drivers/staging/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <asm/unaligned.h>
  31 #include <defs.h>
  32 #include <brcmu_wifi.h>
  33 #include <brcmu_utils.h>
  34 #include <brcm_hw_ids.h>
  35 #include <soc.h>
  36 #include "sdio_host.h"
  37
  38 #ifdef BCMDBG
  39
  40 /* ARM trap handling */
  41 struct brcmf_trap {
  42         u32 type;
  43         u32 epc;
  44         u32 cpsr;
  45         u32 spsr;
  46         u32 r0;
  47         u32 r1;
  48         u32 r2;
  49         u32 r3;
  50         u32 r4;
  51         u32 r5;
  52         u32 r6;
  53         u32 r7;
  54         u32 r8;
  55         u32 r9;
  56         u32 r10;
  57         u32 r11;
  58         u32 r12;
  59         u32 r13;
  60         u32 r14;
  61         u32 pc;
  62 };
  63
  64 #define CBUF_LEN        (128)
  65
  66 struct rte_log {
  67         u32 buf;                /* Can't be pointer on (64-bit) hosts */
  68         uint buf_size;
  69         uint idx;
  70         char *_buf_compat;      /* Redundant pointer for backward compat. */
  71 };
  72
  73 struct rte_console {
  74         /* Virtual UART
  75          * When there is no UART (e.g. Quickturn),
  76          * the host should write a complete
  77          * input line directly into cbuf and then write
  78          * the length into vcons_in.
  79          * This may also be used when there is a real UART
  80          * (at risk of conflicting with
  81          * the real UART).  vcons_out is currently unused.
  82          */
  83         uint vcons_in;
  84         uint vcons_out;
  85
  86         /* Output (logging) buffer
  87          * Console output is written to a ring buffer log_buf at index log_idx.
  88          * The host may read the output when it sees log_idx advance.
  89          * Output will be lost if the output wraps around faster than the host
  90          * polls.
  91          */
  92         struct rte_log log;
  93
  94         /* Console input line buffer
  95          * Characters are read one at a time into cbuf
  96          * until <CR> is received, then
  97          * the buffer is processed as a command line.
  98          * Also used for virtual UART.
  99          */
 100         uint cbuf_idx;
 101         char cbuf[CBUF_LEN];
 102 };
 103
 104 #endif                          /* BCMDBG */
 105 #include <chipcommon.h>
 106
 107 #include "dhd.h"
 108 #include "dhd_bus.h"
 109 #include "dhd_proto.h"
 110 #include "dhd_dbg.h"
 111 #include <bcmchip.h>
 112
 113 #define TXQLEN          2048    /* bulk tx queue length */
 114 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 115 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 116 #define PRIOMASK        7
 117
 118 #define TXRETRIES       2       /* # of retries for tx frames */
 119
 120 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 121                                  one scheduling */
 122
 123 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 124                                  one scheduling */
 125
 126 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 127
 128 #define MEMBLOCK        2048    /* Block size used for downloading
 129                                  of dongle image */
 130 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 131                                  biggest possible glom */
 132
 133 #define BRCMF_FIRSTREAD (1 << 6)
 134
 135
 136 /* SBSDIO_DEVICE_CTL */
 137
 138 /* 1: device will assert busy signal when receiving CMD53 */
 139 #define SBSDIO_DEVCTL_SETBUSY           0x01
 140 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 141 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 142 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 143 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 144 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 145  * sdio bus power cycle to clear (rev 9) */
 146 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 147 /* Force SD->SB reset mapping (rev 11) */
 148 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 149 /*   Determined by CoreControl bit */
 150 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 151 /*   Force backplane reset */
 152 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 153 /*   Force no backplane reset */
 154 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 155
 156 /* SBSDIO_FUNC1_CHIPCLKCSR */
 157
 158 /* Force ALP request to backplane */
 159 #define SBSDIO_FORCE_ALP                0x01
 160 /* Force HT request to backplane */
 161 #define SBSDIO_FORCE_HT                 0x02
 162 /* Force ILP request to backplane */
 163 #define SBSDIO_FORCE_ILP                0x04
 164 /* Make ALP ready (power up xtal) */
 165 #define SBSDIO_ALP_AVAIL_REQ            0x08
 166 /* Make HT ready (power up PLL) */
 167 #define SBSDIO_HT_AVAIL_REQ             0x10
 168 /* Squelch clock requests from HW */
 169 #define SBSDIO_FORCE_HW_CLKREQ_OFF      0x20
 170 /* Status: ALP is ready */
 171 #define SBSDIO_ALP_AVAIL                0x40
 172 /* Status: HT is ready */
 173 #define SBSDIO_HT_AVAIL                 0x80
 174
 175 #define SBSDIO_AVBITS           (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
 176 #define SBSDIO_ALPAV(regval)    ((regval) & SBSDIO_AVBITS)
 177 #define SBSDIO_HTAV(regval)     (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
 178 #define SBSDIO_ALPONLY(regval)  (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
 179
 180 #define SBSDIO_CLKAV(regval, alponly) \
 181         (SBSDIO_ALPAV(regval) && (alponly ? 1 : SBSDIO_HTAV(regval)))
 182
 183 /* direct(mapped) cis space */
 184
 185 /* MAPPED common CIS address */
 186 #define SBSDIO_CIS_BASE_COMMON          0x1000
 187 /* maximum bytes in one CIS */
 188 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 189 /* cis offset addr is < 17 bits */
 190 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 191
 192 /* manfid tuple length, include tuple, link bytes */
 193 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 194
 195 /* intstatus */
 196 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 197 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 198 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 199 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 200 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 201 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 202 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 203 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 204 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 205 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 206 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 207 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 208 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 209 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 210 #define I_PC            (1 << 10)       /* descriptor error */
 211 #define I_PD            (1 << 11)       /* data error */
 212 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 213 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 214 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 215 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 216 #define I_RI            (1 << 16)       /* Receive Interrupt */
 217 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 218 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 219 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 220 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 221 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 222 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 223 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 224 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 225 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 226 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 227 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 228 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 229
 230 /* corecontrol */
 231 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 232 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 233 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 234 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 235 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 236 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 237
 238 /* SDA_FRAMECTRL */
 239 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 240 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 241 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 242 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 243
 244 /* HW frame tag */
 245 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 246
 247 /* Total length of frame header for dongle protocol */
 248 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 249 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 250
 251 /*
 252  * Software allocation of To SB Mailbox resources
 253  */
 254
 255 /* tosbmailbox bits corresponding to intstatus bits */
 256 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 257 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 258 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 259 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 260
 261 /* tosbmailboxdata */
 262 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 263
 264 /*
 265  * Software allocation of To Host Mailbox resources
 266  */
 267
 268 /* intstatus bits */
 269 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 270 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 271 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 272 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 273
 274 /* tohostmailboxdata */
 275 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 276 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 277 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 278 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 279
 280 #define HMB_DATA_FCDATA_MASK    0xff000000
 281 #define HMB_DATA_FCDATA_SHIFT   24
 282
 283 #define HMB_DATA_VERSION_MASK   0x00ff0000
 284 #define HMB_DATA_VERSION_SHIFT  16
 285
 286 /*
 287  * Software-defined protocol header
 288  */
 289
 290 /* Current protocol version */
 291 #define SDPCM_PROT_VERSION      4
 292
 293 /* SW frame header */
 294 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 295
 296 #define SDPCM_CHANNEL_MASK              0x00000f00
 297 #define SDPCM_CHANNEL_SHIFT             8
 298 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 299
 300 #define SDPCM_NEXTLEN_OFFSET            2
 301
 302 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 303 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 304 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 305 #define SDPCM_DOFFSET_MASK              0xff000000
 306 #define SDPCM_DOFFSET_SHIFT             24
 307 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 308 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 309 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 310 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 311
 312 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 313
 314 /* logical channel numbers */
 315 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 316 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 317 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 318 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 319 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 320
 321 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 322
 323 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 324
 325 /*
 326  * Shared structure between dongle and the host.
 327  * The structure contains pointers to trap or assert information.
 328  */
 329 #define SDPCM_SHARED_VERSION       0x0002
 330 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 331 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 332 #define SDPCM_SHARED_ASSERT        0x0200
 333 #define SDPCM_SHARED_TRAP          0x0400
 334
 335 /* Space for header read, limit for data packets */
 336 #define MAX_HDR_READ    (1 << 6)
 337 #define MAX_RX_DATASZ   2048
 338
 339 /* Maximum milliseconds to wait for F2 to come up */
 340 #define BRCMF_WAIT_F2RDY        3000
 341
 342 /* Bump up limit on waiting for HT to account for first startup;
 343  * if the image is doing a CRC calculation before programming the PMU
 344  * for HT availability, it could take a couple hundred ms more, so
 345  * max out at a 1 second (1000000us).
 346  */
 347 #undef PMU_MAX_TRANSITION_DLY
 348 #define PMU_MAX_TRANSITION_DLY 1000000
 349
 350 /* Value for ChipClockCSR during initial setup */
 351 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 352                                         SBSDIO_ALP_AVAIL_REQ)
 353
 354 /* Flags for SDH calls */
 355 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 356
 357 /* sbimstate */
 358 #define SBIM_IBE                0x20000 /* inbanderror */
 359 #define SBIM_TO                 0x40000 /* timeout */
 360 #define SBIM_BY                 0x01800000      /* busy (sonics >= 2.3) */
 361 #define SBIM_RJ                 0x02000000      /* reject (sonics >= 2.3) */
 362
 363 /* sbtmstatelow */
 364
 365 /* reset */
 366 #define SBTML_RESET             0x0001
 367 /* reject field */
 368 #define SBTML_REJ_MASK          0x0006
 369 /* reject */
 370 #define SBTML_REJ               0x0002
 371 /* temporary reject, for error recovery */
 372 #define SBTML_TMPREJ            0x0004
 373
 374 /* Shift to locate the SI control flags in sbtml */
 375 #define SBTML_SICF_SHIFT        16
 376
 377 /* sbtmstatehigh */
 378 #define SBTMH_SERR              0x0001  /* serror */
 379 #define SBTMH_INT               0x0002  /* interrupt */
 380 #define SBTMH_BUSY              0x0004  /* busy */
 381 #define SBTMH_TO                0x0020  /* timeout (sonics >= 2.3) */
 382
 383 /* Shift to locate the SI status flags in sbtmh */
 384 #define SBTMH_SISF_SHIFT        16
 385
 386 /* sbidlow */
 387 #define SBIDL_INIT              0x80    /* initiator */
 388
 389 /* sbidhigh */
 390 #define SBIDH_RC_MASK           0x000f  /* revision code */
 391 #define SBIDH_RCE_MASK          0x7000  /* revision code extension field */
 392 #define SBIDH_RCE_SHIFT         8
 393 #define SBCOREREV(sbidh) \
 394         ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | \
 395           ((sbidh) & SBIDH_RC_MASK))
 396 #define SBIDH_CC_MASK           0x8ff0  /* core code */
 397 #define SBIDH_CC_SHIFT          4
 398 #define SBIDH_VC_MASK           0xffff0000      /* vendor code */
 399 #define SBIDH_VC_SHIFT          16
 400
 401 /*
 402  * Conversion of 802.1D priority to precedence level
 403  */
 404 static uint prio2prec(u32 prio)
 405 {
 406         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 407                (prio^2) : prio;
 408 }
 409
 410 /*
 411  * Core reg address translation.
 412  * Both macro's returns a 32 bits byte address on the backplane bus.
 413  */
 414 #define CORE_CC_REG(base, field) \
 415                 (base + offsetof(struct chipcregs, field))
 416 #define CORE_BUS_REG(base, field) \
 417                 (base + offsetof(struct sdpcmd_regs, field))
 418 #define CORE_SB(base, field) \
 419                 (base + SBCONFIGOFF + offsetof(struct sbconfig, field))
 420
 421 /* core registers */
 422 struct sdpcmd_regs {
 423         u32 corecontrol;                /* 0x00, rev8 */
 424         u32 corestatus;                 /* rev8 */
 425         u32 PAD[1];
 426         u32 biststatus;                 /* rev8 */
 427
 428         /* PCMCIA access */
 429         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 430         u16 PAD[1];
 431         u16 pcmciamesportalmask;        /* rev8 */
 432         u16 PAD[1];
 433         u16 pcmciawrframebc;            /* rev8 */
 434         u16 PAD[1];
 435         u16 pcmciaunderflowtimer;       /* rev8 */
 436         u16 PAD[1];
 437
 438         /* interrupt */
 439         u32 intstatus;                  /* 0x020, rev8 */
 440         u32 hostintmask;                /* rev8 */
 441         u32 intmask;                    /* rev8 */
 442         u32 sbintstatus;                /* rev8 */
 443         u32 sbintmask;                  /* rev8 */
 444         u32 funcintmask;                /* rev4 */
 445         u32 PAD[2];
 446         u32 tosbmailbox;                /* 0x040, rev8 */
 447         u32 tohostmailbox;              /* rev8 */
 448         u32 tosbmailboxdata;            /* rev8 */
 449         u32 tohostmailboxdata;          /* rev8 */
 450
 451         /* synchronized access to registers in SDIO clock domain */
 452         u32 sdioaccess;                 /* 0x050, rev8 */
 453         u32 PAD[3];
 454
 455         /* PCMCIA frame control */
 456         u8 pcmciaframectrl;             /* 0x060, rev8 */
 457         u8 PAD[3];
 458         u8 pcmciawatermark;             /* rev8 */
 459         u8 PAD[155];
 460
 461         /* interrupt batching control */
 462         u32 intrcvlazy;                 /* 0x100, rev8 */
 463         u32 PAD[3];
 464
 465         /* counters */
 466         u32 cmd52rd;                    /* 0x110, rev8 */
 467         u32 cmd52wr;                    /* rev8 */
 468         u32 cmd53rd;                    /* rev8 */
 469         u32 cmd53wr;                    /* rev8 */
 470         u32 abort;                      /* rev8 */
 471         u32 datacrcerror;               /* rev8 */
 472         u32 rdoutofsync;                /* rev8 */
 473         u32 wroutofsync;                /* rev8 */
 474         u32 writebusy;                  /* rev8 */
 475         u32 readwait;                   /* rev8 */
 476         u32 readterm;                   /* rev8 */
 477         u32 writeterm;                  /* rev8 */
 478         u32 PAD[40];
 479         u32 clockctlstatus;             /* rev8 */
 480         u32 PAD[7];
 481
 482         u32 PAD[128];                   /* DMA engines */
 483
 484         /* SDIO/PCMCIA CIS region */
 485         char cis[512];                  /* 0x400-0x5ff, rev6 */
 486
 487         /* PCMCIA function control registers */
 488         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 489         u16 PAD[55];
 490
 491         /* PCMCIA backplane access */
 492         u16 backplanecsr;               /* 0x76E, rev6 */
 493         u16 backplaneaddr0;             /* rev6 */
 494         u16 backplaneaddr1;             /* rev6 */
 495         u16 backplaneaddr2;             /* rev6 */
 496         u16 backplaneaddr3;             /* rev6 */
 497         u16 backplanedata0;             /* rev6 */
 498         u16 backplanedata1;             /* rev6 */
 499         u16 backplanedata2;             /* rev6 */
 500         u16 backplanedata3;             /* rev6 */
 501         u16 PAD[31];
 502
 503         /* sprom "size" & "blank" info */
 504         u16 spromstatus;                /* 0x7BE, rev2 */
 505         u32 PAD[464];
 506
 507         u16 PAD[0x80];
 508 };
 509
 510 #ifdef BCMDBG
 511 /* Device console log buffer state */
 512 struct brcmf_console {
 513         uint count;             /* Poll interval msec counter */
 514         uint log_addr;          /* Log struct address (fixed) */
 515         struct rte_log log;     /* Log struct (host copy) */
 516         uint bufsize;           /* Size of log buffer */
 517         u8 *buf;                /* Log buffer (host copy) */
 518         uint last;              /* Last buffer read index */
 519 };
 520 #endif                          /* BCMDBG */
 521
 522 struct sdpcm_shared {
 523         u32 flags;
 524         u32 trap_addr;
 525         u32 assert_exp_addr;
 526         u32 assert_file_addr;
 527         u32 assert_line;
 528         u32 console_addr;       /* Address of struct rte_console */
 529         u32 msgtrace_addr;
 530         u8 tag[32];
 531 };
 532
 533
 534 /* misc chip info needed by some of the routines */
 535 struct chip_info {
 536         u32 chip;
 537         u32 chiprev;
 538         u32 cccorebase;
 539         u32 ccrev;
 540         u32 cccaps;
 541         u32 buscorebase; /* 32 bits backplane bus address */
 542         u32 buscorerev;
 543         u32 buscoretype;
 544         u32 ramcorebase;
 545         u32 armcorebase;
 546         u32 pmurev;
 547         u32 ramsize;
 548 };
 549
 550 /* Private data for SDIO bus interaction */
 551 struct brcmf_bus {
 552         struct brcmf_pub *drvr;
 553
 554         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 555         struct chip_info *ci;   /* Chip info struct */
 556         char *vars;             /* Variables (from CIS and/or other) */
 557         uint varsz;             /* Size of variables buffer */
 558
 559         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 560         u32 orig_ramsize;       /* Size of RAM in SOCRAM (bytes) */
 561
 562         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 563         u32 intstatus;  /* Intstatus bits (events) pending */
 564         bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
 565         bool fcstate;           /* State of dongle flow-control */
 566
 567         uint blocksize;         /* Block size of SDIO transfers */
 568         uint roundup;           /* Max roundup limit */
 569
 570         struct pktq txq;        /* Queue length used for flow-control */
 571         u8 flowcontrol; /* per prio flow control bitmask */
 572         u8 tx_seq;              /* Transmit sequence number (next) */
 573         u8 tx_max;              /* Maximum transmit sequence allowed */
 574
 575         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 576         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 577         u16 nextlen;            /* Next Read Len from last header */
 578         u8 rx_seq;              /* Receive sequence number (expected) */
 579         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 580
 581         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 582         struct sk_buff *glom;   /* Packet chain for glommed superframe */
 583         uint glomerr;           /* Glom packet read errors */
 584
 585         u8 *rxbuf;              /* Buffer for receiving control packets */
 586         uint rxblen;            /* Allocated length of rxbuf */
 587         u8 *rxctl;              /* Aligned pointer into rxbuf */
 588         u8 *databuf;            /* Buffer for receiving big glom packet */
 589         u8 *dataptr;            /* Aligned pointer into databuf */
 590         uint rxlen;             /* Length of valid data in buffer */
 591
 592         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 593
 594         bool intr;              /* Use interrupts */
 595         bool poll;              /* Use polling */
 596         bool ipend;             /* Device interrupt is pending */
 597         uint intrcount;         /* Count of device interrupt callbacks */
 598         uint lastintrs;         /* Count as of last watchdog timer */
 599         uint spurious;          /* Count of spurious interrupts */
 600         uint pollrate;          /* Ticks between device polls */
 601         uint polltick;          /* Tick counter */
 602         uint pollcnt;           /* Count of active polls */
 603
 604 #ifdef BCMDBG
 605         struct brcmf_console console;   /* Console output polling support */
 606         uint console_addr;      /* Console address from shared struct */
 607 #endif                          /* BCMDBG */
 608
 609         uint regfails;          /* Count of R_REG failures */
 610
 611         uint clkstate;          /* State of sd and backplane clock(s) */
 612         bool activity;          /* Activity flag for clock down */
 613         s32 idletime;           /* Control for activity timeout */
 614         s32 idlecount;  /* Activity timeout counter */
 615         s32 idleclock;  /* How to set bus driver when idle */
 616         s32 sd_rxchain;
 617         bool use_rxchain;       /* If brcmf should use PKT chains */
 618         bool sleeping;          /* Is SDIO bus sleeping? */
 619         bool rxflow_mode;       /* Rx flow control mode */
 620         bool rxflow;            /* Is rx flow control on */
 621         bool alp_only;          /* Don't use HT clock (ALP only) */
 622 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
 623         bool usebufpool;
 624
 625         /* Some additional counters */
 626         uint tx_sderrs;         /* Count of tx attempts with sd errors */
 627         uint fcqueued;          /* Tx packets that got queued */
 628         uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 629         uint rx_toolong;        /* Receive frames too long to receive */
 630         uint rxc_errors;        /* SDIO errors when reading control frames */
 631         uint rx_hdrfail;        /* SDIO errors on header reads */
 632         uint rx_badhdr;         /* Bad received headers (roosync?) */
 633         uint rx_badseq;         /* Mismatched rx sequence number */
 634         uint fc_rcvd;           /* Number of flow-control events received */
 635         uint fc_xoff;           /* Number which turned on flow-control */
 636         uint fc_xon;            /* Number which turned off flow-control */
 637         uint rxglomfail;        /* Failed deglom attempts */
 638         uint rxglomframes;      /* Number of glom frames (superframes) */
 639         uint rxglompkts;        /* Number of packets from glom frames */
 640         uint f2rxhdrs;          /* Number of header reads */
 641         uint f2rxdata;          /* Number of frame data reads */
 642         uint f2txdata;          /* Number of f2 frame writes */
 643         uint f1regdata;         /* Number of f1 register accesses */
 644
 645         u8 *ctrl_frame_buf;
 646         u32 ctrl_frame_len;
 647         bool ctrl_frame_stat;
 648
 649         spinlock_t txqlock;
 650         wait_queue_head_t ctrl_wait;
 651         wait_queue_head_t ioctl_resp_wait;
 652
 653         struct timer_list timer;
 654         struct completion watchdog_wait;
 655         struct task_struct *watchdog_tsk;
 656         bool wd_timer_valid;
 657         uint save_ms;
 658
 659         struct tasklet_struct tasklet;
 660         struct task_struct *dpc_tsk;
 661         struct completion dpc_wait;
 662
 663         bool threads_only;
 664         struct semaphore sdsem;
 665         spinlock_t sdlock;
 666
 667         const char *fw_name;
 668         const struct firmware *firmware;
 669         const char *nv_name;
 670         u32 fw_ptr;
 671 };
 672
 673 struct sbconfig {
 674         u32 PAD[2];
 675         u32 sbipsflag;  /* initiator port ocp slave flag */
 676         u32 PAD[3];
 677         u32 sbtpsflag;  /* target port ocp slave flag */
 678         u32 PAD[11];
 679         u32 sbtmerrloga;        /* (sonics >= 2.3) */
 680         u32 PAD;
 681         u32 sbtmerrlog; /* (sonics >= 2.3) */
 682         u32 PAD[3];
 683         u32 sbadmatch3; /* address match3 */
 684         u32 PAD;
 685         u32 sbadmatch2; /* address match2 */
 686         u32 PAD;
 687         u32 sbadmatch1; /* address match1 */
 688         u32 PAD[7];
 689         u32 sbimstate;  /* initiator agent state */
 690         u32 sbintvec;   /* interrupt mask */
 691         u32 sbtmstatelow;       /* target state */
 692         u32 sbtmstatehigh;      /* target state */
 693         u32 sbbwa0;             /* bandwidth allocation table0 */
 694         u32 PAD;
 695         u32 sbimconfiglow;      /* initiator configuration */
 696         u32 sbimconfighigh;     /* initiator configuration */
 697         u32 sbadmatch0; /* address match0 */
 698         u32 PAD;
 699         u32 sbtmconfiglow;      /* target configuration */
 700         u32 sbtmconfighigh;     /* target configuration */
 701         u32 sbbconfig;  /* broadcast configuration */
 702         u32 PAD;
 703         u32 sbbstate;   /* broadcast state */
 704         u32 PAD[3];
 705         u32 sbactcnfg;  /* activate configuration */
 706         u32 PAD[3];
 707         u32 sbflagst;   /* current sbflags */
 708         u32 PAD[3];
 709         u32 sbidlow;            /* identification */
 710         u32 sbidhigh;   /* identification */
 711 };
 712
 713 /* clkstate */
 714 #define CLK_NONE        0
 715 #define CLK_SDONLY      1
 716 #define CLK_PENDING     2       /* Not used yet */
 717 #define CLK_AVAIL       3
 718
 719 #ifdef BCMDBG
 720 static int qcount[NUMPRIO];
 721 static int tx_packets[NUMPRIO];
 722 #endif                          /* BCMDBG */
 723
 724 /* Watchdog thread priority, -1 to use kernel timer */
 725 int brcmf_watchdog_prio = 97;
 726 module_param(brcmf_watchdog_prio, int, 0);
 727
 728 /* Watchdog interval */
 729 uint brcmf_watchdog_ms = 10;
 730 module_param(brcmf_watchdog_ms, uint, 0);
 731
 732 /* DPC thread priority, -1 to use tasklet */
 733 int brcmf_dpc_prio = 98;
 734 module_param(brcmf_dpc_prio, int, 0);
 735
 736 #ifdef BCMDBG
 737 /* Console poll interval */
 738 uint brcmf_console_ms;
 739 module_param(brcmf_console_ms, uint, 0);
 740 #endif          /* BCMDBG */
 741
 742 /* Tx/Rx bounds */
 743 uint brcmf_txbound;
 744 uint brcmf_rxbound;
 745 module_param(brcmf_txbound, uint, 0);
 746 module_param(brcmf_rxbound, uint, 0);
 747 static uint brcmf_txminmax;
 748
 749 int brcmf_idletime = 1;
 750 module_param(brcmf_idletime, int, 0);
 751
 752 /* SDIO Drive Strength (in milliamps) */
 753 uint brcmf_sdiod_drive_strength = 6;
 754 module_param(brcmf_sdiod_drive_strength, uint, 0);
 755
 756 /* Use polling */
 757 uint brcmf_poll;
 758 module_param(brcmf_poll, uint, 0);
 759
 760 /* Use interrupts */
 761 uint brcmf_intr = true;
 762 module_param(brcmf_intr, uint, 0);
 763
 764 /* IOCTL response timeout */
 765 static int brcmf_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
 766
 767 /* override the RAM size if possible */
 768 #define DONGLE_MIN_MEMSIZE (128 * 1024)
 769 int brcmf_dongle_memsize;
 770 module_param(brcmf_dongle_memsize, int, 0);
 771
 772 static bool brcmf_alignctl;
 773
 774 static bool retrydata;
 775 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
 776
 777 static const uint firstread = BRCMF_FIRSTREAD;
 778
 779 /* Retry count for register access failures */
 780 static const uint retry_limit = 2;
 781
 782 /* Force even SD lengths (some host controllers mess up on odd bytes) */
 783 static bool forcealign;
 784
 785 #define ALIGNMENT  4
 786
 787 static void pkt_align(struct sk_buff *p, int len, int align)
 788 {
 789         uint datalign;
 790         datalign = (unsigned long)(p->data);
 791         datalign = roundup(datalign, (align)) - datalign;
 792         if (datalign)
 793                 skb_pull(p, datalign);
 794         __skb_trim(p, len);
 795 }
 796
 797 /* Limit on rounding up frames */
 798 static const uint max_roundup = 512;
 799
 800 /* Try doing readahead */
 801 static bool brcmf_readahead;
 802
 803 /* To check if there's window offered */
 804 static bool data_ok(struct brcmf_bus *bus)
 805 {
 806         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 807                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 808 }
 809
 810 /*
 811  * Reads a register in the SDIO hardware block. This block occupies a series of
 812  * adresses on the 32 bit backplane bus.
 813  */
 814 static void
 815 r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
 816 {
 817         *retryvar = 0;
 818         do {
 819                 *regvar = brcmf_sdcard_reg_read(bus->sdiodev,
 820                                 bus->ci->buscorebase + reg_offset, sizeof(u32));
 821         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 822                  (++(*retryvar) <= retry_limit));
 823         if (*retryvar) {
 824                 bus->regfails += (*retryvar-1);
 825                 if (*retryvar > retry_limit) {
 826                         brcmf_dbg(ERROR, "FAILED READ %Xh\n", reg_offset);
 827                         *regvar = 0;
 828                 }
 829         }
 830 }
 831
 832 static void
 833 w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
 834 {
 835         *retryvar = 0;
 836         do {
 837                 brcmf_sdcard_reg_write(bus->sdiodev,
 838                                        bus->ci->buscorebase + reg_offset,
 839                                        sizeof(u32), regval);
 840         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 841                  (++(*retryvar) <= retry_limit));
 842         if (*retryvar) {
 843                 bus->regfails += (*retryvar-1);
 844                 if (*retryvar > retry_limit)
 845                         brcmf_dbg(ERROR, "FAILED REGISTER WRITE %Xh\n",
 846                                   reg_offset);
 847         }
 848 }
 849
 850 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 851
 852 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 853
 854 /* Packet free applicable unconditionally for sdio and sdspi.
 855  * Conditional if bufpool was present for gspi bus.
 856  */
 857 static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
 858 {
 859         if (bus->usebufpool)
 860                 brcmu_pkt_buf_free_skb(pkt);
 861 }
 862
 863 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size)
 864 {
 865         s32 min_size = DONGLE_MIN_MEMSIZE;
 866         /* Restrict the memsize to user specified limit */
 867         brcmf_dbg(ERROR, "user: Restrict the dongle ram size to %d, min %d\n",
 868                   brcmf_dongle_memsize, min_size);
 869         if ((brcmf_dongle_memsize > min_size) &&
 870             (brcmf_dongle_memsize < (s32) bus->orig_ramsize))
 871                 bus->ramsize = brcmf_dongle_memsize;
 872 }
 873
 874 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus)
 875 {
 876         if (bus->threads_only)
 877                 down(&bus->sdsem);
 878         else
 879                 spin_lock_bh(&bus->sdlock);
 880 }
 881
 882 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus)
 883 {
 884         if (bus->threads_only)
 885                 up(&bus->sdsem);
 886         else
 887                 spin_unlock_bh(&bus->sdlock);
 888 }
 889
 890 /* Turn backplane clock on or off */
 891 static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
 892 {
 893         int err;
 894         u8 clkctl, clkreq, devctl;
 895         unsigned long timeout;
 896
 897         brcmf_dbg(TRACE, "Enter\n");
 898
 899         clkctl = 0;
 900
 901         if (on) {
 902                 /* Request HT Avail */
 903                 clkreq =
 904                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 905
 906                 if ((bus->ci->chip == BCM4329_CHIP_ID)
 907                     && (bus->ci->chiprev == 0))
 908                         clkreq |= SBSDIO_FORCE_ALP;
 909
 910                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 911                                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 912                 if (err) {
 913                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 914                         return -EBADE;
 915                 }
 916
 917                 if (pendok && ((bus->ci->buscoretype == PCMCIA_CORE_ID)
 918                                && (bus->ci->buscorerev == 9))) {
 919                         u32 dummy, retries;
 920                         r_sdreg32(bus, &dummy,
 921                                   offsetof(struct sdpcmd_regs, clockctlstatus),
 922                                   &retries);
 923                 }
 924
 925                 /* Check current status */
 926                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 927                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
 928                 if (err) {
 929                         brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
 930                         return -EBADE;
 931                 }
 932
 933                 /* Go to pending and await interrupt if appropriate */
 934                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 935                         /* Allow only clock-available interrupt */
 936                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 937                                         SDIO_FUNC_1,
 938                                         SBSDIO_DEVICE_CTL, &err);
 939                         if (err) {
 940                                 brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
 941                                           err);
 942                                 return -EBADE;
 943                         }
 944
 945                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 946                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 947                                                SBSDIO_DEVICE_CTL, devctl, &err);
 948                         brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
 949                         bus->clkstate = CLK_PENDING;
 950
 951                         return 0;
 952                 } else if (bus->clkstate == CLK_PENDING) {
 953                         /* Cancel CA-only interrupt filter */
 954                         devctl =
 955                             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 956                                                   SBSDIO_DEVICE_CTL, &err);
 957                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 958                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 959                                 SBSDIO_DEVICE_CTL, devctl, &err);
 960                 }
 961
 962                 /* Otherwise, wait here (polling) for HT Avail */
 963                 timeout = jiffies +
 964                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 965                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 966                         clkctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 967                                                        SDIO_FUNC_1,
 968                                                        SBSDIO_FUNC1_CHIPCLKCSR,
 969                                                        &err);
 970                         if (time_after(jiffies, timeout))
 971                                 break;
 972                         else
 973                                 usleep_range(5000, 10000);
 974                 }
 975                 if (err) {
 976                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 977                         return -EBADE;
 978                 }
 979                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 980                         brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
 981                                   PMU_MAX_TRANSITION_DLY, clkctl);
 982                         return -EBADE;
 983                 }
 984
 985                 /* Mark clock available */
 986                 bus->clkstate = CLK_AVAIL;
 987                 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
 988
 989 #if defined(BCMDBG)
 990                 if (bus->alp_only != true) {
 991                         if (SBSDIO_ALPONLY(clkctl))
 992                                 brcmf_dbg(ERROR, "HT Clock should be on\n");
 993                 }
 994 #endif                          /* defined (BCMDBG) */
 995
 996                 bus->activity = true;
 997         } else {
 998                 clkreq = 0;
 999
1000                 if (bus->clkstate == CLK_PENDING) {
1001                         /* Cancel CA-only interrupt filter */
1002                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
1003                                         SDIO_FUNC_1,
1004                                         SBSDIO_DEVICE_CTL, &err);
1005                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
1006                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1007                                 SBSDIO_DEVICE_CTL, devctl, &err);
1008                 }
1009
1010                 bus->clkstate = CLK_SDONLY;
1011                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1012                         SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
1013                 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
1014                 if (err) {
1015                         brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
1016                                   err);
1017                         return -EBADE;
1018                 }
1019         }
1020         return 0;
1021 }
1022
1023 /* Change idle/active SD state */
1024 static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
1025 {
1026         brcmf_dbg(TRACE, "Enter\n");
1027
1028         if (on)
1029                 bus->clkstate = CLK_SDONLY;
1030         else
1031                 bus->clkstate = CLK_NONE;
1032
1033         return 0;
1034 }
1035
1036 /* Transition SD and backplane clock readiness */
1037 static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
1038 {
1039 #ifdef BCMDBG
1040         uint oldstate = bus->clkstate;
1041 #endif                          /* BCMDBG */
1042
1043         brcmf_dbg(TRACE, "Enter\n");
1044
1045         /* Early exit if we're already there */
1046         if (bus->clkstate == target) {
1047                 if (target == CLK_AVAIL) {
1048                         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1049                         bus->activity = true;
1050                 }
1051                 return 0;
1052         }
1053
1054         switch (target) {
1055         case CLK_AVAIL:
1056                 /* Make sure SD clock is available */
1057                 if (bus->clkstate == CLK_NONE)
1058                         brcmf_sdbrcm_sdclk(bus, true);
1059                 /* Now request HT Avail on the backplane */
1060                 brcmf_sdbrcm_htclk(bus, true, pendok);
1061                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1062                 bus->activity = true;
1063                 break;
1064
1065         case CLK_SDONLY:
1066                 /* Remove HT request, or bring up SD clock */
1067                 if (bus->clkstate == CLK_NONE)
1068                         brcmf_sdbrcm_sdclk(bus, true);
1069                 else if (bus->clkstate == CLK_AVAIL)
1070                         brcmf_sdbrcm_htclk(bus, false, false);
1071                 else
1072                         brcmf_dbg(ERROR, "request for %d -> %d\n",
1073                                   bus->clkstate, target);
1074                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1075                 break;
1076
1077         case CLK_NONE:
1078                 /* Make sure to remove HT request */
1079                 if (bus->clkstate == CLK_AVAIL)
1080                         brcmf_sdbrcm_htclk(bus, false, false);
1081                 /* Now remove the SD clock */
1082                 brcmf_sdbrcm_sdclk(bus, false);
1083                 brcmf_sdbrcm_wd_timer(bus, 0);
1084                 break;
1085         }
1086 #ifdef BCMDBG
1087         brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
1088 #endif                          /* BCMDBG */
1089
1090         return 0;
1091 }
1092
1093 static int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
1094 {
1095         uint retries = 0;
1096
1097         brcmf_dbg(INFO, "request %s (currently %s)\n",
1098                   sleep ? "SLEEP" : "WAKE",
1099                   bus->sleeping ? "SLEEP" : "WAKE");
1100
1101         /* Done if we're already in the requested state */
1102         if (sleep == bus->sleeping)
1103                 return 0;
1104
1105         /* Going to sleep: set the alarm and turn off the lights... */
1106         if (sleep) {
1107                 /* Don't sleep if something is pending */
1108                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
1109                         return -EBUSY;
1110
1111                 /* Make sure the controller has the bus up */
1112                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1113
1114                 /* Tell device to start using OOB wakeup */
1115                 w_sdreg32(bus, SMB_USE_OOB,
1116                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1117                 if (retries > retry_limit)
1118                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
1119
1120                 /* Turn off our contribution to the HT clock request */
1121                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1122
1123                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1124                         SBSDIO_FUNC1_CHIPCLKCSR,
1125                         SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
1126
1127                 /* Isolate the bus */
1128                 if (bus->ci->chip != BCM4329_CHIP_ID) {
1129                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1130                                 SBSDIO_DEVICE_CTL,
1131                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
1132                 }
1133
1134                 /* Change state */
1135                 bus->sleeping = true;
1136
1137         } else {
1138                 /* Waking up: bus power up is ok, set local state */
1139
1140                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1141                         SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
1142
1143                 /* Force pad isolation off if possible
1144                          (in case power never toggled) */
1145                 if ((bus->ci->buscoretype == PCMCIA_CORE_ID)
1146                     && (bus->ci->buscorerev >= 10))
1147                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1148                                 SBSDIO_DEVICE_CTL, 0, NULL);
1149
1150                 /* Make sure the controller has the bus up */
1151                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1152
1153                 /* Send misc interrupt to indicate OOB not needed */
1154                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
1155                           &retries);
1156                 if (retries <= retry_limit)
1157                         w_sdreg32(bus, SMB_DEV_INT,
1158                                   offsetof(struct sdpcmd_regs, tosbmailbox),
1159                                   &retries);
1160
1161                 if (retries > retry_limit)
1162                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
1163
1164                 /* Make sure we have SD bus access */
1165                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1166
1167                 /* Change state */
1168                 bus->sleeping = false;
1169         }
1170
1171         return 0;
1172 }
1173
1174 static void bus_wake(struct brcmf_bus *bus)
1175 {
1176         if (bus->sleeping)
1177                 brcmf_sdbrcm_bussleep(bus, false);
1178 }
1179
1180 static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
1181 {
1182         u32 intstatus = 0;
1183         u32 hmb_data;
1184         u8 fcbits;
1185         uint retries = 0;
1186
1187         brcmf_dbg(TRACE, "Enter\n");
1188
1189         /* Read mailbox data and ack that we did so */
1190         r_sdreg32(bus, &hmb_data,
1191                   offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
1192
1193         if (retries <= retry_limit)
1194                 w_sdreg32(bus, SMB_INT_ACK,
1195                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1196         bus->f1regdata += 2;
1197
1198         /* Dongle recomposed rx frames, accept them again */
1199         if (hmb_data & HMB_DATA_NAKHANDLED) {
1200                 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
1201                           bus->rx_seq);
1202                 if (!bus->rxskip)
1203                         brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
1204
1205                 bus->rxskip = false;
1206                 intstatus |= I_HMB_FRAME_IND;
1207         }
1208
1209         /*
1210          * DEVREADY does not occur with gSPI.
1211          */
1212         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
1213                 bus->sdpcm_ver =
1214                     (hmb_data & HMB_DATA_VERSION_MASK) >>
1215                     HMB_DATA_VERSION_SHIFT;
1216                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
1217                         brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
1218                                   "expecting %d\n",
1219                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
1220                 else
1221                         brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
1222                                   bus->sdpcm_ver);
1223         }
1224
1225         /*
1226          * Flow Control has been moved into the RX headers and this out of band
1227          * method isn't used any more.
1228          * remaining backward compatible with older dongles.
1229          */
1230         if (hmb_data & HMB_DATA_FC) {
1231                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
1232                                                         HMB_DATA_FCDATA_SHIFT;
1233
1234                 if (fcbits & ~bus->flowcontrol)
1235                         bus->fc_xoff++;
1236
1237                 if (bus->flowcontrol & ~fcbits)
1238                         bus->fc_xon++;
1239
1240                 bus->fc_rcvd++;
1241                 bus->flowcontrol = fcbits;
1242         }
1243
1244         /* Shouldn't be any others */
1245         if (hmb_data & ~(HMB_DATA_DEVREADY |
1246                          HMB_DATA_NAKHANDLED |
1247                          HMB_DATA_FC |
1248                          HMB_DATA_FWREADY |
1249                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1250                 brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
1251                           hmb_data);
1252
1253         return intstatus;
1254 }
1255
1256 static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
1257 {
1258         uint retries = 0;
1259         u16 lastrbc;
1260         u8 hi, lo;
1261         int err;
1262
1263         brcmf_dbg(ERROR, "%sterminate frame%s\n",
1264                   abort ? "abort command, " : "",
1265                   rtx ? ", send NAK" : "");
1266
1267         if (abort)
1268                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1269
1270         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1271                                SBSDIO_FUNC1_FRAMECTRL,
1272                                SFC_RF_TERM, &err);
1273         bus->f1regdata++;
1274
1275         /* Wait until the packet has been flushed (device/FIFO stable) */
1276         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1277                 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1278                                            SBSDIO_FUNC1_RFRAMEBCHI, NULL);
1279                 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1280                                            SBSDIO_FUNC1_RFRAMEBCLO, NULL);
1281                 bus->f1regdata += 2;
1282
1283                 if ((hi == 0) && (lo == 0))
1284                         break;
1285
1286                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1287                         brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
1288                                   lastrbc, (hi << 8) + lo);
1289                 }
1290                 lastrbc = (hi << 8) + lo;
1291         }
1292
1293         if (!retries)
1294                 brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
1295         else
1296                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
1297
1298         if (rtx) {
1299                 bus->rxrtx++;
1300                 w_sdreg32(bus, SMB_NAK,
1301                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1302
1303                 bus->f1regdata++;
1304                 if (retries <= retry_limit)
1305                         bus->rxskip = true;
1306         }
1307
1308         /* Clear partial in any case */
1309         bus->nextlen = 0;
1310
1311         /* If we can't reach the device, signal failure */
1312         if (err || brcmf_sdcard_regfail(bus->sdiodev))
1313                 bus->drvr->busstate = BRCMF_BUS_DOWN;
1314 }
1315
1316 static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
1317 {
1318         u16 dlen, totlen;
1319         u8 *dptr, num = 0;
1320
1321         u16 sublen, check;
1322         struct sk_buff *pfirst, *plast, *pnext, *save_pfirst;
1323
1324         int errcode;
1325         u8 chan, seq, doff, sfdoff;
1326         u8 txmax;
1327
1328         int ifidx = 0;
1329         bool usechain = bus->use_rxchain;
1330
1331         /* If packets, issue read(s) and send up packet chain */
1332         /* Return sequence numbers consumed? */
1333
1334         brcmf_dbg(TRACE, "start: glomd %p glom %p\n", bus->glomd, bus->glom);
1335
1336         /* If there's a descriptor, generate the packet chain */
1337         if (bus->glomd) {
1338                 pfirst = plast = pnext = NULL;
1339                 dlen = (u16) (bus->glomd->len);
1340                 dptr = bus->glomd->data;
1341                 if (!dlen || (dlen & 1)) {
1342                         brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
1343                                   dlen);
1344                         dlen = 0;
1345                 }
1346
1347                 for (totlen = num = 0; dlen; num++) {
1348                         /* Get (and move past) next length */
1349                         sublen = get_unaligned_le16(dptr);
1350                         dlen -= sizeof(u16);
1351                         dptr += sizeof(u16);
1352                         if ((sublen < SDPCM_HDRLEN) ||
1353                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1354                                 brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
1355                                           num, sublen);
1356                                 pnext = NULL;
1357                                 break;
1358                         }
1359                         if (sublen % BRCMF_SDALIGN) {
1360                                 brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
1361                                           sublen, BRCMF_SDALIGN);
1362                                 usechain = false;
1363                         }
1364                         totlen += sublen;
1365
1366                         /* For last frame, adjust read len so total
1367                                  is a block multiple */
1368                         if (!dlen) {
1369                                 sublen +=
1370                                     (roundup(totlen, bus->blocksize) - totlen);
1371                                 totlen = roundup(totlen, bus->blocksize);
1372                         }
1373
1374                         /* Allocate/chain packet for next subframe */
1375                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1376                         if (pnext == NULL) {
1377                                 brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
1378                                           num, sublen);
1379                                 break;
1380                         }
1381                         if (!pfirst) {
1382                                 pfirst = plast = pnext;
1383                         } else {
1384                                 plast->next = pnext;
1385                                 plast = pnext;
1386                         }
1387
1388                         /* Adhere to start alignment requirements */
1389                         pkt_align(pnext, sublen, BRCMF_SDALIGN);
1390                 }
1391
1392                 /* If all allocations succeeded, save packet chain
1393                          in bus structure */
1394                 if (pnext) {
1395                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1396                                   totlen, num);
1397                         if (BRCMF_GLOM_ON() && bus->nextlen) {
1398                                 if (totlen != bus->nextlen) {
1399                                         brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1400                                                   bus->nextlen, totlen, rxseq);
1401                                 }
1402                         }
1403                         bus->glom = pfirst;
1404                         pfirst = pnext = NULL;
1405                 } else {
1406                         if (pfirst)
1407                                 brcmu_pkt_buf_free_skb(pfirst);
1408                         bus->glom = NULL;
1409                         num = 0;
1410                 }
1411
1412                 /* Done with descriptor packet */
1413                 brcmu_pkt_buf_free_skb(bus->glomd);
1414                 bus->glomd = NULL;
1415                 bus->nextlen = 0;
1416         }
1417
1418         /* Ok -- either we just generated a packet chain,
1419                  or had one from before */
1420         if (bus->glom) {
1421                 if (BRCMF_GLOM_ON()) {
1422                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1423                         for (pnext = bus->glom; pnext; pnext = pnext->next) {
1424                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1425                                           pnext, (u8 *) (pnext->data),
1426                                           pnext->len, pnext->len);
1427                         }
1428                 }
1429
1430                 pfirst = bus->glom;
1431                 dlen = (u16) brcmu_pkttotlen(pfirst);
1432
1433                 /* Do an SDIO read for the superframe.  Configurable iovar to
1434                  * read directly into the chained packet, or allocate a large
1435                  * packet and and copy into the chain.
1436                  */
1437                 if (usechain) {
1438                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1439                                         bus->sdiodev->sbwad,
1440                                         SDIO_FUNC_2,
1441                                         F2SYNC, (u8 *) pfirst->data, dlen,
1442                                         pfirst);
1443                 } else if (bus->dataptr) {
1444                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1445                                         bus->sdiodev->sbwad,
1446                                         SDIO_FUNC_2,
1447                                         F2SYNC, bus->dataptr, dlen,
1448                                         NULL);
1449                         sublen = (u16) brcmu_pktfrombuf(pfirst, 0, dlen,
1450                                                 bus->dataptr);
1451                         if (sublen != dlen) {
1452                                 brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
1453                                           dlen, sublen);
1454                                 errcode = -1;
1455                         }
1456                         pnext = NULL;
1457                 } else {
1458                         brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1459                                   dlen);
1460                         errcode = -1;
1461                 }
1462                 bus->f2rxdata++;
1463
1464                 /* On failure, kill the superframe, allow a couple retries */
1465                 if (errcode < 0) {
1466                         brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
1467                                   dlen, errcode);
1468                         bus->drvr->rx_errors++;
1469
1470                         if (bus->glomerr++ < 3) {
1471                                 brcmf_sdbrcm_rxfail(bus, true, true);
1472                         } else {
1473                                 bus->glomerr = 0;
1474                                 brcmf_sdbrcm_rxfail(bus, true, false);
1475                                 brcmu_pkt_buf_free_skb(bus->glom);
1476                                 bus->rxglomfail++;
1477                                 bus->glom = NULL;
1478                         }
1479                         return 0;
1480                 }
1481 #ifdef BCMDBG
1482                 if (BRCMF_GLOM_ON()) {
1483                         printk(KERN_DEBUG "SUPERFRAME:\n");
1484                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1485                                 pfirst->data, min_t(int, pfirst->len, 48));
1486                 }
1487 #endif
1488
1489                 /* Validate the superframe header */
1490                 dptr = (u8 *) (pfirst->data);
1491                 sublen = get_unaligned_le16(dptr);
1492                 check = get_unaligned_le16(dptr + sizeof(u16));
1493
1494                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1495                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1496                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1497                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1498                         brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
1499                                   bus->nextlen, seq);
1500                         bus->nextlen = 0;
1501                 }
1502                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1503                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1504
1505                 errcode = 0;
1506                 if ((u16)~(sublen ^ check)) {
1507                         brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
1508                                   sublen, check);
1509                         errcode = -1;
1510                 } else if (roundup(sublen, bus->blocksize) != dlen) {
1511                         brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
1512                                   sublen, roundup(sublen, bus->blocksize),
1513                                   dlen);
1514                         errcode = -1;
1515                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
1516                            SDPCM_GLOM_CHANNEL) {
1517                         brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
1518                                   SDPCM_PACKET_CHANNEL(
1519                                           &dptr[SDPCM_FRAMETAG_LEN]));
1520                         errcode = -1;
1521                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
1522                         brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
1523                         errcode = -1;
1524                 } else if ((doff < SDPCM_HDRLEN) ||
1525                            (doff > (pfirst->len - SDPCM_HDRLEN))) {
1526                         brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
1527                                   doff, sublen, pfirst->len, SDPCM_HDRLEN);
1528                         errcode = -1;
1529                 }
1530
1531                 /* Check sequence number of superframe SW header */
1532                 if (rxseq != seq) {
1533                         brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
1534                                   seq, rxseq);
1535                         bus->rx_badseq++;
1536                         rxseq = seq;
1537                 }
1538
1539                 /* Check window for sanity */
1540                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1541                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1542                                   txmax, bus->tx_seq);
1543                         txmax = bus->tx_seq + 2;
1544                 }
1545                 bus->tx_max = txmax;
1546
1547                 /* Remove superframe header, remember offset */
1548                 skb_pull(pfirst, doff);
1549                 sfdoff = doff;
1550
1551                 /* Validate all the subframe headers */
1552                 for (num = 0, pnext = pfirst; pnext && !errcode;
1553                      num++, pnext = pnext->next) {
1554                         dptr = (u8 *) (pnext->data);
1555                         dlen = (u16) (pnext->len);
1556                         sublen = get_unaligned_le16(dptr);
1557                         check = get_unaligned_le16(dptr + sizeof(u16));
1558                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1559                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1560 #ifdef BCMDBG
1561                         if (BRCMF_GLOM_ON()) {
1562                                 printk(KERN_DEBUG "subframe:\n");
1563                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1564                                                      dptr, 32);
1565                         }
1566 #endif
1567
1568                         if ((u16)~(sublen ^ check)) {
1569                                 brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
1570                                           num, sublen, check);
1571                                 errcode = -1;
1572                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
1573                                 brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
1574                                           num, sublen, dlen);
1575                                 errcode = -1;
1576                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
1577                                    (chan != SDPCM_EVENT_CHANNEL)) {
1578                                 brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
1579                                           num, chan);
1580                                 errcode = -1;
1581                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
1582                                 brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
1583                                           num, doff, sublen, SDPCM_HDRLEN);
1584                                 errcode = -1;
1585                         }
1586                 }
1587
1588                 if (errcode) {
1589                         /* Terminate frame on error, request
1590                                  a couple retries */
1591                         if (bus->glomerr++ < 3) {
1592                                 /* Restore superframe header space */
1593                                 skb_push(pfirst, sfdoff);
1594                                 brcmf_sdbrcm_rxfail(bus, true, true);
1595                         } else {
1596                                 bus->glomerr = 0;
1597                                 brcmf_sdbrcm_rxfail(bus, true, false);
1598                                 brcmu_pkt_buf_free_skb(bus->glom);
1599                                 bus->rxglomfail++;
1600                                 bus->glom = NULL;
1601                         }
1602                         bus->nextlen = 0;
1603                         return 0;
1604                 }
1605
1606                 /* Basic SD framing looks ok - process each packet (header) */
1607                 save_pfirst = pfirst;
1608                 bus->glom = NULL;
1609                 plast = NULL;
1610
1611                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
1612                         pnext = pfirst->next;
1613                         pfirst->next = NULL;
1614
1615                         dptr = (u8 *) (pfirst->data);
1616                         sublen = get_unaligned_le16(dptr);
1617                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1618                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1619                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1620
1621                         brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
1622                                   num, pfirst, pfirst->data,
1623                                   pfirst->len, sublen, chan, seq);
1624
1625                         /* precondition: chan == SDPCM_DATA_CHANNEL ||
1626                                          chan == SDPCM_EVENT_CHANNEL */
1627
1628                         if (rxseq != seq) {
1629                                 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
1630                                           seq, rxseq);
1631                                 bus->rx_badseq++;
1632                                 rxseq = seq;
1633                         }
1634 #ifdef BCMDBG
1635                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1636                                 printk(KERN_DEBUG "Rx Subframe Data:\n");
1637                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1638                                                      dptr, dlen);
1639                         }
1640 #endif
1641
1642                         __skb_trim(pfirst, sublen);
1643                         skb_pull(pfirst, doff);
1644
1645                         if (pfirst->len == 0) {
1646                                 brcmu_pkt_buf_free_skb(pfirst);
1647                                 if (plast)
1648                                         plast->next = pnext;
1649                                 else
1650                                         save_pfirst = pnext;
1651
1652                                 continue;
1653                         } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx,
1654                                                        pfirst) != 0) {
1655                                 brcmf_dbg(ERROR, "rx protocol error\n");
1656                                 bus->drvr->rx_errors++;
1657                                 brcmu_pkt_buf_free_skb(pfirst);
1658                                 if (plast)
1659                                         plast->next = pnext;
1660                                 else
1661                                         save_pfirst = pnext;
1662
1663                                 continue;
1664                         }
1665
1666                         /* this packet will go up, link back into
1667                                  chain and count it */
1668                         pfirst->next = pnext;
1669                         plast = pfirst;
1670                         num++;
1671
1672 #ifdef BCMDBG
1673                         if (BRCMF_GLOM_ON()) {
1674                                 brcmf_dbg(GLOM, "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1675                                           num, pfirst, pfirst->data,
1676                                           pfirst->len, pfirst->next,
1677                                           pfirst->prev);
1678                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1679                                                 pfirst->data,
1680                                                 min_t(int, pfirst->len, 32));
1681                         }
1682 #endif                          /* BCMDBG */
1683                 }
1684                 if (num) {
1685                         brcmf_sdbrcm_sdunlock(bus);
1686                         brcmf_rx_frame(bus->drvr, ifidx, save_pfirst, num);
1687                         brcmf_sdbrcm_sdlock(bus);
1688                 }
1689
1690                 bus->rxglomframes++;
1691                 bus->rxglompkts += num;
1692         }
1693         return num;
1694 }
1695
1696 static int brcmf_sdbrcm_ioctl_resp_wait(struct brcmf_bus *bus, uint *condition,
1697                                         bool *pending)
1698 {
1699         DECLARE_WAITQUEUE(wait, current);
1700         int timeout = msecs_to_jiffies(brcmf_ioctl_timeout_msec);
1701
1702         /* Wait until control frame is available */
1703         add_wait_queue(&bus->ioctl_resp_wait, &wait);
1704         set_current_state(TASK_INTERRUPTIBLE);
1705
1706         while (!(*condition) && (!signal_pending(current) && timeout))
1707                 timeout = schedule_timeout(timeout);
1708
1709         if (signal_pending(current))
1710                 *pending = true;
1711
1712         set_current_state(TASK_RUNNING);
1713         remove_wait_queue(&bus->ioctl_resp_wait, &wait);
1714
1715         return timeout;
1716 }
1717
1718 static int brcmf_sdbrcm_ioctl_resp_wake(struct brcmf_bus *bus)
1719 {
1720         if (waitqueue_active(&bus->ioctl_resp_wait))
1721                 wake_up_interruptible(&bus->ioctl_resp_wait);
1722
1723         return 0;
1724 }
1725 static void
1726 brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
1727 {
1728         uint rdlen, pad;
1729
1730         int sdret;
1731
1732         brcmf_dbg(TRACE, "Enter\n");
1733
1734         /* Set rxctl for frame (w/optional alignment) */
1735         bus->rxctl = bus->rxbuf;
1736         if (brcmf_alignctl) {
1737                 bus->rxctl += firstread;
1738                 pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
1739                 if (pad)
1740                         bus->rxctl += (BRCMF_SDALIGN - pad);
1741                 bus->rxctl -= firstread;
1742         }
1743
1744         /* Copy the already-read portion over */
1745         memcpy(bus->rxctl, hdr, firstread);
1746         if (len <= firstread)
1747                 goto gotpkt;
1748
1749         /* Raise rdlen to next SDIO block to avoid tail command */
1750         rdlen = len - firstread;
1751         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1752                 pad = bus->blocksize - (rdlen % bus->blocksize);
1753                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1754                     ((len + pad) < bus->drvr->maxctl))
1755                         rdlen += pad;
1756         } else if (rdlen % BRCMF_SDALIGN) {
1757                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1758         }
1759
1760         /* Satisfy length-alignment requirements */
1761         if (forcealign && (rdlen & (ALIGNMENT - 1)))
1762                 rdlen = roundup(rdlen, ALIGNMENT);
1763
1764         /* Drop if the read is too big or it exceeds our maximum */
1765         if ((rdlen + firstread) > bus->drvr->maxctl) {
1766                 brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
1767                           rdlen, bus->drvr->maxctl);
1768                 bus->drvr->rx_errors++;
1769                 brcmf_sdbrcm_rxfail(bus, false, false);
1770                 goto done;
1771         }
1772
1773         if ((len - doff) > bus->drvr->maxctl) {
1774                 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1775                           len, len - doff, bus->drvr->maxctl);
1776                 bus->drvr->rx_errors++;
1777                 bus->rx_toolong++;
1778                 brcmf_sdbrcm_rxfail(bus, false, false);
1779                 goto done;
1780         }
1781
1782         /* Read remainder of frame body into the rxctl buffer */
1783         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1784                                 bus->sdiodev->sbwad,
1785                                 SDIO_FUNC_2,
1786                                 F2SYNC, (bus->rxctl + firstread), rdlen,
1787                                 NULL);
1788         bus->f2rxdata++;
1789
1790         /* Control frame failures need retransmission */
1791         if (sdret < 0) {
1792                 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
1793                           rdlen, sdret);
1794                 bus->rxc_errors++;
1795                 brcmf_sdbrcm_rxfail(bus, true, true);
1796                 goto done;
1797         }
1798
1799 gotpkt:
1800
1801 #ifdef BCMDBG
1802         if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1803                 printk(KERN_DEBUG "RxCtrl:\n");
1804                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
1805         }
1806 #endif
1807
1808         /* Point to valid data and indicate its length */
1809         bus->rxctl += doff;
1810         bus->rxlen = len - doff;
1811
1812 done:
1813         /* Awake any waiters */
1814         brcmf_sdbrcm_ioctl_resp_wake(bus);
1815 }
1816
1817 /* Return true if there may be more frames to read */
1818 static uint
1819 brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
1820 {
1821         u16 len, check; /* Extracted hardware header fields */
1822         u8 chan, seq, doff;     /* Extracted software header fields */
1823         u8 fcbits;              /* Extracted fcbits from software header */
1824
1825         struct sk_buff *pkt;            /* Packet for event or data frames */
1826         u16 pad;                /* Number of pad bytes to read */
1827         u16 rdlen;              /* Total number of bytes to read */
1828         u8 rxseq;               /* Next sequence number to expect */
1829         uint rxleft = 0;        /* Remaining number of frames allowed */
1830         int sdret;              /* Return code from calls */
1831         u8 txmax;               /* Maximum tx sequence offered */
1832         bool len_consistent;    /* Result of comparing readahead len and
1833                                          len from hw-hdr */
1834         u8 *rxbuf;
1835         int ifidx = 0;
1836         uint rxcount = 0;       /* Total frames read */
1837
1838         brcmf_dbg(TRACE, "Enter\n");
1839
1840         /* Not finished unless we encounter no more frames indication */
1841         *finished = false;
1842
1843         for (rxseq = bus->rx_seq, rxleft = maxframes;
1844              !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
1845              rxseq++, rxleft--) {
1846
1847                 /* Handle glomming separately */
1848                 if (bus->glom || bus->glomd) {
1849                         u8 cnt;
1850                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1851                                   bus->glomd, bus->glom);
1852                         cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
1853                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1854                         rxseq += cnt - 1;
1855                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1856                         continue;
1857                 }
1858
1859                 /* Try doing single read if we can */
1860                 if (brcmf_readahead && bus->nextlen) {
1861                         u16 nextlen = bus->nextlen;
1862                         bus->nextlen = 0;
1863
1864                         rdlen = len = nextlen << 4;
1865
1866                         /* Pad read to blocksize for efficiency */
1867                         if (bus->roundup && bus->blocksize
1868                             && (rdlen > bus->blocksize)) {
1869                                 pad =
1870                                     bus->blocksize -
1871                                     (rdlen % bus->blocksize);
1872                                 if ((pad <= bus->roundup)
1873                                     && (pad < bus->blocksize)
1874                                     && ((rdlen + pad + firstread) <
1875                                         MAX_RX_DATASZ))
1876                                         rdlen += pad;
1877                         } else if (rdlen % BRCMF_SDALIGN) {
1878                                 rdlen += BRCMF_SDALIGN -
1879                                          (rdlen % BRCMF_SDALIGN);
1880                         }
1881
1882                         /* We use bus->rxctl buffer in WinXP for initial
1883                          * control pkt receives.
1884                          * Later we use buffer-poll for data as well
1885                          * as control packets.
1886                          * This is required because dhd receives full
1887                          * frame in gSPI unlike SDIO.
1888                          * After the frame is received we have to
1889                          * distinguish whether it is data
1890                          * or non-data frame.
1891                          */
1892                         /* Allocate a packet buffer */
1893                         pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
1894                         if (!pkt) {
1895                                 /* Give up on data, request rtx of events */
1896                                 brcmf_dbg(ERROR, "(nextlen): brcmu_pkt_buf_get_skb failed: len %d rdlen %d expected rxseq %d\n",
1897                                           len, rdlen, rxseq);
1898                                 continue;
1899                         } else {
1900                                 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
1901                                 rxbuf = (u8 *) (pkt->data);
1902                                 /* Read the entire frame */
1903                                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1904                                                 bus->sdiodev->sbwad,
1905                                                 SDIO_FUNC_2, F2SYNC,
1906                                                 rxbuf, rdlen,
1907                                                 pkt);
1908                                 bus->f2rxdata++;
1909
1910                                 if (sdret < 0) {
1911                                         brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
1912                                                   rdlen, sdret);
1913                                         brcmu_pkt_buf_free_skb(pkt);
1914                                         bus->drvr->rx_errors++;
1915                                         /* Force retry w/normal header read.
1916                                          * Don't attempt NAK for
1917                                          * gSPI
1918                                          */
1919                                         brcmf_sdbrcm_rxfail(bus, true, true);
1920                                         continue;
1921                                 }
1922                         }
1923
1924                         /* Now check the header */
1925                         memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
1926
1927                         /* Extract hardware header fields */
1928                         len = get_unaligned_le16(bus->rxhdr);
1929                         check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1930
1931                         /* All zeros means readahead info was bad */
1932                         if (!(len | check)) {
1933                                 brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
1934                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1935                                 continue;
1936                         }
1937
1938                         /* Validate check bytes */
1939                         if ((u16)~(len ^ check)) {
1940                                 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
1941                                           nextlen, len, check);
1942                                 bus->rx_badhdr++;
1943                                 brcmf_sdbrcm_rxfail(bus, false, false);
1944                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1945                                 continue;
1946                         }
1947
1948                         /* Validate frame length */
1949                         if (len < SDPCM_HDRLEN) {
1950                                 brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
1951                                           len);
1952                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1953                                 continue;
1954                         }
1955
1956                         /* Check for consistency withreadahead info */
1957                         len_consistent = (nextlen != (roundup(len, 16) >> 4));
1958                         if (len_consistent) {
1959                                 /* Mismatch, force retry w/normal
1960                                         header (may be >4K) */
1961                                 brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
1962                                           nextlen, len, roundup(len, 16),
1963                                           rxseq);
1964                                 brcmf_sdbrcm_rxfail(bus, true, true);
1965                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1966                                 continue;
1967                         }
1968
1969                         /* Extract software header fields */
1970                         chan = SDPCM_PACKET_CHANNEL(
1971                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1972                         seq = SDPCM_PACKET_SEQUENCE(
1973                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1974                         doff = SDPCM_DOFFSET_VALUE(
1975                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1976                         txmax = SDPCM_WINDOW_VALUE(
1977                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1978
1979                         bus->nextlen =
1980                             bus->rxhdr[SDPCM_FRAMETAG_LEN +
1981                                        SDPCM_NEXTLEN_OFFSET];
1982                         if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1983                                 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1984                                           bus->nextlen, seq);
1985                                 bus->nextlen = 0;
1986                         }
1987
1988                         bus->drvr->rx_readahead_cnt++;
1989
1990                         /* Handle Flow Control */
1991                         fcbits = SDPCM_FCMASK_VALUE(
1992                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1993
1994                         if (bus->flowcontrol != fcbits) {
1995                                 if (~bus->flowcontrol & fcbits)
1996                                         bus->fc_xoff++;
1997
1998                                 if (bus->flowcontrol & ~fcbits)
1999                                         bus->fc_xon++;
2000
2001                                 bus->fc_rcvd++;
2002                                 bus->flowcontrol = fcbits;
2003                         }
2004
2005                         /* Check and update sequence number */
2006                         if (rxseq != seq) {
2007                                 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
2008                                           seq, rxseq);
2009                                 bus->rx_badseq++;
2010                                 rxseq = seq;
2011                         }
2012
2013                         /* Check window for sanity */
2014                         if ((u8) (txmax - bus->tx_seq) > 0x40) {
2015                                 brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
2016                                           txmax, bus->tx_seq);
2017                                 txmax = bus->tx_seq + 2;
2018                         }
2019                         bus->tx_max = txmax;
2020
2021 #ifdef BCMDBG
2022                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2023                                 printk(KERN_DEBUG "Rx Data:\n");
2024                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2025                                                      rxbuf, len);
2026                         } else if (BRCMF_HDRS_ON()) {
2027                                 printk(KERN_DEBUG "RxHdr:\n");
2028                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2029                                                      bus->rxhdr, SDPCM_HDRLEN);
2030                         }
2031 #endif
2032
2033                         if (chan == SDPCM_CONTROL_CHANNEL) {
2034                                 brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
2035                                           seq);
2036                                 /* Force retry w/normal header read */
2037                                 bus->nextlen = 0;
2038                                 brcmf_sdbrcm_rxfail(bus, false, true);
2039                                 brcmf_sdbrcm_pktfree2(bus, pkt);
2040                                 continue;
2041                         }
2042
2043                         /* Validate data offset */
2044                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
2045                                 brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
2046                                           doff, len, SDPCM_HDRLEN);
2047                                 brcmf_sdbrcm_rxfail(bus, false, false);
2048                                 brcmf_sdbrcm_pktfree2(bus, pkt);
2049                                 continue;
2050                         }
2051
2052                         /* All done with this one -- now deliver the packet */
2053                         goto deliver;
2054                 }
2055
2056                 /* Read frame header (hardware and software) */
2057                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
2058                                 SDIO_FUNC_2, F2SYNC, bus->rxhdr, firstread,
2059                                 NULL);
2060                 bus->f2rxhdrs++;
2061
2062                 if (sdret < 0) {
2063                         brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
2064                         bus->rx_hdrfail++;
2065                         brcmf_sdbrcm_rxfail(bus, true, true);
2066                         continue;
2067                 }
2068 #ifdef BCMDBG
2069                 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
2070                         printk(KERN_DEBUG "RxHdr:\n");
2071                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2072                                              bus->rxhdr, SDPCM_HDRLEN);
2073                 }
2074 #endif
2075
2076                 /* Extract hardware header fields */
2077                 len = get_unaligned_le16(bus->rxhdr);
2078                 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
2079
2080                 /* All zeros means no more frames */
2081                 if (!(len | check)) {
2082                         *finished = true;
2083                         break;
2084                 }
2085
2086                 /* Validate check bytes */
2087                 if ((u16) ~(len ^ check)) {
2088                         brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
2089                                   len, check);
2090                         bus->rx_badhdr++;
2091                         brcmf_sdbrcm_rxfail(bus, false, false);
2092                         continue;
2093                 }
2094
2095                 /* Validate frame length */
2096                 if (len < SDPCM_HDRLEN) {
2097                         brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
2098                         continue;
2099                 }
2100
2101                 /* Extract software header fields */
2102                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
2103                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
2104                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
2105                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
2106
2107                 /* Validate data offset */
2108                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
2109                         brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
2110                                   doff, len, SDPCM_HDRLEN, seq);
2111                         bus->rx_badhdr++;
2112                         brcmf_sdbrcm_rxfail(bus, false, false);
2113                         continue;
2114                 }
2115
2116                 /* Save the readahead length if there is one */
2117                 bus->nextlen =
2118                     bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
2119                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
2120                         brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
2121                                   bus->nextlen, seq);
2122                         bus->nextlen = 0;
2123                 }
2124
2125                 /* Handle Flow Control */
2126                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
2127
2128                 if (bus->flowcontrol != fcbits) {
2129                         if (~bus->flowcontrol & fcbits)
2130                                 bus->fc_xoff++;
2131
2132                         if (bus->flowcontrol & ~fcbits)
2133                                 bus->fc_xon++;
2134
2135                         bus->fc_rcvd++;
2136                         bus->flowcontrol = fcbits;
2137                 }
2138
2139                 /* Check and update sequence number */
2140                 if (rxseq != seq) {
2141                         brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
2142                         bus->rx_badseq++;
2143                         rxseq = seq;
2144                 }
2145
2146                 /* Check window for sanity */
2147                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
2148                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
2149                                   txmax, bus->tx_seq);
2150                         txmax = bus->tx_seq + 2;
2151                 }
2152                 bus->tx_max = txmax;
2153
2154                 /* Call a separate function for control frames */
2155                 if (chan == SDPCM_CONTROL_CHANNEL) {
2156                         brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
2157                         continue;
2158                 }
2159
2160                 /* precondition: chan is either SDPCM_DATA_CHANNEL,
2161                    SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
2162                    SDPCM_GLOM_CHANNEL */
2163
2164                 /* Length to read */
2165                 rdlen = (len > firstread) ? (len - firstread) : 0;
2166
2167                 /* May pad read to blocksize for efficiency */
2168                 if (bus->roundup && bus->blocksize &&
2169                         (rdlen > bus->blocksize)) {
2170                         pad = bus->blocksize - (rdlen % bus->blocksize);
2171                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
2172                             ((rdlen + pad + firstread) < MAX_RX_DATASZ))
2173                                 rdlen += pad;
2174                 } else if (rdlen % BRCMF_SDALIGN) {
2175                         rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
2176                 }
2177
2178                 /* Satisfy length-alignment requirements */
2179                 if (forcealign && (rdlen & (ALIGNMENT - 1)))
2180                         rdlen = roundup(rdlen, ALIGNMENT);
2181
2182                 if ((rdlen + firstread) > MAX_RX_DATASZ) {
2183                         /* Too long -- skip this frame */
2184                         brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
2185                                   len, rdlen);
2186                         bus->drvr->rx_errors++;
2187                         bus->rx_toolong++;
2188                         brcmf_sdbrcm_rxfail(bus, false, false);
2189                         continue;
2190                 }
2191
2192                 pkt = brcmu_pkt_buf_get_skb(rdlen + firstread + BRCMF_SDALIGN);
2193                 if (!pkt) {
2194                         /* Give up on data, request rtx of events */
2195                         brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
2196                                   rdlen, chan);
2197                         bus->drvr->rx_dropped++;
2198                         brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
2199                         continue;
2200                 }
2201
2202                 /* Leave room for what we already read, and align remainder */
2203                 skb_pull(pkt, firstread);
2204                 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
2205
2206                 /* Read the remaining frame data */
2207                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
2208                                 SDIO_FUNC_2, F2SYNC, ((u8 *) (pkt->data)),
2209                                 rdlen, pkt);
2210                 bus->f2rxdata++;
2211
2212                 if (sdret < 0) {
2213                         brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
2214                                   ((chan == SDPCM_EVENT_CHANNEL) ? "event"
2215                                    : ((chan == SDPCM_DATA_CHANNEL) ? "data"
2216                                       : "test")), sdret);
2217                         brcmu_pkt_buf_free_skb(pkt);
2218                         bus->drvr->rx_errors++;
2219                         brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
2220                         continue;
2221                 }
2222
2223                 /* Copy the already-read portion */
2224                 skb_push(pkt, firstread);
2225                 memcpy(pkt->data, bus->rxhdr, firstread);
2226
2227 #ifdef BCMDBG
2228                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2229                         printk(KERN_DEBUG "Rx Data:\n");
2230                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2231                                              pkt->data, len);
2232                 }
2233 #endif
2234
2235 deliver:
2236                 /* Save superframe descriptor and allocate packet frame */
2237                 if (chan == SDPCM_GLOM_CHANNEL) {
2238                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
2239                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
2240                                           len);
2241 #ifdef BCMDBG
2242                                 if (BRCMF_GLOM_ON()) {
2243                                         printk(KERN_DEBUG "Glom Data:\n");
2244                                         print_hex_dump_bytes("",
2245                                                              DUMP_PREFIX_OFFSET,
2246                                                              pkt->data, len);
2247                                 }
2248 #endif
2249                                 __skb_trim(pkt, len);
2250                                 skb_pull(pkt, SDPCM_HDRLEN);
2251                                 bus->glomd = pkt;
2252                         } else {
2253                                 brcmf_dbg(ERROR, "%s: glom superframe w/o "
2254                                           "descriptor!\n", __func__);
2255                                 brcmf_sdbrcm_rxfail(bus, false, false);
2256                         }
2257                         continue;
2258                 }
2259
2260                 /* Fill in packet len and prio, deliver upward */
2261                 __skb_trim(pkt, len);
2262                 skb_pull(pkt, doff);
2263
2264                 if (pkt->len == 0) {
2265                         brcmu_pkt_buf_free_skb(pkt);
2266                         continue;
2267                 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
2268                         brcmf_dbg(ERROR, "rx protocol error\n");
2269                         brcmu_pkt_buf_free_skb(pkt);
2270                         bus->drvr->rx_errors++;
2271                         continue;
2272                 }
2273
2274                 /* Unlock during rx call */
2275                 brcmf_sdbrcm_sdunlock(bus);
2276                 brcmf_rx_frame(bus->drvr, ifidx, pkt, 1);
2277                 brcmf_sdbrcm_sdlock(bus);
2278         }
2279         rxcount = maxframes - rxleft;
2280 #ifdef BCMDBG
2281         /* Message if we hit the limit */
2282         if (!rxleft)
2283                 brcmf_dbg(DATA, "hit rx limit of %d frames\n",
2284                           maxframes);
2285         else
2286 #endif                          /* BCMDBG */
2287                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2288         /* Back off rxseq if awaiting rtx, update rx_seq */
2289         if (bus->rxskip)
2290                 rxseq--;
2291         bus->rx_seq = rxseq;
2292
2293         return rxcount;
2294 }
2295
2296 static int
2297 brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn, uint flags,
2298                     u8 *buf, uint nbytes, struct sk_buff *pkt)
2299 {
2300         return brcmf_sdcard_send_buf
2301                 (bus->sdiodev, addr, fn, flags, buf, nbytes, pkt);
2302 }
2303
2304 static void
2305 brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
2306 {
2307         brcmf_sdbrcm_sdunlock(bus);
2308         wait_event_interruptible_timeout(bus->ctrl_wait,
2309                                          (*lockvar == false), HZ * 2);
2310         brcmf_sdbrcm_sdlock(bus);
2311         return;
2312 }
2313
2314 static void
2315 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
2316 {
2317         if (waitqueue_active(&bus->ctrl_wait))
2318                 wake_up_interruptible(&bus->ctrl_wait);
2319         return;
2320 }
2321
2322 /* Writes a HW/SW header into the packet and sends it. */
2323 /* Assumes: (a) header space already there, (b) caller holds lock */
2324 static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt,
2325                               uint chan, bool free_pkt)
2326 {
2327         int ret;
2328         u8 *frame;
2329         u16 len, pad = 0;
2330         u32 swheader;
2331         uint retries = 0;
2332         struct sk_buff *new;
2333         int i;
2334
2335         brcmf_dbg(TRACE, "Enter\n");
2336
2337         if (bus->drvr->dongle_reset) {
2338                 ret = -EPERM;
2339                 goto done;
2340         }
2341
2342         frame = (u8 *) (pkt->data);
2343
2344         /* Add alignment padding, allocate new packet if needed */
2345         pad = ((unsigned long)frame % BRCMF_SDALIGN);
2346         if (pad) {
2347                 if (skb_headroom(pkt) < pad) {
2348                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
2349                                   skb_headroom(pkt), pad);
2350                         bus->drvr->tx_realloc++;
2351                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
2352                         if (!new) {
2353                                 brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
2354                                           pkt->len + BRCMF_SDALIGN);
2355                                 ret = -ENOMEM;
2356                                 goto done;
2357                         }
2358
2359                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
2360                         memcpy(new->data, pkt->data, pkt->len);
2361                         if (free_pkt)
2362                                 brcmu_pkt_buf_free_skb(pkt);
2363                         /* free the pkt if canned one is not used */
2364                         free_pkt = true;
2365                         pkt = new;
2366                         frame = (u8 *) (pkt->data);
2367                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
2368                         pad = 0;
2369                 } else {
2370                         skb_push(pkt, pad);
2371                         frame = (u8 *) (pkt->data);
2372                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
2373                         memset(frame, 0, pad + SDPCM_HDRLEN);
2374                 }
2375         }
2376         /* precondition: pad < BRCMF_SDALIGN */
2377
2378         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2379         len = (u16) (pkt->len);
2380         *(u16 *) frame = cpu_to_le16(len);
2381         *(((u16 *) frame) + 1) = cpu_to_le16(~len);
2382
2383         /* Software tag: channel, sequence number, data offset */
2384         swheader =
2385             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
2386             (((pad +
2387                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
2388
2389         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2390         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2391
2392 #ifdef BCMDBG
2393         tx_packets[pkt->priority]++;
2394         if (BRCMF_BYTES_ON() &&
2395             (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
2396               (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
2397                 printk(KERN_DEBUG "Tx Frame:\n");
2398                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
2399         } else if (BRCMF_HDRS_ON()) {
2400                 printk(KERN_DEBUG "TxHdr:\n");
2401                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2402                                      frame, min_t(u16, len, 16));
2403         }
2404 #endif
2405
2406         /* Raise len to next SDIO block to eliminate tail command */
2407         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2408                 u16 pad = bus->blocksize - (len % bus->blocksize);
2409                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2410                                 len += pad;
2411         } else if (len % BRCMF_SDALIGN) {
2412                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2413         }
2414
2415         /* Some controllers have trouble with odd bytes -- round to even */
2416         if (forcealign && (len & (ALIGNMENT - 1)))
2417                         len = roundup(len, ALIGNMENT);
2418
2419         do {
2420                 ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
2421                                             SDIO_FUNC_2, F2SYNC, frame,
2422                                             len, pkt);
2423                 bus->f2txdata++;
2424
2425                 if (ret < 0) {
2426                         /* On failure, abort the command
2427                          and terminate the frame */
2428                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2429                                   ret);
2430                         bus->tx_sderrs++;
2431
2432                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2433                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2434                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2435                                          NULL);
2436                         bus->f1regdata++;
2437
2438                         for (i = 0; i < 3; i++) {
2439                                 u8 hi, lo;
2440                                 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2441                                                      SDIO_FUNC_1,
2442                                                      SBSDIO_FUNC1_WFRAMEBCHI,
2443                                                      NULL);
2444                                 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2445                                                      SDIO_FUNC_1,
2446                                                      SBSDIO_FUNC1_WFRAMEBCLO,
2447                                                      NULL);
2448                                 bus->f1regdata += 2;
2449                                 if ((hi == 0) && (lo == 0))
2450                                         break;
2451                         }
2452
2453                 }
2454                 if (ret == 0)
2455                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2456
2457         } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
2458
2459 done:
2460         /* restore pkt buffer pointer before calling tx complete routine */
2461         skb_pull(pkt, SDPCM_HDRLEN + pad);
2462         brcmf_sdbrcm_sdunlock(bus);
2463         brcmf_txcomplete(bus->drvr, pkt, ret != 0);
2464         brcmf_sdbrcm_sdlock(bus);
2465
2466         if (free_pkt)
2467                 brcmu_pkt_buf_free_skb(pkt);
2468
2469         return ret;
2470 }
2471
2472 static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
2473 {
2474         struct sk_buff *pkt;
2475         u32 intstatus = 0;
2476         uint retries = 0;
2477         int ret = 0, prec_out;
2478         uint cnt = 0;
2479         uint datalen;
2480         u8 tx_prec_map;
2481
2482         struct brcmf_pub *drvr = bus->drvr;
2483
2484         brcmf_dbg(TRACE, "Enter\n");
2485
2486         tx_prec_map = ~bus->flowcontrol;
2487
2488         /* Send frames until the limit or some other event */
2489         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
2490                 spin_lock_bh(&bus->txqlock);
2491                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
2492                 if (pkt == NULL) {
2493                         spin_unlock_bh(&bus->txqlock);
2494                         break;
2495                 }
2496                 spin_unlock_bh(&bus->txqlock);
2497                 datalen = pkt->len - SDPCM_HDRLEN;
2498
2499                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
2500                 if (ret)
2501                         bus->drvr->tx_errors++;
2502                 else
2503                         bus->drvr->dstats.tx_bytes += datalen;
2504
2505                 /* In poll mode, need to check for other events */
2506                 if (!bus->intr && cnt) {
2507                         /* Check device status, signal pending interrupt */
2508                         r_sdreg32(bus, &intstatus,
2509                                   offsetof(struct sdpcmd_regs, intstatus),
2510                                   &retries);
2511                         bus->f2txdata++;
2512                         if (brcmf_sdcard_regfail(bus->sdiodev))
2513                                 break;
2514                         if (intstatus & bus->hostintmask)
2515                                 bus->ipend = true;
2516                 }
2517         }
2518
2519         /* Deflow-control stack if needed */
2520         if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
2521             drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
2522                 brcmf_txflowcontrol(drvr, 0, OFF);
2523
2524         return cnt;
2525 }
2526
2527 static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
2528 {
2529         u32 intstatus, newstatus = 0;
2530         uint retries = 0;
2531         uint rxlimit = brcmf_rxbound;   /* Rx frames to read before resched */
2532         uint txlimit = brcmf_txbound;   /* Tx frames to send before resched */
2533         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2534         bool rxdone = true;     /* Flag for no more read data */
2535         bool resched = false;   /* Flag indicating resched wanted */
2536
2537         brcmf_dbg(TRACE, "Enter\n");
2538
2539         /* Start with leftover status bits */
2540         intstatus = bus->intstatus;
2541
2542         brcmf_sdbrcm_sdlock(bus);
2543
2544         /* If waiting for HTAVAIL, check status */
2545         if (bus->clkstate == CLK_PENDING) {
2546                 int err;
2547                 u8 clkctl, devctl = 0;
2548
2549 #ifdef BCMDBG
2550                 /* Check for inconsistent device control */
2551                 devctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2552                                                SBSDIO_DEVICE_CTL, &err);
2553                 if (err) {
2554                         brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
2555                         bus->drvr->busstate = BRCMF_BUS_DOWN;
2556                 }
2557 #endif                          /* BCMDBG */
2558
2559                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2560                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2561                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
2562                 if (err) {
2563                         brcmf_dbg(ERROR, "error reading CSR: %d\n",
2564                                   err);
2565                         bus->drvr->busstate = BRCMF_BUS_DOWN;
2566                 }
2567
2568                 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2569                           devctl, clkctl);
2570
2571                 if (SBSDIO_HTAV(clkctl)) {
2572                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
2573                                                        SDIO_FUNC_1,
2574                                                        SBSDIO_DEVICE_CTL, &err);
2575                         if (err) {
2576                                 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
2577                                           err);
2578                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2579                         }
2580                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2581                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2582                                 SBSDIO_DEVICE_CTL, devctl, &err);
2583                         if (err) {
2584                                 brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
2585                                           err);
2586                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2587                         }
2588                         bus->clkstate = CLK_AVAIL;
2589                 } else {
2590                         goto clkwait;
2591                 }
2592         }
2593
2594         bus_wake(bus);
2595
2596         /* Make sure backplane clock is on */
2597         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2598         if (bus->clkstate == CLK_PENDING)
2599                 goto clkwait;
2600
2601         /* Pending interrupt indicates new device status */
2602         if (bus->ipend) {
2603                 bus->ipend = false;
2604                 r_sdreg32(bus, &newstatus,
2605                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2606                 bus->f1regdata++;
2607                 if (brcmf_sdcard_regfail(bus->sdiodev))
2608                         newstatus = 0;
2609                 newstatus &= bus->hostintmask;
2610                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
2611                 if (newstatus) {
2612                         w_sdreg32(bus, newstatus,
2613                                   offsetof(struct sdpcmd_regs, intstatus),
2614                                   &retries);
2615                         bus->f1regdata++;
2616                 }
2617         }
2618
2619         /* Merge new bits with previous */
2620         intstatus |= newstatus;
2621         bus->intstatus = 0;
2622
2623         /* Handle flow-control change: read new state in case our ack
2624          * crossed another change interrupt.  If change still set, assume
2625          * FC ON for safety, let next loop through do the debounce.
2626          */
2627         if (intstatus & I_HMB_FC_CHANGE) {
2628                 intstatus &= ~I_HMB_FC_CHANGE;
2629                 w_sdreg32(bus, I_HMB_FC_CHANGE,
2630                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2631
2632                 r_sdreg32(bus, &newstatus,
2633                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2634                 bus->f1regdata += 2;
2635                 bus->fcstate =
2636                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
2637                 intstatus |= (newstatus & bus->hostintmask);
2638         }
2639
2640         /* Handle host mailbox indication */
2641         if (intstatus & I_HMB_HOST_INT) {
2642                 intstatus &= ~I_HMB_HOST_INT;
2643                 intstatus |= brcmf_sdbrcm_hostmail(bus);
2644         }
2645
2646         /* Generally don't ask for these, can get CRC errors... */
2647         if (intstatus & I_WR_OOSYNC) {
2648                 brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
2649                 intstatus &= ~I_WR_OOSYNC;
2650         }
2651
2652         if (intstatus & I_RD_OOSYNC) {
2653                 brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
2654                 intstatus &= ~I_RD_OOSYNC;
2655         }
2656
2657         if (intstatus & I_SBINT) {
2658                 brcmf_dbg(ERROR, "Dongle reports SBINT\n");
2659                 intstatus &= ~I_SBINT;
2660         }
2661
2662         /* Would be active due to wake-wlan in gSPI */
2663         if (intstatus & I_CHIPACTIVE) {
2664                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2665                 intstatus &= ~I_CHIPACTIVE;
2666         }
2667
2668         /* Ignore frame indications if rxskip is set */
2669         if (bus->rxskip)
2670                 intstatus &= ~I_HMB_FRAME_IND;
2671
2672         /* On frame indication, read available frames */
2673         if (PKT_AVAILABLE()) {
2674                 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
2675                 if (rxdone || bus->rxskip)
2676                         intstatus &= ~I_HMB_FRAME_IND;
2677                 rxlimit -= min(framecnt, rxlimit);
2678         }
2679
2680         /* Keep still-pending events for next scheduling */
2681         bus->intstatus = intstatus;
2682
2683 clkwait:
2684         if (data_ok(bus) && bus->ctrl_frame_stat &&
2685                 (bus->clkstate == CLK_AVAIL)) {
2686                 int ret, i;
2687
2688                 ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
2689                         SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
2690                         (u32) bus->ctrl_frame_len, NULL);
2691
2692                 if (ret < 0) {
2693                         /* On failure, abort the command and
2694                                 terminate the frame */
2695                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2696                                   ret);
2697                         bus->tx_sderrs++;
2698
2699                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2700
2701                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2702                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2703                                          NULL);
2704                         bus->f1regdata++;
2705
2706                         for (i = 0; i < 3; i++) {
2707                                 u8 hi, lo;
2708                                 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2709                                                      SDIO_FUNC_1,
2710                                                      SBSDIO_FUNC1_WFRAMEBCHI,
2711                                                      NULL);
2712                                 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2713                                                      SDIO_FUNC_1,
2714                                                      SBSDIO_FUNC1_WFRAMEBCLO,
2715                                                      NULL);
2716                                 bus->f1regdata += 2;
2717                                 if ((hi == 0) && (lo == 0))
2718                                         break;
2719                         }
2720
2721                 }
2722                 if (ret == 0)
2723                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2724
2725                 brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
2726                 bus->ctrl_frame_stat = false;
2727                 brcmf_sdbrcm_wait_event_wakeup(bus);
2728         }
2729         /* Send queued frames (limit 1 if rx may still be pending) */
2730         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
2731                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2732                  && data_ok(bus)) {
2733                 framecnt = rxdone ? txlimit : min(txlimit, brcmf_txminmax);
2734                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2735                 txlimit -= framecnt;
2736         }
2737
2738         /* Resched if events or tx frames are pending,
2739                  else await next interrupt */
2740         /* On failed register access, all bets are off:
2741                  no resched or interrupts */
2742         if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
2743             brcmf_sdcard_regfail(bus->sdiodev)) {
2744                 brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation %d\n",
2745                           brcmf_sdcard_regfail(bus->sdiodev));
2746                 bus->drvr->busstate = BRCMF_BUS_DOWN;
2747                 bus->intstatus = 0;
2748         } else if (bus->clkstate == CLK_PENDING) {
2749                 brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
2750                 resched = true;
2751         } else if (bus->intstatus || bus->ipend ||
2752                 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
2753                  && data_ok(bus)) || PKT_AVAILABLE()) {
2754                 resched = true;
2755         }
2756
2757         bus->dpc_sched = resched;
2758
2759         /* If we're done for now, turn off clock request. */
2760         if ((bus->clkstate != CLK_PENDING)
2761             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2762                 bus->activity = false;
2763                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2764         }
2765
2766         brcmf_sdbrcm_sdunlock(bus);
2767
2768         return resched;
2769 }
2770
2771 static int brcmf_sdbrcm_dpc_thread(void *data)
2772 {
2773         struct brcmf_bus *bus = (struct brcmf_bus *) data;
2774
2775         /* This thread doesn't need any user-level access,
2776          * so get rid of all our resources
2777          */
2778         if (brcmf_dpc_prio > 0) {
2779                 struct sched_param param;
2780                 param.sched_priority = (brcmf_dpc_prio < MAX_RT_PRIO) ?
2781                                        brcmf_dpc_prio : (MAX_RT_PRIO - 1);
2782                 sched_setscheduler(current, SCHED_FIFO, &param);
2783         }
2784
2785         allow_signal(SIGTERM);
2786         /* Run until signal received */
2787         while (1) {
2788                 if (kthread_should_stop())
2789                         break;
2790                 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
2791                         /* Call bus dpc unless it indicated down
2792                         (then clean stop) */
2793                         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
2794                                 if (brcmf_sdbrcm_dpc(bus))
2795                                         complete(&bus->dpc_wait);
2796                         } else {
2797                                 brcmf_sdbrcm_bus_stop(bus, true);
2798                         }
2799                 } else
2800                         break;
2801         }
2802         return 0;
2803 }
2804
2805 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data)
2806 {
2807         struct brcmf_bus *bus = (struct brcmf_bus *) data;
2808
2809         /* Call bus dpc unless it indicated down (then clean stop) */
2810         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
2811                 if (brcmf_sdbrcm_dpc(bus))
2812                         tasklet_schedule(&bus->tasklet);
2813         } else
2814                 brcmf_sdbrcm_bus_stop(bus, true);
2815 }
2816
2817 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus)
2818 {
2819         if (bus->dpc_tsk) {
2820                 complete(&bus->dpc_wait);
2821                 return;
2822         }
2823
2824         tasklet_schedule(&bus->tasklet);
2825 }
2826
2827 int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
2828 {
2829         int ret = -EBADE;
2830         uint datalen, prec;
2831
2832         brcmf_dbg(TRACE, "Enter\n");
2833
2834         datalen = pkt->len;
2835
2836         /* Add space for the header */
2837         skb_push(pkt, SDPCM_HDRLEN);
2838         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2839
2840         prec = prio2prec((pkt->priority & PRIOMASK));
2841
2842         /* Check for existing queue, current flow-control,
2843                          pending event, or pending clock */
2844         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2845         bus->fcqueued++;
2846
2847         /* Priority based enq */
2848         spin_lock_bh(&bus->txqlock);
2849         if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) == false) {
2850                 skb_pull(pkt, SDPCM_HDRLEN);
2851                 brcmf_txcomplete(bus->drvr, pkt, false);
2852                 brcmu_pkt_buf_free_skb(pkt);
2853                 brcmf_dbg(ERROR, "out of bus->txq !!!\n");
2854                 ret = -ENOSR;
2855         } else {
2856                 ret = 0;
2857         }
2858         spin_unlock_bh(&bus->txqlock);
2859
2860         if (pktq_len(&bus->txq) >= TXHI)
2861                 brcmf_txflowcontrol(bus->drvr, 0, ON);
2862
2863 #ifdef BCMDBG
2864         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2865                 qcount[prec] = pktq_plen(&bus->txq, prec);
2866 #endif
2867         /* Schedule DPC if needed to send queued packet(s) */
2868         if (!bus->dpc_sched) {
2869                 bus->dpc_sched = true;
2870                 brcmf_sdbrcm_sched_dpc(bus);
2871         }
2872
2873         return ret;
2874 }
2875
2876 static int
2877 brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
2878                  uint size)
2879 {
2880         int bcmerror = 0;
2881         u32 sdaddr;
2882         uint dsize;
2883
2884         /* Determine initial transfer parameters */
2885         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2886         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2887                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2888         else
2889                 dsize = size;
2890
2891         /* Set the backplane window to include the start address */
2892         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2893         if (bcmerror) {
2894                 brcmf_dbg(ERROR, "window change failed\n");
2895                 goto xfer_done;
2896         }
2897
2898         /* Do the transfer(s) */
2899         while (size) {
2900                 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2901                           write ? "write" : "read", dsize,
2902                           sdaddr, address & SBSDIO_SBWINDOW_MASK);
2903                 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2904                                                sdaddr, data, dsize);
2905                 if (bcmerror) {
2906                         brcmf_dbg(ERROR, "membytes transfer failed\n");
2907                         break;
2908                 }
2909
2910                 /* Adjust for next transfer (if any) */
2911                 size -= dsize;
2912                 if (size) {
2913                         data += dsize;
2914                         address += dsize;
2915                         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2916                                                                   address);
2917                         if (bcmerror) {
2918                                 brcmf_dbg(ERROR, "window change failed\n");
2919                                 break;
2920                         }
2921                         sdaddr = 0;
2922                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2923                 }
2924         }
2925
2926 xfer_done:
2927         /* Return the window to backplane enumeration space for core access */
2928         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2929                 brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
2930                           bus->sdiodev->sbwad);
2931
2932         return bcmerror;
2933 }
2934
2935 #ifdef BCMDBG
2936 static int
2937 brcmf_sdbrcm_readshared(struct brcmf_bus *bus, struct sdpcm_shared *sh)
2938 {
2939         u32 addr;
2940         int rv;
2941
2942         /* Read last word in memory to determine address of
2943                          sdpcm_shared structure */
2944         rv = brcmf_sdbrcm_membytes(bus, false, bus->ramsize - 4, (u8 *)&addr,
2945                                    4);
2946         if (rv < 0)
2947                 return rv;
2948
2949         addr = le32_to_cpu(addr);
2950
2951         brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
2952
2953         /*
2954          * Check if addr is valid.
2955          * NVRAM length at the end of memory should have been overwritten.
2956          */
2957         if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
2958                 brcmf_dbg(ERROR, "address (0x%08x) of sdpcm_shared invalid\n",
2959                           addr);
2960                 return -EBADE;
2961         }
2962
2963         /* Read rte_shared structure */
2964         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *) sh,
2965                               sizeof(struct sdpcm_shared));
2966         if (rv < 0)
2967                 return rv;
2968
2969         /* Endianness */
2970         sh->flags = le32_to_cpu(sh->flags);
2971         sh->trap_addr = le32_to_cpu(sh->trap_addr);
2972         sh->assert_exp_addr = le32_to_cpu(sh->assert_exp_addr);
2973         sh->assert_file_addr = le32_to_cpu(sh->assert_file_addr);
2974         sh->assert_line = le32_to_cpu(sh->assert_line);
2975         sh->console_addr = le32_to_cpu(sh->console_addr);
2976         sh->msgtrace_addr = le32_to_cpu(sh->msgtrace_addr);
2977
2978         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
2979                 brcmf_dbg(ERROR, "sdpcm_shared version %d in brcmf is different than sdpcm_shared version %d in dongle\n",
2980                           SDPCM_SHARED_VERSION,
2981                           sh->flags & SDPCM_SHARED_VERSION_MASK);
2982                 return -EBADE;
2983         }
2984
2985         return 0;
2986 }
2987
2988 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus)
2989 {
2990         int ret = 0;
2991         int size;               /* Full mem size */
2992         int start = 0;          /* Start address */
2993         int read_size = 0;      /* Read size of each iteration */
2994         u8 *buf = NULL, *databuf = NULL;
2995
2996         /* Get full mem size */
2997         size = bus->ramsize;
2998         buf = kmalloc(size, GFP_ATOMIC);
2999         if (!buf) {
3000                 brcmf_dbg(ERROR, "Out of memory (%d bytes)\n", size);
3001                 return -1;
3002         }
3003
3004         /* Read mem content */
3005         printk(KERN_DEBUG "Dump dongle memory");
3006         databuf = buf;
3007         while (size) {
3008                 read_size = min(MEMBLOCK, size);
3009                 ret = brcmf_sdbrcm_membytes(bus, false, start, databuf,
3010                                           read_size);
3011                 if (ret) {
3012                         brcmf_dbg(ERROR, "Error membytes %d\n", ret);
3013                         kfree(buf);
3014                         return -1;
3015                 }
3016                 printk(".");
3017
3018                 /* Decrement size and increment start address */
3019                 size -= read_size;
3020                 start += read_size;
3021                 databuf += read_size;
3022         }
3023         printk(KERN_DEBUG "Done\n");
3024
3025         /* free buf before return !!! */
3026         if (brcmf_write_to_file(bus->drvr, buf, bus->ramsize)) {
3027                 brcmf_dbg(ERROR, "Error writing to files\n");
3028                 return -1;
3029         }
3030
3031         /* buf free handled in brcmf_write_to_file, not here */
3032         return 0;
3033 }
3034
3035 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size)
3036 {
3037         int bcmerror = 0;
3038         uint msize = 512;
3039         char *mbuffer = NULL;
3040         uint maxstrlen = 256;
3041         char *str = NULL;
3042         struct brcmf_trap tr;
3043         struct sdpcm_shared sdpcm_shared;
3044         struct brcmu_strbuf strbuf;
3045
3046         brcmf_dbg(TRACE, "Enter\n");
3047
3048         if (data == NULL) {
3049                 /*
3050                  * Called after a rx ctrl timeout. "data" is NULL.
3051                  * allocate memory to trace the trap or assert.
3052                  */
3053                 size = msize;
3054                 mbuffer = data = kmalloc(msize, GFP_ATOMIC);
3055                 if (mbuffer == NULL) {
3056                         brcmf_dbg(ERROR, "kmalloc(%d) failed\n", msize);
3057                         bcmerror = -ENOMEM;
3058                         goto done;
3059                 }
3060         }
3061
3062         str = kmalloc(maxstrlen, GFP_ATOMIC);
3063         if (str == NULL) {
3064                 brcmf_dbg(ERROR, "kmalloc(%d) failed\n", maxstrlen);
3065                 bcmerror = -ENOMEM;
3066                 goto done;
3067         }
3068
3069         bcmerror = brcmf_sdbrcm_readshared(bus, &sdpcm_shared);
3070         if (bcmerror < 0)
3071                 goto done;
3072
3073         brcmu_binit(&strbuf, data, size);
3074
3075         brcmu_bprintf(&strbuf,
3076                     "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
3077                     sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
3078
3079         if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
3080                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
3081                  * (Avoids conflict with real asserts for programmatic
3082                  * parsing of output.)
3083                  */
3084                 brcmu_bprintf(&strbuf, "Assrt not built in dongle\n");
3085
3086         if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) ==
3087             0) {
3088                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
3089                  * (Avoids conflict with real asserts for programmatic
3090                  * parsing of output.)
3091                  */
3092                 brcmu_bprintf(&strbuf, "No trap%s in dongle",
3093                             (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
3094                             ? "/assrt" : "");
3095         } else {
3096                 if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
3097                         /* Download assert */
3098                         brcmu_bprintf(&strbuf, "Dongle assert");
3099                         if (sdpcm_shared.assert_exp_addr != 0) {
3100                                 str[0] = '\0';
3101                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
3102                                                 sdpcm_shared.assert_exp_addr,
3103                                                 (u8 *) str, maxstrlen);
3104                                 if (bcmerror < 0)
3105                                         goto done;
3106
3107                                 str[maxstrlen - 1] = '\0';
3108                                 brcmu_bprintf(&strbuf, " expr \"%s\"", str);
3109                         }
3110
3111                         if (sdpcm_shared.assert_file_addr != 0) {
3112                                 str[0] = '\0';
3113                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
3114                                                 sdpcm_shared.assert_file_addr,
3115                                                 (u8 *) str, maxstrlen);
3116                                 if (bcmerror < 0)
3117                                         goto done;
3118
3119                                 str[maxstrlen - 1] = '\0';
3120                                 brcmu_bprintf(&strbuf, " file \"%s\"", str);
3121                         }
3122
3123                         brcmu_bprintf(&strbuf, " line %d ",
3124                                     sdpcm_shared.assert_line);
3125                 }
3126
3127                 if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
3128                         bcmerror = brcmf_sdbrcm_membytes(bus, false,
3129                                         sdpcm_shared.trap_addr, (u8 *)&tr,
3130                                         sizeof(struct brcmf_trap));
3131                         if (bcmerror < 0)
3132                                 goto done;
3133
3134                         brcmu_bprintf(&strbuf,
3135                                     "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
3136                                     "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
3137                                     "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n",
3138                                     tr.type, tr.epc, tr.cpsr, tr.spsr, tr.r13,
3139                                     tr.r14, tr.pc, sdpcm_shared.trap_addr,
3140                                     tr.r0, tr.r1, tr.r2, tr.r3, tr.r4, tr.r5,
3141                                     tr.r6, tr.r7);
3142                 }
3143         }
3144
3145         if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP))
3146                 brcmf_dbg(ERROR, "%s\n", strbuf.origbuf);
3147
3148 #ifdef BCMDBG
3149         if (sdpcm_shared.flags & SDPCM_SHARED_TRAP)
3150                 /* Mem dump to a file on device */
3151                 brcmf_sdbrcm_mem_dump(bus);
3152
3153 #endif                          /* BCMDBG */
3154
3155 done:
3156         kfree(mbuffer);
3157         kfree(str);
3158
3159         return bcmerror;
3160 }
3161
3162 #define CONSOLE_LINE_MAX        192
3163
3164 static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
3165 {
3166         struct brcmf_console *c = &bus->console;
3167         u8 line[CONSOLE_LINE_MAX], ch;
3168         u32 n, idx, addr;
3169         int rv;
3170
3171         /* Don't do anything until FWREADY updates console address */
3172         if (bus->console_addr == 0)
3173                 return 0;
3174
3175         /* Read console log struct */
3176         addr = bus->console_addr + offsetof(struct rte_console, log);
3177         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log,
3178                                 sizeof(c->log));
3179         if (rv < 0)
3180                 return rv;
3181
3182         /* Allocate console buffer (one time only) */
3183         if (c->buf == NULL) {
3184                 c->bufsize = le32_to_cpu(c->log.buf_size);
3185                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
3186                 if (c->buf == NULL)
3187                         return -ENOMEM;
3188         }
3189
3190         idx = le32_to_cpu(c->log.idx);
3191
3192         /* Protect against corrupt value */
3193         if (idx > c->bufsize)
3194                 return -EBADE;
3195
3196         /* Skip reading the console buffer if the index pointer
3197          has not moved */
3198         if (idx == c->last)
3199                 return 0;
3200
3201         /* Read the console buffer */
3202         addr = le32_to_cpu(c->log.buf);
3203         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
3204         if (rv < 0)
3205                 return rv;
3206
3207         while (c->last != idx) {
3208                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
3209                         if (c->last == idx) {
3210                                 /* This would output a partial line.
3211                                  * Instead, back up
3212                                  * the buffer pointer and output this
3213                                  * line next time around.
3214                                  */
3215                                 if (c->last >= n)
3216                                         c->last -= n;
3217                                 else
3218                                         c->last = c->bufsize - n;
3219                                 goto break2;
3220                         }
3221                         ch = c->buf[c->last];
3222                         c->last = (c->last + 1) % c->bufsize;
3223                         if (ch == '\n')
3224                                 break;
3225                         line[n] = ch;
3226                 }
3227
3228                 if (n > 0) {
3229                         if (line[n - 1] == '\r')
3230                                 n--;
3231                         line[n] = 0;
3232                         printk(KERN_DEBUG "CONSOLE: %s\n", line);
3233                 }
3234         }
3235 break2:
3236
3237         return 0;
3238 }
3239 #endif                          /* BCMDBG */
3240
3241 int
3242 brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
3243 {
3244         u8 *frame;
3245         u16 len;
3246         u32 swheader;
3247         uint retries = 0;
3248         u8 doff = 0;
3249         int ret = -1;
3250         int i;
3251
3252         brcmf_dbg(TRACE, "Enter\n");
3253
3254         if (bus->drvr->dongle_reset)
3255                 return -EIO;
3256
3257         /* Back the pointer to make a room for bus header */
3258         frame = msg - SDPCM_HDRLEN;
3259         len = (msglen += SDPCM_HDRLEN);
3260
3261         /* Add alignment padding (optional for ctl frames) */
3262         if (brcmf_alignctl) {
3263                 doff = ((unsigned long)frame % BRCMF_SDALIGN);
3264                 if (doff) {
3265                         frame -= doff;
3266                         len += doff;
3267                         msglen += doff;
3268                         memset(frame, 0, doff + SDPCM_HDRLEN);
3269                 }
3270                 /* precondition: doff < BRCMF_SDALIGN */
3271         }
3272         doff += SDPCM_HDRLEN;
3273
3274         /* Round send length to next SDIO block */
3275         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
3276                 u16 pad = bus->blocksize - (len % bus->blocksize);
3277                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
3278                         len += pad;
3279         } else if (len % BRCMF_SDALIGN) {
3280                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
3281         }
3282
3283         /* Satisfy length-alignment requirements */
3284         if (forcealign && (len & (ALIGNMENT - 1)))
3285                 len = roundup(len, ALIGNMENT);
3286
3287         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
3288
3289         /* Need to lock here to protect txseq and SDIO tx calls */
3290         brcmf_sdbrcm_sdlock(bus);
3291
3292         bus_wake(bus);
3293
3294         /* Make sure backplane clock is on */
3295         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3296
3297         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
3298         *(u16 *) frame = cpu_to_le16((u16) msglen);
3299         *(((u16 *) frame) + 1) = cpu_to_le16(~msglen);
3300
3301         /* Software tag: channel, sequence number, data offset */
3302         swheader =
3303             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
3304              SDPCM_CHANNEL_MASK)
3305             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
3306                              SDPCM_DOFFSET_MASK);
3307         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
3308         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
3309
3310         if (!data_ok(bus)) {
3311                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
3312                           bus->tx_max, bus->tx_seq);
3313                 bus->ctrl_frame_stat = true;
3314                 /* Send from dpc */
3315                 bus->ctrl_frame_buf = frame;
3316                 bus->ctrl_frame_len = len;
3317
3318                 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
3319
3320                 if (bus->ctrl_frame_stat == false) {
3321                         brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
3322                         ret = 0;
3323                 } else {
3324                         brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
3325                         ret = -1;
3326                 }
3327         }
3328
3329         if (ret == -1) {
3330 #ifdef BCMDBG
3331                 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
3332                         printk(KERN_DEBUG "Tx Frame:\n");
3333                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3334                                              frame, len);
3335                 } else if (BRCMF_HDRS_ON()) {
3336                         printk(KERN_DEBUG "TxHdr:\n");
3337                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3338                                              frame, min_t(u16, len, 16));
3339                 }
3340 #endif
3341
3342                 do {
3343                         bus->ctrl_frame_stat = false;
3344                         ret = brcmf_sdbrcm_send_buf(bus, bus->sdiodev->sbwad,
3345                                         SDIO_FUNC_2, F2SYNC, frame, len, NULL);
3346
3347                         if (ret < 0) {
3348                                 /* On failure, abort the command and
3349                                  terminate the frame */
3350                                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
3351                                           ret);
3352                                 bus->tx_sderrs++;
3353
3354                                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
3355
3356                                 brcmf_sdcard_cfg_write(bus->sdiodev,
3357                                                  SDIO_FUNC_1,
3358                                                  SBSDIO_FUNC1_FRAMECTRL,
3359                                                  SFC_WF_TERM, NULL);
3360                                 bus->f1regdata++;
3361
3362                                 for (i = 0; i < 3; i++) {
3363                                         u8 hi, lo;
3364                                         hi = brcmf_sdcard_cfg_read(bus->sdiodev,
3365                                              SDIO_FUNC_1,
3366                                              SBSDIO_FUNC1_WFRAMEBCHI,
3367                                              NULL);
3368                                         lo = brcmf_sdcard_cfg_read(bus->sdiodev,
3369                                              SDIO_FUNC_1,
3370                                              SBSDIO_FUNC1_WFRAMEBCLO,
3371                                              NULL);
3372                                         bus->f1regdata += 2;
3373                                         if ((hi == 0) && (lo == 0))
3374                                                 break;
3375                                 }
3376
3377                         }
3378                         if (ret == 0)
3379                                 bus->tx_seq =
3380                                     (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
3381
3382                 } while ((ret < 0) && retries++ < TXRETRIES);
3383         }
3384
3385         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
3386                 bus->activity = false;
3387                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
3388         }
3389
3390         brcmf_sdbrcm_sdunlock(bus);
3391
3392         if (ret)
3393                 bus->drvr->tx_ctlerrs++;
3394         else
3395                 bus->drvr->tx_ctlpkts++;
3396
3397         return ret ? -EIO : 0;
3398 }
3399
3400 int
3401 brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
3402 {
3403         int timeleft;
3404         uint rxlen = 0;
3405         bool pending;
3406
3407         brcmf_dbg(TRACE, "Enter\n");
3408
3409         if (bus->drvr->dongle_reset)
3410                 return -EIO;
3411
3412         /* Wait until control frame is available */
3413         timeleft = brcmf_sdbrcm_ioctl_resp_wait(bus, &bus->rxlen, &pending);
3414
3415         brcmf_sdbrcm_sdlock(bus);
3416         rxlen = bus->rxlen;
3417         memcpy(msg, bus->rxctl, min(msglen, rxlen));
3418         bus->rxlen = 0;
3419         brcmf_sdbrcm_sdunlock(bus);
3420
3421         if (rxlen) {
3422                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
3423                           rxlen, msglen);
3424         } else if (timeleft == 0) {
3425                 brcmf_dbg(ERROR, "resumed on timeout\n");
3426 #ifdef BCMDBG
3427                 brcmf_sdbrcm_sdlock(bus);
3428                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
3429                 brcmf_sdbrcm_sdunlock(bus);
3430 #endif                          /* BCMDBG */
3431         } else if (pending == true) {
3432                 brcmf_dbg(CTL, "cancelled\n");
3433                 return -ERESTARTSYS;
3434         } else {
3435                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
3436 #ifdef BCMDBG
3437                 brcmf_sdbrcm_sdlock(bus);
3438                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
3439                 brcmf_sdbrcm_sdunlock(bus);
3440 #endif                          /* BCMDBG */
3441         }
3442
3443         if (rxlen)
3444                 bus->drvr->rx_ctlpkts++;
3445         else
3446                 bus->drvr->rx_ctlerrs++;
3447
3448         return rxlen ? (int)rxlen : -ETIMEDOUT;
3449 }
3450
3451 static int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
3452 {
3453         int bcmerror = 0;
3454
3455         brcmf_dbg(TRACE, "Enter\n");
3456
3457         /* Basic sanity checks */
3458         if (bus->drvr->up) {
3459                 bcmerror = -EISCONN;
3460                 goto err;
3461         }
3462         if (!len) {
3463                 bcmerror = -EOVERFLOW;
3464                 goto err;
3465         }
3466
3467         /* Free the old ones and replace with passed variables */
3468         kfree(bus->vars);
3469
3470         bus->vars = kmalloc(len, GFP_ATOMIC);
3471         bus->varsz = bus->vars ? len : 0;
3472         if (bus->vars == NULL) {
3473                 bcmerror = -ENOMEM;
3474                 goto err;
3475         }
3476
3477         /* Copy the passed variables, which should include the
3478                  terminating double-null */
3479         memcpy(bus->vars, arg, bus->varsz);
3480 err:
3481         return bcmerror;
3482 }
3483
3484 static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
3485 {
3486         int bcmerror = 0;
3487         u32 varsize;
3488         u32 varaddr;
3489         u8 *vbuffer;
3490         u32 varsizew;
3491 #ifdef BCMDBG
3492         char *nvram_ularray;
3493 #endif                          /* BCMDBG */
3494
3495         /* Even if there are no vars are to be written, we still
3496                  need to set the ramsize. */
3497         varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
3498         varaddr = (bus->ramsize - 4) - varsize;
3499
3500         if (bus->vars) {
3501                 vbuffer = kzalloc(varsize, GFP_ATOMIC);
3502                 if (!vbuffer)
3503                         return -ENOMEM;
3504
3505                 memcpy(vbuffer, bus->vars, bus->varsz);
3506
3507                 /* Write the vars list */
3508                 bcmerror =
3509                     brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
3510 #ifdef BCMDBG
3511                 /* Verify NVRAM bytes */
3512                 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
3513                 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
3514                 if (!nvram_ularray)
3515                         return -ENOMEM;
3516
3517                 /* Upload image to verify downloaded contents. */
3518                 memset(nvram_ularray, 0xaa, varsize);
3519
3520                 /* Read the vars list to temp buffer for comparison */
3521                 bcmerror =
3522                     brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
3523                                      varsize);
3524                 if (bcmerror) {
3525                         brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
3526                                   bcmerror, varsize, varaddr);
3527                 }
3528                 /* Compare the org NVRAM with the one read from RAM */
3529                 if (memcmp(vbuffer, nvram_ularray, varsize))
3530                         brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
3531                 else
3532                         brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
3533
3534                 kfree(nvram_ularray);
3535 #endif                          /* BCMDBG */
3536
3537                 kfree(vbuffer);
3538         }
3539
3540         /* adjust to the user specified RAM */
3541         brcmf_dbg(INFO, "Physical memory size: %d, usable memory size: %d\n",
3542                   bus->orig_ramsize, bus->ramsize);
3543         brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3544                   varaddr, varsize);
3545         varsize = ((bus->orig_ramsize - 4) - varaddr);
3546
3547         /*
3548          * Determine the length token:
3549          * Varsize, converted to words, in lower 16-bits, checksum
3550          * in upper 16-bits.
3551          */
3552         if (bcmerror) {
3553                 varsizew = 0;
3554         } else {
3555                 varsizew = varsize / 4;
3556                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3557                 varsizew = cpu_to_le32(varsizew);
3558         }
3559
3560         brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3561                   varsize, varsizew);
3562
3563         /* Write the length token to the last word */
3564         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->orig_ramsize - 4),
3565                                     (u8 *)&varsizew, 4);
3566
3567         return bcmerror;
3568 }
3569
3570 static void
3571 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_dev *sdiodev, u32 corebase)
3572 {
3573         u32 regdata;
3574
3575         regdata = brcmf_sdcard_reg_read(sdiodev,
3576                 CORE_SB(corebase, sbtmstatelow), 4);
3577         if (regdata & SBTML_RESET)
3578                 return;
3579
3580         regdata = brcmf_sdcard_reg_read(sdiodev,
3581                 CORE_SB(corebase, sbtmstatelow), 4);
3582         if ((regdata & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) != 0) {
3583                 /*
3584                  * set target reject and spin until busy is clear
3585                  * (preserve core-specific bits)
3586                  */
3587                 regdata = brcmf_sdcard_reg_read(sdiodev,
3588                         CORE_SB(corebase, sbtmstatelow), 4);
3589                 brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow),
3590                                        4, regdata | SBTML_REJ);
3591
3592                 regdata = brcmf_sdcard_reg_read(sdiodev,
3593                         CORE_SB(corebase, sbtmstatelow), 4);
3594                 udelay(1);
3595                 SPINWAIT((brcmf_sdcard_reg_read(sdiodev,
3596                         CORE_SB(corebase, sbtmstatehigh), 4) &
3597                         SBTMH_BUSY), 100000);
3598
3599                 regdata = brcmf_sdcard_reg_read(sdiodev,
3600                         CORE_SB(corebase, sbtmstatehigh), 4);
3601                 if (regdata & SBTMH_BUSY)
3602                         brcmf_dbg(ERROR, "ARM core still busy\n");
3603
3604                 regdata = brcmf_sdcard_reg_read(sdiodev,
3605                         CORE_SB(corebase, sbidlow), 4);
3606                 if (regdata & SBIDL_INIT) {
3607                         regdata = brcmf_sdcard_reg_read(sdiodev,
3608                                 CORE_SB(corebase, sbimstate), 4) |
3609                                 SBIM_RJ;
3610                         brcmf_sdcard_reg_write(sdiodev,
3611                                 CORE_SB(corebase, sbimstate), 4,
3612                                 regdata);
3613                         regdata = brcmf_sdcard_reg_read(sdiodev,
3614                                 CORE_SB(corebase, sbimstate), 4);
3615                         udelay(1);
3616                         SPINWAIT((brcmf_sdcard_reg_read(sdiodev,
3617                                 CORE_SB(corebase, sbimstate), 4) &
3618                                 SBIM_BY), 100000);
3619                 }
3620
3621                 /* set reset and reject while enabling the clocks */
3622                 brcmf_sdcard_reg_write(sdiodev,
3623                         CORE_SB(corebase, sbtmstatelow), 4,
3624                         (((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
3625                         SBTML_REJ | SBTML_RESET));
3626                 regdata = brcmf_sdcard_reg_read(sdiodev,
3627                         CORE_SB(corebase, sbtmstatelow), 4);
3628                 udelay(10);
3629
3630                 /* clear the initiator reject bit */
3631                 regdata = brcmf_sdcard_reg_read(sdiodev,
3632                         CORE_SB(corebase, sbidlow), 4);
3633                 if (regdata & SBIDL_INIT) {
3634                         regdata = brcmf_sdcard_reg_read(sdiodev,
3635                                 CORE_SB(corebase, sbimstate), 4) &
3636                                 ~SBIM_RJ;
3637                         brcmf_sdcard_reg_write(sdiodev,
3638                                 CORE_SB(corebase, sbimstate), 4,
3639                                 regdata);
3640                 }
3641         }
3642
3643         /* leave reset and reject asserted */
3644         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
3645                 (SBTML_REJ | SBTML_RESET));
3646         udelay(1);
3647 }
3648
3649 static void
3650 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_dev *sdiodev, u32 corebase)
3651 {
3652         u32 regdata;
3653
3654         /*
3655          * Must do the disable sequence first to work for
3656          * arbitrary current core state.
3657          */
3658         brcmf_sdbrcm_chip_disablecore(sdiodev, corebase);
3659
3660         /*
3661          * Now do the initialization sequence.
3662          * set reset while enabling the clock and
3663          * forcing them on throughout the core
3664          */
3665         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
3666                 ((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
3667                 SBTML_RESET);
3668         udelay(1);
3669
3670         regdata = brcmf_sdcard_reg_read(sdiodev,
3671                                         CORE_SB(corebase, sbtmstatehigh), 4);
3672         if (regdata & SBTMH_SERR)
3673                 brcmf_sdcard_reg_write(sdiodev,
3674                                        CORE_SB(corebase, sbtmstatehigh), 4, 0);
3675
3676         regdata = brcmf_sdcard_reg_read(sdiodev,
3677                                         CORE_SB(corebase, sbimstate), 4);
3678         if (regdata & (SBIM_IBE | SBIM_TO))
3679                 brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbimstate), 4,
3680                         regdata & ~(SBIM_IBE | SBIM_TO));
3681
3682         /* clear reset and allow it to propagate throughout the core */
3683         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
3684                 (SICF_FGC << SBTML_SICF_SHIFT) |
3685                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
3686         udelay(1);
3687
3688         /* leave clock enabled */
3689         brcmf_sdcard_reg_write(sdiodev, CORE_SB(corebase, sbtmstatelow), 4,
3690                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
3691         udelay(1);
3692 }
3693
3694 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
3695 {
3696         uint retries;
3697         u32 regdata;
3698         int bcmerror = 0;
3699
3700         /* To enter download state, disable ARM and reset SOCRAM.
3701          * To exit download state, simply reset ARM (default is RAM boot).
3702          */
3703         if (enter) {
3704                 bus->alp_only = true;
3705
3706                 brcmf_sdbrcm_chip_disablecore(bus->sdiodev,
3707                                               bus->ci->armcorebase);
3708
3709                 brcmf_sdbrcm_chip_resetcore(bus->sdiodev, bus->ci->ramcorebase);
3710
3711                 /* Clear the top bit of memory */
3712                 if (bus->ramsize) {
3713                         u32 zeros = 0;
3714                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3715                                          (u8 *)&zeros, 4);
3716                 }
3717         } else {
3718                 regdata = brcmf_sdcard_reg_read(bus->sdiodev,
3719                         CORE_SB(bus->ci->ramcorebase, sbtmstatelow), 4);
3720                 regdata &= (SBTML_RESET | SBTML_REJ_MASK |
3721                         (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
3722                 if ((SICF_CLOCK_EN << SBTML_SICF_SHIFT) != regdata) {
3723                         brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
3724                         bcmerror = -EBADE;
3725                         goto fail;
3726                 }
3727
3728                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3729                 if (bcmerror) {
3730                         brcmf_dbg(ERROR, "no vars written to RAM\n");
3731                         bcmerror = 0;
3732                 }
3733
3734                 w_sdreg32(bus, 0xFFFFFFFF,
3735                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3736
3737                 brcmf_sdbrcm_chip_resetcore(bus->sdiodev, bus->ci->armcorebase);
3738
3739                 /* Allow HT Clock now that the ARM is running. */
3740                 bus->alp_only = false;
3741
3742                 bus->drvr->busstate = BRCMF_BUS_LOAD;
3743         }
3744 fail:
3745         return bcmerror;
3746 }
3747
3748 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
3749 {
3750         if (bus->firmware->size < bus->fw_ptr + len)
3751                 len = bus->firmware->size - bus->fw_ptr;
3752
3753         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3754         bus->fw_ptr += len;
3755         return len;
3756 }
3757
3758 MODULE_FIRMWARE(BCM4329_FW_NAME);
3759 MODULE_FIRMWARE(BCM4329_NV_NAME);
3760
3761 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
3762 {
3763         int offset = 0;
3764         uint len;
3765         u8 *memblock = NULL, *memptr;
3766         int ret;
3767
3768         brcmf_dbg(INFO, "Enter\n");
3769
3770         bus->fw_name = BCM4329_FW_NAME;
3771         ret = request_firmware(&bus->firmware, bus->fw_name,
3772                                &bus->sdiodev->func[2]->dev);
3773         if (ret) {
3774                 brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
3775                 return ret;
3776         }
3777         bus->fw_ptr = 0;
3778
3779         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3780         if (memblock == NULL) {
3781                 brcmf_dbg(ERROR, "Failed to allocate memory %d bytes\n",
3782                           MEMBLOCK);
3783                 ret = -ENOMEM;
3784                 goto err;
3785         }
3786         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3787                 memptr += (BRCMF_SDALIGN -
3788                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3789
3790         /* Download image */
3791         while ((len =
3792                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3793                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3794                 if (ret) {
3795                         brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
3796                                   ret, MEMBLOCK, offset);
3797                         goto err;
3798                 }
3799
3800                 offset += MEMBLOCK;
3801         }
3802
3803 err:
3804         kfree(memblock);
3805
3806         release_firmware(bus->firmware);
3807         bus->fw_ptr = 0;
3808
3809         return ret;
3810 }
3811
3812 /*
3813  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3814  * and ending in a NUL.
3815  * Removes carriage returns, empty lines, comment lines, and converts
3816  * newlines to NULs.
3817  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
3818  * by two NULs.
3819 */
3820
3821 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
3822 {
3823         char *dp;
3824         bool findNewline;
3825         int column;
3826         uint buf_len, n;
3827
3828         dp = varbuf;
3829
3830         findNewline = false;
3831         column = 0;
3832
3833         for (n = 0; n < len; n++) {
3834                 if (varbuf[n] == 0)
3835                         break;
3836                 if (varbuf[n] == '\r')
3837                         continue;
3838                 if (findNewline && varbuf[n] != '\n')
3839                         continue;
3840                 findNewline = false;
3841                 if (varbuf[n] == '#') {
3842                         findNewline = true;
3843                         continue;
3844                 }
3845                 if (varbuf[n] == '\n') {
3846                         if (column == 0)
3847                                 continue;
3848                         *dp++ = 0;
3849                         column = 0;
3850                         continue;
3851                 }
3852                 *dp++ = varbuf[n];
3853                 column++;
3854         }
3855         buf_len = dp - varbuf;
3856
3857         while (dp < varbuf + n)
3858                 *dp++ = 0;
3859
3860         return buf_len;
3861 }
3862
3863 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
3864 {
3865         uint len;
3866         char *memblock = NULL;
3867         char *bufp;
3868         int ret;
3869
3870         bus->nv_name = BCM4329_NV_NAME;
3871         ret = request_firmware(&bus->firmware, bus->nv_name,
3872                                &bus->sdiodev->func[2]->dev);
3873         if (ret) {
3874                 brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
3875                 return ret;
3876         }
3877         bus->fw_ptr = 0;
3878
3879         memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
3880         if (memblock == NULL) {
3881                 brcmf_dbg(ERROR, "Failed to allocate memory %d bytes\n",
3882                           MEMBLOCK);
3883                 ret = -ENOMEM;
3884                 goto err;
3885         }
3886
3887         len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
3888
3889         if (len > 0 && len < MEMBLOCK) {
3890                 bufp = (char *)memblock;
3891                 bufp[len] = 0;
3892                 len = brcmf_process_nvram_vars(bufp, len);
3893                 bufp += len;
3894                 *bufp++ = 0;
3895                 if (len)
3896                         ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
3897                 if (ret)
3898                         brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
3899         } else {
3900                 brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
3901                 ret = -EIO;
3902         }
3903
3904 err:
3905         kfree(memblock);
3906
3907         release_firmware(bus->firmware);
3908         bus->fw_ptr = 0;
3909
3910         return ret;
3911 }
3912
3913 static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
3914 {
3915         int bcmerror = -1;
3916
3917         /* Keep arm in reset */
3918         if (brcmf_sdbrcm_download_state(bus, true)) {
3919                 brcmf_dbg(ERROR, "error placing ARM core in reset\n");
3920                 goto err;
3921         }
3922
3923         /* External image takes precedence if specified */
3924         if (brcmf_sdbrcm_download_code_file(bus)) {
3925                 brcmf_dbg(ERROR, "dongle image file download failed\n");
3926                 goto err;
3927         }
3928
3929         /* External nvram takes precedence if specified */
3930         if (brcmf_sdbrcm_download_nvram(bus))
3931                 brcmf_dbg(ERROR, "dongle nvram file download failed\n");
3932
3933         /* Take arm out of reset */
3934         if (brcmf_sdbrcm_download_state(bus, false)) {
3935                 brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
3936                 goto err;
3937         }
3938
3939         bcmerror = 0;
3940
3941 err:
3942         return bcmerror;
3943 }
3944
3945 static bool
3946 brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
3947 {
3948         bool ret;
3949
3950         /* Download the firmware */
3951         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3952
3953         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3954
3955         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3956
3957         return ret;
3958 }
3959
3960 void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus, bool enforce_mutex)
3961 {
3962         u32 local_hostintmask;
3963         u8 saveclk;
3964         uint retries;
3965         int err;
3966
3967         brcmf_dbg(TRACE, "Enter\n");
3968
3969         if (enforce_mutex)
3970                 brcmf_sdbrcm_sdlock(bus);
3971
3972         bus_wake(bus);
3973
3974         /* Enable clock for device interrupts */
3975         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3976
3977         if (bus->watchdog_tsk) {
3978                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
3979                 kthread_stop(bus->watchdog_tsk);
3980                 bus->watchdog_tsk = NULL;
3981         }
3982
3983         if (bus->dpc_tsk) {
3984                 send_sig(SIGTERM, bus->dpc_tsk, 1);
3985                 kthread_stop(bus->dpc_tsk);
3986                 bus->dpc_tsk = NULL;
3987         } else
3988                 tasklet_kill(&bus->tasklet);
3989
3990         /* Disable and clear interrupts at the chip level also */
3991         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
3992         local_hostintmask = bus->hostintmask;
3993         bus->hostintmask = 0;
3994
3995         /* Change our idea of bus state */
3996         bus->drvr->busstate = BRCMF_BUS_DOWN;
3997
3998         /* Force clocks on backplane to be sure F2 interrupt propagates */
3999         saveclk = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4000                                         SBSDIO_FUNC1_CHIPCLKCSR, &err);
4001         if (!err) {
4002                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4003                                        SBSDIO_FUNC1_CHIPCLKCSR,
4004                                        (saveclk | SBSDIO_FORCE_HT), &err);
4005         }
4006         if (err)
4007                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
4008
4009         /* Turn off the bus (F2), free any pending packets */
4010         brcmf_dbg(INTR, "disable SDIO interrupts\n");
4011         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
4012                          SDIO_FUNC_ENABLE_1, NULL);
4013
4014         /* Clear any pending interrupts now that F2 is disabled */
4015         w_sdreg32(bus, local_hostintmask,
4016                   offsetof(struct sdpcmd_regs, intstatus), &retries);
4017
4018         /* Turn off the backplane clock (only) */
4019         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
4020
4021         /* Clear the data packet queues */
4022         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
4023
4024         /* Clear any held glomming stuff */
4025         if (bus->glomd)
4026                 brcmu_pkt_buf_free_skb(bus->glomd);
4027
4028         if (bus->glom)
4029                 brcmu_pkt_buf_free_skb(bus->glom);
4030
4031         bus->glom = bus->glomd = NULL;
4032
4033         /* Clear rx control and wake any waiters */
4034         bus->rxlen = 0;
4035         brcmf_sdbrcm_ioctl_resp_wake(bus);
4036
4037         /* Reset some F2 state stuff */
4038         bus->rxskip = false;
4039         bus->tx_seq = bus->rx_seq = 0;
4040
4041         if (enforce_mutex)
4042                 brcmf_sdbrcm_sdunlock(bus);
4043 }
4044
4045 int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr, bool enforce_mutex)
4046 {
4047         struct brcmf_bus *bus = drvr->bus;
4048         unsigned long timeout;
4049         uint retries = 0;
4050         u8 ready, enable;
4051         int err, ret = 0;
4052         u8 saveclk;
4053
4054         brcmf_dbg(TRACE, "Enter\n");
4055
4056         /* try to download image and nvram to the dongle */
4057         if (drvr->busstate == BRCMF_BUS_DOWN) {
4058                 if (!(brcmf_sdbrcm_download_firmware(bus)))
4059                         return -1;
4060         }
4061
4062         if (!bus->drvr)
4063                 return 0;
4064
4065         /* Start the watchdog timer */
4066         bus->drvr->tickcnt = 0;
4067         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
4068
4069         if (enforce_mutex)
4070                 brcmf_sdbrcm_sdlock(bus);
4071
4072         /* Make sure backplane clock is on, needed to generate F2 interrupt */
4073         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
4074         if (bus->clkstate != CLK_AVAIL)
4075                 goto exit;
4076
4077         /* Force clocks on backplane to be sure F2 interrupt propagates */
4078         saveclk =
4079             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4080                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
4081         if (!err) {
4082                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4083                                        SBSDIO_FUNC1_CHIPCLKCSR,
4084                                        (saveclk | SBSDIO_FORCE_HT), &err);
4085         }
4086         if (err) {
4087                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
4088                 goto exit;
4089         }
4090
4091         /* Enable function 2 (frame transfers) */
4092         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
4093                   offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
4094         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
4095
4096         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
4097                                enable, NULL);
4098
4099         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
4100         ready = 0;
4101         while (enable != ready) {
4102                 ready = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_0,
4103                                               SDIO_CCCR_IORx, NULL);
4104                 if (time_after(jiffies, timeout))
4105                         break;
4106                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
4107                         /* prevent busy waiting if it takes too long */
4108                         msleep_interruptible(20);
4109         }
4110
4111         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
4112
4113         /* If F2 successfully enabled, set core and enable interrupts */
4114         if (ready == enable) {
4115                 /* Set up the interrupt mask and enable interrupts */
4116                 bus->hostintmask = HOSTINTMASK;
4117                 w_sdreg32(bus, bus->hostintmask,
4118                           offsetof(struct sdpcmd_regs, hostintmask), &retries);
4119
4120                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4121                                        SBSDIO_WATERMARK, 8, &err);
4122
4123                 /* Set bus state according to enable result */
4124                 drvr->busstate = BRCMF_BUS_DATA;
4125         }
4126
4127         else {
4128                 /* Disable F2 again */
4129                 enable = SDIO_FUNC_ENABLE_1;
4130                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0,
4131                                        SDIO_CCCR_IOEx, enable, NULL);
4132         }
4133
4134         /* Restore previous clock setting */
4135         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4136                                SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
4137
4138         /* If we didn't come up, turn off backplane clock */
4139         if (drvr->busstate != BRCMF_BUS_DATA)
4140                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
4141
4142 exit:
4143         if (enforce_mutex)
4144                 brcmf_sdbrcm_sdunlock(bus);
4145
4146         return ret;
4147 }
4148
4149 void brcmf_sdbrcm_isr(void *arg)
4150 {
4151         struct brcmf_bus *bus = (struct brcmf_bus *) arg;
4152
4153         brcmf_dbg(TRACE, "Enter\n");
4154
4155         if (!bus) {
4156                 brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
4157                 return;
4158         }
4159
4160         if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
4161                 brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
4162                 return;
4163         }
4164         /* Count the interrupt call */
4165         bus->intrcount++;
4166         bus->ipend = true;
4167
4168         /* Shouldn't get this interrupt if we're sleeping? */
4169         if (bus->sleeping) {
4170                 brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
4171                 return;
4172         }
4173
4174         /* Disable additional interrupts (is this needed now)? */
4175         if (!bus->intr)
4176                 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
4177
4178         bus->dpc_sched = true;
4179         brcmf_sdbrcm_sched_dpc(bus);
4180 }
4181
4182 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
4183 {
4184         struct brcmf_bus *bus;
4185
4186         brcmf_dbg(TIMER, "Enter\n");
4187
4188         bus = drvr->bus;
4189
4190         if (bus->drvr->dongle_reset)
4191                 return false;
4192
4193         /* Ignore the timer if simulating bus down */
4194         if (bus->sleeping)
4195                 return false;
4196
4197         brcmf_sdbrcm_sdlock(bus);
4198
4199         /* Poll period: check device if appropriate. */
4200         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
4201                 u32 intstatus = 0;
4202
4203                 /* Reset poll tick */
4204                 bus->polltick = 0;
4205
4206                 /* Check device if no interrupts */
4207                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
4208
4209                         if (!bus->dpc_sched) {
4210                                 u8 devpend;
4211                                 devpend = brcmf_sdcard_cfg_read(bus->sdiodev,
4212                                                 SDIO_FUNC_0, SDIO_CCCR_INTx,
4213                                                 NULL);
4214                                 intstatus =
4215                                     devpend & (INTR_STATUS_FUNC1 |
4216                                                INTR_STATUS_FUNC2);
4217                         }
4218
4219                         /* If there is something, make like the ISR and
4220                                  schedule the DPC */
4221                         if (intstatus) {
4222                                 bus->pollcnt++;
4223                                 bus->ipend = true;
4224
4225                                 bus->dpc_sched = true;
4226                                 brcmf_sdbrcm_sched_dpc(bus);
4227
4228                         }
4229                 }
4230
4231                 /* Update interrupt tracking */
4232                 bus->lastintrs = bus->intrcount;
4233         }
4234 #ifdef BCMDBG
4235         /* Poll for console output periodically */
4236         if (drvr->busstate == BRCMF_BUS_DATA && brcmf_console_ms != 0) {
4237                 bus->console.count += brcmf_watchdog_ms;
4238                 if (bus->console.count >= brcmf_console_ms) {
4239                         bus->console.count -= brcmf_console_ms;
4240                         /* Make sure backplane clock is on */
4241                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
4242                         if (brcmf_sdbrcm_readconsole(bus) < 0)
4243                                 brcmf_console_ms = 0;   /* On error,
4244                                                          stop trying */
4245                 }
4246         }
4247 #endif                          /* BCMDBG */
4248
4249         /* On idle timeout clear activity flag and/or turn off clock */
4250         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
4251                 if (++bus->idlecount >= bus->idletime) {
4252                         bus->idlecount = 0;
4253                         if (bus->activity) {
4254                                 bus->activity = false;
4255                                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
4256                         } else {
4257                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
4258                         }
4259                 }
4260         }
4261
4262         brcmf_sdbrcm_sdunlock(bus);
4263
4264         return bus->ipend;
4265 }
4266
4267 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
4268 {
4269         if (chipid == BCM4329_CHIP_ID)
4270                 return true;
4271         return false;
4272 }
4273
4274 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
4275 {
4276         brcmf_dbg(TRACE, "Enter\n");
4277
4278         if (bus->drvr && bus->drvr->dongle_reset)
4279                 return;
4280
4281         kfree(bus->rxbuf);
4282         bus->rxctl = bus->rxbuf = NULL;
4283         bus->rxlen = 0;
4284
4285         kfree(bus->databuf);
4286         bus->databuf = NULL;
4287 }
4288
4289 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus)
4290 {
4291         brcmf_dbg(TRACE, "Enter\n");
4292
4293         if (bus->drvr->maxctl) {
4294                 bus->rxblen =
4295                     roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
4296                             ALIGNMENT) + BRCMF_SDALIGN;
4297                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
4298                 if (!(bus->rxbuf)) {
4299                         brcmf_dbg(ERROR, "kmalloc of %d-byte rxbuf failed\n",
4300                                   bus->rxblen);
4301                         goto fail;
4302                 }
4303         }
4304
4305         /* Allocate buffer to receive glomed packet */
4306         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
4307         if (!(bus->databuf)) {
4308                 brcmf_dbg(ERROR, "kmalloc of %d-byte databuf failed\n",
4309                           MAX_DATA_BUF);
4310                 /* release rxbuf which was already located as above */
4311                 if (!bus->rxblen)
4312                         kfree(bus->rxbuf);
4313                 goto fail;
4314         }
4315
4316         /* Align the buffer */
4317         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
4318                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
4319                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
4320         else
4321                 bus->dataptr = bus->databuf;
4322
4323         return true;
4324
4325 fail:
4326         return false;
4327 }
4328
4329 /* SDIO Pad drive strength to select value mappings */
4330 struct sdiod_drive_str {
4331         u8 strength;    /* Pad Drive Strength in mA */
4332         u8 sel;         /* Chip-specific select value */
4333 };
4334
4335 /* SDIO Drive Strength to sel value table for PMU Rev 1 */
4336 static const struct sdiod_drive_str sdiod_drive_strength_tab1[] = {
4337         {
4338         4, 0x2}, {
4339         2, 0x3}, {
4340         1, 0x0}, {
4341         0, 0x0}
4342         };
4343
4344 /* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
4345 static const struct sdiod_drive_str sdiod_drive_strength_tab2[] = {
4346         {
4347         12, 0x7}, {
4348         10, 0x6}, {
4349         8, 0x5}, {
4350         6, 0x4}, {
4351         4, 0x2}, {
4352         2, 0x1}, {
4353         0, 0x0}
4354         };
4355
4356 /* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
4357 static const struct sdiod_drive_str sdiod_drive_strength_tab3[] = {
4358         {
4359         32, 0x7}, {
4360         26, 0x6}, {
4361         22, 0x5}, {
4362         16, 0x4}, {
4363         12, 0x3}, {
4364         8, 0x2}, {
4365         4, 0x1}, {
4366         0, 0x0}
4367         };
4368
4369 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
4370
4371 static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
4372                                                    u32 drivestrength) {
4373         struct sdiod_drive_str *str_tab = NULL;
4374         u32 str_mask = 0;
4375         u32 str_shift = 0;
4376         char chn[8];
4377
4378         if (!(bus->ci->cccaps & CC_CAP_PMU))
4379                 return;
4380
4381         switch (SDIOD_DRVSTR_KEY(bus->ci->chip, bus->ci->pmurev)) {
4382         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
4383                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab1;
4384                 str_mask = 0x30000000;
4385                 str_shift = 28;
4386                 break;
4387         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
4388         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
4389                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab2;
4390                 str_mask = 0x00003800;
4391                 str_shift = 11;
4392                 break;
4393         case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
4394                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab3;
4395                 str_mask = 0x00003800;
4396                 str_shift = 11;
4397                 break;
4398         default:
4399                 brcmf_dbg(ERROR, "No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
4400                           brcmu_chipname(bus->ci->chip, chn, 8),
4401                           bus->ci->chiprev, bus->ci->pmurev);
4402                 break;
4403         }
4404
4405         if (str_tab != NULL) {
4406                 u32 drivestrength_sel = 0;
4407                 u32 cc_data_temp;
4408                 int i;
4409
4410                 for (i = 0; str_tab[i].strength != 0; i++) {
4411                         if (drivestrength >= str_tab[i].strength) {
4412                                 drivestrength_sel = str_tab[i].sel;
4413                                 break;
4414                         }
4415                 }
4416
4417                 brcmf_sdcard_reg_write(bus->sdiodev,
4418                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
4419                         4, 1);
4420                 cc_data_temp = brcmf_sdcard_reg_read(bus->sdiodev,
4421                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr), 4);
4422                 cc_data_temp &= ~str_mask;
4423                 drivestrength_sel <<= str_shift;
4424                 cc_data_temp |= drivestrength_sel;
4425                 brcmf_sdcard_reg_write(bus->sdiodev,
4426                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
4427                         4, cc_data_temp);
4428
4429                 brcmf_dbg(INFO, "SDIO: %dmA drive strength selected, set to 0x%08x\n",
4430                           drivestrength, cc_data_temp);
4431         }
4432 }
4433
4434 static int
4435 brcmf_sdbrcm_chip_recognition(struct brcmf_sdio_dev *sdiodev,
4436                               struct chip_info *ci, u32 regs)
4437 {
4438         u32 regdata;
4439
4440         /*
4441          * Get CC core rev
4442          * Chipid is assume to be at offset 0 from regs arg
4443          * For different chiptypes or old sdio hosts w/o chipcommon,
4444          * other ways of recognition should be added here.
4445          */
4446         ci->cccorebase = regs;
4447         regdata = brcmf_sdcard_reg_read(sdiodev,
4448                                 CORE_CC_REG(ci->cccorebase, chipid), 4);
4449         ci->chip = regdata & CID_ID_MASK;
4450         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
4451
4452         brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
4453
4454         /* Address of cores for new chips should be added here */
4455         switch (ci->chip) {
4456         case BCM4329_CHIP_ID:
4457                 ci->buscorebase = BCM4329_CORE_BUS_BASE;
4458                 ci->ramcorebase = BCM4329_CORE_SOCRAM_BASE;
4459                 ci->armcorebase = BCM4329_CORE_ARM_BASE;
4460                 ci->ramsize = BCM4329_RAMSIZE;
4461                 break;
4462         default:
4463                 brcmf_dbg(ERROR, "chipid 0x%x is not supported\n", ci->chip);
4464                 return -ENODEV;
4465         }
4466
4467         regdata = brcmf_sdcard_reg_read(sdiodev,
4468                 CORE_SB(ci->cccorebase, sbidhigh), 4);
4469         ci->ccrev = SBCOREREV(regdata);
4470
4471         regdata = brcmf_sdcard_reg_read(sdiodev,
4472                 CORE_CC_REG(ci->cccorebase, pmucapabilities), 4);
4473         ci->pmurev = regdata & PCAP_REV_MASK;
4474
4475         regdata = brcmf_sdcard_reg_read(sdiodev,
4476                                         CORE_SB(ci->buscorebase, sbidhigh), 4);
4477         ci->buscorerev = SBCOREREV(regdata);
4478         ci->buscoretype = (regdata & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
4479
4480         brcmf_dbg(INFO, "ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
4481                   ci->ccrev, ci->pmurev, ci->buscorerev, ci->buscoretype);
4482
4483         /* get chipcommon capabilites */
4484         ci->cccaps = brcmf_sdcard_reg_read(sdiodev,
4485                 CORE_CC_REG(ci->cccorebase, capabilities), 4);
4486
4487         return 0;
4488 }
4489
4490 static int
4491 brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs)
4492 {
4493         struct chip_info *ci;
4494         int err;
4495         u8 clkval, clkset;
4496
4497         brcmf_dbg(TRACE, "Enter\n");
4498
4499         /* alloc chip_info_t */
4500         ci = kzalloc(sizeof(struct chip_info), GFP_ATOMIC);
4501         if (NULL == ci) {
4502                 brcmf_dbg(ERROR, "malloc failed!\n");
4503                 return -ENOMEM;
4504         }
4505
4506         /* bus/core/clk setup for register access */
4507         /* Try forcing SDIO core to do ALPAvail request only */
4508         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
4509         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4510                                SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
4511         if (err) {
4512                 brcmf_dbg(ERROR, "error writing for HT off\n");
4513                 goto fail;
4514         }
4515
4516         /* If register supported, wait for ALPAvail and then force ALP */
4517         /* This may take up to 15 milliseconds */
4518         clkval = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4519                         SBSDIO_FUNC1_CHIPCLKCSR, NULL);
4520         if ((clkval & ~SBSDIO_AVBITS) == clkset) {
4521                 SPINWAIT(((clkval =
4522                                 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4523                                                 SBSDIO_FUNC1_CHIPCLKCSR,
4524                                                 NULL)),
4525                                 !SBSDIO_ALPAV(clkval)),
4526                                 PMU_MAX_TRANSITION_DLY);
4527                 if (!SBSDIO_ALPAV(clkval)) {
4528                         brcmf_dbg(ERROR, "timeout on ALPAV wait, clkval 0x%02x\n",
4529                                   clkval);
4530                         err = -EBUSY;
4531                         goto fail;
4532                 }
4533                 clkset = SBSDIO_FORCE_HW_CLKREQ_OFF |
4534                                 SBSDIO_FORCE_ALP;
4535                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4536                                 SBSDIO_FUNC1_CHIPCLKCSR,
4537                                 clkset, &err);
4538                 udelay(65);
4539         } else {
4540                 brcmf_dbg(ERROR, "ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
4541                           clkset, clkval);
4542                 err = -EACCES;
4543                 goto fail;
4544         }
4545
4546         /* Also, disable the extra SDIO pull-ups */
4547         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4548                                SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
4549
4550         err = brcmf_sdbrcm_chip_recognition(bus->sdiodev, ci, regs);
4551         if (err)
4552                 goto fail;
4553
4554         /*
4555          * Make sure any on-chip ARM is off (in case strapping is wrong),
4556          * or downloaded code was already running.
4557          */
4558         brcmf_sdbrcm_chip_disablecore(bus->sdiodev, ci->armcorebase);
4559
4560         brcmf_sdcard_reg_write(bus->sdiodev,
4561                 CORE_CC_REG(ci->cccorebase, gpiopullup), 4, 0);
4562         brcmf_sdcard_reg_write(bus->sdiodev,
4563                 CORE_CC_REG(ci->cccorebase, gpiopulldown), 4, 0);
4564
4565         /* Disable F2 to clear any intermediate frame state on the dongle */
4566         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
4567                 SDIO_FUNC_ENABLE_1, NULL);
4568
4569         /* WAR: cmd52 backplane read so core HW will drop ALPReq */
4570         clkval = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4571                         0, NULL);
4572
4573         /* Done with backplane-dependent accesses, can drop clock... */
4574         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4575                                SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
4576
4577         bus->ci = ci;
4578         return 0;
4579 fail:
4580         bus->ci = NULL;
4581         kfree(ci);
4582         return err;
4583 }
4584
4585 static bool
4586 brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, u32 regsva)
4587 {
4588         u8 clkctl = 0;
4589         int err = 0;
4590         int reg_addr;
4591         u32 reg_val;
4592
4593         bus->alp_only = true;
4594
4595         /* Return the window to backplane enumeration space for core access */
4596         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, SI_ENUM_BASE))
4597                 brcmf_dbg(ERROR, "FAILED to return to SI_ENUM_BASE\n");
4598
4599 #ifdef BCMDBG
4600         printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
4601                brcmf_sdcard_reg_read(bus->sdiodev, SI_ENUM_BASE, 4));
4602
4603 #endif                          /* BCMDBG */
4604
4605         /*
4606          * Force PLL off until brcmf_sdbrcm_chip_attach()
4607          * programs PLL control regs
4608          */
4609
4610         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4611                                SBSDIO_FUNC1_CHIPCLKCSR,
4612                                BRCMF_INIT_CLKCTL1, &err);
4613         if (!err)
4614                 clkctl =
4615                     brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
4616                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
4617
4618         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
4619                 brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
4620                           err, BRCMF_INIT_CLKCTL1, clkctl);
4621                 goto fail;
4622         }
4623
4624         if (brcmf_sdbrcm_chip_attach(bus, regsva)) {
4625                 brcmf_dbg(ERROR, "brcmf_sdbrcm_chip_attach failed!\n");
4626                 goto fail;
4627         }
4628
4629         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
4630                 brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
4631                 goto fail;
4632         }
4633
4634         brcmf_sdbrcm_sdiod_drive_strength_init(bus, brcmf_sdiod_drive_strength);
4635
4636         /* Get info on the ARM and SOCRAM cores... */
4637         brcmf_sdcard_reg_read(bus->sdiodev,
4638                   CORE_SB(bus->ci->armcorebase, sbidhigh), 4);
4639         bus->orig_ramsize = bus->ci->ramsize;
4640         if (!(bus->orig_ramsize)) {
4641                 brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
4642                 goto fail;
4643         }
4644         bus->ramsize = bus->orig_ramsize;
4645         if (brcmf_dongle_memsize)
4646                 brcmf_sdbrcm_setmemsize(bus, brcmf_dongle_memsize);
4647
4648         brcmf_dbg(ERROR, "DHD: dongle ram size is set to %d(orig %d)\n",
4649                   bus->ramsize, bus->orig_ramsize);
4650
4651         /* Set core control so an SDIO reset does a backplane reset */
4652         reg_addr = bus->ci->buscorebase +
4653                    offsetof(struct sdpcmd_regs, corecontrol);
4654         reg_val = brcmf_sdcard_reg_read(bus->sdiodev, reg_addr, sizeof(u32));
4655         brcmf_sdcard_reg_write(bus->sdiodev, reg_addr, sizeof(u32),
4656                                reg_val | CC_BPRESEN);
4657
4658         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
4659
4660         /* Locate an appropriately-aligned portion of hdrbuf */
4661         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
4662                                     BRCMF_SDALIGN);
4663
4664         /* Set the poll and/or interrupt flags */
4665         bus->intr = (bool) brcmf_intr;
4666         bus->poll = (bool) brcmf_poll;
4667         if (bus->poll)
4668                 bus->pollrate = 1;
4669
4670         return true;
4671
4672 fail:
4673         return false;
4674 }
4675
4676 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus)
4677 {
4678         brcmf_dbg(TRACE, "Enter\n");
4679
4680         /* Disable F2 to clear any intermediate frame state on the dongle */
4681         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
4682                                SDIO_FUNC_ENABLE_1, NULL);
4683
4684         bus->drvr->busstate = BRCMF_BUS_DOWN;
4685         bus->sleeping = false;
4686         bus->rxflow = false;
4687
4688         /* Done with backplane-dependent accesses, can drop clock... */
4689         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
4690                                SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
4691
4692         /* ...and initialize clock/power states */
4693         bus->clkstate = CLK_SDONLY;
4694         bus->idletime = (s32) brcmf_idletime;
4695         bus->idleclock = BRCMF_IDLE_ACTIVE;
4696
4697         /* Query the F2 block size, set roundup accordingly */
4698         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
4699         bus->roundup = min(max_roundup, bus->blocksize);
4700
4701         /* bus module does not support packet chaining */
4702         bus->use_rxchain = false;
4703         bus->sd_rxchain = false;
4704
4705         return true;
4706 }
4707
4708 static int
4709 brcmf_sdbrcm_watchdog_thread(void *data)
4710 {
4711         struct brcmf_bus *bus = (struct brcmf_bus *)data;
4712
4713         /* This thread doesn't need any user-level access,
4714         * so get rid of all our resources
4715         */
4716         if (brcmf_watchdog_prio > 0) {
4717                 struct sched_param param;
4718                 param.sched_priority = (brcmf_watchdog_prio < MAX_RT_PRIO) ?
4719                                        brcmf_watchdog_prio : (MAX_RT_PRIO - 1);
4720                 sched_setscheduler(current, SCHED_FIFO, &param);
4721         }
4722
4723         allow_signal(SIGTERM);
4724         /* Run until signal received */
4725         while (1) {
4726                 if (kthread_should_stop())
4727                         break;
4728                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
4729                         if (bus->drvr->dongle_reset == false)
4730                                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
4731                         /* Count the tick for reference */
4732                         bus->drvr->tickcnt++;
4733                 } else
4734                         break;
4735         }
4736         return 0;
4737 }
4738
4739 static void
4740 brcmf_sdbrcm_watchdog(unsigned long data)
4741 {
4742         struct brcmf_bus *bus = (struct brcmf_bus *)data;
4743
4744         if (brcmf_watchdog_prio >= 0) {
4745                 if (bus->watchdog_tsk)
4746                         complete(&bus->watchdog_wait);
4747                 else
4748                         return;
4749         } else {
4750                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
4751
4752                 /* Count the tick for reference */
4753                 bus->drvr->tickcnt++;
4754         }
4755
4756         /* Reschedule the watchdog */
4757         if (bus->wd_timer_valid)
4758                 mod_timer(&bus->timer, jiffies + brcmf_watchdog_ms * HZ / 1000);
4759 }
4760
4761 static void
4762 brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus)
4763 {
4764         brcmf_dbg(TRACE, "Enter\n");
4765
4766         kfree(bus->ci);
4767         bus->ci = NULL;
4768 }
4769
4770 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
4771 {
4772         brcmf_dbg(TRACE, "Enter\n");
4773
4774         if (bus->drvr && bus->drvr->dongle_reset)
4775                 return;
4776
4777         if (bus->ci) {
4778                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
4779                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
4780                 brcmf_sdbrcm_chip_detach(bus);
4781                 if (bus->vars && bus->varsz)
4782                         kfree(bus->vars);
4783                 bus->vars = NULL;
4784         }
4785
4786         brcmf_dbg(TRACE, "Disconnected\n");
4787 }
4788
4789 /* Detach and free everything */
4790 static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
4791 {
4792         brcmf_dbg(TRACE, "Enter\n");
4793
4794         if (bus) {
4795                 /* De-register interrupt handler */
4796                 brcmf_sdcard_intr_dereg(bus->sdiodev);
4797
4798                 if (bus->drvr) {
4799                         brcmf_detach(bus->drvr);
4800                         brcmf_sdbrcm_release_dongle(bus);
4801                         bus->drvr = NULL;
4802                 }
4803
4804                 brcmf_sdbrcm_release_malloc(bus);
4805
4806                 kfree(bus);
4807         }
4808
4809         brcmf_dbg(TRACE, "Disconnected\n");
4810 }
4811
4812 void *brcmf_sdbrcm_probe(u16 bus_no, u16 slot, u16 func, uint bustype,
4813                          u32 regsva, struct brcmf_sdio_dev *sdiodev)
4814 {
4815         int ret;
4816         struct brcmf_bus *bus;
4817
4818         /* Init global variables at run-time, not as part of the declaration.
4819          * This is required to support init/de-init of the driver.
4820          * Initialization
4821          * of globals as part of the declaration results in non-deterministic
4822          * behavior since the value of the globals may be different on the
4823          * first time that the driver is initialized vs subsequent
4824          * initializations.
4825          */
4826         brcmf_txbound = BRCMF_TXBOUND;
4827         brcmf_rxbound = BRCMF_RXBOUND;
4828         brcmf_alignctl = true;
4829         brcmf_readahead = true;
4830         retrydata = false;
4831         brcmf_dongle_memsize = 0;
4832         brcmf_txminmax = BRCMF_TXMINMAX;
4833
4834         forcealign = true;
4835
4836         brcmf_c_init();
4837
4838         brcmf_dbg(TRACE, "Enter\n");
4839
4840         /* We make an assumption about address window mappings:
4841          * regsva == SI_ENUM_BASE*/
4842
4843         /* Allocate private bus interface state */
4844         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
4845         if (!bus) {
4846                 brcmf_dbg(ERROR, "kmalloc of struct dhd_bus failed\n");
4847                 goto fail;
4848         }
4849         bus->sdiodev = sdiodev;
4850         sdiodev->bus = bus;
4851         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
4852         bus->usebufpool = false;        /* Use bufpool if allocated,
4853                                          else use locally malloced rxbuf */
4854
4855         /* attempt to attach to the dongle */
4856         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
4857                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
4858                 goto fail;
4859         }
4860
4861         spin_lock_init(&bus->txqlock);
4862         init_waitqueue_head(&bus->ctrl_wait);
4863         init_waitqueue_head(&bus->ioctl_resp_wait);
4864
4865         /* Set up the watchdog timer */
4866         init_timer(&bus->timer);
4867         bus->timer.data = (unsigned long)bus;
4868         bus->timer.function = brcmf_sdbrcm_watchdog;
4869
4870         /* Initialize thread based operation and lock */
4871         if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)) {
4872                 bus->threads_only = true;
4873                 sema_init(&bus->sdsem, 1);
4874         } else {
4875                 bus->threads_only = false;
4876                 spin_lock_init(&bus->sdlock);
4877         }
4878
4879         if (brcmf_dpc_prio >= 0) {
4880                 /* Initialize watchdog thread */
4881                 init_completion(&bus->watchdog_wait);
4882                 bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
4883                                                 bus, "brcmf_watchdog");
4884                 if (IS_ERR(bus->watchdog_tsk)) {
4885                         printk(KERN_WARNING
4886                                "brcmf_watchdog thread failed to start\n");
4887                         bus->watchdog_tsk = NULL;
4888                 }
4889         } else
4890                 bus->watchdog_tsk = NULL;
4891
4892         /* Set up the bottom half handler */
4893         if (brcmf_dpc_prio >= 0) {
4894                 /* Initialize DPC thread */
4895                 init_completion(&bus->dpc_wait);
4896                 bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
4897                                            bus, "brcmf_dpc");
4898                 if (IS_ERR(bus->dpc_tsk)) {
4899                         printk(KERN_WARNING
4900                                "brcmf_dpc thread failed to start\n");
4901                         bus->dpc_tsk = NULL;
4902                 }
4903         } else {
4904                 tasklet_init(&bus->tasklet, brcmf_sdbrcm_dpc_tasklet,
4905                              (unsigned long)bus);
4906                 bus->dpc_tsk = NULL;
4907         }
4908
4909         /* Attach to the brcmf/OS/network interface */
4910         bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
4911         if (!bus->drvr) {
4912                 brcmf_dbg(ERROR, "brcmf_attach failed\n");
4913                 goto fail;
4914         }
4915
4916         /* Allocate buffers */
4917         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
4918                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
4919                 goto fail;
4920         }
4921
4922         if (!(brcmf_sdbrcm_probe_init(bus))) {
4923                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
4924                 goto fail;
4925         }
4926
4927         /* Register interrupt callback, but mask it (not operational yet). */
4928         brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
4929         ret = brcmf_sdcard_intr_reg(bus->sdiodev);
4930         if (ret != 0) {
4931                 brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
4932                 goto fail;
4933         }
4934         brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
4935
4936         brcmf_dbg(INFO, "completed!!\n");
4937
4938         /* if firmware path present try to download and bring up bus */
4939         ret = brcmf_bus_start(bus->drvr);
4940         if (ret != 0) {
4941                 if (ret == -ENOLINK) {
4942                         brcmf_dbg(ERROR, "dongle is not responding\n");
4943                         goto fail;
4944                 }
4945         }
4946         /* Ok, have the per-port tell the stack we're open for business */
4947         if (brcmf_net_attach(bus->drvr, 0) != 0) {
4948                 brcmf_dbg(ERROR, "Net attach failed!!\n");
4949                 goto fail;
4950         }
4951
4952         return bus;
4953
4954 fail:
4955         brcmf_sdbrcm_release(bus);
4956         return NULL;
4957 }
4958
4959 void brcmf_sdbrcm_disconnect(void *ptr)
4960 {
4961         struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
4962
4963         brcmf_dbg(TRACE, "Enter\n");
4964
4965         if (bus)
4966                 brcmf_sdbrcm_release(bus);
4967
4968         brcmf_dbg(TRACE, "Disconnected\n");
4969 }
4970
4971 int brcmf_bus_register(void)
4972 {
4973         brcmf_dbg(TRACE, "Enter\n");
4974
4975         /* Sanity check on the module parameters */
4976         do {
4977                 /* Both watchdog and DPC as tasklets are ok */
4978                 if ((brcmf_watchdog_prio < 0) && (brcmf_dpc_prio < 0))
4979                         break;
4980
4981                 /* If both watchdog and DPC are threads, TX must be deferred */
4982                 if (brcmf_watchdog_prio >= 0 && brcmf_dpc_prio >= 0)
4983                         break;
4984
4985                 brcmf_dbg(ERROR, "Invalid module parameters.\n");
4986                 return -EINVAL;
4987         } while (0);
4988
4989         return brcmf_sdio_register();
4990 }
4991
4992 void brcmf_bus_unregister(void)
4993 {
4994         brcmf_dbg(TRACE, "Enter\n");
4995
4996         brcmf_sdio_unregister();
4997 }
4998
4999 struct device *brcmf_bus_get_device(struct brcmf_bus *bus)
5000 {
5001         return &bus->sdiodev->func[2]->dev;
5002 }
5003
5004 int brcmf_bus_devreset(struct brcmf_pub *drvr, u8 flag)
5005 {
5006         int bcmerror = 0;
5007         struct brcmf_bus *bus;
5008
5009         bus = drvr->bus;
5010
5011         if (flag == true) {
5012                 brcmf_sdbrcm_wd_timer(bus, 0);
5013                 if (!bus->drvr->dongle_reset) {
5014                         /* Expect app to have torn down any
5015                          connection before calling */
5016                         /* Stop the bus, disable F2 */
5017                         brcmf_sdbrcm_bus_stop(bus, false);
5018
5019                         /* Clean tx/rx buffer pointers,
5020                          detach from the dongle */
5021                         brcmf_sdbrcm_release_dongle(bus);
5022
5023                         bus->drvr->dongle_reset = true;
5024                         bus->drvr->up = false;
5025
5026                         brcmf_dbg(TRACE, "WLAN OFF DONE\n");
5027                         /* App can now remove power from device */
5028                 } else
5029                         bcmerror = -EIO;
5030         } else {
5031                 /* App must have restored power to device before calling */
5032
5033                 brcmf_dbg(TRACE, " == WLAN ON ==\n");
5034
5035                 if (bus->drvr->dongle_reset) {
5036                         /* Turn on WLAN */
5037
5038                         /* Attempt to re-attach & download */
5039                         if (brcmf_sdbrcm_probe_attach(bus, SI_ENUM_BASE)) {
5040                                 /* Attempt to download binary to the dongle */
5041                                 if (brcmf_sdbrcm_probe_init(bus)) {
5042                                         /* Re-init bus, enable F2 transfer */
5043                                         brcmf_sdbrcm_bus_init(bus->drvr, false);
5044
5045                                         bus->drvr->dongle_reset = false;
5046                                         bus->drvr->up = true;
5047
5048                                         brcmf_dbg(TRACE, "WLAN ON DONE\n");
5049                                 } else
5050                                         bcmerror = -EIO;
5051                         } else
5052                                 bcmerror = -EIO;
5053                 } else {
5054                         bcmerror = -EISCONN;
5055                         brcmf_dbg(ERROR, "Set DEVRESET=false invoked when device is on\n");
5056                         bcmerror = -EIO;
5057                 }
5058                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
5059         }
5060         return bcmerror;
5061 }
5062
5063 void
5064 brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
5065 {
5066         /* don't start the wd until fw is loaded */
5067         if (bus->drvr->busstate == BRCMF_BUS_DOWN)
5068                 return;
5069
5070         /* Totally stop the timer */
5071         if (!wdtick && bus->wd_timer_valid == true) {
5072                 del_timer_sync(&bus->timer);
5073                 bus->wd_timer_valid = false;
5074                 bus->save_ms = wdtick;
5075                 return;
5076         }
5077
5078         if (wdtick) {
5079                 brcmf_watchdog_ms = (uint) wdtick;
5080
5081                 if (bus->save_ms != brcmf_watchdog_ms) {
5082                         if (bus->wd_timer_valid == true)
5083                                 /* Stop timer and restart at new value */
5084                                 del_timer_sync(&bus->timer);
5085
5086                         /* Create timer again when watchdog period is
5087                            dynamically changed or in the first instance
5088                          */
5089                         bus->timer.expires =
5090                                 jiffies + brcmf_watchdog_ms * HZ / 1000;
5091                         add_timer(&bus->timer);
5092
5093                 } else {
5094                         /* Re arm the timer, at last watchdog period */
5095                         mod_timer(&bus->timer,
5096                                 jiffies + brcmf_watchdog_ms * HZ / 1000);
5097                 }
5098
5099                 bus->wd_timer_valid = true;
5100                 bus->save_ms = wdtick;
5101         }
5102 }