drivers/staging/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <asm/unaligned.h>
  31 #include <defs.h>
  32 #include <brcmu_wifi.h>
  33 #include <brcmu_utils.h>
  34 #include <brcm_hw_ids.h>
  35 #include <soc.h>
  36 #include "sdio_host.h"
  37
  38 #ifdef BCMDBG
  39
  40 /* ARM trap handling */
  41 struct brcmf_trap {
  42         u32 type;
  43         u32 epc;
  44         u32 cpsr;
  45         u32 spsr;
  46         u32 r0;
  47         u32 r1;
  48         u32 r2;
  49         u32 r3;
  50         u32 r4;
  51         u32 r5;
  52         u32 r6;
  53         u32 r7;
  54         u32 r8;
  55         u32 r9;
  56         u32 r10;
  57         u32 r11;
  58         u32 r12;
  59         u32 r13;
  60         u32 r14;
  61         u32 pc;
  62 };
  63
  64 #define CBUF_LEN        (128)
  65
  66 struct rte_log {
  67         u32 buf;                /* Can't be pointer on (64-bit) hosts */
  68         uint buf_size;
  69         uint idx;
  70         char *_buf_compat;      /* Redundant pointer for backward compat. */
  71 };
  72
  73 struct rte_console {
  74         /* Virtual UART
  75          * When there is no UART (e.g. Quickturn),
  76          * the host should write a complete
  77          * input line directly into cbuf and then write
  78          * the length into vcons_in.
  79          * This may also be used when there is a real UART
  80          * (at risk of conflicting with
  81          * the real UART).  vcons_out is currently unused.
  82          */
  83         uint vcons_in;
  84         uint vcons_out;
  85
  86         /* Output (logging) buffer
  87          * Console output is written to a ring buffer log_buf at index log_idx.
  88          * The host may read the output when it sees log_idx advance.
  89          * Output will be lost if the output wraps around faster than the host
  90          * polls.
  91          */
  92         struct rte_log log;
  93
  94         /* Console input line buffer
  95          * Characters are read one at a time into cbuf
  96          * until <CR> is received, then
  97          * the buffer is processed as a command line.
  98          * Also used for virtual UART.
  99          */
 100         uint cbuf_idx;
 101         char cbuf[CBUF_LEN];
 102 };
 103
 104 #endif                          /* BCMDBG */
 105 #include <chipcommon.h>
 106
 107 #include "dhd.h"
 108 #include "dhd_bus.h"
 109 #include "dhd_proto.h"
 110 #include "dhd_dbg.h"
 111 #include <bcmchip.h>
 112
 113 #define TXQLEN          2048    /* bulk tx queue length */
 114 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 115 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 116 #define PRIOMASK        7
 117
 118 #define TXRETRIES       2       /* # of retries for tx frames */
 119
 120 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 121                                  one scheduling */
 122
 123 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 124                                  one scheduling */
 125
 126 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 127
 128 #define MEMBLOCK        2048    /* Block size used for downloading
 129                                  of dongle image */
 130 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 131                                  biggest possible glom */
 132
 133 #define BRCMF_FIRSTREAD (1 << 6)
 134
 135
 136 /* SBSDIO_DEVICE_CTL */
 137
 138 /* 1: device will assert busy signal when receiving CMD53 */
 139 #define SBSDIO_DEVCTL_SETBUSY           0x01
 140 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 141 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 142 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 143 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 144 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 145  * sdio bus power cycle to clear (rev 9) */
 146 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 147 /* Force SD->SB reset mapping (rev 11) */
 148 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 149 /*   Determined by CoreControl bit */
 150 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 151 /*   Force backplane reset */
 152 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 153 /*   Force no backplane reset */
 154 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 155
 156 /* SBSDIO_FUNC1_CHIPCLKCSR */
 157
 158 /* Force ALP request to backplane */
 159 #define SBSDIO_FORCE_ALP                0x01
 160 /* Force HT request to backplane */
 161 #define SBSDIO_FORCE_HT                 0x02
 162 /* Force ILP request to backplane */
 163 #define SBSDIO_FORCE_ILP                0x04
 164 /* Make ALP ready (power up xtal) */
 165 #define SBSDIO_ALP_AVAIL_REQ            0x08
 166 /* Make HT ready (power up PLL) */
 167 #define SBSDIO_HT_AVAIL_REQ             0x10
 168 /* Squelch clock requests from HW */
 169 #define SBSDIO_FORCE_HW_CLKREQ_OFF      0x20
 170 /* Status: ALP is ready */
 171 #define SBSDIO_ALP_AVAIL                0x40
 172 /* Status: HT is ready */
 173 #define SBSDIO_HT_AVAIL                 0x80
 174
 175 #define SBSDIO_AVBITS           (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
 176 #define SBSDIO_ALPAV(regval)    ((regval) & SBSDIO_AVBITS)
 177 #define SBSDIO_HTAV(regval)     (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
 178 #define SBSDIO_ALPONLY(regval)  (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
 179
 180 #define SBSDIO_CLKAV(regval, alponly) \
 181         (SBSDIO_ALPAV(regval) && (alponly ? 1 : SBSDIO_HTAV(regval)))
 182
 183 /* direct(mapped) cis space */
 184
 185 /* MAPPED common CIS address */
 186 #define SBSDIO_CIS_BASE_COMMON          0x1000
 187 /* maximum bytes in one CIS */
 188 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 189 /* cis offset addr is < 17 bits */
 190 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 191
 192 /* manfid tuple length, include tuple, link bytes */
 193 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 194
 195 /* intstatus */
 196 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 197 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 198 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 199 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 200 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 201 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 202 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 203 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 204 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 205 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 206 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 207 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 208 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 209 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 210 #define I_PC            (1 << 10)       /* descriptor error */
 211 #define I_PD            (1 << 11)       /* data error */
 212 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 213 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 214 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 215 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 216 #define I_RI            (1 << 16)       /* Receive Interrupt */
 217 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 218 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 219 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 220 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 221 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 222 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 223 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 224 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 225 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 226 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 227 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 228 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 229
 230 /* corecontrol */
 231 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 232 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 233 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 234 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 235 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 236 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 237
 238 /* SDA_FRAMECTRL */
 239 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 240 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 241 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 242 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 243
 244 /* HW frame tag */
 245 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 246
 247 /* Total length of frame header for dongle protocol */
 248 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 249 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 250
 251 /*
 252  * Software allocation of To SB Mailbox resources
 253  */
 254
 255 /* tosbmailbox bits corresponding to intstatus bits */
 256 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 257 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 258 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 259 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 260
 261 /* tosbmailboxdata */
 262 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 263
 264 /*
 265  * Software allocation of To Host Mailbox resources
 266  */
 267
 268 /* intstatus bits */
 269 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 270 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 271 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 272 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 273
 274 /* tohostmailboxdata */
 275 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 276 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 277 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 278 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 279
 280 #define HMB_DATA_FCDATA_MASK    0xff000000
 281 #define HMB_DATA_FCDATA_SHIFT   24
 282
 283 #define HMB_DATA_VERSION_MASK   0x00ff0000
 284 #define HMB_DATA_VERSION_SHIFT  16
 285
 286 /*
 287  * Software-defined protocol header
 288  */
 289
 290 /* Current protocol version */
 291 #define SDPCM_PROT_VERSION      4
 292
 293 /* SW frame header */
 294 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 295
 296 #define SDPCM_CHANNEL_MASK              0x00000f00
 297 #define SDPCM_CHANNEL_SHIFT             8
 298 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 299
 300 #define SDPCM_NEXTLEN_OFFSET            2
 301
 302 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 303 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 304 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 305 #define SDPCM_DOFFSET_MASK              0xff000000
 306 #define SDPCM_DOFFSET_SHIFT             24
 307 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 308 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 309 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 310 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 311
 312 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 313
 314 /* logical channel numbers */
 315 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 316 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 317 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 318 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 319 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 320
 321 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 322
 323 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 324
 325 /*
 326  * Shared structure between dongle and the host.
 327  * The structure contains pointers to trap or assert information.
 328  */
 329 #define SDPCM_SHARED_VERSION       0x0002
 330 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 331 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 332 #define SDPCM_SHARED_ASSERT        0x0200
 333 #define SDPCM_SHARED_TRAP          0x0400
 334
 335 /* Space for header read, limit for data packets */
 336 #define MAX_HDR_READ    (1 << 6)
 337 #define MAX_RX_DATASZ   2048
 338
 339 /* Maximum milliseconds to wait for F2 to come up */
 340 #define BRCMF_WAIT_F2RDY        3000
 341
 342 /* Bump up limit on waiting for HT to account for first startup;
 343  * if the image is doing a CRC calculation before programming the PMU
 344  * for HT availability, it could take a couple hundred ms more, so
 345  * max out at a 1 second (1000000us).
 346  */
 347 #undef PMU_MAX_TRANSITION_DLY
 348 #define PMU_MAX_TRANSITION_DLY 1000000
 349
 350 /* Value for ChipClockCSR during initial setup */
 351 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 352                                         SBSDIO_ALP_AVAIL_REQ)
 353
 354 /* Flags for SDH calls */
 355 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 356
 357 /* sbimstate */
 358 #define SBIM_IBE                0x20000 /* inbanderror */
 359 #define SBIM_TO                 0x40000 /* timeout */
 360 #define SBIM_BY                 0x01800000      /* busy (sonics >= 2.3) */
 361 #define SBIM_RJ                 0x02000000      /* reject (sonics >= 2.3) */
 362
 363 /* sbtmstatelow */
 364
 365 /* reset */
 366 #define SBTML_RESET             0x0001
 367 /* reject field */
 368 #define SBTML_REJ_MASK          0x0006
 369 /* reject */
 370 #define SBTML_REJ               0x0002
 371 /* temporary reject, for error recovery */
 372 #define SBTML_TMPREJ            0x0004
 373
 374 /* Shift to locate the SI control flags in sbtml */
 375 #define SBTML_SICF_SHIFT        16
 376
 377 /* sbtmstatehigh */
 378 #define SBTMH_SERR              0x0001  /* serror */
 379 #define SBTMH_INT               0x0002  /* interrupt */
 380 #define SBTMH_BUSY              0x0004  /* busy */
 381 #define SBTMH_TO                0x0020  /* timeout (sonics >= 2.3) */
 382
 383 /* Shift to locate the SI status flags in sbtmh */
 384 #define SBTMH_SISF_SHIFT        16
 385
 386 /* sbidlow */
 387 #define SBIDL_INIT              0x80    /* initiator */
 388
 389 /* sbidhigh */
 390 #define SBIDH_RC_MASK           0x000f  /* revision code */
 391 #define SBIDH_RCE_MASK          0x7000  /* revision code extension field */
 392 #define SBIDH_RCE_SHIFT         8
 393 #define SBCOREREV(sbidh) \
 394         ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | \
 395           ((sbidh) & SBIDH_RC_MASK))
 396 #define SBIDH_CC_MASK           0x8ff0  /* core code */
 397 #define SBIDH_CC_SHIFT          4
 398 #define SBIDH_VC_MASK           0xffff0000      /* vendor code */
 399 #define SBIDH_VC_SHIFT          16
 400
 401 /*
 402  * Conversion of 802.1D priority to precedence level
 403  */
 404 static uint prio2prec(u32 prio)
 405 {
 406         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 407                (prio^2) : prio;
 408 }
 409
 410 /*
 411  * Core reg address translation.
 412  * Both macro's returns a 32 bits byte address on the backplane bus.
 413  */
 414 #define CORE_CC_REG(base, field) \
 415                 (base + offsetof(struct chipcregs, field))
 416 #define CORE_BUS_REG(base, field) \
 417                 (base + offsetof(struct sdpcmd_regs, field))
 418 #define CORE_SB(base, field) \
 419                 (base + SBCONFIGOFF + offsetof(struct sbconfig, field))
 420
 421 /* core registers */
 422 struct sdpcmd_regs {
 423         u32 corecontrol;                /* 0x00, rev8 */
 424         u32 corestatus;                 /* rev8 */
 425         u32 PAD[1];
 426         u32 biststatus;                 /* rev8 */
 427
 428         /* PCMCIA access */
 429         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 430         u16 PAD[1];
 431         u16 pcmciamesportalmask;        /* rev8 */
 432         u16 PAD[1];
 433         u16 pcmciawrframebc;            /* rev8 */
 434         u16 PAD[1];
 435         u16 pcmciaunderflowtimer;       /* rev8 */
 436         u16 PAD[1];
 437
 438         /* interrupt */
 439         u32 intstatus;                  /* 0x020, rev8 */
 440         u32 hostintmask;                /* rev8 */
 441         u32 intmask;                    /* rev8 */
 442         u32 sbintstatus;                /* rev8 */
 443         u32 sbintmask;                  /* rev8 */
 444         u32 funcintmask;                /* rev4 */
 445         u32 PAD[2];
 446         u32 tosbmailbox;                /* 0x040, rev8 */
 447         u32 tohostmailbox;              /* rev8 */
 448         u32 tosbmailboxdata;            /* rev8 */
 449         u32 tohostmailboxdata;          /* rev8 */
 450
 451         /* synchronized access to registers in SDIO clock domain */
 452         u32 sdioaccess;                 /* 0x050, rev8 */
 453         u32 PAD[3];
 454
 455         /* PCMCIA frame control */
 456         u8 pcmciaframectrl;             /* 0x060, rev8 */
 457         u8 PAD[3];
 458         u8 pcmciawatermark;             /* rev8 */
 459         u8 PAD[155];
 460
 461         /* interrupt batching control */
 462         u32 intrcvlazy;                 /* 0x100, rev8 */
 463         u32 PAD[3];
 464
 465         /* counters */
 466         u32 cmd52rd;                    /* 0x110, rev8 */
 467         u32 cmd52wr;                    /* rev8 */
 468         u32 cmd53rd;                    /* rev8 */
 469         u32 cmd53wr;                    /* rev8 */
 470         u32 abort;                      /* rev8 */
 471         u32 datacrcerror;               /* rev8 */
 472         u32 rdoutofsync;                /* rev8 */
 473         u32 wroutofsync;                /* rev8 */
 474         u32 writebusy;                  /* rev8 */
 475         u32 readwait;                   /* rev8 */
 476         u32 readterm;                   /* rev8 */
 477         u32 writeterm;                  /* rev8 */
 478         u32 PAD[40];
 479         u32 clockctlstatus;             /* rev8 */
 480         u32 PAD[7];
 481
 482         u32 PAD[128];                   /* DMA engines */
 483
 484         /* SDIO/PCMCIA CIS region */
 485         char cis[512];                  /* 0x400-0x5ff, rev6 */
 486
 487         /* PCMCIA function control registers */
 488         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 489         u16 PAD[55];
 490
 491         /* PCMCIA backplane access */
 492         u16 backplanecsr;               /* 0x76E, rev6 */
 493         u16 backplaneaddr0;             /* rev6 */
 494         u16 backplaneaddr1;             /* rev6 */
 495         u16 backplaneaddr2;             /* rev6 */
 496         u16 backplaneaddr3;             /* rev6 */
 497         u16 backplanedata0;             /* rev6 */
 498         u16 backplanedata1;             /* rev6 */
 499         u16 backplanedata2;             /* rev6 */
 500         u16 backplanedata3;             /* rev6 */
 501         u16 PAD[31];
 502
 503         /* sprom "size" & "blank" info */
 504         u16 spromstatus;                /* 0x7BE, rev2 */
 505         u32 PAD[464];
 506
 507         u16 PAD[0x80];
 508 };
 509
 510 #ifdef BCMDBG
 511 /* Device console log buffer state */
 512 struct brcmf_console {
 513         uint count;             /* Poll interval msec counter */
 514         uint log_addr;          /* Log struct address (fixed) */
 515         struct rte_log log;     /* Log struct (host copy) */
 516         uint bufsize;           /* Size of log buffer */
 517         u8 *buf;                /* Log buffer (host copy) */
 518         uint last;              /* Last buffer read index */
 519 };
 520 #endif                          /* BCMDBG */
 521
 522 struct sdpcm_shared {
 523         u32 flags;
 524         u32 trap_addr;
 525         u32 assert_exp_addr;
 526         u32 assert_file_addr;
 527         u32 assert_line;
 528         u32 console_addr;       /* Address of struct rte_console */
 529         u32 msgtrace_addr;
 530         u8 tag[32];
 531 };
 532
 533
 534 /* misc chip info needed by some of the routines */
 535 struct chip_info {
 536         u32 chip;
 537         u32 chiprev;
 538         u32 cccorebase;
 539         u32 ccrev;
 540         u32 cccaps;
 541         u32 buscorebase; /* 32 bits backplane bus address */
 542         u32 buscorerev;
 543         u32 buscoretype;
 544         u32 ramcorebase;
 545         u32 armcorebase;
 546         u32 pmurev;
 547         u32 ramsize;
 548 };
 549
 550 /* Private data for SDIO bus interaction */
 551 struct brcmf_bus {
 552         struct brcmf_pub *drvr;
 553
 554         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 555         struct chip_info *ci;   /* Chip info struct */
 556         char *vars;             /* Variables (from CIS and/or other) */
 557         uint varsz;             /* Size of variables buffer */
 558
 559         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 560         u32 orig_ramsize;       /* Size of RAM in SOCRAM (bytes) */
 561
 562         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 563         u32 intstatus;  /* Intstatus bits (events) pending */
 564         bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
 565         bool fcstate;           /* State of dongle flow-control */
 566
 567         uint blocksize;         /* Block size of SDIO transfers */
 568         uint roundup;           /* Max roundup limit */
 569
 570         struct pktq txq;        /* Queue length used for flow-control */
 571         u8 flowcontrol; /* per prio flow control bitmask */
 572         u8 tx_seq;              /* Transmit sequence number (next) */
 573         u8 tx_max;              /* Maximum transmit sequence allowed */
 574
 575         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 576         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 577         u16 nextlen;            /* Next Read Len from last header */
 578         u8 rx_seq;              /* Receive sequence number (expected) */
 579         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 580
 581         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 582         struct sk_buff *glom;   /* Packet chain for glommed superframe */
 583         uint glomerr;           /* Glom packet read errors */
 584
 585         u8 *rxbuf;              /* Buffer for receiving control packets */
 586         uint rxblen;            /* Allocated length of rxbuf */
 587         u8 *rxctl;              /* Aligned pointer into rxbuf */
 588         u8 *databuf;            /* Buffer for receiving big glom packet */
 589         u8 *dataptr;            /* Aligned pointer into databuf */
 590         uint rxlen;             /* Length of valid data in buffer */
 591
 592         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 593
 594         bool intr;              /* Use interrupts */
 595         bool poll;              /* Use polling */
 596         bool ipend;             /* Device interrupt is pending */
 597         uint intrcount;         /* Count of device interrupt callbacks */
 598         uint lastintrs;         /* Count as of last watchdog timer */
 599         uint spurious;          /* Count of spurious interrupts */
 600         uint pollrate;          /* Ticks between device polls */
 601         uint polltick;          /* Tick counter */
 602         uint pollcnt;           /* Count of active polls */
 603
 604 #ifdef BCMDBG
 605         struct brcmf_console console;   /* Console output polling support */
 606         uint console_addr;      /* Console address from shared struct */
 607 #endif                          /* BCMDBG */
 608
 609         uint regfails;          /* Count of R_REG failures */
 610
 611         uint clkstate;          /* State of sd and backplane clock(s) */
 612         bool activity;          /* Activity flag for clock down */
 613         s32 idletime;           /* Control for activity timeout */
 614         s32 idlecount;  /* Activity timeout counter */
 615         s32 idleclock;  /* How to set bus driver when idle */
 616         s32 sd_rxchain;
 617         bool use_rxchain;       /* If brcmf should use PKT chains */
 618         bool sleeping;          /* Is SDIO bus sleeping? */
 619         bool rxflow_mode;       /* Rx flow control mode */
 620         bool rxflow;            /* Is rx flow control on */
 621         bool alp_only;          /* Don't use HT clock (ALP only) */
 622 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
 623         bool usebufpool;
 624
 625         /* Some additional counters */
 626         uint tx_sderrs;         /* Count of tx attempts with sd errors */
 627         uint fcqueued;          /* Tx packets that got queued */
 628         uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 629         uint rx_toolong;        /* Receive frames too long to receive */
 630         uint rxc_errors;        /* SDIO errors when reading control frames */
 631         uint rx_hdrfail;        /* SDIO errors on header reads */
 632         uint rx_badhdr;         /* Bad received headers (roosync?) */
 633         uint rx_badseq;         /* Mismatched rx sequence number */
 634         uint fc_rcvd;           /* Number of flow-control events received */
 635         uint fc_xoff;           /* Number which turned on flow-control */
 636         uint fc_xon;            /* Number which turned off flow-control */
 637         uint rxglomfail;        /* Failed deglom attempts */
 638         uint rxglomframes;      /* Number of glom frames (superframes) */
 639         uint rxglompkts;        /* Number of packets from glom frames */
 640         uint f2rxhdrs;          /* Number of header reads */
 641         uint f2rxdata;          /* Number of frame data reads */
 642         uint f2txdata;          /* Number of f2 frame writes */
 643         uint f1regdata;         /* Number of f1 register accesses */
 644
 645         u8 *ctrl_frame_buf;
 646         u32 ctrl_frame_len;
 647         bool ctrl_frame_stat;
 648
 649         spinlock_t txqlock;
 650         wait_queue_head_t ctrl_wait;
 651         wait_queue_head_t ioctl_resp_wait;
 652
 653         struct timer_list timer;
 654         struct completion watchdog_wait;
 655         struct task_struct *watchdog_tsk;
 656         bool wd_timer_valid;
 657         uint save_ms;
 658
 659         struct tasklet_struct tasklet;
 660         struct task_struct *dpc_tsk;
 661         struct completion dpc_wait;
 662
 663         bool threads_only;
 664         struct semaphore sdsem;
 665         spinlock_t sdlock;
 666
 667         const char *fw_name;
 668         const struct firmware *firmware;
 669         const char *nv_name;
 670         u32 fw_ptr;
 671 };
 672
 673 struct sbconfig {
 674         u32 PAD[2];
 675         u32 sbipsflag;  /* initiator port ocp slave flag */
 676         u32 PAD[3];
 677         u32 sbtpsflag;  /* target port ocp slave flag */
 678         u32 PAD[11];
 679         u32 sbtmerrloga;        /* (sonics >= 2.3) */
 680         u32 PAD;
 681         u32 sbtmerrlog; /* (sonics >= 2.3) */
 682         u32 PAD[3];
 683         u32 sbadmatch3; /* address match3 */
 684         u32 PAD;
 685         u32 sbadmatch2; /* address match2 */
 686         u32 PAD;
 687         u32 sbadmatch1; /* address match1 */
 688         u32 PAD[7];
 689         u32 sbimstate;  /* initiator agent state */
 690         u32 sbintvec;   /* interrupt mask */
 691         u32 sbtmstatelow;       /* target state */
 692         u32 sbtmstatehigh;      /* target state */
 693         u32 sbbwa0;             /* bandwidth allocation table0 */
 694         u32 PAD;
 695         u32 sbimconfiglow;      /* initiator configuration */
 696         u32 sbimconfighigh;     /* initiator configuration */
 697         u32 sbadmatch0; /* address match0 */
 698         u32 PAD;
 699         u32 sbtmconfiglow;      /* target configuration */
 700         u32 sbtmconfighigh;     /* target configuration */
 701         u32 sbbconfig;  /* broadcast configuration */
 702         u32 PAD;
 703         u32 sbbstate;   /* broadcast state */
 704         u32 PAD[3];
 705         u32 sbactcnfg;  /* activate configuration */
 706         u32 PAD[3];
 707         u32 sbflagst;   /* current sbflags */
 708         u32 PAD[3];
 709         u32 sbidlow;            /* identification */
 710         u32 sbidhigh;   /* identification */
 711 };
 712
 713 /* clkstate */
 714 #define CLK_NONE        0
 715 #define CLK_SDONLY      1
 716 #define CLK_PENDING     2       /* Not used yet */
 717 #define CLK_AVAIL       3
 718
 719 #ifdef BCMDBG
 720 static int qcount[NUMPRIO];
 721 static int tx_packets[NUMPRIO];
 722 #endif                          /* BCMDBG */
 723
 724 /* Deferred transmit */
 725 uint brcmf_deferred_tx = 1;
 726 module_param(brcmf_deferred_tx, uint, 0);
 727
 728 /* Watchdog thread priority, -1 to use kernel timer */
 729 int brcmf_watchdog_prio = 97;
 730 module_param(brcmf_watchdog_prio, int, 0);
 731
 732 /* Watchdog interval */
 733 uint brcmf_watchdog_ms = 10;
 734 module_param(brcmf_watchdog_ms, uint, 0);
 735
 736 /* DPC thread priority, -1 to use tasklet */
 737 int brcmf_dpc_prio = 98;
 738 module_param(brcmf_dpc_prio, int, 0);
 739
 740 #ifdef BCMDBG
 741 /* Console poll interval */
 742 uint brcmf_console_ms;
 743 module_param(brcmf_console_ms, uint, 0);
 744 #endif          /* BCMDBG */
 745
 746 /* Tx/Rx bounds */
 747 uint brcmf_txbound;
 748 uint brcmf_rxbound;
 749 module_param(brcmf_txbound, uint, 0);
 750 module_param(brcmf_rxbound, uint, 0);
 751 static uint brcmf_txminmax;
 752
 753 int brcmf_idletime = 1;
 754 module_param(brcmf_idletime, int, 0);
 755
 756 /* SDIO Drive Strength (in milliamps) */
 757 uint brcmf_sdiod_drive_strength = 6;
 758 module_param(brcmf_sdiod_drive_strength, uint, 0);
 759
 760 /* Use polling */
 761 uint brcmf_poll;
 762 module_param(brcmf_poll, uint, 0);
 763
 764 /* Use interrupts */
 765 uint brcmf_intr = true;
 766 module_param(brcmf_intr, uint, 0);
 767
 768 /* IOCTL response timeout */
 769 static int brcmf_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
 770
 771 /* override the RAM size if possible */
 772 #define DONGLE_MIN_MEMSIZE (128 * 1024)
 773 int brcmf_dongle_memsize;
 774 module_param(brcmf_dongle_memsize, int, 0);
 775
 776 static bool brcmf_alignctl;
 777
 778 static bool retrydata;
 779 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
 780
 781 static const uint firstread = BRCMF_FIRSTREAD;
 782
 783 /* Retry count for register access failures */
 784 static const uint retry_limit = 2;
 785
 786 /* Force even SD lengths (some host controllers mess up on odd bytes) */
 787 static bool forcealign;
 788
 789 #define ALIGNMENT  4
 790
 791 static void pkt_align(struct sk_buff *p, int len, int align)
 792 {
 793         uint datalign;
 794         datalign = (unsigned long)(p->data);
 795         datalign = roundup(datalign, (align)) - datalign;
 796         if (datalign)
 797                 skb_pull(p, datalign);
 798         __skb_trim(p, len);
 799 }
 800
 801 /* Limit on rounding up frames */
 802 static const uint max_roundup = 512;
 803
 804 /* Try doing readahead */
 805 static bool brcmf_readahead;
 806
 807 /* To check if there's window offered */
 808 static bool data_ok(struct brcmf_bus *bus)
 809 {
 810         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 811                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 812 }
 813
 814 /*
 815  * Reads a register in the SDIO hardware block. This block occupies a series of
 816  * adresses on the 32 bit backplane bus.
 817  */
 818 static void
 819 r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
 820 {
 821         *retryvar = 0;
 822         do {
 823                 *regvar = brcmf_sdcard_reg_read(bus->sdiodev,
 824                                 bus->ci->buscorebase + reg_offset, sizeof(u32));
 825         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 826                  (++(*retryvar) <= retry_limit));
 827         if (*retryvar) {
 828                 bus->regfails += (*retryvar-1);
 829                 if (*retryvar > retry_limit) {
 830                         brcmf_dbg(ERROR, "FAILED READ %Xh\n", reg_offset);
 831                         *regvar = 0;
 832                 }
 833         }
 834 }
 835
 836 static void
 837 w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
 838 {
 839         *retryvar = 0;
 840         do {
 841                 brcmf_sdcard_reg_write(bus->sdiodev,
 842                                        bus->ci->buscorebase + reg_offset,
 843                                        sizeof(u32), regval);
 844         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 845                  (++(*retryvar) <= retry_limit));
 846         if (*retryvar) {
 847                 bus->regfails += (*retryvar-1);
 848                 if (*retryvar > retry_limit)
 849                         brcmf_dbg(ERROR, "FAILED REGISTER WRITE %Xh\n",
 850                                   reg_offset);
 851         }
 852 }
 853
 854 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 855
 856 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 857
 858 #ifdef BCMDBG
 859 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size);
 860 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus);
 861 #endif                          /* BCMDBG  */
 862 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter);
 863
 864 static void brcmf_sdbrcm_release(struct brcmf_bus *bus);
 865 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus);
 866 static bool brcmf_sdbrcm_chipmatch(u16 chipid);
 867 static bool brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, u32 regsva);
 868 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus);
 869 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus);
 870 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus);
 871
 872 static uint brcmf_process_nvram_vars(char *varbuf, uint len);
 873
 874 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size);
 875 static int brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn,
 876                                uint flags, u8 *buf, uint nbytes,
 877                                struct sk_buff *pkt);
 878
 879 static bool brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus);
 880 static int  _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus);
 881
 882 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus);
 883 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus);
 884
 885 static void
 886 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_dev *sdiodev, u32 corebase);
 887
 888 static int brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs);
 889
 890 static void
 891 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_dev *sdiodev, u32 corebase);
 892
 893 static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
 894                                         u32 drivestrength);
 895 static void brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus);
 896 static void brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar);
 897 static void brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus);
 898 static void brcmf_sdbrcm_watchdog(unsigned long data);
 899 static int brcmf_sdbrcm_watchdog_thread(void *data);
 900 static int brcmf_sdbrcm_dpc_thread(void *data);
 901 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data);
 902 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus);
 903 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus);
 904 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus);
 905 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus);
 906 static int brcmf_sdbrcm_ioctl_resp_wait(struct brcmf_bus *bus, uint *condition,
 907                                         bool *pending);
 908 static int brcmf_sdbrcm_ioctl_resp_wake(struct brcmf_bus *bus);
 909
 910 /* Packet free applicable unconditionally for sdio and sdspi.
 911  * Conditional if bufpool was present for gspi bus.
 912  */
 913 static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
 914 {
 915         if (bus->usebufpool)
 916                 brcmu_pkt_buf_free_skb(pkt);
 917 }
 918
 919 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size)
 920 {
 921         s32 min_size = DONGLE_MIN_MEMSIZE;
 922         /* Restrict the memsize to user specified limit */
 923         brcmf_dbg(ERROR, "user: Restrict the dongle ram size to %d, min %d\n",
 924                   brcmf_dongle_memsize, min_size);
 925         if ((brcmf_dongle_memsize > min_size) &&
 926             (brcmf_dongle_memsize < (s32) bus->orig_ramsize))
 927                 bus->ramsize = brcmf_dongle_memsize;
 928 }
 929
 930 /* Turn backplane clock on or off */
 931 static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
 932 {
 933         int err;
 934         u8 clkctl, clkreq, devctl;
 935         unsigned long timeout;
 936
 937         brcmf_dbg(TRACE, "Enter\n");
 938
 939         clkctl = 0;
 940
 941         if (on) {
 942                 /* Request HT Avail */
 943                 clkreq =
 944                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 945
 946                 if ((bus->ci->chip == BCM4329_CHIP_ID)
 947                     && (bus->ci->chiprev == 0))
 948                         clkreq |= SBSDIO_FORCE_ALP;
 949
 950                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 951                                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 952                 if (err) {
 953                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 954                         return -EBADE;
 955                 }
 956
 957                 if (pendok && ((bus->ci->buscoretype == PCMCIA_CORE_ID)
 958                                && (bus->ci->buscorerev == 9))) {
 959                         u32 dummy, retries;
 960                         r_sdreg32(bus, &dummy,
 961                                   offsetof(struct sdpcmd_regs, clockctlstatus),
 962                                   &retries);
 963                 }
 964
 965                 /* Check current status */
 966                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 967                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
 968                 if (err) {
 969                         brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
 970                         return -EBADE;
 971                 }
 972
 973                 /* Go to pending and await interrupt if appropriate */
 974                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 975                         /* Allow only clock-available interrupt */
 976                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 977                                         SDIO_FUNC_1,
 978                                         SBSDIO_DEVICE_CTL, &err);
 979                         if (err) {
 980                                 brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
 981                                           err);
 982                                 return -EBADE;
 983                         }
 984
 985                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 986                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 987                                                SBSDIO_DEVICE_CTL, devctl, &err);
 988                         brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
 989                         bus->clkstate = CLK_PENDING;
 990
 991                         return 0;
 992                 } else if (bus->clkstate == CLK_PENDING) {
 993                         /* Cancel CA-only interrupt filter */
 994                         devctl =
 995                             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 996                                                   SBSDIO_DEVICE_CTL, &err);
 997                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 998                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 999                                 SBSDIO_DEVICE_CTL, devctl, &err);
1000                 }
1001
1002                 /* Otherwise, wait here (polling) for HT Avail */
1003                 timeout = jiffies +
1004                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
1005                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
1006                         clkctl = brcmf_sdcard_cfg_read(bus->sdiodev,
1007                                                        SDIO_FUNC_1,
1008                                                        SBSDIO_FUNC1_CHIPCLKCSR,
1009                                                        &err);
1010                         if (time_after(jiffies, timeout))
1011                                 break;
1012                         else
1013                                 usleep_range(5000, 10000);
1014                 }
1015                 if (err) {
1016                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
1017                         return -EBADE;
1018                 }
1019                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
1020                         brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
1021                                   PMU_MAX_TRANSITION_DLY, clkctl);
1022                         return -EBADE;
1023                 }
1024
1025                 /* Mark clock available */
1026                 bus->clkstate = CLK_AVAIL;
1027                 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
1028
1029 #if defined(BCMDBG)
1030                 if (bus->alp_only != true) {
1031                         if (SBSDIO_ALPONLY(clkctl))
1032                                 brcmf_dbg(ERROR, "HT Clock should be on\n");
1033                 }
1034 #endif                          /* defined (BCMDBG) */
1035
1036                 bus->activity = true;
1037         } else {
1038                 clkreq = 0;
1039
1040                 if (bus->clkstate == CLK_PENDING) {
1041                         /* Cancel CA-only interrupt filter */
1042                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
1043                                         SDIO_FUNC_1,
1044                                         SBSDIO_DEVICE_CTL, &err);
1045                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
1046                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1047                                 SBSDIO_DEVICE_CTL, devctl, &err);
1048                 }
1049
1050                 bus->clkstate = CLK_SDONLY;
1051                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1052                         SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
1053                 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
1054                 if (err) {
1055                         brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
1056                                   err);
1057                         return -EBADE;
1058                 }
1059         }
1060         return 0;
1061 }
1062
1063 /* Change idle/active SD state */
1064 static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
1065 {
1066         brcmf_dbg(TRACE, "Enter\n");
1067
1068         if (on)
1069                 bus->clkstate = CLK_SDONLY;
1070         else
1071                 bus->clkstate = CLK_NONE;
1072
1073         return 0;
1074 }
1075
1076 /* Transition SD and backplane clock readiness */
1077 static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
1078 {
1079 #ifdef BCMDBG
1080         uint oldstate = bus->clkstate;
1081 #endif                          /* BCMDBG */
1082
1083         brcmf_dbg(TRACE, "Enter\n");
1084
1085         /* Early exit if we're already there */
1086         if (bus->clkstate == target) {
1087                 if (target == CLK_AVAIL) {
1088                         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1089                         bus->activity = true;
1090                 }
1091                 return 0;
1092         }
1093
1094         switch (target) {
1095         case CLK_AVAIL:
1096                 /* Make sure SD clock is available */
1097                 if (bus->clkstate == CLK_NONE)
1098                         brcmf_sdbrcm_sdclk(bus, true);
1099                 /* Now request HT Avail on the backplane */
1100                 brcmf_sdbrcm_htclk(bus, true, pendok);
1101                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1102                 bus->activity = true;
1103                 break;
1104
1105         case CLK_SDONLY:
1106                 /* Remove HT request, or bring up SD clock */
1107                 if (bus->clkstate == CLK_NONE)
1108                         brcmf_sdbrcm_sdclk(bus, true);
1109                 else if (bus->clkstate == CLK_AVAIL)
1110                         brcmf_sdbrcm_htclk(bus, false, false);
1111                 else
1112                         brcmf_dbg(ERROR, "request for %d -> %d\n",
1113                                   bus->clkstate, target);
1114                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1115                 break;
1116
1117         case CLK_NONE:
1118                 /* Make sure to remove HT request */
1119                 if (bus->clkstate == CLK_AVAIL)
1120                         brcmf_sdbrcm_htclk(bus, false, false);
1121                 /* Now remove the SD clock */
1122                 brcmf_sdbrcm_sdclk(bus, false);
1123                 brcmf_sdbrcm_wd_timer(bus, 0);
1124                 break;
1125         }
1126 #ifdef BCMDBG
1127         brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
1128 #endif                          /* BCMDBG */
1129
1130         return 0;
1131 }
1132
1133 static int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
1134 {
1135         uint retries = 0;
1136
1137         brcmf_dbg(INFO, "request %s (currently %s)\n",
1138                   sleep ? "SLEEP" : "WAKE",
1139                   bus->sleeping ? "SLEEP" : "WAKE");
1140
1141         /* Done if we're already in the requested state */
1142         if (sleep == bus->sleeping)
1143                 return 0;
1144
1145         /* Going to sleep: set the alarm and turn off the lights... */
1146         if (sleep) {
1147                 /* Don't sleep if something is pending */
1148                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
1149                         return -EBUSY;
1150
1151                 /* Make sure the controller has the bus up */
1152                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1153
1154                 /* Tell device to start using OOB wakeup */
1155                 w_sdreg32(bus, SMB_USE_OOB,
1156                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1157                 if (retries > retry_limit)
1158                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
1159
1160                 /* Turn off our contribution to the HT clock request */
1161                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1162
1163                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1164                         SBSDIO_FUNC1_CHIPCLKCSR,
1165                         SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
1166
1167                 /* Isolate the bus */
1168                 if (bus->ci->chip != BCM4329_CHIP_ID) {
1169                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1170                                 SBSDIO_DEVICE_CTL,
1171                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
1172                 }
1173
1174                 /* Change state */
1175                 bus->sleeping = true;
1176
1177         } else {
1178                 /* Waking up: bus power up is ok, set local state */
1179
1180                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1181                         SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
1182
1183                 /* Force pad isolation off if possible
1184                          (in case power never toggled) */
1185                 if ((bus->ci->buscoretype == PCMCIA_CORE_ID)
1186                     && (bus->ci->buscorerev >= 10))
1187                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1188                                 SBSDIO_DEVICE_CTL, 0, NULL);
1189
1190                 /* Make sure the controller has the bus up */
1191                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1192
1193                 /* Send misc interrupt to indicate OOB not needed */
1194                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
1195                           &retries);
1196                 if (retries <= retry_limit)
1197                         w_sdreg32(bus, SMB_DEV_INT,
1198                                   offsetof(struct sdpcmd_regs, tosbmailbox),
1199                                   &retries);
1200
1201                 if (retries > retry_limit)
1202                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
1203
1204                 /* Make sure we have SD bus access */
1205                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1206
1207                 /* Change state */
1208                 bus->sleeping = false;
1209         }
1210
1211         return 0;
1212 }
1213
1214 static void bus_wake(struct brcmf_bus *bus)
1215 {
1216         if (bus->sleeping)
1217                 brcmf_sdbrcm_bussleep(bus, false);
1218 }
1219
1220 /* Writes a HW/SW header into the packet and sends it. */
1221 /* Assumes: (a) header space already there, (b) caller holds lock */
1222 static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt,
1223                               uint chan, bool free_pkt)
1224 {
1225         int ret;
1226         u8 *frame;
1227         u16 len, pad = 0;
1228         u32 swheader;
1229         uint retries = 0;
1230         struct sk_buff *new;
1231         int i;
1232
1233         brcmf_dbg(TRACE, "Enter\n");
1234
1235         if (bus->drvr->dongle_reset) {
1236                 ret = -EPERM;
1237                 goto done;
1238         }
1239
1240         frame = (u8 *) (pkt->data);
1241
1242         /* Add alignment padding, allocate new packet if needed */
1243         pad = ((unsigned long)frame % BRCMF_SDALIGN);
1244         if (pad) {
1245                 if (skb_headroom(pkt) < pad) {
1246                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
1247                                   skb_headroom(pkt), pad);
1248                         bus->drvr->tx_realloc++;
1249                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
1250                         if (!new) {
1251                                 brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
1252                                           pkt->len + BRCMF_SDALIGN);
1253                                 ret = -ENOMEM;
1254                                 goto done;
1255                         }
1256
1257                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
1258                         memcpy(new->data, pkt->data, pkt->len);
1259                         if (free_pkt)
1260                                 brcmu_pkt_buf_free_skb(pkt);
1261                         /* free the pkt if canned one is not used */
1262                         free_pkt = true;
1263                         pkt = new;
1264                         frame = (u8 *) (pkt->data);
1265                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
1266                         pad = 0;
1267                 } else {
1268                         skb_push(pkt, pad);
1269                         frame = (u8 *) (pkt->data);
1270                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
1271                         memset(frame, 0, pad + SDPCM_HDRLEN);
1272                 }
1273         }
1274         /* precondition: pad < BRCMF_SDALIGN */
1275
1276         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1277         len = (u16) (pkt->len);
1278         *(u16 *) frame = cpu_to_le16(len);
1279         *(((u16 *) frame) + 1) = cpu_to_le16(~len);
1280
1281         /* Software tag: channel, sequence number, data offset */
1282         swheader =
1283             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1284             (((pad +
1285                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1286
1287         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1288         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1289
1290 #ifdef BCMDBG
1291         tx_packets[pkt->priority]++;
1292         if (BRCMF_BYTES_ON() &&
1293             (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
1294               (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
1295                 printk(KERN_DEBUG "Tx Frame:\n");
1296                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
1297         } else if (BRCMF_HDRS_ON()) {
1298                 printk(KERN_DEBUG "TxHdr:\n");
1299                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1300                                      frame, min_t(u16, len, 16));
1301         }
1302 #endif
1303
1304         /* Raise len to next SDIO block to eliminate tail command */
1305         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1306                 u16 pad = bus->blocksize - (len % bus->blocksize);
1307                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1308                                 len += pad;
1309         } else if (len % BRCMF_SDALIGN) {
1310                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1311         }
1312
1313         /* Some controllers have trouble with odd bytes -- round to even */
1314         if (forcealign && (len & (ALIGNMENT - 1)))
1315                         len = roundup(len, ALIGNMENT);
1316
1317         do {
1318                 ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
1319                                             SDIO_FUNC_2, F2SYNC, frame,
1320                                             len, pkt);
1321                 bus->f2txdata++;
1322
1323                 if (ret < 0) {
1324                         /* On failure, abort the command
1325                          and terminate the frame */
1326                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
1327                                   ret);
1328                         bus->tx_sderrs++;
1329
1330                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1331                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1332                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
1333                                          NULL);
1334                         bus->f1regdata++;
1335
1336                         for (i = 0; i < 3; i++) {
1337                                 u8 hi, lo;
1338                                 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
1339                                                      SDIO_FUNC_1,
1340                                                      SBSDIO_FUNC1_WFRAMEBCHI,
1341                                                      NULL);
1342                                 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
1343                                                      SDIO_FUNC_1,
1344                                                      SBSDIO_FUNC1_WFRAMEBCLO,
1345                                                      NULL);
1346                                 bus->f1regdata += 2;
1347                                 if ((hi == 0) && (lo == 0))
1348                                         break;
1349                         }
1350
1351                 }
1352                 if (ret == 0)
1353                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1354
1355         } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
1356
1357 done:
1358         /* restore pkt buffer pointer before calling tx complete routine */
1359         skb_pull(pkt, SDPCM_HDRLEN + pad);
1360         brcmf_sdbrcm_sdunlock(bus);
1361         brcmf_txcomplete(bus->drvr, pkt, ret != 0);
1362         brcmf_sdbrcm_sdlock(bus);
1363
1364         if (free_pkt)
1365                 brcmu_pkt_buf_free_skb(pkt);
1366
1367         return ret;
1368 }
1369
1370 int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
1371 {
1372         int ret = -EBADE;
1373         uint datalen, prec;
1374
1375         brcmf_dbg(TRACE, "Enter\n");
1376
1377         datalen = pkt->len;
1378
1379         /* Add space for the header */
1380         skb_push(pkt, SDPCM_HDRLEN);
1381         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
1382
1383         prec = prio2prec((pkt->priority & PRIOMASK));
1384
1385         /* Check for existing queue, current flow-control,
1386                          pending event, or pending clock */
1387         if (brcmf_deferred_tx || bus->fcstate || pktq_len(&bus->txq)
1388             || bus->dpc_sched || (!data_ok(bus))
1389             || (bus->flowcontrol & NBITVAL(prec))
1390             || (bus->clkstate != CLK_AVAIL)) {
1391                 brcmf_dbg(TRACE, "deferring pktq len %d\n",
1392                           pktq_len(&bus->txq));
1393                 bus->fcqueued++;
1394
1395                 /* Priority based enq */
1396                 spin_lock_bh(&bus->txqlock);
1397                 if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) ==
1398                     false) {
1399                         skb_pull(pkt, SDPCM_HDRLEN);
1400                         brcmf_txcomplete(bus->drvr, pkt, false);
1401                         brcmu_pkt_buf_free_skb(pkt);
1402                         brcmf_dbg(ERROR, "out of bus->txq !!!\n");
1403                         ret = -ENOSR;
1404                 } else {
1405                         ret = 0;
1406                 }
1407                 spin_unlock_bh(&bus->txqlock);
1408
1409                 if (pktq_len(&bus->txq) >= TXHI)
1410                         brcmf_txflowcontrol(bus->drvr, 0, ON);
1411
1412 #ifdef BCMDBG
1413                 if (pktq_plen(&bus->txq, prec) > qcount[prec])
1414                         qcount[prec] = pktq_plen(&bus->txq, prec);
1415 #endif
1416                 /* Schedule DPC if needed to send queued packet(s) */
1417                 if (brcmf_deferred_tx && !bus->dpc_sched) {
1418                         bus->dpc_sched = true;
1419                         brcmf_sdbrcm_sched_dpc(bus);
1420                 }
1421         } else {
1422                 /* Lock: we're about to use shared data/code (and SDIO) */
1423                 brcmf_sdbrcm_sdlock(bus);
1424
1425                 /* Otherwise, send it now */
1426                 bus_wake(bus);
1427                 /* Make sure back plane ht clk is on, no pending allowed */
1428                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
1429
1430                 brcmf_dbg(TRACE, "calling txpkt\n");
1431                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1432                 if (ret)
1433                         bus->drvr->tx_errors++;
1434                 else
1435                         bus->drvr->dstats.tx_bytes += datalen;
1436
1437                 if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
1438                     !bus->dpc_sched) {
1439                         bus->activity = false;
1440                         brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
1441                 }
1442
1443                 brcmf_sdbrcm_sdunlock(bus);
1444         }
1445
1446         return ret;
1447 }
1448
1449 static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
1450 {
1451         struct sk_buff *pkt;
1452         u32 intstatus = 0;
1453         uint retries = 0;
1454         int ret = 0, prec_out;
1455         uint cnt = 0;
1456         uint datalen;
1457         u8 tx_prec_map;
1458
1459         struct brcmf_pub *drvr = bus->drvr;
1460
1461         brcmf_dbg(TRACE, "Enter\n");
1462
1463         tx_prec_map = ~bus->flowcontrol;
1464
1465         /* Send frames until the limit or some other event */
1466         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
1467                 spin_lock_bh(&bus->txqlock);
1468                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
1469                 if (pkt == NULL) {
1470                         spin_unlock_bh(&bus->txqlock);
1471                         break;
1472                 }
1473                 spin_unlock_bh(&bus->txqlock);
1474                 datalen = pkt->len - SDPCM_HDRLEN;
1475
1476                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1477                 if (ret)
1478                         bus->drvr->tx_errors++;
1479                 else
1480                         bus->drvr->dstats.tx_bytes += datalen;
1481
1482                 /* In poll mode, need to check for other events */
1483                 if (!bus->intr && cnt) {
1484                         /* Check device status, signal pending interrupt */
1485                         r_sdreg32(bus, &intstatus,
1486                                   offsetof(struct sdpcmd_regs, intstatus),
1487                                   &retries);
1488                         bus->f2txdata++;
1489                         if (brcmf_sdcard_regfail(bus->sdiodev))
1490                                 break;
1491                         if (intstatus & bus->hostintmask)
1492                                 bus->ipend = true;
1493                 }
1494         }
1495
1496         /* Deflow-control stack if needed */
1497         if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
1498             drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
1499                 brcmf_txflowcontrol(drvr, 0, OFF);
1500
1501         return cnt;
1502 }
1503
1504 int
1505 brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
1506 {
1507         u8 *frame;
1508         u16 len;
1509         u32 swheader;
1510         uint retries = 0;
1511         u8 doff = 0;
1512         int ret = -1;
1513         int i;
1514
1515         brcmf_dbg(TRACE, "Enter\n");
1516
1517         if (bus->drvr->dongle_reset)
1518                 return -EIO;
1519
1520         /* Back the pointer to make a room for bus header */
1521         frame = msg - SDPCM_HDRLEN;
1522         len = (msglen += SDPCM_HDRLEN);
1523
1524         /* Add alignment padding (optional for ctl frames) */
1525         if (brcmf_alignctl) {
1526                 doff = ((unsigned long)frame % BRCMF_SDALIGN);
1527                 if (doff) {
1528                         frame -= doff;
1529                         len += doff;
1530                         msglen += doff;
1531                         memset(frame, 0, doff + SDPCM_HDRLEN);
1532                 }
1533                 /* precondition: doff < BRCMF_SDALIGN */
1534         }
1535         doff += SDPCM_HDRLEN;
1536
1537         /* Round send length to next SDIO block */
1538         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1539                 u16 pad = bus->blocksize - (len % bus->blocksize);
1540                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1541                         len += pad;
1542         } else if (len % BRCMF_SDALIGN) {
1543                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1544         }
1545
1546         /* Satisfy length-alignment requirements */
1547         if (forcealign && (len & (ALIGNMENT - 1)))
1548                 len = roundup(len, ALIGNMENT);
1549
1550         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
1551
1552         /* Need to lock here to protect txseq and SDIO tx calls */
1553         brcmf_sdbrcm_sdlock(bus);
1554
1555         bus_wake(bus);
1556
1557         /* Make sure backplane clock is on */
1558         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1559
1560         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1561         *(u16 *) frame = cpu_to_le16((u16) msglen);
1562         *(((u16 *) frame) + 1) = cpu_to_le16(~msglen);
1563
1564         /* Software tag: channel, sequence number, data offset */
1565         swheader =
1566             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
1567              SDPCM_CHANNEL_MASK)
1568             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
1569                              SDPCM_DOFFSET_MASK);
1570         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1571         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1572
1573         if (!data_ok(bus)) {
1574                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
1575                           bus->tx_max, bus->tx_seq);
1576                 bus->ctrl_frame_stat = true;
1577                 /* Send from dpc */
1578                 bus->ctrl_frame_buf = frame;
1579                 bus->ctrl_frame_len = len;
1580
1581                 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
1582
1583                 if (bus->ctrl_frame_stat == false) {
1584                         brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
1585                         ret = 0;
1586                 } else {
1587                         brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
1588                         ret = -1;
1589                 }
1590         }
1591
1592         if (ret == -1) {
1593 #ifdef BCMDBG
1594                 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1595                         printk(KERN_DEBUG "Tx Frame:\n");
1596                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1597                                              frame, len);
1598                 } else if (BRCMF_HDRS_ON()) {
1599                         printk(KERN_DEBUG "TxHdr:\n");
1600                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1601                                              frame, min_t(u16, len, 16));
1602                 }
1603 #endif
1604
1605                 do {
1606                         bus->ctrl_frame_stat = false;
1607                         ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
1608                                         SDIO_FUNC_2, F2SYNC, frame, len, NULL);
1609
1610                         if (ret < 0) {
1611                                 /* On failure, abort the command and
1612                                  terminate the frame */
1613                                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
1614                                           ret);
1615                                 bus->tx_sderrs++;
1616
1617                                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1618
1619                                 brcmf_sdcard_cfg_write(bus->sdiodev,
1620                                                  SDIO_FUNC_1,
1621                                                  SBSDIO_FUNC1_FRAMECTRL,
1622                                                  SFC_WF_TERM, NULL);
1623                                 bus->f1regdata++;
1624
1625                                 for (i = 0; i < 3; i++) {
1626                                         u8 hi, lo;
1627                                         hi = brcmf_sdcard_cfg_read(bus->sdiodev,
1628                                              SDIO_FUNC_1,
1629                                              SBSDIO_FUNC1_WFRAMEBCHI,
1630                                              NULL);
1631                                         lo = brcmf_sdcard_cfg_read(bus->sdiodev,
1632                                              SDIO_FUNC_1,
1633                                              SBSDIO_FUNC1_WFRAMEBCLO,
1634                                              NULL);
1635                                         bus->f1regdata += 2;
1636                                         if ((hi == 0) && (lo == 0))
1637                                                 break;
1638                                 }
1639
1640                         }
1641                         if (ret == 0)
1642                                 bus->tx_seq =
1643                                     (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1644
1645                 } while ((ret < 0) && retries++ < TXRETRIES);
1646         }
1647
1648         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1649                 bus->activity = false;
1650                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
1651         }
1652
1653         brcmf_sdbrcm_sdunlock(bus);
1654
1655         if (ret)
1656                 bus->drvr->tx_ctlerrs++;
1657         else
1658                 bus->drvr->tx_ctlpkts++;
1659
1660         return ret ? -EIO : 0;
1661 }
1662
1663 int
1664 brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
1665 {
1666         int timeleft;
1667         uint rxlen = 0;
1668         bool pending;
1669
1670         brcmf_dbg(TRACE, "Enter\n");
1671
1672         if (bus->drvr->dongle_reset)
1673                 return -EIO;
1674
1675         /* Wait until control frame is available */
1676         timeleft = brcmf_sdbrcm_ioctl_resp_wait(bus, &bus->rxlen, &pending);
1677
1678         brcmf_sdbrcm_sdlock(bus);
1679         rxlen = bus->rxlen;
1680         memcpy(msg, bus->rxctl, min(msglen, rxlen));
1681         bus->rxlen = 0;
1682         brcmf_sdbrcm_sdunlock(bus);
1683
1684         if (rxlen) {
1685                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
1686                           rxlen, msglen);
1687         } else if (timeleft == 0) {
1688                 brcmf_dbg(ERROR, "resumed on timeout\n");
1689 #ifdef BCMDBG
1690                 brcmf_sdbrcm_sdlock(bus);
1691                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
1692                 brcmf_sdbrcm_sdunlock(bus);
1693 #endif                          /* BCMDBG */
1694         } else if (pending == true) {
1695                 brcmf_dbg(CTL, "cancelled\n");
1696                 return -ERESTARTSYS;
1697         } else {
1698                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
1699 #ifdef BCMDBG
1700                 brcmf_sdbrcm_sdlock(bus);
1701                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
1702                 brcmf_sdbrcm_sdunlock(bus);
1703 #endif                          /* BCMDBG */
1704         }
1705
1706         if (rxlen)
1707                 bus->drvr->rx_ctlpkts++;
1708         else
1709                 bus->drvr->rx_ctlerrs++;
1710
1711         return rxlen ? (int)rxlen : -ETIMEDOUT;
1712 }
1713
1714 static int
1715 brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
1716                  uint size)
1717 {
1718         int bcmerror = 0;
1719         u32 sdaddr;
1720         uint dsize;
1721
1722         /* Determine initial transfer parameters */
1723         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
1724         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
1725                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
1726         else
1727                 dsize = size;
1728
1729         /* Set the backplane window to include the start address */
1730         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
1731         if (bcmerror) {
1732                 brcmf_dbg(ERROR, "window change failed\n");
1733                 goto xfer_done;
1734         }
1735
1736         /* Do the transfer(s) */
1737         while (size) {
1738                 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
1739                           write ? "write" : "read", dsize,
1740                           sdaddr, address & SBSDIO_SBWINDOW_MASK);
1741                 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
1742                                                sdaddr, data, dsize);
1743                 if (bcmerror) {
1744                         brcmf_dbg(ERROR, "membytes transfer failed\n");
1745                         break;
1746                 }
1747
1748                 /* Adjust for next transfer (if any) */
1749                 size -= dsize;
1750                 if (size) {
1751                         data += dsize;
1752                         address += dsize;
1753                         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
1754                                                                   address);
1755                         if (bcmerror) {
1756                                 brcmf_dbg(ERROR, "window change failed\n");
1757                                 break;
1758                         }
1759                         sdaddr = 0;
1760                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
1761                 }
1762         }
1763
1764 xfer_done:
1765         /* Return the window to backplane enumeration space for core access */
1766         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
1767                 brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
1768                           bus->sdiodev->sbwad);
1769
1770         return bcmerror;
1771 }
1772
1773 #ifdef BCMDBG
1774 static int
1775 brcmf_sdbrcm_readshared(struct brcmf_bus *bus, struct sdpcm_shared *sh)
1776 {
1777         u32 addr;
1778         int rv;
1779
1780         /* Read last word in memory to determine address of
1781                          sdpcm_shared structure */
1782         rv = brcmf_sdbrcm_membytes(bus, false, bus->ramsize - 4, (u8 *)&addr,
1783                                    4);
1784         if (rv < 0)
1785                 return rv;
1786
1787         addr = le32_to_cpu(addr);
1788
1789         brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
1790
1791         /*
1792          * Check if addr is valid.
1793          * NVRAM length at the end of memory should have been overwritten.
1794          */
1795         if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
1796                 brcmf_dbg(ERROR, "address (0x%08x) of sdpcm_shared invalid\n",
1797                           addr);
1798                 return -EBADE;
1799         }
1800
1801         /* Read rte_shared structure */
1802         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *) sh,
1803                               sizeof(struct sdpcm_shared));
1804         if (rv < 0)
1805                 return rv;
1806
1807         /* Endianness */
1808         sh->flags = le32_to_cpu(sh->flags);
1809         sh->trap_addr = le32_to_cpu(sh->trap_addr);
1810         sh->assert_exp_addr = le32_to_cpu(sh->assert_exp_addr);
1811         sh->assert_file_addr = le32_to_cpu(sh->assert_file_addr);
1812         sh->assert_line = le32_to_cpu(sh->assert_line);
1813         sh->console_addr = le32_to_cpu(sh->console_addr);
1814         sh->msgtrace_addr = le32_to_cpu(sh->msgtrace_addr);
1815
1816         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
1817                 brcmf_dbg(ERROR, "sdpcm_shared version %d in brcmf is different than sdpcm_shared version %d in dongle\n",
1818                           SDPCM_SHARED_VERSION,
1819                           sh->flags & SDPCM_SHARED_VERSION_MASK);
1820                 return -EBADE;
1821         }
1822
1823         return 0;
1824 }
1825
1826 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size)
1827 {
1828         int bcmerror = 0;
1829         uint msize = 512;
1830         char *mbuffer = NULL;
1831         uint maxstrlen = 256;
1832         char *str = NULL;
1833         struct brcmf_trap tr;
1834         struct sdpcm_shared sdpcm_shared;
1835         struct brcmu_strbuf strbuf;
1836
1837         brcmf_dbg(TRACE, "Enter\n");
1838
1839         if (data == NULL) {
1840                 /*
1841                  * Called after a rx ctrl timeout. "data" is NULL.
1842                  * allocate memory to trace the trap or assert.
1843                  */
1844                 size = msize;
1845                 mbuffer = data = kmalloc(msize, GFP_ATOMIC);
1846                 if (mbuffer == NULL) {
1847                         brcmf_dbg(ERROR, "kmalloc(%d) failed\n", msize);
1848                         bcmerror = -ENOMEM;
1849                         goto done;
1850                 }
1851         }
1852
1853         str = kmalloc(maxstrlen, GFP_ATOMIC);
1854         if (str == NULL) {
1855                 brcmf_dbg(ERROR, "kmalloc(%d) failed\n", maxstrlen);
1856                 bcmerror = -ENOMEM;
1857                 goto done;
1858         }
1859
1860         bcmerror = brcmf_sdbrcm_readshared(bus, &sdpcm_shared);
1861         if (bcmerror < 0)
1862                 goto done;
1863
1864         brcmu_binit(&strbuf, data, size);
1865
1866         brcmu_bprintf(&strbuf,
1867                     "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
1868                     sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
1869
1870         if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
1871                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
1872                  * (Avoids conflict with real asserts for programmatic
1873                  * parsing of output.)
1874                  */
1875                 brcmu_bprintf(&strbuf, "Assrt not built in dongle\n");
1876
1877         if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) ==
1878             0) {
1879                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
1880                  * (Avoids conflict with real asserts for programmatic
1881                  * parsing of output.)
1882                  */
1883                 brcmu_bprintf(&strbuf, "No trap%s in dongle",
1884                             (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
1885                             ? "/assrt" : "");
1886         } else {
1887                 if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
1888                         /* Download assert */
1889                         brcmu_bprintf(&strbuf, "Dongle assert");
1890                         if (sdpcm_shared.assert_exp_addr != 0) {
1891                                 str[0] = '\0';
1892                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
1893                                                 sdpcm_shared.assert_exp_addr,
1894                                                 (u8 *) str, maxstrlen);
1895                                 if (bcmerror < 0)
1896                                         goto done;
1897
1898                                 str[maxstrlen - 1] = '\0';
1899                                 brcmu_bprintf(&strbuf, " expr \"%s\"", str);
1900                         }
1901
1902                         if (sdpcm_shared.assert_file_addr != 0) {
1903                                 str[0] = '\0';
1904                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
1905                                                 sdpcm_shared.assert_file_addr,
1906                                                 (u8 *) str, maxstrlen);
1907                                 if (bcmerror < 0)
1908                                         goto done;
1909
1910                                 str[maxstrlen - 1] = '\0';
1911                                 brcmu_bprintf(&strbuf, " file \"%s\"", str);
1912                         }
1913
1914                         brcmu_bprintf(&strbuf, " line %d ",
1915                                     sdpcm_shared.assert_line);
1916                 }
1917
1918                 if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
1919                         bcmerror = brcmf_sdbrcm_membytes(bus, false,
1920                                         sdpcm_shared.trap_addr, (u8 *)&tr,
1921                                         sizeof(struct brcmf_trap));
1922                         if (bcmerror < 0)
1923                                 goto done;
1924
1925                         brcmu_bprintf(&strbuf,
1926                                     "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
1927                                     "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
1928                                     "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n",
1929                                     tr.type, tr.epc, tr.cpsr, tr.spsr, tr.r13,
1930                                     tr.r14, tr.pc, sdpcm_shared.trap_addr,
1931                                     tr.r0, tr.r1, tr.r2, tr.r3, tr.r4, tr.r5,
1932                                     tr.r6, tr.r7);
1933                 }
1934         }
1935
1936         if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP))
1937                 brcmf_dbg(ERROR, "%s\n", strbuf.origbuf);
1938
1939 #ifdef BCMDBG
1940         if (sdpcm_shared.flags & SDPCM_SHARED_TRAP)
1941                 /* Mem dump to a file on device */
1942                 brcmf_sdbrcm_mem_dump(bus);
1943
1944 #endif                          /* BCMDBG */
1945
1946 done:
1947         kfree(mbuffer);
1948         kfree(str);
1949
1950         return bcmerror;
1951 }
1952
1953 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus)
1954 {
1955         int ret = 0;
1956         int size;               /* Full mem size */
1957         int start = 0;          /* Start address */
1958         int read_size = 0;      /* Read size of each iteration */
1959         u8 *buf = NULL, *databuf = NULL;
1960
1961         /* Get full mem size */
1962         size = bus->ramsize;
1963         buf = kmalloc(size, GFP_ATOMIC);
1964         if (!buf) {
1965                 brcmf_dbg(ERROR, "Out of memory (%d bytes)\n", size);
1966                 return -1;
1967         }
1968
1969         /* Read mem content */
1970         printk(KERN_DEBUG "Dump dongle memory");
1971         databuf = buf;
1972         while (size) {
1973                 read_size = min(MEMBLOCK, size);
1974                 ret = brcmf_sdbrcm_membytes(bus, false, start, databuf,
1975                                           read_size);
1976                 if (ret) {
1977                         brcmf_dbg(ERROR, "Error membytes %d\n", ret);
1978                         kfree(buf);
1979                         return -1;
1980                 }
1981                 printk(".");
1982
1983                 /* Decrement size and increment start address */
1984                 size -= read_size;
1985                 start += read_size;
1986                 databuf += read_size;
1987         }
1988         printk(KERN_DEBUG "Done\n");
1989
1990         /* free buf before return !!! */
1991         if (brcmf_write_to_file(bus->drvr, buf, bus->ramsize)) {
1992                 brcmf_dbg(ERROR, "Error writing to files\n");
1993                 return -1;
1994         }
1995
1996         /* buf free handled in brcmf_write_to_file, not here */
1997         return 0;
1998 }
1999
2000 #define CONSOLE_LINE_MAX        192
2001
2002 static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
2003 {
2004         struct brcmf_console *c = &bus->console;
2005         u8 line[CONSOLE_LINE_MAX], ch;
2006         u32 n, idx, addr;
2007         int rv;
2008
2009         /* Don't do anything until FWREADY updates console address */
2010         if (bus->console_addr == 0)
2011                 return 0;
2012
2013         /* Read console log struct */
2014         addr = bus->console_addr + offsetof(struct rte_console, log);
2015         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log,
2016                                 sizeof(c->log));
2017         if (rv < 0)
2018                 return rv;
2019
2020         /* Allocate console buffer (one time only) */
2021         if (c->buf == NULL) {
2022                 c->bufsize = le32_to_cpu(c->log.buf_size);
2023                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2024                 if (c->buf == NULL)
2025                         return -ENOMEM;
2026         }
2027
2028         idx = le32_to_cpu(c->log.idx);
2029
2030         /* Protect against corrupt value */
2031         if (idx > c->bufsize)
2032                 return -EBADE;
2033
2034         /* Skip reading the console buffer if the index pointer
2035          has not moved */
2036         if (idx == c->last)
2037                 return 0;
2038
2039         /* Read the console buffer */
2040         addr = le32_to_cpu(c->log.buf);
2041         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2042         if (rv < 0)
2043                 return rv;
2044
2045         while (c->last != idx) {
2046                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2047                         if (c->last == idx) {
2048                                 /* This would output a partial line.
2049                                  * Instead, back up
2050                                  * the buffer pointer and output this
2051                                  * line next time around.
2052                                  */
2053                                 if (c->last >= n)
2054                                         c->last -= n;
2055                                 else
2056                                         c->last = c->bufsize - n;
2057                                 goto break2;
2058                         }
2059                         ch = c->buf[c->last];
2060                         c->last = (c->last + 1) % c->bufsize;
2061                         if (ch == '\n')
2062                                 break;
2063                         line[n] = ch;
2064                 }
2065
2066                 if (n > 0) {
2067                         if (line[n - 1] == '\r')
2068                                 n--;
2069                         line[n] = 0;
2070                         printk(KERN_DEBUG "CONSOLE: %s\n", line);
2071                 }
2072         }
2073 break2:
2074
2075         return 0;
2076 }
2077 #endif                          /* BCMDBG */
2078
2079 static int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
2080 {
2081         int bcmerror = 0;
2082
2083         brcmf_dbg(TRACE, "Enter\n");
2084
2085         /* Basic sanity checks */
2086         if (bus->drvr->up) {
2087                 bcmerror = -EISCONN;
2088                 goto err;
2089         }
2090         if (!len) {
2091                 bcmerror = -EOVERFLOW;
2092                 goto err;
2093         }
2094
2095         /* Free the old ones and replace with passed variables */
2096         kfree(bus->vars);
2097
2098         bus->vars = kmalloc(len, GFP_ATOMIC);
2099         bus->varsz = bus->vars ? len : 0;
2100         if (bus->vars == NULL) {
2101                 bcmerror = -ENOMEM;
2102                 goto err;
2103         }
2104
2105         /* Copy the passed variables, which should include the
2106                  terminating double-null */
2107         memcpy(bus->vars, arg, bus->varsz);
2108 err:
2109         return bcmerror;
2110 }
2111
2112 static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
2113 {
2114         int bcmerror = 0;
2115         u32 varsize;
2116         u32 varaddr;
2117         u8 *vbuffer;
2118         u32 varsizew;
2119 #ifdef BCMDBG
2120         char *nvram_ularray;
2121 #endif                          /* BCMDBG */
2122
2123         /* Even if there are no vars are to be written, we still
2124                  need to set the ramsize. */
2125         varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
2126         varaddr = (bus->ramsize - 4) - varsize;
2127
2128         if (bus->vars) {
2129                 vbuffer = kzalloc(varsize, GFP_ATOMIC);
2130                 if (!vbuffer)
2131                         return -ENOMEM;
2132
2133                 memcpy(vbuffer, bus->vars, bus->varsz);
2134
2135                 /* Write the vars list */
2136                 bcmerror =
2137                     brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
2138 #ifdef BCMDBG
2139                 /* Verify NVRAM bytes */
2140                 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
2141                 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
2142                 if (!nvram_ularray)
2143                         return -ENOMEM;
2144
2145                 /* Upload image to verify downloaded contents. */
2146                 memset(nvram_ularray, 0xaa, varsize);
2147
2148                 /* Read the vars list to temp buffer for comparison */
2149                 bcmerror =
2150                     brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
2151                                      varsize);
2152                 if (bcmerror) {
2153                         brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
2154                                   bcmerror, varsize, varaddr);
2155                 }
2156                 /* Compare the org NVRAM with the one read from RAM */
2157                 if (memcmp(vbuffer, nvram_ularray, varsize))
2158                         brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
2159                 else
2160                         brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
2161
2162                 kfree(nvram_ularray);
2163 #endif                          /* BCMDBG */
2164
2165                 kfree(vbuffer);
2166         }
2167
2168         /* adjust to the user specified RAM */
2169         brcmf_dbg(INFO, "Physical memory size: %d, usable memory size: %d\n",
2170                   bus->orig_ramsize, bus->ramsize);
2171         brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
2172                   varaddr, varsize);
2173         varsize = ((bus->orig_ramsize - 4) - varaddr);
2174
2175         /*
2176          * Determine the length token:
2177          * Varsize, converted to words, in lower 16-bits, checksum
2178          * in upper 16-bits.
2179          */
2180         if (bcmerror) {
2181                 varsizew = 0;
2182         } else {
2183                 varsizew = varsize / 4;
2184                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
2185                 varsizew = cpu_to_le32(varsizew);
2186         }
2187
2188         brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
2189                   varsize, varsizew);
2190
2191         /* Write the length token to the last word */
2192         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->orig_ramsize - 4),
2193                                     (u8 *)&varsizew, 4);
2194
2195         return bcmerror;
2196 }
2197
2198 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
2199 {
2200         uint retries;
2201         u32 regdata;
2202         int bcmerror = 0;
2203
2204         /* To enter download state, disable ARM and reset SOCRAM.
2205          * To exit download state, simply reset ARM (default is RAM boot).
2206          */
2207         if (enter) {
2208                 bus->alp_only = true;
2209
2210                 brcmf_sdbrcm_chip_disablecore(bus->sdiodev,
2211                                               bus->ci->armcorebase);
2212
2213                 brcmf_sdbrcm_chip_resetcore(bus->sdiodev, bus->ci->ramcorebase);
2214
2215                 /* Clear the top bit of memory */
2216                 if (bus->ramsize) {
2217                         u32 zeros = 0;
2218                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
2219                                          (u8 *)&zeros, 4);
2220                 }
2221         } else {
2222                 regdata = brcmf_sdcard_reg_read(bus->sdiodev,
2223                         CORE_SB(bus->ci->ramcorebase, sbtmstatelow), 4);
2224                 regdata &= (SBTML_RESET | SBTML_REJ_MASK |
2225                         (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
2226                 if ((SICF_CLOCK_EN << SBTML_SICF_SHIFT) != regdata) {
2227                         brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
2228                         bcmerror = -EBADE;
2229                         goto fail;
2230                 }
2231
2232                 bcmerror = brcmf_sdbrcm_write_vars(bus);
2233                 if (bcmerror) {
2234                         brcmf_dbg(ERROR, "no vars written to RAM\n");
2235                         bcmerror = 0;
2236                 }
2237
2238                 w_sdreg32(bus, 0xFFFFFFFF,
2239                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2240
2241                 brcmf_sdbrcm_chip_resetcore(bus->sdiodev, bus->ci->armcorebase);
2242
2243                 /* Allow HT Clock now that the ARM is running. */
2244                 bus->alp_only = false;
2245
2246                 bus->drvr->busstate = BRCMF_BUS_LOAD;
2247         }
2248 fail:
2249         return bcmerror;
2250 }
2251
2252 void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus, bool enforce_mutex)
2253 {
2254         u32 local_hostintmask;
2255         u8 saveclk;
2256         uint retries;
2257         int err;
2258
2259         brcmf_dbg(TRACE, "Enter\n");
2260
2261         if (enforce_mutex)
2262                 brcmf_sdbrcm_sdlock(bus);
2263
2264         bus_wake(bus);
2265
2266         /* Enable clock for device interrupts */
2267         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2268
2269         if (bus->watchdog_tsk) {
2270                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
2271                 kthread_stop(bus->watchdog_tsk);
2272                 bus->watchdog_tsk = NULL;
2273         }
2274
2275         if (bus->dpc_tsk) {
2276                 send_sig(SIGTERM, bus->dpc_tsk, 1);
2277                 kthread_stop(bus->dpc_tsk);
2278                 bus->dpc_tsk = NULL;
2279         } else
2280                 tasklet_kill(&bus->tasklet);
2281
2282         /* Disable and clear interrupts at the chip level also */
2283         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
2284         local_hostintmask = bus->hostintmask;
2285         bus->hostintmask = 0;
2286
2287         /* Change our idea of bus state */
2288         bus->drvr->busstate = BRCMF_BUS_DOWN;
2289
2290         /* Force clocks on backplane to be sure F2 interrupt propagates */
2291         saveclk = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2292                                         SBSDIO_FUNC1_CHIPCLKCSR, &err);
2293         if (!err) {
2294                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2295                                        SBSDIO_FUNC1_CHIPCLKCSR,
2296                                        (saveclk | SBSDIO_FORCE_HT), &err);
2297         }
2298         if (err)
2299                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
2300
2301         /* Turn off the bus (F2), free any pending packets */
2302         brcmf_dbg(INTR, "disable SDIO interrupts\n");
2303         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
2304                          SDIO_FUNC_ENABLE_1, NULL);
2305
2306         /* Clear any pending interrupts now that F2 is disabled */
2307         w_sdreg32(bus, local_hostintmask,
2308                   offsetof(struct sdpcmd_regs, intstatus), &retries);
2309
2310         /* Turn off the backplane clock (only) */
2311         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
2312
2313         /* Clear the data packet queues */
2314         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2315
2316         /* Clear any held glomming stuff */
2317         if (bus->glomd)
2318                 brcmu_pkt_buf_free_skb(bus->glomd);
2319
2320         if (bus->glom)
2321                 brcmu_pkt_buf_free_skb(bus->glom);
2322
2323         bus->glom = bus->glomd = NULL;
2324
2325         /* Clear rx control and wake any waiters */
2326         bus->rxlen = 0;
2327         brcmf_sdbrcm_ioctl_resp_wake(bus);
2328
2329         /* Reset some F2 state stuff */
2330         bus->rxskip = false;
2331         bus->tx_seq = bus->rx_seq = 0;
2332
2333         if (enforce_mutex)
2334                 brcmf_sdbrcm_sdunlock(bus);
2335 }
2336
2337 int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr, bool enforce_mutex)
2338 {
2339         struct brcmf_bus *bus = drvr->bus;
2340         unsigned long timeout;
2341         uint retries = 0;
2342         u8 ready, enable;
2343         int err, ret = 0;
2344         u8 saveclk;
2345
2346         brcmf_dbg(TRACE, "Enter\n");
2347
2348         /* try to download image and nvram to the dongle */
2349         if (drvr->busstate == BRCMF_BUS_DOWN) {
2350                 if (!(brcmf_sdbrcm_download_firmware(bus)))
2351                         return -1;
2352         }
2353
2354         if (!bus->drvr)
2355                 return 0;
2356
2357         /* Start the watchdog timer */
2358         bus->drvr->tickcnt = 0;
2359         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
2360
2361         if (enforce_mutex)
2362                 brcmf_sdbrcm_sdlock(bus);
2363
2364         /* Make sure backplane clock is on, needed to generate F2 interrupt */
2365         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2366         if (bus->clkstate != CLK_AVAIL)
2367                 goto exit;
2368
2369         /* Force clocks on backplane to be sure F2 interrupt propagates */
2370         saveclk =
2371             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2372                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
2373         if (!err) {
2374                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2375                                        SBSDIO_FUNC1_CHIPCLKCSR,
2376                                        (saveclk | SBSDIO_FORCE_HT), &err);
2377         }
2378         if (err) {
2379                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
2380                 goto exit;
2381         }
2382
2383         /* Enable function 2 (frame transfers) */
2384         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
2385                   offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
2386         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
2387
2388         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
2389                                enable, NULL);
2390
2391         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
2392         ready = 0;
2393         while (enable != ready) {
2394                 ready = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_0,
2395                                               SDIO_CCCR_IORx, NULL);
2396                 if (time_after(jiffies, timeout))
2397                         break;
2398                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
2399                         /* prevent busy waiting if it takes too long */
2400                         msleep_interruptible(20);
2401         }
2402
2403         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
2404
2405         /* If F2 successfully enabled, set core and enable interrupts */
2406         if (ready == enable) {
2407                 /* Set up the interrupt mask and enable interrupts */
2408                 bus->hostintmask = HOSTINTMASK;
2409                 w_sdreg32(bus, bus->hostintmask,
2410                           offsetof(struct sdpcmd_regs, hostintmask), &retries);
2411
2412                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2413                                        SBSDIO_WATERMARK, 8, &err);
2414
2415                 /* Set bus state according to enable result */
2416                 drvr->busstate = BRCMF_BUS_DATA;
2417         }
2418
2419         else {
2420                 /* Disable F2 again */
2421                 enable = SDIO_FUNC_ENABLE_1;
2422                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0,
2423                                        SDIO_CCCR_IOEx, enable, NULL);
2424         }
2425
2426         /* Restore previous clock setting */
2427         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2428                                SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
2429
2430         /* If we didn't come up, turn off backplane clock */
2431         if (drvr->busstate != BRCMF_BUS_DATA)
2432                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2433
2434 exit:
2435         if (enforce_mutex)
2436                 brcmf_sdbrcm_sdunlock(bus);
2437
2438         return ret;
2439 }
2440
2441 static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
2442 {
2443         uint retries = 0;
2444         u16 lastrbc;
2445         u8 hi, lo;
2446         int err;
2447
2448         brcmf_dbg(ERROR, "%sterminate frame%s\n",
2449                   abort ? "abort command, " : "",
2450                   rtx ? ", send NAK" : "");
2451
2452         if (abort)
2453                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2454
2455         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2456                                SBSDIO_FUNC1_FRAMECTRL,
2457                                SFC_RF_TERM, &err);
2458         bus->f1regdata++;
2459
2460         /* Wait until the packet has been flushed (device/FIFO stable) */
2461         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
2462                 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2463                                            SBSDIO_FUNC1_RFRAMEBCHI, NULL);
2464                 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2465                                            SBSDIO_FUNC1_RFRAMEBCLO, NULL);
2466                 bus->f1regdata += 2;
2467
2468                 if ((hi == 0) && (lo == 0))
2469                         break;
2470
2471                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
2472                         brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
2473                                   lastrbc, (hi << 8) + lo);
2474                 }
2475                 lastrbc = (hi << 8) + lo;
2476         }
2477
2478         if (!retries)
2479                 brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
2480         else
2481                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
2482
2483         if (rtx) {
2484                 bus->rxrtx++;
2485                 w_sdreg32(bus, SMB_NAK,
2486                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
2487
2488                 bus->f1regdata++;
2489                 if (retries <= retry_limit)
2490                         bus->rxskip = true;
2491         }
2492
2493         /* Clear partial in any case */
2494         bus->nextlen = 0;
2495
2496         /* If we can't reach the device, signal failure */
2497         if (err || brcmf_sdcard_regfail(bus->sdiodev))
2498                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2499 }
2500
2501 static void
2502 brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
2503 {
2504         uint rdlen, pad;
2505
2506         int sdret;
2507
2508         brcmf_dbg(TRACE, "Enter\n");
2509
2510         /* Set rxctl for frame (w/optional alignment) */
2511         bus->rxctl = bus->rxbuf;
2512         if (brcmf_alignctl) {
2513                 bus->rxctl += firstread;
2514                 pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
2515                 if (pad)
2516                         bus->rxctl += (BRCMF_SDALIGN - pad);
2517                 bus->rxctl -= firstread;
2518         }
2519
2520         /* Copy the already-read portion over */
2521         memcpy(bus->rxctl, hdr, firstread);
2522         if (len <= firstread)
2523                 goto gotpkt;
2524
2525         /* Raise rdlen to next SDIO block to avoid tail command */
2526         rdlen = len - firstread;
2527         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
2528                 pad = bus->blocksize - (rdlen % bus->blocksize);
2529                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
2530                     ((len + pad) < bus->drvr->maxctl))
2531                         rdlen += pad;
2532         } else if (rdlen % BRCMF_SDALIGN) {
2533                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
2534         }
2535
2536         /* Satisfy length-alignment requirements */
2537         if (forcealign && (rdlen & (ALIGNMENT - 1)))
2538                 rdlen = roundup(rdlen, ALIGNMENT);
2539
2540         /* Drop if the read is too big or it exceeds our maximum */
2541         if ((rdlen + firstread) > bus->drvr->maxctl) {
2542                 brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
2543                           rdlen, bus->drvr->maxctl);
2544                 bus->drvr->rx_errors++;
2545                 brcmf_sdbrcm_rxfail(bus, false, false);
2546                 goto done;
2547         }
2548
2549         if ((len - doff) > bus->drvr->maxctl) {
2550                 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
2551                           len, len - doff, bus->drvr->maxctl);
2552                 bus->drvr->rx_errors++;
2553                 bus->rx_toolong++;
2554                 brcmf_sdbrcm_rxfail(bus, false, false);
2555                 goto done;
2556         }
2557
2558         /* Read remainder of frame body into the rxctl buffer */
2559         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
2560                                 bus->sdiodev->sbwad,
2561                                 SDIO_FUNC_2,
2562                                 F2SYNC, (bus->rxctl + firstread), rdlen,
2563                                 NULL);
2564         bus->f2rxdata++;
2565
2566         /* Control frame failures need retransmission */
2567         if (sdret < 0) {
2568                 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
2569                           rdlen, sdret);
2570                 bus->rxc_errors++;
2571                 brcmf_sdbrcm_rxfail(bus, true, true);
2572                 goto done;
2573         }
2574
2575 gotpkt:
2576
2577 #ifdef BCMDBG
2578         if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
2579                 printk(KERN_DEBUG "RxCtrl:\n");
2580                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
2581         }
2582 #endif
2583
2584         /* Point to valid data and indicate its length */
2585         bus->rxctl += doff;
2586         bus->rxlen = len - doff;
2587
2588 done:
2589         /* Awake any waiters */
2590         brcmf_sdbrcm_ioctl_resp_wake(bus);
2591 }
2592
2593 static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
2594 {
2595         u16 dlen, totlen;
2596         u8 *dptr, num = 0;
2597
2598         u16 sublen, check;
2599         struct sk_buff *pfirst, *plast, *pnext, *save_pfirst;
2600
2601         int errcode;
2602         u8 chan, seq, doff, sfdoff;
2603         u8 txmax;
2604
2605         int ifidx = 0;
2606         bool usechain = bus->use_rxchain;
2607
2608         /* If packets, issue read(s) and send up packet chain */
2609         /* Return sequence numbers consumed? */
2610
2611         brcmf_dbg(TRACE, "start: glomd %p glom %p\n", bus->glomd, bus->glom);
2612
2613         /* If there's a descriptor, generate the packet chain */
2614         if (bus->glomd) {
2615                 pfirst = plast = pnext = NULL;
2616                 dlen = (u16) (bus->glomd->len);
2617                 dptr = bus->glomd->data;
2618                 if (!dlen || (dlen & 1)) {
2619                         brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
2620                                   dlen);
2621                         dlen = 0;
2622                 }
2623
2624                 for (totlen = num = 0; dlen; num++) {
2625                         /* Get (and move past) next length */
2626                         sublen = get_unaligned_le16(dptr);
2627                         dlen -= sizeof(u16);
2628                         dptr += sizeof(u16);
2629                         if ((sublen < SDPCM_HDRLEN) ||
2630                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
2631                                 brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
2632                                           num, sublen);
2633                                 pnext = NULL;
2634                                 break;
2635                         }
2636                         if (sublen % BRCMF_SDALIGN) {
2637                                 brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
2638                                           sublen, BRCMF_SDALIGN);
2639                                 usechain = false;
2640                         }
2641                         totlen += sublen;
2642
2643                         /* For last frame, adjust read len so total
2644                                  is a block multiple */
2645                         if (!dlen) {
2646                                 sublen +=
2647                                     (roundup(totlen, bus->blocksize) - totlen);
2648                                 totlen = roundup(totlen, bus->blocksize);
2649                         }
2650
2651                         /* Allocate/chain packet for next subframe */
2652                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
2653                         if (pnext == NULL) {
2654                                 brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
2655                                           num, sublen);
2656                                 break;
2657                         }
2658                         if (!pfirst) {
2659                                 pfirst = plast = pnext;
2660                         } else {
2661                                 plast->next = pnext;
2662                                 plast = pnext;
2663                         }
2664
2665                         /* Adhere to start alignment requirements */
2666                         pkt_align(pnext, sublen, BRCMF_SDALIGN);
2667                 }
2668
2669                 /* If all allocations succeeded, save packet chain
2670                          in bus structure */
2671                 if (pnext) {
2672                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
2673                                   totlen, num);
2674                         if (BRCMF_GLOM_ON() && bus->nextlen) {
2675                                 if (totlen != bus->nextlen) {
2676                                         brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
2677                                                   bus->nextlen, totlen, rxseq);
2678                                 }
2679                         }
2680                         bus->glom = pfirst;
2681                         pfirst = pnext = NULL;
2682                 } else {
2683                         if (pfirst)
2684                                 brcmu_pkt_buf_free_skb(pfirst);
2685                         bus->glom = NULL;
2686                         num = 0;
2687                 }
2688
2689                 /* Done with descriptor packet */
2690                 brcmu_pkt_buf_free_skb(bus->glomd);
2691                 bus->glomd = NULL;
2692                 bus->nextlen = 0;
2693         }
2694
2695         /* Ok -- either we just generated a packet chain,
2696                  or had one from before */
2697         if (bus->glom) {
2698                 if (BRCMF_GLOM_ON()) {
2699                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
2700                         for (pnext = bus->glom; pnext; pnext = pnext->next) {
2701                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
2702                                           pnext, (u8 *) (pnext->data),
2703                                           pnext->len, pnext->len);
2704                         }
2705                 }
2706
2707                 pfirst = bus->glom;
2708                 dlen = (u16) brcmu_pkttotlen(pfirst);
2709
2710                 /* Do an SDIO read for the superframe.  Configurable iovar to
2711                  * read directly into the chained packet, or allocate a large
2712                  * packet and and copy into the chain.
2713                  */
2714                 if (usechain) {
2715                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
2716                                         bus->sdiodev->sbwad,
2717                                         SDIO_FUNC_2,
2718                                         F2SYNC, (u8 *) pfirst->data, dlen,
2719                                         pfirst);
2720                 } else if (bus->dataptr) {
2721                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
2722                                         bus->sdiodev->sbwad,
2723                                         SDIO_FUNC_2,
2724                                         F2SYNC, bus->dataptr, dlen,
2725                                         NULL);
2726                         sublen = (u16) brcmu_pktfrombuf(pfirst, 0, dlen,
2727                                                 bus->dataptr);
2728                         if (sublen != dlen) {
2729                                 brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
2730                                           dlen, sublen);
2731                                 errcode = -1;
2732                         }
2733                         pnext = NULL;
2734                 } else {
2735                         brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
2736                                   dlen);
2737                         errcode = -1;
2738                 }
2739                 bus->f2rxdata++;
2740
2741                 /* On failure, kill the superframe, allow a couple retries */
2742                 if (errcode < 0) {
2743                         brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
2744                                   dlen, errcode);
2745                         bus->drvr->rx_errors++;
2746
2747                         if (bus->glomerr++ < 3) {
2748                                 brcmf_sdbrcm_rxfail(bus, true, true);
2749                         } else {
2750                                 bus->glomerr = 0;
2751                                 brcmf_sdbrcm_rxfail(bus, true, false);
2752                                 brcmu_pkt_buf_free_skb(bus->glom);
2753                                 bus->rxglomfail++;
2754                                 bus->glom = NULL;
2755                         }
2756                         return 0;
2757                 }
2758 #ifdef BCMDBG
2759                 if (BRCMF_GLOM_ON()) {
2760                         printk(KERN_DEBUG "SUPERFRAME:\n");
2761                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2762                                 pfirst->data, min_t(int, pfirst->len, 48));
2763                 }
2764 #endif
2765
2766                 /* Validate the superframe header */
2767                 dptr = (u8 *) (pfirst->data);
2768                 sublen = get_unaligned_le16(dptr);
2769                 check = get_unaligned_le16(dptr + sizeof(u16));
2770
2771                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
2772                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
2773                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
2774                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
2775                         brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
2776                                   bus->nextlen, seq);
2777                         bus->nextlen = 0;
2778                 }
2779                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
2780                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
2781
2782                 errcode = 0;
2783                 if ((u16)~(sublen ^ check)) {
2784                         brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
2785                                   sublen, check);
2786                         errcode = -1;
2787                 } else if (roundup(sublen, bus->blocksize) != dlen) {
2788                         brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
2789                                   sublen, roundup(sublen, bus->blocksize),
2790                                   dlen);
2791                         errcode = -1;
2792                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
2793                            SDPCM_GLOM_CHANNEL) {
2794                         brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
2795                                   SDPCM_PACKET_CHANNEL(
2796                                           &dptr[SDPCM_FRAMETAG_LEN]));
2797                         errcode = -1;
2798                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
2799                         brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
2800                         errcode = -1;
2801                 } else if ((doff < SDPCM_HDRLEN) ||
2802                            (doff > (pfirst->len - SDPCM_HDRLEN))) {
2803                         brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
2804                                   doff, sublen, pfirst->len, SDPCM_HDRLEN);
2805                         errcode = -1;
2806                 }
2807
2808                 /* Check sequence number of superframe SW header */
2809                 if (rxseq != seq) {
2810                         brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
2811                                   seq, rxseq);
2812                         bus->rx_badseq++;
2813                         rxseq = seq;
2814                 }
2815
2816                 /* Check window for sanity */
2817                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
2818                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
2819                                   txmax, bus->tx_seq);
2820                         txmax = bus->tx_seq + 2;
2821                 }
2822                 bus->tx_max = txmax;
2823
2824                 /* Remove superframe header, remember offset */
2825                 skb_pull(pfirst, doff);
2826                 sfdoff = doff;
2827
2828                 /* Validate all the subframe headers */
2829                 for (num = 0, pnext = pfirst; pnext && !errcode;
2830                      num++, pnext = pnext->next) {
2831                         dptr = (u8 *) (pnext->data);
2832                         dlen = (u16) (pnext->len);
2833                         sublen = get_unaligned_le16(dptr);
2834                         check = get_unaligned_le16(dptr + sizeof(u16));
2835                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
2836                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
2837 #ifdef BCMDBG
2838                         if (BRCMF_GLOM_ON()) {
2839                                 printk(KERN_DEBUG "subframe:\n");
2840                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2841                                                      dptr, 32);
2842                         }
2843 #endif
2844
2845                         if ((u16)~(sublen ^ check)) {
2846                                 brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
2847                                           num, sublen, check);
2848                                 errcode = -1;
2849                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
2850                                 brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
2851                                           num, sublen, dlen);
2852                                 errcode = -1;
2853                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
2854                                    (chan != SDPCM_EVENT_CHANNEL)) {
2855                                 brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
2856                                           num, chan);
2857                                 errcode = -1;
2858                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
2859                                 brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
2860                                           num, doff, sublen, SDPCM_HDRLEN);
2861                                 errcode = -1;
2862                         }
2863                 }
2864
2865                 if (errcode) {
2866                         /* Terminate frame on error, request
2867                                  a couple retries */
2868                         if (bus->glomerr++ < 3) {
2869                                 /* Restore superframe header space */
2870                                 skb_push(pfirst, sfdoff);
2871                                 brcmf_sdbrcm_rxfail(bus, true, true);
2872                         } else {
2873                                 bus->glomerr = 0;
2874                                 brcmf_sdbrcm_rxfail(bus, true, false);
2875                                 brcmu_pkt_buf_free_skb(bus->glom);
2876                                 bus->rxglomfail++;
2877                                 bus->glom = NULL;
2878                         }
2879                         bus->nextlen = 0;
2880                         return 0;
2881                 }
2882
2883                 /* Basic SD framing looks ok - process each packet (header) */
2884                 save_pfirst = pfirst;
2885                 bus->glom = NULL;
2886                 plast = NULL;
2887
2888                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
2889                         pnext = pfirst->next;
2890                         pfirst->next = NULL;
2891
2892                         dptr = (u8 *) (pfirst->data);
2893                         sublen = get_unaligned_le16(dptr);
2894                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
2895                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
2896                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
2897
2898                         brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
2899                                   num, pfirst, pfirst->data,
2900                                   pfirst->len, sublen, chan, seq);
2901
2902                         /* precondition: chan == SDPCM_DATA_CHANNEL ||
2903                                          chan == SDPCM_EVENT_CHANNEL */
2904
2905                         if (rxseq != seq) {
2906                                 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
2907                                           seq, rxseq);
2908                                 bus->rx_badseq++;
2909                                 rxseq = seq;
2910                         }
2911 #ifdef BCMDBG
2912                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2913                                 printk(KERN_DEBUG "Rx Subframe Data:\n");
2914                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2915                                                      dptr, dlen);
2916                         }
2917 #endif
2918
2919                         __skb_trim(pfirst, sublen);
2920                         skb_pull(pfirst, doff);
2921
2922                         if (pfirst->len == 0) {
2923                                 brcmu_pkt_buf_free_skb(pfirst);
2924                                 if (plast)
2925                                         plast->next = pnext;
2926                                 else
2927                                         save_pfirst = pnext;
2928
2929                                 continue;
2930                         } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx,
2931                                                        pfirst) != 0) {
2932                                 brcmf_dbg(ERROR, "rx protocol error\n");
2933                                 bus->drvr->rx_errors++;
2934                                 brcmu_pkt_buf_free_skb(pfirst);
2935                                 if (plast)
2936                                         plast->next = pnext;
2937                                 else
2938                                         save_pfirst = pnext;
2939
2940                                 continue;
2941                         }
2942
2943                         /* this packet will go up, link back into
2944                                  chain and count it */
2945                         pfirst->next = pnext;
2946                         plast = pfirst;
2947                         num++;
2948
2949 #ifdef BCMDBG
2950                         if (BRCMF_GLOM_ON()) {
2951                                 brcmf_dbg(GLOM, "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
2952                                           num, pfirst, pfirst->data,
2953                                           pfirst->len, pfirst->next,
2954                                           pfirst->prev);
2955                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2956                                                 pfirst->data,
2957                                                 min_t(int, pfirst->len, 32));
2958                         }
2959 #endif                          /* BCMDBG */
2960                 }
2961                 if (num) {
2962                         brcmf_sdbrcm_sdunlock(bus);
2963                         brcmf_rx_frame(bus->drvr, ifidx, save_pfirst, num);
2964                         brcmf_sdbrcm_sdlock(bus);
2965                 }
2966
2967                 bus->rxglomframes++;
2968                 bus->rxglompkts += num;
2969         }
2970         return num;
2971 }
2972
2973 /* Return true if there may be more frames to read */
2974 static uint
2975 brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
2976 {
2977         u16 len, check; /* Extracted hardware header fields */
2978         u8 chan, seq, doff;     /* Extracted software header fields */
2979         u8 fcbits;              /* Extracted fcbits from software header */
2980
2981         struct sk_buff *pkt;            /* Packet for event or data frames */
2982         u16 pad;                /* Number of pad bytes to read */
2983         u16 rdlen;              /* Total number of bytes to read */
2984         u8 rxseq;               /* Next sequence number to expect */
2985         uint rxleft = 0;        /* Remaining number of frames allowed */
2986         int sdret;              /* Return code from calls */
2987         u8 txmax;               /* Maximum tx sequence offered */
2988         bool len_consistent;    /* Result of comparing readahead len and
2989                                          len from hw-hdr */
2990         u8 *rxbuf;
2991         int ifidx = 0;
2992         uint rxcount = 0;       /* Total frames read */
2993
2994         brcmf_dbg(TRACE, "Enter\n");
2995
2996         /* Not finished unless we encounter no more frames indication */
2997         *finished = false;
2998
2999         for (rxseq = bus->rx_seq, rxleft = maxframes;
3000              !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
3001              rxseq++, rxleft--) {
3002
3003                 /* Handle glomming separately */
3004                 if (bus->glom || bus->glomd) {
3005                         u8 cnt;
3006                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
3007                                   bus->glomd, bus->glom);
3008                         cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
3009                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
3010                         rxseq += cnt - 1;
3011                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
3012                         continue;
3013                 }
3014
3015                 /* Try doing single read if we can */
3016                 if (brcmf_readahead && bus->nextlen) {
3017                         u16 nextlen = bus->nextlen;
3018                         bus->nextlen = 0;
3019
3020                         rdlen = len = nextlen << 4;
3021
3022                         /* Pad read to blocksize for efficiency */
3023                         if (bus->roundup && bus->blocksize
3024                             && (rdlen > bus->blocksize)) {
3025                                 pad =
3026                                     bus->blocksize -
3027                                     (rdlen % bus->blocksize);
3028                                 if ((pad <= bus->roundup)
3029                                     && (pad < bus->blocksize)
3030                                     && ((rdlen + pad + firstread) <
3031                                         MAX_RX_DATASZ))
3032                                         rdlen += pad;
3033                         } else if (rdlen % BRCMF_SDALIGN) {
3034                                 rdlen += BRCMF_SDALIGN -
3035                                          (rdlen % BRCMF_SDALIGN);
3036                         }
3037
3038                         /* We use bus->rxctl buffer in WinXP for initial
3039                          * control pkt receives.
3040                          * Later we use buffer-poll for data as well
3041                          * as control packets.
3042                          * This is required because dhd receives full
3043                          * frame in gSPI unlike SDIO.
3044                          * After the frame is received we have to
3045                          * distinguish whether it is data
3046                          * or non-data frame.
3047                          */
3048                         /* Allocate a packet buffer */
3049                         pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
3050                         if (!pkt) {
3051                                 /* Give up on data, request rtx of events */
3052                                 brcmf_dbg(ERROR, "(nextlen): brcmu_pkt_buf_get_skb failed: len %d rdlen %d expected rxseq %d\n",
3053                                           len, rdlen, rxseq);
3054                                 continue;
3055                         } else {
3056                                 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
3057                                 rxbuf = (u8 *) (pkt->data);
3058                                 /* Read the entire frame */
3059                                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
3060                                                 bus->sdiodev->sbwad,
3061                                                 SDIO_FUNC_2, F2SYNC,
3062                                                 rxbuf, rdlen,
3063                                                 pkt);
3064                                 bus->f2rxdata++;
3065
3066                                 if (sdret < 0) {
3067                                         brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
3068                                                   rdlen, sdret);
3069                                         brcmu_pkt_buf_free_skb(pkt);
3070                                         bus->drvr->rx_errors++;
3071                                         /* Force retry w/normal header read.
3072                                          * Don't attempt NAK for
3073                                          * gSPI
3074                                          */
3075                                         brcmf_sdbrcm_rxfail(bus, true, true);
3076                                         continue;
3077                                 }
3078                         }
3079
3080                         /* Now check the header */
3081                         memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
3082
3083                         /* Extract hardware header fields */
3084                         len = get_unaligned_le16(bus->rxhdr);
3085                         check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
3086
3087                         /* All zeros means readahead info was bad */
3088                         if (!(len | check)) {
3089                                 brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
3090                                 brcmf_sdbrcm_pktfree2(bus, pkt);
3091                                 continue;
3092                         }
3093
3094                         /* Validate check bytes */
3095                         if ((u16)~(len ^ check)) {
3096                                 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
3097                                           nextlen, len, check);
3098                                 bus->rx_badhdr++;
3099                                 brcmf_sdbrcm_rxfail(bus, false, false);
3100                                 brcmf_sdbrcm_pktfree2(bus, pkt);
3101                                 continue;
3102                         }
3103
3104                         /* Validate frame length */
3105                         if (len < SDPCM_HDRLEN) {
3106                                 brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
3107                                           len);
3108                                 brcmf_sdbrcm_pktfree2(bus, pkt);
3109                                 continue;
3110                         }
3111
3112                         /* Check for consistency withreadahead info */
3113                         len_consistent = (nextlen != (roundup(len, 16) >> 4));
3114                         if (len_consistent) {
3115                                 /* Mismatch, force retry w/normal
3116                                         header (may be >4K) */
3117                                 brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
3118                                           nextlen, len, roundup(len, 16),
3119                                           rxseq);
3120                                 brcmf_sdbrcm_rxfail(bus, true, true);
3121                                 brcmf_sdbrcm_pktfree2(bus, pkt);
3122                                 continue;
3123                         }
3124
3125                         /* Extract software header fields */
3126                         chan = SDPCM_PACKET_CHANNEL(
3127                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3128                         seq = SDPCM_PACKET_SEQUENCE(
3129                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3130                         doff = SDPCM_DOFFSET_VALUE(
3131                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3132                         txmax = SDPCM_WINDOW_VALUE(
3133                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3134
3135                         bus->nextlen =
3136                             bus->rxhdr[SDPCM_FRAMETAG_LEN +
3137                                        SDPCM_NEXTLEN_OFFSET];
3138                         if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3139                                 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
3140                                           bus->nextlen, seq);
3141                                 bus->nextlen = 0;
3142                         }
3143
3144                         bus->drvr->rx_readahead_cnt++;
3145
3146                         /* Handle Flow Control */
3147                         fcbits = SDPCM_FCMASK_VALUE(
3148                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3149
3150                         if (bus->flowcontrol != fcbits) {
3151                                 if (~bus->flowcontrol & fcbits)
3152                                         bus->fc_xoff++;
3153
3154                                 if (bus->flowcontrol & ~fcbits)
3155                                         bus->fc_xon++;
3156
3157                                 bus->fc_rcvd++;
3158                                 bus->flowcontrol = fcbits;
3159                         }
3160
3161                         /* Check and update sequence number */
3162                         if (rxseq != seq) {
3163                                 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
3164                                           seq, rxseq);
3165                                 bus->rx_badseq++;
3166                                 rxseq = seq;
3167                         }
3168
3169                         /* Check window for sanity */
3170                         if ((u8) (txmax - bus->tx_seq) > 0x40) {
3171                                 brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
3172                                           txmax, bus->tx_seq);
3173                                 txmax = bus->tx_seq + 2;
3174                         }
3175                         bus->tx_max = txmax;
3176
3177 #ifdef BCMDBG
3178                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
3179                                 printk(KERN_DEBUG "Rx Data:\n");
3180                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3181                                                      rxbuf, len);
3182                         } else if (BRCMF_HDRS_ON()) {
3183                                 printk(KERN_DEBUG "RxHdr:\n");
3184                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3185                                                      bus->rxhdr, SDPCM_HDRLEN);
3186                         }
3187 #endif
3188
3189                         if (chan == SDPCM_CONTROL_CHANNEL) {
3190                                 brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
3191                                           seq);
3192                                 /* Force retry w/normal header read */
3193                                 bus->nextlen = 0;
3194                                 brcmf_sdbrcm_rxfail(bus, false, true);
3195                                 brcmf_sdbrcm_pktfree2(bus, pkt);
3196                                 continue;
3197                         }
3198
3199                         /* Validate data offset */
3200                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
3201                                 brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
3202                                           doff, len, SDPCM_HDRLEN);
3203                                 brcmf_sdbrcm_rxfail(bus, false, false);
3204                                 brcmf_sdbrcm_pktfree2(bus, pkt);
3205                                 continue;
3206                         }
3207
3208                         /* All done with this one -- now deliver the packet */
3209                         goto deliver;
3210                 }
3211
3212                 /* Read frame header (hardware and software) */
3213                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
3214                                 SDIO_FUNC_2, F2SYNC, bus->rxhdr, firstread,
3215                                 NULL);
3216                 bus->f2rxhdrs++;
3217
3218                 if (sdret < 0) {
3219                         brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
3220                         bus->rx_hdrfail++;
3221                         brcmf_sdbrcm_rxfail(bus, true, true);
3222                         continue;
3223                 }
3224 #ifdef BCMDBG
3225                 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
3226                         printk(KERN_DEBUG "RxHdr:\n");
3227                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3228                                              bus->rxhdr, SDPCM_HDRLEN);
3229                 }
3230 #endif
3231
3232                 /* Extract hardware header fields */
3233                 len = get_unaligned_le16(bus->rxhdr);
3234                 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
3235
3236                 /* All zeros means no more frames */
3237                 if (!(len | check)) {
3238                         *finished = true;
3239                         break;
3240                 }
3241
3242                 /* Validate check bytes */
3243                 if ((u16) ~(len ^ check)) {
3244                         brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
3245                                   len, check);
3246                         bus->rx_badhdr++;
3247                         brcmf_sdbrcm_rxfail(bus, false, false);
3248                         continue;
3249                 }
3250
3251                 /* Validate frame length */
3252                 if (len < SDPCM_HDRLEN) {
3253                         brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
3254                         continue;
3255                 }
3256
3257                 /* Extract software header fields */
3258                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3259                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3260                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3261                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3262
3263                 /* Validate data offset */
3264                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
3265                         brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
3266                                   doff, len, SDPCM_HDRLEN, seq);
3267                         bus->rx_badhdr++;
3268                         brcmf_sdbrcm_rxfail(bus, false, false);
3269                         continue;
3270                 }
3271
3272                 /* Save the readahead length if there is one */
3273                 bus->nextlen =
3274                     bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3275                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3276                         brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
3277                                   bus->nextlen, seq);
3278                         bus->nextlen = 0;
3279                 }
3280
3281                 /* Handle Flow Control */
3282                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3283
3284                 if (bus->flowcontrol != fcbits) {
3285                         if (~bus->flowcontrol & fcbits)
3286                                 bus->fc_xoff++;
3287
3288                         if (bus->flowcontrol & ~fcbits)
3289                                 bus->fc_xon++;
3290
3291                         bus->fc_rcvd++;
3292                         bus->flowcontrol = fcbits;
3293                 }
3294
3295                 /* Check and update sequence number */
3296                 if (rxseq != seq) {
3297                         brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
3298                         bus->rx_badseq++;
3299                         rxseq = seq;
3300                 }
3301
3302                 /* Check window for sanity */
3303                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
3304                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
3305                                   txmax, bus->tx_seq);
3306                         txmax = bus->tx_seq + 2;
3307                 }
3308                 bus->tx_max = txmax;
3309
3310                 /* Call a separate function for control frames */
3311                 if (chan == SDPCM_CONTROL_CHANNEL) {
3312                         brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
3313                         continue;
3314                 }
3315
3316                 /* precondition: chan is either SDPCM_DATA_CHANNEL,
3317                    SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
3318                    SDPCM_GLOM_CHANNEL */
3319
3320                 /* Length to read */
3321                 rdlen = (len > firstread) ? (len - firstread) : 0;
3322
3323                 /* May pad read to blocksize for efficiency */
3324                 if (bus->roundup && bus->blocksize &&
3325                         (rdlen > bus->blocksize)) {
3326                         pad = bus->blocksize - (rdlen % bus->blocksize);
3327                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3328                             ((rdlen + pad + firstread) < MAX_RX_DATASZ))
3329                                 rdlen += pad;
3330                 } else if (rdlen % BRCMF_SDALIGN) {
3331                         rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
3332                 }
3333
3334                 /* Satisfy length-alignment requirements */
3335                 if (forcealign && (rdlen & (ALIGNMENT - 1)))
3336                         rdlen = roundup(rdlen, ALIGNMENT);
3337
3338                 if ((rdlen + firstread) > MAX_RX_DATASZ) {
3339                         /* Too long -- skip this frame */
3340                         brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
3341                                   len, rdlen);
3342                         bus->drvr->rx_errors++;
3343                         bus->rx_toolong++;
3344                         brcmf_sdbrcm_rxfail(bus, false, false);
3345                         continue;
3346                 }
3347
3348                 pkt = brcmu_pkt_buf_get_skb(rdlen + firstread + BRCMF_SDALIGN);
3349                 if (!pkt) {
3350                         /* Give up on data, request rtx of events */
3351                         brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
3352                                   rdlen, chan);
3353                         bus->drvr->rx_dropped++;
3354                         brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
3355                         continue;
3356                 }
3357
3358                 /* Leave room for what we already read, and align remainder */
3359                 skb_pull(pkt, firstread);
3360                 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
3361
3362                 /* Read the remaining frame data */
3363                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
3364                                 SDIO_FUNC_2, F2SYNC, ((u8 *) (pkt->data)),
3365                                 rdlen, pkt);
3366                 bus->f2rxdata++;
3367
3368                 if (sdret < 0) {
3369                         brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
3370                                   ((chan == SDPCM_EVENT_CHANNEL) ? "event"
3371                                    : ((chan == SDPCM_DATA_CHANNEL) ? "data"
3372                                       : "test")), sdret);
3373                         brcmu_pkt_buf_free_skb(pkt);
3374                         bus->drvr->rx_errors++;
3375                         brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
3376                         continue;
3377                 }
3378
3379                 /* Copy the already-read portion */
3380                 skb_push(pkt, firstread);
3381                 memcpy(pkt->data, bus->rxhdr, firstread);
3382
3383 #ifdef BCMDBG
3384                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
3385                         printk(KERN_DEBUG "Rx Data:\n");
3386                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3387                                              pkt->data, len);
3388                 }
3389 #endif
3390
3391 deliver:
3392                 /* Save superframe descriptor and allocate packet frame */
3393                 if (chan == SDPCM_GLOM_CHANNEL) {
3394                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
3395                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
3396                                           len);
3397 #ifdef BCMDBG
3398                                 if (BRCMF_GLOM_ON()) {
3399                                         printk(KERN_DEBUG "Glom Data:\n");
3400                                         print_hex_dump_bytes("",
3401                                                              DUMP_PREFIX_OFFSET,
3402                                                              pkt->data, len);
3403                                 }
3404 #endif
3405                                 __skb_trim(pkt, len);
3406                                 skb_pull(pkt, SDPCM_HDRLEN);
3407                                 bus->glomd = pkt;
3408                         } else {
3409                                 brcmf_dbg(ERROR, "%s: glom superframe w/o "
3410                                           "descriptor!\n", __func__);
3411                                 brcmf_sdbrcm_rxfail(bus, false, false);
3412                         }
3413                         continue;
3414                 }
3415
3416                 /* Fill in packet len and prio, deliver upward */
3417                 __skb_trim(pkt, len);
3418                 skb_pull(pkt, doff);
3419
3420                 if (pkt->len == 0) {
3421                         brcmu_pkt_buf_free_skb(pkt);
3422                         continue;
3423                 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
3424                         brcmf_dbg(ERROR, "rx protocol error\n");
3425                         brcmu_pkt_buf_free_skb(pkt);
3426                         bus->drvr->rx_errors++;
3427                         continue;
3428                 }
3429
3430                 /* Unlock during rx call */
3431                 brcmf_sdbrcm_sdunlock(bus);
3432                 brcmf_rx_frame(bus->drvr, ifidx, pkt, 1);
3433                 brcmf_sdbrcm_sdlock(bus);
3434         }
3435         rxcount = maxframes - rxleft;
3436 #ifdef BCMDBG
3437         /* Message if we hit the limit */
3438         if (!rxleft)
3439                 brcmf_dbg(DATA, "hit rx limit of %d frames\n",
3440                           maxframes);
3441         else
3442 #endif                          /* BCMDBG */
3443                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
3444         /* Back off rxseq if awaiting rtx, update rx_seq */
3445         if (bus->rxskip)
3446                 rxseq--;
3447         bus->rx_seq = rxseq;
3448
3449         return rxcount;
3450 }
3451
3452 static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
3453 {
3454         u32 intstatus = 0;
3455         u32 hmb_data;
3456         u8 fcbits;
3457         uint retries = 0;
3458
3459         brcmf_dbg(TRACE, "Enter\n");
3460
3461         /* Read mailbox data and ack that we did so */
3462         r_sdreg32(bus, &hmb_data,
3463                   offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
3464
3465         if (retries <= retry_limit)
3466                 w_sdreg32(bus, SMB_INT_ACK,
3467                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
3468         bus->f1regdata += 2;
3469
3470         /* Dongle recomposed rx frames, accept them again */
3471         if (hmb_data & HMB_DATA_NAKHANDLED) {
3472                 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
3473                           bus->rx_seq);
3474                 if (!bus->rxskip)
3475                         brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
3476
3477                 bus->rxskip = false;
3478                 intstatus |= I_HMB_FRAME_IND;
3479         }
3480
3481         /*
3482          * DEVREADY does not occur with gSPI.
3483          */
3484         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
3485                 bus->sdpcm_ver =
3486                     (hmb_data & HMB_DATA_VERSION_MASK) >>
3487                     HMB_DATA_VERSION_SHIFT;
3488                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
3489                         brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
3490                                   "expecting %d\n",
3491                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
3492                 else
3493                         brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
3494                                   bus->sdpcm_ver);
3495         }
3496
3497         /*
3498          * Flow Control has been moved into the RX headers and this out of band
3499          * method isn't used any more.
3500          * remaining backward compatible with older dongles.
3501          */
3502         if (hmb_data & HMB_DATA_FC) {
3503                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
3504                                                         HMB_DATA_FCDATA_SHIFT;
3505
3506                 if (fcbits & ~bus->flowcontrol)
3507                         bus->fc_xoff++;
3508
3509                 if (bus->flowcontrol & ~fcbits)
3510                         bus->fc_xon++;
3511
3512                 bus->fc_rcvd++;
3513                 bus->flowcontrol = fcbits;
3514         }
3515
3516         /* Shouldn't be any others */
3517         if (hmb_data & ~(HMB_DATA_DEVREADY |
3518                          HMB_DATA_NAKHANDLED |
3519                          HMB_DATA_FC |
3520                          HMB_DATA_FWREADY |
3521                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
3522                 brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
3523                           hmb_data);
3524
3525         return intstatus;
3526 }
3527
3528 static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
3529 {
3530         u32 intstatus, newstatus = 0;
3531         uint retries = 0;
3532         uint rxlimit = brcmf_rxbound;   /* Rx frames to read before resched */
3533         uint txlimit = brcmf_txbound;   /* Tx frames to send before resched */
3534         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
3535         bool rxdone = true;     /* Flag for no more read data */
3536         bool resched = false;   /* Flag indicating resched wanted */
3537
3538         brcmf_dbg(TRACE, "Enter\n");
3539
3540         /* Start with leftover status bits */
3541         intstatus = bus->intstatus;
3542
3543         brcmf_sdbrcm_sdlock(bus);
3544
3545         /* If waiting for HTAVAIL, check status */
3546         if (bus->clkstate == CLK_PENDING) {
3547                 int err;
3548                 u8 clkctl, devctl = 0;
3549
3550 #ifdef BCMDBG
3551                 /* Check for inconsistent device control */
3552                 devctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3553                                                SBSDIO_DEVICE_CTL, &err);
3554                 if (err) {
3555                         brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
3556                         bus->drvr->busstate = BRCMF_BUS_DOWN;
3557                 }
3558 #endif                          /* BCMDBG */
3559
3560                 /* Read CSR, if clock on switch to AVAIL, else ignore */
3561                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3562                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
3563                 if (err) {
3564                         brcmf_dbg(ERROR, "error reading CSR: %d\n",
3565                                   err);
3566                         bus->drvr->busstate = BRCMF_BUS_DOWN;
3567                 }
3568
3569                 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
3570                           devctl, clkctl);
3571
3572                 if (SBSDIO_HTAV(clkctl)) {
3573                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
3574                                                        SDIO_FUNC_1,
3575                                                        SBSDIO_DEVICE_CTL, &err);
3576                         if (err) {
3577                                 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
3578                                           err);
3579                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
3580                         }
3581                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
3582                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3583                                 SBSDIO_DEVICE_CTL, devctl, &err);
3584                         if (err) {
3585                                 brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
3586                                           err);
3587                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
3588                         }
3589                         bus->clkstate = CLK_AVAIL;
3590                 } else {
3591                         goto clkwait;
3592                 }
3593         }
3594
3595         bus_wake(bus);
3596
3597         /* Make sure backplane clock is on */
3598         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
3599         if (bus->clkstate == CLK_PENDING)
3600                 goto clkwait;
3601
3602         /* Pending interrupt indicates new device status */
3603         if (bus->ipend) {
3604                 bus->ipend = false;
3605                 r_sdreg32(bus, &newstatus,
3606                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3607                 bus->f1regdata++;
3608                 if (brcmf_sdcard_regfail(bus->sdiodev))
3609                         newstatus = 0;
3610                 newstatus &= bus->hostintmask;
3611                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
3612                 if (newstatus) {
3613                         w_sdreg32(bus, newstatus,
3614                                   offsetof(struct sdpcmd_regs, intstatus),
3615                                   &retries);
3616                         bus->f1regdata++;
3617                 }
3618         }
3619
3620         /* Merge new bits with previous */
3621         intstatus |= newstatus;
3622         bus->intstatus = 0;
3623
3624         /* Handle flow-control change: read new state in case our ack
3625          * crossed another change interrupt.  If change still set, assume
3626          * FC ON for safety, let next loop through do the debounce.
3627          */
3628         if (intstatus & I_HMB_FC_CHANGE) {
3629                 intstatus &= ~I_HMB_FC_CHANGE;
3630                 w_sdreg32(bus, I_HMB_FC_CHANGE,
3631                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3632
3633                 r_sdreg32(bus, &newstatus,
3634                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3635                 bus->f1regdata += 2;
3636                 bus->fcstate =
3637                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
3638                 intstatus |= (newstatus & bus->hostintmask);
3639         }
3640
3641         /* Handle host mailbox indication */
3642         if (intstatus & I_HMB_HOST_INT) {
3643                 intstatus &= ~I_HMB_HOST_INT;
3644                 intstatus |= brcmf_sdbrcm_hostmail(bus);
3645         }
3646
3647         /* Generally don't ask for these, can get CRC errors... */
3648         if (intstatus & I_WR_OOSYNC) {
3649                 brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
3650                 intstatus &= ~I_WR_OOSYNC;
3651         }
3652
3653         if (intstatus & I_RD_OOSYNC) {
3654                 brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
3655                 intstatus &= ~I_RD_OOSYNC;
3656         }
3657
3658         if (intstatus & I_SBINT) {
3659                 brcmf_dbg(ERROR, "Dongle reports SBINT\n");
3660                 intstatus &= ~I_SBINT;
3661         }
3662
3663         /* Would be active due to wake-wlan in gSPI */
3664         if (intstatus & I_CHIPACTIVE) {
3665                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
3666                 intstatus &= ~I_CHIPACTIVE;
3667         }
3668
3669         /* Ignore frame indications if rxskip is set */
3670         if (bus->rxskip)
3671                 intstatus &= ~I_HMB_FRAME_IND;
3672
3673         /* On frame indication, read available frames */
3674         if (PKT_AVAILABLE()) {
3675                 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
3676                 if (rxdone || bus->rxskip)
3677                         intstatus &= ~I_HMB_FRAME_IND;
3678                 rxlimit -= min(framecnt, rxlimit);
3679         }
3680
3681         /* Keep still-pending events for next scheduling */
3682         bus->intstatus = intstatus;
3683
3684 clkwait:
3685         if (data_ok(bus) && bus->ctrl_frame_stat &&
3686                 (bus->clkstate == CLK_AVAIL)) {
3687                 int ret, i;
3688
3689                 ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
3690                         SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
3691                         (u32) bus->ctrl_frame_len, NULL);
3692
3693                 if (ret < 0) {
3694                         /* On failure, abort the command and
3695                                 terminate the frame */
3696                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
3697                                   ret);
3698                         bus->tx_sderrs++;
3699
3700                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
3701
3702                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3703                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
3704                                          NULL);
3705                         bus->f1regdata++;
3706
3707                         for (i = 0; i < 3; i++) {
3708                                 u8 hi, lo;
3709                                 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
3710                                                      SDIO_FUNC_1,
3711                                                      SBSDIO_FUNC1_WFRAMEBCHI,
3712                                                      NULL);
3713                                 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
3714                                                      SDIO_FUNC_1,
3715                                                      SBSDIO_FUNC1_WFRAMEBCLO,
3716                                                      NULL);
3717                                 bus->f1regdata += 2;
3718                                 if ((hi == 0) && (lo == 0))
3719                                         break;
3720                         }
3721
3722                 }
3723                 if (ret == 0)
3724                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
3725
3726                 brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
3727                 bus->ctrl_frame_stat = false;
3728                 brcmf_sdbrcm_wait_event_wakeup(bus);
3729         }
3730         /* Send queued frames (limit 1 if rx may still be pending) */
3731         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
3732                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
3733                  && data_ok(bus)) {
3734                 framecnt = rxdone ? txlimit : min(txlimit, brcmf_txminmax);
3735                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
3736                 txlimit -= framecnt;
3737         }
3738
3739         /* Resched if events or tx frames are pending,
3740                  else await next interrupt */
3741         /* On failed register access, all bets are off:
3742                  no resched or interrupts */
3743         if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
3744             brcmf_sdcard_regfail(bus->sdiodev)) {
3745                 brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation %d\n",
3746                           brcmf_sdcard_regfail(bus->sdiodev));
3747                 bus->drvr->busstate = BRCMF_BUS_DOWN;
3748                 bus->intstatus = 0;
3749         } else if (bus->clkstate == CLK_PENDING) {
3750                 brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
3751                 resched = true;
3752         } else if (bus->intstatus || bus->ipend ||
3753                 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
3754                  && data_ok(bus)) || PKT_AVAILABLE()) {
3755                 resched = true;
3756         }
3757
3758         bus->dpc_sched = resched;
3759
3760         /* If we're done for now, turn off clock request. */
3761         if ((bus->clkstate != CLK_PENDING)
3762             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
3763                 bus->activity = false;
3764                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3765         }
3766
3767         brcmf_sdbrcm_sdunlock(bus);
3768
3769         return resched;
3770 }
3771
3772 void brcmf_sdbrcm_isr(void *arg)
3773 {
3774         struct brcmf_bus *bus = (struct brcmf_bus *) arg;
3775
3776         brcmf_dbg(TRACE, "Enter\n");
3777
3778         if (!bus) {
3779                 brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
3780                 return;
3781         }
3782
3783         if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
3784                 brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
3785                 return;
3786         }
3787         /* Count the interrupt call */
3788         bus->intrcount++;
3789         bus->ipend = true;
3790
3791         /* Shouldn't get this interrupt if we're sleeping? */
3792         if (bus->sleeping) {
3793                 brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
3794                 return;
3795         }
3796
3797         /* Disable additional interrupts (is this needed now)? */
3798         if (!bus->intr)
3799                 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
3800
3801         bus->dpc_sched = true;
3802         brcmf_sdbrcm_sched_dpc(bus);
3803 }
3804
3805 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
3806 {
3807         struct brcmf_bus *bus;
3808
3809         brcmf_dbg(TIMER, "Enter\n");
3810
3811         bus = drvr->bus;
3812
3813         if (bus->drvr->dongle_reset)
3814                 return false;
3815
3816         /* Ignore the timer if simulating bus down */
3817         if (bus->sleeping)
3818                 return false;
3819
3820         brcmf_sdbrcm_sdlock(bus);
3821
3822         /* Poll period: check device if appropriate. */
3823         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3824                 u32 intstatus = 0;
3825
3826                 /* Reset poll tick */
3827                 bus->polltick = 0;
3828
3829                 /* Check device if no interrupts */
3830                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
3831
3832                         if (!bus->dpc_sched) {
3833                                 u8 devpend;
3834                                 devpend = brcmf_sdcard_cfg_read(bus->sdiodev,
3835                                                 SDIO_FUNC_0, SDIO_CCCR_INTx,
3836                                                 NULL);
3837                                 intstatus =
3838                                     devpend & (INTR_STATUS_FUNC1 |
3839                                                INTR_STATUS_FUNC2);
3840                         }
3841
3842                         /* If there is something, make like the ISR and
3843                                  schedule the DPC */
3844                         if (intstatus) {
3845                                 bus->pollcnt++;
3846                                 bus->ipend = true;
3847
3848                                 bus->dpc_sched = true;
3849                                 brcmf_sdbrcm_sched_dpc(bus);
3850
3851                         }
3852                 }
3853
3854                 /* Update interrupt tracking */
3855                 bus->lastintrs = bus->intrcount;
3856         }
3857 #ifdef BCMDBG
3858         /* Poll for console output periodically */
3859         if (drvr->busstate == BRCMF_BUS_DATA && brcmf_console_ms != 0) {
3860                 bus->console.count += brcmf_watchdog_ms;
3861                 if (bus->console.count >= brcmf_console_ms) {
3862                         bus->console.count -= brcmf_console_ms;
3863                         /* Make sure backplane clock is on */
3864                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3865                         if (brcmf_sdbrcm_readconsole(bus) < 0)
3866                                 brcmf_console_ms = 0;   /* On error,
3867                                                          stop trying */
3868                 }
3869         }
3870 #endif                          /* BCMDBG */
3871
3872         /* On idle timeout clear activity flag and/or turn off clock */
3873         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3874                 if (++bus->idlecount >= bus->idletime) {
3875                         bus->idlecount = 0;
3876                         if (bus->activity) {
3877                                 bus->activity = false;
3878                                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
3879                         } else {
3880                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3881                         }
3882                 }
3883         }
3884
3885         brcmf_sdbrcm_sdunlock(bus);
3886
3887         return bus->ipend;
3888 }
3889
3890 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3891 {
3892         if (chipid == BCM4329_CHIP_ID)
3893                 return true;
3894         return false;
3895 }
3896
3897 void *brcmf_sdbrcm_probe(u16 bus_no, u16 slot, u16 func, uint bustype,
3898                          u32 regsva, struct brcmf_sdio_dev *sdiodev)
3899 {
3900         int ret;
3901         struct brcmf_bus *bus;
3902
3903         /* Init global variables at run-time, not as part of the declaration.
3904          * This is required to support init/de-init of the driver.
3905          * Initialization
3906          * of globals as part of the declaration results in non-deterministic
3907          * behavior since the value of the globals may be different on the
3908          * first time that the driver is initialized vs subsequent
3909          * initializations.
3910          */
3911         brcmf_txbound = BRCMF_TXBOUND;
3912         brcmf_rxbound = BRCMF_RXBOUND;
3913         brcmf_alignctl = true;
3914         brcmf_readahead = true;
3915         retrydata = false;
3916         brcmf_dongle_memsize = 0;
3917         brcmf_txminmax = BRCMF_TXMINMAX;
3918
3919         forcealign = true;
3920
3921         brcmf_c_init();
3922
3923         brcmf_dbg(TRACE, "Enter\n");
3924
3925         /* We make an assumption about address window mappings:
3926          * regsva == SI_ENUM_BASE*/
3927
3928         /* Allocate private bus interface state */
3929         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
3930         if (!bus) {
3931                 brcmf_dbg(ERROR, "kmalloc of struct dhd_bus failed\n");
3932                 goto fail;
3933         }
3934         bus->sdiodev = sdiodev;
3935         sdiodev->bus = bus;
3936         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
3937         bus->usebufpool = false;        /* Use bufpool if allocated,
3938                                          else use locally malloced rxbuf */
3939
3940         /* attempt to attach to the dongle */
3941         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3942                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
3943                 goto fail;
3944         }
3945
3946         spin_lock_init(&bus->txqlock);
3947         init_waitqueue_head(&bus->ctrl_wait);
3948         init_waitqueue_head(&bus->ioctl_resp_wait);
3949
3950         /* Set up the watchdog timer */
3951         init_timer(&bus->timer);
3952         bus->timer.data = (unsigned long)bus;
3953         bus->timer.function = brcmf_sdbrcm_watchdog;
3954
3955         /* Initialize thread based operation and lock */
3956         if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)) {
3957                 bus->threads_only = true;
3958                 sema_init(&bus->sdsem, 1);
3959         } else {
3960                 bus->threads_only = false;
3961                 spin_lock_init(&bus->sdlock);
3962         }
3963
3964         if (brcmf_dpc_prio >= 0) {
3965                 /* Initialize watchdog thread */
3966                 init_completion(&bus->watchdog_wait);
3967                 bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3968                                                 bus, "brcmf_watchdog");
3969                 if (IS_ERR(bus->watchdog_tsk)) {
3970                         printk(KERN_WARNING
3971                                "brcmf_watchdog thread failed to start\n");
3972                         bus->watchdog_tsk = NULL;
3973                 }
3974         } else
3975                 bus->watchdog_tsk = NULL;
3976
3977         /* Set up the bottom half handler */
3978         if (brcmf_dpc_prio >= 0) {
3979                 /* Initialize DPC thread */
3980                 init_completion(&bus->dpc_wait);
3981                 bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
3982                                            bus, "brcmf_dpc");
3983                 if (IS_ERR(bus->dpc_tsk)) {
3984                         printk(KERN_WARNING
3985                                "brcmf_dpc thread failed to start\n");
3986                         bus->dpc_tsk = NULL;
3987                 }
3988         } else {
3989                 tasklet_init(&bus->tasklet, brcmf_sdbrcm_dpc_tasklet,
3990                              (unsigned long)bus);
3991                 bus->dpc_tsk = NULL;
3992         }
3993
3994         /* Attach to the brcmf/OS/network interface */
3995         bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
3996         if (!bus->drvr) {
3997                 brcmf_dbg(ERROR, "brcmf_attach failed\n");
3998                 goto fail;
3999         }
4000
4001         /* Allocate buffers */
4002         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
4003                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
4004                 goto fail;
4005         }
4006
4007         if (!(brcmf_sdbrcm_probe_init(bus))) {
4008                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
4009                 goto fail;
4010         }
4011
4012         /* Register interrupt callback, but mask it (not operational yet). */
4013         brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
4014         ret = brcmf_sdcard_intr_reg(bus->sdiodev);
4015         if (ret != 0) {
4016                 brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
4017                 goto fail;
4018         }
4019         brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
4020
4021         brcmf_dbg(INFO, "completed!!\n");
4022
4023         /* if firmware path present try to download and bring up bus */
4024         ret = brcmf_bus_start(bus->drvr);
4025         if (ret != 0) {
4026                 if (ret == -ENOLINK) {
4027                         brcmf_dbg(ERROR, "dongle is not responding\n");
4028                         goto fail;
4029                 }
4030         }
4031         /* Ok, have the per-port tell the stack we're open for business */
4032         if (brcmf_net_attach(bus->drvr, 0) != 0) {
4033                 brcmf_dbg(ERROR, "Net attach failed!!\n");
4034                 goto fail;
4035         }
4036
4037         return bus;
4038
4039 fail:
4040         brcmf_sdbrcm_release(bus);
4041         return NULL;
4042 }
4043
4044 static bool
4045 brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, u32 regsva)
4046 {
4047         u8 clkctl = 0;
4048         int err = 0;
4049         int reg_addr;
4050         u32 reg_val;
4051
4052         bus->alp_only = true;
4053
4054         /* Return the window to backplane enumeration space for core access */
4055         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, SI_ENUM_BASE))
4056                 brcmf_dbg(ERROR, "FAILED to return to SI_ENUM_BASE\n");
4057
4058 #ifdef BCMDBG
4059         printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
4060                brcmf_sdcard_reg_read(bus->sdiodev, SI_ENUM_BASE, 4));
4061
4062 #endif                          /* BCMDBG */
4063
4064         /*
4065          * Force PLL off until brcmf_sdbrcm_chip_attach()
4066          * programs PLL control regs
4067          */
4068
4069         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4070                                SBSDIO_FUNC1_CHIPCLKCSR,
4071                                BRCMF_INIT_CLKCTL1, &err);
4072         if (!err)
4073                 clkctl =
4074                     brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4075                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
4076
4077         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
4078                 brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
4079                           err, BRCMF_INIT_CLKCTL1, clkctl);
4080                 goto fail;
4081         }
4082
4083         if (brcmf_sdbrcm_chip_attach(bus, regsva)) {
4084                 brcmf_dbg(ERROR, "brcmf_sdbrcm_chip_attach failed!\n");
4085                 goto fail;
4086         }
4087
4088         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
4089                 brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
4090                 goto fail;
4091         }
4092
4093         brcmf_sdbrcm_sdiod_drive_strength_init(bus, brcmf_sdiod_drive_strength);
4094
4095         /* Get info on the ARM and SOCRAM cores... */
4096         brcmf_sdcard_reg_read(bus->sdiodev,
4097                   CORE_SB(bus->ci->armcorebase, sbidhigh), 4);
4098         bus->orig_ramsize = bus->ci->ramsize;
4099         if (!(bus->orig_ramsize)) {
4100                 brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
4101                 goto fail;
4102         }
4103         bus->ramsize = bus->orig_ramsize;
4104         if (brcmf_dongle_memsize)
4105                 brcmf_sdbrcm_setmemsize(bus, brcmf_dongle_memsize);
4106
4107         brcmf_dbg(ERROR, "DHD: dongle ram size is set to %d(orig %d)\n",
4108                   bus->ramsize, bus->orig_ramsize);
4109
4110         /* Set core control so an SDIO reset does a backplane reset */
4111         reg_addr = bus->ci->buscorebase +
4112                    offsetof(struct sdpcmd_regs, corecontrol);
4113         reg_val = brcmf_sdcard_reg_read(bus->sdiodev, reg_addr, sizeof(u32));
4114         brcmf_sdcard_reg_write(bus->sdiodev, reg_addr, sizeof(u32),
4115                                reg_val | CC_BPRESEN);
4116
4117         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
4118
4119         /* Locate an appropriately-aligned portion of hdrbuf */
4120         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
4121                                     BRCMF_SDALIGN);
4122
4123         /* Set the poll and/or interrupt flags */
4124         bus->intr = (bool) brcmf_intr;
4125         bus->poll = (bool) brcmf_poll;
4126         if (bus->poll)
4127                 bus->pollrate = 1;
4128
4129         return true;
4130
4131 fail:
4132         return false;
4133 }
4134
4135 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus)
4136 {
4137         brcmf_dbg(TRACE, "Enter\n");
4138
4139         if (bus->drvr->maxctl) {
4140                 bus->rxblen =
4141                     roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
4142                             ALIGNMENT) + BRCMF_SDALIGN;
4143                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
4144                 if (!(bus->rxbuf)) {
4145                         brcmf_dbg(ERROR, "kmalloc of %d-byte rxbuf failed\n",
4146                                   bus->rxblen);
4147                         goto fail;
4148                 }
4149         }
4150
4151         /* Allocate buffer to receive glomed packet */
4152         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
4153         if (!(bus->databuf)) {
4154                 brcmf_dbg(ERROR, "kmalloc of %d-byte databuf failed\n",
4155                           MAX_DATA_BUF);
4156                 /* release rxbuf which was already located as above */
4157                 if (!bus->rxblen)
4158                         kfree(bus->rxbuf);
4159                 goto fail;
4160         }
4161
4162         /* Align the buffer */
4163         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
4164                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
4165                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
4166         else
4167                 bus->dataptr = bus->databuf;
4168
4169         return true;
4170
4171 fail:
4172         return false;
4173 }
4174
4175 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus)
4176 {
4177         brcmf_dbg(TRACE, "Enter\n");
4178
4179         /* Disable F2 to clear any intermediate frame state on the dongle */
4180         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
4181                                SDIO_FUNC_ENABLE_1, NULL);
4182
4183         bus->drvr->busstate = BRCMF_BUS_DOWN;
4184         bus->sleeping = false;
4185         bus->rxflow = false;
4186
4187         /* Done with backplane-dependent accesses, can drop clock... */
4188         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4189                                SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
4190
4191         /* ...and initialize clock/power states */
4192         bus->clkstate = CLK_SDONLY;
4193         bus->idletime = (s32) brcmf_idletime;
4194         bus->idleclock = BRCMF_IDLE_ACTIVE;
4195
4196         /* Query the F2 block size, set roundup accordingly */
4197         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
4198         bus->roundup = min(max_roundup, bus->blocksize);
4199
4200         /* bus module does not support packet chaining */
4201         bus->use_rxchain = false;
4202         bus->sd_rxchain = false;
4203
4204         return true;
4205 }
4206
4207 static bool
4208 brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
4209 {
4210         bool ret;
4211
4212         /* Download the firmware */
4213         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
4214
4215         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
4216
4217         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
4218
4219         return ret;
4220 }
4221
4222 /* Detach and free everything */
4223 static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
4224 {
4225         brcmf_dbg(TRACE, "Enter\n");
4226
4227         if (bus) {
4228                 /* De-register interrupt handler */
4229                 brcmf_sdcard_intr_dereg(bus->sdiodev);
4230
4231                 if (bus->drvr) {
4232                         brcmf_detach(bus->drvr);
4233                         brcmf_sdbrcm_release_dongle(bus);
4234                         bus->drvr = NULL;
4235                 }
4236
4237                 brcmf_sdbrcm_release_malloc(bus);
4238
4239                 kfree(bus);
4240         }
4241
4242         brcmf_dbg(TRACE, "Disconnected\n");
4243 }
4244
4245 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
4246 {
4247         brcmf_dbg(TRACE, "Enter\n");
4248
4249         if (bus->drvr && bus->drvr->dongle_reset)
4250                 return;
4251
4252         kfree(bus->rxbuf);
4253         bus->rxctl = bus->rxbuf = NULL;
4254         bus->rxlen = 0;
4255
4256         kfree(bus->databuf);
4257         bus->databuf = NULL;
4258 }
4259
4260 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
4261 {
4262         brcmf_dbg(TRACE, "Enter\n");
4263
4264         if (bus->drvr && bus->drvr->dongle_reset)
4265                 return;
4266
4267         if (bus->ci) {
4268                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
4269                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
4270                 brcmf_sdbrcm_chip_detach(bus);
4271                 if (bus->vars && bus->varsz)
4272                         kfree(bus->vars);
4273                 bus->vars = NULL;
4274         }
4275
4276         brcmf_dbg(TRACE, "Disconnected\n");
4277 }
4278
4279 void brcmf_sdbrcm_disconnect(void *ptr)
4280 {
4281         struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
4282
4283         brcmf_dbg(TRACE, "Enter\n");
4284
4285         if (bus)
4286                 brcmf_sdbrcm_release(bus);
4287
4288         brcmf_dbg(TRACE, "Disconnected\n");
4289 }
4290
4291 int brcmf_bus_register(void)
4292 {
4293         brcmf_dbg(TRACE, "Enter\n");
4294
4295         /* Sanity check on the module parameters */
4296         do {
4297                 /* Both watchdog and DPC as tasklets are ok */
4298                 if ((brcmf_watchdog_prio < 0) && (brcmf_dpc_prio < 0))
4299                         break;
4300
4301                 /* If both watchdog and DPC are threads, TX must be deferred */
4302                 if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)
4303                     && brcmf_deferred_tx)
4304                         break;
4305
4306                 brcmf_dbg(ERROR, "Invalid module parameters.\n");
4307                 return -EINVAL;
4308         } while (0);
4309
4310         return brcmf_sdio_register();
4311 }
4312
4313 void brcmf_bus_unregister(void)
4314 {
4315         brcmf_dbg(TRACE, "Enter\n");
4316
4317         brcmf_sdio_unregister();
4318 }
4319
4320 struct device *brcmf_bus_get_device(struct brcmf_bus *bus)
4321 {
4322         return &bus->sdiodev->func[2]->dev;
4323 }
4324
4325 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
4326 {
4327         int offset = 0;
4328         uint len;
4329         u8 *memblock = NULL, *memptr;
4330         int ret;
4331
4332         brcmf_dbg(INFO, "Enter\n");
4333
4334         bus->fw_name = BCM4329_FW_NAME;
4335         ret = request_firmware(&bus->firmware, bus->fw_name,
4336                                &bus->sdiodev->func[2]->dev);
4337         if (ret) {
4338                 brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
4339                 return ret;
4340         }
4341         bus->fw_ptr = 0;
4342
4343         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
4344         if (memblock == NULL) {
4345                 brcmf_dbg(ERROR, "Failed to allocate memory %d bytes\n",
4346                           MEMBLOCK);
4347                 ret = -ENOMEM;
4348                 goto err;
4349         }
4350         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
4351                 memptr += (BRCMF_SDALIGN -
4352                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
4353
4354         /* Download image */
4355         while ((len =
4356                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
4357                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
4358                 if (ret) {
4359                         brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
4360                                   ret, MEMBLOCK, offset);
4361                         goto err;
4362                 }
4363
4364                 offset += MEMBLOCK;
4365         }
4366
4367 err:
4368         kfree(memblock);
4369
4370         release_firmware(bus->firmware);
4371         bus->fw_ptr = 0;
4372
4373         return ret;
4374 }
4375
4376 /*
4377  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
4378  * and ending in a NUL.
4379  * Removes carriage returns, empty lines, comment lines, and converts
4380  * newlines to NULs.
4381  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
4382  * by two NULs.
4383 */
4384
4385 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
4386 {
4387         char *dp;
4388         bool findNewline;
4389         int column;
4390         uint buf_len, n;
4391
4392         dp = varbuf;
4393
4394         findNewline = false;
4395         column = 0;
4396
4397         for (n = 0; n < len; n++) {
4398                 if (varbuf[n] == 0)
4399                         break;
4400                 if (varbuf[n] == '\r')
4401                         continue;
4402                 if (findNewline && varbuf[n] != '\n')
4403                         continue;
4404                 findNewline = false;
4405                 if (varbuf[n] == '#') {
4406                         findNewline = true;
4407                         continue;
4408                 }
4409                 if (varbuf[n] == '\n') {
4410                         if (column == 0)
4411                                 continue;
4412                         *dp++ = 0;
4413                         column = 0;
4414                         continue;
4415                 }
4416                 *dp++ = varbuf[n];
4417                 column++;
4418         }
4419         buf_len = dp - varbuf;
4420
4421         while (dp < varbuf + n)
4422                 *dp++ = 0;
4423
4424         return buf_len;
4425 }
4426
4427 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
4428 {
4429         uint len;
4430         char *memblock = NULL;
4431         char *bufp;
4432         int ret;
4433
4434         bus->nv_name = BCM4329_NV_NAME;
4435         ret = request_firmware(&bus->firmware, bus->nv_name,
4436                                &bus->sdiodev->func[2]->dev);
4437         if (ret) {
4438                 brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
4439                 return ret;
4440         }
4441         bus->fw_ptr = 0;
4442
4443         memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
4444         if (memblock == NULL) {
4445                 brcmf_dbg(ERROR, "Failed to allocate memory %d bytes\n",
4446                           MEMBLOCK);
4447                 ret = -ENOMEM;
4448                 goto err;
4449         }
4450
4451         len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
4452
4453         if (len > 0 && len < MEMBLOCK) {
4454                 bufp = (char *)memblock;
4455                 bufp[len] = 0;
4456                 len = brcmf_process_nvram_vars(bufp, len);
4457                 bufp += len;
4458                 *bufp++ = 0;
4459                 if (len)
4460                         ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
4461                 if (ret)
4462                         brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
4463         } else {
4464                 brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
4465                 ret = -EIO;
4466         }
4467
4468 err:
4469         kfree(memblock);
4470
4471         release_firmware(bus->firmware);
4472         bus->fw_ptr = 0;
4473
4474         return ret;
4475 }
4476
4477 static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
4478 {
4479         int bcmerror = -1;
4480
4481         /* Keep arm in reset */
4482         if (brcmf_sdbrcm_download_state(bus, true)) {
4483                 brcmf_dbg(ERROR, "error placing ARM core in reset\n");
4484                 goto err;
4485         }
4486
4487         /* External image takes precedence if specified */
4488         if (brcmf_sdbrcm_download_code_file(bus)) {
4489                 brcmf_dbg(ERROR, "dongle image file download failed\n");
4490                 goto err;
4491         }
4492
4493         /* External nvram takes precedence if specified */
4494         if (brcmf_sdbrcm_download_nvram(bus))
4495                 brcmf_dbg(ERROR, "dongle nvram file download failed\n");
4496
4497         /* Take arm out of reset */
4498         if (brcmf_sdbrcm_download_state(bus, false)) {
4499                 brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
4500                 goto err;
4501         }
4502
4503         bcmerror = 0;
4504
4505 err:
4506         return bcmerror;
4507 }
4508
4509
4510 static int
4511 brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn, uint flags,
4512                     u8 *buf, uint nbytes, struct sk_buff *pkt)
4513 {
4514         return brcmf_sdcard_send_buf
4515                 (bus->sdiodev, addr, fn, flags, buf, nbytes, pkt);
4516 }
4517
4518 int brcmf_bus_devreset(struct brcmf_pub *drvr, u8 flag)
4519 {
4520         int bcmerror = 0;
4521         struct brcmf_bus *bus;
4522
4523         bus = drvr->bus;
4524
4525         if (flag == true) {
4526                 brcmf_sdbrcm_wd_timer(bus, 0);
4527                 if (!bus->drvr->dongle_reset) {
4528                         /* Expect app to have torn down any
4529                          connection before calling */
4530                         /* Stop the bus, disable F2 */
4531                         brcmf_sdbrcm_bus_stop(bus, false);
4532
4533                         /* Clean tx/rx buffer pointers,
4534                          detach from the dongle */
4535                         brcmf_sdbrcm_release_dongle(bus);
4536
4537                         bus->drvr->dongle_reset = true;
4538                         bus->drvr->up = false;
4539
4540                         brcmf_dbg(TRACE, "WLAN OFF DONE\n");
4541                         /* App can now remove power from device */
4542                 } else
4543                         bcmerror = -EIO;
4544         } else {
4545                 /* App must have restored power to device before calling */
4546
4547                 brcmf_dbg(TRACE, " == WLAN ON ==\n");
4548
4549                 if (bus->drvr->dongle_reset) {
4550                         /* Turn on WLAN */
4551
4552                         /* Attempt to re-attach & download */
4553                         if (brcmf_sdbrcm_probe_attach(bus, SI_ENUM_BASE)) {
4554                                 /* Attempt to download binary to the dongle */
4555                                 if (brcmf_sdbrcm_probe_init(bus)) {
4556                                         /* Re-init bus, enable F2 transfer */
4557                                         brcmf_sdbrcm_bus_init(bus->drvr, false);
4558
4559                                         bus->drvr->dongle_reset = false;
4560                                         bus->drvr->up = true;
4561
4562                                         brcmf_dbg(TRACE, "WLAN ON DONE\n");
4563                                 } else
4564                                         bcmerror = -EIO;
4565                         } else
4566                                 bcmerror = -EIO;
4567                 } else {
4568                         bcmerror = -EISCONN;
4569                         brcmf_dbg(ERROR, "Set DEVRESET=false invoked when device is on\n");
4570                         bcmerror = -EIO;
4571                 }
4572                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
4573         }
4574         return bcmerror;
4575 }
4576
4577 static int
4578 brcmf_sdbrcm_chip_recognition(struct brcmf_sdio_dev *sdiodev,
4579                               struct chip_info *ci, u32 regs)
4580 {
4581         u32 regdata;
4582
4583         /*
4584          * Get CC core rev
4585          * Chipid is assume to be at offset 0 from regs arg
4586          * For different chiptypes or old sdio hosts w/o chipcommon,
4587          * other ways of recognition should be added here.
4588          */
4589         ci->cccorebase = regs;
4590         regdata = brcmf_sdcard_reg_read(sdiodev,
4591                                 CORE_CC_REG(ci->cccorebase, chipid), 4);
4592         ci->chip = regdata & CID_ID_MASK;
4593         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
4594
4595         brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
4596
4597         /* Address of cores for new chips should be added here */
4598         switch (ci->chip) {
4599         case BCM4329_CHIP_ID:
4600                 ci->buscorebase = BCM4329_CORE_BUS_BASE;
4601                 ci->ramcorebase = BCM4329_CORE_SOCRAM_BASE;
4602                 ci->armcorebase = BCM4329_CORE_ARM_BASE;
4603                 ci->ramsize = BCM4329_RAMSIZE;
4604                 break;
4605         default:
4606                 brcmf_dbg(ERROR, "chipid 0x%x is not supported\n", ci->chip);
4607                 return -ENODEV;
4608         }
4609
4610         regdata = brcmf_sdcard_reg_read(sdiodev,
4611                 CORE_SB(ci->cccorebase, sbidhigh), 4);
4612         ci->ccrev = SBCOREREV(regdata);
4613
4614         regdata = brcmf_sdcard_reg_read(sdiodev,
4615                 CORE_CC_REG(ci->cccorebase, pmucapabilities), 4);
4616         ci->pmurev = regdata & PCAP_REV_MASK;
4617
4618         regdata = brcmf_sdcard_reg_read(sdiodev,
4619                                         CORE_SB(ci->buscorebase, sbidhigh), 4);
4620         ci->buscorerev = SBCOREREV(regdata);
4621         ci->buscoretype = (regdata & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
4622
4623         brcmf_dbg(INFO, "ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
4624                   ci->ccrev, ci->pmurev, ci->buscorerev, ci->buscoretype);
4625
4626         /* get chipcommon capabilites */
4627         ci->cccaps = brcmf_sdcard_reg_read(sdiodev,
4628                 CORE_CC_REG(ci->cccorebase, capabilities), 4);
4629
4630         return 0;
4631 }
4632
4633 static void
4634 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_dev *sdiodev, u32 corebase)
4635 {
4636         u32 regdata;
4637
4638         regdata = brcmf_sdcard_reg_read(sdiodev,
4639                 CORE_SB(corebase, sbtmstatelow), 4);
4640         if (regdata & SBTML_RESET)
4641                 return;
4642
4643         regdata = brcmf_sdcard_reg_read(sdiodev,
4644                 CORE_SB(corebase, sbtmstatelow), 4);
4645         if ((regdata & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) != 0) {
4646                 /*
4647                  * set target reject and spin until busy is clear
4648                  * (preserve core-specific bits)
4649                  */
4650                 regdata = brcmf_sdcard_reg_read(sdiodev,
4651                         CORE_SB(corebase, sbtmstatelow), 4);
4652                 brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow),
4653                                        4, regdata | SBTML_REJ);
4654
4655                 regdata = brcmf_sdcard_reg_read(sdiodev,
4656                         CORE_SB(corebase, sbtmstatelow), 4);
4657                 udelay(1);
4658                 SPINWAIT((brcmf_sdcard_reg_read(sdiodev,
4659                         CORE_SB(corebase, sbtmstatehigh), 4) &
4660                         SBTMH_BUSY), 100000);
4661
4662                 regdata = brcmf_sdcard_reg_read(sdiodev,
4663                         CORE_SB(corebase, sbtmstatehigh), 4);
4664                 if (regdata & SBTMH_BUSY)
4665                         brcmf_dbg(ERROR, "ARM core still busy\n");
4666
4667                 regdata = brcmf_sdcard_reg_read(sdiodev,
4668                         CORE_SB(corebase, sbidlow), 4);
4669                 if (regdata & SBIDL_INIT) {
4670                         regdata = brcmf_sdcard_reg_read(sdiodev,
4671                                 CORE_SB(corebase, sbimstate), 4) |
4672                                 SBIM_RJ;
4673                         brcmf_sdcard_reg_write(sdiodev,
4674                                 CORE_SB(corebase, sbimstate), 4,
4675                                 regdata);
4676                         regdata = brcmf_sdcard_reg_read(sdiodev,
4677                                 CORE_SB(corebase, sbimstate), 4);
4678                         udelay(1);
4679                         SPINWAIT((brcmf_sdcard_reg_read(sdiodev,
4680                                 CORE_SB(corebase, sbimstate), 4) &
4681                                 SBIM_BY), 100000);
4682                 }
4683
4684                 /* set reset and reject while enabling the clocks */
4685                 brcmf_sdcard_reg_write(sdiodev,
4686                         CORE_SB(corebase, sbtmstatelow), 4,
4687                         (((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
4688                         SBTML_REJ | SBTML_RESET));
4689                 regdata = brcmf_sdcard_reg_read(sdiodev,
4690                         CORE_SB(corebase, sbtmstatelow), 4);
4691                 udelay(10);
4692
4693                 /* clear the initiator reject bit */
4694                 regdata = brcmf_sdcard_reg_read(sdiodev,
4695                         CORE_SB(corebase, sbidlow), 4);
4696                 if (regdata & SBIDL_INIT) {
4697                         regdata = brcmf_sdcard_reg_read(sdiodev,
4698                                 CORE_SB(corebase, sbimstate), 4) &
4699                                 ~SBIM_RJ;
4700                         brcmf_sdcard_reg_write(sdiodev,
4701                                 CORE_SB(corebase, sbimstate), 4,
4702                                 regdata);
4703                 }
4704         }
4705
4706         /* leave reset and reject asserted */
4707         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
4708                 (SBTML_REJ | SBTML_RESET));
4709         udelay(1);
4710 }
4711
4712 static int
4713 brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs)
4714 {
4715         struct chip_info *ci;
4716         int err;
4717         u8 clkval, clkset;
4718
4719         brcmf_dbg(TRACE, "Enter\n");
4720
4721         /* alloc chip_info_t */
4722         ci = kzalloc(sizeof(struct chip_info), GFP_ATOMIC);
4723         if (NULL == ci) {
4724                 brcmf_dbg(ERROR, "malloc failed!\n");
4725                 return -ENOMEM;
4726         }
4727
4728         /* bus/core/clk setup for register access */
4729         /* Try forcing SDIO core to do ALPAvail request only */
4730         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
4731         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4732                                SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
4733         if (err) {
4734                 brcmf_dbg(ERROR, "error writing for HT off\n");
4735                 goto fail;
4736         }
4737
4738         /* If register supported, wait for ALPAvail and then force ALP */
4739         /* This may take up to 15 milliseconds */
4740         clkval = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4741                         SBSDIO_FUNC1_CHIPCLKCSR, NULL);
4742         if ((clkval & ~SBSDIO_AVBITS) == clkset) {
4743                 SPINWAIT(((clkval =
4744                                 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4745                                                 SBSDIO_FUNC1_CHIPCLKCSR,
4746                                                 NULL)),
4747                                 !SBSDIO_ALPAV(clkval)),
4748                                 PMU_MAX_TRANSITION_DLY);
4749                 if (!SBSDIO_ALPAV(clkval)) {
4750                         brcmf_dbg(ERROR, "timeout on ALPAV wait, clkval 0x%02x\n",
4751                                   clkval);
4752                         err = -EBUSY;
4753                         goto fail;
4754                 }
4755                 clkset = SBSDIO_FORCE_HW_CLKREQ_OFF |
4756                                 SBSDIO_FORCE_ALP;
4757                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4758                                 SBSDIO_FUNC1_CHIPCLKCSR,
4759                                 clkset, &err);
4760                 udelay(65);
4761         } else {
4762                 brcmf_dbg(ERROR, "ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
4763                           clkset, clkval);
4764                 err = -EACCES;
4765                 goto fail;
4766         }
4767
4768         /* Also, disable the extra SDIO pull-ups */
4769         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4770                                SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
4771
4772         err = brcmf_sdbrcm_chip_recognition(bus->sdiodev, ci, regs);
4773         if (err)
4774                 goto fail;
4775
4776         /*
4777          * Make sure any on-chip ARM is off (in case strapping is wrong),
4778          * or downloaded code was already running.
4779          */
4780         brcmf_sdbrcm_chip_disablecore(bus->sdiodev, ci->armcorebase);
4781
4782         brcmf_sdcard_reg_write(bus->sdiodev,
4783                 CORE_CC_REG(ci->cccorebase, gpiopullup), 4, 0);
4784         brcmf_sdcard_reg_write(bus->sdiodev,
4785                 CORE_CC_REG(ci->cccorebase, gpiopulldown), 4, 0);
4786
4787         /* Disable F2 to clear any intermediate frame state on the dongle */
4788         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
4789                 SDIO_FUNC_ENABLE_1, NULL);
4790
4791         /* WAR: cmd52 backplane read so core HW will drop ALPReq */
4792         clkval = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4793                         0, NULL);
4794
4795         /* Done with backplane-dependent accesses, can drop clock... */
4796         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4797                                SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
4798
4799         bus->ci = ci;
4800         return 0;
4801 fail:
4802         bus->ci = NULL;
4803         kfree(ci);
4804         return err;
4805 }
4806
4807 static void
4808 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_dev *sdiodev, u32 corebase)
4809 {
4810         u32 regdata;
4811
4812         /*
4813          * Must do the disable sequence first to work for
4814          * arbitrary current core state.
4815          */
4816         brcmf_sdbrcm_chip_disablecore(sdiodev, corebase);
4817
4818         /*
4819          * Now do the initialization sequence.
4820          * set reset while enabling the clock and
4821          * forcing them on throughout the core
4822          */
4823         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
4824                 ((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
4825                 SBTML_RESET);
4826         udelay(1);
4827
4828         regdata = brcmf_sdcard_reg_read(sdiodev,
4829                                         CORE_SB(corebase, sbtmstatehigh), 4);
4830         if (regdata & SBTMH_SERR)
4831                 brcmf_sdcard_reg_write(sdiodev,
4832                                        CORE_SB(corebase, sbtmstatehigh), 4, 0);
4833
4834         regdata = brcmf_sdcard_reg_read(sdiodev,
4835                                         CORE_SB(corebase, sbimstate), 4);
4836         if (regdata & (SBIM_IBE | SBIM_TO))
4837                 brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbimstate), 4,
4838                         regdata & ~(SBIM_IBE | SBIM_TO));
4839
4840         /* clear reset and allow it to propagate throughout the core */
4841         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
4842                 (SICF_FGC << SBTML_SICF_SHIFT) |
4843                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
4844         udelay(1);
4845
4846         /* leave clock enabled */
4847         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
4848                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
4849         udelay(1);
4850 }
4851
4852 /* SDIO Pad drive strength to select value mappings */
4853 struct sdiod_drive_str {
4854         u8 strength;    /* Pad Drive Strength in mA */
4855         u8 sel;         /* Chip-specific select value */
4856 };
4857
4858 /* SDIO Drive Strength to sel value table for PMU Rev 1 */
4859 static const struct sdiod_drive_str sdiod_drive_strength_tab1[] = {
4860         {
4861         4, 0x2}, {
4862         2, 0x3}, {
4863         1, 0x0}, {
4864         0, 0x0}
4865         };
4866
4867 /* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
4868 static const struct sdiod_drive_str sdiod_drive_strength_tab2[] = {
4869         {
4870         12, 0x7}, {
4871         10, 0x6}, {
4872         8, 0x5}, {
4873         6, 0x4}, {
4874         4, 0x2}, {
4875         2, 0x1}, {
4876         0, 0x0}
4877         };
4878
4879 /* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
4880 static const struct sdiod_drive_str sdiod_drive_strength_tab3[] = {
4881         {
4882         32, 0x7}, {
4883         26, 0x6}, {
4884         22, 0x5}, {
4885         16, 0x4}, {
4886         12, 0x3}, {
4887         8, 0x2}, {
4888         4, 0x1}, {
4889         0, 0x0}
4890         };
4891
4892 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
4893
4894 static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
4895                                                    u32 drivestrength) {
4896         struct sdiod_drive_str *str_tab = NULL;
4897         u32 str_mask = 0;
4898         u32 str_shift = 0;
4899         char chn[8];
4900
4901         if (!(bus->ci->cccaps & CC_CAP_PMU))
4902                 return;
4903
4904         switch (SDIOD_DRVSTR_KEY(bus->ci->chip, bus->ci->pmurev)) {
4905         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
4906                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab1;
4907                 str_mask = 0x30000000;
4908                 str_shift = 28;
4909                 break;
4910         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
4911         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
4912                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab2;
4913                 str_mask = 0x00003800;
4914                 str_shift = 11;
4915                 break;
4916         case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
4917                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab3;
4918                 str_mask = 0x00003800;
4919                 str_shift = 11;
4920                 break;
4921         default:
4922                 brcmf_dbg(ERROR, "No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
4923                           brcmu_chipname(bus->ci->chip, chn, 8),
4924                           bus->ci->chiprev, bus->ci->pmurev);
4925                 break;
4926         }
4927
4928         if (str_tab != NULL) {
4929                 u32 drivestrength_sel = 0;
4930                 u32 cc_data_temp;
4931                 int i;
4932
4933                 for (i = 0; str_tab[i].strength != 0; i++) {
4934                         if (drivestrength >= str_tab[i].strength) {
4935                                 drivestrength_sel = str_tab[i].sel;
4936                                 break;
4937                         }
4938                 }
4939
4940                 brcmf_sdcard_reg_write(bus->sdiodev,
4941                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
4942                         4, 1);
4943                 cc_data_temp = brcmf_sdcard_reg_read(bus->sdiodev,
4944                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr), 4);
4945                 cc_data_temp &= ~str_mask;
4946                 drivestrength_sel <<= str_shift;
4947                 cc_data_temp |= drivestrength_sel;
4948                 brcmf_sdcard_reg_write(bus->sdiodev,
4949                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
4950                         4, cc_data_temp);
4951
4952                 brcmf_dbg(INFO, "SDIO: %dmA drive strength selected, set to 0x%08x\n",
4953                           drivestrength, cc_data_temp);
4954         }
4955 }
4956
4957 static void
4958 brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus)
4959 {
4960         brcmf_dbg(TRACE, "Enter\n");
4961
4962         kfree(bus->ci);
4963         bus->ci = NULL;
4964 }
4965
4966 static void
4967 brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
4968 {
4969         brcmf_sdbrcm_sdunlock(bus);
4970         wait_event_interruptible_timeout(bus->ctrl_wait,
4971                                          (*lockvar == false), HZ * 2);
4972         brcmf_sdbrcm_sdlock(bus);
4973         return;
4974 }
4975
4976 static void
4977 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
4978 {
4979         if (waitqueue_active(&bus->ctrl_wait))
4980                 wake_up_interruptible(&bus->ctrl_wait);
4981         return;
4982 }
4983
4984 static int
4985 brcmf_sdbrcm_watchdog_thread(void *data)
4986 {
4987         struct brcmf_bus *bus = (struct brcmf_bus *)data;
4988
4989         /* This thread doesn't need any user-level access,
4990         * so get rid of all our resources
4991         */
4992         if (brcmf_watchdog_prio > 0) {
4993                 struct sched_param param;
4994                 param.sched_priority = (brcmf_watchdog_prio < MAX_RT_PRIO) ?
4995                                        brcmf_watchdog_prio : (MAX_RT_PRIO - 1);
4996                 sched_setscheduler(current, SCHED_FIFO, &param);
4997         }
4998
4999         allow_signal(SIGTERM);
5000         /* Run until signal received */
5001         while (1) {
5002                 if (kthread_should_stop())
5003                         break;
5004                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
5005                         if (bus->drvr->dongle_reset == false)
5006                                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
5007                         /* Count the tick for reference */
5008                         bus->drvr->tickcnt++;
5009                 } else
5010                         break;
5011         }
5012         return 0;
5013 }
5014
5015 static void
5016 brcmf_sdbrcm_watchdog(unsigned long data)
5017 {
5018         struct brcmf_bus *bus = (struct brcmf_bus *)data;
5019
5020         if (brcmf_watchdog_prio >= 0) {
5021                 if (bus->watchdog_tsk)
5022                         complete(&bus->watchdog_wait);
5023                 else
5024                         return;
5025         } else {
5026                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
5027
5028                 /* Count the tick for reference */
5029                 bus->drvr->tickcnt++;
5030         }
5031
5032         /* Reschedule the watchdog */
5033         if (bus->wd_timer_valid)
5034                 mod_timer(&bus->timer, jiffies + brcmf_watchdog_ms * HZ / 1000);
5035 }
5036
5037 void
5038 brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
5039 {
5040         /* don't start the wd until fw is loaded */
5041         if (bus->drvr->busstate == BRCMF_BUS_DOWN)
5042                 return;
5043
5044         /* Totally stop the timer */
5045         if (!wdtick && bus->wd_timer_valid == true) {
5046                 del_timer_sync(&bus->timer);
5047                 bus->wd_timer_valid = false;
5048                 bus->save_ms = wdtick;
5049                 return;
5050         }
5051
5052         if (wdtick) {
5053                 brcmf_watchdog_ms = (uint) wdtick;
5054
5055                 if (bus->save_ms != brcmf_watchdog_ms) {
5056                         if (bus->wd_timer_valid == true)
5057                                 /* Stop timer and restart at new value */
5058                                 del_timer_sync(&bus->timer);
5059
5060                         /* Create timer again when watchdog period is
5061                            dynamically changed or in the first instance
5062                          */
5063                         bus->timer.expires =
5064                                 jiffies + brcmf_watchdog_ms * HZ / 1000;
5065                         add_timer(&bus->timer);
5066
5067                 } else {
5068                         /* Re arm the timer, at last watchdog period */
5069                         mod_timer(&bus->timer,
5070                                 jiffies + brcmf_watchdog_ms * HZ / 1000);
5071                 }
5072
5073                 bus->wd_timer_valid = true;
5074                 bus->save_ms = wdtick;
5075         }
5076 }
5077
5078 static int brcmf_sdbrcm_dpc_thread(void *data)
5079 {
5080         struct brcmf_bus *bus = (struct brcmf_bus *) data;
5081
5082         /* This thread doesn't need any user-level access,
5083          * so get rid of all our resources
5084          */
5085         if (brcmf_dpc_prio > 0) {
5086                 struct sched_param param;
5087                 param.sched_priority = (brcmf_dpc_prio < MAX_RT_PRIO) ?
5088                                        brcmf_dpc_prio : (MAX_RT_PRIO - 1);
5089                 sched_setscheduler(current, SCHED_FIFO, &param);
5090         }
5091
5092         allow_signal(SIGTERM);
5093         /* Run until signal received */
5094         while (1) {
5095                 if (kthread_should_stop())
5096                         break;
5097                 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
5098                         /* Call bus dpc unless it indicated down
5099                         (then clean stop) */
5100                         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
5101                                 if (brcmf_sdbrcm_dpc(bus))
5102                                         complete(&bus->dpc_wait);
5103                         } else {
5104                                 brcmf_sdbrcm_bus_stop(bus, true);
5105                         }
5106                 } else
5107                         break;
5108         }
5109         return 0;
5110 }
5111
5112 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data)
5113 {
5114         struct brcmf_bus *bus = (struct brcmf_bus *) data;
5115
5116         /* Call bus dpc unless it indicated down (then clean stop) */
5117         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
5118                 if (brcmf_sdbrcm_dpc(bus))
5119                         tasklet_schedule(&bus->tasklet);
5120         } else
5121                 brcmf_sdbrcm_bus_stop(bus, true);
5122 }
5123
5124 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus)
5125 {
5126         if (bus->dpc_tsk) {
5127                 complete(&bus->dpc_wait);
5128                 return;
5129         }
5130
5131         tasklet_schedule(&bus->tasklet);
5132 }
5133
5134 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus)
5135 {
5136         if (bus->threads_only)
5137                 down(&bus->sdsem);
5138         else
5139                 spin_lock_bh(&bus->sdlock);
5140 }
5141
5142 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus)
5143 {
5144         if (bus->threads_only)
5145                 up(&bus->sdsem);
5146         else
5147                 spin_unlock_bh(&bus->sdlock);
5148 }
5149
5150 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
5151 {
5152         if (bus->firmware->size < bus->fw_ptr + len)
5153                 len = bus->firmware->size - bus->fw_ptr;
5154
5155         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
5156         bus->fw_ptr += len;
5157         return len;
5158 }
5159
5160 MODULE_FIRMWARE(BCM4329_FW_NAME);
5161 MODULE_FIRMWARE(BCM4329_NV_NAME);
5162
5163 static int brcmf_sdbrcm_ioctl_resp_wait(struct brcmf_bus *bus, uint *condition,
5164                                         bool *pending)
5165 {
5166         DECLARE_WAITQUEUE(wait, current);
5167         int timeout = msecs_to_jiffies(brcmf_ioctl_timeout_msec);
5168
5169         /* Wait until control frame is available */
5170         add_wait_queue(&bus->ioctl_resp_wait, &wait);
5171         set_current_state(TASK_INTERRUPTIBLE);
5172
5173         while (!(*condition) && (!signal_pending(current) && timeout))
5174                 timeout = schedule_timeout(timeout);
5175
5176         if (signal_pending(current))
5177                 *pending = true;
5178
5179         set_current_state(TASK_RUNNING);
5180         remove_wait_queue(&bus->ioctl_resp_wait, &wait);
5181
5182         return timeout;
5183 }
5184
5185 static int brcmf_sdbrcm_ioctl_resp_wake(struct brcmf_bus *bus)
5186 {
5187         if (waitqueue_active(&bus->ioctl_resp_wait))
5188                 wake_up_interruptible(&bus->ioctl_resp_wait);
5189
5190         return 0;
5191 }