drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <linux/module.h>
  31 #include <asm/unaligned.h>
  32 #include <defs.h>
  33 #include <brcmu_wifi.h>
  34 #include <brcmu_utils.h>
  35 #include <brcm_hw_ids.h>
  36 #include <soc.h>
  37 #include "sdio_host.h"
  38 #include "sdio_chip.h"
  39
  40 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
  41
  42 #ifdef BCMDBG
  43
  44 #define BRCMF_TRAP_INFO_SIZE    80
  45
  46 #define CBUF_LEN        (128)
  47
  48 struct rte_log_le {
  49         __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  50         __le32 buf_size;
  51         __le32 idx;
  52         char *_buf_compat;      /* Redundant pointer for backward compat. */
  53 };
  54
  55 struct rte_console {
  56         /* Virtual UART
  57          * When there is no UART (e.g. Quickturn),
  58          * the host should write a complete
  59          * input line directly into cbuf and then write
  60          * the length into vcons_in.
  61          * This may also be used when there is a real UART
  62          * (at risk of conflicting with
  63          * the real UART).  vcons_out is currently unused.
  64          */
  65         uint vcons_in;
  66         uint vcons_out;
  67
  68         /* Output (logging) buffer
  69          * Console output is written to a ring buffer log_buf at index log_idx.
  70          * The host may read the output when it sees log_idx advance.
  71          * Output will be lost if the output wraps around faster than the host
  72          * polls.
  73          */
  74         struct rte_log_le log_le;
  75
  76         /* Console input line buffer
  77          * Characters are read one at a time into cbuf
  78          * until <CR> is received, then
  79          * the buffer is processed as a command line.
  80          * Also used for virtual UART.
  81          */
  82         uint cbuf_idx;
  83         char cbuf[CBUF_LEN];
  84 };
  85
  86 #endif                          /* BCMDBG */
  87 #include <chipcommon.h>
  88
  89 #include "dhd.h"
  90 #include "dhd_bus.h"
  91 #include "dhd_proto.h"
  92 #include "dhd_dbg.h"
  93 #include <bcmchip.h>
  94
  95 #define TXQLEN          2048    /* bulk tx queue length */
  96 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
  97 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
  98 #define PRIOMASK        7
  99
 100 #define TXRETRIES       2       /* # of retries for tx frames */
 101
 102 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 103                                  one scheduling */
 104
 105 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 106                                  one scheduling */
 107
 108 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 109
 110 #define MEMBLOCK        2048    /* Block size used for downloading
 111                                  of dongle image */
 112 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 113                                  biggest possible glom */
 114
 115 #define BRCMF_FIRSTREAD (1 << 6)
 116
 117
 118 /* SBSDIO_DEVICE_CTL */
 119
 120 /* 1: device will assert busy signal when receiving CMD53 */
 121 #define SBSDIO_DEVCTL_SETBUSY           0x01
 122 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 123 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 124 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 125 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 126 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 127  * sdio bus power cycle to clear (rev 9) */
 128 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 129 /* Force SD->SB reset mapping (rev 11) */
 130 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 131 /*   Determined by CoreControl bit */
 132 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 133 /*   Force backplane reset */
 134 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 135 /*   Force no backplane reset */
 136 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 137
 138 /* direct(mapped) cis space */
 139
 140 /* MAPPED common CIS address */
 141 #define SBSDIO_CIS_BASE_COMMON          0x1000
 142 /* maximum bytes in one CIS */
 143 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 144 /* cis offset addr is < 17 bits */
 145 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 146
 147 /* manfid tuple length, include tuple, link bytes */
 148 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 149
 150 /* intstatus */
 151 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 152 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 153 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 154 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 155 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 156 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 157 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 158 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 159 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 160 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 161 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 162 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 163 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 164 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 165 #define I_PC            (1 << 10)       /* descriptor error */
 166 #define I_PD            (1 << 11)       /* data error */
 167 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 168 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 169 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 170 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 171 #define I_RI            (1 << 16)       /* Receive Interrupt */
 172 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 173 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 174 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 175 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 176 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 177 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 178 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 179 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 180 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 181 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 182 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 183 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 184
 185 /* corecontrol */
 186 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 187 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 188 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 189 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 190 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 191 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 192
 193 /* SDA_FRAMECTRL */
 194 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 195 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 196 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 197 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 198
 199 /* HW frame tag */
 200 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 201
 202 /* Total length of frame header for dongle protocol */
 203 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 204 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 205
 206 /*
 207  * Software allocation of To SB Mailbox resources
 208  */
 209
 210 /* tosbmailbox bits corresponding to intstatus bits */
 211 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 212 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 213 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 214 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 215
 216 /* tosbmailboxdata */
 217 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 218
 219 /*
 220  * Software allocation of To Host Mailbox resources
 221  */
 222
 223 /* intstatus bits */
 224 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 225 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 226 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 227 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 228
 229 /* tohostmailboxdata */
 230 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 231 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 232 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 233 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 234
 235 #define HMB_DATA_FCDATA_MASK    0xff000000
 236 #define HMB_DATA_FCDATA_SHIFT   24
 237
 238 #define HMB_DATA_VERSION_MASK   0x00ff0000
 239 #define HMB_DATA_VERSION_SHIFT  16
 240
 241 /*
 242  * Software-defined protocol header
 243  */
 244
 245 /* Current protocol version */
 246 #define SDPCM_PROT_VERSION      4
 247
 248 /* SW frame header */
 249 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 250
 251 #define SDPCM_CHANNEL_MASK              0x00000f00
 252 #define SDPCM_CHANNEL_SHIFT             8
 253 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 254
 255 #define SDPCM_NEXTLEN_OFFSET            2
 256
 257 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 258 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 259 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 260 #define SDPCM_DOFFSET_MASK              0xff000000
 261 #define SDPCM_DOFFSET_SHIFT             24
 262 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 263 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 264 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 265 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 266
 267 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 268
 269 /* logical channel numbers */
 270 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 271 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 272 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 273 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 274 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 275
 276 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 277
 278 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 279
 280 /*
 281  * Shared structure between dongle and the host.
 282  * The structure contains pointers to trap or assert information.
 283  */
 284 #define SDPCM_SHARED_VERSION       0x0002
 285 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 286 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 287 #define SDPCM_SHARED_ASSERT        0x0200
 288 #define SDPCM_SHARED_TRAP          0x0400
 289
 290 /* Space for header read, limit for data packets */
 291 #define MAX_HDR_READ    (1 << 6)
 292 #define MAX_RX_DATASZ   2048
 293
 294 /* Maximum milliseconds to wait for F2 to come up */
 295 #define BRCMF_WAIT_F2RDY        3000
 296
 297 /* Bump up limit on waiting for HT to account for first startup;
 298  * if the image is doing a CRC calculation before programming the PMU
 299  * for HT availability, it could take a couple hundred ms more, so
 300  * max out at a 1 second (1000000us).
 301  */
 302 #undef PMU_MAX_TRANSITION_DLY
 303 #define PMU_MAX_TRANSITION_DLY 1000000
 304
 305 /* Value for ChipClockCSR during initial setup */
 306 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 307                                         SBSDIO_ALP_AVAIL_REQ)
 308
 309 /* Flags for SDH calls */
 310 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 311
 312 /*
 313  * Conversion of 802.1D priority to precedence level
 314  */
 315 static uint prio2prec(u32 prio)
 316 {
 317         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 318                (prio^2) : prio;
 319 }
 320
 321 /* core registers */
 322 struct sdpcmd_regs {
 323         u32 corecontrol;                /* 0x00, rev8 */
 324         u32 corestatus;                 /* rev8 */
 325         u32 PAD[1];
 326         u32 biststatus;                 /* rev8 */
 327
 328         /* PCMCIA access */
 329         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 330         u16 PAD[1];
 331         u16 pcmciamesportalmask;        /* rev8 */
 332         u16 PAD[1];
 333         u16 pcmciawrframebc;            /* rev8 */
 334         u16 PAD[1];
 335         u16 pcmciaunderflowtimer;       /* rev8 */
 336         u16 PAD[1];
 337
 338         /* interrupt */
 339         u32 intstatus;                  /* 0x020, rev8 */
 340         u32 hostintmask;                /* rev8 */
 341         u32 intmask;                    /* rev8 */
 342         u32 sbintstatus;                /* rev8 */
 343         u32 sbintmask;                  /* rev8 */
 344         u32 funcintmask;                /* rev4 */
 345         u32 PAD[2];
 346         u32 tosbmailbox;                /* 0x040, rev8 */
 347         u32 tohostmailbox;              /* rev8 */
 348         u32 tosbmailboxdata;            /* rev8 */
 349         u32 tohostmailboxdata;          /* rev8 */
 350
 351         /* synchronized access to registers in SDIO clock domain */
 352         u32 sdioaccess;                 /* 0x050, rev8 */
 353         u32 PAD[3];
 354
 355         /* PCMCIA frame control */
 356         u8 pcmciaframectrl;             /* 0x060, rev8 */
 357         u8 PAD[3];
 358         u8 pcmciawatermark;             /* rev8 */
 359         u8 PAD[155];
 360
 361         /* interrupt batching control */
 362         u32 intrcvlazy;                 /* 0x100, rev8 */
 363         u32 PAD[3];
 364
 365         /* counters */
 366         u32 cmd52rd;                    /* 0x110, rev8 */
 367         u32 cmd52wr;                    /* rev8 */
 368         u32 cmd53rd;                    /* rev8 */
 369         u32 cmd53wr;                    /* rev8 */
 370         u32 abort;                      /* rev8 */
 371         u32 datacrcerror;               /* rev8 */
 372         u32 rdoutofsync;                /* rev8 */
 373         u32 wroutofsync;                /* rev8 */
 374         u32 writebusy;                  /* rev8 */
 375         u32 readwait;                   /* rev8 */
 376         u32 readterm;                   /* rev8 */
 377         u32 writeterm;                  /* rev8 */
 378         u32 PAD[40];
 379         u32 clockctlstatus;             /* rev8 */
 380         u32 PAD[7];
 381
 382         u32 PAD[128];                   /* DMA engines */
 383
 384         /* SDIO/PCMCIA CIS region */
 385         char cis[512];                  /* 0x400-0x5ff, rev6 */
 386
 387         /* PCMCIA function control registers */
 388         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 389         u16 PAD[55];
 390
 391         /* PCMCIA backplane access */
 392         u16 backplanecsr;               /* 0x76E, rev6 */
 393         u16 backplaneaddr0;             /* rev6 */
 394         u16 backplaneaddr1;             /* rev6 */
 395         u16 backplaneaddr2;             /* rev6 */
 396         u16 backplaneaddr3;             /* rev6 */
 397         u16 backplanedata0;             /* rev6 */
 398         u16 backplanedata1;             /* rev6 */
 399         u16 backplanedata2;             /* rev6 */
 400         u16 backplanedata3;             /* rev6 */
 401         u16 PAD[31];
 402
 403         /* sprom "size" & "blank" info */
 404         u16 spromstatus;                /* 0x7BE, rev2 */
 405         u32 PAD[464];
 406
 407         u16 PAD[0x80];
 408 };
 409
 410 #ifdef BCMDBG
 411 /* Device console log buffer state */
 412 struct brcmf_console {
 413         uint count;             /* Poll interval msec counter */
 414         uint log_addr;          /* Log struct address (fixed) */
 415         struct rte_log_le log_le;       /* Log struct (host copy) */
 416         uint bufsize;           /* Size of log buffer */
 417         u8 *buf;                /* Log buffer (host copy) */
 418         uint last;              /* Last buffer read index */
 419 };
 420 #endif                          /* BCMDBG */
 421
 422 struct sdpcm_shared {
 423         u32 flags;
 424         u32 trap_addr;
 425         u32 assert_exp_addr;
 426         u32 assert_file_addr;
 427         u32 assert_line;
 428         u32 console_addr;       /* Address of struct rte_console */
 429         u32 msgtrace_addr;
 430         u8 tag[32];
 431 };
 432
 433 struct sdpcm_shared_le {
 434         __le32 flags;
 435         __le32 trap_addr;
 436         __le32 assert_exp_addr;
 437         __le32 assert_file_addr;
 438         __le32 assert_line;
 439         __le32 console_addr;    /* Address of struct rte_console */
 440         __le32 msgtrace_addr;
 441         u8 tag[32];
 442 };
 443
 444
 445 /* misc chip info needed by some of the routines */
 446 /* Private data for SDIO bus interaction */
 447 struct brcmf_bus {
 448         struct brcmf_pub *drvr;
 449
 450         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 451         struct chip_info *ci;   /* Chip info struct */
 452         char *vars;             /* Variables (from CIS and/or other) */
 453         uint varsz;             /* Size of variables buffer */
 454
 455         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 456
 457         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 458         u32 intstatus;  /* Intstatus bits (events) pending */
 459         bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
 460         bool fcstate;           /* State of dongle flow-control */
 461
 462         uint blocksize;         /* Block size of SDIO transfers */
 463         uint roundup;           /* Max roundup limit */
 464
 465         struct pktq txq;        /* Queue length used for flow-control */
 466         u8 flowcontrol; /* per prio flow control bitmask */
 467         u8 tx_seq;              /* Transmit sequence number (next) */
 468         u8 tx_max;              /* Maximum transmit sequence allowed */
 469
 470         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 471         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 472         u16 nextlen;            /* Next Read Len from last header */
 473         u8 rx_seq;              /* Receive sequence number (expected) */
 474         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 475
 476         uint rxbound;           /* Rx frames to read before resched */
 477         uint txbound;           /* Tx frames to send before resched */
 478         uint txminmax;
 479
 480         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 481         struct sk_buff_head glom; /* Packet list for glommed superframe */
 482         uint glomerr;           /* Glom packet read errors */
 483
 484         u8 *rxbuf;              /* Buffer for receiving control packets */
 485         uint rxblen;            /* Allocated length of rxbuf */
 486         u8 *rxctl;              /* Aligned pointer into rxbuf */
 487         u8 *databuf;            /* Buffer for receiving big glom packet */
 488         u8 *dataptr;            /* Aligned pointer into databuf */
 489         uint rxlen;             /* Length of valid data in buffer */
 490
 491         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 492
 493         bool intr;              /* Use interrupts */
 494         bool poll;              /* Use polling */
 495         bool ipend;             /* Device interrupt is pending */
 496         uint intrcount;         /* Count of device interrupt callbacks */
 497         uint lastintrs;         /* Count as of last watchdog timer */
 498         uint spurious;          /* Count of spurious interrupts */
 499         uint pollrate;          /* Ticks between device polls */
 500         uint polltick;          /* Tick counter */
 501         uint pollcnt;           /* Count of active polls */
 502
 503 #ifdef BCMDBG
 504         uint console_interval;
 505         struct brcmf_console console;   /* Console output polling support */
 506         uint console_addr;      /* Console address from shared struct */
 507 #endif                          /* BCMDBG */
 508
 509         uint regfails;          /* Count of R_REG failures */
 510
 511         uint clkstate;          /* State of sd and backplane clock(s) */
 512         bool activity;          /* Activity flag for clock down */
 513         s32 idletime;           /* Control for activity timeout */
 514         s32 idlecount;  /* Activity timeout counter */
 515         s32 idleclock;  /* How to set bus driver when idle */
 516         s32 sd_rxchain;
 517         bool use_rxchain;       /* If brcmf should use PKT chains */
 518         bool sleeping;          /* Is SDIO bus sleeping? */
 519         bool rxflow_mode;       /* Rx flow control mode */
 520         bool rxflow;            /* Is rx flow control on */
 521         bool alp_only;          /* Don't use HT clock (ALP only) */
 522 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
 523         bool usebufpool;
 524
 525         /* Some additional counters */
 526         uint tx_sderrs;         /* Count of tx attempts with sd errors */
 527         uint fcqueued;          /* Tx packets that got queued */
 528         uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 529         uint rx_toolong;        /* Receive frames too long to receive */
 530         uint rxc_errors;        /* SDIO errors when reading control frames */
 531         uint rx_hdrfail;        /* SDIO errors on header reads */
 532         uint rx_badhdr;         /* Bad received headers (roosync?) */
 533         uint rx_badseq;         /* Mismatched rx sequence number */
 534         uint fc_rcvd;           /* Number of flow-control events received */
 535         uint fc_xoff;           /* Number which turned on flow-control */
 536         uint fc_xon;            /* Number which turned off flow-control */
 537         uint rxglomfail;        /* Failed deglom attempts */
 538         uint rxglomframes;      /* Number of glom frames (superframes) */
 539         uint rxglompkts;        /* Number of packets from glom frames */
 540         uint f2rxhdrs;          /* Number of header reads */
 541         uint f2rxdata;          /* Number of frame data reads */
 542         uint f2txdata;          /* Number of f2 frame writes */
 543         uint f1regdata;         /* Number of f1 register accesses */
 544
 545         u8 *ctrl_frame_buf;
 546         u32 ctrl_frame_len;
 547         bool ctrl_frame_stat;
 548
 549         spinlock_t txqlock;
 550         wait_queue_head_t ctrl_wait;
 551         wait_queue_head_t dcmd_resp_wait;
 552
 553         struct timer_list timer;
 554         struct completion watchdog_wait;
 555         struct task_struct *watchdog_tsk;
 556         bool wd_timer_valid;
 557         uint save_ms;
 558
 559         struct task_struct *dpc_tsk;
 560         struct completion dpc_wait;
 561
 562         struct semaphore sdsem;
 563
 564         const char *fw_name;
 565         const struct firmware *firmware;
 566         const char *nv_name;
 567         u32 fw_ptr;
 568 };
 569
 570 /* clkstate */
 571 #define CLK_NONE        0
 572 #define CLK_SDONLY      1
 573 #define CLK_PENDING     2       /* Not used yet */
 574 #define CLK_AVAIL       3
 575
 576 #ifdef BCMDBG
 577 static int qcount[NUMPRIO];
 578 static int tx_packets[NUMPRIO];
 579 #endif                          /* BCMDBG */
 580
 581 #define SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 582
 583 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 584
 585 /* Retry count for register access failures */
 586 static const uint retry_limit = 2;
 587
 588 /* Limit on rounding up frames */
 589 static const uint max_roundup = 512;
 590
 591 #define ALIGNMENT  4
 592
 593 static void pkt_align(struct sk_buff *p, int len, int align)
 594 {
 595         uint datalign;
 596         datalign = (unsigned long)(p->data);
 597         datalign = roundup(datalign, (align)) - datalign;
 598         if (datalign)
 599                 skb_pull(p, datalign);
 600         __skb_trim(p, len);
 601 }
 602
 603 /* To check if there's window offered */
 604 static bool data_ok(struct brcmf_bus *bus)
 605 {
 606         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 607                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 608 }
 609
 610 /*
 611  * Reads a register in the SDIO hardware block. This block occupies a series of
 612  * adresses on the 32 bit backplane bus.
 613  */
 614 static void
 615 r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
 616 {
 617         *retryvar = 0;
 618         do {
 619                 *regvar = brcmf_sdcard_reg_read(bus->sdiodev,
 620                                 bus->ci->buscorebase + reg_offset, sizeof(u32));
 621         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 622                  (++(*retryvar) <= retry_limit));
 623         if (*retryvar) {
 624                 bus->regfails += (*retryvar-1);
 625                 if (*retryvar > retry_limit) {
 626                         brcmf_dbg(ERROR, "FAILED READ %Xh\n", reg_offset);
 627                         *regvar = 0;
 628                 }
 629         }
 630 }
 631
 632 static void
 633 w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
 634 {
 635         *retryvar = 0;
 636         do {
 637                 brcmf_sdcard_reg_write(bus->sdiodev,
 638                                        bus->ci->buscorebase + reg_offset,
 639                                        sizeof(u32), regval);
 640         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 641                  (++(*retryvar) <= retry_limit));
 642         if (*retryvar) {
 643                 bus->regfails += (*retryvar-1);
 644                 if (*retryvar > retry_limit)
 645                         brcmf_dbg(ERROR, "FAILED REGISTER WRITE %Xh\n",
 646                                   reg_offset);
 647         }
 648 }
 649
 650 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 651
 652 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 653
 654 /* Packet free applicable unconditionally for sdio and sdspi.
 655  * Conditional if bufpool was present for gspi bus.
 656  */
 657 static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
 658 {
 659         if (bus->usebufpool)
 660                 brcmu_pkt_buf_free_skb(pkt);
 661 }
 662
 663 /* Turn backplane clock on or off */
 664 static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
 665 {
 666         int err;
 667         u8 clkctl, clkreq, devctl;
 668         unsigned long timeout;
 669
 670         brcmf_dbg(TRACE, "Enter\n");
 671
 672         clkctl = 0;
 673
 674         if (on) {
 675                 /* Request HT Avail */
 676                 clkreq =
 677                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 678
 679                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 680                                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 681                 if (err) {
 682                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 683                         return -EBADE;
 684                 }
 685
 686                 if (pendok && ((bus->ci->buscoretype == PCMCIA_CORE_ID)
 687                                && (bus->ci->buscorerev == 9))) {
 688                         u32 dummy, retries;
 689                         r_sdreg32(bus, &dummy,
 690                                   offsetof(struct sdpcmd_regs, clockctlstatus),
 691                                   &retries);
 692                 }
 693
 694                 /* Check current status */
 695                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 696                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
 697                 if (err) {
 698                         brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
 699                         return -EBADE;
 700                 }
 701
 702                 /* Go to pending and await interrupt if appropriate */
 703                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 704                         /* Allow only clock-available interrupt */
 705                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 706                                         SDIO_FUNC_1,
 707                                         SBSDIO_DEVICE_CTL, &err);
 708                         if (err) {
 709                                 brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
 710                                           err);
 711                                 return -EBADE;
 712                         }
 713
 714                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 715                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 716                                                SBSDIO_DEVICE_CTL, devctl, &err);
 717                         brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
 718                         bus->clkstate = CLK_PENDING;
 719
 720                         return 0;
 721                 } else if (bus->clkstate == CLK_PENDING) {
 722                         /* Cancel CA-only interrupt filter */
 723                         devctl =
 724                             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 725                                                   SBSDIO_DEVICE_CTL, &err);
 726                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 727                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 728                                 SBSDIO_DEVICE_CTL, devctl, &err);
 729                 }
 730
 731                 /* Otherwise, wait here (polling) for HT Avail */
 732                 timeout = jiffies +
 733                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 734                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 735                         clkctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 736                                                        SDIO_FUNC_1,
 737                                                        SBSDIO_FUNC1_CHIPCLKCSR,
 738                                                        &err);
 739                         if (time_after(jiffies, timeout))
 740                                 break;
 741                         else
 742                                 usleep_range(5000, 10000);
 743                 }
 744                 if (err) {
 745                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 746                         return -EBADE;
 747                 }
 748                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 749                         brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
 750                                   PMU_MAX_TRANSITION_DLY, clkctl);
 751                         return -EBADE;
 752                 }
 753
 754                 /* Mark clock available */
 755                 bus->clkstate = CLK_AVAIL;
 756                 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
 757
 758 #if defined(BCMDBG)
 759                 if (bus->alp_only != true) {
 760                         if (SBSDIO_ALPONLY(clkctl))
 761                                 brcmf_dbg(ERROR, "HT Clock should be on\n");
 762                 }
 763 #endif                          /* defined (BCMDBG) */
 764
 765                 bus->activity = true;
 766         } else {
 767                 clkreq = 0;
 768
 769                 if (bus->clkstate == CLK_PENDING) {
 770                         /* Cancel CA-only interrupt filter */
 771                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 772                                         SDIO_FUNC_1,
 773                                         SBSDIO_DEVICE_CTL, &err);
 774                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 775                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 776                                 SBSDIO_DEVICE_CTL, devctl, &err);
 777                 }
 778
 779                 bus->clkstate = CLK_SDONLY;
 780                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 781                         SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 782                 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
 783                 if (err) {
 784                         brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
 785                                   err);
 786                         return -EBADE;
 787                 }
 788         }
 789         return 0;
 790 }
 791
 792 /* Change idle/active SD state */
 793 static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
 794 {
 795         brcmf_dbg(TRACE, "Enter\n");
 796
 797         if (on)
 798                 bus->clkstate = CLK_SDONLY;
 799         else
 800                 bus->clkstate = CLK_NONE;
 801
 802         return 0;
 803 }
 804
 805 /* Transition SD and backplane clock readiness */
 806 static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
 807 {
 808 #ifdef BCMDBG
 809         uint oldstate = bus->clkstate;
 810 #endif                          /* BCMDBG */
 811
 812         brcmf_dbg(TRACE, "Enter\n");
 813
 814         /* Early exit if we're already there */
 815         if (bus->clkstate == target) {
 816                 if (target == CLK_AVAIL) {
 817                         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 818                         bus->activity = true;
 819                 }
 820                 return 0;
 821         }
 822
 823         switch (target) {
 824         case CLK_AVAIL:
 825                 /* Make sure SD clock is available */
 826                 if (bus->clkstate == CLK_NONE)
 827                         brcmf_sdbrcm_sdclk(bus, true);
 828                 /* Now request HT Avail on the backplane */
 829                 brcmf_sdbrcm_htclk(bus, true, pendok);
 830                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 831                 bus->activity = true;
 832                 break;
 833
 834         case CLK_SDONLY:
 835                 /* Remove HT request, or bring up SD clock */
 836                 if (bus->clkstate == CLK_NONE)
 837                         brcmf_sdbrcm_sdclk(bus, true);
 838                 else if (bus->clkstate == CLK_AVAIL)
 839                         brcmf_sdbrcm_htclk(bus, false, false);
 840                 else
 841                         brcmf_dbg(ERROR, "request for %d -> %d\n",
 842                                   bus->clkstate, target);
 843                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 844                 break;
 845
 846         case CLK_NONE:
 847                 /* Make sure to remove HT request */
 848                 if (bus->clkstate == CLK_AVAIL)
 849                         brcmf_sdbrcm_htclk(bus, false, false);
 850                 /* Now remove the SD clock */
 851                 brcmf_sdbrcm_sdclk(bus, false);
 852                 brcmf_sdbrcm_wd_timer(bus, 0);
 853                 break;
 854         }
 855 #ifdef BCMDBG
 856         brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
 857 #endif                          /* BCMDBG */
 858
 859         return 0;
 860 }
 861
 862 static int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
 863 {
 864         uint retries = 0;
 865
 866         brcmf_dbg(INFO, "request %s (currently %s)\n",
 867                   sleep ? "SLEEP" : "WAKE",
 868                   bus->sleeping ? "SLEEP" : "WAKE");
 869
 870         /* Done if we're already in the requested state */
 871         if (sleep == bus->sleeping)
 872                 return 0;
 873
 874         /* Going to sleep: set the alarm and turn off the lights... */
 875         if (sleep) {
 876                 /* Don't sleep if something is pending */
 877                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
 878                         return -EBUSY;
 879
 880                 /* Make sure the controller has the bus up */
 881                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
 882
 883                 /* Tell device to start using OOB wakeup */
 884                 w_sdreg32(bus, SMB_USE_OOB,
 885                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
 886                 if (retries > retry_limit)
 887                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
 888
 889                 /* Turn off our contribution to the HT clock request */
 890                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
 891
 892                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 893                         SBSDIO_FUNC1_CHIPCLKCSR,
 894                         SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
 895
 896                 /* Isolate the bus */
 897                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 898                         SBSDIO_DEVICE_CTL,
 899                         SBSDIO_DEVCTL_PADS_ISO, NULL);
 900
 901                 /* Change state */
 902                 bus->sleeping = true;
 903
 904         } else {
 905                 /* Waking up: bus power up is ok, set local state */
 906
 907                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 908                         SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
 909
 910                 /* Force pad isolation off if possible
 911                          (in case power never toggled) */
 912                 if ((bus->ci->buscoretype == PCMCIA_CORE_ID)
 913                     && (bus->ci->buscorerev >= 10))
 914                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 915                                 SBSDIO_DEVICE_CTL, 0, NULL);
 916
 917                 /* Make sure the controller has the bus up */
 918                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
 919
 920                 /* Send misc interrupt to indicate OOB not needed */
 921                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
 922                           &retries);
 923                 if (retries <= retry_limit)
 924                         w_sdreg32(bus, SMB_DEV_INT,
 925                                   offsetof(struct sdpcmd_regs, tosbmailbox),
 926                                   &retries);
 927
 928                 if (retries > retry_limit)
 929                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
 930
 931                 /* Make sure we have SD bus access */
 932                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
 933
 934                 /* Change state */
 935                 bus->sleeping = false;
 936         }
 937
 938         return 0;
 939 }
 940
 941 static void bus_wake(struct brcmf_bus *bus)
 942 {
 943         if (bus->sleeping)
 944                 brcmf_sdbrcm_bussleep(bus, false);
 945 }
 946
 947 static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
 948 {
 949         u32 intstatus = 0;
 950         u32 hmb_data;
 951         u8 fcbits;
 952         uint retries = 0;
 953
 954         brcmf_dbg(TRACE, "Enter\n");
 955
 956         /* Read mailbox data and ack that we did so */
 957         r_sdreg32(bus, &hmb_data,
 958                   offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
 959
 960         if (retries <= retry_limit)
 961                 w_sdreg32(bus, SMB_INT_ACK,
 962                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
 963         bus->f1regdata += 2;
 964
 965         /* Dongle recomposed rx frames, accept them again */
 966         if (hmb_data & HMB_DATA_NAKHANDLED) {
 967                 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
 968                           bus->rx_seq);
 969                 if (!bus->rxskip)
 970                         brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
 971
 972                 bus->rxskip = false;
 973                 intstatus |= I_HMB_FRAME_IND;
 974         }
 975
 976         /*
 977          * DEVREADY does not occur with gSPI.
 978          */
 979         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
 980                 bus->sdpcm_ver =
 981                     (hmb_data & HMB_DATA_VERSION_MASK) >>
 982                     HMB_DATA_VERSION_SHIFT;
 983                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
 984                         brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
 985                                   "expecting %d\n",
 986                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
 987                 else
 988                         brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
 989                                   bus->sdpcm_ver);
 990         }
 991
 992         /*
 993          * Flow Control has been moved into the RX headers and this out of band
 994          * method isn't used any more.
 995          * remaining backward compatible with older dongles.
 996          */
 997         if (hmb_data & HMB_DATA_FC) {
 998                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
 999                                                         HMB_DATA_FCDATA_SHIFT;
1000
1001                 if (fcbits & ~bus->flowcontrol)
1002                         bus->fc_xoff++;
1003
1004                 if (bus->flowcontrol & ~fcbits)
1005                         bus->fc_xon++;
1006
1007                 bus->fc_rcvd++;
1008                 bus->flowcontrol = fcbits;
1009         }
1010
1011         /* Shouldn't be any others */
1012         if (hmb_data & ~(HMB_DATA_DEVREADY |
1013                          HMB_DATA_NAKHANDLED |
1014                          HMB_DATA_FC |
1015                          HMB_DATA_FWREADY |
1016                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1017                 brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
1018                           hmb_data);
1019
1020         return intstatus;
1021 }
1022
1023 static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
1024 {
1025         uint retries = 0;
1026         u16 lastrbc;
1027         u8 hi, lo;
1028         int err;
1029
1030         brcmf_dbg(ERROR, "%sterminate frame%s\n",
1031                   abort ? "abort command, " : "",
1032                   rtx ? ", send NAK" : "");
1033
1034         if (abort)
1035                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1036
1037         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1038                                SBSDIO_FUNC1_FRAMECTRL,
1039                                SFC_RF_TERM, &err);
1040         bus->f1regdata++;
1041
1042         /* Wait until the packet has been flushed (device/FIFO stable) */
1043         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1044                 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1045                                            SBSDIO_FUNC1_RFRAMEBCHI, NULL);
1046                 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1047                                            SBSDIO_FUNC1_RFRAMEBCLO, NULL);
1048                 bus->f1regdata += 2;
1049
1050                 if ((hi == 0) && (lo == 0))
1051                         break;
1052
1053                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1054                         brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
1055                                   lastrbc, (hi << 8) + lo);
1056                 }
1057                 lastrbc = (hi << 8) + lo;
1058         }
1059
1060         if (!retries)
1061                 brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
1062         else
1063                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
1064
1065         if (rtx) {
1066                 bus->rxrtx++;
1067                 w_sdreg32(bus, SMB_NAK,
1068                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1069
1070                 bus->f1regdata++;
1071                 if (retries <= retry_limit)
1072                         bus->rxskip = true;
1073         }
1074
1075         /* Clear partial in any case */
1076         bus->nextlen = 0;
1077
1078         /* If we can't reach the device, signal failure */
1079         if (err || brcmf_sdcard_regfail(bus->sdiodev))
1080                 bus->drvr->busstate = BRCMF_BUS_DOWN;
1081 }
1082
1083 /* copy a buffer into a pkt buffer chain */
1084 static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_bus *bus, uint len)
1085 {
1086         uint n, ret = 0;
1087         struct sk_buff *p;
1088         u8 *buf;
1089
1090         buf = bus->dataptr;
1091
1092         /* copy the data */
1093         skb_queue_walk(&bus->glom, p) {
1094                 n = min_t(uint, p->len, len);
1095                 memcpy(p->data, buf, n);
1096                 buf += n;
1097                 len -= n;
1098                 ret += n;
1099                 if (!len)
1100                         break;
1101         }
1102
1103         return ret;
1104 }
1105
1106 static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
1107 {
1108         u16 dlen, totlen;
1109         u8 *dptr, num = 0;
1110
1111         u16 sublen, check;
1112         struct sk_buff *pfirst, *plast, *pnext, *save_pfirst;
1113
1114         int errcode;
1115         u8 chan, seq, doff, sfdoff;
1116         u8 txmax;
1117
1118         int ifidx = 0;
1119         bool usechain = bus->use_rxchain;
1120
1121         /* If packets, issue read(s) and send up packet chain */
1122         /* Return sequence numbers consumed? */
1123
1124         brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
1125                   bus->glomd, skb_peek(&bus->glom));
1126
1127         /* If there's a descriptor, generate the packet chain */
1128         if (bus->glomd) {
1129                 pfirst = plast = pnext = NULL;
1130                 dlen = (u16) (bus->glomd->len);
1131                 dptr = bus->glomd->data;
1132                 if (!dlen || (dlen & 1)) {
1133                         brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
1134                                   dlen);
1135                         dlen = 0;
1136                 }
1137
1138                 for (totlen = num = 0; dlen; num++) {
1139                         /* Get (and move past) next length */
1140                         sublen = get_unaligned_le16(dptr);
1141                         dlen -= sizeof(u16);
1142                         dptr += sizeof(u16);
1143                         if ((sublen < SDPCM_HDRLEN) ||
1144                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1145                                 brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
1146                                           num, sublen);
1147                                 pnext = NULL;
1148                                 break;
1149                         }
1150                         if (sublen % BRCMF_SDALIGN) {
1151                                 brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
1152                                           sublen, BRCMF_SDALIGN);
1153                                 usechain = false;
1154                         }
1155                         totlen += sublen;
1156
1157                         /* For last frame, adjust read len so total
1158                                  is a block multiple */
1159                         if (!dlen) {
1160                                 sublen +=
1161                                     (roundup(totlen, bus->blocksize) - totlen);
1162                                 totlen = roundup(totlen, bus->blocksize);
1163                         }
1164
1165                         /* Allocate/chain packet for next subframe */
1166                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1167                         if (pnext == NULL) {
1168                                 brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
1169                                           num, sublen);
1170                                 break;
1171                         }
1172                         skb_queue_tail(&bus->glom, pnext);
1173
1174                         /* Adhere to start alignment requirements */
1175                         pkt_align(pnext, sublen, BRCMF_SDALIGN);
1176                 }
1177
1178                 /* If all allocations succeeded, save packet chain
1179                          in bus structure */
1180                 if (pnext) {
1181                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1182                                   totlen, num);
1183                         if (BRCMF_GLOM_ON() && bus->nextlen &&
1184                             totlen != bus->nextlen) {
1185                                 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1186                                           bus->nextlen, totlen, rxseq);
1187                         }
1188                         pfirst = pnext = NULL;
1189                 } else {
1190                         if (!skb_queue_empty(&bus->glom))
1191                                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1192                                         skb_unlink(pfirst, &bus->glom);
1193                                         brcmu_pkt_buf_free_skb(pfirst);
1194                                 }
1195                         num = 0;
1196                 }
1197
1198                 /* Done with descriptor packet */
1199                 brcmu_pkt_buf_free_skb(bus->glomd);
1200                 bus->glomd = NULL;
1201                 bus->nextlen = 0;
1202         }
1203
1204         /* Ok -- either we just generated a packet chain,
1205                  or had one from before */
1206         if (!skb_queue_empty(&bus->glom)) {
1207                 if (BRCMF_GLOM_ON()) {
1208                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1209                         skb_queue_walk(&bus->glom, pnext) {
1210                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1211                                           pnext, (u8 *) (pnext->data),
1212                                           pnext->len, pnext->len);
1213                         }
1214                 }
1215
1216                 pfirst = skb_peek(&bus->glom);
1217                 dlen = (u16) brcmu_pkttotlen(pfirst);
1218
1219                 /* Do an SDIO read for the superframe.  Configurable iovar to
1220                  * read directly into the chained packet, or allocate a large
1221                  * packet and and copy into the chain.
1222                  */
1223                 if (usechain) {
1224                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1225                                         bus->sdiodev->sbwad,
1226                                         SDIO_FUNC_2,
1227                                         F2SYNC, (u8 *) pfirst->data, dlen,
1228                                         pfirst);
1229                 } else if (bus->dataptr) {
1230                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1231                                         bus->sdiodev->sbwad,
1232                                         SDIO_FUNC_2,
1233                                         F2SYNC, bus->dataptr, dlen,
1234                                         NULL);
1235                         sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
1236                         if (sublen != dlen) {
1237                                 brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
1238                                           dlen, sublen);
1239                                 errcode = -1;
1240                         }
1241                         pnext = NULL;
1242                 } else {
1243                         brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1244                                   dlen);
1245                         errcode = -1;
1246                 }
1247                 bus->f2rxdata++;
1248
1249                 /* On failure, kill the superframe, allow a couple retries */
1250                 if (errcode < 0) {
1251                         brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
1252                                   dlen, errcode);
1253                         bus->drvr->rx_errors++;
1254
1255                         if (bus->glomerr++ < 3) {
1256                                 brcmf_sdbrcm_rxfail(bus, true, true);
1257                         } else {
1258                                 bus->glomerr = 0;
1259                                 brcmf_sdbrcm_rxfail(bus, true, false);
1260                                 bus->rxglomfail++;
1261                                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1262                                         skb_unlink(pfirst, &bus->glom);
1263                                         brcmu_pkt_buf_free_skb(pfirst);
1264                                 }
1265                         }
1266                         return 0;
1267                 }
1268 #ifdef BCMDBG
1269                 if (BRCMF_GLOM_ON()) {
1270                         printk(KERN_DEBUG "SUPERFRAME:\n");
1271                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1272                                 pfirst->data, min_t(int, pfirst->len, 48));
1273                 }
1274 #endif
1275
1276                 /* Validate the superframe header */
1277                 dptr = (u8 *) (pfirst->data);
1278                 sublen = get_unaligned_le16(dptr);
1279                 check = get_unaligned_le16(dptr + sizeof(u16));
1280
1281                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1282                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1283                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1284                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1285                         brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
1286                                   bus->nextlen, seq);
1287                         bus->nextlen = 0;
1288                 }
1289                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1290                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1291
1292                 errcode = 0;
1293                 if ((u16)~(sublen ^ check)) {
1294                         brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
1295                                   sublen, check);
1296                         errcode = -1;
1297                 } else if (roundup(sublen, bus->blocksize) != dlen) {
1298                         brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
1299                                   sublen, roundup(sublen, bus->blocksize),
1300                                   dlen);
1301                         errcode = -1;
1302                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
1303                            SDPCM_GLOM_CHANNEL) {
1304                         brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
1305                                   SDPCM_PACKET_CHANNEL(
1306                                           &dptr[SDPCM_FRAMETAG_LEN]));
1307                         errcode = -1;
1308                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
1309                         brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
1310                         errcode = -1;
1311                 } else if ((doff < SDPCM_HDRLEN) ||
1312                            (doff > (pfirst->len - SDPCM_HDRLEN))) {
1313                         brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
1314                                   doff, sublen, pfirst->len, SDPCM_HDRLEN);
1315                         errcode = -1;
1316                 }
1317
1318                 /* Check sequence number of superframe SW header */
1319                 if (rxseq != seq) {
1320                         brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
1321                                   seq, rxseq);
1322                         bus->rx_badseq++;
1323                         rxseq = seq;
1324                 }
1325
1326                 /* Check window for sanity */
1327                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1328                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1329                                   txmax, bus->tx_seq);
1330                         txmax = bus->tx_seq + 2;
1331                 }
1332                 bus->tx_max = txmax;
1333
1334                 /* Remove superframe header, remember offset */
1335                 skb_pull(pfirst, doff);
1336                 sfdoff = doff;
1337
1338                 /* Validate all the subframe headers */
1339                 for (num = 0, pnext = pfirst; pnext && !errcode;
1340                      num++, pnext = pnext->next) {
1341                         dptr = (u8 *) (pnext->data);
1342                         dlen = (u16) (pnext->len);
1343                         sublen = get_unaligned_le16(dptr);
1344                         check = get_unaligned_le16(dptr + sizeof(u16));
1345                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1346                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1347 #ifdef BCMDBG
1348                         if (BRCMF_GLOM_ON()) {
1349                                 printk(KERN_DEBUG "subframe:\n");
1350                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1351                                                      dptr, 32);
1352                         }
1353 #endif
1354
1355                         if ((u16)~(sublen ^ check)) {
1356                                 brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
1357                                           num, sublen, check);
1358                                 errcode = -1;
1359                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
1360                                 brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
1361                                           num, sublen, dlen);
1362                                 errcode = -1;
1363                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
1364                                    (chan != SDPCM_EVENT_CHANNEL)) {
1365                                 brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
1366                                           num, chan);
1367                                 errcode = -1;
1368                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
1369                                 brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
1370                                           num, doff, sublen, SDPCM_HDRLEN);
1371                                 errcode = -1;
1372                         }
1373                 }
1374
1375                 if (errcode) {
1376                         /* Terminate frame on error, request
1377                                  a couple retries */
1378                         if (bus->glomerr++ < 3) {
1379                                 /* Restore superframe header space */
1380                                 skb_push(pfirst, sfdoff);
1381                                 brcmf_sdbrcm_rxfail(bus, true, true);
1382                         } else {
1383                                 bus->glomerr = 0;
1384                                 brcmf_sdbrcm_rxfail(bus, true, false);
1385                                 bus->rxglomfail++;
1386                                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1387                                         skb_unlink(pfirst, &bus->glom);
1388                                         brcmu_pkt_buf_free_skb(pfirst);
1389                                 }
1390                         }
1391                         bus->nextlen = 0;
1392                         return 0;
1393                 }
1394
1395                 /* Basic SD framing looks ok - process each packet (header) */
1396                 save_pfirst = pfirst;
1397                 plast = NULL;
1398
1399                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
1400                         pnext = pfirst->next;
1401                         pfirst->next = NULL;
1402
1403                         dptr = (u8 *) (pfirst->data);
1404                         sublen = get_unaligned_le16(dptr);
1405                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1406                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1407                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1408
1409                         brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
1410                                   num, pfirst, pfirst->data,
1411                                   pfirst->len, sublen, chan, seq);
1412
1413                         /* precondition: chan == SDPCM_DATA_CHANNEL ||
1414                                          chan == SDPCM_EVENT_CHANNEL */
1415
1416                         if (rxseq != seq) {
1417                                 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
1418                                           seq, rxseq);
1419                                 bus->rx_badseq++;
1420                                 rxseq = seq;
1421                         }
1422 #ifdef BCMDBG
1423                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1424                                 printk(KERN_DEBUG "Rx Subframe Data:\n");
1425                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1426                                                      dptr, dlen);
1427                         }
1428 #endif
1429
1430                         __skb_trim(pfirst, sublen);
1431                         skb_pull(pfirst, doff);
1432
1433                         if (pfirst->len == 0) {
1434                                 brcmu_pkt_buf_free_skb(pfirst);
1435                                 if (plast)
1436                                         plast->next = pnext;
1437                                 else
1438                                         save_pfirst = pnext;
1439
1440                                 continue;
1441                         } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx,
1442                                                        pfirst) != 0) {
1443                                 brcmf_dbg(ERROR, "rx protocol error\n");
1444                                 bus->drvr->rx_errors++;
1445                                 brcmu_pkt_buf_free_skb(pfirst);
1446                                 if (plast)
1447                                         plast->next = pnext;
1448                                 else
1449                                         save_pfirst = pnext;
1450
1451                                 continue;
1452                         }
1453
1454                         /* this packet will go up, link back into
1455                                  chain and count it */
1456                         pfirst->next = pnext;
1457                         plast = pfirst;
1458                         num++;
1459
1460 #ifdef BCMDBG
1461                         if (BRCMF_GLOM_ON()) {
1462                                 brcmf_dbg(GLOM, "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1463                                           num, pfirst, pfirst->data,
1464                                           pfirst->len, pfirst->next,
1465                                           pfirst->prev);
1466                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1467                                                 pfirst->data,
1468                                                 min_t(int, pfirst->len, 32));
1469                         }
1470 #endif                          /* BCMDBG */
1471                 }
1472                 if (num) {
1473                         up(&bus->sdsem);
1474                         brcmf_rx_frame(bus->drvr, ifidx, save_pfirst, num);
1475                         down(&bus->sdsem);
1476                 }
1477
1478                 bus->rxglomframes++;
1479                 bus->rxglompkts += num;
1480         }
1481         return num;
1482 }
1483
1484 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_bus *bus, uint *condition,
1485                                         bool *pending)
1486 {
1487         DECLARE_WAITQUEUE(wait, current);
1488         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1489
1490         /* Wait until control frame is available */
1491         add_wait_queue(&bus->dcmd_resp_wait, &wait);
1492         set_current_state(TASK_INTERRUPTIBLE);
1493
1494         while (!(*condition) && (!signal_pending(current) && timeout))
1495                 timeout = schedule_timeout(timeout);
1496
1497         if (signal_pending(current))
1498                 *pending = true;
1499
1500         set_current_state(TASK_RUNNING);
1501         remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1502
1503         return timeout;
1504 }
1505
1506 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_bus *bus)
1507 {
1508         if (waitqueue_active(&bus->dcmd_resp_wait))
1509                 wake_up_interruptible(&bus->dcmd_resp_wait);
1510
1511         return 0;
1512 }
1513 static void
1514 brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
1515 {
1516         uint rdlen, pad;
1517
1518         int sdret;
1519
1520         brcmf_dbg(TRACE, "Enter\n");
1521
1522         /* Set rxctl for frame (w/optional alignment) */
1523         bus->rxctl = bus->rxbuf;
1524         bus->rxctl += BRCMF_FIRSTREAD;
1525         pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
1526         if (pad)
1527                 bus->rxctl += (BRCMF_SDALIGN - pad);
1528         bus->rxctl -= BRCMF_FIRSTREAD;
1529
1530         /* Copy the already-read portion over */
1531         memcpy(bus->rxctl, hdr, BRCMF_FIRSTREAD);
1532         if (len <= BRCMF_FIRSTREAD)
1533                 goto gotpkt;
1534
1535         /* Raise rdlen to next SDIO block to avoid tail command */
1536         rdlen = len - BRCMF_FIRSTREAD;
1537         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1538                 pad = bus->blocksize - (rdlen % bus->blocksize);
1539                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1540                     ((len + pad) < bus->drvr->maxctl))
1541                         rdlen += pad;
1542         } else if (rdlen % BRCMF_SDALIGN) {
1543                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1544         }
1545
1546         /* Satisfy length-alignment requirements */
1547         if (rdlen & (ALIGNMENT - 1))
1548                 rdlen = roundup(rdlen, ALIGNMENT);
1549
1550         /* Drop if the read is too big or it exceeds our maximum */
1551         if ((rdlen + BRCMF_FIRSTREAD) > bus->drvr->maxctl) {
1552                 brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
1553                           rdlen, bus->drvr->maxctl);
1554                 bus->drvr->rx_errors++;
1555                 brcmf_sdbrcm_rxfail(bus, false, false);
1556                 goto done;
1557         }
1558
1559         if ((len - doff) > bus->drvr->maxctl) {
1560                 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1561                           len, len - doff, bus->drvr->maxctl);
1562                 bus->drvr->rx_errors++;
1563                 bus->rx_toolong++;
1564                 brcmf_sdbrcm_rxfail(bus, false, false);
1565                 goto done;
1566         }
1567
1568         /* Read remainder of frame body into the rxctl buffer */
1569         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1570                                 bus->sdiodev->sbwad,
1571                                 SDIO_FUNC_2,
1572                                 F2SYNC, (bus->rxctl + BRCMF_FIRSTREAD), rdlen,
1573                                 NULL);
1574         bus->f2rxdata++;
1575
1576         /* Control frame failures need retransmission */
1577         if (sdret < 0) {
1578                 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
1579                           rdlen, sdret);
1580                 bus->rxc_errors++;
1581                 brcmf_sdbrcm_rxfail(bus, true, true);
1582                 goto done;
1583         }
1584
1585 gotpkt:
1586
1587 #ifdef BCMDBG
1588         if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1589                 printk(KERN_DEBUG "RxCtrl:\n");
1590                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
1591         }
1592 #endif
1593
1594         /* Point to valid data and indicate its length */
1595         bus->rxctl += doff;
1596         bus->rxlen = len - doff;
1597
1598 done:
1599         /* Awake any waiters */
1600         brcmf_sdbrcm_dcmd_resp_wake(bus);
1601 }
1602
1603 /* Pad read to blocksize for efficiency */
1604 static void brcmf_pad(struct brcmf_bus *bus, u16 *pad, u16 *rdlen)
1605 {
1606         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1607                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1608                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1609                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1610                         *rdlen += *pad;
1611         } else if (*rdlen % BRCMF_SDALIGN) {
1612                 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1613         }
1614 }
1615
1616 static void
1617 brcmf_alloc_pkt_and_read(struct brcmf_bus *bus, u16 rdlen,
1618                          struct sk_buff **pkt, u8 **rxbuf)
1619 {
1620         int sdret;              /* Return code from calls */
1621
1622         *pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
1623         if (*pkt == NULL)
1624                 return;
1625
1626         pkt_align(*pkt, rdlen, BRCMF_SDALIGN);
1627         *rxbuf = (u8 *) ((*pkt)->data);
1628         /* Read the entire frame */
1629         sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
1630                                       SDIO_FUNC_2, F2SYNC,
1631                                       *rxbuf, rdlen, *pkt);
1632         bus->f2rxdata++;
1633
1634         if (sdret < 0) {
1635                 brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
1636                           rdlen, sdret);
1637                 brcmu_pkt_buf_free_skb(*pkt);
1638                 bus->drvr->rx_errors++;
1639                 /* Force retry w/normal header read.
1640                  * Don't attempt NAK for
1641                  * gSPI
1642                  */
1643                 brcmf_sdbrcm_rxfail(bus, true, true);
1644                 *pkt = NULL;
1645         }
1646 }
1647
1648 /* Checks the header */
1649 static int
1650 brcmf_check_rxbuf(struct brcmf_bus *bus, struct sk_buff *pkt, u8 *rxbuf,
1651                   u8 rxseq, u16 nextlen, u16 *len)
1652 {
1653         u16 check;
1654         bool len_consistent;    /* Result of comparing readahead len and
1655                                    len from hw-hdr */
1656
1657         memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
1658
1659         /* Extract hardware header fields */
1660         *len = get_unaligned_le16(bus->rxhdr);
1661         check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1662
1663         /* All zeros means readahead info was bad */
1664         if (!(*len | check)) {
1665                 brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
1666                 goto fail;
1667         }
1668
1669         /* Validate check bytes */
1670         if ((u16)~(*len ^ check)) {
1671                 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
1672                           nextlen, *len, check);
1673                 bus->rx_badhdr++;
1674                 brcmf_sdbrcm_rxfail(bus, false, false);
1675                 goto fail;
1676         }
1677
1678         /* Validate frame length */
1679         if (*len < SDPCM_HDRLEN) {
1680                 brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
1681                           *len);
1682                 goto fail;
1683         }
1684
1685         /* Check for consistency with readahead info */
1686         len_consistent = (nextlen != (roundup(*len, 16) >> 4));
1687         if (len_consistent) {
1688                 /* Mismatch, force retry w/normal
1689                         header (may be >4K) */
1690                 brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
1691                           nextlen, *len, roundup(*len, 16),
1692                           rxseq);
1693                 brcmf_sdbrcm_rxfail(bus, true, true);
1694                 goto fail;
1695         }
1696
1697         return 0;
1698
1699 fail:
1700         brcmf_sdbrcm_pktfree2(bus, pkt);
1701         return -EINVAL;
1702 }
1703
1704 /* Return true if there may be more frames to read */
1705 static uint
1706 brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
1707 {
1708         u16 len, check; /* Extracted hardware header fields */
1709         u8 chan, seq, doff;     /* Extracted software header fields */
1710         u8 fcbits;              /* Extracted fcbits from software header */
1711
1712         struct sk_buff *pkt;            /* Packet for event or data frames */
1713         u16 pad;                /* Number of pad bytes to read */
1714         u16 rdlen;              /* Total number of bytes to read */
1715         u8 rxseq;               /* Next sequence number to expect */
1716         uint rxleft = 0;        /* Remaining number of frames allowed */
1717         int sdret;              /* Return code from calls */
1718         u8 txmax;               /* Maximum tx sequence offered */
1719         u8 *rxbuf;
1720         int ifidx = 0;
1721         uint rxcount = 0;       /* Total frames read */
1722
1723         brcmf_dbg(TRACE, "Enter\n");
1724
1725         /* Not finished unless we encounter no more frames indication */
1726         *finished = false;
1727
1728         for (rxseq = bus->rx_seq, rxleft = maxframes;
1729              !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
1730              rxseq++, rxleft--) {
1731
1732                 /* Handle glomming separately */
1733                 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1734                         u8 cnt;
1735                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1736                                   bus->glomd, skb_peek(&bus->glom));
1737                         cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
1738                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1739                         rxseq += cnt - 1;
1740                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1741                         continue;
1742                 }
1743
1744                 /* Try doing single read if we can */
1745                 if (bus->nextlen) {
1746                         u16 nextlen = bus->nextlen;
1747                         bus->nextlen = 0;
1748
1749                         rdlen = len = nextlen << 4;
1750                         brcmf_pad(bus, &pad, &rdlen);
1751
1752                         /*
1753                          * After the frame is received we have to
1754                          * distinguish whether it is data
1755                          * or non-data frame.
1756                          */
1757                         brcmf_alloc_pkt_and_read(bus, rdlen, &pkt, &rxbuf);
1758                         if (pkt == NULL) {
1759                                 /* Give up on data, request rtx of events */
1760                                 brcmf_dbg(ERROR, "(nextlen): brcmf_alloc_pkt_and_read failed: len %d rdlen %d expected rxseq %d\n",
1761                                           len, rdlen, rxseq);
1762                                 continue;
1763                         }
1764
1765                         if (brcmf_check_rxbuf(bus, pkt, rxbuf, rxseq, nextlen,
1766                                               &len) < 0)
1767                                 continue;
1768
1769                         /* Extract software header fields */
1770                         chan = SDPCM_PACKET_CHANNEL(
1771                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1772                         seq = SDPCM_PACKET_SEQUENCE(
1773                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1774                         doff = SDPCM_DOFFSET_VALUE(
1775                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1776                         txmax = SDPCM_WINDOW_VALUE(
1777                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1778
1779                         bus->nextlen =
1780                             bus->rxhdr[SDPCM_FRAMETAG_LEN +
1781                                        SDPCM_NEXTLEN_OFFSET];
1782                         if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1783                                 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1784                                           bus->nextlen, seq);
1785                                 bus->nextlen = 0;
1786                         }
1787
1788                         bus->drvr->rx_readahead_cnt++;
1789
1790                         /* Handle Flow Control */
1791                         fcbits = SDPCM_FCMASK_VALUE(
1792                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1793
1794                         if (bus->flowcontrol != fcbits) {
1795                                 if (~bus->flowcontrol & fcbits)
1796                                         bus->fc_xoff++;
1797
1798                                 if (bus->flowcontrol & ~fcbits)
1799                                         bus->fc_xon++;
1800
1801                                 bus->fc_rcvd++;
1802                                 bus->flowcontrol = fcbits;
1803                         }
1804
1805                         /* Check and update sequence number */
1806                         if (rxseq != seq) {
1807                                 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
1808                                           seq, rxseq);
1809                                 bus->rx_badseq++;
1810                                 rxseq = seq;
1811                         }
1812
1813                         /* Check window for sanity */
1814                         if ((u8) (txmax - bus->tx_seq) > 0x40) {
1815                                 brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
1816                                           txmax, bus->tx_seq);
1817                                 txmax = bus->tx_seq + 2;
1818                         }
1819                         bus->tx_max = txmax;
1820
1821 #ifdef BCMDBG
1822                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1823                                 printk(KERN_DEBUG "Rx Data:\n");
1824                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1825                                                      rxbuf, len);
1826                         } else if (BRCMF_HDRS_ON()) {
1827                                 printk(KERN_DEBUG "RxHdr:\n");
1828                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1829                                                      bus->rxhdr, SDPCM_HDRLEN);
1830                         }
1831 #endif
1832
1833                         if (chan == SDPCM_CONTROL_CHANNEL) {
1834                                 brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
1835                                           seq);
1836                                 /* Force retry w/normal header read */
1837                                 bus->nextlen = 0;
1838                                 brcmf_sdbrcm_rxfail(bus, false, true);
1839                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1840                                 continue;
1841                         }
1842
1843                         /* Validate data offset */
1844                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1845                                 brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
1846                                           doff, len, SDPCM_HDRLEN);
1847                                 brcmf_sdbrcm_rxfail(bus, false, false);
1848                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1849                                 continue;
1850                         }
1851
1852                         /* All done with this one -- now deliver the packet */
1853                         goto deliver;
1854                 }
1855
1856                 /* Read frame header (hardware and software) */
1857                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
1858                                               SDIO_FUNC_2, F2SYNC, bus->rxhdr,
1859                                               BRCMF_FIRSTREAD, NULL);
1860                 bus->f2rxhdrs++;
1861
1862                 if (sdret < 0) {
1863                         brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
1864                         bus->rx_hdrfail++;
1865                         brcmf_sdbrcm_rxfail(bus, true, true);
1866                         continue;
1867                 }
1868 #ifdef BCMDBG
1869                 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
1870                         printk(KERN_DEBUG "RxHdr:\n");
1871                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1872                                              bus->rxhdr, SDPCM_HDRLEN);
1873                 }
1874 #endif
1875
1876                 /* Extract hardware header fields */
1877                 len = get_unaligned_le16(bus->rxhdr);
1878                 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1879
1880                 /* All zeros means no more frames */
1881                 if (!(len | check)) {
1882                         *finished = true;
1883                         break;
1884                 }
1885
1886                 /* Validate check bytes */
1887                 if ((u16) ~(len ^ check)) {
1888                         brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
1889                                   len, check);
1890                         bus->rx_badhdr++;
1891                         brcmf_sdbrcm_rxfail(bus, false, false);
1892                         continue;
1893                 }
1894
1895                 /* Validate frame length */
1896                 if (len < SDPCM_HDRLEN) {
1897                         brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
1898                         continue;
1899                 }
1900
1901                 /* Extract software header fields */
1902                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1903                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1904                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1905                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1906
1907                 /* Validate data offset */
1908                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1909                         brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
1910                                   doff, len, SDPCM_HDRLEN, seq);
1911                         bus->rx_badhdr++;
1912                         brcmf_sdbrcm_rxfail(bus, false, false);
1913                         continue;
1914                 }
1915
1916                 /* Save the readahead length if there is one */
1917                 bus->nextlen =
1918                     bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1919                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1920                         brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1921                                   bus->nextlen, seq);
1922                         bus->nextlen = 0;
1923                 }
1924
1925                 /* Handle Flow Control */
1926                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1927
1928                 if (bus->flowcontrol != fcbits) {
1929                         if (~bus->flowcontrol & fcbits)
1930                                 bus->fc_xoff++;
1931
1932                         if (bus->flowcontrol & ~fcbits)
1933                                 bus->fc_xon++;
1934
1935                         bus->fc_rcvd++;
1936                         bus->flowcontrol = fcbits;
1937                 }
1938
1939                 /* Check and update sequence number */
1940                 if (rxseq != seq) {
1941                         brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
1942                         bus->rx_badseq++;
1943                         rxseq = seq;
1944                 }
1945
1946                 /* Check window for sanity */
1947                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1948                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1949                                   txmax, bus->tx_seq);
1950                         txmax = bus->tx_seq + 2;
1951                 }
1952                 bus->tx_max = txmax;
1953
1954                 /* Call a separate function for control frames */
1955                 if (chan == SDPCM_CONTROL_CHANNEL) {
1956                         brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
1957                         continue;
1958                 }
1959
1960                 /* precondition: chan is either SDPCM_DATA_CHANNEL,
1961                    SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
1962                    SDPCM_GLOM_CHANNEL */
1963
1964                 /* Length to read */
1965                 rdlen = (len > BRCMF_FIRSTREAD) ? (len - BRCMF_FIRSTREAD) : 0;
1966
1967                 /* May pad read to blocksize for efficiency */
1968                 if (bus->roundup && bus->blocksize &&
1969                         (rdlen > bus->blocksize)) {
1970                         pad = bus->blocksize - (rdlen % bus->blocksize);
1971                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1972                             ((rdlen + pad + BRCMF_FIRSTREAD) < MAX_RX_DATASZ))
1973                                 rdlen += pad;
1974                 } else if (rdlen % BRCMF_SDALIGN) {
1975                         rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1976                 }
1977
1978                 /* Satisfy length-alignment requirements */
1979                 if (rdlen & (ALIGNMENT - 1))
1980                         rdlen = roundup(rdlen, ALIGNMENT);
1981
1982                 if ((rdlen + BRCMF_FIRSTREAD) > MAX_RX_DATASZ) {
1983                         /* Too long -- skip this frame */
1984                         brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
1985                                   len, rdlen);
1986                         bus->drvr->rx_errors++;
1987                         bus->rx_toolong++;
1988                         brcmf_sdbrcm_rxfail(bus, false, false);
1989                         continue;
1990                 }
1991
1992                 pkt = brcmu_pkt_buf_get_skb(rdlen +
1993                                             BRCMF_FIRSTREAD + BRCMF_SDALIGN);
1994                 if (!pkt) {
1995                         /* Give up on data, request rtx of events */
1996                         brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
1997                                   rdlen, chan);
1998                         bus->drvr->rx_dropped++;
1999                         brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
2000                         continue;
2001                 }
2002
2003                 /* Leave room for what we already read, and align remainder */
2004                 skb_pull(pkt, BRCMF_FIRSTREAD);
2005                 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
2006
2007                 /* Read the remaining frame data */
2008                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
2009                                 SDIO_FUNC_2, F2SYNC, ((u8 *) (pkt->data)),
2010                                 rdlen, pkt);
2011                 bus->f2rxdata++;
2012
2013                 if (sdret < 0) {
2014                         brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
2015                                   ((chan == SDPCM_EVENT_CHANNEL) ? "event"
2016                                    : ((chan == SDPCM_DATA_CHANNEL) ? "data"
2017                                       : "test")), sdret);
2018                         brcmu_pkt_buf_free_skb(pkt);
2019                         bus->drvr->rx_errors++;
2020                         brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
2021                         continue;
2022                 }
2023
2024                 /* Copy the already-read portion */
2025                 skb_push(pkt, BRCMF_FIRSTREAD);
2026                 memcpy(pkt->data, bus->rxhdr, BRCMF_FIRSTREAD);
2027
2028 #ifdef BCMDBG
2029                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2030                         printk(KERN_DEBUG "Rx Data:\n");
2031                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2032                                              pkt->data, len);
2033                 }
2034 #endif
2035
2036 deliver:
2037                 /* Save superframe descriptor and allocate packet frame */
2038                 if (chan == SDPCM_GLOM_CHANNEL) {
2039                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
2040                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
2041                                           len);
2042 #ifdef BCMDBG
2043                                 if (BRCMF_GLOM_ON()) {
2044                                         printk(KERN_DEBUG "Glom Data:\n");
2045                                         print_hex_dump_bytes("",
2046                                                              DUMP_PREFIX_OFFSET,
2047                                                              pkt->data, len);
2048                                 }
2049 #endif
2050                                 __skb_trim(pkt, len);
2051                                 skb_pull(pkt, SDPCM_HDRLEN);
2052                                 bus->glomd = pkt;
2053                         } else {
2054                                 brcmf_dbg(ERROR, "%s: glom superframe w/o "
2055                                           "descriptor!\n", __func__);
2056                                 brcmf_sdbrcm_rxfail(bus, false, false);
2057                         }
2058                         continue;
2059                 }
2060
2061                 /* Fill in packet len and prio, deliver upward */
2062                 __skb_trim(pkt, len);
2063                 skb_pull(pkt, doff);
2064
2065                 if (pkt->len == 0) {
2066                         brcmu_pkt_buf_free_skb(pkt);
2067                         continue;
2068                 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
2069                         brcmf_dbg(ERROR, "rx protocol error\n");
2070                         brcmu_pkt_buf_free_skb(pkt);
2071                         bus->drvr->rx_errors++;
2072                         continue;
2073                 }
2074
2075                 /* Unlock during rx call */
2076                 up(&bus->sdsem);
2077                 brcmf_rx_frame(bus->drvr, ifidx, pkt, 1);
2078                 down(&bus->sdsem);
2079         }
2080         rxcount = maxframes - rxleft;
2081 #ifdef BCMDBG
2082         /* Message if we hit the limit */
2083         if (!rxleft)
2084                 brcmf_dbg(DATA, "hit rx limit of %d frames\n",
2085                           maxframes);
2086         else
2087 #endif                          /* BCMDBG */
2088                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2089         /* Back off rxseq if awaiting rtx, update rx_seq */
2090         if (bus->rxskip)
2091                 rxseq--;
2092         bus->rx_seq = rxseq;
2093
2094         return rxcount;
2095 }
2096
2097 static int
2098 brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn, uint flags,
2099                     u8 *buf, uint nbytes, struct sk_buff *pkt)
2100 {
2101         return brcmf_sdcard_send_buf
2102                 (bus->sdiodev, addr, fn, flags, buf, nbytes, pkt);
2103 }
2104
2105 static void
2106 brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
2107 {
2108         up(&bus->sdsem);
2109         wait_event_interruptible_timeout(bus->ctrl_wait,
2110                                          (*lockvar == false), HZ * 2);
2111         down(&bus->sdsem);
2112         return;
2113 }
2114
2115 static void
2116 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
2117 {
2118         if (waitqueue_active(&bus->ctrl_wait))
2119                 wake_up_interruptible(&bus->ctrl_wait);
2120         return;
2121 }
2122
2123 /* Writes a HW/SW header into the packet and sends it. */
2124 /* Assumes: (a) header space already there, (b) caller holds lock */
2125 static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt,
2126                               uint chan, bool free_pkt)
2127 {
2128         int ret;
2129         u8 *frame;
2130         u16 len, pad = 0;
2131         u32 swheader;
2132         struct sk_buff *new;
2133         int i;
2134
2135         brcmf_dbg(TRACE, "Enter\n");
2136
2137         frame = (u8 *) (pkt->data);
2138
2139         /* Add alignment padding, allocate new packet if needed */
2140         pad = ((unsigned long)frame % BRCMF_SDALIGN);
2141         if (pad) {
2142                 if (skb_headroom(pkt) < pad) {
2143                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
2144                                   skb_headroom(pkt), pad);
2145                         bus->drvr->tx_realloc++;
2146                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
2147                         if (!new) {
2148                                 brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
2149                                           pkt->len + BRCMF_SDALIGN);
2150                                 ret = -ENOMEM;
2151                                 goto done;
2152                         }
2153
2154                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
2155                         memcpy(new->data, pkt->data, pkt->len);
2156                         if (free_pkt)
2157                                 brcmu_pkt_buf_free_skb(pkt);
2158                         /* free the pkt if canned one is not used */
2159                         free_pkt = true;
2160                         pkt = new;
2161                         frame = (u8 *) (pkt->data);
2162                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
2163                         pad = 0;
2164                 } else {
2165                         skb_push(pkt, pad);
2166                         frame = (u8 *) (pkt->data);
2167                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
2168                         memset(frame, 0, pad + SDPCM_HDRLEN);
2169                 }
2170         }
2171         /* precondition: pad < BRCMF_SDALIGN */
2172
2173         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2174         len = (u16) (pkt->len);
2175         *(__le16 *) frame = cpu_to_le16(len);
2176         *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
2177
2178         /* Software tag: channel, sequence number, data offset */
2179         swheader =
2180             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
2181             (((pad +
2182                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
2183
2184         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2185         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2186
2187 #ifdef BCMDBG
2188         tx_packets[pkt->priority]++;
2189         if (BRCMF_BYTES_ON() &&
2190             (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
2191               (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
2192                 printk(KERN_DEBUG "Tx Frame:\n");
2193                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
2194         } else if (BRCMF_HDRS_ON()) {
2195                 printk(KERN_DEBUG "TxHdr:\n");
2196                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2197                                      frame, min_t(u16, len, 16));
2198         }
2199 #endif
2200
2201         /* Raise len to next SDIO block to eliminate tail command */
2202         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2203                 u16 pad = bus->blocksize - (len % bus->blocksize);
2204                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2205                                 len += pad;
2206         } else if (len % BRCMF_SDALIGN) {
2207                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2208         }
2209
2210         /* Some controllers have trouble with odd bytes -- round to even */
2211         if (len & (ALIGNMENT - 1))
2212                         len = roundup(len, ALIGNMENT);
2213
2214         ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
2215                                     SDIO_FUNC_2, F2SYNC, frame,
2216                                     len, pkt);
2217         bus->f2txdata++;
2218
2219         if (ret < 0) {
2220                 /* On failure, abort the command and terminate the frame */
2221                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2222                           ret);
2223                 bus->tx_sderrs++;
2224
2225                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2226                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2227                                  SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2228                                  NULL);
2229                 bus->f1regdata++;
2230
2231                 for (i = 0; i < 3; i++) {
2232                         u8 hi, lo;
2233                         hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2234                                              SDIO_FUNC_1,
2235                                              SBSDIO_FUNC1_WFRAMEBCHI,
2236                                              NULL);
2237                         lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2238                                              SDIO_FUNC_1,
2239                                              SBSDIO_FUNC1_WFRAMEBCLO,
2240                                              NULL);
2241                         bus->f1regdata += 2;
2242                         if ((hi == 0) && (lo == 0))
2243                                 break;
2244                 }
2245
2246         }
2247         if (ret == 0)
2248                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2249
2250 done:
2251         /* restore pkt buffer pointer before calling tx complete routine */
2252         skb_pull(pkt, SDPCM_HDRLEN + pad);
2253         up(&bus->sdsem);
2254         brcmf_txcomplete(bus->drvr, pkt, ret != 0);
2255         down(&bus->sdsem);
2256
2257         if (free_pkt)
2258                 brcmu_pkt_buf_free_skb(pkt);
2259
2260         return ret;
2261 }
2262
2263 static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
2264 {
2265         struct sk_buff *pkt;
2266         u32 intstatus = 0;
2267         uint retries = 0;
2268         int ret = 0, prec_out;
2269         uint cnt = 0;
2270         uint datalen;
2271         u8 tx_prec_map;
2272
2273         struct brcmf_pub *drvr = bus->drvr;
2274
2275         brcmf_dbg(TRACE, "Enter\n");
2276
2277         tx_prec_map = ~bus->flowcontrol;
2278
2279         /* Send frames until the limit or some other event */
2280         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
2281                 spin_lock_bh(&bus->txqlock);
2282                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
2283                 if (pkt == NULL) {
2284                         spin_unlock_bh(&bus->txqlock);
2285                         break;
2286                 }
2287                 spin_unlock_bh(&bus->txqlock);
2288                 datalen = pkt->len - SDPCM_HDRLEN;
2289
2290                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
2291                 if (ret)
2292                         bus->drvr->tx_errors++;
2293                 else
2294                         bus->drvr->dstats.tx_bytes += datalen;
2295
2296                 /* In poll mode, need to check for other events */
2297                 if (!bus->intr && cnt) {
2298                         /* Check device status, signal pending interrupt */
2299                         r_sdreg32(bus, &intstatus,
2300                                   offsetof(struct sdpcmd_regs, intstatus),
2301                                   &retries);
2302                         bus->f2txdata++;
2303                         if (brcmf_sdcard_regfail(bus->sdiodev))
2304                                 break;
2305                         if (intstatus & bus->hostintmask)
2306                                 bus->ipend = true;
2307                 }
2308         }
2309
2310         /* Deflow-control stack if needed */
2311         if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
2312             drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
2313                 brcmf_txflowcontrol(drvr, 0, OFF);
2314
2315         return cnt;
2316 }
2317
2318 static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
2319 {
2320         u32 intstatus, newstatus = 0;
2321         uint retries = 0;
2322         uint rxlimit = bus->rxbound;    /* Rx frames to read before resched */
2323         uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2324         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2325         bool rxdone = true;     /* Flag for no more read data */
2326         bool resched = false;   /* Flag indicating resched wanted */
2327
2328         brcmf_dbg(TRACE, "Enter\n");
2329
2330         /* Start with leftover status bits */
2331         intstatus = bus->intstatus;
2332
2333         down(&bus->sdsem);
2334
2335         /* If waiting for HTAVAIL, check status */
2336         if (bus->clkstate == CLK_PENDING) {
2337                 int err;
2338                 u8 clkctl, devctl = 0;
2339
2340 #ifdef BCMDBG
2341                 /* Check for inconsistent device control */
2342                 devctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2343                                                SBSDIO_DEVICE_CTL, &err);
2344                 if (err) {
2345                         brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
2346                         bus->drvr->busstate = BRCMF_BUS_DOWN;
2347                 }
2348 #endif                          /* BCMDBG */
2349
2350                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2351                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2352                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
2353                 if (err) {
2354                         brcmf_dbg(ERROR, "error reading CSR: %d\n",
2355                                   err);
2356                         bus->drvr->busstate = BRCMF_BUS_DOWN;
2357                 }
2358
2359                 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2360                           devctl, clkctl);
2361
2362                 if (SBSDIO_HTAV(clkctl)) {
2363                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
2364                                                        SDIO_FUNC_1,
2365                                                        SBSDIO_DEVICE_CTL, &err);
2366                         if (err) {
2367                                 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
2368                                           err);
2369                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2370                         }
2371                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2372                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2373                                 SBSDIO_DEVICE_CTL, devctl, &err);
2374                         if (err) {
2375                                 brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
2376                                           err);
2377                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2378                         }
2379                         bus->clkstate = CLK_AVAIL;
2380                 } else {
2381                         goto clkwait;
2382                 }
2383         }
2384
2385         bus_wake(bus);
2386
2387         /* Make sure backplane clock is on */
2388         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2389         if (bus->clkstate == CLK_PENDING)
2390                 goto clkwait;
2391
2392         /* Pending interrupt indicates new device status */
2393         if (bus->ipend) {
2394                 bus->ipend = false;
2395                 r_sdreg32(bus, &newstatus,
2396                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2397                 bus->f1regdata++;
2398                 if (brcmf_sdcard_regfail(bus->sdiodev))
2399                         newstatus = 0;
2400                 newstatus &= bus->hostintmask;
2401                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
2402                 if (newstatus) {
2403                         w_sdreg32(bus, newstatus,
2404                                   offsetof(struct sdpcmd_regs, intstatus),
2405                                   &retries);
2406                         bus->f1regdata++;
2407                 }
2408         }
2409
2410         /* Merge new bits with previous */
2411         intstatus |= newstatus;
2412         bus->intstatus = 0;
2413
2414         /* Handle flow-control change: read new state in case our ack
2415          * crossed another change interrupt.  If change still set, assume
2416          * FC ON for safety, let next loop through do the debounce.
2417          */
2418         if (intstatus & I_HMB_FC_CHANGE) {
2419                 intstatus &= ~I_HMB_FC_CHANGE;
2420                 w_sdreg32(bus, I_HMB_FC_CHANGE,
2421                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2422
2423                 r_sdreg32(bus, &newstatus,
2424                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2425                 bus->f1regdata += 2;
2426                 bus->fcstate =
2427                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
2428                 intstatus |= (newstatus & bus->hostintmask);
2429         }
2430
2431         /* Handle host mailbox indication */
2432         if (intstatus & I_HMB_HOST_INT) {
2433                 intstatus &= ~I_HMB_HOST_INT;
2434                 intstatus |= brcmf_sdbrcm_hostmail(bus);
2435         }
2436
2437         /* Generally don't ask for these, can get CRC errors... */
2438         if (intstatus & I_WR_OOSYNC) {
2439                 brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
2440                 intstatus &= ~I_WR_OOSYNC;
2441         }
2442
2443         if (intstatus & I_RD_OOSYNC) {
2444                 brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
2445                 intstatus &= ~I_RD_OOSYNC;
2446         }
2447
2448         if (intstatus & I_SBINT) {
2449                 brcmf_dbg(ERROR, "Dongle reports SBINT\n");
2450                 intstatus &= ~I_SBINT;
2451         }
2452
2453         /* Would be active due to wake-wlan in gSPI */
2454         if (intstatus & I_CHIPACTIVE) {
2455                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2456                 intstatus &= ~I_CHIPACTIVE;
2457         }
2458
2459         /* Ignore frame indications if rxskip is set */
2460         if (bus->rxskip)
2461                 intstatus &= ~I_HMB_FRAME_IND;
2462
2463         /* On frame indication, read available frames */
2464         if (PKT_AVAILABLE()) {
2465                 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
2466                 if (rxdone || bus->rxskip)
2467                         intstatus &= ~I_HMB_FRAME_IND;
2468                 rxlimit -= min(framecnt, rxlimit);
2469         }
2470
2471         /* Keep still-pending events for next scheduling */
2472         bus->intstatus = intstatus;
2473
2474 clkwait:
2475         if (data_ok(bus) && bus->ctrl_frame_stat &&
2476                 (bus->clkstate == CLK_AVAIL)) {
2477                 int ret, i;
2478
2479                 ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
2480                         SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
2481                         (u32) bus->ctrl_frame_len, NULL);
2482
2483                 if (ret < 0) {
2484                         /* On failure, abort the command and
2485                                 terminate the frame */
2486                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2487                                   ret);
2488                         bus->tx_sderrs++;
2489
2490                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2491
2492                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2493                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2494                                          NULL);
2495                         bus->f1regdata++;
2496
2497                         for (i = 0; i < 3; i++) {
2498                                 u8 hi, lo;
2499                                 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2500                                                      SDIO_FUNC_1,
2501                                                      SBSDIO_FUNC1_WFRAMEBCHI,
2502                                                      NULL);
2503                                 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2504                                                      SDIO_FUNC_1,
2505                                                      SBSDIO_FUNC1_WFRAMEBCLO,
2506                                                      NULL);
2507                                 bus->f1regdata += 2;
2508                                 if ((hi == 0) && (lo == 0))
2509                                         break;
2510                         }
2511
2512                 }
2513                 if (ret == 0)
2514                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2515
2516                 brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
2517                 bus->ctrl_frame_stat = false;
2518                 brcmf_sdbrcm_wait_event_wakeup(bus);
2519         }
2520         /* Send queued frames (limit 1 if rx may still be pending) */
2521         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
2522                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2523                  && data_ok(bus)) {
2524                 framecnt = rxdone ? txlimit : min(txlimit, bus->txminmax);
2525                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2526                 txlimit -= framecnt;
2527         }
2528
2529         /* Resched if events or tx frames are pending,
2530                  else await next interrupt */
2531         /* On failed register access, all bets are off:
2532                  no resched or interrupts */
2533         if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
2534             brcmf_sdcard_regfail(bus->sdiodev)) {
2535                 brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation %d\n",
2536                           brcmf_sdcard_regfail(bus->sdiodev));
2537                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2538                 bus->intstatus = 0;
2539         } else if (bus->clkstate == CLK_PENDING) {
2540                 brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
2541                 resched = true;
2542         } else if (bus->intstatus || bus->ipend ||
2543                 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
2544                  && data_ok(bus)) || PKT_AVAILABLE()) {
2545                 resched = true;
2546         }
2547
2548         bus->dpc_sched = resched;
2549
2550         /* If we're done for now, turn off clock request. */
2551         if ((bus->clkstate != CLK_PENDING)
2552             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2553                 bus->activity = false;
2554                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2555         }
2556
2557         up(&bus->sdsem);
2558
2559         return resched;
2560 }
2561
2562 static int brcmf_sdbrcm_dpc_thread(void *data)
2563 {
2564         struct brcmf_bus *bus = (struct brcmf_bus *) data;
2565
2566         allow_signal(SIGTERM);
2567         /* Run until signal received */
2568         while (1) {
2569                 if (kthread_should_stop())
2570                         break;
2571                 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
2572                         /* Call bus dpc unless it indicated down
2573                         (then clean stop) */
2574                         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
2575                                 if (brcmf_sdbrcm_dpc(bus))
2576                                         complete(&bus->dpc_wait);
2577                         } else {
2578                                 /* after stopping the bus, exit thread */
2579                                 brcmf_sdbrcm_bus_stop(bus);
2580                                 bus->dpc_tsk = NULL;
2581                                 break;
2582                         }
2583                 } else
2584                         break;
2585         }
2586         return 0;
2587 }
2588
2589 int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
2590 {
2591         int ret = -EBADE;
2592         uint datalen, prec;
2593
2594         brcmf_dbg(TRACE, "Enter\n");
2595
2596         datalen = pkt->len;
2597
2598         /* Add space for the header */
2599         skb_push(pkt, SDPCM_HDRLEN);
2600         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2601
2602         prec = prio2prec((pkt->priority & PRIOMASK));
2603
2604         /* Check for existing queue, current flow-control,
2605                          pending event, or pending clock */
2606         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2607         bus->fcqueued++;
2608
2609         /* Priority based enq */
2610         spin_lock_bh(&bus->txqlock);
2611         if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) == false) {
2612                 skb_pull(pkt, SDPCM_HDRLEN);
2613                 brcmf_txcomplete(bus->drvr, pkt, false);
2614                 brcmu_pkt_buf_free_skb(pkt);
2615                 brcmf_dbg(ERROR, "out of bus->txq !!!\n");
2616                 ret = -ENOSR;
2617         } else {
2618                 ret = 0;
2619         }
2620         spin_unlock_bh(&bus->txqlock);
2621
2622         if (pktq_len(&bus->txq) >= TXHI)
2623                 brcmf_txflowcontrol(bus->drvr, 0, ON);
2624
2625 #ifdef BCMDBG
2626         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2627                 qcount[prec] = pktq_plen(&bus->txq, prec);
2628 #endif
2629         /* Schedule DPC if needed to send queued packet(s) */
2630         if (!bus->dpc_sched) {
2631                 bus->dpc_sched = true;
2632                 if (bus->dpc_tsk)
2633                         complete(&bus->dpc_wait);
2634         }
2635
2636         return ret;
2637 }
2638
2639 static int
2640 brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
2641                  uint size)
2642 {
2643         int bcmerror = 0;
2644         u32 sdaddr;
2645         uint dsize;
2646
2647         /* Determine initial transfer parameters */
2648         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2649         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2650                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2651         else
2652                 dsize = size;
2653
2654         /* Set the backplane window to include the start address */
2655         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2656         if (bcmerror) {
2657                 brcmf_dbg(ERROR, "window change failed\n");
2658                 goto xfer_done;
2659         }
2660
2661         /* Do the transfer(s) */
2662         while (size) {
2663                 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2664                           write ? "write" : "read", dsize,
2665                           sdaddr, address & SBSDIO_SBWINDOW_MASK);
2666                 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2667                                                sdaddr, data, dsize);
2668                 if (bcmerror) {
2669                         brcmf_dbg(ERROR, "membytes transfer failed\n");
2670                         break;
2671                 }
2672
2673                 /* Adjust for next transfer (if any) */
2674                 size -= dsize;
2675                 if (size) {
2676                         data += dsize;
2677                         address += dsize;
2678                         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2679                                                                   address);
2680                         if (bcmerror) {
2681                                 brcmf_dbg(ERROR, "window change failed\n");
2682                                 break;
2683                         }
2684                         sdaddr = 0;
2685                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2686                 }
2687         }
2688
2689 xfer_done:
2690         /* Return the window to backplane enumeration space for core access */
2691         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2692                 brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
2693                           bus->sdiodev->sbwad);
2694
2695         return bcmerror;
2696 }
2697
2698 #ifdef BCMDBG
2699 #define CONSOLE_LINE_MAX        192
2700
2701 static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
2702 {
2703         struct brcmf_console *c = &bus->console;
2704         u8 line[CONSOLE_LINE_MAX], ch;
2705         u32 n, idx, addr;
2706         int rv;
2707
2708         /* Don't do anything until FWREADY updates console address */
2709         if (bus->console_addr == 0)
2710                 return 0;
2711
2712         /* Read console log struct */
2713         addr = bus->console_addr + offsetof(struct rte_console, log_le);
2714         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
2715                                    sizeof(c->log_le));
2716         if (rv < 0)
2717                 return rv;
2718
2719         /* Allocate console buffer (one time only) */
2720         if (c->buf == NULL) {
2721                 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2722                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2723                 if (c->buf == NULL)
2724                         return -ENOMEM;
2725         }
2726
2727         idx = le32_to_cpu(c->log_le.idx);
2728
2729         /* Protect against corrupt value */
2730         if (idx > c->bufsize)
2731                 return -EBADE;
2732
2733         /* Skip reading the console buffer if the index pointer
2734          has not moved */
2735         if (idx == c->last)
2736                 return 0;
2737
2738         /* Read the console buffer */
2739         addr = le32_to_cpu(c->log_le.buf);
2740         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2741         if (rv < 0)
2742                 return rv;
2743
2744         while (c->last != idx) {
2745                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2746                         if (c->last == idx) {
2747                                 /* This would output a partial line.
2748                                  * Instead, back up
2749                                  * the buffer pointer and output this
2750                                  * line next time around.
2751                                  */
2752                                 if (c->last >= n)
2753                                         c->last -= n;
2754                                 else
2755                                         c->last = c->bufsize - n;
2756                                 goto break2;
2757                         }
2758                         ch = c->buf[c->last];
2759                         c->last = (c->last + 1) % c->bufsize;
2760                         if (ch == '\n')
2761                                 break;
2762                         line[n] = ch;
2763                 }
2764
2765                 if (n > 0) {
2766                         if (line[n - 1] == '\r')
2767                                 n--;
2768                         line[n] = 0;
2769                         printk(KERN_DEBUG "CONSOLE: %s\n", line);
2770                 }
2771         }
2772 break2:
2773
2774         return 0;
2775 }
2776 #endif                          /* BCMDBG */
2777
2778 static int brcmf_tx_frame(struct brcmf_bus *bus, u8 *frame, u16 len)
2779 {
2780         int i;
2781         int ret;
2782
2783         bus->ctrl_frame_stat = false;
2784         ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
2785                                     SDIO_FUNC_2, F2SYNC, frame, len, NULL);
2786
2787         if (ret < 0) {
2788                 /* On failure, abort the command and terminate the frame */
2789                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2790                           ret);
2791                 bus->tx_sderrs++;
2792
2793                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2794
2795                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2796                                        SBSDIO_FUNC1_FRAMECTRL,
2797                                        SFC_WF_TERM, NULL);
2798                 bus->f1regdata++;
2799
2800                 for (i = 0; i < 3; i++) {
2801                         u8 hi, lo;
2802                         hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2803                                                    SBSDIO_FUNC1_WFRAMEBCHI,
2804                                                    NULL);
2805                         lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2806                                                    SBSDIO_FUNC1_WFRAMEBCLO,
2807                                                    NULL);
2808                         bus->f1regdata += 2;
2809                         if (hi == 0 && lo == 0)
2810                                 break;
2811                 }
2812                 return ret;
2813         }
2814
2815         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2816
2817         return ret;
2818 }
2819
2820 int
2821 brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
2822 {
2823         u8 *frame;
2824         u16 len;
2825         u32 swheader;
2826         uint retries = 0;
2827         u8 doff = 0;
2828         int ret = -1;
2829
2830         brcmf_dbg(TRACE, "Enter\n");
2831
2832         /* Back the pointer to make a room for bus header */
2833         frame = msg - SDPCM_HDRLEN;
2834         len = (msglen += SDPCM_HDRLEN);
2835
2836         /* Add alignment padding (optional for ctl frames) */
2837         doff = ((unsigned long)frame % BRCMF_SDALIGN);
2838         if (doff) {
2839                 frame -= doff;
2840                 len += doff;
2841                 msglen += doff;
2842                 memset(frame, 0, doff + SDPCM_HDRLEN);
2843         }
2844         /* precondition: doff < BRCMF_SDALIGN */
2845         doff += SDPCM_HDRLEN;
2846
2847         /* Round send length to next SDIO block */
2848         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2849                 u16 pad = bus->blocksize - (len % bus->blocksize);
2850                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2851                         len += pad;
2852         } else if (len % BRCMF_SDALIGN) {
2853                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2854         }
2855
2856         /* Satisfy length-alignment requirements */
2857         if (len & (ALIGNMENT - 1))
2858                 len = roundup(len, ALIGNMENT);
2859
2860         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2861
2862         /* Need to lock here to protect txseq and SDIO tx calls */
2863         down(&bus->sdsem);
2864
2865         bus_wake(bus);
2866
2867         /* Make sure backplane clock is on */
2868         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2869
2870         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2871         *(__le16 *) frame = cpu_to_le16((u16) msglen);
2872         *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
2873
2874         /* Software tag: channel, sequence number, data offset */
2875         swheader =
2876             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
2877              SDPCM_CHANNEL_MASK)
2878             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
2879                              SDPCM_DOFFSET_MASK);
2880         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2881         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2882
2883         if (!data_ok(bus)) {
2884                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2885                           bus->tx_max, bus->tx_seq);
2886                 bus->ctrl_frame_stat = true;
2887                 /* Send from dpc */
2888                 bus->ctrl_frame_buf = frame;
2889                 bus->ctrl_frame_len = len;
2890
2891                 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
2892
2893                 if (bus->ctrl_frame_stat == false) {
2894                         brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
2895                         ret = 0;
2896                 } else {
2897                         brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
2898                         ret = -1;
2899                 }
2900         }
2901
2902         if (ret == -1) {
2903 #ifdef BCMDBG
2904                 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
2905                         printk(KERN_DEBUG "Tx Frame:\n");
2906                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2907                                              frame, len);
2908                 } else if (BRCMF_HDRS_ON()) {
2909                         printk(KERN_DEBUG "TxHdr:\n");
2910                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2911                                              frame, min_t(u16, len, 16));
2912                 }
2913 #endif
2914
2915                 do {
2916                         ret = brcmf_tx_frame(bus, frame, len);
2917                 } while (ret < 0 && retries++ < TXRETRIES);
2918         }
2919
2920         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2921                 bus->activity = false;
2922                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2923         }
2924
2925         up(&bus->sdsem);
2926
2927         if (ret)
2928                 bus->drvr->tx_ctlerrs++;
2929         else
2930                 bus->drvr->tx_ctlpkts++;
2931
2932         return ret ? -EIO : 0;
2933 }
2934
2935 int
2936 brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
2937 {
2938         int timeleft;
2939         uint rxlen = 0;
2940         bool pending;
2941
2942         brcmf_dbg(TRACE, "Enter\n");
2943
2944         /* Wait until control frame is available */
2945         timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
2946
2947         down(&bus->sdsem);
2948         rxlen = bus->rxlen;
2949         memcpy(msg, bus->rxctl, min(msglen, rxlen));
2950         bus->rxlen = 0;
2951         up(&bus->sdsem);
2952
2953         if (rxlen) {
2954                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
2955                           rxlen, msglen);
2956         } else if (timeleft == 0) {
2957                 brcmf_dbg(ERROR, "resumed on timeout\n");
2958         } else if (pending == true) {
2959                 brcmf_dbg(CTL, "cancelled\n");
2960                 return -ERESTARTSYS;
2961         } else {
2962                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
2963         }
2964
2965         if (rxlen)
2966                 bus->drvr->rx_ctlpkts++;
2967         else
2968                 bus->drvr->rx_ctlerrs++;
2969
2970         return rxlen ? (int)rxlen : -ETIMEDOUT;
2971 }
2972
2973 static int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
2974 {
2975         int bcmerror = 0;
2976
2977         brcmf_dbg(TRACE, "Enter\n");
2978
2979         /* Basic sanity checks */
2980         if (bus->drvr->up) {
2981                 bcmerror = -EISCONN;
2982                 goto err;
2983         }
2984         if (!len) {
2985                 bcmerror = -EOVERFLOW;
2986                 goto err;
2987         }
2988
2989         /* Free the old ones and replace with passed variables */
2990         kfree(bus->vars);
2991
2992         bus->vars = kmalloc(len, GFP_ATOMIC);
2993         bus->varsz = bus->vars ? len : 0;
2994         if (bus->vars == NULL) {
2995                 bcmerror = -ENOMEM;
2996                 goto err;
2997         }
2998
2999         /* Copy the passed variables, which should include the
3000                  terminating double-null */
3001         memcpy(bus->vars, arg, bus->varsz);
3002 err:
3003         return bcmerror;
3004 }
3005
3006 static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
3007 {
3008         int bcmerror = 0;
3009         u32 varsize;
3010         u32 varaddr;
3011         u8 *vbuffer;
3012         u32 varsizew;
3013         __le32 varsizew_le;
3014 #ifdef BCMDBG
3015         char *nvram_ularray;
3016 #endif                          /* BCMDBG */
3017
3018         /* Even if there are no vars are to be written, we still
3019                  need to set the ramsize. */
3020         varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
3021         varaddr = (bus->ramsize - 4) - varsize;
3022
3023         if (bus->vars) {
3024                 vbuffer = kzalloc(varsize, GFP_ATOMIC);
3025                 if (!vbuffer)
3026                         return -ENOMEM;
3027
3028                 memcpy(vbuffer, bus->vars, bus->varsz);
3029
3030                 /* Write the vars list */
3031                 bcmerror =
3032                     brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
3033 #ifdef BCMDBG
3034                 /* Verify NVRAM bytes */
3035                 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
3036                 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
3037                 if (!nvram_ularray)
3038                         return -ENOMEM;
3039
3040                 /* Upload image to verify downloaded contents. */
3041                 memset(nvram_ularray, 0xaa, varsize);
3042
3043                 /* Read the vars list to temp buffer for comparison */
3044                 bcmerror =
3045                     brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
3046                                      varsize);
3047                 if (bcmerror) {
3048                         brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
3049                                   bcmerror, varsize, varaddr);
3050                 }
3051                 /* Compare the org NVRAM with the one read from RAM */
3052                 if (memcmp(vbuffer, nvram_ularray, varsize))
3053                         brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
3054                 else
3055                         brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
3056
3057                 kfree(nvram_ularray);
3058 #endif                          /* BCMDBG */
3059
3060                 kfree(vbuffer);
3061         }
3062
3063         /* adjust to the user specified RAM */
3064         brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
3065         brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3066                   varaddr, varsize);
3067         varsize = ((bus->ramsize - 4) - varaddr);
3068
3069         /*
3070          * Determine the length token:
3071          * Varsize, converted to words, in lower 16-bits, checksum
3072          * in upper 16-bits.
3073          */
3074         if (bcmerror) {
3075                 varsizew = 0;
3076                 varsizew_le = cpu_to_le32(0);
3077         } else {
3078                 varsizew = varsize / 4;
3079                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3080                 varsizew_le = cpu_to_le32(varsizew);
3081         }
3082
3083         brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3084                   varsize, varsizew);
3085
3086         /* Write the length token to the last word */
3087         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
3088                                          (u8 *)&varsizew_le, 4);
3089
3090         return bcmerror;
3091 }
3092
3093 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
3094 {
3095         uint retries;
3096         int bcmerror = 0;
3097
3098         /* To enter download state, disable ARM and reset SOCRAM.
3099          * To exit download state, simply reset ARM (default is RAM boot).
3100          */
3101         if (enter) {
3102                 bus->alp_only = true;
3103
3104                 brcmf_sdio_chip_coredisable(bus->sdiodev,
3105                                               bus->ci->armcorebase);
3106
3107                 brcmf_sdio_chip_resetcore(bus->sdiodev, bus->ci->ramcorebase);
3108
3109                 /* Clear the top bit of memory */
3110                 if (bus->ramsize) {
3111                         u32 zeros = 0;
3112                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3113                                          (u8 *)&zeros, 4);
3114                 }
3115         } else {
3116                 if (!brcmf_sdio_chip_iscoreup(bus->sdiodev,
3117                                               bus->ci->ramcorebase)) {
3118                         brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
3119                         bcmerror = -EBADE;
3120                         goto fail;
3121                 }
3122
3123                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3124                 if (bcmerror) {
3125                         brcmf_dbg(ERROR, "no vars written to RAM\n");
3126                         bcmerror = 0;
3127                 }
3128
3129                 w_sdreg32(bus, 0xFFFFFFFF,
3130                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3131
3132                 brcmf_sdio_chip_resetcore(bus->sdiodev, bus->ci->armcorebase);
3133
3134                 /* Allow HT Clock now that the ARM is running. */
3135                 bus->alp_only = false;
3136
3137                 bus->drvr->busstate = BRCMF_BUS_LOAD;
3138         }
3139 fail:
3140         return bcmerror;
3141 }
3142
3143 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
3144 {
3145         if (bus->firmware->size < bus->fw_ptr + len)
3146                 len = bus->firmware->size - bus->fw_ptr;
3147
3148         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3149         bus->fw_ptr += len;
3150         return len;
3151 }
3152
3153 MODULE_FIRMWARE(BCM4329_FW_NAME);
3154 MODULE_FIRMWARE(BCM4329_NV_NAME);
3155
3156 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
3157 {
3158         int offset = 0;
3159         uint len;
3160         u8 *memblock = NULL, *memptr;
3161         int ret;
3162
3163         brcmf_dbg(INFO, "Enter\n");
3164
3165         bus->fw_name = BCM4329_FW_NAME;
3166         ret = request_firmware(&bus->firmware, bus->fw_name,
3167                                &bus->sdiodev->func[2]->dev);
3168         if (ret) {
3169                 brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
3170                 return ret;
3171         }
3172         bus->fw_ptr = 0;
3173
3174         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3175         if (memblock == NULL) {
3176                 ret = -ENOMEM;
3177                 goto err;
3178         }
3179         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3180                 memptr += (BRCMF_SDALIGN -
3181                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3182
3183         /* Download image */
3184         while ((len =
3185                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3186                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3187                 if (ret) {
3188                         brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
3189                                   ret, MEMBLOCK, offset);
3190                         goto err;
3191                 }
3192
3193                 offset += MEMBLOCK;
3194         }
3195
3196 err:
3197         kfree(memblock);
3198
3199         release_firmware(bus->firmware);
3200         bus->fw_ptr = 0;
3201
3202         return ret;
3203 }
3204
3205 /*
3206  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3207  * and ending in a NUL.
3208  * Removes carriage returns, empty lines, comment lines, and converts
3209  * newlines to NULs.
3210  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
3211  * by two NULs.
3212 */
3213
3214 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
3215 {
3216         char *dp;
3217         bool findNewline;
3218         int column;
3219         uint buf_len, n;
3220
3221         dp = varbuf;
3222
3223         findNewline = false;
3224         column = 0;
3225
3226         for (n = 0; n < len; n++) {
3227                 if (varbuf[n] == 0)
3228                         break;
3229                 if (varbuf[n] == '\r')
3230                         continue;
3231                 if (findNewline && varbuf[n] != '\n')
3232                         continue;
3233                 findNewline = false;
3234                 if (varbuf[n] == '#') {
3235                         findNewline = true;
3236                         continue;
3237                 }
3238                 if (varbuf[n] == '\n') {
3239                         if (column == 0)
3240                                 continue;
3241                         *dp++ = 0;
3242                         column = 0;
3243                         continue;
3244                 }
3245                 *dp++ = varbuf[n];
3246                 column++;
3247         }
3248         buf_len = dp - varbuf;
3249
3250         while (dp < varbuf + n)
3251                 *dp++ = 0;
3252
3253         return buf_len;
3254 }
3255
3256 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
3257 {
3258         uint len;
3259         char *memblock = NULL;
3260         char *bufp;
3261         int ret;
3262
3263         bus->nv_name = BCM4329_NV_NAME;
3264         ret = request_firmware(&bus->firmware, bus->nv_name,
3265                                &bus->sdiodev->func[2]->dev);
3266         if (ret) {
3267                 brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
3268                 return ret;
3269         }
3270         bus->fw_ptr = 0;
3271
3272         memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
3273         if (memblock == NULL) {
3274                 ret = -ENOMEM;
3275                 goto err;
3276         }
3277
3278         len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
3279
3280         if (len > 0 && len < MEMBLOCK) {
3281                 bufp = (char *)memblock;
3282                 bufp[len] = 0;
3283                 len = brcmf_process_nvram_vars(bufp, len);
3284                 bufp += len;
3285                 *bufp++ = 0;
3286                 if (len)
3287                         ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
3288                 if (ret)
3289                         brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
3290         } else {
3291                 brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
3292                 ret = -EIO;
3293         }
3294
3295 err:
3296         kfree(memblock);
3297
3298         release_firmware(bus->firmware);
3299         bus->fw_ptr = 0;
3300
3301         return ret;
3302 }
3303
3304 static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
3305 {
3306         int bcmerror = -1;
3307
3308         /* Keep arm in reset */
3309         if (brcmf_sdbrcm_download_state(bus, true)) {
3310                 brcmf_dbg(ERROR, "error placing ARM core in reset\n");
3311                 goto err;
3312         }
3313
3314         /* External image takes precedence if specified */
3315         if (brcmf_sdbrcm_download_code_file(bus)) {
3316                 brcmf_dbg(ERROR, "dongle image file download failed\n");
3317                 goto err;
3318         }
3319
3320         /* External nvram takes precedence if specified */
3321         if (brcmf_sdbrcm_download_nvram(bus))
3322                 brcmf_dbg(ERROR, "dongle nvram file download failed\n");
3323
3324         /* Take arm out of reset */
3325         if (brcmf_sdbrcm_download_state(bus, false)) {
3326                 brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
3327                 goto err;
3328         }
3329
3330         bcmerror = 0;
3331
3332 err:
3333         return bcmerror;
3334 }
3335
3336 static bool
3337 brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
3338 {
3339         bool ret;
3340
3341         /* Download the firmware */
3342         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3343
3344         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3345
3346         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3347
3348         return ret;
3349 }
3350
3351 void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus)
3352 {
3353         u32 local_hostintmask;
3354         u8 saveclk;
3355         uint retries;
3356         int err;
3357         struct sk_buff *cur;
3358         struct sk_buff *next;
3359
3360         brcmf_dbg(TRACE, "Enter\n");
3361
3362         if (bus->watchdog_tsk) {
3363                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
3364                 kthread_stop(bus->watchdog_tsk);
3365                 bus->watchdog_tsk = NULL;
3366         }
3367
3368         if (bus->dpc_tsk && bus->dpc_tsk != current) {
3369                 send_sig(SIGTERM, bus->dpc_tsk, 1);
3370                 kthread_stop(bus->dpc_tsk);
3371                 bus->dpc_tsk = NULL;
3372         }
3373
3374         down(&bus->sdsem);
3375
3376         bus_wake(bus);
3377
3378         /* Enable clock for device interrupts */
3379         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3380
3381         /* Disable and clear interrupts at the chip level also */
3382         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
3383         local_hostintmask = bus->hostintmask;
3384         bus->hostintmask = 0;
3385
3386         /* Change our idea of bus state */
3387         bus->drvr->busstate = BRCMF_BUS_DOWN;
3388
3389         /* Force clocks on backplane to be sure F2 interrupt propagates */
3390         saveclk = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3391                                         SBSDIO_FUNC1_CHIPCLKCSR, &err);
3392         if (!err) {
3393                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3394                                        SBSDIO_FUNC1_CHIPCLKCSR,
3395                                        (saveclk | SBSDIO_FORCE_HT), &err);
3396         }
3397         if (err)
3398                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3399
3400         /* Turn off the bus (F2), free any pending packets */
3401         brcmf_dbg(INTR, "disable SDIO interrupts\n");
3402         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3403                          SDIO_FUNC_ENABLE_1, NULL);
3404
3405         /* Clear any pending interrupts now that F2 is disabled */
3406         w_sdreg32(bus, local_hostintmask,
3407                   offsetof(struct sdpcmd_regs, intstatus), &retries);
3408
3409         /* Turn off the backplane clock (only) */
3410         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3411
3412         /* Clear the data packet queues */
3413         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
3414
3415         /* Clear any held glomming stuff */
3416         if (bus->glomd)
3417                 brcmu_pkt_buf_free_skb(bus->glomd);
3418         if (!skb_queue_empty(&bus->glom))
3419                 skb_queue_walk_safe(&bus->glom, cur, next) {
3420                         skb_unlink(cur, &bus->glom);
3421                         brcmu_pkt_buf_free_skb(cur);
3422                 }
3423
3424         /* Clear rx control and wake any waiters */
3425         bus->rxlen = 0;
3426         brcmf_sdbrcm_dcmd_resp_wake(bus);
3427
3428         /* Reset some F2 state stuff */
3429         bus->rxskip = false;
3430         bus->tx_seq = bus->rx_seq = 0;
3431
3432         up(&bus->sdsem);
3433 }
3434
3435 int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr)
3436 {
3437         struct brcmf_bus *bus = drvr->bus;
3438         unsigned long timeout;
3439         uint retries = 0;
3440         u8 ready, enable;
3441         int err, ret = 0;
3442         u8 saveclk;
3443
3444         brcmf_dbg(TRACE, "Enter\n");
3445
3446         /* try to download image and nvram to the dongle */
3447         if (drvr->busstate == BRCMF_BUS_DOWN) {
3448                 if (!(brcmf_sdbrcm_download_firmware(bus)))
3449                         return -1;
3450         }
3451
3452         if (!bus->drvr)
3453                 return 0;
3454
3455         /* Start the watchdog timer */
3456         bus->drvr->tickcnt = 0;
3457         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3458
3459         down(&bus->sdsem);
3460
3461         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3462         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3463         if (bus->clkstate != CLK_AVAIL)
3464                 goto exit;
3465
3466         /* Force clocks on backplane to be sure F2 interrupt propagates */
3467         saveclk =
3468             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3469                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
3470         if (!err) {
3471                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3472                                        SBSDIO_FUNC1_CHIPCLKCSR,
3473                                        (saveclk | SBSDIO_FORCE_HT), &err);
3474         }
3475         if (err) {
3476                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3477                 goto exit;
3478         }
3479
3480         /* Enable function 2 (frame transfers) */
3481         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3482                   offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
3483         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3484
3485         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3486                                enable, NULL);
3487
3488         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3489         ready = 0;
3490         while (enable != ready) {
3491                 ready = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_0,
3492                                               SDIO_CCCR_IORx, NULL);
3493                 if (time_after(jiffies, timeout))
3494                         break;
3495                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3496                         /* prevent busy waiting if it takes too long */
3497                         msleep_interruptible(20);
3498         }
3499
3500         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3501
3502         /* If F2 successfully enabled, set core and enable interrupts */
3503         if (ready == enable) {
3504                 /* Set up the interrupt mask and enable interrupts */
3505                 bus->hostintmask = HOSTINTMASK;
3506                 w_sdreg32(bus, bus->hostintmask,
3507                           offsetof(struct sdpcmd_regs, hostintmask), &retries);
3508
3509                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3510                                        SBSDIO_WATERMARK, 8, &err);
3511
3512                 /* Set bus state according to enable result */
3513                 drvr->busstate = BRCMF_BUS_DATA;
3514         }
3515
3516         else {
3517                 /* Disable F2 again */
3518                 enable = SDIO_FUNC_ENABLE_1;
3519                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0,
3520                                        SDIO_CCCR_IOEx, enable, NULL);
3521         }
3522
3523         /* Restore previous clock setting */
3524         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3525                                SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3526
3527         /* If we didn't come up, turn off backplane clock */
3528         if (drvr->busstate != BRCMF_BUS_DATA)
3529                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3530
3531 exit:
3532         up(&bus->sdsem);
3533
3534         return ret;
3535 }
3536
3537 void brcmf_sdbrcm_isr(void *arg)
3538 {
3539         struct brcmf_bus *bus = (struct brcmf_bus *) arg;
3540
3541         brcmf_dbg(TRACE, "Enter\n");
3542
3543         if (!bus) {
3544                 brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
3545                 return;
3546         }
3547
3548         if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
3549                 brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
3550                 return;
3551         }
3552         /* Count the interrupt call */
3553         bus->intrcount++;
3554         bus->ipend = true;
3555
3556         /* Shouldn't get this interrupt if we're sleeping? */
3557         if (bus->sleeping) {
3558                 brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
3559                 return;
3560         }
3561
3562         /* Disable additional interrupts (is this needed now)? */
3563         if (!bus->intr)
3564                 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
3565
3566         bus->dpc_sched = true;
3567         if (bus->dpc_tsk)
3568                 complete(&bus->dpc_wait);
3569 }
3570
3571 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
3572 {
3573         struct brcmf_bus *bus;
3574
3575         brcmf_dbg(TIMER, "Enter\n");
3576
3577         bus = drvr->bus;
3578
3579         /* Ignore the timer if simulating bus down */
3580         if (bus->sleeping)
3581                 return false;
3582
3583         down(&bus->sdsem);
3584
3585         /* Poll period: check device if appropriate. */
3586         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3587                 u32 intstatus = 0;
3588
3589                 /* Reset poll tick */
3590                 bus->polltick = 0;
3591
3592                 /* Check device if no interrupts */
3593                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
3594
3595                         if (!bus->dpc_sched) {
3596                                 u8 devpend;
3597                                 devpend = brcmf_sdcard_cfg_read(bus->sdiodev,
3598                                                 SDIO_FUNC_0, SDIO_CCCR_INTx,
3599                                                 NULL);
3600                                 intstatus =
3601                                     devpend & (INTR_STATUS_FUNC1 |
3602                                                INTR_STATUS_FUNC2);
3603                         }
3604
3605                         /* If there is something, make like the ISR and
3606                                  schedule the DPC */
3607                         if (intstatus) {
3608                                 bus->pollcnt++;
3609                                 bus->ipend = true;
3610
3611                                 bus->dpc_sched = true;
3612                                 if (bus->dpc_tsk)
3613                                         complete(&bus->dpc_wait);
3614                         }
3615                 }
3616
3617                 /* Update interrupt tracking */
3618                 bus->lastintrs = bus->intrcount;
3619         }
3620 #ifdef BCMDBG
3621         /* Poll for console output periodically */
3622         if (drvr->busstate == BRCMF_BUS_DATA && bus->console_interval != 0) {
3623                 bus->console.count += BRCMF_WD_POLL_MS;
3624                 if (bus->console.count >= bus->console_interval) {
3625                         bus->console.count -= bus->console_interval;
3626                         /* Make sure backplane clock is on */
3627                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3628                         if (brcmf_sdbrcm_readconsole(bus) < 0)
3629                                 /* stop on error */
3630                                 bus->console_interval = 0;
3631                 }
3632         }
3633 #endif                          /* BCMDBG */
3634
3635         /* On idle timeout clear activity flag and/or turn off clock */
3636         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3637                 if (++bus->idlecount >= bus->idletime) {
3638                         bus->idlecount = 0;
3639                         if (bus->activity) {
3640                                 bus->activity = false;
3641                                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3642                         } else {
3643                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3644                         }
3645                 }
3646         }
3647
3648         up(&bus->sdsem);
3649
3650         return bus->ipend;
3651 }
3652
3653 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3654 {
3655         if (chipid == BCM4329_CHIP_ID)
3656                 return true;
3657         return false;
3658 }
3659
3660 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
3661 {
3662         brcmf_dbg(TRACE, "Enter\n");
3663
3664         kfree(bus->rxbuf);
3665         bus->rxctl = bus->rxbuf = NULL;
3666         bus->rxlen = 0;
3667
3668         kfree(bus->databuf);
3669         bus->databuf = NULL;
3670 }
3671
3672 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus)
3673 {
3674         brcmf_dbg(TRACE, "Enter\n");
3675
3676         if (bus->drvr->maxctl) {
3677                 bus->rxblen =
3678                     roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
3679                             ALIGNMENT) + BRCMF_SDALIGN;
3680                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3681                 if (!(bus->rxbuf))
3682                         goto fail;
3683         }
3684
3685         /* Allocate buffer to receive glomed packet */
3686         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
3687         if (!(bus->databuf)) {
3688                 /* release rxbuf which was already located as above */
3689                 if (!bus->rxblen)
3690                         kfree(bus->rxbuf);
3691                 goto fail;
3692         }
3693
3694         /* Align the buffer */
3695         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
3696                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
3697                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
3698         else
3699                 bus->dataptr = bus->databuf;
3700
3701         return true;
3702
3703 fail:
3704         return false;
3705 }
3706
3707 /* SDIO Pad drive strength to select value mappings */
3708 struct sdiod_drive_str {
3709         u8 strength;    /* Pad Drive Strength in mA */
3710         u8 sel;         /* Chip-specific select value */
3711 };
3712
3713 /* SDIO Drive Strength to sel value table for PMU Rev 1 */
3714 static const struct sdiod_drive_str sdiod_drive_strength_tab1[] = {
3715         {
3716         4, 0x2}, {
3717         2, 0x3}, {
3718         1, 0x0}, {
3719         0, 0x0}
3720         };
3721
3722 /* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
3723 static const struct sdiod_drive_str sdiod_drive_strength_tab2[] = {
3724         {
3725         12, 0x7}, {
3726         10, 0x6}, {
3727         8, 0x5}, {
3728         6, 0x4}, {
3729         4, 0x2}, {
3730         2, 0x1}, {
3731         0, 0x0}
3732         };
3733
3734 /* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
3735 static const struct sdiod_drive_str sdiod_drive_strength_tab3[] = {
3736         {
3737         32, 0x7}, {
3738         26, 0x6}, {
3739         22, 0x5}, {
3740         16, 0x4}, {
3741         12, 0x3}, {
3742         8, 0x2}, {
3743         4, 0x1}, {
3744         0, 0x0}
3745         };
3746
3747 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
3748
3749 static char *brcmf_chipname(uint chipid, char *buf, uint len)
3750 {
3751         const char *fmt;
3752
3753         fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
3754         snprintf(buf, len, fmt, chipid);
3755         return buf;
3756 }
3757
3758 static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
3759                                                    u32 drivestrength) {
3760         struct sdiod_drive_str *str_tab = NULL;
3761         u32 str_mask = 0;
3762         u32 str_shift = 0;
3763         char chn[8];
3764
3765         if (!(bus->ci->cccaps & CC_CAP_PMU))
3766                 return;
3767
3768         switch (SDIOD_DRVSTR_KEY(bus->ci->chip, bus->ci->pmurev)) {
3769         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
3770                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab1;
3771                 str_mask = 0x30000000;
3772                 str_shift = 28;
3773                 break;
3774         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
3775         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
3776                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab2;
3777                 str_mask = 0x00003800;
3778                 str_shift = 11;
3779                 break;
3780         case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
3781                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab3;
3782                 str_mask = 0x00003800;
3783                 str_shift = 11;
3784                 break;
3785         default:
3786                 brcmf_dbg(ERROR, "No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
3787                           brcmf_chipname(bus->ci->chip, chn, 8),
3788                           bus->ci->chiprev, bus->ci->pmurev);
3789                 break;
3790         }
3791
3792         if (str_tab != NULL) {
3793                 u32 drivestrength_sel = 0;
3794                 u32 cc_data_temp;
3795                 int i;
3796
3797                 for (i = 0; str_tab[i].strength != 0; i++) {
3798                         if (drivestrength >= str_tab[i].strength) {
3799                                 drivestrength_sel = str_tab[i].sel;
3800                                 break;
3801                         }
3802                 }
3803
3804                 brcmf_sdcard_reg_write(bus->sdiodev,
3805                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
3806                         4, 1);
3807                 cc_data_temp = brcmf_sdcard_reg_read(bus->sdiodev,
3808                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr), 4);
3809                 cc_data_temp &= ~str_mask;
3810                 drivestrength_sel <<= str_shift;
3811                 cc_data_temp |= drivestrength_sel;
3812                 brcmf_sdcard_reg_write(bus->sdiodev,
3813                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
3814                         4, cc_data_temp);
3815
3816                 brcmf_dbg(INFO, "SDIO: %dmA drive strength selected, set to 0x%08x\n",
3817                           drivestrength, cc_data_temp);
3818         }
3819 }
3820
3821 static bool
3822 brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, u32 regsva)
3823 {
3824         u8 clkctl = 0;
3825         int err = 0;
3826         int reg_addr;
3827         u32 reg_val;
3828
3829         bus->alp_only = true;
3830
3831         /* Return the window to backplane enumeration space for core access */
3832         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, SI_ENUM_BASE))
3833                 brcmf_dbg(ERROR, "FAILED to return to SI_ENUM_BASE\n");
3834
3835 #ifdef BCMDBG
3836         printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
3837                brcmf_sdcard_reg_read(bus->sdiodev, SI_ENUM_BASE, 4));
3838
3839 #endif                          /* BCMDBG */
3840
3841         /*
3842          * Force PLL off until brcmf_sdio_chip_attach()
3843          * programs PLL control regs
3844          */
3845
3846         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3847                                SBSDIO_FUNC1_CHIPCLKCSR,
3848                                BRCMF_INIT_CLKCTL1, &err);
3849         if (!err)
3850                 clkctl =
3851                     brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3852                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
3853
3854         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3855                 brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3856                           err, BRCMF_INIT_CLKCTL1, clkctl);
3857                 goto fail;
3858         }
3859
3860         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3861                 brcmf_dbg(ERROR, "brcmf_sdio_chip_attach failed!\n");
3862                 goto fail;
3863         }
3864
3865         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
3866                 brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
3867                 goto fail;
3868         }
3869
3870         brcmf_sdbrcm_sdiod_drive_strength_init(bus, SDIO_DRIVE_STRENGTH);
3871
3872         /* Get info on the SOCRAM cores... */
3873         bus->ramsize = bus->ci->ramsize;
3874         if (!(bus->ramsize)) {
3875                 brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
3876                 goto fail;
3877         }
3878
3879         /* Set core control so an SDIO reset does a backplane reset */
3880         reg_addr = bus->ci->buscorebase +
3881                    offsetof(struct sdpcmd_regs, corecontrol);
3882         reg_val = brcmf_sdcard_reg_read(bus->sdiodev, reg_addr, sizeof(u32));
3883         brcmf_sdcard_reg_write(bus->sdiodev, reg_addr, sizeof(u32),
3884                                reg_val | CC_BPRESEN);
3885
3886         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3887
3888         /* Locate an appropriately-aligned portion of hdrbuf */
3889         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3890                                     BRCMF_SDALIGN);
3891
3892         /* Set the poll and/or interrupt flags */
3893         bus->intr = true;
3894         bus->poll = false;
3895         if (bus->poll)
3896                 bus->pollrate = 1;
3897
3898         return true;
3899
3900 fail:
3901         return false;
3902 }
3903
3904 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus)
3905 {
3906         brcmf_dbg(TRACE, "Enter\n");
3907
3908         /* Disable F2 to clear any intermediate frame state on the dongle */
3909         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3910                                SDIO_FUNC_ENABLE_1, NULL);
3911
3912         bus->drvr->busstate = BRCMF_BUS_DOWN;
3913         bus->sleeping = false;
3914         bus->rxflow = false;
3915
3916         /* Done with backplane-dependent accesses, can drop clock... */
3917         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3918                                SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3919
3920         /* ...and initialize clock/power states */
3921         bus->clkstate = CLK_SDONLY;
3922         bus->idletime = BRCMF_IDLE_INTERVAL;
3923         bus->idleclock = BRCMF_IDLE_ACTIVE;
3924
3925         /* Query the F2 block size, set roundup accordingly */
3926         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3927         bus->roundup = min(max_roundup, bus->blocksize);
3928
3929         /* bus module does not support packet chaining */
3930         bus->use_rxchain = false;
3931         bus->sd_rxchain = false;
3932
3933         return true;
3934 }
3935
3936 static int
3937 brcmf_sdbrcm_watchdog_thread(void *data)
3938 {
3939         struct brcmf_bus *bus = (struct brcmf_bus *)data;
3940
3941         allow_signal(SIGTERM);
3942         /* Run until signal received */
3943         while (1) {
3944                 if (kthread_should_stop())
3945                         break;
3946                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3947                         brcmf_sdbrcm_bus_watchdog(bus->drvr);
3948                         /* Count the tick for reference */
3949                         bus->drvr->tickcnt++;
3950                 } else
3951                         break;
3952         }
3953         return 0;
3954 }
3955
3956 static void
3957 brcmf_sdbrcm_watchdog(unsigned long data)
3958 {
3959         struct brcmf_bus *bus = (struct brcmf_bus *)data;
3960
3961         if (bus->watchdog_tsk) {
3962                 complete(&bus->watchdog_wait);
3963                 /* Reschedule the watchdog */
3964                 if (bus->wd_timer_valid)
3965                         mod_timer(&bus->timer,
3966                                   jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3967         }
3968 }
3969
3970 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
3971 {
3972         brcmf_dbg(TRACE, "Enter\n");
3973
3974         if (bus->ci) {
3975                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3976                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3977                 brcmf_sdio_chip_detach(&bus->ci);
3978                 if (bus->vars && bus->varsz)
3979                         kfree(bus->vars);
3980                 bus->vars = NULL;
3981         }
3982
3983         brcmf_dbg(TRACE, "Disconnected\n");
3984 }
3985
3986 /* Detach and free everything */
3987 static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
3988 {
3989         brcmf_dbg(TRACE, "Enter\n");
3990
3991         if (bus) {
3992                 /* De-register interrupt handler */
3993                 brcmf_sdcard_intr_dereg(bus->sdiodev);
3994
3995                 if (bus->drvr) {
3996                         brcmf_detach(bus->drvr);
3997                         brcmf_sdbrcm_release_dongle(bus);
3998                         bus->drvr = NULL;
3999                 }
4000
4001                 brcmf_sdbrcm_release_malloc(bus);
4002
4003                 kfree(bus);
4004         }
4005
4006         brcmf_dbg(TRACE, "Disconnected\n");
4007 }
4008
4009 void *brcmf_sdbrcm_probe(u16 bus_no, u16 slot, u16 func, uint bustype,
4010                          u32 regsva, struct brcmf_sdio_dev *sdiodev)
4011 {
4012         int ret;
4013         struct brcmf_bus *bus;
4014
4015         /* Init global variables at run-time, not as part of the declaration.
4016          * This is required to support init/de-init of the driver.
4017          * Initialization
4018          * of globals as part of the declaration results in non-deterministic
4019          * behavior since the value of the globals may be different on the
4020          * first time that the driver is initialized vs subsequent
4021          * initializations.
4022          */
4023         brcmf_c_init();
4024
4025         brcmf_dbg(TRACE, "Enter\n");
4026
4027         /* We make an assumption about address window mappings:
4028          * regsva == SI_ENUM_BASE*/
4029
4030         /* Allocate private bus interface state */
4031         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
4032         if (!bus)
4033                 goto fail;
4034
4035         bus->sdiodev = sdiodev;
4036         sdiodev->bus = bus;
4037         skb_queue_head_init(&bus->glom);
4038         bus->txbound = BRCMF_TXBOUND;
4039         bus->rxbound = BRCMF_RXBOUND;
4040         bus->txminmax = BRCMF_TXMINMAX;
4041         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
4042         bus->usebufpool = false;        /* Use bufpool if allocated,
4043                                          else use locally malloced rxbuf */
4044
4045         /* attempt to attach to the dongle */
4046         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
4047                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
4048                 goto fail;
4049         }
4050
4051         spin_lock_init(&bus->txqlock);
4052         init_waitqueue_head(&bus->ctrl_wait);
4053         init_waitqueue_head(&bus->dcmd_resp_wait);
4054
4055         /* Set up the watchdog timer */
4056         init_timer(&bus->timer);
4057         bus->timer.data = (unsigned long)bus;
4058         bus->timer.function = brcmf_sdbrcm_watchdog;
4059
4060         /* Initialize thread based operation and lock */
4061         sema_init(&bus->sdsem, 1);
4062
4063         /* Initialize watchdog thread */
4064         init_completion(&bus->watchdog_wait);
4065         bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
4066                                         bus, "brcmf_watchdog");
4067         if (IS_ERR(bus->watchdog_tsk)) {
4068                 printk(KERN_WARNING
4069                        "brcmf_watchdog thread failed to start\n");
4070                 bus->watchdog_tsk = NULL;
4071         }
4072         /* Initialize DPC thread */
4073         init_completion(&bus->dpc_wait);
4074         bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
4075                                    bus, "brcmf_dpc");
4076         if (IS_ERR(bus->dpc_tsk)) {
4077                 printk(KERN_WARNING
4078                        "brcmf_dpc thread failed to start\n");
4079                 bus->dpc_tsk = NULL;
4080         }
4081
4082         /* Attach to the brcmf/OS/network interface */
4083         bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
4084         if (!bus->drvr) {
4085                 brcmf_dbg(ERROR, "brcmf_attach failed\n");
4086                 goto fail;
4087         }
4088
4089         /* Allocate buffers */
4090         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
4091                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
4092                 goto fail;
4093         }
4094
4095         if (!(brcmf_sdbrcm_probe_init(bus))) {
4096                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
4097                 goto fail;
4098         }
4099
4100         /* Register interrupt callback, but mask it (not operational yet). */
4101         brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
4102         ret = brcmf_sdcard_intr_reg(bus->sdiodev);
4103         if (ret != 0) {
4104                 brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
4105                 goto fail;
4106         }
4107         brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
4108
4109         brcmf_dbg(INFO, "completed!!\n");
4110
4111         /* if firmware path present try to download and bring up bus */
4112         ret = brcmf_bus_start(bus->drvr);
4113         if (ret != 0) {
4114                 if (ret == -ENOLINK) {
4115                         brcmf_dbg(ERROR, "dongle is not responding\n");
4116                         goto fail;
4117                 }
4118         }
4119
4120         /* add interface and open for business */
4121         if (brcmf_add_if((struct brcmf_info *)bus->drvr, 0, "wlan%d", NULL)) {
4122                 brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
4123                 goto fail;
4124         }
4125
4126         return bus;
4127
4128 fail:
4129         brcmf_sdbrcm_release(bus);
4130         return NULL;
4131 }
4132
4133 void brcmf_sdbrcm_disconnect(void *ptr)
4134 {
4135         struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
4136
4137         brcmf_dbg(TRACE, "Enter\n");
4138
4139         if (bus)
4140                 brcmf_sdbrcm_release(bus);
4141
4142         brcmf_dbg(TRACE, "Disconnected\n");
4143 }
4144
4145 struct device *brcmf_bus_get_device(struct brcmf_bus *bus)
4146 {
4147         return &bus->sdiodev->func[2]->dev;
4148 }
4149
4150 void
4151 brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
4152 {
4153         /* Totally stop the timer */
4154         if (!wdtick && bus->wd_timer_valid == true) {
4155                 del_timer_sync(&bus->timer);
4156                 bus->wd_timer_valid = false;
4157                 bus->save_ms = wdtick;
4158                 return;
4159         }
4160
4161         /* don't start the wd until fw is loaded */
4162         if (bus->drvr->busstate == BRCMF_BUS_DOWN)
4163                 return;
4164
4165         if (wdtick) {
4166                 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4167                         if (bus->wd_timer_valid == true)
4168                                 /* Stop timer and restart at new value */
4169                                 del_timer_sync(&bus->timer);
4170
4171                         /* Create timer again when watchdog period is
4172                            dynamically changed or in the first instance
4173                          */
4174                         bus->timer.expires =
4175                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4176                         add_timer(&bus->timer);
4177
4178                 } else {
4179                         /* Re arm the timer, at last watchdog period */
4180                         mod_timer(&bus->timer,
4181                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4182                 }
4183
4184                 bus->wd_timer_valid = true;
4185                 bus->save_ms = wdtick;
4186         }
4187 }