE)
+		atomic_inc(&ifp->pend_8021x_cnt);
+
+	if (!brcmf_fws_fc_active(drvr->fws)) {
+		/* If the protocol uses a data header, apply it */
+		brcmf_proto_hdrpush(drvr, ifidx, 0, skb);
+
+		/* Use bus module to send data frame */
+		return brcmf_bus_txdata(drvr->bus_if, skb);
+	}
+
+	/* set control buffer information */
+	skcb->mac = brcmf_fws_find_mac_desc(drvr->fws, ifidx, eh->h_dest);
+	skcb->state = BRCMF_FWS_SKBSTATE_NEW;
+	brcmf_skb_if_flags_set_field(skb, INDEX, ifidx);
+	if (!multicast)
+		fifo = brcmf_fws_prio2fifo[skb->priority];
+	brcmf_skb_if_flags_set_field(skb, FIFO, fifo);
+	brcmf_skb_if_flags_set_field(skb, CREDITCHECK, 0);
+
+	brcmf_dbg(TRACE, "ea=%pM, multi=%d, fifo=%d\n", eh->h_dest,
+		  multicast, fifo);
+
+	brcmf_fws_lock(drvr, flags);
+	brcmf_fws_commit_skb(drvr->fws, fifo, skb);
+	brcmf_fws_unlock(drvr, flags);
+	return 0;
+}
+
 void brcmf_fws_reset_interface(struct brcmf_if *ifp)
 {
 	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;