Revert "b43: Enforce DMA descriptor memory constraints"
[safe/jmp/linux-2.6] / drivers / net / wireless / b43 / dma.c
index 8a9776b..88d1fd0 100644 (file)
 #include <asm/div64.h>
 
 
+/* Required number of TX DMA slots per TX frame.
+ * This currently is 2, because we put the header and the ieee80211 frame
+ * into separate slots. */
+#define TX_SLOTS_PER_FRAME     2
+
+
 /* 32bit DMA ops. */
 static
 struct b43_dmadesc_generic *op32_idx2desc(struct b43_dmaring *ring,
@@ -74,8 +80,7 @@ static void op32_fill_descriptor(struct b43_dmaring *ring,
        addrext = (u32) (dmaaddr & SSB_DMA_TRANSLATION_MASK)
            >> SSB_DMA_TRANSLATION_SHIFT;
        addr |= ssb_dma_translation(ring->dev->dev);
-       ctl = (bufsize - ring->frameoffset)
-           & B43_DMA32_DCTL_BYTECNT;
+       ctl = bufsize & B43_DMA32_DCTL_BYTECNT;
        if (slot == ring->nr_slots - 1)
                ctl |= B43_DMA32_DCTL_DTABLEEND;
        if (start)
@@ -177,8 +182,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
                ctl0 |= B43_DMA64_DCTL0_FRAMEEND;
        if (irq)
                ctl0 |= B43_DMA64_DCTL0_IRQ;
-       ctl1 |= (bufsize - ring->frameoffset)
-           & B43_DMA64_DCTL1_BYTECNT;
+       ctl1 |= bufsize & B43_DMA64_DCTL1_BYTECNT;
        ctl1 |= (addrext << B43_DMA64_DCTL1_ADDREXT_SHIFT)
            & B43_DMA64_DCTL1_ADDREXT_MASK;
 
@@ -328,11 +332,11 @@ static inline
        dma_addr_t dmaaddr;
 
        if (tx) {
-               dmaaddr = dma_map_single(ring->dev->dev->dev,
-                                        buf, len, DMA_TO_DEVICE);
+               dmaaddr = ssb_dma_map_single(ring->dev->dev,
+                                            buf, len, DMA_TO_DEVICE);
        } else {
-               dmaaddr = dma_map_single(ring->dev->dev->dev,
-                                        buf, len, DMA_FROM_DEVICE);
+               dmaaddr = ssb_dma_map_single(ring->dev->dev,
+                                            buf, len, DMA_FROM_DEVICE);
        }
 
        return dmaaddr;
@@ -343,10 +347,11 @@ static inline
                          dma_addr_t addr, size_t len, int tx)
 {
        if (tx) {
-               dma_unmap_single(ring->dev->dev->dev, addr, len, DMA_TO_DEVICE);
+               ssb_dma_unmap_single(ring->dev->dev,
+                                    addr, len, DMA_TO_DEVICE);
        } else {
-               dma_unmap_single(ring->dev->dev->dev,
-                                addr, len, DMA_FROM_DEVICE);
+               ssb_dma_unmap_single(ring->dev->dev,
+                                    addr, len, DMA_FROM_DEVICE);
        }
 }
 
@@ -355,8 +360,8 @@ static inline
                                 dma_addr_t addr, size_t len)
 {
        B43_WARN_ON(ring->tx);
-       dma_sync_single_for_cpu(ring->dev->dev->dev,
-                               addr, len, DMA_FROM_DEVICE);
+       ssb_dma_sync_single_for_cpu(ring->dev->dev,
+                                   addr, len, DMA_FROM_DEVICE);
 }
 
 static inline
@@ -364,8 +369,8 @@ static inline
                                    dma_addr_t addr, size_t len)
 {
        B43_WARN_ON(ring->tx);
-       dma_sync_single_for_device(ring->dev->dev->dev,
-                                  addr, len, DMA_FROM_DEVICE);
+       ssb_dma_sync_single_for_device(ring->dev->dev,
+                                      addr, len, DMA_FROM_DEVICE);
 }
 
 static inline
@@ -380,7 +385,6 @@ static inline
 
 static int alloc_ringmemory(struct b43_dmaring *ring)
 {
-       struct device *dev = ring->dev->dev->dev;
        gfp_t flags = GFP_KERNEL;
 
        /* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
@@ -391,11 +395,14 @@ static int alloc_ringmemory(struct b43_dmaring *ring)
         * For unknown reasons - possibly a hardware error - the BCM4311 rev
         * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
         * which accounts for the GFP_DMA flag below.
+        *
+        * The flags here must match the flags in free_ringmemory below!
         */
        if (ring->type == B43_DMA_64BIT)
                flags |= GFP_DMA;
-       ring->descbase = dma_alloc_coherent(dev, B43_DMA_RINGMEMSIZE,
-                                           &(ring->dmabase), flags);
+       ring->descbase = ssb_dma_alloc_consistent(ring->dev->dev,
+                                                 B43_DMA_RINGMEMSIZE,
+                                                 &(ring->dmabase), flags);
        if (!ring->descbase) {
                b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
                return -ENOMEM;
@@ -407,10 +414,13 @@ static int alloc_ringmemory(struct b43_dmaring *ring)
 
 static void free_ringmemory(struct b43_dmaring *ring)
 {
-       struct device *dev = ring->dev->dev->dev;
+       gfp_t flags = GFP_KERNEL;
+
+       if (ring->type == B43_DMA_64BIT)
+               flags |= GFP_DMA;
 
-       dma_free_coherent(dev, B43_DMA_RINGMEMSIZE,
-                         ring->descbase, ring->dmabase);
+       ssb_dma_free_consistent(ring->dev->dev, B43_DMA_RINGMEMSIZE,
+                               ring->descbase, ring->dmabase, flags);
 }
 
 /* Reset the RX DMA channel */
@@ -517,7 +527,7 @@ static bool b43_dma_mapping_error(struct b43_dmaring *ring,
                                  dma_addr_t addr,
                                  size_t buffersize, bool dma_to_device)
 {
-       if (unlikely(dma_mapping_error(addr)))
+       if (unlikely(ssb_dma_mapping_error(ring->dev->dev, addr)))
                return 1;
 
        switch (ring->type) {
@@ -545,12 +555,32 @@ address_error:
        return 1;
 }
 
+static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb)
+{
+       unsigned char *f = skb->data + ring->frameoffset;
+
+       return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7]) == 0xFF);
+}
+
+static void b43_poison_rx_buffer(struct b43_dmaring *ring, struct sk_buff *skb)
+{
+       struct b43_rxhdr_fw4 *rxhdr;
+       unsigned char *frame;
+
+       /* This poisons the RX buffer to detect DMA failures. */
+
+       rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
+       rxhdr->frame_len = 0;
+
+       B43_WARN_ON(ring->rx_buffersize < ring->frameoffset + sizeof(struct b43_plcp_hdr6) + 2);
+       frame = skb->data + ring->frameoffset;
+       memset(frame, 0xFF, sizeof(struct b43_plcp_hdr6) + 2 /* padding */);
+}
+
 static int setup_rx_descbuffer(struct b43_dmaring *ring,
                               struct b43_dmadesc_generic *desc,
                               struct b43_dmadesc_meta *meta, gfp_t gfp_flags)
 {
-       struct b43_rxhdr_fw4 *rxhdr;
-       struct b43_hwtxstatus *txstat;
        dma_addr_t dmaaddr;
        struct sk_buff *skb;
 
@@ -559,6 +589,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
        skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
        if (unlikely(!skb))
                return -ENOMEM;
+       b43_poison_rx_buffer(ring, skb);
        dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
        if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
                /* ugh. try to realloc in zone_dma */
@@ -569,13 +600,14 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
                skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
                if (unlikely(!skb))
                        return -ENOMEM;
+               b43_poison_rx_buffer(ring, skb);
                dmaaddr = map_descbuffer(ring, skb->data,
                                         ring->rx_buffersize, 0);
-       }
-
-       if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
-               dev_kfree_skb_any(skb);
-               return -EIO;
+               if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
+                       b43err(ring->dev->wl, "RX DMA buffer allocation failed\n");
+                       dev_kfree_skb_any(skb);
+                       return -EIO;
+               }
        }
 
        meta->skb = skb;
@@ -583,11 +615,6 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
        ring->ops->fill_descriptor(ring, desc, dmaaddr,
                                   ring->rx_buffersize, 0, 0, 0);
 
-       rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
-       rxhdr->frame_len = 0;
-       txstat = (struct b43_hwtxstatus *)(skb->data);
-       txstat->cookie = 0;
-
        return 0;
 }
 
@@ -743,7 +770,7 @@ static void free_all_descbuffers(struct b43_dmaring *ring)
        for (i = 0; i < ring->nr_slots; i++) {
                desc = ring->ops->idx2desc(ring, i, &meta);
 
-               if (!meta->skb) {
+               if (!meta->skb || b43_dma_ptr_is_poisoned(meta->skb)) {
                        B43_WARN_ON(!ring->tx);
                        continue;
                }
@@ -765,14 +792,26 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
 
        tmp = b43_read32(dev, SSB_TMSHIGH);
        if (tmp & SSB_TMSHIGH_DMA64)
-               return DMA_64BIT_MASK;
+               return DMA_BIT_MASK(64);
        mmio_base = b43_dmacontroller_base(0, 0);
        b43_write32(dev, mmio_base + B43_DMA32_TXCTL, B43_DMA32_TXADDREXT_MASK);
        tmp = b43_read32(dev, mmio_base + B43_DMA32_TXCTL);
        if (tmp & B43_DMA32_TXADDREXT_MASK)
-               return DMA_32BIT_MASK;
+               return DMA_BIT_MASK(32);
+
+       return DMA_BIT_MASK(30);
+}
 
-       return DMA_30BIT_MASK;
+static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask)
+{
+       if (dmamask == DMA_BIT_MASK(30))
+               return B43_DMA_30BIT;
+       if (dmamask == DMA_BIT_MASK(32))
+               return B43_DMA_32BIT;
+       if (dmamask == DMA_BIT_MASK(64))
+               return B43_DMA_64BIT;
+       B43_WARN_ON(1);
+       return B43_DMA_30BIT;
 }
 
 /* Main initialization function. */
@@ -783,86 +822,90 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                                      enum b43_dmatype type)
 {
        struct b43_dmaring *ring;
-       int err;
-       int nr_slots;
+       int i, err;
        dma_addr_t dma_test;
 
        ring = kzalloc(sizeof(*ring), GFP_KERNEL);
        if (!ring)
                goto out;
-       ring->type = type;
 
-       nr_slots = B43_RXRING_SLOTS;
+       ring->nr_slots = B43_RXRING_SLOTS;
        if (for_tx)
-               nr_slots = B43_TXRING_SLOTS;
+               ring->nr_slots = B43_TXRING_SLOTS;
 
-       ring->meta = kcalloc(nr_slots, sizeof(struct b43_dmadesc_meta),
+       ring->meta = kcalloc(ring->nr_slots, sizeof(struct b43_dmadesc_meta),
                             GFP_KERNEL);
        if (!ring->meta)
                goto err_kfree_ring;
+       for (i = 0; i < ring->nr_slots; i++)
+               ring->meta->skb = B43_DMA_PTR_POISON;
+
+       ring->type = type;
+       ring->dev = dev;
+       ring->mmio_base = b43_dmacontroller_base(type, controller_index);
+       ring->index = controller_index;
+       if (type == B43_DMA_64BIT)
+               ring->ops = &dma64_ops;
+       else
+               ring->ops = &dma32_ops;
+       if (for_tx) {
+               ring->tx = 1;
+               ring->current_slot = -1;
+       } else {
+               if (ring->index == 0) {
+                       ring->rx_buffersize = B43_DMA0_RX_BUFFERSIZE;
+                       ring->frameoffset = B43_DMA0_RX_FRAMEOFFSET;
+               } else
+                       B43_WARN_ON(1);
+       }
+#ifdef CONFIG_B43_DEBUG
+       ring->last_injected_overflow = jiffies;
+#endif
+
        if (for_tx) {
-               ring->txhdr_cache = kcalloc(nr_slots,
+               /* Assumption: B43_TXRING_SLOTS can be divided by TX_SLOTS_PER_FRAME */
+               BUILD_BUG_ON(B43_TXRING_SLOTS % TX_SLOTS_PER_FRAME != 0);
+
+               ring->txhdr_cache = kcalloc(ring->nr_slots / TX_SLOTS_PER_FRAME,
                                            b43_txhdr_size(dev),
                                            GFP_KERNEL);
                if (!ring->txhdr_cache)
                        goto err_kfree_meta;
 
                /* test for ability to dma to txhdr_cache */
-               dma_test = dma_map_single(dev->dev->dev,
-                                         ring->txhdr_cache,
-                                         b43_txhdr_size(dev),
-                                         DMA_TO_DEVICE);
+               dma_test = ssb_dma_map_single(dev->dev,
+                                             ring->txhdr_cache,
+                                             b43_txhdr_size(dev),
+                                             DMA_TO_DEVICE);
 
                if (b43_dma_mapping_error(ring, dma_test,
                                          b43_txhdr_size(dev), 1)) {
                        /* ugh realloc */
                        kfree(ring->txhdr_cache);
-                       ring->txhdr_cache = kcalloc(nr_slots,
+                       ring->txhdr_cache = kcalloc(ring->nr_slots / TX_SLOTS_PER_FRAME,
                                                    b43_txhdr_size(dev),
                                                    GFP_KERNEL | GFP_DMA);
                        if (!ring->txhdr_cache)
                                goto err_kfree_meta;
 
-                       dma_test = dma_map_single(dev->dev->dev,
-                                                 ring->txhdr_cache,
-                                                 b43_txhdr_size(dev),
-                                                 DMA_TO_DEVICE);
+                       dma_test = ssb_dma_map_single(dev->dev,
+                                                     ring->txhdr_cache,
+                                                     b43_txhdr_size(dev),
+                                                     DMA_TO_DEVICE);
 
                        if (b43_dma_mapping_error(ring, dma_test,
-                                                 b43_txhdr_size(dev), 1))
+                                                 b43_txhdr_size(dev), 1)) {
+
+                               b43err(dev->wl,
+                                      "TXHDR DMA allocation failed\n");
                                goto err_kfree_txhdr_cache;
+                       }
                }
 
-               dma_unmap_single(dev->dev->dev,
-                                dma_test, b43_txhdr_size(dev),
-                                DMA_TO_DEVICE);
-       }
-
-       ring->dev = dev;
-       ring->nr_slots = nr_slots;
-       ring->mmio_base = b43_dmacontroller_base(type, controller_index);
-       ring->index = controller_index;
-       if (type == B43_DMA_64BIT)
-               ring->ops = &dma64_ops;
-       else
-               ring->ops = &dma32_ops;
-       if (for_tx) {
-               ring->tx = 1;
-               ring->current_slot = -1;
-       } else {
-               if (ring->index == 0) {
-                       ring->rx_buffersize = B43_DMA0_RX_BUFFERSIZE;
-                       ring->frameoffset = B43_DMA0_RX_FRAMEOFFSET;
-               } else if (ring->index == 3) {
-                       ring->rx_buffersize = B43_DMA3_RX_BUFFERSIZE;
-                       ring->frameoffset = B43_DMA3_RX_FRAMEOFFSET;
-               } else
-                       B43_WARN_ON(1);
+               ssb_dma_unmap_single(dev->dev,
+                                    dma_test, b43_txhdr_size(dev),
+                                    DMA_TO_DEVICE);
        }
-       spin_lock_init(&ring->lock);
-#ifdef CONFIG_B43_DEBUG
-       ring->last_injected_overflow = jiffies;
-#endif
 
        err = alloc_ringmemory(ring);
        if (err)
@@ -951,7 +994,11 @@ static void b43_destroy_dmaring(struct b43_dmaring *ring,
 
 void b43_dma_free(struct b43_wldev *dev)
 {
-       struct b43_dma *dma = &dev->dma;
+       struct b43_dma *dma;
+
+       if (b43_using_pio_transfers(dev))
+               return;
+       dma = &dev->dma;
 
        destroy_ring(dma, rx_ring);
        destroy_ring(dma, tx_ring_AC_BK);
@@ -961,6 +1008,42 @@ void b43_dma_free(struct b43_wldev *dev)
        destroy_ring(dma, tx_ring_mcast);
 }
 
+static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask)
+{
+       u64 orig_mask = mask;
+       bool fallback = 0;
+       int err;
+
+       /* Try to set the DMA mask. If it fails, try falling back to a
+        * lower mask, as we can always also support a lower one. */
+       while (1) {
+               err = ssb_dma_set_mask(dev->dev, mask);
+               if (!err)
+                       break;
+               if (mask == DMA_BIT_MASK(64)) {
+                       mask = DMA_BIT_MASK(32);
+                       fallback = 1;
+                       continue;
+               }
+               if (mask == DMA_BIT_MASK(32)) {
+                       mask = DMA_BIT_MASK(30);
+                       fallback = 1;
+                       continue;
+               }
+               b43err(dev->wl, "The machine/kernel does not support "
+                      "the required %u-bit DMA mask\n",
+                      (unsigned int)dma_mask_to_engine_type(orig_mask));
+               return -EOPNOTSUPP;
+       }
+       if (fallback) {
+               b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n",
+                       (unsigned int)dma_mask_to_engine_type(orig_mask),
+                       (unsigned int)dma_mask_to_engine_type(mask));
+       }
+
+       return 0;
+}
+
 int b43_dma_init(struct b43_wldev *dev)
 {
        struct b43_dma *dma = &dev->dma;
@@ -969,27 +1052,10 @@ int b43_dma_init(struct b43_wldev *dev)
        enum b43_dmatype type;
 
        dmamask = supported_dma_mask(dev);
-       switch (dmamask) {
-       default:
-               B43_WARN_ON(1);
-       case DMA_30BIT_MASK:
-               type = B43_DMA_30BIT;
-               break;
-       case DMA_32BIT_MASK:
-               type = B43_DMA_32BIT;
-               break;
-       case DMA_64BIT_MASK:
-               type = B43_DMA_64BIT;
-               break;
-       }
-       err = ssb_dma_set_mask(dev->dev, dmamask);
-       if (err) {
-               b43err(dev->wl, "The machine/kernel does not support "
-                      "the required DMA mask (0x%08X%08X)\n",
-                      (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32),
-                      (unsigned int)(dmamask & 0x00000000FFFFFFFFULL));
-               return -EOPNOTSUPP;
-       }
+       type = dma_mask_to_engine_type(dmamask);
+       err = b43_dma_set_mask(dev, dmamask);
+       if (err)
+               return err;
 
        err = -ENOMEM;
        /* setup TX DMA channels. */
@@ -1083,32 +1149,36 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot)
        case 0x5000:
                ring = dma->tx_ring_mcast;
                break;
-       default:
-               B43_WARN_ON(1);
        }
        *slot = (cookie & 0x0FFF);
-       B43_WARN_ON(!(ring && *slot >= 0 && *slot < ring->nr_slots));
+       if (unlikely(!ring || *slot < 0 || *slot >= ring->nr_slots)) {
+               b43dbg(dev->wl, "TX-status contains "
+                      "invalid cookie: 0x%04X\n", cookie);
+               return NULL;
+       }
 
        return ring;
 }
 
 static int dma_tx_fragment(struct b43_dmaring *ring,
-                          struct sk_buff *skb,
-                          struct ieee80211_tx_control *ctl)
+                          struct sk_buff *skb)
 {
        const struct b43_dma_ops *ops = ring->ops;
+       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+       struct b43_private_tx_info *priv_info = b43_get_priv_tx_info(info);
        u8 *header;
        int slot, old_top_slot, old_used_slots;
        int err;
        struct b43_dmadesc_generic *desc;
        struct b43_dmadesc_meta *meta;
        struct b43_dmadesc_meta *meta_hdr;
-       struct sk_buff *bounce_skb;
        u16 cookie;
        size_t hdrsize = b43_txhdr_size(ring->dev);
 
-#define SLOTS_PER_PACKET  2
-       B43_WARN_ON(skb_shinfo(skb)->nr_frags);
+       /* Important note: If the number of used DMA slots per TX frame
+        * is changed here, the TX_SLOTS_PER_FRAME definition at the top of
+        * the file has to be updated, too!
+        */
 
        old_top_slot = ring->current_slot;
        old_used_slots = ring->used_slots;
@@ -1118,10 +1188,10 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
        desc = ops->idx2desc(ring, slot, &meta_hdr);
        memset(meta_hdr, 0, sizeof(*meta_hdr));
 
-       header = &(ring->txhdr_cache[slot * hdrsize]);
+       header = &(ring->txhdr_cache[(slot / TX_SLOTS_PER_FRAME) * hdrsize]);
        cookie = generate_cookie(ring, slot);
        err = b43_generate_txhdr(ring->dev, header,
-                                skb->data, skb->len, ctl, cookie);
+                                skb, info, cookie);
        if (unlikely(err)) {
                ring->current_slot = old_top_slot;
                ring->used_slots = old_used_slots;
@@ -1143,37 +1213,36 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
        desc = ops->idx2desc(ring, slot, &meta);
        memset(meta, 0, sizeof(*meta));
 
-       memcpy(&meta->txstat.control, ctl, sizeof(*ctl));
        meta->skb = skb;
        meta->is_last_fragment = 1;
+       priv_info->bouncebuffer = NULL;
 
        meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
        /* create a bounce buffer in zone_dma on mapping failure. */
        if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-               bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
-               if (!bounce_skb) {
+               priv_info->bouncebuffer = kmalloc(skb->len, GFP_ATOMIC | GFP_DMA);
+               if (!priv_info->bouncebuffer) {
                        ring->current_slot = old_top_slot;
                        ring->used_slots = old_used_slots;
                        err = -ENOMEM;
                        goto out_unmap_hdr;
                }
+               memcpy(priv_info->bouncebuffer, skb->data, skb->len);
 
-               memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
-               dev_kfree_skb_any(skb);
-               skb = bounce_skb;
-               meta->skb = skb;
-               meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
+               meta->dmaaddr = map_descbuffer(ring, priv_info->bouncebuffer, skb->len, 1);
                if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
+                       kfree(priv_info->bouncebuffer);
+                       priv_info->bouncebuffer = NULL;
                        ring->current_slot = old_top_slot;
                        ring->used_slots = old_used_slots;
                        err = -EIO;
-                       goto out_free_bounce;
+                       goto out_unmap_hdr;
                }
        }
 
        ops->fill_descriptor(ring, desc, meta->dmaaddr, skb->len, 0, 1, 1);
 
-       if (ctl->flags & IEEE80211_TXCTL_SEND_AFTER_DTIM) {
+       if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
                /* Tell the firmware about the cookie of the last
                 * mcast frame, so it can clear the more-data bit in it. */
                b43_shm_write16(ring->dev, B43_SHM_SHARED,
@@ -1184,8 +1253,6 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
        ops->poke_tx(ring, next_slot(ring, slot));
        return 0;
 
-out_free_bounce:
-       dev_kfree_skb_any(skb);
 out_unmap_hdr:
        unmap_descbuffer(ring, meta_hdr->dmaaddr,
                         hdrsize, 1);
@@ -1214,12 +1281,12 @@ static inline int should_inject_overflow(struct b43_dmaring *ring)
 }
 
 /* Static mapping of mac80211's queues (priorities) to b43 DMA rings. */
-static struct b43_dmaring * select_ring_by_priority(struct b43_wldev *dev,
-                                                   u8 queue_prio)
+static struct b43_dmaring *select_ring_by_priority(struct b43_wldev *dev,
+                                                  u8 queue_prio)
 {
        struct b43_dmaring *ring;
 
-       if (b43_modparam_qos) {
+       if (dev->qos_enabled) {
                /* 0 = highest priority */
                switch (queue_prio) {
                default:
@@ -1244,21 +1311,15 @@ static struct b43_dmaring * select_ring_by_priority(struct b43_wldev *dev,
        return ring;
 }
 
-int b43_dma_tx(struct b43_wldev *dev,
-              struct sk_buff *skb, struct ieee80211_tx_control *ctl)
+int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
 {
        struct b43_dmaring *ring;
        struct ieee80211_hdr *hdr;
        int err = 0;
-       unsigned long flags;
-
-       if (unlikely(skb->len < 2 + 2 + 6)) {
-               /* Too short, this can't be a valid frame. */
-               return -EINVAL;
-       }
+       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
        hdr = (struct ieee80211_hdr *)skb->data;
-       if (ctl->flags & IEEE80211_TXCTL_SEND_AFTER_DTIM) {
+       if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
                /* The multicast ring will be sent after the DTIM */
                ring = dev->dma.tx_ring_mcast;
                /* Set the more-data bit. Ucode will clear it on
@@ -1266,87 +1327,63 @@ int b43_dma_tx(struct b43_wldev *dev,
                hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
        } else {
                /* Decide by priority where to put this frame. */
-               ring = select_ring_by_priority(dev, ctl->queue);
+               ring = select_ring_by_priority(
+                       dev, skb_get_queue_mapping(skb));
        }
 
-       spin_lock_irqsave(&ring->lock, flags);
        B43_WARN_ON(!ring->tx);
-       if (unlikely(free_slots(ring) < SLOTS_PER_PACKET)) {
-               b43warn(dev->wl, "DMA queue overflow\n");
+
+       if (unlikely(ring->stopped)) {
+               /* We get here only because of a bug in mac80211.
+                * Because of a race, one packet may be queued after
+                * the queue is stopped, thus we got called when we shouldn't.
+                * For now, just refuse the transmit. */
+               if (b43_debug(dev, B43_DBG_DMAVERBOSE))
+                       b43err(dev->wl, "Packet after queue stopped\n");
                err = -ENOSPC;
-               goto out_unlock;
+               goto out;
+       }
+
+       if (unlikely(WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME))) {
+               /* If we get here, we have a real error with the queue
+                * full, but queues not stopped. */
+               b43err(dev->wl, "DMA queue overflow\n");
+               err = -ENOSPC;
+               goto out;
        }
-       /* Check if the queue was stopped in mac80211,
-        * but we got called nevertheless.
-        * That would be a mac80211 bug. */
-       B43_WARN_ON(ring->stopped);
 
        /* Assign the queue number to the ring (if not already done before)
         * so TX status handling can use it. The queue to ring mapping is
         * static, so we don't need to store it per frame. */
-       ring->queue_prio = ctl->queue;
+       ring->queue_prio = skb_get_queue_mapping(skb);
 
-       err = dma_tx_fragment(ring, skb, ctl);
+       err = dma_tx_fragment(ring, skb);
        if (unlikely(err == -ENOKEY)) {
                /* Drop this packet, as we don't have the encryption key
                 * anymore and must not transmit it unencrypted. */
                dev_kfree_skb_any(skb);
                err = 0;
-               goto out_unlock;
+               goto out;
        }
        if (unlikely(err)) {
                b43err(dev->wl, "DMA tx mapping failure\n");
-               goto out_unlock;
+               goto out;
        }
        ring->nr_tx_packets++;
-       if ((free_slots(ring) < SLOTS_PER_PACKET) ||
+       if ((free_slots(ring) < TX_SLOTS_PER_FRAME) ||
            should_inject_overflow(ring)) {
                /* This TX ring is full. */
-               ieee80211_stop_queue(dev->wl->hw, ctl->queue);
+               ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
                ring->stopped = 1;
                if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
                        b43dbg(dev->wl, "Stopped TX ring %d\n", ring->index);
                }
        }
-out_unlock:
-       spin_unlock_irqrestore(&ring->lock, flags);
+out:
 
        return err;
 }
 
-static void b43_fill_txstatus_report(struct b43_dmaring *ring,
-                                   struct ieee80211_tx_status *report,
-                                   const struct b43_txstatus *status)
-{
-       bool frame_failed = 0;
-
-       if (status->acked) {
-               /* The frame was ACKed. */
-               report->flags |= IEEE80211_TX_STATUS_ACK;
-       } else {
-               /* The frame was not ACKed... */
-               if (!(report->control.flags & IEEE80211_TXCTL_NO_ACK)) {
-                       /* ...but we expected an ACK. */
-                       frame_failed = 1;
-                       report->excessive_retries = 1;
-               }
-       }
-       if (status->frame_count == 0) {
-               /* The frame was not transmitted at all. */
-               report->retry_count = 0;
-       } else {
-               report->retry_count = status->frame_count - 1;
-#ifdef CONFIG_B43_DEBUG
-               if (frame_failed)
-                       ring->nr_failed_tx_packets++;
-               else
-                       ring->nr_succeed_tx_packets++;
-               ring->nr_total_packet_tries += status->frame_count;
-#endif /* DEBUG */
-       }
-}
-
-/* Called with IRQs disabled. */
 void b43_dma_handle_txstatus(struct b43_wldev *dev,
                             const struct b43_txstatus *status)
 {
@@ -1354,63 +1391,113 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
        struct b43_dmaring *ring;
        struct b43_dmadesc_generic *desc;
        struct b43_dmadesc_meta *meta;
-       int slot;
+       int slot, firstused;
+       bool frame_succeed;
 
        ring = parse_cookie(dev, status->cookie, &slot);
        if (unlikely(!ring))
                return;
+       B43_WARN_ON(!ring->tx);
 
-       spin_lock(&ring->lock); /* IRQs are already disabled. */
+       /* Sanity check: TX packets are processed in-order on one ring.
+        * Check if the slot deduced from the cookie really is the first
+        * used slot. */
+       firstused = ring->current_slot - ring->used_slots + 1;
+       if (firstused < 0)
+               firstused = ring->nr_slots + firstused;
+       if (unlikely(slot != firstused)) {
+               /* This possibly is a firmware bug and will result in
+                * malfunction, memory leaks and/or stall of DMA functionality. */
+               b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
+                      "Expected %d, but got %d\n",
+                      ring->index, firstused, slot);
+               return;
+       }
 
-       B43_WARN_ON(!ring->tx);
        ops = ring->ops;
        while (1) {
-               B43_WARN_ON(!(slot >= 0 && slot < ring->nr_slots));
+               B43_WARN_ON(slot < 0 || slot >= ring->nr_slots);
                desc = ops->idx2desc(ring, slot, &meta);
 
-               if (meta->skb)
-                       unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len,
-                                        1);
-               else
+               if (b43_dma_ptr_is_poisoned(meta->skb)) {
+                       b43dbg(dev->wl, "Poisoned TX slot %d (first=%d) "
+                              "on ring %d\n",
+                              slot, firstused, ring->index);
+                       break;
+               }
+               if (meta->skb) {
+                       struct b43_private_tx_info *priv_info =
+                               b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
+
+                       unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
+                       kfree(priv_info->bouncebuffer);
+                       priv_info->bouncebuffer = NULL;
+               } else {
                        unmap_descbuffer(ring, meta->dmaaddr,
                                         b43_txhdr_size(dev), 1);
+               }
 
                if (meta->is_last_fragment) {
-                       B43_WARN_ON(!meta->skb);
-                       /* Call back to inform the ieee80211 subsystem about the
-                        * status of the transmission.
-                        * Some fields of txstat are already filled in dma_tx().
+                       struct ieee80211_tx_info *info;
+
+                       if (unlikely(!meta->skb)) {
+                               /* This is a scatter-gather fragment of a frame, so
+                                * the skb pointer must not be NULL. */
+                               b43dbg(dev->wl, "TX status unexpected NULL skb "
+                                      "at slot %d (first=%d) on ring %d\n",
+                                      slot, firstused, ring->index);
+                               break;
+                       }
+
+                       info = IEEE80211_SKB_CB(meta->skb);
+
+                       /*
+                        * Call back to inform the ieee80211 subsystem about
+                        * the status of the transmission.
                         */
-                       b43_fill_txstatus_report(ring, &(meta->txstat), status);
-                       ieee80211_tx_status_irqsafe(dev->wl->hw, meta->skb,
-                                                   &(meta->txstat));
-                       /* skb is freed by ieee80211_tx_status_irqsafe() */
-                       meta->skb = NULL;
+                       frame_succeed = b43_fill_txstatus_report(dev, info, status);
+#ifdef CONFIG_B43_DEBUG
+                       if (frame_succeed)
+                               ring->nr_succeed_tx_packets++;
+                       else
+                               ring->nr_failed_tx_packets++;
+                       ring->nr_total_packet_tries += status->frame_count;
+#endif /* DEBUG */
+                       ieee80211_tx_status(dev->wl->hw, meta->skb);
+
+                       /* skb will be freed by ieee80211_tx_status().
+                        * Poison our pointer. */
+                       meta->skb = B43_DMA_PTR_POISON;
                } else {
                        /* No need to call free_descriptor_buffer here, as
                         * this is only the txhdr, which is not allocated.
                         */
-                       B43_WARN_ON(meta->skb);
+                       if (unlikely(meta->skb)) {
+                               b43dbg(dev->wl, "TX status unexpected non-NULL skb "
+                                      "at slot %d (first=%d) on ring %d\n",
+                                      slot, firstused, ring->index);
+                               break;
+                       }
                }
 
                /* Everything unmapped and free'd. So it's not used anymore. */
                ring->used_slots--;
 
-               if (meta->is_last_fragment)
+               if (meta->is_last_fragment) {
+                       /* This is the last scatter-gather
+                        * fragment of the frame. We are done. */
                        break;
+               }
                slot = next_slot(ring, slot);
        }
-       dev->stats.last_tx = jiffies;
        if (ring->stopped) {
-               B43_WARN_ON(free_slots(ring) < SLOTS_PER_PACKET);
+               B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
                ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);
                ring->stopped = 0;
                if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
                        b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index);
                }
        }
-
-       spin_unlock(&ring->lock);
 }
 
 void b43_dma_get_tx_stats(struct b43_wldev *dev,
@@ -1418,19 +1505,14 @@ void b43_dma_get_tx_stats(struct b43_wldev *dev,
 {
        const int nr_queues = dev->wl->hw->queues;
        struct b43_dmaring *ring;
-       struct ieee80211_tx_queue_stats_data *data;
-       unsigned long flags;
        int i;
 
        for (i = 0; i < nr_queues; i++) {
-               data = &(stats->data[i]);
                ring = select_ring_by_priority(dev, i);
 
-               spin_lock_irqsave(&ring->lock, flags);
-               data->len = ring->used_slots / SLOTS_PER_PACKET;
-               data->limit = ring->nr_slots / SLOTS_PER_PACKET;
-               data->count = ring->nr_tx_packets;
-               spin_unlock_irqrestore(&ring->lock, flags);
+               stats[i].len = ring->used_slots / TX_SLOTS_PER_FRAME;
+               stats[i].limit = ring->nr_slots / TX_SLOTS_PER_FRAME;
+               stats[i].count = ring->nr_tx_packets;
        }
 }
 
@@ -1461,12 +1543,17 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                        len = le16_to_cpu(rxhdr->frame_len);
                } while (len == 0 && i++ < 5);
                if (unlikely(len == 0)) {
-                       /* recycle the descriptor buffer. */
-                       sync_descbuffer_for_device(ring, meta->dmaaddr,
-                                                  ring->rx_buffersize);
-                       goto drop;
+                       dmaaddr = meta->dmaaddr;
+                       goto drop_recycle_buffer;
                }
        }
+       if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) {
+               /* Something went wrong with the DMA.
+                * The device did not touch the buffer and did not overwrite the poison. */
+               b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n");
+               dmaaddr = meta->dmaaddr;
+               goto drop_recycle_buffer;
+       }
        if (unlikely(len > ring->rx_buffersize)) {
                /* The data did not fit into one descriptor buffer
                 * and is split over multiple buffers.
@@ -1479,6 +1566,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                while (1) {
                        desc = ops->idx2desc(ring, *slot, &meta);
                        /* recycle the descriptor buffer. */
+                       b43_poison_rx_buffer(ring, meta->skb);
                        sync_descbuffer_for_device(ring, meta->dmaaddr,
                                                   ring->rx_buffersize);
                        *slot = next_slot(ring, *slot);
@@ -1497,8 +1585,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
        err = setup_rx_descbuffer(ring, desc, meta, GFP_ATOMIC);
        if (unlikely(err)) {
                b43dbg(ring->dev->wl, "DMA RX: setup_rx_descbuffer() failed\n");
-               sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
-               goto drop;
+               goto drop_recycle_buffer;
        }
 
        unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
@@ -1508,6 +1595,11 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
        b43_rx(ring->dev, skb, rxhdr);
 drop:
        return;
+
+drop_recycle_buffer:
+       /* Poison and recycle the RX buffer. */
+       b43_poison_rx_buffer(ring, skb);
+       sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
 }
 
 void b43_dma_rx(struct b43_dmaring *ring)
@@ -1531,22 +1623,14 @@ void b43_dma_rx(struct b43_dmaring *ring)
 
 static void b43_dma_tx_suspend_ring(struct b43_dmaring *ring)
 {
-       unsigned long flags;
-
-       spin_lock_irqsave(&ring->lock, flags);
        B43_WARN_ON(!ring->tx);
        ring->ops->tx_suspend(ring);
-       spin_unlock_irqrestore(&ring->lock, flags);
 }
 
 static void b43_dma_tx_resume_ring(struct b43_dmaring *ring)
 {
-       unsigned long flags;
-
-       spin_lock_irqsave(&ring->lock, flags);
        B43_WARN_ON(!ring->tx);
        ring->ops->tx_resume(ring);
-       spin_unlock_irqrestore(&ring->lock, flags);
 }
 
 void b43_dma_tx_suspend(struct b43_wldev *dev)
@@ -1568,3 +1652,39 @@ void b43_dma_tx_resume(struct b43_wldev *dev)
        b43_dma_tx_resume_ring(dev->dma.tx_ring_AC_BK);
        b43_power_saving_ctl_bits(dev, 0);
 }
+
+#ifdef CONFIG_B43_PIO
+static void direct_fifo_rx(struct b43_wldev *dev, enum b43_dmatype type,
+                          u16 mmio_base, bool enable)
+{
+       u32 ctl;
+
+       if (type == B43_DMA_64BIT) {
+               ctl = b43_read32(dev, mmio_base + B43_DMA64_RXCTL);
+               ctl &= ~B43_DMA64_RXDIRECTFIFO;
+               if (enable)
+                       ctl |= B43_DMA64_RXDIRECTFIFO;
+               b43_write32(dev, mmio_base + B43_DMA64_RXCTL, ctl);
+       } else {
+               ctl = b43_read32(dev, mmio_base + B43_DMA32_RXCTL);
+               ctl &= ~B43_DMA32_RXDIRECTFIFO;
+               if (enable)
+                       ctl |= B43_DMA32_RXDIRECTFIFO;
+               b43_write32(dev, mmio_base + B43_DMA32_RXCTL, ctl);
+       }
+}
+
+/* Enable/Disable Direct FIFO Receive Mode (PIO) on a RX engine.
+ * This is called from PIO code, so DMA structures are not available. */
+void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
+                           unsigned int engine_index, bool enable)
+{
+       enum b43_dmatype type;
+       u16 mmio_base;
+
+       type = dma_mask_to_engine_type(supported_dma_mask(dev));
+
+       mmio_base = b43_dmacontroller_base(type, engine_index);
+       direct_fifo_rx(dev, type, mmio_base, enable);
+}
+#endif /* CONFIG_B43_PIO */