drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <linux/module.h>
  31 #include <linux/bcma/bcma.h>
  32 #include <linux/debugfs.h>
  33 #include <linux/vmalloc.h>
  34 #include <linux/platform_data/brcmfmac-sdio.h>
  35 #include <linux/moduleparam.h>
  36 #include <asm/unaligned.h>
  37 #include <defs.h>
  38 #include <brcmu_wifi.h>
  39 #include <brcmu_utils.h>
  40 #include <brcm_hw_ids.h>
  41 #include <soc.h>
  42 #include "sdio_host.h"
  43 #include "chip.h"
  44 #include "nvram.h"
  45
  46 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
  47
  48 #ifdef DEBUG
  49
  50 #define BRCMF_TRAP_INFO_SIZE    80
  51
  52 #define CBUF_LEN        (128)
  53
  54 /* Device console log buffer state */
  55 #define CONSOLE_BUFFER_MAX      2024
  56
  57 struct rte_log_le {
  58         __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  59         __le32 buf_size;
  60         __le32 idx;
  61         char *_buf_compat;      /* Redundant pointer for backward compat. */
  62 };
  63
  64 struct rte_console {
  65         /* Virtual UART
  66          * When there is no UART (e.g. Quickturn),
  67          * the host should write a complete
  68          * input line directly into cbuf and then write
  69          * the length into vcons_in.
  70          * This may also be used when there is a real UART
  71          * (at risk of conflicting with
  72          * the real UART).  vcons_out is currently unused.
  73          */
  74         uint vcons_in;
  75         uint vcons_out;
  76
  77         /* Output (logging) buffer
  78          * Console output is written to a ring buffer log_buf at index log_idx.
  79          * The host may read the output when it sees log_idx advance.
  80          * Output will be lost if the output wraps around faster than the host
  81          * polls.
  82          */
  83         struct rte_log_le log_le;
  84
  85         /* Console input line buffer
  86          * Characters are read one at a time into cbuf
  87          * until <CR> is received, then
  88          * the buffer is processed as a command line.
  89          * Also used for virtual UART.
  90          */
  91         uint cbuf_idx;
  92         char cbuf[CBUF_LEN];
  93 };
  94
  95 #endif                          /* DEBUG */
  96 #include <chipcommon.h>
  97
  98 #include "dhd_bus.h"
  99 #include "dhd_dbg.h"
 100 #include "tracepoint.h"
 101
 102 #define TXQLEN          2048    /* bulk tx queue length */
 103 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 104 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 105 #define PRIOMASK        7
 106
 107 #define TXRETRIES       2       /* # of retries for tx frames */
 108
 109 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 110                                  one scheduling */
 111
 112 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 113                                  one scheduling */
 114
 115 #define BRCMF_DEFAULT_TXGLOM_SIZE       32  /* max tx frames in glom chain */
 116
 117 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 118
 119 #define MEMBLOCK        2048    /* Block size used for downloading
 120                                  of dongle image */
 121 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 122                                  biggest possible glom */
 123
 124 #define BRCMF_FIRSTREAD (1 << 6)
 125
 126
 127 /* SBSDIO_DEVICE_CTL */
 128
 129 /* 1: device will assert busy signal when receiving CMD53 */
 130 #define SBSDIO_DEVCTL_SETBUSY           0x01
 131 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 132 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 133 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 134 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 135 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 136  * sdio bus power cycle to clear (rev 9) */
 137 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 138 /* Force SD->SB reset mapping (rev 11) */
 139 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 140 /*   Determined by CoreControl bit */
 141 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 142 /*   Force backplane reset */
 143 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 144 /*   Force no backplane reset */
 145 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 146
 147 /* direct(mapped) cis space */
 148
 149 /* MAPPED common CIS address */
 150 #define SBSDIO_CIS_BASE_COMMON          0x1000
 151 /* maximum bytes in one CIS */
 152 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 153 /* cis offset addr is < 17 bits */
 154 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 155
 156 /* manfid tuple length, include tuple, link bytes */
 157 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 158
 159 /* intstatus */
 160 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 161 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 162 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 163 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 164 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 165 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 166 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 167 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 168 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 169 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 170 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 171 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 172 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 173 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 174 #define I_PC            (1 << 10)       /* descriptor error */
 175 #define I_PD            (1 << 11)       /* data error */
 176 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 177 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 178 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 179 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 180 #define I_RI            (1 << 16)       /* Receive Interrupt */
 181 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 182 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 183 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 184 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 185 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 186 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 187 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 188 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 189 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 190 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 191 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 192 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 193
 194 /* corecontrol */
 195 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 196 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 197 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 198 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 199 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 200 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 201
 202 /* SDA_FRAMECTRL */
 203 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 204 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 205 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 206 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 207
 208 /*
 209  * Software allocation of To SB Mailbox resources
 210  */
 211
 212 /* tosbmailbox bits corresponding to intstatus bits */
 213 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 214 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 215 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 216 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 217
 218 /* tosbmailboxdata */
 219 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 220
 221 /*
 222  * Software allocation of To Host Mailbox resources
 223  */
 224
 225 /* intstatus bits */
 226 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 227 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 228 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 229 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 230
 231 /* tohostmailboxdata */
 232 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 233 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 234 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 235 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 236
 237 #define HMB_DATA_FCDATA_MASK    0xff000000
 238 #define HMB_DATA_FCDATA_SHIFT   24
 239
 240 #define HMB_DATA_VERSION_MASK   0x00ff0000
 241 #define HMB_DATA_VERSION_SHIFT  16
 242
 243 /*
 244  * Software-defined protocol header
 245  */
 246
 247 /* Current protocol version */
 248 #define SDPCM_PROT_VERSION      4
 249
 250 /*
 251  * Shared structure between dongle and the host.
 252  * The structure contains pointers to trap or assert information.
 253  */
 254 #define SDPCM_SHARED_VERSION       0x0003
 255 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 256 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 257 #define SDPCM_SHARED_ASSERT        0x0200
 258 #define SDPCM_SHARED_TRAP          0x0400
 259
 260 /* Space for header read, limit for data packets */
 261 #define MAX_HDR_READ    (1 << 6)
 262 #define MAX_RX_DATASZ   2048
 263
 264 /* Bump up limit on waiting for HT to account for first startup;
 265  * if the image is doing a CRC calculation before programming the PMU
 266  * for HT availability, it could take a couple hundred ms more, so
 267  * max out at a 1 second (1000000us).
 268  */
 269 #undef PMU_MAX_TRANSITION_DLY
 270 #define PMU_MAX_TRANSITION_DLY 1000000
 271
 272 /* Value for ChipClockCSR during initial setup */
 273 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 274                                         SBSDIO_ALP_AVAIL_REQ)
 275
 276 /* Flags for SDH calls */
 277 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 278
 279 #define BRCMF_IDLE_IMMEDIATE    (-1)    /* Enter idle immediately */
 280 #define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
 281                                          * when idle
 282                                          */
 283 #define BRCMF_IDLE_INTERVAL     1
 284
 285 #define KSO_WAIT_US 50
 286 #define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
 287
 288 /*
 289  * Conversion of 802.1D priority to precedence level
 290  */
 291 static uint prio2prec(u32 prio)
 292 {
 293         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 294                (prio^2) : prio;
 295 }
 296
 297 #ifdef DEBUG
 298 /* Device console log buffer state */
 299 struct brcmf_console {
 300         uint count;             /* Poll interval msec counter */
 301         uint log_addr;          /* Log struct address (fixed) */
 302         struct rte_log_le log_le;       /* Log struct (host copy) */
 303         uint bufsize;           /* Size of log buffer */
 304         u8 *buf;                /* Log buffer (host copy) */
 305         uint last;              /* Last buffer read index */
 306 };
 307
 308 struct brcmf_trap_info {
 309         __le32          type;
 310         __le32          epc;
 311         __le32          cpsr;
 312         __le32          spsr;
 313         __le32          r0;     /* a1 */
 314         __le32          r1;     /* a2 */
 315         __le32          r2;     /* a3 */
 316         __le32          r3;     /* a4 */
 317         __le32          r4;     /* v1 */
 318         __le32          r5;     /* v2 */
 319         __le32          r6;     /* v3 */
 320         __le32          r7;     /* v4 */
 321         __le32          r8;     /* v5 */
 322         __le32          r9;     /* sb/v6 */
 323         __le32          r10;    /* sl/v7 */
 324         __le32          r11;    /* fp/v8 */
 325         __le32          r12;    /* ip */
 326         __le32          r13;    /* sp */
 327         __le32          r14;    /* lr */
 328         __le32          pc;     /* r15 */
 329 };
 330 #endif                          /* DEBUG */
 331
 332 struct sdpcm_shared {
 333         u32 flags;
 334         u32 trap_addr;
 335         u32 assert_exp_addr;
 336         u32 assert_file_addr;
 337         u32 assert_line;
 338         u32 console_addr;       /* Address of struct rte_console */
 339         u32 msgtrace_addr;
 340         u8 tag[32];
 341         u32 brpt_addr;
 342 };
 343
 344 struct sdpcm_shared_le {
 345         __le32 flags;
 346         __le32 trap_addr;
 347         __le32 assert_exp_addr;
 348         __le32 assert_file_addr;
 349         __le32 assert_line;
 350         __le32 console_addr;    /* Address of struct rte_console */
 351         __le32 msgtrace_addr;
 352         u8 tag[32];
 353         __le32 brpt_addr;
 354 };
 355
 356 /* dongle SDIO bus specific header info */
 357 struct brcmf_sdio_hdrinfo {
 358         u8 seq_num;
 359         u8 channel;
 360         u16 len;
 361         u16 len_left;
 362         u16 len_nxtfrm;
 363         u8 dat_offset;
 364         bool lastfrm;
 365         u16 tail_pad;
 366 };
 367
 368 /* misc chip info needed by some of the routines */
 369 /* Private data for SDIO bus interaction */
 370 struct brcmf_sdio {
 371         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 372         struct brcmf_chip *ci;  /* Chip info struct */
 373
 374         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 375
 376         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 377         atomic_t intstatus;     /* Intstatus bits (events) pending */
 378         atomic_t fcstate;       /* State of dongle flow-control */
 379
 380         uint blocksize;         /* Block size of SDIO transfers */
 381         uint roundup;           /* Max roundup limit */
 382
 383         struct pktq txq;        /* Queue length used for flow-control */
 384         u8 flowcontrol; /* per prio flow control bitmask */
 385         u8 tx_seq;              /* Transmit sequence number (next) */
 386         u8 tx_max;              /* Maximum transmit sequence allowed */
 387
 388         u8 *hdrbuf;             /* buffer for handling rx frame */
 389         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 390         u8 rx_seq;              /* Receive sequence number (expected) */
 391         struct brcmf_sdio_hdrinfo cur_read;
 392                                 /* info of current read frame */
 393         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 394         bool rxpending;         /* Data frame pending in dongle */
 395
 396         uint rxbound;           /* Rx frames to read before resched */
 397         uint txbound;           /* Tx frames to send before resched */
 398         uint txminmax;
 399
 400         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 401         struct sk_buff_head glom; /* Packet list for glommed superframe */
 402         uint glomerr;           /* Glom packet read errors */
 403
 404         u8 *rxbuf;              /* Buffer for receiving control packets */
 405         uint rxblen;            /* Allocated length of rxbuf */
 406         u8 *rxctl;              /* Aligned pointer into rxbuf */
 407         u8 *rxctl_orig;         /* pointer for freeing rxctl */
 408         uint rxlen;             /* Length of valid data in buffer */
 409         spinlock_t rxctl_lock;  /* protection lock for ctrl frame resources */
 410
 411         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 412
 413         bool intr;              /* Use interrupts */
 414         bool poll;              /* Use polling */
 415         atomic_t ipend;         /* Device interrupt is pending */
 416         uint spurious;          /* Count of spurious interrupts */
 417         uint pollrate;          /* Ticks between device polls */
 418         uint polltick;          /* Tick counter */
 419
 420 #ifdef DEBUG
 421         uint console_interval;
 422         struct brcmf_console console;   /* Console output polling support */
 423         uint console_addr;      /* Console address from shared struct */
 424 #endif                          /* DEBUG */
 425
 426         uint clkstate;          /* State of sd and backplane clock(s) */
 427         bool activity;          /* Activity flag for clock down */
 428         s32 idletime;           /* Control for activity timeout */
 429         s32 idlecount;  /* Activity timeout counter */
 430         s32 idleclock;  /* How to set bus driver when idle */
 431         bool rxflow_mode;       /* Rx flow control mode */
 432         bool rxflow;            /* Is rx flow control on */
 433         bool alp_only;          /* Don't use HT clock (ALP only) */
 434
 435         u8 *ctrl_frame_buf;
 436         u32 ctrl_frame_len;
 437         bool ctrl_frame_stat;
 438
 439         spinlock_t txqlock;
 440         wait_queue_head_t ctrl_wait;
 441         wait_queue_head_t dcmd_resp_wait;
 442
 443         struct timer_list timer;
 444         struct completion watchdog_wait;
 445         struct task_struct *watchdog_tsk;
 446         bool wd_timer_valid;
 447         uint save_ms;
 448
 449         struct workqueue_struct *brcmf_wq;
 450         struct work_struct datawork;
 451         atomic_t dpc_tskcnt;
 452
 453         bool txoff;             /* Transmit flow-controlled */
 454         struct brcmf_sdio_count sdcnt;
 455         bool sr_enabled; /* SaveRestore enabled */
 456         bool sleeping; /* SDIO bus sleeping */
 457
 458         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
 459         bool txglom;            /* host tx glomming enable flag */
 460         struct sk_buff *txglom_sgpad;   /* scatter-gather padding buffer */
 461         u16 head_align;         /* buffer pointer alignment */
 462         u16 sgentry_align;      /* scatter-gather buffer alignment */
 463 };
 464
 465 /* clkstate */
 466 #define CLK_NONE        0
 467 #define CLK_SDONLY      1
 468 #define CLK_PENDING     2
 469 #define CLK_AVAIL       3
 470
 471 #ifdef DEBUG
 472 static int qcount[NUMPRIO];
 473 #endif                          /* DEBUG */
 474
 475 #define DEFAULT_SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 476
 477 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 478
 479 /* Retry count for register access failures */
 480 static const uint retry_limit = 2;
 481
 482 /* Limit on rounding up frames */
 483 static const uint max_roundup = 512;
 484
 485 #define ALIGNMENT  4
 486
 487 static int brcmf_sdio_txglomsz = BRCMF_DEFAULT_TXGLOM_SIZE;
 488 module_param_named(txglomsz, brcmf_sdio_txglomsz, int, 0);
 489 MODULE_PARM_DESC(txglomsz, "maximum tx packet chain size [SDIO]");
 490
 491 enum brcmf_sdio_frmtype {
 492         BRCMF_SDIO_FT_NORMAL,
 493         BRCMF_SDIO_FT_SUPER,
 494         BRCMF_SDIO_FT_SUB,
 495 };
 496
 497 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
 498
 499 /* SDIO Pad drive strength to select value mappings */
 500 struct sdiod_drive_str {
 501         u8 strength;    /* Pad Drive Strength in mA */
 502         u8 sel;         /* Chip-specific select value */
 503 };
 504
 505 /* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8V) */
 506 static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
 507         {32, 0x6},
 508         {26, 0x7},
 509         {22, 0x4},
 510         {16, 0x5},
 511         {12, 0x2},
 512         {8, 0x3},
 513         {4, 0x0},
 514         {0, 0x1}
 515 };
 516
 517 /* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
 518 static const struct sdiod_drive_str sdiod_drive_strength_tab5_1v8[] = {
 519         {6, 0x7},
 520         {5, 0x6},
 521         {4, 0x5},
 522         {3, 0x4},
 523         {2, 0x2},
 524         {1, 0x1},
 525         {0, 0x0}
 526 };
 527
 528 /* SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
 529 static const struct sdiod_drive_str sdiod_drvstr_tab6_1v8[] = {
 530         {3, 0x3},
 531         {2, 0x2},
 532         {1, 0x1},
 533         {0, 0x0} };
 534
 535 /* SDIO Drive Strength to sel value table for 43143 PMU Rev 17 (3.3V) */
 536 static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 537         {16, 0x7},
 538         {12, 0x5},
 539         {8,  0x3},
 540         {4,  0x1}
 541 };
 542
 543 #define BCM43143_FIRMWARE_NAME          "brcm/brcmfmac43143-sdio.bin"
 544 #define BCM43143_NVRAM_NAME             "brcm/brcmfmac43143-sdio.txt"
 545 #define BCM43241B0_FIRMWARE_NAME        "brcm/brcmfmac43241b0-sdio.bin"
 546 #define BCM43241B0_NVRAM_NAME           "brcm/brcmfmac43241b0-sdio.txt"
 547 #define BCM43241B4_FIRMWARE_NAME        "brcm/brcmfmac43241b4-sdio.bin"
 548 #define BCM43241B4_NVRAM_NAME           "brcm/brcmfmac43241b4-sdio.txt"
 549 #define BCM4329_FIRMWARE_NAME           "brcm/brcmfmac4329-sdio.bin"
 550 #define BCM4329_NVRAM_NAME              "brcm/brcmfmac4329-sdio.txt"
 551 #define BCM4330_FIRMWARE_NAME           "brcm/brcmfmac4330-sdio.bin"
 552 #define BCM4330_NVRAM_NAME              "brcm/brcmfmac4330-sdio.txt"
 553 #define BCM4334_FIRMWARE_NAME           "brcm/brcmfmac4334-sdio.bin"
 554 #define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
 555 #define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
 556 #define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
 557 #define BCM43362_FIRMWARE_NAME          "brcm/brcmfmac43362-sdio.bin"
 558 #define BCM43362_NVRAM_NAME             "brcm/brcmfmac43362-sdio.txt"
 559 #define BCM4339_FIRMWARE_NAME           "brcm/brcmfmac4339-sdio.bin"
 560 #define BCM4339_NVRAM_NAME              "brcm/brcmfmac4339-sdio.txt"
 561
 562 MODULE_FIRMWARE(BCM43143_FIRMWARE_NAME);
 563 MODULE_FIRMWARE(BCM43143_NVRAM_NAME);
 564 MODULE_FIRMWARE(BCM43241B0_FIRMWARE_NAME);
 565 MODULE_FIRMWARE(BCM43241B0_NVRAM_NAME);
 566 MODULE_FIRMWARE(BCM43241B4_FIRMWARE_NAME);
 567 MODULE_FIRMWARE(BCM43241B4_NVRAM_NAME);
 568 MODULE_FIRMWARE(BCM4329_FIRMWARE_NAME);
 569 MODULE_FIRMWARE(BCM4329_NVRAM_NAME);
 570 MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
 571 MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
 572 MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
 573 MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
 574 MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
 575 MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
 576 MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
 577 MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
 578 MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
 579 MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
 580
 581 struct brcmf_firmware_names {
 582         u32 chipid;
 583         u32 revmsk;
 584         const char *bin;
 585         const char *nv;
 586 };
 587
 588 enum brcmf_firmware_type {
 589         BRCMF_FIRMWARE_BIN,
 590         BRCMF_FIRMWARE_NVRAM
 591 };
 592
 593 #define BRCMF_FIRMWARE_NVRAM(name) \
 594         name ## _FIRMWARE_NAME, name ## _NVRAM_NAME
 595
 596 static const struct brcmf_firmware_names brcmf_fwname_data[] = {
 597         { BCM43143_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43143) },
 598         { BCM43241_CHIP_ID, 0x0000001F, BRCMF_FIRMWARE_NVRAM(BCM43241B0) },
 599         { BCM43241_CHIP_ID, 0xFFFFFFE0, BRCMF_FIRMWARE_NVRAM(BCM43241B4) },
 600         { BCM4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
 601         { BCM4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
 602         { BCM4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
 603         { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
 604         { BCM43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
 605         { BCM4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) }
 606 };
 607
 608
 609 static const struct firmware *brcmf_sdio_get_fw(struct brcmf_sdio *bus,
 610                                                   enum brcmf_firmware_type type)
 611 {
 612         const struct firmware *fw;
 613         const char *name;
 614         int err, i;
 615
 616         for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
 617                 if (brcmf_fwname_data[i].chipid == bus->ci->chip &&
 618                     brcmf_fwname_data[i].revmsk & BIT(bus->ci->chiprev)) {
 619                         switch (type) {
 620                         case BRCMF_FIRMWARE_BIN:
 621                                 name = brcmf_fwname_data[i].bin;
 622                                 break;
 623                         case BRCMF_FIRMWARE_NVRAM:
 624                                 name = brcmf_fwname_data[i].nv;
 625                                 break;
 626                         default:
 627                                 brcmf_err("invalid firmware type (%d)\n", type);
 628                                 return NULL;
 629                         }
 630                         goto found;
 631                 }
 632         }
 633         brcmf_err("Unknown chipid %d [%d]\n",
 634                   bus->ci->chip, bus->ci->chiprev);
 635         return NULL;
 636
 637 found:
 638         err = request_firmware(&fw, name, &bus->sdiodev->func[2]->dev);
 639         if ((err) || (!fw)) {
 640                 brcmf_err("fail to request firmware %s (%d)\n", name, err);
 641                 return NULL;
 642         }
 643
 644         return fw;
 645 }
 646
 647 static void pkt_align(struct sk_buff *p, int len, int align)
 648 {
 649         uint datalign;
 650         datalign = (unsigned long)(p->data);
 651         datalign = roundup(datalign, (align)) - datalign;
 652         if (datalign)
 653                 skb_pull(p, datalign);
 654         __skb_trim(p, len);
 655 }
 656
 657 /* To check if there's window offered */
 658 static bool data_ok(struct brcmf_sdio *bus)
 659 {
 660         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 661                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 662 }
 663
 664 /*
 665  * Reads a register in the SDIO hardware block. This block occupies a series of
 666  * adresses on the 32 bit backplane bus.
 667  */
 668 static int
 669 r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
 670 {
 671         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 672         int ret;
 673
 674         *regvar = brcmf_sdiod_regrl(bus->sdiodev,
 675                                     bus->ci->c_inf[idx].base + offset, &ret);
 676
 677         return ret;
 678 }
 679
 680 static int
 681 w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
 682 {
 683         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 684         int ret;
 685
 686         brcmf_sdiod_regwl(bus->sdiodev,
 687                           bus->ci->c_inf[idx].base + reg_offset,
 688                           regval, &ret);
 689
 690         return ret;
 691 }
 692
 693 static int
 694 brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
 695 {
 696         u8 wr_val = 0, rd_val, cmp_val, bmask;
 697         int err = 0;
 698         int try_cnt = 0;
 699
 700         brcmf_dbg(TRACE, "Enter\n");
 701
 702         wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
 703         /* 1st KSO write goes to AOS wake up core if device is asleep  */
 704         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 705                           wr_val, &err);
 706         if (err) {
 707                 brcmf_err("SDIO_AOS KSO write error: %d\n", err);
 708                 return err;
 709         }
 710
 711         if (on) {
 712                 /* device WAKEUP through KSO:
 713                  * write bit 0 & read back until
 714                  * both bits 0 (kso bit) & 1 (dev on status) are set
 715                  */
 716                 cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |
 717                           SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
 718                 bmask = cmp_val;
 719                 usleep_range(2000, 3000);
 720         } else {
 721                 /* Put device to sleep, turn off KSO */
 722                 cmp_val = 0;
 723                 /* only check for bit0, bit1(dev on status) may not
 724                  * get cleared right away
 725                  */
 726                 bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
 727         }
 728
 729         do {
 730                 /* reliable KSO bit set/clr:
 731                  * the sdiod sleep write access is synced to PMU 32khz clk
 732                  * just one write attempt may fail,
 733                  * read it back until it matches written value
 734                  */
 735                 rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 736                                            &err);
 737                 if (((rd_val & bmask) == cmp_val) && !err)
 738                         break;
 739                 brcmf_dbg(SDIO, "KSO wr/rd retry:%d (max: %d) ERR:%x\n",
 740                           try_cnt, MAX_KSO_ATTEMPTS, err);
 741                 udelay(KSO_WAIT_US);
 742                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 743                                   wr_val, &err);
 744         } while (try_cnt++ < MAX_KSO_ATTEMPTS);
 745
 746         return err;
 747 }
 748
 749 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 750
 751 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 752
 753 /* Turn backplane clock on or off */
 754 static int brcmf_sdio_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 755 {
 756         int err;
 757         u8 clkctl, clkreq, devctl;
 758         unsigned long timeout;
 759
 760         brcmf_dbg(SDIO, "Enter\n");
 761
 762         clkctl = 0;
 763
 764         if (bus->sr_enabled) {
 765                 bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
 766                 return 0;
 767         }
 768
 769         if (on) {
 770                 /* Request HT Avail */
 771                 clkreq =
 772                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 773
 774                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 775                                   clkreq, &err);
 776                 if (err) {
 777                         brcmf_err("HT Avail request error: %d\n", err);
 778                         return -EBADE;
 779                 }
 780
 781                 /* Check current status */
 782                 clkctl = brcmf_sdiod_regrb(bus->sdiodev,
 783                                            SBSDIO_FUNC1_CHIPCLKCSR, &err);
 784                 if (err) {
 785                         brcmf_err("HT Avail read error: %d\n", err);
 786                         return -EBADE;
 787                 }
 788
 789                 /* Go to pending and await interrupt if appropriate */
 790                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 791                         /* Allow only clock-available interrupt */
 792                         devctl = brcmf_sdiod_regrb(bus->sdiodev,
 793                                                    SBSDIO_DEVICE_CTL, &err);
 794                         if (err) {
 795                                 brcmf_err("Devctl error setting CA: %d\n",
 796                                           err);
 797                                 return -EBADE;
 798                         }
 799
 800                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 801                         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 802                                           devctl, &err);
 803                         brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
 804                         bus->clkstate = CLK_PENDING;
 805
 806                         return 0;
 807                 } else if (bus->clkstate == CLK_PENDING) {
 808                         /* Cancel CA-only interrupt filter */
 809                         devctl = brcmf_sdiod_regrb(bus->sdiodev,
 810                                                    SBSDIO_DEVICE_CTL, &err);
 811                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 812                         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 813                                           devctl, &err);
 814                 }
 815
 816                 /* Otherwise, wait here (polling) for HT Avail */
 817                 timeout = jiffies +
 818                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 819                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 820                         clkctl = brcmf_sdiod_regrb(bus->sdiodev,
 821                                                    SBSDIO_FUNC1_CHIPCLKCSR,
 822                                                    &err);
 823                         if (time_after(jiffies, timeout))
 824                                 break;
 825                         else
 826                                 usleep_range(5000, 10000);
 827                 }
 828                 if (err) {
 829                         brcmf_err("HT Avail request error: %d\n", err);
 830                         return -EBADE;
 831                 }
 832                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 833                         brcmf_err("HT Avail timeout (%d): clkctl 0x%02x\n",
 834                                   PMU_MAX_TRANSITION_DLY, clkctl);
 835                         return -EBADE;
 836                 }
 837
 838                 /* Mark clock available */
 839                 bus->clkstate = CLK_AVAIL;
 840                 brcmf_dbg(SDIO, "CLKCTL: turned ON\n");
 841
 842 #if defined(DEBUG)
 843                 if (!bus->alp_only) {
 844                         if (SBSDIO_ALPONLY(clkctl))
 845                                 brcmf_err("HT Clock should be on\n");
 846                 }
 847 #endif                          /* defined (DEBUG) */
 848
 849                 bus->activity = true;
 850         } else {
 851                 clkreq = 0;
 852
 853                 if (bus->clkstate == CLK_PENDING) {
 854                         /* Cancel CA-only interrupt filter */
 855                         devctl = brcmf_sdiod_regrb(bus->sdiodev,
 856                                                    SBSDIO_DEVICE_CTL, &err);
 857                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 858                         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 859                                           devctl, &err);
 860                 }
 861
 862                 bus->clkstate = CLK_SDONLY;
 863                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 864                                   clkreq, &err);
 865                 brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
 866                 if (err) {
 867                         brcmf_err("Failed access turning clock off: %d\n",
 868                                   err);
 869                         return -EBADE;
 870                 }
 871         }
 872         return 0;
 873 }
 874
 875 /* Change idle/active SD state */
 876 static int brcmf_sdio_sdclk(struct brcmf_sdio *bus, bool on)
 877 {
 878         brcmf_dbg(SDIO, "Enter\n");
 879
 880         if (on)
 881                 bus->clkstate = CLK_SDONLY;
 882         else
 883                 bus->clkstate = CLK_NONE;
 884
 885         return 0;
 886 }
 887
 888 /* Transition SD and backplane clock readiness */
 889 static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 890 {
 891 #ifdef DEBUG
 892         uint oldstate = bus->clkstate;
 893 #endif                          /* DEBUG */
 894
 895         brcmf_dbg(SDIO, "Enter\n");
 896
 897         /* Early exit if we're already there */
 898         if (bus->clkstate == target) {
 899                 if (target == CLK_AVAIL) {
 900                         brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
 901                         bus->activity = true;
 902                 }
 903                 return 0;
 904         }
 905
 906         switch (target) {
 907         case CLK_AVAIL:
 908                 /* Make sure SD clock is available */
 909                 if (bus->clkstate == CLK_NONE)
 910                         brcmf_sdio_sdclk(bus, true);
 911                 /* Now request HT Avail on the backplane */
 912                 brcmf_sdio_htclk(bus, true, pendok);
 913                 brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
 914                 bus->activity = true;
 915                 break;
 916
 917         case CLK_SDONLY:
 918                 /* Remove HT request, or bring up SD clock */
 919                 if (bus->clkstate == CLK_NONE)
 920                         brcmf_sdio_sdclk(bus, true);
 921                 else if (bus->clkstate == CLK_AVAIL)
 922                         brcmf_sdio_htclk(bus, false, false);
 923                 else
 924                         brcmf_err("request for %d -> %d\n",
 925                                   bus->clkstate, target);
 926                 brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
 927                 break;
 928
 929         case CLK_NONE:
 930                 /* Make sure to remove HT request */
 931                 if (bus->clkstate == CLK_AVAIL)
 932                         brcmf_sdio_htclk(bus, false, false);
 933                 /* Now remove the SD clock */
 934                 brcmf_sdio_sdclk(bus, false);
 935                 brcmf_sdio_wd_timer(bus, 0);
 936                 break;
 937         }
 938 #ifdef DEBUG
 939         brcmf_dbg(SDIO, "%d -> %d\n", oldstate, bus->clkstate);
 940 #endif                          /* DEBUG */
 941
 942         return 0;
 943 }
 944
 945 static int
 946 brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 947 {
 948         int err = 0;
 949         brcmf_dbg(TRACE, "Enter\n");
 950         brcmf_dbg(SDIO, "request %s currently %s\n",
 951                   (sleep ? "SLEEP" : "WAKE"),
 952                   (bus->sleeping ? "SLEEP" : "WAKE"));
 953
 954         /* If SR is enabled control bus state with KSO */
 955         if (bus->sr_enabled) {
 956                 /* Done if we're already in the requested state */
 957                 if (sleep == bus->sleeping)
 958                         goto end;
 959
 960                 /* Going to sleep */
 961                 if (sleep) {
 962                         /* Don't sleep if something is pending */
 963                         if (atomic_read(&bus->intstatus) ||
 964                             atomic_read(&bus->ipend) > 0 ||
 965                             (!atomic_read(&bus->fcstate) &&
 966                             brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
 967                             data_ok(bus)))
 968                                  return -EBUSY;
 969                         err = brcmf_sdio_kso_control(bus, false);
 970                         /* disable watchdog */
 971                         if (!err)
 972                                 brcmf_sdio_wd_timer(bus, 0);
 973                 } else {
 974                         bus->idlecount = 0;
 975                         err = brcmf_sdio_kso_control(bus, true);
 976                 }
 977                 if (!err) {
 978                         /* Change state */
 979                         bus->sleeping = sleep;
 980                         brcmf_dbg(SDIO, "new state %s\n",
 981                                   (sleep ? "SLEEP" : "WAKE"));
 982                 } else {
 983                         brcmf_err("error while changing bus sleep state %d\n",
 984                                   err);
 985                         return err;
 986                 }
 987         }
 988
 989 end:
 990         /* control clocks */
 991         if (sleep) {
 992                 if (!bus->sr_enabled)
 993                         brcmf_sdio_clkctl(bus, CLK_NONE, pendok);
 994         } else {
 995                 brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
 996         }
 997
 998         return err;
 999
1000 }
1001
1002 #ifdef DEBUG
1003 static inline bool brcmf_sdio_valid_shared_address(u32 addr)
1004 {
1005         return !(addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff));
1006 }
1007
1008 static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
1009                                  struct sdpcm_shared *sh)
1010 {
1011         u32 addr;
1012         int rv;
1013         u32 shaddr = 0;
1014         struct sdpcm_shared_le sh_le;
1015         __le32 addr_le;
1016
1017         shaddr = bus->ci->rambase + bus->ramsize - 4;
1018
1019         /*
1020          * Read last word in socram to determine
1021          * address of sdpcm_shared structure
1022          */
1023         sdio_claim_host(bus->sdiodev->func[1]);
1024         brcmf_sdio_bus_sleep(bus, false, false);
1025         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
1026         sdio_release_host(bus->sdiodev->func[1]);
1027         if (rv < 0)
1028                 return rv;
1029
1030         addr = le32_to_cpu(addr_le);
1031
1032         brcmf_dbg(SDIO, "sdpcm_shared address 0x%08X\n", addr);
1033
1034         /*
1035          * Check if addr is valid.
1036          * NVRAM length at the end of memory should have been overwritten.
1037          */
1038         if (!brcmf_sdio_valid_shared_address(addr)) {
1039                         brcmf_err("invalid sdpcm_shared address 0x%08X\n",
1040                                   addr);
1041                         return -EINVAL;
1042         }
1043
1044         /* Read hndrte_shared structure */
1045         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
1046                                sizeof(struct sdpcm_shared_le));
1047         if (rv < 0)
1048                 return rv;
1049
1050         /* Endianness */
1051         sh->flags = le32_to_cpu(sh_le.flags);
1052         sh->trap_addr = le32_to_cpu(sh_le.trap_addr);
1053         sh->assert_exp_addr = le32_to_cpu(sh_le.assert_exp_addr);
1054         sh->assert_file_addr = le32_to_cpu(sh_le.assert_file_addr);
1055         sh->assert_line = le32_to_cpu(sh_le.assert_line);
1056         sh->console_addr = le32_to_cpu(sh_le.console_addr);
1057         sh->msgtrace_addr = le32_to_cpu(sh_le.msgtrace_addr);
1058
1059         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) > SDPCM_SHARED_VERSION) {
1060                 brcmf_err("sdpcm shared version unsupported: dhd %d dongle %d\n",
1061                           SDPCM_SHARED_VERSION,
1062                           sh->flags & SDPCM_SHARED_VERSION_MASK);
1063                 return -EPROTO;
1064         }
1065
1066         return 0;
1067 }
1068
1069 static void brcmf_sdio_get_console_addr(struct brcmf_sdio *bus)
1070 {
1071         struct sdpcm_shared sh;
1072
1073         if (brcmf_sdio_readshared(bus, &sh) == 0)
1074                 bus->console_addr = sh.console_addr;
1075 }
1076 #else
1077 static void brcmf_sdio_get_console_addr(struct brcmf_sdio *bus)
1078 {
1079 }
1080 #endif /* DEBUG */
1081
1082 static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
1083 {
1084         u32 intstatus = 0;
1085         u32 hmb_data;
1086         u8 fcbits;
1087         int ret;
1088
1089         brcmf_dbg(SDIO, "Enter\n");
1090
1091         /* Read mailbox data and ack that we did so */
1092         ret = r_sdreg32(bus, &hmb_data,
1093                         offsetof(struct sdpcmd_regs, tohostmailboxdata));
1094
1095         if (ret == 0)
1096                 w_sdreg32(bus, SMB_INT_ACK,
1097                           offsetof(struct sdpcmd_regs, tosbmailbox));
1098         bus->sdcnt.f1regdata += 2;
1099
1100         /* Dongle recomposed rx frames, accept them again */
1101         if (hmb_data & HMB_DATA_NAKHANDLED) {
1102                 brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
1103                           bus->rx_seq);
1104                 if (!bus->rxskip)
1105                         brcmf_err("unexpected NAKHANDLED!\n");
1106
1107                 bus->rxskip = false;
1108                 intstatus |= I_HMB_FRAME_IND;
1109         }
1110
1111         /*
1112          * DEVREADY does not occur with gSPI.
1113          */
1114         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
1115                 bus->sdpcm_ver =
1116                     (hmb_data & HMB_DATA_VERSION_MASK) >>
1117                     HMB_DATA_VERSION_SHIFT;
1118                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
1119                         brcmf_err("Version mismatch, dongle reports %d, "
1120                                   "expecting %d\n",
1121                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
1122                 else
1123                         brcmf_dbg(SDIO, "Dongle ready, protocol version %d\n",
1124                                   bus->sdpcm_ver);
1125
1126                 /*
1127                  * Retrieve console state address now that firmware should have
1128                  * updated it.
1129                  */
1130                 brcmf_sdio_get_console_addr(bus);
1131         }
1132
1133         /*
1134          * Flow Control has been moved into the RX headers and this out of band
1135          * method isn't used any more.
1136          * remaining backward compatible with older dongles.
1137          */
1138         if (hmb_data & HMB_DATA_FC) {
1139                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
1140                                                         HMB_DATA_FCDATA_SHIFT;
1141
1142                 if (fcbits & ~bus->flowcontrol)
1143                         bus->sdcnt.fc_xoff++;
1144
1145                 if (bus->flowcontrol & ~fcbits)
1146                         bus->sdcnt.fc_xon++;
1147
1148                 bus->sdcnt.fc_rcvd++;
1149                 bus->flowcontrol = fcbits;
1150         }
1151
1152         /* Shouldn't be any others */
1153         if (hmb_data & ~(HMB_DATA_DEVREADY |
1154                          HMB_DATA_NAKHANDLED |
1155                          HMB_DATA_FC |
1156                          HMB_DATA_FWREADY |
1157                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1158                 brcmf_err("Unknown mailbox data content: 0x%02x\n",
1159                           hmb_data);
1160
1161         return intstatus;
1162 }
1163
1164 static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
1165 {
1166         uint retries = 0;
1167         u16 lastrbc;
1168         u8 hi, lo;
1169         int err;
1170
1171         brcmf_err("%sterminate frame%s\n",
1172                   abort ? "abort command, " : "",
1173                   rtx ? ", send NAK" : "");
1174
1175         if (abort)
1176                 brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
1177
1178         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
1179                           SFC_RF_TERM, &err);
1180         bus->sdcnt.f1regdata++;
1181
1182         /* Wait until the packet has been flushed (device/FIFO stable) */
1183         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1184                 hi = brcmf_sdiod_regrb(bus->sdiodev,
1185                                        SBSDIO_FUNC1_RFRAMEBCHI, &err);
1186                 lo = brcmf_sdiod_regrb(bus->sdiodev,
1187                                        SBSDIO_FUNC1_RFRAMEBCLO, &err);
1188                 bus->sdcnt.f1regdata += 2;
1189
1190                 if ((hi == 0) && (lo == 0))
1191                         break;
1192
1193                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1194                         brcmf_err("count growing: last 0x%04x now 0x%04x\n",
1195                                   lastrbc, (hi << 8) + lo);
1196                 }
1197                 lastrbc = (hi << 8) + lo;
1198         }
1199
1200         if (!retries)
1201                 brcmf_err("count never zeroed: last 0x%04x\n", lastrbc);
1202         else
1203                 brcmf_dbg(SDIO, "flush took %d iterations\n", 0xffff - retries);
1204
1205         if (rtx) {
1206                 bus->sdcnt.rxrtx++;
1207                 err = w_sdreg32(bus, SMB_NAK,
1208                                 offsetof(struct sdpcmd_regs, tosbmailbox));
1209
1210                 bus->sdcnt.f1regdata++;
1211                 if (err == 0)
1212                         bus->rxskip = true;
1213         }
1214
1215         /* Clear partial in any case */
1216         bus->cur_read.len = 0;
1217 }
1218
1219 /* return total length of buffer chain */
1220 static uint brcmf_sdio_glom_len(struct brcmf_sdio *bus)
1221 {
1222         struct sk_buff *p;
1223         uint total;
1224
1225         total = 0;
1226         skb_queue_walk(&bus->glom, p)
1227                 total += p->len;
1228         return total;
1229 }
1230
1231 static void brcmf_sdio_free_glom(struct brcmf_sdio *bus)
1232 {
1233         struct sk_buff *cur, *next;
1234
1235         skb_queue_walk_safe(&bus->glom, cur, next) {
1236                 skb_unlink(cur, &bus->glom);
1237                 brcmu_pkt_buf_free_skb(cur);
1238         }
1239 }
1240
1241 /**
1242  * brcmfmac sdio bus specific header
1243  * This is the lowest layer header wrapped on the packets transmitted between
1244  * host and WiFi dongle which contains information needed for SDIO core and
1245  * firmware
1246  *
1247  * It consists of 3 parts: hardware header, hardware extension header and
1248  * software header
1249  * hardware header (frame tag) - 4 bytes
1250  * Byte 0~1: Frame length
1251  * Byte 2~3: Checksum, bit-wise inverse of frame length
1252  * hardware extension header - 8 bytes
1253  * Tx glom mode only, N/A for Rx or normal Tx
1254  * Byte 0~1: Packet length excluding hw frame tag
1255  * Byte 2: Reserved
1256  * Byte 3: Frame flags, bit 0: last frame indication
1257  * Byte 4~5: Reserved
1258  * Byte 6~7: Tail padding length
1259  * software header - 8 bytes
1260  * Byte 0: Rx/Tx sequence number
1261  * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
1262  * Byte 2: Length of next data frame, reserved for Tx
1263  * Byte 3: Data offset
1264  * Byte 4: Flow control bits, reserved for Tx
1265  * Byte 5: Maximum Sequence number allowed by firmware for Tx, N/A for Tx packet
1266  * Byte 6~7: Reserved
1267  */
1268 #define SDPCM_HWHDR_LEN                 4
1269 #define SDPCM_HWEXT_LEN                 8
1270 #define SDPCM_SWHDR_LEN                 8
1271 #define SDPCM_HDRLEN                    (SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN)
1272 /* software header */
1273 #define SDPCM_SEQ_MASK                  0x000000ff
1274 #define SDPCM_SEQ_WRAP                  256
1275 #define SDPCM_CHANNEL_MASK              0x00000f00
1276 #define SDPCM_CHANNEL_SHIFT             8
1277 #define SDPCM_CONTROL_CHANNEL           0       /* Control */
1278 #define SDPCM_EVENT_CHANNEL             1       /* Asyc Event Indication */
1279 #define SDPCM_DATA_CHANNEL              2       /* Data Xmit/Recv */
1280 #define SDPCM_GLOM_CHANNEL              3       /* Coalesced packets */
1281 #define SDPCM_TEST_CHANNEL              15      /* Test/debug packets */
1282 #define SDPCM_GLOMDESC(p)               (((u8 *)p)[1] & 0x80)
1283 #define SDPCM_NEXTLEN_MASK              0x00ff0000
1284 #define SDPCM_NEXTLEN_SHIFT             16
1285 #define SDPCM_DOFFSET_MASK              0xff000000
1286 #define SDPCM_DOFFSET_SHIFT             24
1287 #define SDPCM_FCMASK_MASK               0x000000ff
1288 #define SDPCM_WINDOW_MASK               0x0000ff00
1289 #define SDPCM_WINDOW_SHIFT              8
1290
1291 static inline u8 brcmf_sdio_getdatoffset(u8 *swheader)
1292 {
1293         u32 hdrvalue;
1294         hdrvalue = *(u32 *)swheader;
1295         return (u8)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT);
1296 }
1297
1298 static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
1299                               struct brcmf_sdio_hdrinfo *rd,
1300                               enum brcmf_sdio_frmtype type)
1301 {
1302         u16 len, checksum;
1303         u8 rx_seq, fc, tx_seq_max;
1304         u32 swheader;
1305
1306         trace_brcmf_sdpcm_hdr(SDPCM_RX, header);
1307
1308         /* hw header */
1309         len = get_unaligned_le16(header);
1310         checksum = get_unaligned_le16(header + sizeof(u16));
1311         /* All zero means no more to read */
1312         if (!(len | checksum)) {
1313                 bus->rxpending = false;
1314                 return -ENODATA;
1315         }
1316         if ((u16)(~(len ^ checksum))) {
1317                 brcmf_err("HW header checksum error\n");
1318                 bus->sdcnt.rx_badhdr++;
1319                 brcmf_sdio_rxfail(bus, false, false);
1320                 return -EIO;
1321         }
1322         if (len < SDPCM_HDRLEN) {
1323                 brcmf_err("HW header length error\n");
1324                 return -EPROTO;
1325         }
1326         if (type == BRCMF_SDIO_FT_SUPER &&
1327             (roundup(len, bus->blocksize) != rd->len)) {
1328                 brcmf_err("HW superframe header length error\n");
1329                 return -EPROTO;
1330         }
1331         if (type == BRCMF_SDIO_FT_SUB && len > rd->len) {
1332                 brcmf_err("HW subframe header length error\n");
1333                 return -EPROTO;
1334         }
1335         rd->len = len;
1336
1337         /* software header */
1338         header += SDPCM_HWHDR_LEN;
1339         swheader = le32_to_cpu(*(__le32 *)header);
1340         if (type == BRCMF_SDIO_FT_SUPER && SDPCM_GLOMDESC(header)) {
1341                 brcmf_err("Glom descriptor found in superframe head\n");
1342                 rd->len = 0;
1343                 return -EINVAL;
1344         }
1345         rx_seq = (u8)(swheader & SDPCM_SEQ_MASK);
1346         rd->channel = (swheader & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT;
1347         if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
1348             type != BRCMF_SDIO_FT_SUPER) {
1349                 brcmf_err("HW header length too long\n");
1350                 bus->sdcnt.rx_toolong++;
1351                 brcmf_sdio_rxfail(bus, false, false);
1352                 rd->len = 0;
1353                 return -EPROTO;
1354         }
1355         if (type == BRCMF_SDIO_FT_SUPER && rd->channel != SDPCM_GLOM_CHANNEL) {
1356                 brcmf_err("Wrong channel for superframe\n");
1357                 rd->len = 0;
1358                 return -EINVAL;
1359         }
1360         if (type == BRCMF_SDIO_FT_SUB && rd->channel != SDPCM_DATA_CHANNEL &&
1361             rd->channel != SDPCM_EVENT_CHANNEL) {
1362                 brcmf_err("Wrong channel for subframe\n");
1363                 rd->len = 0;
1364                 return -EINVAL;
1365         }
1366         rd->dat_offset = brcmf_sdio_getdatoffset(header);
1367         if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
1368                 brcmf_err("seq %d: bad data offset\n", rx_seq);
1369                 bus->sdcnt.rx_badhdr++;
1370                 brcmf_sdio_rxfail(bus, false, false);
1371                 rd->len = 0;
1372                 return -ENXIO;
1373         }
1374         if (rd->seq_num != rx_seq) {
1375                 brcmf_err("seq %d: sequence number error, expect %d\n",
1376                           rx_seq, rd->seq_num);
1377                 bus->sdcnt.rx_badseq++;
1378                 rd->seq_num = rx_seq;
1379         }
1380         /* no need to check the reset for subframe */
1381         if (type == BRCMF_SDIO_FT_SUB)
1382                 return 0;
1383         rd->len_nxtfrm = (swheader & SDPCM_NEXTLEN_MASK) >> SDPCM_NEXTLEN_SHIFT;
1384         if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
1385                 /* only warm for NON glom packet */
1386                 if (rd->channel != SDPCM_GLOM_CHANNEL)
1387                         brcmf_err("seq %d: next length error\n", rx_seq);
1388                 rd->len_nxtfrm = 0;
1389         }
1390         swheader = le32_to_cpu(*(__le32 *)(header + 4));
1391         fc = swheader & SDPCM_FCMASK_MASK;
1392         if (bus->flowcontrol != fc) {
1393                 if (~bus->flowcontrol & fc)
1394                         bus->sdcnt.fc_xoff++;
1395                 if (bus->flowcontrol & ~fc)
1396                         bus->sdcnt.fc_xon++;
1397                 bus->sdcnt.fc_rcvd++;
1398                 bus->flowcontrol = fc;
1399         }
1400         tx_seq_max = (swheader & SDPCM_WINDOW_MASK) >> SDPCM_WINDOW_SHIFT;
1401         if ((u8)(tx_seq_max - bus->tx_seq) > 0x40) {
1402                 brcmf_err("seq %d: max tx seq number error\n", rx_seq);
1403                 tx_seq_max = bus->tx_seq + 2;
1404         }
1405         bus->tx_max = tx_seq_max;
1406
1407         return 0;
1408 }
1409
1410 static inline void brcmf_sdio_update_hwhdr(u8 *header, u16 frm_length)
1411 {
1412         *(__le16 *)header = cpu_to_le16(frm_length);
1413         *(((__le16 *)header) + 1) = cpu_to_le16(~frm_length);
1414 }
1415
1416 static void brcmf_sdio_hdpack(struct brcmf_sdio *bus, u8 *header,
1417                               struct brcmf_sdio_hdrinfo *hd_info)
1418 {
1419         u32 hdrval;
1420         u8 hdr_offset;
1421
1422         brcmf_sdio_update_hwhdr(header, hd_info->len);
1423         hdr_offset = SDPCM_HWHDR_LEN;
1424
1425         if (bus->txglom) {
1426                 hdrval = (hd_info->len - hdr_offset) | (hd_info->lastfrm << 24);
1427                 *((__le32 *)(header + hdr_offset)) = cpu_to_le32(hdrval);
1428                 hdrval = (u16)hd_info->tail_pad << 16;
1429                 *(((__le32 *)(header + hdr_offset)) + 1) = cpu_to_le32(hdrval);
1430                 hdr_offset += SDPCM_HWEXT_LEN;
1431         }
1432
1433         hdrval = hd_info->seq_num;
1434         hdrval |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) &
1435                   SDPCM_CHANNEL_MASK;
1436         hdrval |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) &
1437                   SDPCM_DOFFSET_MASK;
1438         *((__le32 *)(header + hdr_offset)) = cpu_to_le32(hdrval);
1439         *(((__le32 *)(header + hdr_offset)) + 1) = 0;
1440         trace_brcmf_sdpcm_hdr(SDPCM_TX + !!(bus->txglom), header);
1441 }
1442
1443 static u8 brcmf_sdio_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1444 {
1445         u16 dlen, totlen;
1446         u8 *dptr, num = 0;
1447         u16 sublen;
1448         struct sk_buff *pfirst, *pnext;
1449
1450         int errcode;
1451         u8 doff, sfdoff;
1452
1453         struct brcmf_sdio_hdrinfo rd_new;
1454
1455         /* If packets, issue read(s) and send up packet chain */
1456         /* Return sequence numbers consumed? */
1457
1458         brcmf_dbg(SDIO, "start: glomd %p glom %p\n",
1459                   bus->glomd, skb_peek(&bus->glom));
1460
1461         /* If there's a descriptor, generate the packet chain */
1462         if (bus->glomd) {
1463                 pfirst = pnext = NULL;
1464                 dlen = (u16) (bus->glomd->len);
1465                 dptr = bus->glomd->data;
1466                 if (!dlen || (dlen & 1)) {
1467                         brcmf_err("bad glomd len(%d), ignore descriptor\n",
1468                                   dlen);
1469                         dlen = 0;
1470                 }
1471
1472                 for (totlen = num = 0; dlen; num++) {
1473                         /* Get (and move past) next length */
1474                         sublen = get_unaligned_le16(dptr);
1475                         dlen -= sizeof(u16);
1476                         dptr += sizeof(u16);
1477                         if ((sublen < SDPCM_HDRLEN) ||
1478                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1479                                 brcmf_err("descriptor len %d bad: %d\n",
1480                                           num, sublen);
1481                                 pnext = NULL;
1482                                 break;
1483                         }
1484                         if (sublen % bus->sgentry_align) {
1485                                 brcmf_err("sublen %d not multiple of %d\n",
1486                                           sublen, bus->sgentry_align);
1487                         }
1488                         totlen += sublen;
1489
1490                         /* For last frame, adjust read len so total
1491                                  is a block multiple */
1492                         if (!dlen) {
1493                                 sublen +=
1494                                     (roundup(totlen, bus->blocksize) - totlen);
1495                                 totlen = roundup(totlen, bus->blocksize);
1496                         }
1497
1498                         /* Allocate/chain packet for next subframe */
1499                         pnext = brcmu_pkt_buf_get_skb(sublen + bus->sgentry_align);
1500                         if (pnext == NULL) {
1501                                 brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
1502                                           num, sublen);
1503                                 break;
1504                         }
1505                         skb_queue_tail(&bus->glom, pnext);
1506
1507                         /* Adhere to start alignment requirements */
1508                         pkt_align(pnext, sublen, bus->sgentry_align);
1509                 }
1510
1511                 /* If all allocations succeeded, save packet chain
1512                          in bus structure */
1513                 if (pnext) {
1514                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1515                                   totlen, num);
1516                         if (BRCMF_GLOM_ON() && bus->cur_read.len &&
1517                             totlen != bus->cur_read.len) {
1518                                 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1519                                           bus->cur_read.len, totlen, rxseq);
1520                         }
1521                         pfirst = pnext = NULL;
1522                 } else {
1523                         brcmf_sdio_free_glom(bus);
1524                         num = 0;
1525                 }
1526
1527                 /* Done with descriptor packet */
1528                 brcmu_pkt_buf_free_skb(bus->glomd);
1529                 bus->glomd = NULL;
1530                 bus->cur_read.len = 0;
1531         }
1532
1533         /* Ok -- either we just generated a packet chain,
1534                  or had one from before */
1535         if (!skb_queue_empty(&bus->glom)) {
1536                 if (BRCMF_GLOM_ON()) {
1537                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1538                         skb_queue_walk(&bus->glom, pnext) {
1539                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1540                                           pnext, (u8 *) (pnext->data),
1541                                           pnext->len, pnext->len);
1542                         }
1543                 }
1544
1545                 pfirst = skb_peek(&bus->glom);
1546                 dlen = (u16) brcmf_sdio_glom_len(bus);
1547
1548                 /* Do an SDIO read for the superframe.  Configurable iovar to
1549                  * read directly into the chained packet, or allocate a large
1550                  * packet and and copy into the chain.
1551                  */
1552                 sdio_claim_host(bus->sdiodev->func[1]);
1553                 errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
1554                                                  &bus->glom, dlen);
1555                 sdio_release_host(bus->sdiodev->func[1]);
1556                 bus->sdcnt.f2rxdata++;
1557
1558                 /* On failure, kill the superframe, allow a couple retries */
1559                 if (errcode < 0) {
1560                         brcmf_err("glom read of %d bytes failed: %d\n",
1561                                   dlen, errcode);
1562
1563                         sdio_claim_host(bus->sdiodev->func[1]);
1564                         if (bus->glomerr++ < 3) {
1565                                 brcmf_sdio_rxfail(bus, true, true);
1566                         } else {
1567                                 bus->glomerr = 0;
1568                                 brcmf_sdio_rxfail(bus, true, false);
1569                                 bus->sdcnt.rxglomfail++;
1570                                 brcmf_sdio_free_glom(bus);
1571                         }
1572                         sdio_release_host(bus->sdiodev->func[1]);
1573                         return 0;
1574                 }
1575
1576                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1577                                    pfirst->data, min_t(int, pfirst->len, 48),
1578                                    "SUPERFRAME:\n");
1579
1580                 rd_new.seq_num = rxseq;
1581                 rd_new.len = dlen;
1582                 sdio_claim_host(bus->sdiodev->func[1]);
1583                 errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
1584                                              BRCMF_SDIO_FT_SUPER);
1585                 sdio_release_host(bus->sdiodev->func[1]);
1586                 bus->cur_read.len = rd_new.len_nxtfrm << 4;
1587
1588                 /* Remove superframe header, remember offset */
1589                 skb_pull(pfirst, rd_new.dat_offset);
1590                 sfdoff = rd_new.dat_offset;
1591                 num = 0;
1592
1593                 /* Validate all the subframe headers */
1594                 skb_queue_walk(&bus->glom, pnext) {
1595                         /* leave when invalid subframe is found */
1596                         if (errcode)
1597                                 break;
1598
1599                         rd_new.len = pnext->len;
1600                         rd_new.seq_num = rxseq++;
1601                         sdio_claim_host(bus->sdiodev->func[1]);
1602                         errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
1603                                                      BRCMF_SDIO_FT_SUB);
1604                         sdio_release_host(bus->sdiodev->func[1]);
1605                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1606                                            pnext->data, 32, "subframe:\n");
1607
1608                         num++;
1609                 }
1610
1611                 if (errcode) {
1612                         /* Terminate frame on error, request
1613                                  a couple retries */
1614                         sdio_claim_host(bus->sdiodev->func[1]);
1615                         if (bus->glomerr++ < 3) {
1616                                 /* Restore superframe header space */
1617                                 skb_push(pfirst, sfdoff);
1618                                 brcmf_sdio_rxfail(bus, true, true);
1619                         } else {
1620                                 bus->glomerr = 0;
1621                                 brcmf_sdio_rxfail(bus, true, false);
1622                                 bus->sdcnt.rxglomfail++;
1623                                 brcmf_sdio_free_glom(bus);
1624                         }
1625                         sdio_release_host(bus->sdiodev->func[1]);
1626                         bus->cur_read.len = 0;
1627                         return 0;
1628                 }
1629
1630                 /* Basic SD framing looks ok - process each packet (header) */
1631
1632                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1633                         dptr = (u8 *) (pfirst->data);
1634                         sublen = get_unaligned_le16(dptr);
1635                         doff = brcmf_sdio_getdatoffset(&dptr[SDPCM_HWHDR_LEN]);
1636
1637                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1638                                            dptr, pfirst->len,
1639                                            "Rx Subframe Data:\n");
1640
1641                         __skb_trim(pfirst, sublen);
1642                         skb_pull(pfirst, doff);
1643
1644                         if (pfirst->len == 0) {
1645                                 skb_unlink(pfirst, &bus->glom);
1646                                 brcmu_pkt_buf_free_skb(pfirst);
1647                                 continue;
1648                         }
1649
1650                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1651                                            pfirst->data,
1652                                            min_t(int, pfirst->len, 32),
1653                                            "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1654                                            bus->glom.qlen, pfirst, pfirst->data,
1655                                            pfirst->len, pfirst->next,
1656                                            pfirst->prev);
1657                         skb_unlink(pfirst, &bus->glom);
1658                         brcmf_rx_frame(bus->sdiodev->dev, pfirst);
1659                         bus->sdcnt.rxglompkts++;
1660                 }
1661
1662                 bus->sdcnt.rxglomframes++;
1663         }
1664         return num;
1665 }
1666
1667 static int brcmf_sdio_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1668                                      bool *pending)
1669 {
1670         DECLARE_WAITQUEUE(wait, current);
1671         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1672
1673         /* Wait until control frame is available */
1674         add_wait_queue(&bus->dcmd_resp_wait, &wait);
1675         set_current_state(TASK_INTERRUPTIBLE);
1676
1677         while (!(*condition) && (!signal_pending(current) && timeout))
1678                 timeout = schedule_timeout(timeout);
1679
1680         if (signal_pending(current))
1681                 *pending = true;
1682
1683         set_current_state(TASK_RUNNING);
1684         remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1685
1686         return timeout;
1687 }
1688
1689 static int brcmf_sdio_dcmd_resp_wake(struct brcmf_sdio *bus)
1690 {
1691         if (waitqueue_active(&bus->dcmd_resp_wait))
1692                 wake_up_interruptible(&bus->dcmd_resp_wait);
1693
1694         return 0;
1695 }
1696 static void
1697 brcmf_sdio_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1698 {
1699         uint rdlen, pad;
1700         u8 *buf = NULL, *rbuf;
1701         int sdret;
1702
1703         brcmf_dbg(TRACE, "Enter\n");
1704
1705         if (bus->rxblen)
1706                 buf = vzalloc(bus->rxblen);
1707         if (!buf)
1708                 goto done;
1709
1710         rbuf = bus->rxbuf;
1711         pad = ((unsigned long)rbuf % bus->head_align);
1712         if (pad)
1713                 rbuf += (bus->head_align - pad);
1714
1715         /* Copy the already-read portion over */
1716         memcpy(buf, hdr, BRCMF_FIRSTREAD);
1717         if (len <= BRCMF_FIRSTREAD)
1718                 goto gotpkt;
1719
1720         /* Raise rdlen to next SDIO block to avoid tail command */
1721         rdlen = len - BRCMF_FIRSTREAD;
1722         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1723                 pad = bus->blocksize - (rdlen % bus->blocksize);
1724                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1725                     ((len + pad) < bus->sdiodev->bus_if->maxctl))
1726                         rdlen += pad;
1727         } else if (rdlen % bus->head_align) {
1728                 rdlen += bus->head_align - (rdlen % bus->head_align);
1729         }
1730
1731         /* Drop if the read is too big or it exceeds our maximum */
1732         if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
1733                 brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
1734                           rdlen, bus->sdiodev->bus_if->maxctl);
1735                 brcmf_sdio_rxfail(bus, false, false);
1736                 goto done;
1737         }
1738
1739         if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
1740                 brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1741                           len, len - doff, bus->sdiodev->bus_if->maxctl);
1742                 bus->sdcnt.rx_toolong++;
1743                 brcmf_sdio_rxfail(bus, false, false);
1744                 goto done;
1745         }
1746
1747         /* Read remain of frame body */
1748         sdret = brcmf_sdiod_recv_buf(bus->sdiodev, rbuf, rdlen);
1749         bus->sdcnt.f2rxdata++;
1750
1751         /* Control frame failures need retransmission */
1752         if (sdret < 0) {
1753                 brcmf_err("read %d control bytes failed: %d\n",
1754                           rdlen, sdret);
1755                 bus->sdcnt.rxc_errors++;
1756                 brcmf_sdio_rxfail(bus, true, true);
1757                 goto done;
1758         } else
1759                 memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
1760
1761 gotpkt:
1762
1763         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
1764                            buf, len, "RxCtrl:\n");
1765
1766         /* Point to valid data and indicate its length */
1767         spin_lock_bh(&bus->rxctl_lock);
1768         if (bus->rxctl) {
1769                 brcmf_err("last control frame is being processed.\n");
1770                 spin_unlock_bh(&bus->rxctl_lock);
1771                 vfree(buf);
1772                 goto done;
1773         }
1774         bus->rxctl = buf + doff;
1775         bus->rxctl_orig = buf;
1776         bus->rxlen = len - doff;
1777         spin_unlock_bh(&bus->rxctl_lock);
1778
1779 done:
1780         /* Awake any waiters */
1781         brcmf_sdio_dcmd_resp_wake(bus);
1782 }
1783
1784 /* Pad read to blocksize for efficiency */
1785 static void brcmf_sdio_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1786 {
1787         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1788                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1789                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1790                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1791                         *rdlen += *pad;
1792         } else if (*rdlen % bus->head_align) {
1793                 *rdlen += bus->head_align - (*rdlen % bus->head_align);
1794         }
1795 }
1796
1797 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
1798 {
1799         struct sk_buff *pkt;            /* Packet for event or data frames */
1800         u16 pad;                /* Number of pad bytes to read */
1801         uint rxleft = 0;        /* Remaining number of frames allowed */
1802         int ret;                /* Return code from calls */
1803         uint rxcount = 0;       /* Total frames read */
1804         struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
1805         u8 head_read = 0;
1806
1807         brcmf_dbg(TRACE, "Enter\n");
1808
1809         /* Not finished unless we encounter no more frames indication */
1810         bus->rxpending = true;
1811
1812         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
1813              !bus->rxskip && rxleft && brcmf_bus_ready(bus->sdiodev->bus_if);
1814              rd->seq_num++, rxleft--) {
1815
1816                 /* Handle glomming separately */
1817                 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1818                         u8 cnt;
1819                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1820                                   bus->glomd, skb_peek(&bus->glom));
1821                         cnt = brcmf_sdio_rxglom(bus, rd->seq_num);
1822                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1823                         rd->seq_num += cnt - 1;
1824                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1825                         continue;
1826                 }
1827
1828                 rd->len_left = rd->len;
1829                 /* read header first for unknow frame length */
1830                 sdio_claim_host(bus->sdiodev->func[1]);
1831                 if (!rd->len) {
1832                         ret = brcmf_sdiod_recv_buf(bus->sdiodev,
1833                                                    bus->rxhdr, BRCMF_FIRSTREAD);
1834                         bus->sdcnt.f2rxhdrs++;
1835                         if (ret < 0) {
1836                                 brcmf_err("RXHEADER FAILED: %d\n",
1837                                           ret);
1838                                 bus->sdcnt.rx_hdrfail++;
1839                                 brcmf_sdio_rxfail(bus, true, true);
1840                                 sdio_release_host(bus->sdiodev->func[1]);
1841                                 continue;
1842                         }
1843
1844                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() || BRCMF_HDRS_ON(),
1845                                            bus->rxhdr, SDPCM_HDRLEN,
1846                                            "RxHdr:\n");
1847
1848                         if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
1849                                                BRCMF_SDIO_FT_NORMAL)) {
1850                                 sdio_release_host(bus->sdiodev->func[1]);
1851                                 if (!bus->rxpending)
1852                                         break;
1853                                 else
1854                                         continue;
1855                         }
1856
1857                         if (rd->channel == SDPCM_CONTROL_CHANNEL) {
1858                                 brcmf_sdio_read_control(bus, bus->rxhdr,
1859                                                         rd->len,
1860                                                         rd->dat_offset);
1861                                 /* prepare the descriptor for the next read */
1862                                 rd->len = rd->len_nxtfrm << 4;
1863                                 rd->len_nxtfrm = 0;
1864                                 /* treat all packet as event if we don't know */
1865                                 rd->channel = SDPCM_EVENT_CHANNEL;
1866                                 sdio_release_host(bus->sdiodev->func[1]);
1867                                 continue;
1868                         }
1869                         rd->len_left = rd->len > BRCMF_FIRSTREAD ?
1870                                        rd->len - BRCMF_FIRSTREAD : 0;
1871                         head_read = BRCMF_FIRSTREAD;
1872                 }
1873
1874                 brcmf_sdio_pad(bus, &pad, &rd->len_left);
1875
1876                 pkt = brcmu_pkt_buf_get_skb(rd->len_left + head_read +
1877                                             bus->head_align);
1878                 if (!pkt) {
1879                         /* Give up on data, request rtx of events */
1880                         brcmf_err("brcmu_pkt_buf_get_skb failed\n");
1881                         brcmf_sdio_rxfail(bus, false,
1882                                             RETRYCHAN(rd->channel));
1883                         sdio_release_host(bus->sdiodev->func[1]);
1884                         continue;
1885                 }
1886                 skb_pull(pkt, head_read);
1887                 pkt_align(pkt, rd->len_left, bus->head_align);
1888
1889                 ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
1890                 bus->sdcnt.f2rxdata++;
1891                 sdio_release_host(bus->sdiodev->func[1]);
1892
1893                 if (ret < 0) {
1894                         brcmf_err("read %d bytes from channel %d failed: %d\n",
1895                                   rd->len, rd->channel, ret);
1896                         brcmu_pkt_buf_free_skb(pkt);
1897                         sdio_claim_host(bus->sdiodev->func[1]);
1898                         brcmf_sdio_rxfail(bus, true,
1899                                             RETRYCHAN(rd->channel));
1900                         sdio_release_host(bus->sdiodev->func[1]);
1901                         continue;
1902                 }
1903
1904                 if (head_read) {
1905                         skb_push(pkt, head_read);
1906                         memcpy(pkt->data, bus->rxhdr, head_read);
1907                         head_read = 0;
1908                 } else {
1909                         memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
1910                         rd_new.seq_num = rd->seq_num;
1911                         sdio_claim_host(bus->sdiodev->func[1]);
1912                         if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
1913                                                BRCMF_SDIO_FT_NORMAL)) {
1914                                 rd->len = 0;
1915                                 brcmu_pkt_buf_free_skb(pkt);
1916                         }
1917                         bus->sdcnt.rx_readahead_cnt++;
1918                         if (rd->len != roundup(rd_new.len, 16)) {
1919                                 brcmf_err("frame length mismatch:read %d, should be %d\n",
1920                                           rd->len,
1921                                           roundup(rd_new.len, 16) >> 4);
1922                                 rd->len = 0;
1923                                 brcmf_sdio_rxfail(bus, true, true);
1924                                 sdio_release_host(bus->sdiodev->func[1]);
1925                                 brcmu_pkt_buf_free_skb(pkt);
1926                                 continue;
1927                         }
1928                         sdio_release_host(bus->sdiodev->func[1]);
1929                         rd->len_nxtfrm = rd_new.len_nxtfrm;
1930                         rd->channel = rd_new.channel;
1931                         rd->dat_offset = rd_new.dat_offset;
1932
1933                         brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1934                                              BRCMF_DATA_ON()) &&
1935                                            BRCMF_HDRS_ON(),
1936                                            bus->rxhdr, SDPCM_HDRLEN,
1937                                            "RxHdr:\n");
1938
1939                         if (rd_new.channel == SDPCM_CONTROL_CHANNEL) {
1940                                 brcmf_err("readahead on control packet %d?\n",
1941                                           rd_new.seq_num);
1942                                 /* Force retry w/normal header read */
1943                                 rd->len = 0;
1944                                 sdio_claim_host(bus->sdiodev->func[1]);
1945                                 brcmf_sdio_rxfail(bus, false, true);
1946                                 sdio_release_host(bus->sdiodev->func[1]);
1947                                 brcmu_pkt_buf_free_skb(pkt);
1948                                 continue;
1949                         }
1950                 }
1951
1952                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1953                                    pkt->data, rd->len, "Rx Data:\n");
1954
1955                 /* Save superframe descriptor and allocate packet frame */
1956                 if (rd->channel == SDPCM_GLOM_CHANNEL) {
1957                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_HWHDR_LEN])) {
1958                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
1959                                           rd->len);
1960                                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1961                                                    pkt->data, rd->len,
1962                                                    "Glom Data:\n");
1963                                 __skb_trim(pkt, rd->len);
1964                                 skb_pull(pkt, SDPCM_HDRLEN);
1965                                 bus->glomd = pkt;
1966                         } else {
1967                                 brcmf_err("%s: glom superframe w/o "
1968                                           "descriptor!\n", __func__);
1969                                 sdio_claim_host(bus->sdiodev->func[1]);
1970                                 brcmf_sdio_rxfail(bus, false, false);
1971                                 sdio_release_host(bus->sdiodev->func[1]);
1972                         }
1973                         /* prepare the descriptor for the next read */
1974                         rd->len = rd->len_nxtfrm << 4;
1975                         rd->len_nxtfrm = 0;
1976                         /* treat all packet as event if we don't know */
1977                         rd->channel = SDPCM_EVENT_CHANNEL;
1978                         continue;
1979                 }
1980
1981                 /* Fill in packet len and prio, deliver upward */
1982                 __skb_trim(pkt, rd->len);
1983                 skb_pull(pkt, rd->dat_offset);
1984
1985                 /* prepare the descriptor for the next read */
1986                 rd->len = rd->len_nxtfrm << 4;
1987                 rd->len_nxtfrm = 0;
1988                 /* treat all packet as event if we don't know */
1989                 rd->channel = SDPCM_EVENT_CHANNEL;
1990
1991                 if (pkt->len == 0) {
1992                         brcmu_pkt_buf_free_skb(pkt);
1993                         continue;
1994                 }
1995
1996                 brcmf_rx_frame(bus->sdiodev->dev, pkt);
1997         }
1998
1999         rxcount = maxframes - rxleft;
2000         /* Message if we hit the limit */
2001         if (!rxleft)
2002                 brcmf_dbg(DATA, "hit rx limit of %d frames\n", maxframes);
2003         else
2004                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2005         /* Back off rxseq if awaiting rtx, update rx_seq */
2006         if (bus->rxskip)
2007                 rd->seq_num--;
2008         bus->rx_seq = rd->seq_num;
2009
2010         return rxcount;
2011 }
2012
2013 static void
2014 brcmf_sdio_wait_event_wakeup(struct brcmf_sdio *bus)
2015 {
2016         if (waitqueue_active(&bus->ctrl_wait))
2017                 wake_up_interruptible(&bus->ctrl_wait);
2018         return;
2019 }
2020
2021 static int brcmf_sdio_txpkt_hdalign(struct brcmf_sdio *bus, struct sk_buff *pkt)
2022 {
2023         u16 head_pad;
2024         u8 *dat_buf;
2025
2026         dat_buf = (u8 *)(pkt->data);
2027
2028         /* Check head padding */
2029         head_pad = ((unsigned long)dat_buf % bus->head_align);
2030         if (head_pad) {
2031                 if (skb_headroom(pkt) < head_pad) {
2032                         bus->sdiodev->bus_if->tx_realloc++;
2033                         head_pad = 0;
2034                         if (skb_cow(pkt, head_pad))
2035                                 return -ENOMEM;
2036                 }
2037                 skb_push(pkt, head_pad);
2038                 dat_buf = (u8 *)(pkt->data);
2039                 memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
2040         }
2041         return head_pad;
2042 }
2043
2044 /**
2045  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
2046  * bus layer usage.
2047  */
2048 /* flag marking a dummy skb added for DMA alignment requirement */
2049 #define ALIGN_SKB_FLAG          0x8000
2050 /* bit mask of data length chopped from the previous packet */
2051 #define ALIGN_SKB_CHOP_LEN_MASK 0x7fff
2052
2053 static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
2054                                     struct sk_buff_head *pktq,
2055                                     struct sk_buff *pkt, u16 total_len)
2056 {
2057         struct brcmf_sdio_dev *sdiodev;
2058         struct sk_buff *pkt_pad;
2059         u16 tail_pad, tail_chop, chain_pad;
2060         unsigned int blksize;
2061         bool lastfrm;
2062         int ntail, ret;
2063
2064         sdiodev = bus->sdiodev;
2065         blksize = sdiodev->func[SDIO_FUNC_2]->cur_blksize;
2066         /* sg entry alignment should be a divisor of block size */
2067         WARN_ON(blksize % bus->sgentry_align);
2068
2069         /* Check tail padding */
2070         lastfrm = skb_queue_is_last(pktq, pkt);
2071         tail_pad = 0;
2072         tail_chop = pkt->len % bus->sgentry_align;
2073         if (tail_chop)
2074                 tail_pad = bus->sgentry_align - tail_chop;
2075         chain_pad = (total_len + tail_pad) % blksize;
2076         if (lastfrm && chain_pad)
2077                 tail_pad += blksize - chain_pad;
2078         if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
2079                 pkt_pad = bus->txglom_sgpad;
2080                 if (pkt_pad == NULL)
2081                           brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
2082                 if (pkt_pad == NULL)
2083                         return -ENOMEM;
2084                 ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
2085                 if (unlikely(ret < 0))
2086                         return ret;
2087                 memcpy(pkt_pad->data,
2088                        pkt->data + pkt->len - tail_chop,
2089                        tail_chop);
2090                 *(u32 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;
2091                 skb_trim(pkt, pkt->len - tail_chop);
2092                 __skb_queue_after(pktq, pkt, pkt_pad);
2093         } else {
2094                 ntail = pkt->data_len + tail_pad -
2095                         (pkt->end - pkt->tail);
2096                 if (skb_cloned(pkt) || ntail > 0)
2097                         if (pskb_expand_head(pkt, 0, ntail, GFP_ATOMIC))
2098                                 return -ENOMEM;
2099                 if (skb_linearize(pkt))
2100                         return -ENOMEM;
2101                 __skb_put(pkt, tail_pad);
2102         }
2103
2104         return tail_pad;
2105 }
2106
2107 /**
2108  * brcmf_sdio_txpkt_prep - packet preparation for transmit
2109  * @bus: brcmf_sdio structure pointer
2110  * @pktq: packet list pointer
2111  * @chan: virtual channel to transmit the packet
2112  *
2113  * Processes to be applied to the packet
2114  *      - Align data buffer pointer
2115  *      - Align data buffer length
2116  *      - Prepare header
2117  * Return: negative value if there is error
2118  */
2119 static int
2120 brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
2121                       uint chan)
2122 {
2123         u16 head_pad, total_len;
2124         struct sk_buff *pkt_next;
2125         u8 txseq;
2126         int ret;
2127         struct brcmf_sdio_hdrinfo hd_info = {0};
2128
2129         txseq = bus->tx_seq;
2130         total_len = 0;
2131         skb_queue_walk(pktq, pkt_next) {
2132                 /* alignment packet inserted in previous
2133                  * loop cycle can be skipped as it is
2134                  * already properly aligned and does not
2135                  * need an sdpcm header.
2136                  */
2137                 if (*(u32 *)(pkt_next->cb) & ALIGN_SKB_FLAG)
2138                         continue;
2139
2140                 /* align packet data pointer */
2141                 ret = brcmf_sdio_txpkt_hdalign(bus, pkt_next);
2142                 if (ret < 0)
2143                         return ret;
2144                 head_pad = (u16)ret;
2145                 if (head_pad)
2146                         memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);
2147
2148                 total_len += pkt_next->len;
2149
2150                 hd_info.len = pkt_next->len;
2151                 hd_info.lastfrm = skb_queue_is_last(pktq, pkt_next);
2152                 if (bus->txglom && pktq->qlen > 1) {
2153                         ret = brcmf_sdio_txpkt_prep_sg(bus, pktq,
2154                                                        pkt_next, total_len);
2155                         if (ret < 0)
2156                                 return ret;
2157                         hd_info.tail_pad = (u16)ret;
2158                         total_len += (u16)ret;
2159                 }
2160
2161                 hd_info.channel = chan;
2162                 hd_info.dat_offset = head_pad + bus->tx_hdrlen;
2163                 hd_info.seq_num = txseq++;
2164
2165                 /* Now fill the header */
2166                 brcmf_sdio_hdpack(bus, pkt_next->data, &hd_info);
2167
2168                 if (BRCMF_BYTES_ON() &&
2169                     ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
2170                      (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)))
2171                         brcmf_dbg_hex_dump(true, pkt_next, hd_info.len,
2172                                            "Tx Frame:\n");
2173                 else if (BRCMF_HDRS_ON())
2174                         brcmf_dbg_hex_dump(true, pkt_next,
2175                                            head_pad + bus->tx_hdrlen,
2176                                            "Tx Header:\n");
2177         }
2178         /* Hardware length tag of the first packet should be total
2179          * length of the chain (including padding)
2180          */
2181         if (bus->txglom)
2182                 brcmf_sdio_update_hwhdr(pktq->next->data, total_len);
2183         return 0;
2184 }
2185
2186 /**
2187  * brcmf_sdio_txpkt_postp - packet post processing for transmit
2188  * @bus: brcmf_sdio structure pointer
2189  * @pktq: packet list pointer
2190  *
2191  * Processes to be applied to the packet
2192  *      - Remove head padding
2193  *      - Remove tail padding
2194  */
2195 static void
2196 brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
2197 {
2198         u8 *hdr;
2199         u32 dat_offset;
2200         u16 tail_pad;
2201         u32 dummy_flags, chop_len;
2202         struct sk_buff *pkt_next, *tmp, *pkt_prev;
2203
2204         skb_queue_walk_safe(pktq, pkt_next, tmp) {
2205                 dummy_flags = *(u32 *)(pkt_next->cb);
2206                 if (dummy_flags & ALIGN_SKB_FLAG) {
2207                         chop_len = dummy_flags & ALIGN_SKB_CHOP_LEN_MASK;
2208                         if (chop_len) {
2209                                 pkt_prev = pkt_next->prev;
2210                                 skb_put(pkt_prev, chop_len);
2211                         }
2212                         __skb_unlink(pkt_next, pktq);
2213                         brcmu_pkt_buf_free_skb(pkt_next);
2214                 } else {
2215                         hdr = pkt_next->data + bus->tx_hdrlen - SDPCM_SWHDR_LEN;
2216                         dat_offset = le32_to_cpu(*(__le32 *)hdr);
2217                         dat_offset = (dat_offset & SDPCM_DOFFSET_MASK) >>
2218                                      SDPCM_DOFFSET_SHIFT;
2219                         skb_pull(pkt_next, dat_offset);
2220                         if (bus->txglom) {
2221                                 tail_pad = le16_to_cpu(*(__le16 *)(hdr - 2));
2222                                 skb_trim(pkt_next, pkt_next->len - tail_pad);
2223                         }
2224                 }
2225         }
2226 }
2227
2228 /* Writes a HW/SW header into the packet and sends it. */
2229 /* Assumes: (a) header space already there, (b) caller holds lock */
2230 static int brcmf_sdio_txpkt(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
2231                             uint chan)
2232 {
2233         int ret;
2234         int i;
2235         struct sk_buff *pkt_next, *tmp;
2236
2237         brcmf_dbg(TRACE, "Enter\n");
2238
2239         ret = brcmf_sdio_txpkt_prep(bus, pktq, chan);
2240         if (ret)
2241                 goto done;
2242
2243         sdio_claim_host(bus->sdiodev->func[1]);
2244         ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
2245         bus->sdcnt.f2txdata++;
2246
2247         if (ret < 0) {
2248                 /* On failure, abort the command and terminate the frame */
2249                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2250                           ret);
2251                 bus->sdcnt.tx_sderrs++;
2252
2253                 brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
2254                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2255                                   SFC_WF_TERM, NULL);
2256                 bus->sdcnt.f1regdata++;
2257
2258                 for (i = 0; i < 3; i++) {
2259                         u8 hi, lo;
2260                         hi = brcmf_sdiod_regrb(bus->sdiodev,
2261                                                SBSDIO_FUNC1_WFRAMEBCHI, NULL);
2262                         lo = brcmf_sdiod_regrb(bus->sdiodev,
2263                                                SBSDIO_FUNC1_WFRAMEBCLO, NULL);
2264                         bus->sdcnt.f1regdata += 2;
2265                         if ((hi == 0) && (lo == 0))
2266                                 break;
2267                 }
2268         }
2269         sdio_release_host(bus->sdiodev->func[1]);
2270
2271 done:
2272         brcmf_sdio_txpkt_postp(bus, pktq);
2273         if (ret == 0)
2274                 bus->tx_seq = (bus->tx_seq + pktq->qlen) % SDPCM_SEQ_WRAP;
2275         skb_queue_walk_safe(pktq, pkt_next, tmp) {
2276                 __skb_unlink(pkt_next, pktq);
2277                 brcmf_txcomplete(bus->sdiodev->dev, pkt_next, ret == 0);
2278         }
2279         return ret;
2280 }
2281
2282 static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
2283 {
2284         struct sk_buff *pkt;
2285         struct sk_buff_head pktq;
2286         u32 intstatus = 0;
2287         int ret = 0, prec_out, i;
2288         uint cnt = 0;
2289         u8 tx_prec_map, pkt_num;
2290
2291         brcmf_dbg(TRACE, "Enter\n");
2292
2293         tx_prec_map = ~bus->flowcontrol;
2294
2295         /* Send frames until the limit or some other event */
2296         for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
2297                 pkt_num = 1;
2298                 __skb_queue_head_init(&pktq);
2299                 if (bus->txglom)
2300                         pkt_num = min_t(u8, bus->tx_max - bus->tx_seq,
2301                                         brcmf_sdio_txglomsz);
2302                 pkt_num = min_t(u32, pkt_num,
2303                                 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol));
2304                 spin_lock_bh(&bus->txqlock);
2305                 for (i = 0; i < pkt_num; i++) {
2306                         pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map,
2307                                               &prec_out);
2308                         if (pkt == NULL)
2309                                 break;
2310                         __skb_queue_tail(&pktq, pkt);
2311                 }
2312                 spin_unlock_bh(&bus->txqlock);
2313                 if (i == 0)
2314                         break;
2315
2316                 ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
2317                 cnt += i;
2318
2319                 /* In poll mode, need to check for other events */
2320                 if (!bus->intr && cnt) {
2321                         /* Check device status, signal pending interrupt */
2322                         sdio_claim_host(bus->sdiodev->func[1]);
2323                         ret = r_sdreg32(bus, &intstatus,
2324                                         offsetof(struct sdpcmd_regs,
2325                                                  intstatus));
2326                         sdio_release_host(bus->sdiodev->func[1]);
2327                         bus->sdcnt.f2txdata++;
2328                         if (ret != 0)
2329                                 break;
2330                         if (intstatus & bus->hostintmask)
2331                                 atomic_set(&bus->ipend, 1);
2332                 }
2333         }
2334
2335         /* Deflow-control stack if needed */
2336         if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
2337             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
2338                 bus->txoff = false;
2339                 brcmf_txflowblock(bus->sdiodev->dev, false);
2340         }
2341
2342         return cnt;
2343 }
2344
2345 static void brcmf_sdio_bus_stop(struct device *dev)
2346 {
2347         u32 local_hostintmask;
2348         u8 saveclk;
2349         int err;
2350         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2351         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2352         struct brcmf_sdio *bus = sdiodev->bus;
2353
2354         brcmf_dbg(TRACE, "Enter\n");
2355
2356         if (bus->watchdog_tsk) {
2357                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
2358                 kthread_stop(bus->watchdog_tsk);
2359                 bus->watchdog_tsk = NULL;
2360         }
2361
2362         if (bus_if->state == BRCMF_BUS_DOWN) {
2363                 sdio_claim_host(sdiodev->func[1]);
2364
2365                 /* Enable clock for device interrupts */
2366                 brcmf_sdio_bus_sleep(bus, false, false);
2367
2368                 /* Disable and clear interrupts at the chip level also */
2369                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
2370                 local_hostintmask = bus->hostintmask;
2371                 bus->hostintmask = 0;
2372
2373                 /* Force backplane clocks to assure F2 interrupt propagates */
2374                 saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
2375                                             &err);
2376                 if (!err)
2377                         brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
2378                                           (saveclk | SBSDIO_FORCE_HT), &err);
2379                 if (err)
2380                         brcmf_err("Failed to force clock for F2: err %d\n",
2381                                   err);
2382
2383                 /* Turn off the bus (F2), free any pending packets */
2384                 brcmf_dbg(INTR, "disable SDIO interrupts\n");
2385                 sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
2386
2387                 /* Clear any pending interrupts now that F2 is disabled */
2388                 w_sdreg32(bus, local_hostintmask,
2389                           offsetof(struct sdpcmd_regs, intstatus));
2390
2391                 sdio_release_host(sdiodev->func[1]);
2392         }
2393         /* Clear the data packet queues */
2394         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2395
2396         /* Clear any held glomming stuff */
2397         if (bus->glomd)
2398                 brcmu_pkt_buf_free_skb(bus->glomd);
2399         brcmf_sdio_free_glom(bus);
2400
2401         /* Clear rx control and wake any waiters */
2402         spin_lock_bh(&bus->rxctl_lock);
2403         bus->rxlen = 0;
2404         spin_unlock_bh(&bus->rxctl_lock);
2405         brcmf_sdio_dcmd_resp_wake(bus);
2406
2407         /* Reset some F2 state stuff */
2408         bus->rxskip = false;
2409         bus->tx_seq = bus->rx_seq = 0;
2410 }
2411
2412 static inline void brcmf_sdio_clrintr(struct brcmf_sdio *bus)
2413 {
2414         unsigned long flags;
2415
2416         if (bus->sdiodev->oob_irq_requested) {
2417                 spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
2418                 if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
2419                         enable_irq(bus->sdiodev->pdata->oob_irq_nr);
2420                         bus->sdiodev->irq_en = true;
2421                 }
2422                 spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
2423         }
2424 }
2425
2426 static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
2427 {
2428         u8 idx;
2429         u32 addr;
2430         unsigned long val;
2431         int n, ret;
2432
2433         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
2434         addr = bus->ci->c_inf[idx].base +
2435                offsetof(struct sdpcmd_regs, intstatus);
2436
2437         val = brcmf_sdiod_regrl(bus->sdiodev, addr, &ret);
2438         bus->sdcnt.f1regdata++;
2439         if (ret != 0)
2440                 val = 0;
2441
2442         val &= bus->hostintmask;
2443         atomic_set(&bus->fcstate, !!(val & I_HMB_FC_STATE));
2444
2445         /* Clear interrupts */
2446         if (val) {
2447                 brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
2448                 bus->sdcnt.f1regdata++;
2449         }
2450
2451         if (ret) {
2452                 atomic_set(&bus->intstatus, 0);
2453         } else if (val) {
2454                 for_each_set_bit(n, &val, 32)
2455                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2456         }
2457
2458         return ret;
2459 }
2460
2461 static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
2462 {
2463         u32 newstatus = 0;
2464         unsigned long intstatus;
2465         uint rxlimit = bus->rxbound;    /* Rx frames to read before resched */
2466         uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2467         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2468         int err = 0, n;
2469
2470         brcmf_dbg(TRACE, "Enter\n");
2471
2472         sdio_claim_host(bus->sdiodev->func[1]);
2473
2474         /* If waiting for HTAVAIL, check status */
2475         if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
2476                 u8 clkctl, devctl = 0;
2477
2478 #ifdef DEBUG
2479                 /* Check for inconsistent device control */
2480                 devctl = brcmf_sdiod_regrb(bus->sdiodev,
2481                                            SBSDIO_DEVICE_CTL, &err);
2482 #endif                          /* DEBUG */
2483
2484                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2485                 clkctl = brcmf_sdiod_regrb(bus->sdiodev,
2486                                            SBSDIO_FUNC1_CHIPCLKCSR, &err);
2487
2488                 brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2489                           devctl, clkctl);
2490
2491                 if (SBSDIO_HTAV(clkctl)) {
2492                         devctl = brcmf_sdiod_regrb(bus->sdiodev,
2493                                                    SBSDIO_DEVICE_CTL, &err);
2494                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2495                         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
2496                                           devctl, &err);
2497                         bus->clkstate = CLK_AVAIL;
2498                 }
2499         }
2500
2501         /* Make sure backplane clock is on */
2502         brcmf_sdio_bus_sleep(bus, false, true);
2503
2504         /* Pending interrupt indicates new device status */
2505         if (atomic_read(&bus->ipend) > 0) {
2506                 atomic_set(&bus->ipend, 0);
2507                 err = brcmf_sdio_intr_rstatus(bus);
2508         }
2509
2510         /* Start with leftover status bits */
2511         intstatus = atomic_xchg(&bus->intstatus, 0);
2512
2513         /* Handle flow-control change: read new state in case our ack
2514          * crossed another change interrupt.  If change still set, assume
2515          * FC ON for safety, let next loop through do the debounce.
2516          */
2517         if (intstatus & I_HMB_FC_CHANGE) {
2518                 intstatus &= ~I_HMB_FC_CHANGE;
2519                 err = w_sdreg32(bus, I_HMB_FC_CHANGE,
2520                                 offsetof(struct sdpcmd_regs, intstatus));
2521
2522                 err = r_sdreg32(bus, &newstatus,
2523                                 offsetof(struct sdpcmd_regs, intstatus));
2524                 bus->sdcnt.f1regdata += 2;
2525                 atomic_set(&bus->fcstate,
2526                            !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
2527                 intstatus |= (newstatus & bus->hostintmask);
2528         }
2529
2530         /* Handle host mailbox indication */
2531         if (intstatus & I_HMB_HOST_INT) {
2532                 intstatus &= ~I_HMB_HOST_INT;
2533                 intstatus |= brcmf_sdio_hostmail(bus);
2534         }
2535
2536         sdio_release_host(bus->sdiodev->func[1]);
2537
2538         /* Generally don't ask for these, can get CRC errors... */
2539         if (intstatus & I_WR_OOSYNC) {
2540                 brcmf_err("Dongle reports WR_OOSYNC\n");
2541                 intstatus &= ~I_WR_OOSYNC;
2542         }
2543
2544         if (intstatus & I_RD_OOSYNC) {
2545                 brcmf_err("Dongle reports RD_OOSYNC\n");
2546                 intstatus &= ~I_RD_OOSYNC;
2547         }
2548
2549         if (intstatus & I_SBINT) {
2550                 brcmf_err("Dongle reports SBINT\n");
2551                 intstatus &= ~I_SBINT;
2552         }
2553
2554         /* Would be active due to wake-wlan in gSPI */
2555         if (intstatus & I_CHIPACTIVE) {
2556                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2557                 intstatus &= ~I_CHIPACTIVE;
2558         }
2559
2560         /* Ignore frame indications if rxskip is set */
2561         if (bus->rxskip)
2562                 intstatus &= ~I_HMB_FRAME_IND;
2563
2564         /* On frame indication, read available frames */
2565         if (PKT_AVAILABLE() && bus->clkstate == CLK_AVAIL) {
2566                 framecnt = brcmf_sdio_readframes(bus, rxlimit);
2567                 if (!bus->rxpending)
2568                         intstatus &= ~I_HMB_FRAME_IND;
2569                 rxlimit -= min(framecnt, rxlimit);
2570         }
2571
2572         /* Keep still-pending events for next scheduling */
2573         if (intstatus) {
2574                 for_each_set_bit(n, &intstatus, 32)
2575                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2576         }
2577
2578         brcmf_sdio_clrintr(bus);
2579
2580         if (data_ok(bus) && bus->ctrl_frame_stat &&
2581                 (bus->clkstate == CLK_AVAIL)) {
2582                 int i;
2583
2584                 sdio_claim_host(bus->sdiodev->func[1]);
2585                 err = brcmf_sdiod_send_buf(bus->sdiodev, bus->ctrl_frame_buf,
2586                                            (u32)bus->ctrl_frame_len);
2587
2588                 if (err < 0) {
2589                         /* On failure, abort the command and
2590                                 terminate the frame */
2591                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2592                                   err);
2593                         bus->sdcnt.tx_sderrs++;
2594
2595                         brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
2596
2597                         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2598                                           SFC_WF_TERM, &err);
2599                         bus->sdcnt.f1regdata++;
2600
2601                         for (i = 0; i < 3; i++) {
2602                                 u8 hi, lo;
2603                                 hi = brcmf_sdiod_regrb(bus->sdiodev,
2604                                                        SBSDIO_FUNC1_WFRAMEBCHI,
2605                                                        &err);
2606                                 lo = brcmf_sdiod_regrb(bus->sdiodev,
2607                                                        SBSDIO_FUNC1_WFRAMEBCLO,
2608                                                        &err);
2609                                 bus->sdcnt.f1regdata += 2;
2610                                 if ((hi == 0) && (lo == 0))
2611                                         break;
2612                         }
2613
2614                 } else {
2615                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
2616                 }
2617                 sdio_release_host(bus->sdiodev->func[1]);
2618                 bus->ctrl_frame_stat = false;
2619                 brcmf_sdio_wait_event_wakeup(bus);
2620         }
2621         /* Send queued frames (limit 1 if rx may still be pending) */
2622         else if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
2623                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2624                  && data_ok(bus)) {
2625                 framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
2626                                             txlimit;
2627                 framecnt = brcmf_sdio_sendfromq(bus, framecnt);
2628                 txlimit -= framecnt;
2629         }
2630
2631         if (!brcmf_bus_ready(bus->sdiodev->bus_if) || (err != 0)) {
2632                 brcmf_err("failed backplane access over SDIO, halting operation\n");
2633                 atomic_set(&bus->intstatus, 0);
2634         } else if (atomic_read(&bus->intstatus) ||
2635                    atomic_read(&bus->ipend) > 0 ||
2636                    (!atomic_read(&bus->fcstate) &&
2637                     brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
2638                     data_ok(bus)) || PKT_AVAILABLE()) {
2639                 atomic_inc(&bus->dpc_tskcnt);
2640         }
2641
2642         /* If we're done for now, turn off clock request. */
2643         if ((bus->clkstate != CLK_PENDING)
2644             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2645                 bus->activity = false;
2646                 brcmf_dbg(SDIO, "idle state\n");
2647                 sdio_claim_host(bus->sdiodev->func[1]);
2648                 brcmf_sdio_bus_sleep(bus, true, false);
2649                 sdio_release_host(bus->sdiodev->func[1]);
2650         }
2651 }
2652
2653 static struct pktq *brcmf_sdio_bus_gettxq(struct device *dev)
2654 {
2655         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2656         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2657         struct brcmf_sdio *bus = sdiodev->bus;
2658
2659         return &bus->txq;
2660 }
2661
2662 static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
2663 {
2664         int ret = -EBADE;
2665         uint datalen, prec;
2666         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2667         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2668         struct brcmf_sdio *bus = sdiodev->bus;
2669         ulong flags;
2670
2671         brcmf_dbg(TRACE, "Enter\n");
2672
2673         datalen = pkt->len;
2674
2675         /* Add space for the header */
2676         skb_push(pkt, bus->tx_hdrlen);
2677         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2678
2679         prec = prio2prec((pkt->priority & PRIOMASK));
2680
2681         /* Check for existing queue, current flow-control,
2682                          pending event, or pending clock */
2683         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2684         bus->sdcnt.fcqueued++;
2685
2686         /* Priority based enq */
2687         spin_lock_irqsave(&bus->txqlock, flags);
2688         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
2689                 skb_pull(pkt, bus->tx_hdrlen);
2690                 brcmf_err("out of bus->txq !!!\n");
2691                 ret = -ENOSR;
2692         } else {
2693                 ret = 0;
2694         }
2695
2696         if (pktq_len(&bus->txq) >= TXHI) {
2697                 bus->txoff = true;
2698                 brcmf_txflowblock(bus->sdiodev->dev, true);
2699         }
2700         spin_unlock_irqrestore(&bus->txqlock, flags);
2701
2702 #ifdef DEBUG
2703         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2704                 qcount[prec] = pktq_plen(&bus->txq, prec);
2705 #endif
2706
2707         if (atomic_read(&bus->dpc_tskcnt) == 0) {
2708                 atomic_inc(&bus->dpc_tskcnt);
2709                 queue_work(bus->brcmf_wq, &bus->datawork);
2710         }
2711
2712         return ret;
2713 }
2714
2715 #ifdef DEBUG
2716 #define CONSOLE_LINE_MAX        192
2717
2718 static int brcmf_sdio_readconsole(struct brcmf_sdio *bus)
2719 {
2720         struct brcmf_console *c = &bus->console;
2721         u8 line[CONSOLE_LINE_MAX], ch;
2722         u32 n, idx, addr;
2723         int rv;
2724
2725         /* Don't do anything until FWREADY updates console address */
2726         if (bus->console_addr == 0)
2727                 return 0;
2728
2729         /* Read console log struct */
2730         addr = bus->console_addr + offsetof(struct rte_console, log_le);
2731         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&c->log_le,
2732                                sizeof(c->log_le));
2733         if (rv < 0)
2734                 return rv;
2735
2736         /* Allocate console buffer (one time only) */
2737         if (c->buf == NULL) {
2738                 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2739                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2740                 if (c->buf == NULL)
2741                         return -ENOMEM;
2742         }
2743
2744         idx = le32_to_cpu(c->log_le.idx);
2745
2746         /* Protect against corrupt value */
2747         if (idx > c->bufsize)
2748                 return -EBADE;
2749
2750         /* Skip reading the console buffer if the index pointer
2751          has not moved */
2752         if (idx == c->last)
2753                 return 0;
2754
2755         /* Read the console buffer */
2756         addr = le32_to_cpu(c->log_le.buf);
2757         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
2758         if (rv < 0)
2759                 return rv;
2760
2761         while (c->last != idx) {
2762                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2763                         if (c->last == idx) {
2764                                 /* This would output a partial line.
2765                                  * Instead, back up
2766                                  * the buffer pointer and output this
2767                                  * line next time around.
2768                                  */
2769                                 if (c->last >= n)
2770                                         c->last -= n;
2771                                 else
2772                                         c->last = c->bufsize - n;
2773                                 goto break2;
2774                         }
2775                         ch = c->buf[c->last];
2776                         c->last = (c->last + 1) % c->bufsize;
2777                         if (ch == '\n')
2778                                 break;
2779                         line[n] = ch;
2780                 }
2781
2782                 if (n > 0) {
2783                         if (line[n - 1] == '\r')
2784                                 n--;
2785                         line[n] = 0;
2786                         pr_debug("CONSOLE: %s\n", line);
2787                 }
2788         }
2789 break2:
2790
2791         return 0;
2792 }
2793 #endif                          /* DEBUG */
2794
2795 static int brcmf_sdio_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
2796 {
2797         int i;
2798         int ret;
2799
2800         bus->ctrl_frame_stat = false;
2801         ret = brcmf_sdiod_send_buf(bus->sdiodev, frame, len);
2802
2803         if (ret < 0) {
2804                 /* On failure, abort the command and terminate the frame */
2805                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2806                           ret);
2807                 bus->sdcnt.tx_sderrs++;
2808
2809                 brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
2810
2811                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2812                                   SFC_WF_TERM, NULL);
2813                 bus->sdcnt.f1regdata++;
2814
2815                 for (i = 0; i < 3; i++) {
2816                         u8 hi, lo;
2817                         hi = brcmf_sdiod_regrb(bus->sdiodev,
2818                                                SBSDIO_FUNC1_WFRAMEBCHI, NULL);
2819                         lo = brcmf_sdiod_regrb(bus->sdiodev,
2820                                                SBSDIO_FUNC1_WFRAMEBCLO, NULL);
2821                         bus->sdcnt.f1regdata += 2;
2822                         if (hi == 0 && lo == 0)
2823                                 break;
2824                 }
2825                 return ret;
2826         }
2827
2828         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
2829
2830         return ret;
2831 }
2832
2833 static int
2834 brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2835 {
2836         u8 *frame;
2837         u16 len, pad;
2838         uint retries = 0;
2839         u8 doff = 0;
2840         int ret = -1;
2841         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2842         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2843         struct brcmf_sdio *bus = sdiodev->bus;
2844         struct brcmf_sdio_hdrinfo hd_info = {0};
2845
2846         brcmf_dbg(TRACE, "Enter\n");
2847
2848         /* Back the pointer to make a room for bus header */
2849         frame = msg - bus->tx_hdrlen;
2850         len = (msglen += bus->tx_hdrlen);
2851
2852         /* Add alignment padding (optional for ctl frames) */
2853         doff = ((unsigned long)frame % bus->head_align);
2854         if (doff) {
2855                 frame -= doff;
2856                 len += doff;
2857                 msglen += doff;
2858                 memset(frame, 0, doff + bus->tx_hdrlen);
2859         }
2860         /* precondition: doff < bus->head_align */
2861         doff += bus->tx_hdrlen;
2862
2863         /* Round send length to next SDIO block */
2864         pad = 0;
2865         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2866                 pad = bus->blocksize - (len % bus->blocksize);
2867                 if ((pad > bus->roundup) || (pad >= bus->blocksize))
2868                         pad = 0;
2869         } else if (len % bus->head_align) {
2870                 pad = bus->head_align - (len % bus->head_align);
2871         }
2872         len += pad;
2873
2874         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2875
2876         /* Make sure backplane clock is on */
2877         sdio_claim_host(bus->sdiodev->func[1]);
2878         brcmf_sdio_bus_sleep(bus, false, false);
2879         sdio_release_host(bus->sdiodev->func[1]);
2880
2881         hd_info.len = (u16)msglen;
2882         hd_info.channel = SDPCM_CONTROL_CHANNEL;
2883         hd_info.dat_offset = doff;
2884         hd_info.seq_num = bus->tx_seq;
2885         hd_info.lastfrm = true;
2886         hd_info.tail_pad = pad;
2887         brcmf_sdio_hdpack(bus, frame, &hd_info);
2888
2889         if (bus->txglom)
2890                 brcmf_sdio_update_hwhdr(frame, len);
2891
2892         if (!data_ok(bus)) {
2893                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2894                           bus->tx_max, bus->tx_seq);
2895                 bus->ctrl_frame_stat = true;
2896                 /* Send from dpc */
2897                 bus->ctrl_frame_buf = frame;
2898                 bus->ctrl_frame_len = len;
2899
2900                 wait_event_interruptible_timeout(bus->ctrl_wait,
2901                                                  !bus->ctrl_frame_stat,
2902                                                  msecs_to_jiffies(2000));
2903
2904                 if (!bus->ctrl_frame_stat) {
2905                         brcmf_dbg(SDIO, "ctrl_frame_stat == false\n");
2906                         ret = 0;
2907                 } else {
2908                         brcmf_dbg(SDIO, "ctrl_frame_stat == true\n");
2909                         ret = -1;
2910                 }
2911         }
2912
2913         if (ret == -1) {
2914                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
2915                                    frame, len, "Tx Frame:\n");
2916                 brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
2917                                    BRCMF_HDRS_ON(),
2918                                    frame, min_t(u16, len, 16), "TxHdr:\n");
2919
2920                 do {
2921                         sdio_claim_host(bus->sdiodev->func[1]);
2922                         ret = brcmf_sdio_tx_frame(bus, frame, len);
2923                         sdio_release_host(bus->sdiodev->func[1]);
2924                 } while (ret < 0 && retries++ < TXRETRIES);
2925         }
2926
2927         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) &&
2928             atomic_read(&bus->dpc_tskcnt) == 0) {
2929                 bus->activity = false;
2930                 sdio_claim_host(bus->sdiodev->func[1]);
2931                 brcmf_dbg(INFO, "idle\n");
2932                 brcmf_sdio_clkctl(bus, CLK_NONE, true);
2933                 sdio_release_host(bus->sdiodev->func[1]);
2934         }
2935
2936         if (ret)
2937                 bus->sdcnt.tx_ctlerrs++;
2938         else
2939                 bus->sdcnt.tx_ctlpkts++;
2940
2941         return ret ? -EIO : 0;
2942 }
2943
2944 #ifdef DEBUG
2945 static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
2946                                    struct sdpcm_shared *sh, char __user *data,
2947                                    size_t count)
2948 {
2949         u32 addr, console_ptr, console_size, console_index;
2950         char *conbuf = NULL;
2951         __le32 sh_val;
2952         int rv;
2953         loff_t pos = 0;
2954         int nbytes = 0;
2955
2956         /* obtain console information from device memory */
2957         addr = sh->console_addr + offsetof(struct rte_console, log_le);
2958         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
2959                                (u8 *)&sh_val, sizeof(u32));
2960         if (rv < 0)
2961                 return rv;
2962         console_ptr = le32_to_cpu(sh_val);
2963
2964         addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
2965         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
2966                                (u8 *)&sh_val, sizeof(u32));
2967         if (rv < 0)
2968                 return rv;
2969         console_size = le32_to_cpu(sh_val);
2970
2971         addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
2972         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
2973                                (u8 *)&sh_val, sizeof(u32));
2974         if (rv < 0)
2975                 return rv;
2976         console_index = le32_to_cpu(sh_val);
2977
2978         /* allocate buffer for console data */
2979         if (console_size <= CONSOLE_BUFFER_MAX)
2980                 conbuf = vzalloc(console_size+1);
2981
2982         if (!conbuf)
2983                 return -ENOMEM;
2984
2985         /* obtain the console data from device */
2986         conbuf[console_size] = '\0';
2987         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, console_ptr, (u8 *)conbuf,
2988                                console_size);
2989         if (rv < 0)
2990                 goto done;
2991
2992         rv = simple_read_from_buffer(data, count, &pos,
2993                                      conbuf + console_index,
2994                                      console_size - console_index);
2995         if (rv < 0)
2996                 goto done;
2997
2998         nbytes = rv;
2999         if (console_index > 0) {
3000                 pos = 0;
3001                 rv = simple_read_from_buffer(data+nbytes, count, &pos,
3002                                              conbuf, console_index - 1);
3003                 if (rv < 0)
3004                         goto done;
3005                 rv += nbytes;
3006         }
3007 done:
3008         vfree(conbuf);
3009         return rv;
3010 }
3011
3012 static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
3013                                 char __user *data, size_t count)
3014 {
3015         int error, res;
3016         char buf[350];
3017         struct brcmf_trap_info tr;
3018         loff_t pos = 0;
3019
3020         if ((sh->flags & SDPCM_SHARED_TRAP) == 0) {
3021                 brcmf_dbg(INFO, "no trap in firmware\n");
3022                 return 0;
3023         }
3024
3025         error = brcmf_sdiod_ramrw(bus->sdiodev, false, sh->trap_addr, (u8 *)&tr,
3026                                   sizeof(struct brcmf_trap_info));
3027         if (error < 0)
3028                 return error;
3029
3030         res = scnprintf(buf, sizeof(buf),
3031                         "dongle trap info: type 0x%x @ epc 0x%08x\n"
3032                         "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
3033                         "  lr   0x%08x pc   0x%08x offset 0x%x\n"
3034                         "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
3035                         "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
3036                         le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
3037                         le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
3038                         le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
3039                         le32_to_cpu(tr.pc), sh->trap_addr,
3040                         le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
3041                         le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
3042                         le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
3043                         le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
3044
3045         return simple_read_from_buffer(data, count, &pos, buf, res);
3046 }
3047
3048 static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
3049                                   struct sdpcm_shared *sh, char __user *data,
3050                                   size_t count)
3051 {
3052         int error = 0;
3053         char buf[200];
3054         char file[80] = "?";
3055         char expr[80] = "<???>";
3056         int res;
3057         loff_t pos = 0;
3058
3059         if ((sh->flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
3060                 brcmf_dbg(INFO, "firmware not built with -assert\n");
3061                 return 0;
3062         } else if ((sh->flags & SDPCM_SHARED_ASSERT) == 0) {
3063                 brcmf_dbg(INFO, "no assert in dongle\n");
3064                 return 0;
3065         }
3066
3067         sdio_claim_host(bus->sdiodev->func[1]);
3068         if (sh->assert_file_addr != 0) {
3069                 error = brcmf_sdiod_ramrw(bus->sdiodev, false,
3070                                           sh->assert_file_addr, (u8 *)file, 80);
3071                 if (error < 0)
3072                         return error;
3073         }
3074         if (sh->assert_exp_addr != 0) {
3075                 error = brcmf_sdiod_ramrw(bus->sdiodev, false,
3076                                           sh->assert_exp_addr, (u8 *)expr, 80);
3077                 if (error < 0)
3078                         return error;
3079         }
3080         sdio_release_host(bus->sdiodev->func[1]);
3081
3082         res = scnprintf(buf, sizeof(buf),
3083                         "dongle assert: %s:%d: assert(%s)\n",
3084                         file, sh->assert_line, expr);
3085         return simple_read_from_buffer(data, count, &pos, buf, res);
3086 }
3087
3088 static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
3089 {
3090         int error;
3091         struct sdpcm_shared sh;
3092
3093         error = brcmf_sdio_readshared(bus, &sh);
3094
3095         if (error < 0)
3096                 return error;
3097
3098         if ((sh.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
3099                 brcmf_dbg(INFO, "firmware not built with -assert\n");
3100         else if (sh.flags & SDPCM_SHARED_ASSERT)
3101                 brcmf_err("assertion in dongle\n");
3102
3103         if (sh.flags & SDPCM_SHARED_TRAP)
3104                 brcmf_err("firmware trap in dongle\n");
3105
3106         return 0;
3107 }
3108
3109 static int brcmf_sdio_died_dump(struct brcmf_sdio *bus, char __user *data,
3110                                 size_t count, loff_t *ppos)
3111 {
3112         int error = 0;
3113         struct sdpcm_shared sh;
3114         int nbytes = 0;
3115         loff_t pos = *ppos;
3116
3117         if (pos != 0)
3118                 return 0;
3119
3120         error = brcmf_sdio_readshared(bus, &sh);
3121         if (error < 0)
3122                 goto done;
3123
3124         error = brcmf_sdio_assert_info(bus, &sh, data, count);
3125         if (error < 0)
3126                 goto done;
3127         nbytes = error;
3128
3129         error = brcmf_sdio_trap_info(bus, &sh, data+nbytes, count);
3130         if (error < 0)
3131                 goto done;
3132         nbytes += error;
3133
3134         error = brcmf_sdio_dump_console(bus, &sh, data+nbytes, count);
3135         if (error < 0)
3136                 goto done;
3137         nbytes += error;
3138
3139         error = nbytes;
3140         *ppos += nbytes;
3141 done:
3142         return error;
3143 }
3144
3145 static ssize_t brcmf_sdio_forensic_read(struct file *f, char __user *data,
3146                                         size_t count, loff_t *ppos)
3147 {
3148         struct brcmf_sdio *bus = f->private_data;
3149         int res;
3150
3151         res = brcmf_sdio_died_dump(bus, data, count, ppos);
3152         if (res > 0)
3153                 *ppos += res;
3154         return (ssize_t)res;
3155 }
3156
3157 static const struct file_operations brcmf_sdio_forensic_ops = {
3158         .owner = THIS_MODULE,
3159         .open = simple_open,
3160         .read = brcmf_sdio_forensic_read
3161 };
3162
3163 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
3164 {
3165         struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
3166         struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
3167
3168         if (IS_ERR_OR_NULL(dentry))
3169                 return;
3170
3171         debugfs_create_file("forensics", S_IRUGO, dentry, bus,
3172                             &brcmf_sdio_forensic_ops);
3173         brcmf_debugfs_create_sdio_count(drvr, &bus->sdcnt);
3174         debugfs_create_u32("console_interval", 0644, dentry,
3175                            &bus->console_interval);
3176 }
3177 #else
3178 static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
3179 {
3180         return 0;
3181 }
3182
3183 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
3184 {
3185 }
3186 #endif /* DEBUG */
3187
3188 static int
3189 brcmf_sdio_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
3190 {
3191         int timeleft;
3192         uint rxlen = 0;
3193         bool pending;
3194         u8 *buf;
3195         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3196         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3197         struct brcmf_sdio *bus = sdiodev->bus;
3198
3199         brcmf_dbg(TRACE, "Enter\n");
3200
3201         /* Wait until control frame is available */
3202         timeleft = brcmf_sdio_dcmd_resp_wait(bus, &bus->rxlen, &pending);
3203
3204         spin_lock_bh(&bus->rxctl_lock);
3205         rxlen = bus->rxlen;
3206         memcpy(msg, bus->rxctl, min(msglen, rxlen));
3207         bus->rxctl = NULL;
3208         buf = bus->rxctl_orig;
3209         bus->rxctl_orig = NULL;
3210         bus->rxlen = 0;
3211         spin_unlock_bh(&bus->rxctl_lock);
3212         vfree(buf);
3213
3214         if (rxlen) {
3215                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
3216                           rxlen, msglen);
3217         } else if (timeleft == 0) {
3218                 brcmf_err("resumed on timeout\n");
3219                 brcmf_sdio_checkdied(bus);
3220         } else if (pending) {
3221                 brcmf_dbg(CTL, "cancelled\n");
3222                 return -ERESTARTSYS;
3223         } else {
3224                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
3225                 brcmf_sdio_checkdied(bus);
3226         }
3227
3228         if (rxlen)
3229                 bus->sdcnt.rx_ctlpkts++;
3230         else
3231                 bus->sdcnt.rx_ctlerrs++;
3232
3233         return rxlen ? (int)rxlen : -ETIMEDOUT;
3234 }
3235
3236 #ifdef DEBUG
3237 static bool
3238 brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
3239                         u8 *ram_data, uint ram_sz)
3240 {
3241         char *ram_cmp;
3242         int err;
3243         bool ret = true;
3244         int address;
3245         int offset;
3246         int len;
3247
3248         /* read back and verify */
3249         brcmf_dbg(INFO, "Compare RAM dl & ul at 0x%08x; size=%d\n", ram_addr,
3250                   ram_sz);
3251         ram_cmp = kmalloc(MEMBLOCK, GFP_KERNEL);
3252         /* do not proceed while no memory but  */
3253         if (!ram_cmp)
3254                 return true;
3255
3256         address = ram_addr;
3257         offset = 0;
3258         while (offset < ram_sz) {
3259                 len = ((offset + MEMBLOCK) < ram_sz) ? MEMBLOCK :
3260                       ram_sz - offset;
3261                 err = brcmf_sdiod_ramrw(sdiodev, false, address, ram_cmp, len);
3262                 if (err) {
3263                         brcmf_err("error %d on reading %d membytes at 0x%08x\n",
3264                                   err, len, address);
3265                         ret = false;
3266                         break;
3267                 } else if (memcmp(ram_cmp, &ram_data[offset], len)) {
3268                         brcmf_err("Downloaded RAM image is corrupted, block offset is %d, len is %d\n",
3269                                   offset, len);
3270                         ret = false;
3271                         break;
3272                 }
3273                 offset += len;
3274                 address += len;
3275         }
3276
3277         kfree(ram_cmp);
3278
3279         return ret;
3280 }
3281 #else   /* DEBUG */
3282 static bool
3283 brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
3284                         u8 *ram_data, uint ram_sz)
3285 {
3286         return true;
3287 }
3288 #endif  /* DEBUG */
3289
3290 static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus,
3291                                          const struct firmware *fw)
3292 {
3293         int err;
3294
3295         brcmf_dbg(TRACE, "Enter\n");
3296
3297         err = brcmf_sdiod_ramrw(bus->sdiodev, true, bus->ci->rambase,
3298                                 (u8 *)fw->data, fw->size);
3299         if (err)
3300                 brcmf_err("error %d on writing %d membytes at 0x%08x\n",
3301                           err, (int)fw->size, bus->ci->rambase);
3302         else if (!brcmf_sdio_verifymemory(bus->sdiodev, bus->ci->rambase,
3303                                           (u8 *)fw->data, fw->size))
3304                 err = -EIO;
3305
3306         return err;
3307 }
3308
3309 static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus,
3310                                      const struct firmware *nv)
3311 {
3312         void *vars;
3313         u32 varsz;
3314         int address;
3315         int err;
3316
3317         brcmf_dbg(TRACE, "Enter\n");
3318
3319         vars = brcmf_nvram_strip(nv, &varsz);
3320
3321         if (vars == NULL)
3322                 return -EINVAL;
3323
3324         address = bus->ci->ramsize - varsz + bus->ci->rambase;
3325         err = brcmf_sdiod_ramrw(bus->sdiodev, true, address, vars, varsz);
3326         if (err)
3327                 brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
3328                           err, varsz, address);
3329         else if (!brcmf_sdio_verifymemory(bus->sdiodev, address, vars, varsz))
3330                 err = -EIO;
3331
3332         brcmf_nvram_free(vars);
3333
3334         return err;
3335 }
3336
3337 static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus)
3338 {
3339         int bcmerror = -EFAULT;
3340         const struct firmware *fw;
3341         u32 rstvec;
3342
3343         sdio_claim_host(bus->sdiodev->func[1]);
3344         brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
3345
3346         /* Keep arm in reset */
3347         brcmf_sdio_chip_enter_download(bus->sdiodev, bus->ci);
3348
3349         fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_BIN);
3350         if (fw == NULL) {
3351                 bcmerror = -ENOENT;
3352                 goto err;
3353         }
3354
3355         rstvec = get_unaligned_le32(fw->data);
3356         brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
3357
3358         bcmerror = brcmf_sdio_download_code_file(bus, fw);
3359         release_firmware(fw);
3360         if (bcmerror) {
3361                 brcmf_err("dongle image file download failed\n");
3362                 goto err;
3363         }
3364
3365         fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
3366         if (fw == NULL) {
3367                 bcmerror = -ENOENT;
3368                 goto err;
3369         }
3370
3371         bcmerror = brcmf_sdio_download_nvram(bus, fw);
3372         release_firmware(fw);
3373         if (bcmerror) {
3374                 brcmf_err("dongle nvram file download failed\n");
3375                 goto err;
3376         }
3377
3378         /* Take arm out of reset */
3379         if (!brcmf_sdio_chip_exit_download(bus->sdiodev, bus->ci, rstvec)) {
3380                 brcmf_err("error getting out of ARM core reset\n");
3381                 goto err;
3382         }
3383
3384         /* Allow HT Clock now that the ARM is running. */
3385         brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_LOAD);
3386         bcmerror = 0;
3387
3388 err:
3389         brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
3390         sdio_release_host(bus->sdiodev->func[1]);
3391         return bcmerror;
3392 }
3393
3394 static bool brcmf_sdio_sr_capable(struct brcmf_sdio *bus)
3395 {
3396         u32 addr, reg, pmu_cc3_mask = ~0;
3397         int err;
3398
3399         brcmf_dbg(TRACE, "Enter\n");
3400
3401         /* old chips with PMU version less than 17 don't support save restore */
3402         if (bus->ci->pmurev < 17)
3403                 return false;
3404
3405         switch (bus->ci->chip) {
3406         case BCM43241_CHIP_ID:
3407         case BCM4335_CHIP_ID:
3408         case BCM4339_CHIP_ID:
3409                 /* read PMU chipcontrol register 3 */
3410                 addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
3411                 brcmf_sdiod_regwl(bus->sdiodev, addr, 3, NULL);
3412                 addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
3413                 reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
3414                 return (reg & pmu_cc3_mask) != 0;
3415         default:
3416                 addr = CORE_CC_REG(bus->ci->c_inf[0].base, pmucapabilities_ext);
3417                 reg = brcmf_sdiod_regrl(bus->sdiodev, addr, &err);
3418                 if ((reg & PCAPEXT_SR_SUPPORTED_MASK) == 0)
3419                         return false;
3420
3421                 addr = CORE_CC_REG(bus->ci->c_inf[0].base, retention_ctl);
3422                 reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
3423                 return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
3424                                PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
3425         }
3426 }
3427
3428 static void brcmf_sdio_sr_init(struct brcmf_sdio *bus)
3429 {
3430         int err = 0;
3431         u8 val;
3432
3433         brcmf_dbg(TRACE, "Enter\n");
3434
3435         val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
3436         if (err) {
3437                 brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
3438                 return;
3439         }
3440
3441         val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
3442         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
3443         if (err) {
3444                 brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
3445                 return;
3446         }
3447
3448         /* Add CMD14 Support */
3449         brcmf_sdiod_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
3450                           (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
3451                            SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
3452                           &err);
3453         if (err) {
3454                 brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
3455                 return;
3456         }
3457
3458         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3459                           SBSDIO_FORCE_HT, &err);
3460         if (err) {
3461                 brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
3462                 return;
3463         }
3464
3465         /* set flag */
3466         bus->sr_enabled = true;
3467         brcmf_dbg(INFO, "SR enabled\n");
3468 }
3469
3470 /* enable KSO bit */
3471 static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
3472 {
3473         u8 val;
3474         int err = 0;
3475
3476         brcmf_dbg(TRACE, "Enter\n");
3477
3478         /* KSO bit added in SDIO core rev 12 */
3479         if (bus->ci->c_inf[1].rev < 12)
3480                 return 0;
3481
3482         val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
3483         if (err) {
3484                 brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
3485                 return err;
3486         }
3487
3488         if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
3489                 val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
3490                         SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
3491                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
3492                                   val, &err);
3493                 if (err) {
3494                         brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
3495                         return err;
3496                 }
3497         }
3498
3499         return 0;
3500 }
3501
3502
3503 static int brcmf_sdio_bus_preinit(struct device *dev)
3504 {
3505         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3506         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3507         struct brcmf_sdio *bus = sdiodev->bus;
3508         uint pad_size;
3509         u32 value;
3510         u8 idx;
3511         int err;
3512
3513         /* the commands below use the terms tx and rx from
3514          * a device perspective, ie. bus:txglom affects the
3515          * bus transfers from device to host.
3516          */
3517         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3518         if (bus->ci->c_inf[idx].rev < 12) {
3519                 /* for sdio core rev < 12, disable txgloming */
3520                 value = 0;
3521                 err = brcmf_iovar_data_set(dev, "bus:txglom", &value,
3522                                            sizeof(u32));
3523         } else {
3524                 /* otherwise, set txglomalign */
3525                 value = 4;
3526                 if (sdiodev->pdata)
3527                         value = sdiodev->pdata->sd_sgentry_align;
3528                 /* SDIO ADMA requires at least 32 bit alignment */
3529                 value = max_t(u32, value, 4);
3530                 err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
3531                                            sizeof(u32));
3532         }
3533
3534         if (err < 0)
3535                 goto done;
3536
3537         bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
3538         if (sdiodev->sg_support) {
3539                 bus->txglom = false;
3540                 value = 1;
3541                 pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
3542                 bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);
3543                 if (!bus->txglom_sgpad)
3544                         brcmf_err("allocating txglom padding skb failed, reduced performance\n");
3545
3546                 err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
3547                                            &value, sizeof(u32));
3548                 if (err < 0) {
3549                         /* bus:rxglom is allowed to fail */
3550                         err = 0;
3551                 } else {
3552                         bus->txglom = true;
3553                         bus->tx_hdrlen += SDPCM_HWEXT_LEN;
3554                 }
3555         }
3556         brcmf_bus_add_txhdrlen(bus->sdiodev->dev, bus->tx_hdrlen);
3557
3558 done:
3559         return err;
3560 }
3561
3562 static int brcmf_sdio_bus_init(struct device *dev)
3563 {
3564         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3565         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3566         struct brcmf_sdio *bus = sdiodev->bus;
3567         int err, ret = 0;
3568         u8 saveclk;
3569
3570         brcmf_dbg(TRACE, "Enter\n");
3571
3572         /* try to download image and nvram to the dongle */
3573         if (bus_if->state == BRCMF_BUS_DOWN) {
3574                 bus->alp_only = true;
3575                 err = brcmf_sdio_download_firmware(bus);
3576                 if (err)
3577                         return err;
3578                 bus->alp_only = false;
3579         }
3580
3581         if (!bus->sdiodev->bus_if->drvr)
3582                 return 0;
3583
3584         /* Start the watchdog timer */
3585         bus->sdcnt.tickcnt = 0;
3586         brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
3587
3588         sdio_claim_host(bus->sdiodev->func[1]);
3589
3590         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3591         brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
3592         if (bus->clkstate != CLK_AVAIL)
3593                 goto exit;
3594
3595         /* Force clocks on backplane to be sure F2 interrupt propagates */
3596         saveclk = brcmf_sdiod_regrb(bus->sdiodev,
3597                                     SBSDIO_FUNC1_CHIPCLKCSR, &err);
3598         if (!err) {
3599                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3600                                   (saveclk | SBSDIO_FORCE_HT), &err);
3601         }
3602         if (err) {
3603                 brcmf_err("Failed to force clock for F2: err %d\n", err);
3604                 goto exit;
3605         }
3606
3607         /* Enable function 2 (frame transfers) */
3608         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3609                   offsetof(struct sdpcmd_regs, tosbmailboxdata));
3610         err = sdio_enable_func(bus->sdiodev->func[SDIO_FUNC_2]);
3611
3612
3613         brcmf_dbg(INFO, "enable F2: err=%d\n", err);
3614
3615         /* If F2 successfully enabled, set core and enable interrupts */
3616         if (!err) {
3617                 /* Set up the interrupt mask and enable interrupts */
3618                 bus->hostintmask = HOSTINTMASK;
3619                 w_sdreg32(bus, bus->hostintmask,
3620                           offsetof(struct sdpcmd_regs, hostintmask));
3621
3622                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
3623         } else {
3624                 /* Disable F2 again */
3625                 sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
3626                 ret = -ENODEV;
3627         }
3628
3629         if (brcmf_sdio_sr_capable(bus)) {
3630                 brcmf_sdio_sr_init(bus);
3631         } else {
3632                 /* Restore previous clock setting */
3633                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3634                                   saveclk, &err);
3635         }
3636
3637         if (ret == 0) {
3638                 ret = brcmf_sdiod_intr_register(bus->sdiodev);
3639                 if (ret != 0)
3640                         brcmf_err("intr register failed:%d\n", ret);
3641         }
3642
3643         /* If we didn't come up, turn off backplane clock */
3644         if (ret != 0)
3645                 brcmf_sdio_clkctl(bus, CLK_NONE, false);
3646
3647 exit:
3648         sdio_release_host(bus->sdiodev->func[1]);
3649
3650         return ret;
3651 }
3652
3653 void brcmf_sdio_isr(struct brcmf_sdio *bus)
3654 {
3655         brcmf_dbg(TRACE, "Enter\n");
3656
3657         if (!bus) {
3658                 brcmf_err("bus is null pointer, exiting\n");
3659                 return;
3660         }
3661
3662         if (!brcmf_bus_ready(bus->sdiodev->bus_if)) {
3663                 brcmf_err("bus is down. we have nothing to do\n");
3664                 return;
3665         }
3666         /* Count the interrupt call */
3667         bus->sdcnt.intrcount++;
3668         if (in_interrupt())
3669                 atomic_set(&bus->ipend, 1);
3670         else
3671                 if (brcmf_sdio_intr_rstatus(bus)) {
3672                         brcmf_err("failed backplane access\n");
3673                 }
3674
3675         /* Disable additional interrupts (is this needed now)? */
3676         if (!bus->intr)
3677                 brcmf_err("isr w/o interrupt configured!\n");
3678
3679         atomic_inc(&bus->dpc_tskcnt);
3680         queue_work(bus->brcmf_wq, &bus->datawork);
3681 }
3682
3683 static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
3684 {
3685 #ifdef DEBUG
3686         struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
3687 #endif  /* DEBUG */
3688
3689         brcmf_dbg(TIMER, "Enter\n");
3690
3691         /* Poll period: check device if appropriate. */
3692         if (!bus->sr_enabled &&
3693             bus->poll && (++bus->polltick >= bus->pollrate)) {
3694                 u32 intstatus = 0;
3695
3696                 /* Reset poll tick */
3697                 bus->polltick = 0;
3698
3699                 /* Check device if no interrupts */
3700                 if (!bus->intr ||
3701                     (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
3702
3703                         if (atomic_read(&bus->dpc_tskcnt) == 0) {
3704                                 u8 devpend;
3705
3706                                 sdio_claim_host(bus->sdiodev->func[1]);
3707                                 devpend = brcmf_sdiod_regrb(bus->sdiodev,
3708                                                             SDIO_CCCR_INTx,
3709                                                             NULL);
3710                                 sdio_release_host(bus->sdiodev->func[1]);
3711                                 intstatus =
3712                                     devpend & (INTR_STATUS_FUNC1 |
3713                                                INTR_STATUS_FUNC2);
3714                         }
3715
3716                         /* If there is something, make like the ISR and
3717                                  schedule the DPC */
3718                         if (intstatus) {
3719                                 bus->sdcnt.pollcnt++;
3720                                 atomic_set(&bus->ipend, 1);
3721
3722                                 atomic_inc(&bus->dpc_tskcnt);
3723                                 queue_work(bus->brcmf_wq, &bus->datawork);
3724                         }
3725                 }
3726
3727                 /* Update interrupt tracking */
3728                 bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
3729         }
3730 #ifdef DEBUG
3731         /* Poll for console output periodically */
3732         if (bus_if && bus_if->state == BRCMF_BUS_DATA &&
3733             bus->console_interval != 0) {
3734                 bus->console.count += BRCMF_WD_POLL_MS;
3735                 if (bus->console.count >= bus->console_interval) {
3736                         bus->console.count -= bus->console_interval;
3737                         sdio_claim_host(bus->sdiodev->func[1]);
3738                         /* Make sure backplane clock is on */
3739                         brcmf_sdio_bus_sleep(bus, false, false);
3740                         if (brcmf_sdio_readconsole(bus) < 0)
3741                                 /* stop on error */
3742                                 bus->console_interval = 0;
3743                         sdio_release_host(bus->sdiodev->func[1]);
3744                 }
3745         }
3746 #endif                          /* DEBUG */
3747
3748         /* On idle timeout clear activity flag and/or turn off clock */
3749         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3750                 if (++bus->idlecount >= bus->idletime) {
3751                         bus->idlecount = 0;
3752                         if (bus->activity) {
3753                                 bus->activity = false;
3754                                 brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
3755                         } else {
3756                                 brcmf_dbg(SDIO, "idle\n");
3757                                 sdio_claim_host(bus->sdiodev->func[1]);
3758                                 brcmf_sdio_bus_sleep(bus, true, false);
3759                                 sdio_release_host(bus->sdiodev->func[1]);
3760                         }
3761                 }
3762         }
3763
3764         return (atomic_read(&bus->ipend) > 0);
3765 }
3766
3767 static void brcmf_sdio_dataworker(struct work_struct *work)
3768 {
3769         struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
3770                                               datawork);
3771
3772         while (atomic_read(&bus->dpc_tskcnt)) {
3773                 brcmf_sdio_dpc(bus);
3774                 atomic_dec(&bus->dpc_tskcnt);
3775         }
3776 }
3777
3778 static char *brcmf_sdio_chip_name(uint chipid, char *buf, uint len)
3779 {
3780         const char *fmt;
3781
3782         fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
3783         snprintf(buf, len, fmt, chipid);
3784         return buf;
3785 }
3786
3787 static void
3788 brcmf_sdio_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
3789                                   struct brcmf_chip *ci, u32 drivestrength)
3790 {
3791         const struct sdiod_drive_str *str_tab = NULL;
3792         u32 str_mask;
3793         u32 str_shift;
3794         char chn[8];
3795         u32 base = ci->c_inf[0].base;
3796         u32 i;
3797         u32 drivestrength_sel = 0;
3798         u32 cc_data_temp;
3799         u32 addr;
3800
3801         if (!(ci->c_inf[0].caps & CC_CAP_PMU))
3802                 return;
3803
3804         switch (SDIOD_DRVSTR_KEY(ci->chip, ci->pmurev)) {
3805         case SDIOD_DRVSTR_KEY(BCM4330_CHIP_ID, 12):
3806                 str_tab = sdiod_drvstr_tab1_1v8;
3807                 str_mask = 0x00003800;
3808                 str_shift = 11;
3809                 break;
3810         case SDIOD_DRVSTR_KEY(BCM4334_CHIP_ID, 17):
3811                 str_tab = sdiod_drvstr_tab6_1v8;
3812                 str_mask = 0x00001800;
3813                 str_shift = 11;
3814                 break;
3815         case SDIOD_DRVSTR_KEY(BCM43143_CHIP_ID, 17):
3816                 /* note: 43143 does not support tristate */
3817                 i = ARRAY_SIZE(sdiod_drvstr_tab2_3v3) - 1;
3818                 if (drivestrength >= sdiod_drvstr_tab2_3v3[i].strength) {
3819                         str_tab = sdiod_drvstr_tab2_3v3;
3820                         str_mask = 0x00000007;
3821                         str_shift = 0;
3822                 } else
3823                         brcmf_err("Invalid SDIO Drive strength for chip %s, strength=%d\n",
3824                                   brcmf_sdio_chip_name(ci->chip, chn, 8),
3825                                   drivestrength);
3826                 break;
3827         case SDIOD_DRVSTR_KEY(BCM43362_CHIP_ID, 13):
3828                 str_tab = sdiod_drive_strength_tab5_1v8;
3829                 str_mask = 0x00003800;
3830                 str_shift = 11;
3831                 break;
3832         default:
3833                 brcmf_err("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
3834                           brcmf_sdio_chip_name(ci->chip, chn, 8),
3835                           ci->chiprev, ci->pmurev);
3836                 break;
3837         }
3838
3839         if (str_tab != NULL) {
3840                 for (i = 0; str_tab[i].strength != 0; i++) {
3841                         if (drivestrength >= str_tab[i].strength) {
3842                                 drivestrength_sel = str_tab[i].sel;
3843                                 break;
3844                         }
3845                 }
3846                 addr = CORE_CC_REG(base, chipcontrol_addr);
3847                 brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
3848                 cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
3849                 cc_data_temp &= ~str_mask;
3850                 drivestrength_sel <<= str_shift;
3851                 cc_data_temp |= drivestrength_sel;
3852                 brcmf_sdiod_regwl(sdiodev, addr, cc_data_temp, NULL);
3853
3854                 brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
3855                           str_tab[i].strength, drivestrength, cc_data_temp);
3856         }
3857 }
3858
3859 int brcmf_sdio_buscoreprep(struct brcmf_sdio_dev *sdiodev)
3860 {
3861         int err = 0;
3862         u8 clkval, clkset;
3863
3864         /* Try forcing SDIO core to do ALPAvail request only */
3865         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
3866         brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
3867         if (err) {
3868                 brcmf_err("error writing for HT off\n");
3869                 return err;
3870         }
3871
3872         /* If register supported, wait for ALPAvail and then force ALP */
3873         /* This may take up to 15 milliseconds */
3874         clkval = brcmf_sdiod_regrb(sdiodev,
3875                                    SBSDIO_FUNC1_CHIPCLKCSR, NULL);
3876
3877         if ((clkval & ~SBSDIO_AVBITS) != clkset) {
3878                 brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
3879                           clkset, clkval);
3880                 return -EACCES;
3881         }
3882
3883         SPINWAIT(((clkval = brcmf_sdiod_regrb(sdiodev,
3884                                               SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
3885                         !SBSDIO_ALPAV(clkval)),
3886                         PMU_MAX_TRANSITION_DLY);
3887         if (!SBSDIO_ALPAV(clkval)) {
3888                 brcmf_err("timeout on ALPAV wait, clkval 0x%02x\n",
3889                           clkval);
3890                 return -EBUSY;
3891         }
3892
3893         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
3894         brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
3895         udelay(65);
3896
3897         /* Also, disable the extra SDIO pull-ups */
3898         brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
3899
3900         return 0;
3901 }
3902
3903 static bool
3904 brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
3905 {
3906         u8 clkctl = 0;
3907         int err = 0;
3908         int reg_addr;
3909         u32 reg_val;
3910         u32 drivestrength;
3911
3912         sdio_claim_host(bus->sdiodev->func[1]);
3913
3914         pr_debug("F1 signature read @0x18000000=0x%4x\n",
3915                  brcmf_sdiod_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
3916
3917         /*
3918          * Force PLL off until brcmf_sdio_chip_attach()
3919          * programs PLL control regs
3920          */
3921
3922         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3923                           BRCMF_INIT_CLKCTL1, &err);
3924         if (!err)
3925                 clkctl = brcmf_sdiod_regrb(bus->sdiodev,
3926                                            SBSDIO_FUNC1_CHIPCLKCSR, &err);
3927
3928         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3929                 brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3930                           err, BRCMF_INIT_CLKCTL1, clkctl);
3931                 goto fail;
3932         }
3933
3934         /* SDIO register access works so moving
3935          * state from UNKNOWN to DOWN.
3936          */
3937         brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_DOWN);
3938
3939         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci)) {
3940                 brcmf_err("brcmf_sdio_chip_attach failed!\n");
3941                 goto fail;
3942         }
3943
3944         if (brcmf_sdio_kso_init(bus)) {
3945                 brcmf_err("error enabling KSO\n");
3946                 goto fail;
3947         }
3948
3949         if ((bus->sdiodev->pdata) && (bus->sdiodev->pdata->drive_strength))
3950                 drivestrength = bus->sdiodev->pdata->drive_strength;
3951         else
3952                 drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
3953         brcmf_sdio_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
3954
3955         /* Get info on the SOCRAM cores... */
3956         bus->ramsize = bus->ci->ramsize;
3957         if (!(bus->ramsize)) {
3958                 brcmf_err("failed to find SOCRAM memory!\n");
3959                 goto fail;
3960         }
3961
3962         /* Set card control so an SDIO card reset does a WLAN backplane reset */
3963         reg_val = brcmf_sdiod_regrb(bus->sdiodev,
3964                                     SDIO_CCCR_BRCM_CARDCTRL, &err);
3965         if (err)
3966                 goto fail;
3967
3968         reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
3969
3970         brcmf_sdiod_regwb(bus->sdiodev,
3971                           SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
3972         if (err)
3973                 goto fail;
3974
3975         /* set PMUControl so a backplane reset does PMU state reload */
3976         reg_addr = CORE_CC_REG(bus->ci->c_inf[0].base,
3977                                pmucontrol);
3978         reg_val = brcmf_sdiod_regrl(bus->sdiodev,
3979                                     reg_addr,
3980                                     &err);
3981         if (err)
3982                 goto fail;
3983
3984         reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
3985
3986         brcmf_sdiod_regwl(bus->sdiodev,
3987                           reg_addr,
3988                           reg_val,
3989                           &err);
3990         if (err)
3991                 goto fail;
3992
3993
3994         sdio_release_host(bus->sdiodev->func[1]);
3995
3996         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3997
3998         /* allocate header buffer */
3999         bus->hdrbuf = kzalloc(MAX_HDR_READ + bus->head_align, GFP_KERNEL);
4000         if (!bus->hdrbuf)
4001                 return false;
4002         /* Locate an appropriately-aligned portion of hdrbuf */
4003         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
4004                                     bus->head_align);
4005
4006         /* Set the poll and/or interrupt flags */
4007         bus->intr = true;
4008         bus->poll = false;
4009         if (bus->poll)
4010                 bus->pollrate = 1;
4011
4012         return true;
4013
4014 fail:
4015         sdio_release_host(bus->sdiodev->func[1]);
4016         return false;
4017 }
4018
4019 static int
4020 brcmf_sdio_watchdog_thread(void *data)
4021 {
4022         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
4023
4024         allow_signal(SIGTERM);
4025         /* Run until signal received */
4026         while (1) {
4027                 if (kthread_should_stop())
4028                         break;
4029                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
4030                         brcmf_sdio_bus_watchdog(bus);
4031                         /* Count the tick for reference */
4032                         bus->sdcnt.tickcnt++;
4033                 } else
4034                         break;
4035         }
4036         return 0;
4037 }
4038
4039 static void
4040 brcmf_sdio_watchdog(unsigned long data)
4041 {
4042         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
4043
4044         if (bus->watchdog_tsk) {
4045                 complete(&bus->watchdog_wait);
4046                 /* Reschedule the watchdog */
4047                 if (bus->wd_timer_valid)
4048                         mod_timer(&bus->timer,
4049                                   jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4050         }
4051 }
4052
4053 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
4054         .stop = brcmf_sdio_bus_stop,
4055         .preinit = brcmf_sdio_bus_preinit,
4056         .init = brcmf_sdio_bus_init,
4057         .txdata = brcmf_sdio_bus_txdata,
4058         .txctl = brcmf_sdio_bus_txctl,
4059         .rxctl = brcmf_sdio_bus_rxctl,
4060         .gettxq = brcmf_sdio_bus_gettxq,
4061 };
4062
4063 struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
4064 {
4065         int ret;
4066         struct brcmf_sdio *bus;
4067
4068         brcmf_dbg(TRACE, "Enter\n");
4069
4070         /* Allocate private bus interface state */
4071         bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
4072         if (!bus)
4073                 goto fail;
4074
4075         bus->sdiodev = sdiodev;
4076         sdiodev->bus = bus;
4077         skb_queue_head_init(&bus->glom);
4078         bus->txbound = BRCMF_TXBOUND;
4079         bus->rxbound = BRCMF_RXBOUND;
4080         bus->txminmax = BRCMF_TXMINMAX;
4081         bus->tx_seq = SDPCM_SEQ_WRAP - 1;
4082
4083         /* platform specific configuration:
4084          *   alignments must be at least 4 bytes for ADMA
4085          */
4086         bus->head_align = ALIGNMENT;
4087         bus->sgentry_align = ALIGNMENT;
4088         if (sdiodev->pdata) {
4089                 if (sdiodev->pdata->sd_head_align > ALIGNMENT)
4090                         bus->head_align = sdiodev->pdata->sd_head_align;
4091                 if (sdiodev->pdata->sd_sgentry_align > ALIGNMENT)
4092                         bus->sgentry_align = sdiodev->pdata->sd_sgentry_align;
4093         }
4094
4095         INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
4096         bus->brcmf_wq = create_singlethread_workqueue("brcmf_wq");
4097         if (bus->brcmf_wq == NULL) {
4098                 brcmf_err("insufficient memory to create txworkqueue\n");
4099                 goto fail;
4100         }
4101
4102         /* attempt to attach to the dongle */
4103         if (!(brcmf_sdio_probe_attach(bus))) {
4104                 brcmf_err("brcmf_sdio_probe_attach failed\n");
4105                 goto fail;
4106         }
4107
4108         spin_lock_init(&bus->rxctl_lock);
4109         spin_lock_init(&bus->txqlock);
4110         init_waitqueue_head(&bus->ctrl_wait);
4111         init_waitqueue_head(&bus->dcmd_resp_wait);
4112
4113         /* Set up the watchdog timer */
4114         init_timer(&bus->timer);
4115         bus->timer.data = (unsigned long)bus;
4116         bus->timer.function = brcmf_sdio_watchdog;
4117
4118         /* Initialize watchdog thread */
4119         init_completion(&bus->watchdog_wait);
4120         bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
4121                                         bus, "brcmf_watchdog");
4122         if (IS_ERR(bus->watchdog_tsk)) {
4123                 pr_warn("brcmf_watchdog thread failed to start\n");
4124                 bus->watchdog_tsk = NULL;
4125         }
4126         /* Initialize DPC thread */
4127         atomic_set(&bus->dpc_tskcnt, 0);
4128
4129         /* Assign bus interface call back */
4130         bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
4131         bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
4132         bus->sdiodev->bus_if->chip = bus->ci->chip;
4133         bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
4134
4135         /* default sdio bus header length for tx packet */
4136         bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
4137
4138         /* Attach to the common layer, reserve hdr space */
4139         ret = brcmf_attach(bus->sdiodev->dev);
4140         if (ret != 0) {
4141                 brcmf_err("brcmf_attach failed\n");
4142                 goto fail;
4143         }
4144
4145         /* Allocate buffers */
4146         if (bus->sdiodev->bus_if->maxctl) {
4147                 bus->rxblen =
4148                     roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
4149                             ALIGNMENT) + bus->head_align;
4150                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
4151                 if (!(bus->rxbuf)) {
4152                         brcmf_err("rxbuf allocation failed\n");
4153                         goto fail;
4154                 }
4155         }
4156
4157         sdio_claim_host(bus->sdiodev->func[1]);
4158
4159         /* Disable F2 to clear any intermediate frame state on the dongle */
4160         sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
4161
4162         bus->rxflow = false;
4163
4164         /* Done with backplane-dependent accesses, can drop clock... */
4165         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
4166
4167         sdio_release_host(bus->sdiodev->func[1]);
4168
4169         /* ...and initialize clock/power states */
4170         bus->clkstate = CLK_SDONLY;
4171         bus->idletime = BRCMF_IDLE_INTERVAL;
4172         bus->idleclock = BRCMF_IDLE_ACTIVE;
4173
4174         /* Query the F2 block size, set roundup accordingly */
4175         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
4176         bus->roundup = min(max_roundup, bus->blocksize);
4177
4178         /* SR state */
4179         bus->sleeping = false;
4180         bus->sr_enabled = false;
4181
4182         brcmf_sdio_debugfs_create(bus);
4183         brcmf_dbg(INFO, "completed!!\n");
4184
4185         /* if firmware path present try to download and bring up bus */
4186         ret = brcmf_bus_start(bus->sdiodev->dev);
4187         if (ret != 0) {
4188                 brcmf_err("dongle is not responding\n");
4189                 goto fail;
4190         }
4191
4192         return bus;
4193
4194 fail:
4195         brcmf_sdio_remove(bus);
4196         return NULL;
4197 }
4198
4199 /* Detach and free everything */
4200 void brcmf_sdio_remove(struct brcmf_sdio *bus)
4201 {
4202         brcmf_dbg(TRACE, "Enter\n");
4203
4204         if (bus) {
4205                 /* De-register interrupt handler */
4206                 brcmf_sdiod_intr_unregister(bus->sdiodev);
4207
4208                 cancel_work_sync(&bus->datawork);
4209                 if (bus->brcmf_wq)
4210                         destroy_workqueue(bus->brcmf_wq);
4211
4212                 if (bus->sdiodev->bus_if->drvr) {
4213                         brcmf_detach(bus->sdiodev->dev);
4214                 }
4215
4216                 if (bus->ci) {
4217                         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
4218                                 sdio_claim_host(bus->sdiodev->func[1]);
4219                                 brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
4220                                 /* Leave the device in state where it is
4221                                  * 'quiet'. This is done by putting it in
4222                                  * download_state which essentially resets
4223                                  * all necessary cores.
4224                                  */
4225                                 msleep(20);
4226                                 brcmf_sdio_chip_enter_download(bus->sdiodev,
4227                                                                bus->ci);
4228                                 brcmf_sdio_clkctl(bus, CLK_NONE, false);
4229                                 sdio_release_host(bus->sdiodev->func[1]);
4230                         }
4231                         brcmf_sdio_chip_detach(&bus->ci);
4232                 }
4233
4234                 brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
4235                 kfree(bus->rxbuf);
4236                 kfree(bus->hdrbuf);
4237                 kfree(bus);
4238         }
4239
4240         brcmf_dbg(TRACE, "Disconnected\n");
4241 }
4242
4243 void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick)
4244 {
4245         /* Totally stop the timer */
4246         if (!wdtick && bus->wd_timer_valid) {
4247                 del_timer_sync(&bus->timer);
4248                 bus->wd_timer_valid = false;
4249                 bus->save_ms = wdtick;
4250                 return;
4251         }
4252
4253         /* don't start the wd until fw is loaded */
4254         if (bus->sdiodev->bus_if->state != BRCMF_BUS_DATA)
4255                 return;
4256
4257         if (wdtick) {
4258                 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4259                         if (bus->wd_timer_valid)
4260                                 /* Stop timer and restart at new value */
4261                                 del_timer_sync(&bus->timer);
4262
4263                         /* Create timer again when watchdog period is
4264                            dynamically changed or in the first instance
4265                          */
4266                         bus->timer.expires =
4267                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4268                         add_timer(&bus->timer);
4269
4270                 } else {
4271                         /* Re arm the timer, at last watchdog period */
4272                         mod_timer(&bus->timer,
4273                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4274                 }
4275
4276                 bus->wd_timer_valid = true;
4277                 bus->save_ms = wdtick;
4278         }
4279 }