drivers/staging/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/sched.h>
  24 #include <linux/mmc/sdio.h>
  25 #include <linux/mmc/sdio_func.h>
  26 #include <linux/semaphore.h>
  27 #include <linux/firmware.h>
  28 #include <asm/unaligned.h>
  29 #include <defs.h>
  30 #include <brcmu_wifi.h>
  31 #include <brcmu_utils.h>
  32 #include <brcm_hw_ids.h>
  33 #include <soc.h>
  34 #include "sdio_host.h"
  35 #include "bcmsdbus.h"
  36
  37 /* register access macros */
  38 #ifndef __BIG_ENDIAN
  39 #ifndef __mips__
  40 #define R_REG(r, typ) \
  41         brcmf_sdcard_reg_read(NULL, (r), sizeof(typ))
  42 #else                           /* __mips__ */
  43 #define R_REG(r, typ) \
  44         ({ \
  45                 __typeof(*(r)) __osl_v; \
  46                 __asm__ __volatile__("sync"); \
  47                 __osl_v = brcmf_sdcard_reg_read(NULL, (r),\
  48                                           sizeof(typ)); \
  49                 __asm__ __volatile__("sync"); \
  50                 __osl_v; \
  51         })
  52 #endif                          /* __mips__ */
  53
  54 #else                           /* __BIG_ENDIAN */
  55 #define R_REG(r, typ) \
  56         brcmf_sdcard_reg_read(NULL, (r), sizeof(typ))
  57 #endif                          /* __BIG_ENDIAN */
  58
  59 #define OR_REG(r, v, typ) \
  60         brcmf_sdcard_reg_write(NULL, (r), sizeof(typ), R_REG(r, typ) | (v))
  61
  62 #ifdef BCMDBG
  63
  64 /* ARM trap handling */
  65
  66 /* Trap types defined by ARM (see arminc.h) */
  67
  68 #if defined(__ARM_ARCH_4T__)
  69 #define MAX_TRAP_TYPE   (TR_FIQ + 1)
  70 #elif defined(__ARM_ARCH_7M__)
  71 #define MAX_TRAP_TYPE   (TR_ISR + ARMCM3_NUMINTS)
  72 #endif                          /* __ARM_ARCH_7M__ */
  73
  74 /* The trap structure is defined here as offsets for assembly */
  75 #define TR_TYPE         0x00
  76 #define TR_EPC          0x04
  77 #define TR_CPSR         0x08
  78 #define TR_SPSR         0x0c
  79 #define TR_REGS         0x10
  80 #define TR_REG(n)       (TR_REGS + (n) * 4)
  81 #define TR_SP           TR_REG(13)
  82 #define TR_LR           TR_REG(14)
  83 #define TR_PC           TR_REG(15)
  84
  85 #define TRAP_T_SIZE     80
  86
  87 struct brcmf_trap {
  88         u32 type;
  89         u32 epc;
  90         u32 cpsr;
  91         u32 spsr;
  92         u32 r0;
  93         u32 r1;
  94         u32 r2;
  95         u32 r3;
  96         u32 r4;
  97         u32 r5;
  98         u32 r6;
  99         u32 r7;
 100         u32 r8;
 101         u32 r9;
 102         u32 r10;
 103         u32 r11;
 104         u32 r12;
 105         u32 r13;
 106         u32 r14;
 107         u32 pc;
 108 };
 109
 110 #define CBUF_LEN        (128)
 111
 112 struct rte_log {
 113         u32 buf;                /* Can't be pointer on (64-bit) hosts */
 114         uint buf_size;
 115         uint idx;
 116         char *_buf_compat;      /* Redundant pointer for backward compat. */
 117 };
 118
 119 struct rte_console {
 120         /* Virtual UART
 121          * When there is no UART (e.g. Quickturn),
 122          * the host should write a complete
 123          * input line directly into cbuf and then write
 124          * the length into vcons_in.
 125          * This may also be used when there is a real UART
 126          * (at risk of conflicting with
 127          * the real UART).  vcons_out is currently unused.
 128          */
 129         volatile uint vcons_in;
 130         volatile uint vcons_out;
 131
 132         /* Output (logging) buffer
 133          * Console output is written to a ring buffer log_buf at index log_idx.
 134          * The host may read the output when it sees log_idx advance.
 135          * Output will be lost if the output wraps around faster than the host
 136          * polls.
 137          */
 138         struct rte_log log;
 139
 140         /* Console input line buffer
 141          * Characters are read one at a time into cbuf
 142          * until <CR> is received, then
 143          * the buffer is processed as a command line.
 144          * Also used for virtual UART.
 145          */
 146         uint cbuf_idx;
 147         char cbuf[CBUF_LEN];
 148 };
 149
 150 #endif                          /* BCMDBG */
 151 #include <chipcommon.h>
 152
 153 #include "sbsdio.h"
 154
 155 #include "dhd.h"
 156 #include "dhd_bus.h"
 157 #include "dhd_proto.h"
 158 #include "dhd_dbg.h"
 159 #include <bcmchip.h>
 160
 161 #define TXQLEN          2048    /* bulk tx queue length */
 162 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 163 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 164 #define PRIOMASK        7
 165
 166 #define TXRETRIES       2       /* # of retries for tx frames */
 167
 168 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 169                                  one scheduling */
 170
 171 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 172                                  one scheduling */
 173
 174 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 175
 176 #define MEMBLOCK        2048    /* Block size used for downloading
 177                                  of dongle image */
 178 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 179                                  biggest possible glom */
 180
 181 #ifndef BRCMF_FIRSTREAD
 182 #define BRCMF_FIRSTREAD 32
 183 #endif
 184 #if !ISPOWEROF2(BRCMF_FIRSTREAD)
 185 #error BRCMF_FIRSTREAD is not a power of 2!
 186 #endif
 187
 188 /* Total length of frame header for dongle protocol */
 189 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 190 #ifdef SDTEST
 191 #define SDPCM_RESERVE   (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + BRCMF_SDALIGN)
 192 #else
 193 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 194 #endif
 195
 196 /*
 197  * Software allocation of To SB Mailbox resources
 198  */
 199
 200 /* tosbmailbox bits corresponding to intstatus bits */
 201 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 202 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 203 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 204 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 205
 206 /* tosbmailboxdata */
 207 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 208
 209 /*
 210  * Software allocation of To Host Mailbox resources
 211  */
 212
 213 /* intstatus bits */
 214 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 215 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 216 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 217 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 218
 219 /* tohostmailboxdata */
 220 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 221 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 222 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 223 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 224
 225 #define HMB_DATA_FCDATA_MASK    0xff000000
 226 #define HMB_DATA_FCDATA_SHIFT   24
 227
 228 #define HMB_DATA_VERSION_MASK   0x00ff0000
 229 #define HMB_DATA_VERSION_SHIFT  16
 230
 231 /*
 232  * Software-defined protocol header
 233  */
 234
 235 /* Current protocol version */
 236 #define SDPCM_PROT_VERSION      4
 237
 238 /* SW frame header */
 239 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 240
 241 #define SDPCM_CHANNEL_MASK              0x00000f00
 242 #define SDPCM_CHANNEL_SHIFT             8
 243 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 244
 245 #define SDPCM_NEXTLEN_OFFSET            2
 246
 247 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 248 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 249 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 250 #define SDPCM_DOFFSET_MASK              0xff000000
 251 #define SDPCM_DOFFSET_SHIFT             24
 252 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 253 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 254 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 255 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 256
 257 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 258
 259 /* logical channel numbers */
 260 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 261 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 262 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 263 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 264 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 265
 266 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 267
 268 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 269
 270 /* For TEST_CHANNEL packets, define another 4-byte header */
 271 #define SDPCM_TEST_HDRLEN       4       /*
 272                                          * Generally: Cmd(1), Ext(1), Len(2);
 273                                          * Semantics of Ext byte depend on
 274                                          * command. Len is current or requested
 275                                          * frame length, not including test
 276                                          * header; sent little-endian.
 277                                          */
 278 #define SDPCM_TEST_DISCARD      0x01    /* Receiver discards. Ext:pattern id. */
 279 #define SDPCM_TEST_ECHOREQ      0x02    /* Echo request. Ext:pattern id. */
 280 #define SDPCM_TEST_ECHORSP      0x03    /* Echo response. Ext:pattern id. */
 281 #define SDPCM_TEST_BURST        0x04    /*
 282                                          * Receiver to send a burst.
 283                                          * Ext is a frame count
 284                                          */
 285 #define SDPCM_TEST_SEND         0x05    /*
 286                                          * Receiver sets send mode.
 287                                          * Ext is boolean on/off
 288                                          */
 289
 290 /* Handy macro for filling in datagen packets with a pattern */
 291 #define SDPCM_TEST_FILL(byteno, id)     ((u8)(id + byteno))
 292
 293 /*
 294  * Shared structure between dongle and the host.
 295  * The structure contains pointers to trap or assert information.
 296  */
 297 #define SDPCM_SHARED_VERSION       0x0002
 298 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 299 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 300 #define SDPCM_SHARED_ASSERT        0x0200
 301 #define SDPCM_SHARED_TRAP          0x0400
 302
 303
 304 /* Space for header read, limit for data packets */
 305 #ifndef MAX_HDR_READ
 306 #define MAX_HDR_READ    32
 307 #endif
 308 #if !ISPOWEROF2(MAX_HDR_READ)
 309 #error MAX_HDR_READ is not a power of 2!
 310 #endif
 311
 312 #define MAX_RX_DATASZ   2048
 313
 314 /* Maximum milliseconds to wait for F2 to come up */
 315 #define BRCMF_WAIT_F2RDY        3000
 316
 317 /* Bump up limit on waiting for HT to account for first startup;
 318  * if the image is doing a CRC calculation before programming the PMU
 319  * for HT availability, it could take a couple hundred ms more, so
 320  * max out at a 1 second (1000000us).
 321  */
 322 #if (PMU_MAX_TRANSITION_DLY <= 1000000)
 323 #undef PMU_MAX_TRANSITION_DLY
 324 #define PMU_MAX_TRANSITION_DLY 1000000
 325 #endif
 326
 327 /* Value for ChipClockCSR during initial setup */
 328 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 329                                         SBSDIO_ALP_AVAIL_REQ)
 330
 331 /* Flags for SDH calls */
 332 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 333
 334 /* sbimstate */
 335 #define SBIM_IBE                0x20000 /* inbanderror */
 336 #define SBIM_TO                 0x40000 /* timeout */
 337 #define SBIM_BY                 0x01800000      /* busy (sonics >= 2.3) */
 338 #define SBIM_RJ                 0x02000000      /* reject (sonics >= 2.3) */
 339
 340 /* sbtmstatelow */
 341 #define SBTML_RESET             0x0001  /* reset */
 342 #define SBTML_REJ_MASK          0x0006  /* reject field */
 343 #define SBTML_REJ               0x0002  /* reject */
 344 #define SBTML_TMPREJ            0x0004  /* temporary reject, for error recovery */
 345
 346 #define SBTML_SICF_SHIFT        16      /* Shift to locate the SI control flags in sbtml */
 347
 348 /* sbtmstatehigh */
 349 #define SBTMH_SERR              0x0001  /* serror */
 350 #define SBTMH_INT               0x0002  /* interrupt */
 351 #define SBTMH_BUSY              0x0004  /* busy */
 352 #define SBTMH_TO                0x0020  /* timeout (sonics >= 2.3) */
 353
 354 #define SBTMH_SISF_SHIFT        16      /* Shift to locate the SI status flags in sbtmh */
 355
 356 /* sbidlow */
 357 #define SBIDL_INIT              0x80    /* initiator */
 358
 359 /* sbidhigh */
 360 #define SBIDH_RC_MASK           0x000f  /* revision code */
 361 #define SBIDH_RCE_MASK          0x7000  /* revision code extension field */
 362 #define SBIDH_RCE_SHIFT         8
 363 #define SBCOREREV(sbidh) \
 364         ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
 365 #define SBIDH_CC_MASK           0x8ff0  /* core code */
 366 #define SBIDH_CC_SHIFT          4
 367 #define SBIDH_VC_MASK           0xffff0000      /* vendor code */
 368 #define SBIDH_VC_SHIFT          16
 369
 370 /*
 371  * Conversion of 802.1D priority to precedence level
 372  */
 373 #define PRIO2PREC(prio) \
 374         (((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? \
 375         ((prio^2)) : (prio))
 376
 377 BRCMF_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
 378
 379 /*
 380  * Core reg address translation.
 381  * Both macro's returns a 32 bits byte address on the backplane bus.
 382  */
 383 #define CORE_CC_REG(base, field)        (base + offsetof(chipcregs_t, field))
 384 #define CORE_BUS_REG(base, field) \
 385                 (base + offsetof(struct sdpcmd_regs, field))
 386 #define CORE_SB(base, field) \
 387                 (base + SBCONFIGOFF + offsetof(struct sbconfig, field))
 388
 389 /* core registers */
 390 struct sdpcmd_regs {
 391         u32 corecontrol;                /* 0x00, rev8 */
 392         u32 corestatus;                 /* rev8 */
 393         u32 PAD[1];
 394         u32 biststatus;                 /* rev8 */
 395
 396         /* PCMCIA access */
 397         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 398         u16 PAD[1];
 399         u16 pcmciamesportalmask;        /* rev8 */
 400         u16 PAD[1];
 401         u16 pcmciawrframebc;            /* rev8 */
 402         u16 PAD[1];
 403         u16 pcmciaunderflowtimer;       /* rev8 */
 404         u16 PAD[1];
 405
 406         /* interrupt */
 407         u32 intstatus;                  /* 0x020, rev8 */
 408         u32 hostintmask;                /* rev8 */
 409         u32 intmask;                    /* rev8 */
 410         u32 sbintstatus;                /* rev8 */
 411         u32 sbintmask;                  /* rev8 */
 412         u32 funcintmask;                /* rev4 */
 413         u32 PAD[2];
 414         u32 tosbmailbox;                /* 0x040, rev8 */
 415         u32 tohostmailbox;              /* rev8 */
 416         u32 tosbmailboxdata;            /* rev8 */
 417         u32 tohostmailboxdata;          /* rev8 */
 418
 419         /* synchronized access to registers in SDIO clock domain */
 420         u32 sdioaccess;                 /* 0x050, rev8 */
 421         u32 PAD[3];
 422
 423         /* PCMCIA frame control */
 424         u8 pcmciaframectrl;             /* 0x060, rev8 */
 425         u8 PAD[3];
 426         u8 pcmciawatermark;             /* rev8 */
 427         u8 PAD[155];
 428
 429         /* interrupt batching control */
 430         u32 intrcvlazy;                 /* 0x100, rev8 */
 431         u32 PAD[3];
 432
 433         /* counters */
 434         u32 cmd52rd;                    /* 0x110, rev8 */
 435         u32 cmd52wr;                    /* rev8 */
 436         u32 cmd53rd;                    /* rev8 */
 437         u32 cmd53wr;                    /* rev8 */
 438         u32 abort;                      /* rev8 */
 439         u32 datacrcerror;               /* rev8 */
 440         u32 rdoutofsync;                /* rev8 */
 441         u32 wroutofsync;                /* rev8 */
 442         u32 writebusy;                  /* rev8 */
 443         u32 readwait;                   /* rev8 */
 444         u32 readterm;                   /* rev8 */
 445         u32 writeterm;                  /* rev8 */
 446         u32 PAD[40];
 447         u32 clockctlstatus;             /* rev8 */
 448         u32 PAD[7];
 449
 450         u32 PAD[128];                   /* DMA engines */
 451
 452         /* SDIO/PCMCIA CIS region */
 453         char cis[512];                  /* 0x400-0x5ff, rev6 */
 454
 455         /* PCMCIA function control registers */
 456         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 457         u16 PAD[55];
 458
 459         /* PCMCIA backplane access */
 460         u16 backplanecsr;               /* 0x76E, rev6 */
 461         u16 backplaneaddr0;             /* rev6 */
 462         u16 backplaneaddr1;             /* rev6 */
 463         u16 backplaneaddr2;             /* rev6 */
 464         u16 backplaneaddr3;             /* rev6 */
 465         u16 backplanedata0;             /* rev6 */
 466         u16 backplanedata1;             /* rev6 */
 467         u16 backplanedata2;             /* rev6 */
 468         u16 backplanedata3;             /* rev6 */
 469         u16 PAD[31];
 470
 471         /* sprom "size" & "blank" info */
 472         u16 spromstatus;                /* 0x7BE, rev2 */
 473         u32 PAD[464];
 474
 475         u16 PAD[0x80];
 476 };
 477
 478 #ifdef BCMDBG
 479 /* Device console log buffer state */
 480 struct brcmf_console {
 481         uint count;             /* Poll interval msec counter */
 482         uint log_addr;          /* Log struct address (fixed) */
 483         struct rte_log log;     /* Log struct (host copy) */
 484         uint bufsize;           /* Size of log buffer */
 485         u8 *buf;                /* Log buffer (host copy) */
 486         uint last;              /* Last buffer read index */
 487 };
 488 #endif                          /* BCMDBG */
 489
 490 struct sdpcm_shared {
 491         u32 flags;
 492         u32 trap_addr;
 493         u32 assert_exp_addr;
 494         u32 assert_file_addr;
 495         u32 assert_line;
 496         u32 console_addr;       /* Address of struct rte_console */
 497         u32 msgtrace_addr;
 498         u8 tag[32];
 499 };
 500
 501
 502 /* misc chip info needed by some of the routines */
 503 struct chip_info {
 504         u32 chip;
 505         u32 chiprev;
 506         u32 cccorebase;
 507         u32 ccrev;
 508         u32 cccaps;
 509         u32 buscorebase; /* 32 bits backplane bus address */
 510         u32 buscorerev;
 511         u32 buscoretype;
 512         u32 ramcorebase;
 513         u32 armcorebase;
 514         u32 pmurev;
 515         u32 ramsize;
 516 };
 517
 518 /* Private data for SDIO bus interaction */
 519 struct brcmf_bus {
 520         struct brcmf_pub *drvr;
 521
 522         struct brcmf_sdio_card *card;   /* Handle for sdio card calls */
 523         struct chip_info *ci;   /* Chip info struct */
 524         char *vars;             /* Variables (from CIS and/or other) */
 525         uint varsz;             /* Size of variables buffer */
 526
 527         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 528         u32 orig_ramsize;       /* Size of RAM in SOCRAM (bytes) */
 529
 530         u32 bus;                /* gSPI or SDIO bus */
 531         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 532         u32 intstatus;  /* Intstatus bits (events) pending */
 533         bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
 534         bool fcstate;           /* State of dongle flow-control */
 535
 536         u16 cl_devid;   /* cached devid for brcmf_sdio_probe_attach() */
 537
 538         uint blocksize;         /* Block size of SDIO transfers */
 539         uint roundup;           /* Max roundup limit */
 540
 541         struct pktq txq;        /* Queue length used for flow-control */
 542         u8 flowcontrol; /* per prio flow control bitmask */
 543         u8 tx_seq;              /* Transmit sequence number (next) */
 544         u8 tx_max;              /* Maximum transmit sequence allowed */
 545
 546         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 547         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 548         u16 nextlen;            /* Next Read Len from last header */
 549         u8 rx_seq;              /* Receive sequence number (expected) */
 550         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 551
 552         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 553         struct sk_buff *glom;   /* Packet chain for glommed superframe */
 554         uint glomerr;           /* Glom packet read errors */
 555
 556         u8 *rxbuf;              /* Buffer for receiving control packets */
 557         uint rxblen;            /* Allocated length of rxbuf */
 558         u8 *rxctl;              /* Aligned pointer into rxbuf */
 559         u8 *databuf;            /* Buffer for receiving big glom packet */
 560         u8 *dataptr;            /* Aligned pointer into databuf */
 561         uint rxlen;             /* Length of valid data in buffer */
 562
 563         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 564
 565         bool intr;              /* Use interrupts */
 566         bool poll;              /* Use polling */
 567         bool ipend;             /* Device interrupt is pending */
 568         bool intdis;            /* Interrupts disabled by isr */
 569         uint intrcount;         /* Count of device interrupt callbacks */
 570         uint lastintrs;         /* Count as of last watchdog timer */
 571         uint spurious;          /* Count of spurious interrupts */
 572         uint pollrate;          /* Ticks between device polls */
 573         uint polltick;          /* Tick counter */
 574         uint pollcnt;           /* Count of active polls */
 575
 576 #ifdef BCMDBG
 577         struct brcmf_console console;   /* Console output polling support */
 578         uint console_addr;      /* Console address from shared struct */
 579 #endif                          /* BCMDBG */
 580
 581         uint regfails;          /* Count of R_REG failures */
 582
 583         uint clkstate;          /* State of sd and backplane clock(s) */
 584         bool activity;          /* Activity flag for clock down */
 585         s32 idletime;           /* Control for activity timeout */
 586         s32 idlecount;  /* Activity timeout counter */
 587         s32 idleclock;  /* How to set bus driver when idle */
 588         s32 sd_rxchain;
 589         bool use_rxchain;       /* If brcmf should use PKT chains */
 590         bool sleeping;          /* Is SDIO bus sleeping? */
 591         bool rxflow_mode;       /* Rx flow control mode */
 592         bool rxflow;            /* Is rx flow control on */
 593         bool alp_only;          /* Don't use HT clock (ALP only) */
 594 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
 595         bool usebufpool;
 596
 597 #ifdef SDTEST
 598         /* external loopback */
 599         bool ext_loop;
 600         u8 loopid;
 601
 602         /* pktgen configuration */
 603         uint pktgen_freq;       /* Ticks between bursts */
 604         uint pktgen_count;      /* Packets to send each burst */
 605         uint pktgen_print;      /* Bursts between count displays */
 606         uint pktgen_total;      /* Stop after this many */
 607         uint pktgen_minlen;     /* Minimum packet data len */
 608         uint pktgen_maxlen;     /* Maximum packet data len */
 609         uint pktgen_mode;       /* Configured mode: tx, rx, or echo */
 610         uint pktgen_stop;       /* Number of tx failures causing stop */
 611
 612         /* active pktgen fields */
 613         uint pktgen_tick;       /* Tick counter for bursts */
 614         uint pktgen_ptick;      /* Burst counter for printing */
 615         uint pktgen_sent;       /* Number of test packets generated */
 616         uint pktgen_rcvd;       /* Number of test packets received */
 617         uint pktgen_fail;       /* Number of failed send attempts */
 618         u16 pktgen_len; /* Length of next packet to send */
 619 #endif                          /* SDTEST */
 620
 621         /* Some additional counters */
 622         uint tx_sderrs;         /* Count of tx attempts with sd errors */
 623         uint fcqueued;          /* Tx packets that got queued */
 624         uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 625         uint rx_toolong;        /* Receive frames too long to receive */
 626         uint rxc_errors;        /* SDIO errors when reading control frames */
 627         uint rx_hdrfail;        /* SDIO errors on header reads */
 628         uint rx_badhdr;         /* Bad received headers (roosync?) */
 629         uint rx_badseq;         /* Mismatched rx sequence number */
 630         uint fc_rcvd;           /* Number of flow-control events received */
 631         uint fc_xoff;           /* Number which turned on flow-control */
 632         uint fc_xon;            /* Number which turned off flow-control */
 633         uint rxglomfail;        /* Failed deglom attempts */
 634         uint rxglomframes;      /* Number of glom frames (superframes) */
 635         uint rxglompkts;        /* Number of packets from glom frames */
 636         uint f2rxhdrs;          /* Number of header reads */
 637         uint f2rxdata;          /* Number of frame data reads */
 638         uint f2txdata;          /* Number of f2 frame writes */
 639         uint f1regdata;         /* Number of f1 register accesses */
 640
 641         u8 *ctrl_frame_buf;
 642         u32 ctrl_frame_len;
 643         bool ctrl_frame_stat;
 644
 645         spinlock_t txqlock;
 646         wait_queue_head_t ctrl_wait;
 647
 648         struct timer_list timer;
 649         struct completion watchdog_wait;
 650         struct task_struct *watchdog_tsk;
 651         bool wd_timer_valid;
 652
 653         struct tasklet_struct tasklet;
 654         struct task_struct *dpc_tsk;
 655         struct completion dpc_wait;
 656
 657         bool threads_only;
 658         struct semaphore sdsem;
 659         spinlock_t sdlock;
 660
 661         const char *fw_name;
 662         const struct firmware *firmware;
 663         const char *nv_name;
 664         u32 fw_ptr;
 665 };
 666
 667 struct sbconfig {
 668         u32 PAD[2];
 669         u32 sbipsflag;  /* initiator port ocp slave flag */
 670         u32 PAD[3];
 671         u32 sbtpsflag;  /* target port ocp slave flag */
 672         u32 PAD[11];
 673         u32 sbtmerrloga;        /* (sonics >= 2.3) */
 674         u32 PAD;
 675         u32 sbtmerrlog; /* (sonics >= 2.3) */
 676         u32 PAD[3];
 677         u32 sbadmatch3; /* address match3 */
 678         u32 PAD;
 679         u32 sbadmatch2; /* address match2 */
 680         u32 PAD;
 681         u32 sbadmatch1; /* address match1 */
 682         u32 PAD[7];
 683         u32 sbimstate;  /* initiator agent state */
 684         u32 sbintvec;   /* interrupt mask */
 685         u32 sbtmstatelow;       /* target state */
 686         u32 sbtmstatehigh;      /* target state */
 687         u32 sbbwa0;             /* bandwidth allocation table0 */
 688         u32 PAD;
 689         u32 sbimconfiglow;      /* initiator configuration */
 690         u32 sbimconfighigh;     /* initiator configuration */
 691         u32 sbadmatch0; /* address match0 */
 692         u32 PAD;
 693         u32 sbtmconfiglow;      /* target configuration */
 694         u32 sbtmconfighigh;     /* target configuration */
 695         u32 sbbconfig;  /* broadcast configuration */
 696         u32 PAD;
 697         u32 sbbstate;   /* broadcast state */
 698         u32 PAD[3];
 699         u32 sbactcnfg;  /* activate configuration */
 700         u32 PAD[3];
 701         u32 sbflagst;   /* current sbflags */
 702         u32 PAD[3];
 703         u32 sbidlow;            /* identification */
 704         u32 sbidhigh;   /* identification */
 705 };
 706
 707 /* clkstate */
 708 #define CLK_NONE        0
 709 #define CLK_SDONLY      1
 710 #define CLK_PENDING     2       /* Not used yet */
 711 #define CLK_AVAIL       3
 712
 713 #define BRCMF_NOPMU(brcmf)      (false)
 714
 715 #ifdef BCMDBG
 716 static int qcount[NUMPRIO];
 717 static int tx_packets[NUMPRIO];
 718 #endif                          /* BCMDBG */
 719
 720 /* Deferred transmit */
 721 uint brcmf_deferred_tx = 1;
 722 module_param(brcmf_deferred_tx, uint, 0);
 723
 724 /* Watchdog thread priority, -1 to use kernel timer */
 725 int brcmf_watchdog_prio = 97;
 726 module_param(brcmf_watchdog_prio, int, 0);
 727
 728 /* Watchdog interval */
 729 uint brcmf_watchdog_ms = 10;
 730 module_param(brcmf_watchdog_ms, uint, 0);
 731
 732 /* DPC thread priority, -1 to use tasklet */
 733 int brcmf_dpc_prio = 98;
 734 module_param(brcmf_dpc_prio, int, 0);
 735
 736 #ifdef BCMDBG
 737 /* Console poll interval */
 738 uint brcmf_console_ms;
 739 module_param(brcmf_console_ms, uint, 0);
 740 #endif          /* BCMDBG */
 741
 742 /* Tx/Rx bounds */
 743 uint brcmf_txbound;
 744 uint brcmf_rxbound;
 745 uint brcmf_txminmax;
 746
 747 /* override the RAM size if possible */
 748 #define DONGLE_MIN_MEMSIZE (128 * 1024)
 749 int brcmf_dongle_memsize;
 750
 751 static bool brcmf_alignctl;
 752
 753 static bool sd1idle;
 754
 755 static bool retrydata;
 756 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
 757
 758 static const uint watermark = 8;
 759 static const uint firstread = BRCMF_FIRSTREAD;
 760
 761 /* Retry count for register access failures */
 762 static const uint retry_limit = 2;
 763
 764 /* Force even SD lengths (some host controllers mess up on odd bytes) */
 765 static bool forcealign;
 766
 767 #define ALIGNMENT  4
 768
 769 #define PKTALIGN(_p, _len, _align)                              \
 770         do {                                                            \
 771                 uint datalign;                                          \
 772                 datalign = (unsigned long)((_p)->data);                 \
 773                 datalign = roundup(datalign, (_align)) - datalign;      \
 774                 if (datalign)                                           \
 775                         skb_pull((_p), datalign);                       \
 776                 __skb_trim((_p), (_len));                               \
 777         } while (0)
 778
 779 /* Limit on rounding up frames */
 780 static const uint max_roundup = 512;
 781
 782 /* Try doing readahead */
 783 static bool brcmf_readahead;
 784
 785 /* To check if there's window offered */
 786 #define DATAOK(bus) \
 787         (((u8)(bus->tx_max - bus->tx_seq) != 0) && \
 788         (((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
 789
 790 /*
 791  * Reads a register in the SDIO hardware block. This block occupies a series of
 792  * adresses on the 32 bit backplane bus.
 793  */
 794 static void
 795 r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
 796 {
 797         *retryvar = 0;
 798         do {
 799                 *regvar = R_REG(bus->ci->buscorebase + reg_offset, u32);
 800         } while (brcmf_sdcard_regfail(bus->card) &&
 801                  (++(*retryvar) <= retry_limit));
 802         if (*retryvar) {
 803                 bus->regfails += (*retryvar-1);
 804                 if (*retryvar > retry_limit) {
 805                         BRCMF_ERROR(("FAILED READ %Xh\n", reg_offset));
 806                         *regvar = 0;
 807                 }
 808         }
 809 }
 810
 811 static void
 812 w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
 813 {
 814         *retryvar = 0;
 815         do {
 816                 brcmf_sdcard_reg_write(NULL, bus->ci->buscorebase + reg_offset,
 817                                        sizeof(u32), regval);
 818         } while (brcmf_sdcard_regfail(bus->card) &&
 819                  (++(*retryvar) <= retry_limit));
 820         if (*retryvar) {
 821                 bus->regfails += (*retryvar-1);
 822                 if (*retryvar > retry_limit)
 823                         BRCMF_ERROR(("FAILED REGISTER WRITE"
 824                                      " %Xh\n", reg_offset));
 825         }
 826 }
 827
 828 #define BRCMF_BUS                       SDIO_BUS
 829
 830 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 831
 832 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 833
 834 #ifdef SDTEST
 835 static void brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, void *pkt, uint seq);
 836 static void brcmf_sdbrcm_sdtest_set(struct brcmf_bus *bus, bool start);
 837 #endif
 838
 839 #ifdef BCMDBG
 840 static int brcmf_sdbrcm_bus_console_in(struct brcmf_pub *drvr,
 841                                        unsigned char *msg, uint msglen);
 842 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size);
 843 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus);
 844 #endif                          /* BCMDBG  */
 845 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter);
 846
 847 static void brcmf_sdbrcm_release(struct brcmf_bus *bus);
 848 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus);
 849 static void brcmf_sdbrcm_disconnect(void *ptr);
 850 static bool brcmf_sdbrcm_chipmatch(u16 chipid);
 851 static bool brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, void *card,
 852                                       u32 regsva, u16 devid);
 853 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus, void *card);
 854 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus, void *card);
 855 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus);
 856
 857 static uint brcmf_process_nvram_vars(char *varbuf, uint len);
 858
 859 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size);
 860 static int brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn,
 861                                uint flags, u8 *buf, uint nbytes,
 862                                struct sk_buff *pkt,
 863                                void (*complete)(void *handle, int status,
 864                                                       bool sync_waiting),
 865                                void *handle);
 866
 867 static bool brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus, void *card);
 868 static int  _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus);
 869
 870 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus);
 871 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus);
 872
 873 static void
 874 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_card *card, u32 corebase);
 875
 876 static int brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs);
 877
 878 static void
 879 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_card *card, u32 corebase);
 880
 881 static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
 882                                         u32 drivestrength);
 883 static void brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus);
 884 static void brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar);
 885 static void brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus);
 886 static void brcmf_sdbrcm_watchdog(unsigned long data);
 887 static int brcmf_sdbrcm_watchdog_thread(void *data);
 888 static int brcmf_sdbrcm_dpc_thread(void *data);
 889 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data);
 890 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus);
 891 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus);
 892 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus);
 893 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus);
 894
 895 /* Packet free applicable unconditionally for sdio and sdspi.
 896  * Conditional if bufpool was present for gspi bus.
 897  */
 898 static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
 899 {
 900         if ((bus->bus != SPI_BUS) || bus->usebufpool)
 901                 brcmu_pkt_buf_free_skb(pkt);
 902 }
 903
 904 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size)
 905 {
 906         s32 min_size = DONGLE_MIN_MEMSIZE;
 907         /* Restrict the memsize to user specified limit */
 908         BRCMF_ERROR(("user: Restrict the dongle ram size to %d, min %d\n",
 909                      brcmf_dongle_memsize, min_size));
 910         if ((brcmf_dongle_memsize > min_size) &&
 911             (brcmf_dongle_memsize < (s32) bus->orig_ramsize))
 912                 bus->ramsize = brcmf_dongle_memsize;
 913 }
 914
 915 static int brcmf_sdbrcm_set_siaddr_window(struct brcmf_bus *bus, u32 address)
 916 {
 917         int err = 0;
 918         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
 919                          (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
 920         if (!err)
 921                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
 922                                  SBSDIO_FUNC1_SBADDRMID,
 923                                  (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
 924         if (!err)
 925                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
 926                                        SBSDIO_FUNC1_SBADDRHIGH,
 927                                        (address >> 24) & SBSDIO_SBADDRHIGH_MASK,
 928                                        &err);
 929         return err;
 930 }
 931
 932 /* Turn backplane clock on or off */
 933 static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
 934 {
 935         int err;
 936         u8 clkctl, clkreq, devctl;
 937         struct brcmf_sdio_card *card;
 938
 939         BRCMF_TRACE(("%s: Enter\n", __func__));
 940
 941         clkctl = 0;
 942         card = bus->card;
 943
 944         if (on) {
 945                 /* Request HT Avail */
 946                 clkreq =
 947                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 948
 949                 if ((bus->ci->chip == BCM4329_CHIP_ID)
 950                     && (bus->ci->chiprev == 0))
 951                         clkreq |= SBSDIO_FORCE_ALP;
 952
 953                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
 954                                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 955                 if (err) {
 956                         BRCMF_ERROR(("%s: HT Avail request error: %d\n",
 957                                      __func__, err));
 958                         return -EBADE;
 959                 }
 960
 961                 if (pendok && ((bus->ci->buscoretype == PCMCIA_CORE_ID)
 962                                && (bus->ci->buscorerev == 9))) {
 963                         u32 dummy, retries;
 964                         r_sdreg32(bus, &dummy,
 965                                   offsetof(struct sdpcmd_regs, clockctlstatus),
 966                                   &retries);
 967                 }
 968
 969                 /* Check current status */
 970                 clkctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
 971                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
 972                 if (err) {
 973                         BRCMF_ERROR(("%s: HT Avail read error: %d\n",
 974                                      __func__, err));
 975                         return -EBADE;
 976                 }
 977
 978                 /* Go to pending and await interrupt if appropriate */
 979                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 980                         /* Allow only clock-available interrupt */
 981                         devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
 982                                         SBSDIO_DEVICE_CTL, &err);
 983                         if (err) {
 984                                 BRCMF_ERROR(("%s: Devctl error setting CA:"
 985                                              " %d\n", __func__, err));
 986                                 return -EBADE;
 987                         }
 988
 989                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 990                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
 991                                                SBSDIO_DEVICE_CTL, devctl, &err);
 992                         BRCMF_INFO(("CLKCTL: set PENDING\n"));
 993                         bus->clkstate = CLK_PENDING;
 994
 995                         return 0;
 996                 } else if (bus->clkstate == CLK_PENDING) {
 997                         /* Cancel CA-only interrupt filter */
 998                         devctl =
 999                             brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1000                                                   SBSDIO_DEVICE_CTL, &err);
1001                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
1002                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1003                                 SBSDIO_DEVICE_CTL, devctl, &err);
1004                 }
1005
1006                 /* Otherwise, wait here (polling) for HT Avail */
1007                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
1008                         BRCMF_SPINWAIT_SLEEP(sdioh_spinwait_sleep,
1009                                ((clkctl =
1010                                  brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1011                                          SBSDIO_FUNC1_CHIPCLKCSR,
1012                                                  &err)),
1013                                 !SBSDIO_CLKAV(clkctl, bus->alp_only)),
1014                                PMU_MAX_TRANSITION_DLY);
1015                 }
1016                 if (err) {
1017                         BRCMF_ERROR(("%s: HT Avail request error: %d\n",
1018                                      __func__, err));
1019                         return -EBADE;
1020                 }
1021                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
1022                         BRCMF_ERROR(("%s: HT Avail timeout (%d): "
1023                                      "clkctl 0x%02x\n", __func__,
1024                                      PMU_MAX_TRANSITION_DLY, clkctl));
1025                         return -EBADE;
1026                 }
1027
1028                 /* Mark clock available */
1029                 bus->clkstate = CLK_AVAIL;
1030                 BRCMF_INFO(("CLKCTL: turned ON\n"));
1031
1032 #if defined(BCMDBG)
1033                 if (bus->alp_only != true) {
1034                         if (SBSDIO_ALPONLY(clkctl)) {
1035                                 BRCMF_ERROR(("%s: HT Clock should be on.\n",
1036                                              __func__));
1037                         }
1038                 }
1039 #endif                          /* defined (BCMDBG) */
1040
1041                 bus->activity = true;
1042         } else {
1043                 clkreq = 0;
1044
1045                 if (bus->clkstate == CLK_PENDING) {
1046                         /* Cancel CA-only interrupt filter */
1047                         devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1048                                         SBSDIO_DEVICE_CTL, &err);
1049                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
1050                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1051                                 SBSDIO_DEVICE_CTL, devctl, &err);
1052                 }
1053
1054                 bus->clkstate = CLK_SDONLY;
1055                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1056                         SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
1057                 BRCMF_INFO(("CLKCTL: turned OFF\n"));
1058                 if (err) {
1059                         BRCMF_ERROR(("%s: Failed access turning clock off:"
1060                                      " %d\n", __func__, err));
1061                         return -EBADE;
1062                 }
1063         }
1064         return 0;
1065 }
1066
1067 /* Change idle/active SD state */
1068 static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
1069 {
1070         BRCMF_TRACE(("%s: Enter\n", __func__));
1071
1072         if (on)
1073                 bus->clkstate = CLK_SDONLY;
1074         else
1075                 bus->clkstate = CLK_NONE;
1076
1077         return 0;
1078 }
1079
1080 /* Transition SD and backplane clock readiness */
1081 static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
1082 {
1083 #ifdef BCMDBG
1084         uint oldstate = bus->clkstate;
1085 #endif                          /* BCMDBG */
1086
1087         BRCMF_TRACE(("%s: Enter\n", __func__));
1088
1089         /* Early exit if we're already there */
1090         if (bus->clkstate == target) {
1091                 if (target == CLK_AVAIL) {
1092                         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1093                         bus->activity = true;
1094                 }
1095                 return 0;
1096         }
1097
1098         switch (target) {
1099         case CLK_AVAIL:
1100                 /* Make sure SD clock is available */
1101                 if (bus->clkstate == CLK_NONE)
1102                         brcmf_sdbrcm_sdclk(bus, true);
1103                 /* Now request HT Avail on the backplane */
1104                 brcmf_sdbrcm_htclk(bus, true, pendok);
1105                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1106                 bus->activity = true;
1107                 break;
1108
1109         case CLK_SDONLY:
1110                 /* Remove HT request, or bring up SD clock */
1111                 if (bus->clkstate == CLK_NONE)
1112                         brcmf_sdbrcm_sdclk(bus, true);
1113                 else if (bus->clkstate == CLK_AVAIL)
1114                         brcmf_sdbrcm_htclk(bus, false, false);
1115                 else
1116                         BRCMF_ERROR(("brcmf_sdbrcm_clkctl: request for %d -> %d"
1117                                      "\n", bus->clkstate, target));
1118                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1119                 break;
1120
1121         case CLK_NONE:
1122                 /* Make sure to remove HT request */
1123                 if (bus->clkstate == CLK_AVAIL)
1124                         brcmf_sdbrcm_htclk(bus, false, false);
1125                 /* Now remove the SD clock */
1126                 brcmf_sdbrcm_sdclk(bus, false);
1127                 brcmf_sdbrcm_wd_timer(bus, 0);
1128                 break;
1129         }
1130 #ifdef BCMDBG
1131         BRCMF_INFO(("brcmf_sdbrcm_clkctl: %d -> %d\n",
1132                     oldstate, bus->clkstate));
1133 #endif                          /* BCMDBG */
1134
1135         return 0;
1136 }
1137
1138 int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
1139 {
1140         struct brcmf_sdio_card *card = bus->card;
1141         uint retries = 0;
1142
1143         BRCMF_INFO(("brcmf_sdbrcm_bussleep: request %s (currently %s)\n",
1144                     (sleep ? "SLEEP" : "WAKE"),
1145                     (bus->sleeping ? "SLEEP" : "WAKE")));
1146
1147         /* Done if we're already in the requested state */
1148         if (sleep == bus->sleeping)
1149                 return 0;
1150
1151         /* Going to sleep: set the alarm and turn off the lights... */
1152         if (sleep) {
1153                 /* Don't sleep if something is pending */
1154                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
1155                         return -EBUSY;
1156
1157                 /* Disable SDIO interrupts (no longer interested) */
1158                 brcmf_sdcard_intr_disable(bus->card);
1159
1160                 /* Make sure the controller has the bus up */
1161                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1162
1163                 /* Tell device to start using OOB wakeup */
1164                 w_sdreg32(bus, SMB_USE_OOB,
1165                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1166                 if (retries > retry_limit)
1167                         BRCMF_ERROR(("CANNOT SIGNAL CHIP, "
1168                                      "WILL NOT WAKE UP!!\n"));
1169
1170                 /* Turn off our contribution to the HT clock request */
1171                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1172
1173                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1174                         SBSDIO_FUNC1_CHIPCLKCSR,
1175                         SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
1176
1177                 /* Isolate the bus */
1178                 if (bus->ci->chip != BCM4329_CHIP_ID
1179                     && bus->ci->chip != BCM4319_CHIP_ID) {
1180                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1181                                 SBSDIO_DEVICE_CTL,
1182                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
1183                 }
1184
1185                 /* Change state */
1186                 bus->sleeping = true;
1187
1188         } else {
1189                 /* Waking up: bus power up is ok, set local state */
1190
1191                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1192                         SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
1193
1194                 /* Force pad isolation off if possible
1195                          (in case power never toggled) */
1196                 if ((bus->ci->buscoretype == PCMCIA_CORE_ID)
1197                     && (bus->ci->buscorerev >= 10))
1198                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1199                                 SBSDIO_DEVICE_CTL, 0, NULL);
1200
1201                 /* Make sure the controller has the bus up */
1202                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1203
1204                 /* Send misc interrupt to indicate OOB not needed */
1205                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
1206                           &retries);
1207                 if (retries <= retry_limit)
1208                         w_sdreg32(bus, SMB_DEV_INT,
1209                                   offsetof(struct sdpcmd_regs, tosbmailbox),
1210                                   &retries);
1211
1212                 if (retries > retry_limit)
1213                         BRCMF_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
1214
1215                 /* Make sure we have SD bus access */
1216                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1217
1218                 /* Change state */
1219                 bus->sleeping = false;
1220
1221                 /* Enable interrupts again */
1222                 if (bus->intr && (bus->drvr->busstate == BRCMF_BUS_DATA)) {
1223                         bus->intdis = false;
1224                         brcmf_sdcard_intr_enable(bus->card);
1225                 }
1226         }
1227
1228         return 0;
1229 }
1230
1231 #define BUS_WAKE(bus) \
1232         do { \
1233                 if ((bus)->sleeping) \
1234                         brcmf_sdbrcm_bussleep((bus), false); \
1235         } while (0);
1236
1237 /* Writes a HW/SW header into the packet and sends it. */
1238 /* Assumes: (a) header space already there, (b) caller holds lock */
1239 static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt, uint chan,
1240                          bool free_pkt)
1241 {
1242         int ret;
1243         u8 *frame;
1244         u16 len, pad = 0;
1245         u32 swheader;
1246         uint retries = 0;
1247         struct brcmf_sdio_card *card;
1248         struct sk_buff *new;
1249         int i;
1250
1251         BRCMF_TRACE(("%s: Enter\n", __func__));
1252
1253         card = bus->card;
1254
1255         if (bus->drvr->dongle_reset) {
1256                 ret = -EPERM;
1257                 goto done;
1258         }
1259
1260         frame = (u8 *) (pkt->data);
1261
1262         /* Add alignment padding, allocate new packet if needed */
1263         pad = ((unsigned long)frame % BRCMF_SDALIGN);
1264         if (pad) {
1265                 if (skb_headroom(pkt) < pad) {
1266                         BRCMF_INFO(("%s: insufficient headroom %d for %d pad\n",
1267                                     __func__, skb_headroom(pkt), pad));
1268                         bus->drvr->tx_realloc++;
1269                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
1270                         if (!new) {
1271                                 BRCMF_ERROR(("%s: couldn't allocate new "
1272                                              "%d-byte packet\n", __func__,
1273                                              pkt->len + BRCMF_SDALIGN));
1274                                 ret = -ENOMEM;
1275                                 goto done;
1276                         }
1277
1278                         PKTALIGN(new, pkt->len, BRCMF_SDALIGN);
1279                         memcpy(new->data, pkt->data, pkt->len);
1280                         if (free_pkt)
1281                                 brcmu_pkt_buf_free_skb(pkt);
1282                         /* free the pkt if canned one is not used */
1283                         free_pkt = true;
1284                         pkt = new;
1285                         frame = (u8 *) (pkt->data);
1286                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
1287                         pad = 0;
1288                 } else {
1289                         skb_push(pkt, pad);
1290                         frame = (u8 *) (pkt->data);
1291                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
1292                         memset(frame, 0, pad + SDPCM_HDRLEN);
1293                 }
1294         }
1295         /* precondition: pad < BRCMF_SDALIGN */
1296
1297         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1298         len = (u16) (pkt->len);
1299         *(u16 *) frame = cpu_to_le16(len);
1300         *(((u16 *) frame) + 1) = cpu_to_le16(~len);
1301
1302         /* Software tag: channel, sequence number, data offset */
1303         swheader =
1304             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1305             (((pad +
1306                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1307
1308         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1309         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1310
1311 #ifdef BCMDBG
1312         tx_packets[pkt->priority]++;
1313         if (BRCMF_BYTES_ON() &&
1314             (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
1315               (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
1316                 printk(KERN_DEBUG "Tx Frame:\n");
1317                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
1318         } else if (BRCMF_HDRS_ON()) {
1319                 printk(KERN_DEBUG "TxHdr:\n");
1320                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1321                                      frame, min_t(u16, len, 16));
1322         }
1323 #endif
1324
1325         /* Raise len to next SDIO block to eliminate tail command */
1326         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1327                 u16 pad = bus->blocksize - (len % bus->blocksize);
1328                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1329                                 len += pad;
1330         } else if (len % BRCMF_SDALIGN) {
1331                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1332         }
1333
1334         /* Some controllers have trouble with odd bytes -- round to even */
1335         if (forcealign && (len & (ALIGNMENT - 1))) {
1336                         len = roundup(len, ALIGNMENT);
1337         }
1338
1339         do {
1340                 ret = brcmf_sdbrcm_send_buf(bus, brcmf_sdcard_cur_sbwad(card),
1341                         SDIO_FUNC_2, F2SYNC, frame, len, pkt, NULL, NULL);
1342                 bus->f2txdata++;
1343
1344                 if (ret < 0) {
1345                         /* On failure, abort the command
1346                          and terminate the frame */
1347                         BRCMF_INFO(("%s: sdio error %d, abort command and "
1348                                     "terminate frame.\n", __func__, ret));
1349                         bus->tx_sderrs++;
1350
1351                         brcmf_sdcard_abort(card, SDIO_FUNC_2);
1352                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1353                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
1354                                          NULL);
1355                         bus->f1regdata++;
1356
1357                         for (i = 0; i < 3; i++) {
1358                                 u8 hi, lo;
1359                                 hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1360                                                      SBSDIO_FUNC1_WFRAMEBCHI,
1361                                                      NULL);
1362                                 lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1363                                                      SBSDIO_FUNC1_WFRAMEBCLO,
1364                                                      NULL);
1365                                 bus->f1regdata += 2;
1366                                 if ((hi == 0) && (lo == 0))
1367                                         break;
1368                         }
1369
1370                 }
1371                 if (ret == 0)
1372                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1373
1374         } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
1375
1376 done:
1377         /* restore pkt buffer pointer before calling tx complete routine */
1378         skb_pull(pkt, SDPCM_HDRLEN + pad);
1379         brcmf_sdbrcm_sdunlock(bus);
1380         brcmf_txcomplete(bus->drvr, pkt, ret != 0);
1381         brcmf_sdbrcm_sdlock(bus);
1382
1383         if (free_pkt)
1384                 brcmu_pkt_buf_free_skb(pkt);
1385
1386         return ret;
1387 }
1388
1389 int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
1390 {
1391         int ret = -EBADE;
1392         uint datalen, prec;
1393
1394         BRCMF_TRACE(("%s: Enter\n", __func__));
1395
1396         datalen = pkt->len;
1397
1398 #ifdef SDTEST
1399         /* Push the test header if doing loopback */
1400         if (bus->ext_loop) {
1401                 u8 *data;
1402                 skb_push(pkt, SDPCM_TEST_HDRLEN);
1403                 data = pkt->data;
1404                 *data++ = SDPCM_TEST_ECHOREQ;
1405                 *data++ = (u8) bus->loopid++;
1406                 *data++ = (datalen >> 0);
1407                 *data++ = (datalen >> 8);
1408                 datalen += SDPCM_TEST_HDRLEN;
1409         }
1410 #endif                          /* SDTEST */
1411
1412         /* Add space for the header */
1413         skb_push(pkt, SDPCM_HDRLEN);
1414         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
1415
1416         prec = PRIO2PREC((pkt->priority & PRIOMASK));
1417
1418         /* Check for existing queue, current flow-control,
1419                          pending event, or pending clock */
1420         if (brcmf_deferred_tx || bus->fcstate || pktq_len(&bus->txq)
1421             || bus->dpc_sched || (!DATAOK(bus))
1422             || (bus->flowcontrol & NBITVAL(prec))
1423             || (bus->clkstate != CLK_AVAIL)) {
1424                 BRCMF_TRACE(("%s: deferring pktq len %d\n", __func__,
1425                              pktq_len(&bus->txq)));
1426                 bus->fcqueued++;
1427
1428                 /* Priority based enq */
1429                 spin_lock_bh(&bus->txqlock);
1430                 if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) == false) {
1431                         skb_pull(pkt, SDPCM_HDRLEN);
1432                         brcmf_txcomplete(bus->drvr, pkt, false);
1433                         brcmu_pkt_buf_free_skb(pkt);
1434                         BRCMF_ERROR(("%s: out of bus->txq !!!\n", __func__));
1435                         ret = -ENOSR;
1436                 } else {
1437                         ret = 0;
1438                 }
1439                 spin_unlock_bh(&bus->txqlock);
1440
1441                 if (pktq_len(&bus->txq) >= TXHI)
1442                         brcmf_txflowcontrol(bus->drvr, 0, ON);
1443
1444 #ifdef BCMDBG
1445                 if (pktq_plen(&bus->txq, prec) > qcount[prec])
1446                         qcount[prec] = pktq_plen(&bus->txq, prec);
1447 #endif
1448                 /* Schedule DPC if needed to send queued packet(s) */
1449                 if (brcmf_deferred_tx && !bus->dpc_sched) {
1450                         bus->dpc_sched = true;
1451                         brcmf_sdbrcm_sched_dpc(bus);
1452                 }
1453         } else {
1454                 /* Lock: we're about to use shared data/code (and SDIO) */
1455                 brcmf_sdbrcm_sdlock(bus);
1456
1457                 /* Otherwise, send it now */
1458                 BUS_WAKE(bus);
1459                 /* Make sure back plane ht clk is on, no pending allowed */
1460                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
1461
1462 #ifndef SDTEST
1463                 BRCMF_TRACE(("%s: calling txpkt\n", __func__));
1464                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1465 #else
1466                 ret = brcmf_sdbrcm_txpkt(bus, pkt,
1467                                     (bus->ext_loop ? SDPCM_TEST_CHANNEL :
1468                                      SDPCM_DATA_CHANNEL), true);
1469 #endif
1470                 if (ret)
1471                         bus->drvr->tx_errors++;
1472                 else
1473                         bus->drvr->dstats.tx_bytes += datalen;
1474
1475                 if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
1476                     !bus->dpc_sched) {
1477                         bus->activity = false;
1478                         brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
1479                 }
1480
1481                 brcmf_sdbrcm_sdunlock(bus);
1482         }
1483
1484         return ret;
1485 }
1486
1487 static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
1488 {
1489         struct sk_buff *pkt;
1490         u32 intstatus = 0;
1491         uint retries = 0;
1492         int ret = 0, prec_out;
1493         uint cnt = 0;
1494         uint datalen;
1495         u8 tx_prec_map;
1496
1497         struct brcmf_pub *drvr = bus->drvr;
1498
1499         BRCMF_TRACE(("%s: Enter\n", __func__));
1500
1501         tx_prec_map = ~bus->flowcontrol;
1502
1503         /* Send frames until the limit or some other event */
1504         for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
1505                 spin_lock_bh(&bus->txqlock);
1506                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
1507                 if (pkt == NULL) {
1508                         spin_unlock_bh(&bus->txqlock);
1509                         break;
1510                 }
1511                 spin_unlock_bh(&bus->txqlock);
1512                 datalen = pkt->len - SDPCM_HDRLEN;
1513
1514 #ifndef SDTEST
1515                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1516 #else
1517                 ret = brcmf_sdbrcm_txpkt(bus, pkt,
1518                                     (bus->ext_loop ? SDPCM_TEST_CHANNEL :
1519                                      SDPCM_DATA_CHANNEL), true);
1520 #endif
1521                 if (ret)
1522                         bus->drvr->tx_errors++;
1523                 else
1524                         bus->drvr->dstats.tx_bytes += datalen;
1525
1526                 /* In poll mode, need to check for other events */
1527                 if (!bus->intr && cnt) {
1528                         /* Check device status, signal pending interrupt */
1529                         r_sdreg32(bus, &intstatus,
1530                                   offsetof(struct sdpcmd_regs, intstatus),
1531                                   &retries);
1532                         bus->f2txdata++;
1533                         if (brcmf_sdcard_regfail(bus->card))
1534                                 break;
1535                         if (intstatus & bus->hostintmask)
1536                                 bus->ipend = true;
1537                 }
1538         }
1539
1540         /* Deflow-control stack if needed */
1541         if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
1542             drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
1543                 brcmf_txflowcontrol(drvr, 0, OFF);
1544
1545         return cnt;
1546 }
1547
1548 int
1549 brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
1550 {
1551         u8 *frame;
1552         u16 len;
1553         u32 swheader;
1554         uint retries = 0;
1555         struct brcmf_sdio_card *card = bus->card;
1556         u8 doff = 0;
1557         int ret = -1;
1558         int i;
1559
1560         BRCMF_TRACE(("%s: Enter\n", __func__));
1561
1562         if (bus->drvr->dongle_reset)
1563                 return -EIO;
1564
1565         /* Back the pointer to make a room for bus header */
1566         frame = msg - SDPCM_HDRLEN;
1567         len = (msglen += SDPCM_HDRLEN);
1568
1569         /* Add alignment padding (optional for ctl frames) */
1570         if (brcmf_alignctl) {
1571                 doff = ((unsigned long)frame % BRCMF_SDALIGN);
1572                 if (doff) {
1573                         frame -= doff;
1574                         len += doff;
1575                         msglen += doff;
1576                         memset(frame, 0, doff + SDPCM_HDRLEN);
1577                 }
1578                 /* precondition: doff < BRCMF_SDALIGN */
1579         }
1580         doff += SDPCM_HDRLEN;
1581
1582         /* Round send length to next SDIO block */
1583         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1584                 u16 pad = bus->blocksize - (len % bus->blocksize);
1585                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1586                         len += pad;
1587         } else if (len % BRCMF_SDALIGN) {
1588                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1589         }
1590
1591         /* Satisfy length-alignment requirements */
1592         if (forcealign && (len & (ALIGNMENT - 1)))
1593                 len = roundup(len, ALIGNMENT);
1594
1595         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
1596
1597         /* Need to lock here to protect txseq and SDIO tx calls */
1598         brcmf_sdbrcm_sdlock(bus);
1599
1600         BUS_WAKE(bus);
1601
1602         /* Make sure backplane clock is on */
1603         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1604
1605         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1606         *(u16 *) frame = cpu_to_le16((u16) msglen);
1607         *(((u16 *) frame) + 1) = cpu_to_le16(~msglen);
1608
1609         /* Software tag: channel, sequence number, data offset */
1610         swheader =
1611             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
1612              SDPCM_CHANNEL_MASK)
1613             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
1614                              SDPCM_DOFFSET_MASK);
1615         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1616         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1617
1618         if (!DATAOK(bus)) {
1619                 BRCMF_INFO(("%s: No bus credit bus->tx_max %d,"
1620                             " bus->tx_seq %d\n", __func__,
1621                             bus->tx_max, bus->tx_seq));
1622                 bus->ctrl_frame_stat = true;
1623                 /* Send from dpc */
1624                 bus->ctrl_frame_buf = frame;
1625                 bus->ctrl_frame_len = len;
1626
1627                 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
1628
1629                 if (bus->ctrl_frame_stat == false) {
1630                         BRCMF_INFO(("%s: ctrl_frame_stat == false\n",
1631                                     __func__));
1632                         ret = 0;
1633                 } else {
1634                         BRCMF_INFO(("%s: ctrl_frame_stat == true\n", __func__));
1635                         ret = -1;
1636                 }
1637         }
1638
1639         if (ret == -1) {
1640 #ifdef BCMDBG
1641                 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1642                         printk(KERN_DEBUG "Tx Frame:\n");
1643                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1644                                              frame, len);
1645                 } else if (BRCMF_HDRS_ON()) {
1646                         printk(KERN_DEBUG "TxHdr:\n");
1647                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1648                                              frame, min_t(u16, len, 16));
1649                 }
1650 #endif
1651
1652                 do {
1653                         bus->ctrl_frame_stat = false;
1654                         ret = brcmf_sdbrcm_send_buf(bus,
1655                                 brcmf_sdcard_cur_sbwad(card), SDIO_FUNC_2,
1656                                 F2SYNC, frame, len, NULL, NULL, NULL);
1657
1658                         if (ret < 0) {
1659                                 /* On failure, abort the command and
1660                                  terminate the frame */
1661                                 BRCMF_INFO(("%s: sdio error %d, abort command "
1662                                             "and terminate frame.\n",
1663                                             __func__, ret));
1664                                 bus->tx_sderrs++;
1665
1666                                 brcmf_sdcard_abort(card, SDIO_FUNC_2);
1667
1668                                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1669                                                  SBSDIO_FUNC1_FRAMECTRL,
1670                                                  SFC_WF_TERM, NULL);
1671                                 bus->f1regdata++;
1672
1673                                 for (i = 0; i < 3; i++) {
1674                                         u8 hi, lo;
1675                                         hi = brcmf_sdcard_cfg_read(card,
1676                                              SDIO_FUNC_1,
1677                                              SBSDIO_FUNC1_WFRAMEBCHI,
1678                                              NULL);
1679                                         lo = brcmf_sdcard_cfg_read(card,
1680                                              SDIO_FUNC_1,
1681                                              SBSDIO_FUNC1_WFRAMEBCLO,
1682                                              NULL);
1683                                         bus->f1regdata += 2;
1684                                         if ((hi == 0) && (lo == 0))
1685                                                 break;
1686                                 }
1687
1688                         }
1689                         if (ret == 0) {
1690                                 bus->tx_seq =
1691                                     (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1692                         }
1693                 } while ((ret < 0) && retries++ < TXRETRIES);
1694         }
1695
1696         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1697                 bus->activity = false;
1698                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
1699         }
1700
1701         brcmf_sdbrcm_sdunlock(bus);
1702
1703         if (ret)
1704                 bus->drvr->tx_ctlerrs++;
1705         else
1706                 bus->drvr->tx_ctlpkts++;
1707
1708         return ret ? -EIO : 0;
1709 }
1710
1711 int brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
1712 {
1713         int timeleft;
1714         uint rxlen = 0;
1715         bool pending;
1716
1717         BRCMF_TRACE(("%s: Enter\n", __func__));
1718
1719         if (bus->drvr->dongle_reset)
1720                 return -EIO;
1721
1722         /* Wait until control frame is available */
1723         timeleft = brcmf_os_ioctl_resp_wait(bus->drvr, &bus->rxlen, &pending);
1724
1725         brcmf_sdbrcm_sdlock(bus);
1726         rxlen = bus->rxlen;
1727         memcpy(msg, bus->rxctl, min(msglen, rxlen));
1728         bus->rxlen = 0;
1729         brcmf_sdbrcm_sdunlock(bus);
1730
1731         if (rxlen) {
1732                 BRCMF_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
1733                            __func__, rxlen, msglen));
1734         } else if (timeleft == 0) {
1735                 BRCMF_ERROR(("%s: resumed on timeout\n", __func__));
1736 #ifdef BCMDBG
1737                 brcmf_sdbrcm_sdlock(bus);
1738                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
1739                 brcmf_sdbrcm_sdunlock(bus);
1740 #endif                          /* BCMDBG */
1741         } else if (pending == true) {
1742                 BRCMF_CTL(("%s: cancelled\n", __func__));
1743                 return -ERESTARTSYS;
1744         } else {
1745                 BRCMF_CTL(("%s: resumed for unknown reason?\n", __func__));
1746 #ifdef BCMDBG
1747                 brcmf_sdbrcm_sdlock(bus);
1748                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
1749                 brcmf_sdbrcm_sdunlock(bus);
1750 #endif                          /* BCMDBG */
1751         }
1752
1753         if (rxlen)
1754                 bus->drvr->rx_ctlpkts++;
1755         else
1756                 bus->drvr->rx_ctlerrs++;
1757
1758         return rxlen ? (int)rxlen : -ETIMEDOUT;
1759 }
1760
1761 /* IOVar table */
1762 enum {
1763         IOV_INTR = 1,
1764         IOV_POLLRATE,
1765         IOV_SDREG,
1766         IOV_SBREG,
1767         IOV_SDCIS,
1768         IOV_MEMBYTES,
1769         IOV_MEMSIZE,
1770 #ifdef BCMDBG
1771         IOV_CHECKDIED,
1772         IOV_CONS,
1773         IOV_DCONSOLE_POLL,
1774 #endif
1775         IOV_DOWNLOAD,
1776         IOV_FORCEEVEN,
1777         IOV_SDIOD_DRIVE,
1778         IOV_READAHEAD,
1779         IOV_SDRXCHAIN,
1780         IOV_ALIGNCTL,
1781         IOV_SDALIGN,
1782         IOV_DEVRESET,
1783         IOV_CPU,
1784 #ifdef SDTEST
1785         IOV_PKTGEN,
1786         IOV_EXTLOOP,
1787 #endif                          /* SDTEST */
1788         IOV_SPROM,
1789         IOV_TXBOUND,
1790         IOV_RXBOUND,
1791         IOV_TXMINMAX,
1792         IOV_IDLETIME,
1793         IOV_IDLECLOCK,
1794         IOV_SD1IDLE,
1795         IOV_SLEEP,
1796         IOV_WDTICK,
1797         IOV_VARS
1798 };
1799
1800 const struct brcmu_iovar brcmf_sdio_iovars[] = {
1801         {"intr", IOV_INTR, 0, IOVT_BOOL, 0},
1802         {"sleep", IOV_SLEEP, 0, IOVT_BOOL, 0},
1803         {"pollrate", IOV_POLLRATE, 0, IOVT_UINT32, 0},
1804         {"idletime", IOV_IDLETIME, 0, IOVT_INT32, 0},
1805         {"idleclock", IOV_IDLECLOCK, 0, IOVT_INT32, 0},
1806         {"sd1idle", IOV_SD1IDLE, 0, IOVT_BOOL, 0},
1807         {"membytes", IOV_MEMBYTES, 0, IOVT_BUFFER, 2 * sizeof(int)},
1808         {"memsize", IOV_MEMSIZE, 0, IOVT_UINT32, 0},
1809         {"download", IOV_DOWNLOAD, 0, IOVT_BOOL, 0},
1810         {"vars", IOV_VARS, 0, IOVT_BUFFER, 0},
1811         {"sdiod_drive", IOV_SDIOD_DRIVE, 0, IOVT_UINT32, 0},
1812         {"readahead", IOV_READAHEAD, 0, IOVT_BOOL, 0},
1813         {"sdrxchain", IOV_SDRXCHAIN, 0, IOVT_BOOL, 0},
1814         {"alignctl", IOV_ALIGNCTL, 0, IOVT_BOOL, 0},
1815         {"sdalign", IOV_SDALIGN, 0, IOVT_BOOL, 0},
1816         {"devreset", IOV_DEVRESET, 0, IOVT_BOOL, 0},
1817         {"wdtick", IOV_WDTICK, 0, IOVT_UINT32, 0},
1818 #ifdef BCMDBG
1819         {"cons", IOV_CONS, 0, IOVT_BUFFER, 0}
1820         ,
1821         {"dconpoll", IOV_DCONSOLE_POLL, 0, IOVT_UINT32, 0}
1822         ,
1823         {"sdreg", IOV_SDREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
1824         ,
1825         {"sbreg", IOV_SBREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
1826         ,
1827         {"sd_cis", IOV_SDCIS, 0, IOVT_BUFFER, BRCMF_IOCTL_MAXLEN}
1828         ,
1829         {"forcealign", IOV_FORCEEVEN, 0, IOVT_BOOL, 0}
1830         ,
1831         {"txbound", IOV_TXBOUND, 0, IOVT_UINT32, 0}
1832         ,
1833         {"rxbound", IOV_RXBOUND, 0, IOVT_UINT32, 0}
1834         ,
1835         {"txminmax", IOV_TXMINMAX, 0, IOVT_UINT32, 0}
1836         ,
1837         {"cpu", IOV_CPU, 0, IOVT_BOOL, 0}
1838         ,
1839         {"checkdied", IOV_CHECKDIED, 0, IOVT_BUFFER, 0}
1840         ,
1841 #endif                          /* BCMDBG */
1842 #ifdef SDTEST
1843         {"extloop", IOV_EXTLOOP, 0, IOVT_BOOL, 0}
1844         ,
1845         {"pktgen", IOV_PKTGEN, 0, IOVT_BUFFER, sizeof(struct brcmf_pktgen)}
1846         ,
1847 #endif                          /* SDTEST */
1848
1849         {NULL, 0, 0, 0, 0}
1850 };
1851
1852 static void
1853 brcmf_dump_pct(struct brcmu_strbuf *strbuf, char *desc, uint num, uint div)
1854 {
1855         uint q1, q2;
1856
1857         if (!div) {
1858                 brcmu_bprintf(strbuf, "%s N/A", desc);
1859         } else {
1860                 q1 = num / div;
1861                 q2 = (100 * (num - (q1 * div))) / div;
1862                 brcmu_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
1863         }
1864 }
1865
1866 void brcmf_sdbrcm_bus_dump(struct brcmf_pub *drvr, struct brcmu_strbuf *strbuf)
1867 {
1868         struct brcmf_bus *bus = drvr->bus;
1869
1870         brcmu_bprintf(strbuf, "Bus SDIO structure:\n");
1871         brcmu_bprintf(strbuf,
1872                     "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
1873                     bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
1874         brcmu_bprintf(strbuf,
1875                     "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
1876                     bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max,
1877                     bus->rxskip, bus->rxlen, bus->rx_seq);
1878         brcmu_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
1879                     bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
1880         brcmu_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
1881                     bus->pollrate, bus->pollcnt, bus->regfails);
1882
1883         brcmu_bprintf(strbuf, "\nAdditional counters:\n");
1884         brcmu_bprintf(strbuf,
1885                     "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
1886                     bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
1887                     bus->rxc_errors);
1888         brcmu_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
1889                     bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
1890         brcmu_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
1891                       bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
1892         brcmu_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
1893                     bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
1894         brcmu_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs"
1895                       " %d\n",
1896                       (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs,
1897                       bus->f2rxdata, bus->f2txdata, bus->f1regdata);
1898         {
1899                 brcmf_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->drvr->rx_packets,
1900                              (bus->f2rxhdrs + bus->f2rxdata));
1901                 brcmf_dump_pct(strbuf, ", pkts/f1sd", bus->drvr->rx_packets,
1902                              bus->f1regdata);
1903                 brcmf_dump_pct(strbuf, ", pkts/sd", bus->drvr->rx_packets,
1904                              (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
1905                 brcmf_dump_pct(strbuf, ", pkts/int", bus->drvr->rx_packets,
1906                              bus->intrcount);
1907                 brcmu_bprintf(strbuf, "\n");
1908
1909                 brcmf_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
1910                              bus->drvr->rx_packets);
1911                 brcmf_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts,
1912                              bus->rxglomframes);
1913                 brcmu_bprintf(strbuf, "\n");
1914
1915                 brcmf_dump_pct(strbuf, "Tx: pkts/f2wr", bus->drvr->tx_packets,
1916                              bus->f2txdata);
1917                 brcmf_dump_pct(strbuf, ", pkts/f1sd", bus->drvr->tx_packets,
1918                              bus->f1regdata);
1919                 brcmf_dump_pct(strbuf, ", pkts/sd", bus->drvr->tx_packets,
1920                              (bus->f2txdata + bus->f1regdata));
1921                 brcmf_dump_pct(strbuf, ", pkts/int", bus->drvr->tx_packets,
1922                              bus->intrcount);
1923                 brcmu_bprintf(strbuf, "\n");
1924
1925                 brcmf_dump_pct(strbuf, "Total: pkts/f2rw",
1926                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
1927                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
1928                 brcmf_dump_pct(strbuf, ", pkts/f1sd",
1929                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
1930                              bus->f1regdata);
1931                 brcmf_dump_pct(strbuf, ", pkts/sd",
1932                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
1933                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata +
1934                               bus->f1regdata));
1935                 brcmf_dump_pct(strbuf, ", pkts/int",
1936                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
1937                              bus->intrcount);
1938                 brcmu_bprintf(strbuf, "\n\n");
1939         }
1940
1941 #ifdef SDTEST
1942         if (bus->pktgen_count) {
1943                 brcmu_bprintf(strbuf, "pktgen config and count:\n");
1944                 brcmu_bprintf(strbuf,
1945                             "freq %d count %d print %d total %d min %d len %d\n",
1946                             bus->pktgen_freq, bus->pktgen_count,
1947                             bus->pktgen_print, bus->pktgen_total,
1948                             bus->pktgen_minlen, bus->pktgen_maxlen);
1949                 brcmu_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
1950                             bus->pktgen_sent, bus->pktgen_rcvd,
1951                             bus->pktgen_fail);
1952         }
1953 #endif                          /* SDTEST */
1954 #ifdef BCMDBG
1955         brcmu_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
1956                       bus->dpc_sched, " not ");
1957         brcmu_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize,
1958                     bus->roundup);
1959 #endif                          /* BCMDBG */
1960         brcmu_bprintf(strbuf,
1961                     "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
1962                     bus->clkstate, bus->activity, bus->idletime, bus->idlecount,
1963                     bus->sleeping);
1964 }
1965
1966 void brcmf_bus_clearcounts(struct brcmf_pub *drvr)
1967 {
1968         struct brcmf_bus *bus = (struct brcmf_bus *) drvr->bus;
1969
1970         bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
1971         bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
1972         bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
1973         bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
1974         bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
1975         bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
1976 }
1977
1978 #ifdef SDTEST
1979 static int brcmf_sdbrcm_pktgen_get(struct brcmf_bus *bus, u8 *arg)
1980 {
1981         struct brcmf_pktgen pktgen;
1982
1983         pktgen.version = BRCMF_PKTGEN_VERSION;
1984         pktgen.freq = bus->pktgen_freq;
1985         pktgen.count = bus->pktgen_count;
1986         pktgen.print = bus->pktgen_print;
1987         pktgen.total = bus->pktgen_total;
1988         pktgen.minlen = bus->pktgen_minlen;
1989         pktgen.maxlen = bus->pktgen_maxlen;
1990         pktgen.numsent = bus->pktgen_sent;
1991         pktgen.numrcvd = bus->pktgen_rcvd;
1992         pktgen.numfail = bus->pktgen_fail;
1993         pktgen.mode = bus->pktgen_mode;
1994         pktgen.stop = bus->pktgen_stop;
1995
1996         memcpy(arg, &pktgen, sizeof(pktgen));
1997
1998         return 0;
1999 }
2000
2001 static int brcmf_sdbrcm_pktgen_set(struct brcmf_bus *bus, u8 *arg)
2002 {
2003         struct brcmf_pktgen pktgen;
2004         uint oldcnt, oldmode;
2005
2006         memcpy(&pktgen, arg, sizeof(pktgen));
2007         if (pktgen.version != BRCMF_PKTGEN_VERSION)
2008                 return -EINVAL;
2009
2010         oldcnt = bus->pktgen_count;
2011         oldmode = bus->pktgen_mode;
2012
2013         bus->pktgen_freq = pktgen.freq;
2014         bus->pktgen_count = pktgen.count;
2015         bus->pktgen_print = pktgen.print;
2016         bus->pktgen_total = pktgen.total;
2017         bus->pktgen_minlen = pktgen.minlen;
2018         bus->pktgen_maxlen = pktgen.maxlen;
2019         bus->pktgen_mode = pktgen.mode;
2020         bus->pktgen_stop = pktgen.stop;
2021
2022         bus->pktgen_tick = bus->pktgen_ptick = 0;
2023         bus->pktgen_len = max(bus->pktgen_len, bus->pktgen_minlen);
2024         bus->pktgen_len = min(bus->pktgen_len, bus->pktgen_maxlen);
2025
2026         /* Clear counts for a new pktgen (mode change, or was stopped) */
2027         if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
2028                 bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
2029
2030         return 0;
2031 }
2032 #endif                          /* SDTEST */
2033
2034 static int
2035 brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
2036                  uint size)
2037 {
2038         int bcmerror = 0;
2039         u32 sdaddr;
2040         uint dsize;
2041
2042         /* Determine initial transfer parameters */
2043         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2044         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2045                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2046         else
2047                 dsize = size;
2048
2049         /* Set the backplane window to include the start address */
2050         bcmerror = brcmf_sdbrcm_set_siaddr_window(bus, address);
2051         if (bcmerror) {
2052                 BRCMF_ERROR(("%s: window change failed\n", __func__));
2053                 goto xfer_done;
2054         }
2055
2056         /* Do the transfer(s) */
2057         while (size) {
2058                 BRCMF_INFO(("%s: %s %d bytes at offset 0x%08x in window"
2059                             " 0x%08x\n", __func__, (write ? "write" : "read"),
2060                             dsize, sdaddr, (address & SBSDIO_SBWINDOW_MASK)));
2061                 bcmerror =
2062                      brcmf_sdcard_rwdata(bus->card, write, sdaddr, data, dsize);
2063                 if (bcmerror) {
2064                         BRCMF_ERROR(("%s: membytes transfer failed\n",
2065                                      __func__));
2066                         break;
2067                 }
2068
2069                 /* Adjust for next transfer (if any) */
2070                 size -= dsize;
2071                 if (size) {
2072                         data += dsize;
2073                         address += dsize;
2074                         bcmerror = brcmf_sdbrcm_set_siaddr_window(bus, address);
2075                         if (bcmerror) {
2076                                 BRCMF_ERROR(("%s: window change failed\n",
2077                                              __func__));
2078                                 break;
2079                         }
2080                         sdaddr = 0;
2081                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2082                 }
2083         }
2084
2085 xfer_done:
2086         /* Return the window to backplane enumeration space for core access */
2087         if (brcmf_sdbrcm_set_siaddr_window(bus,
2088                                            brcmf_sdcard_cur_sbwad(bus->card))) {
2089                 BRCMF_ERROR(("%s: FAILED to set window back to 0x%x\n",
2090                              __func__, brcmf_sdcard_cur_sbwad(bus->card)));
2091         }
2092
2093         return bcmerror;
2094 }
2095
2096 #ifdef BCMDBG
2097 static int brcmf_sdbrcm_readshared(struct brcmf_bus *bus, struct sdpcm_shared *sh)
2098 {
2099         u32 addr;
2100         int rv;
2101
2102         /* Read last word in memory to determine address of
2103                          sdpcm_shared structure */
2104         rv = brcmf_sdbrcm_membytes(bus, false, bus->ramsize - 4, (u8 *)&addr,
2105                                    4);
2106         if (rv < 0)
2107                 return rv;
2108
2109         addr = le32_to_cpu(addr);
2110
2111         BRCMF_INFO(("sdpcm_shared address 0x%08X\n", addr));
2112
2113         /*
2114          * Check if addr is valid.
2115          * NVRAM length at the end of memory should have been overwritten.
2116          */
2117         if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
2118                 BRCMF_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n",
2119                              __func__, addr));
2120                 return -EBADE;
2121         }
2122
2123         /* Read rte_shared structure */
2124         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *) sh,
2125                               sizeof(struct sdpcm_shared));
2126         if (rv < 0)
2127                 return rv;
2128
2129         /* Endianness */
2130         sh->flags = le32_to_cpu(sh->flags);
2131         sh->trap_addr = le32_to_cpu(sh->trap_addr);
2132         sh->assert_exp_addr = le32_to_cpu(sh->assert_exp_addr);
2133         sh->assert_file_addr = le32_to_cpu(sh->assert_file_addr);
2134         sh->assert_line = le32_to_cpu(sh->assert_line);
2135         sh->console_addr = le32_to_cpu(sh->console_addr);
2136         sh->msgtrace_addr = le32_to_cpu(sh->msgtrace_addr);
2137
2138         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
2139                 BRCMF_ERROR(("%s: sdpcm_shared version %d in brcmf "
2140                              "is different than sdpcm_shared version %d in dongle\n",
2141                              __func__, SDPCM_SHARED_VERSION,
2142                              sh->flags & SDPCM_SHARED_VERSION_MASK));
2143                 return -EBADE;
2144         }
2145
2146         return 0;
2147 }
2148
2149 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size)
2150 {
2151         int bcmerror = 0;
2152         uint msize = 512;
2153         char *mbuffer = NULL;
2154         uint maxstrlen = 256;
2155         char *str = NULL;
2156         struct brcmf_trap tr;
2157         struct sdpcm_shared sdpcm_shared;
2158         struct brcmu_strbuf strbuf;
2159
2160         BRCMF_TRACE(("%s: Enter\n", __func__));
2161
2162         if (data == NULL) {
2163                 /*
2164                  * Called after a rx ctrl timeout. "data" is NULL.
2165                  * allocate memory to trace the trap or assert.
2166                  */
2167                 size = msize;
2168                 mbuffer = data = kmalloc(msize, GFP_ATOMIC);
2169                 if (mbuffer == NULL) {
2170                         BRCMF_ERROR(("%s: kmalloc(%d) failed\n", __func__,
2171                                      msize));
2172                         bcmerror = -ENOMEM;
2173                         goto done;
2174                 }
2175         }
2176
2177         str = kmalloc(maxstrlen, GFP_ATOMIC);
2178         if (str == NULL) {
2179                 BRCMF_ERROR(("%s: kmalloc(%d) failed\n", __func__, maxstrlen));
2180                 bcmerror = -ENOMEM;
2181                 goto done;
2182         }
2183
2184         bcmerror = brcmf_sdbrcm_readshared(bus, &sdpcm_shared);
2185         if (bcmerror < 0)
2186                 goto done;
2187
2188         brcmu_binit(&strbuf, data, size);
2189
2190         brcmu_bprintf(&strbuf,
2191                     "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
2192                     sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
2193
2194         if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
2195                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
2196                  * (Avoids conflict with real asserts for programmatic
2197                  * parsing of output.)
2198                  */
2199                 brcmu_bprintf(&strbuf, "Assrt not built in dongle\n");
2200         }
2201
2202         if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) ==
2203             0) {
2204                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
2205                  * (Avoids conflict with real asserts for programmatic
2206                  * parsing of output.)
2207                  */
2208                 brcmu_bprintf(&strbuf, "No trap%s in dongle",
2209                             (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
2210                             ? "/assrt" : "");
2211         } else {
2212                 if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
2213                         /* Download assert */
2214                         brcmu_bprintf(&strbuf, "Dongle assert");
2215                         if (sdpcm_shared.assert_exp_addr != 0) {
2216                                 str[0] = '\0';
2217                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
2218                                                 sdpcm_shared.assert_exp_addr,
2219                                                 (u8 *) str, maxstrlen);
2220                                 if (bcmerror < 0)
2221                                         goto done;
2222
2223                                 str[maxstrlen - 1] = '\0';
2224                                 brcmu_bprintf(&strbuf, " expr \"%s\"", str);
2225                         }
2226
2227                         if (sdpcm_shared.assert_file_addr != 0) {
2228                                 str[0] = '\0';
2229                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
2230                                                 sdpcm_shared.assert_file_addr,
2231                                                 (u8 *) str, maxstrlen);
2232                                 if (bcmerror < 0)
2233                                         goto done;
2234
2235                                 str[maxstrlen - 1] = '\0';
2236                                 brcmu_bprintf(&strbuf, " file \"%s\"", str);
2237                         }
2238
2239                         brcmu_bprintf(&strbuf, " line %d ",
2240                                     sdpcm_shared.assert_line);
2241                 }
2242
2243                 if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
2244                         bcmerror = brcmf_sdbrcm_membytes(bus, false,
2245                                         sdpcm_shared.trap_addr, (u8 *)&tr,
2246                                         sizeof(struct brcmf_trap));
2247                         if (bcmerror < 0)
2248                                 goto done;
2249
2250                         brcmu_bprintf(&strbuf,
2251                                     "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
2252                                     "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
2253                                     "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n",
2254                                     tr.type, tr.epc, tr.cpsr, tr.spsr, tr.r13,
2255                                     tr.r14, tr.pc, sdpcm_shared.trap_addr,
2256                                     tr.r0, tr.r1, tr.r2, tr.r3, tr.r4, tr.r5,
2257                                     tr.r6, tr.r7);
2258                 }
2259         }
2260
2261         if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP))
2262                 BRCMF_ERROR(("%s: %s\n", __func__, strbuf.origbuf));
2263
2264 #ifdef BCMDBG
2265         if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
2266                 /* Mem dump to a file on device */
2267                 brcmf_sdbrcm_mem_dump(bus);
2268         }
2269 #endif                          /* BCMDBG */
2270
2271 done:
2272         kfree(mbuffer);
2273         kfree(str);
2274
2275         return bcmerror;
2276 }
2277
2278 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus)
2279 {
2280         int ret = 0;
2281         int size;               /* Full mem size */
2282         int start = 0;          /* Start address */
2283         int read_size = 0;      /* Read size of each iteration */
2284         u8 *buf = NULL, *databuf = NULL;
2285
2286         /* Get full mem size */
2287         size = bus->ramsize;
2288         buf = kmalloc(size, GFP_ATOMIC);
2289         if (!buf) {
2290                 BRCMF_ERROR(("%s: Out of memory (%d bytes)\n", __func__, size));
2291                 return -1;
2292         }
2293
2294         /* Read mem content */
2295         printk(KERN_DEBUG "Dump dongle memory");
2296         databuf = buf;
2297         while (size) {
2298                 read_size = min(MEMBLOCK, size);
2299                 ret = brcmf_sdbrcm_membytes(bus, false, start, databuf,
2300                                           read_size);
2301                 if (ret) {
2302                         BRCMF_ERROR(("%s: Error membytes %d\n", __func__, ret));
2303                         kfree(buf);
2304                         return -1;
2305                 }
2306                 printk(".");
2307
2308                 /* Decrement size and increment start address */
2309                 size -= read_size;
2310                 start += read_size;
2311                 databuf += read_size;
2312         }
2313         printk(KERN_DEBUG "Done\n");
2314
2315         /* free buf before return !!! */
2316         if (brcmf_write_to_file(bus->drvr, buf, bus->ramsize)) {
2317                 BRCMF_ERROR(("%s: Error writing to files\n", __func__));
2318                 return -1;
2319         }
2320
2321         /* buf free handled in brcmf_write_to_file, not here */
2322         return 0;
2323 }
2324
2325 #define CONSOLE_LINE_MAX        192
2326
2327 static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
2328 {
2329         struct brcmf_console *c = &bus->console;
2330         u8 line[CONSOLE_LINE_MAX], ch;
2331         u32 n, idx, addr;
2332         int rv;
2333
2334         /* Don't do anything until FWREADY updates console address */
2335         if (bus->console_addr == 0)
2336                 return 0;
2337
2338         /* Read console log struct */
2339         addr = bus->console_addr + offsetof(struct rte_console, log);
2340         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log,
2341                                 sizeof(c->log));
2342         if (rv < 0)
2343                 return rv;
2344
2345         /* Allocate console buffer (one time only) */
2346         if (c->buf == NULL) {
2347                 c->bufsize = le32_to_cpu(c->log.buf_size);
2348                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2349                 if (c->buf == NULL)
2350                         return -ENOMEM;
2351         }
2352
2353         idx = le32_to_cpu(c->log.idx);
2354
2355         /* Protect against corrupt value */
2356         if (idx > c->bufsize)
2357                 return -EBADE;
2358
2359         /* Skip reading the console buffer if the index pointer
2360          has not moved */
2361         if (idx == c->last)
2362                 return 0;
2363
2364         /* Read the console buffer */
2365         addr = le32_to_cpu(c->log.buf);
2366         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2367         if (rv < 0)
2368                 return rv;
2369
2370         while (c->last != idx) {
2371                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2372                         if (c->last == idx) {
2373                                 /* This would output a partial line.
2374                                  * Instead, back up
2375                                  * the buffer pointer and output this
2376                                  * line next time around.
2377                                  */
2378                                 if (c->last >= n)
2379                                         c->last -= n;
2380                                 else
2381                                         c->last = c->bufsize - n;
2382                                 goto break2;
2383                         }
2384                         ch = c->buf[c->last];
2385                         c->last = (c->last + 1) % c->bufsize;
2386                         if (ch == '\n')
2387                                 break;
2388                         line[n] = ch;
2389                 }
2390
2391                 if (n > 0) {
2392                         if (line[n - 1] == '\r')
2393                                 n--;
2394                         line[n] = 0;
2395                         printk(KERN_DEBUG "CONSOLE: %s\n", line);
2396                 }
2397         }
2398 break2:
2399
2400         return 0;
2401 }
2402 #endif                          /* BCMDBG */
2403
2404 int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
2405 {
2406         int bcmerror = 0;
2407
2408         BRCMF_TRACE(("%s: Enter\n", __func__));
2409
2410         /* Basic sanity checks */
2411         if (bus->drvr->up) {
2412                 bcmerror = -EISCONN;
2413                 goto err;
2414         }
2415         if (!len) {
2416                 bcmerror = -EOVERFLOW;
2417                 goto err;
2418         }
2419
2420         /* Free the old ones and replace with passed variables */
2421         kfree(bus->vars);
2422
2423         bus->vars = kmalloc(len, GFP_ATOMIC);
2424         bus->varsz = bus->vars ? len : 0;
2425         if (bus->vars == NULL) {
2426                 bcmerror = -ENOMEM;
2427                 goto err;
2428         }
2429
2430         /* Copy the passed variables, which should include the
2431                  terminating double-null */
2432         memcpy(bus->vars, arg, bus->varsz);
2433 err:
2434         return bcmerror;
2435 }
2436
2437 static int
2438 brcmf_sdbrcm_doiovar(struct brcmf_bus *bus, const struct brcmu_iovar *vi, u32 actionid,
2439                 const char *name, void *params, int plen, void *arg, int len,
2440                 int val_size)
2441 {
2442         int bcmerror = 0;
2443         s32 int_val = 0;
2444         bool bool_val = 0;
2445
2446         BRCMF_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p "
2447                      "len %d val_size %d\n", __func__, actionid, name, params,
2448                      plen, arg, len, val_size));
2449
2450         bcmerror = brcmu_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid));
2451         if (bcmerror != 0)
2452                 goto exit;
2453
2454         if (plen >= (int)sizeof(int_val))
2455                 memcpy(&int_val, params, sizeof(int_val));
2456
2457         bool_val = (int_val != 0) ? true : false;
2458
2459         /* Some ioctls use the bus */
2460         brcmf_sdbrcm_sdlock(bus);
2461
2462         /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
2463         if (bus->drvr->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
2464                                         actionid == IOV_GVAL(IOV_DEVRESET))) {
2465                 bcmerror = -EPERM;
2466                 goto exit;
2467         }
2468
2469         /* Handle sleep stuff before any clock mucking */
2470         if (vi->varid == IOV_SLEEP) {
2471                 if (IOV_ISSET(actionid)) {
2472                         bcmerror = brcmf_sdbrcm_bussleep(bus, bool_val);
2473                 } else {
2474                         int_val = (s32) bus->sleeping;
2475                         memcpy(arg, &int_val, val_size);
2476                 }
2477                 goto exit;
2478         }
2479
2480         /* Request clock to allow SDIO accesses */
2481         if (!bus->drvr->dongle_reset) {
2482                 BUS_WAKE(bus);
2483                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2484         }
2485
2486         switch (actionid) {
2487         case IOV_GVAL(IOV_INTR):
2488                 int_val = (s32) bus->intr;
2489                 memcpy(arg, &int_val, val_size);
2490                 break;
2491
2492         case IOV_SVAL(IOV_INTR):
2493                 bus->intr = bool_val;
2494                 bus->intdis = false;
2495                 if (bus->drvr->up) {
2496                         BRCMF_INTR(("%s: %s SDIO interrupts\n", __func__,
2497                                     bus->intr ? "enable" : "disable"));
2498                         if (bus->intr) {
2499                                 brcmf_sdcard_intr_enable(bus->card);
2500                         } else {
2501                                 brcmf_sdcard_intr_disable(bus->card);
2502                         }
2503                 }
2504                 break;
2505
2506         case IOV_GVAL(IOV_POLLRATE):
2507                 int_val = (s32) bus->pollrate;
2508                 memcpy(arg, &int_val, val_size);
2509                 break;
2510
2511         case IOV_SVAL(IOV_POLLRATE):
2512                 bus->pollrate = (uint) int_val;
2513                 bus->poll = (bus->pollrate != 0);
2514                 break;
2515
2516         case IOV_GVAL(IOV_IDLETIME):
2517                 int_val = bus->idletime;
2518                 memcpy(arg, &int_val, val_size);
2519                 break;
2520
2521         case IOV_SVAL(IOV_IDLETIME):
2522                 if ((int_val < 0) && (int_val != BRCMF_IDLE_IMMEDIATE))
2523                         bcmerror = -EINVAL;
2524                 else
2525                         bus->idletime = int_val;
2526                 break;
2527
2528         case IOV_GVAL(IOV_IDLECLOCK):
2529                 int_val = (s32) bus->idleclock;
2530                 memcpy(arg, &int_val, val_size);
2531                 break;
2532
2533         case IOV_SVAL(IOV_IDLECLOCK):
2534                 bus->idleclock = int_val;
2535                 break;
2536
2537         case IOV_GVAL(IOV_SD1IDLE):
2538                 int_val = (s32) sd1idle;
2539                 memcpy(arg, &int_val, val_size);
2540                 break;
2541
2542         case IOV_SVAL(IOV_SD1IDLE):
2543                 sd1idle = bool_val;
2544                 break;
2545
2546         case IOV_SVAL(IOV_MEMBYTES):
2547         case IOV_GVAL(IOV_MEMBYTES):
2548                 {
2549                         u32 address;
2550                         uint size, dsize;
2551                         u8 *data;
2552
2553                         bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
2554
2555                         address = (u32) int_val;
2556                         memcpy(&int_val, (char *)params + sizeof(int_val),
2557                                sizeof(int_val));
2558                         size = (uint) int_val;
2559
2560                         /* Do some validation */
2561                         dsize = set ? plen - (2 * sizeof(int)) : len;
2562                         if (dsize < size) {
2563                                 BRCMF_ERROR(("%s: error on %s membytes, addr "
2564                                              "0x%08x size %d dsize %d\n",
2565                                              __func__, (set ? "set" : "get"),
2566                                              address, size, dsize));
2567                                 bcmerror = -EINVAL;
2568                                 break;
2569                         }
2570
2571                         BRCMF_INFO(("%s: Request to %s %d bytes at address "
2572                                     "0x%08x\n", __func__,
2573                                     (set ? "write" : "read"), size, address));
2574
2575                         /* If we know about SOCRAM, check for a fit */
2576                         if ((bus->orig_ramsize) &&
2577                             ((address > bus->orig_ramsize)
2578                              || (address + size > bus->orig_ramsize))) {
2579                                 BRCMF_ERROR(("%s: ramsize 0x%08x doesn't have"
2580                                              " %d bytes at 0x%08x\n", __func__,
2581                                              bus->orig_ramsize, size, address));
2582                                 bcmerror = -EINVAL;
2583                                 break;
2584                         }
2585
2586                         /* Generate the actual data pointer */
2587                         data =
2588                             set ? (u8 *) params +
2589                             2 * sizeof(int) : (u8 *) arg;
2590
2591                         /* Call to do the transfer */
2592                         bcmerror = brcmf_sdbrcm_membytes(bus, set, address,
2593                                                          data, size);
2594
2595                         break;
2596                 }
2597
2598         case IOV_GVAL(IOV_MEMSIZE):
2599                 int_val = (s32) bus->ramsize;
2600                 memcpy(arg, &int_val, val_size);
2601                 break;
2602
2603         case IOV_GVAL(IOV_SDIOD_DRIVE):
2604                 int_val = (s32) brcmf_sdiod_drive_strength;
2605                 memcpy(arg, &int_val, val_size);
2606                 break;
2607
2608         case IOV_SVAL(IOV_SDIOD_DRIVE):
2609                 brcmf_sdiod_drive_strength = int_val;
2610                 brcmf_sdbrcm_sdiod_drive_strength_init(bus,
2611                                              brcmf_sdiod_drive_strength);
2612                 break;
2613
2614         case IOV_SVAL(IOV_DOWNLOAD):
2615                 bcmerror = brcmf_sdbrcm_download_state(bus, bool_val);
2616                 break;
2617
2618         case IOV_SVAL(IOV_VARS):
2619                 bcmerror = brcmf_sdbrcm_downloadvars(bus, arg, len);
2620                 break;
2621
2622         case IOV_GVAL(IOV_READAHEAD):
2623                 int_val = (s32) brcmf_readahead;
2624                 memcpy(arg, &int_val, val_size);
2625                 break;
2626
2627         case IOV_SVAL(IOV_READAHEAD):
2628                 if (bool_val && !brcmf_readahead)
2629                         bus->nextlen = 0;
2630                 brcmf_readahead = bool_val;
2631                 break;
2632
2633         case IOV_GVAL(IOV_SDRXCHAIN):
2634                 int_val = (s32) bus->use_rxchain;
2635                 memcpy(arg, &int_val, val_size);
2636                 break;
2637
2638         case IOV_SVAL(IOV_SDRXCHAIN):
2639                 if (bool_val && !bus->sd_rxchain)
2640                         bcmerror = -ENOTSUPP;
2641                 else
2642                         bus->use_rxchain = bool_val;
2643                 break;
2644         case IOV_GVAL(IOV_ALIGNCTL):
2645                 int_val = (s32) brcmf_alignctl;
2646                 memcpy(arg, &int_val, val_size);
2647                 break;
2648
2649         case IOV_SVAL(IOV_ALIGNCTL):
2650                 brcmf_alignctl = bool_val;
2651                 break;
2652
2653         case IOV_GVAL(IOV_SDALIGN):
2654                 int_val = BRCMF_SDALIGN;
2655                 memcpy(arg, &int_val, val_size);
2656                 break;
2657
2658 #ifdef BCMDBG
2659         case IOV_GVAL(IOV_VARS):
2660                 if (bus->varsz < (uint) len)
2661                         memcpy(arg, bus->vars, bus->varsz);
2662                 else
2663                         bcmerror = -EOVERFLOW;
2664                 break;
2665 #endif                          /* BCMDBG */
2666
2667 #ifdef BCMDBG
2668         case IOV_GVAL(IOV_DCONSOLE_POLL):
2669                 int_val = (s32) brcmf_console_ms;
2670                 memcpy(arg, &int_val, val_size);
2671                 break;
2672
2673         case IOV_SVAL(IOV_DCONSOLE_POLL):
2674                 brcmf_console_ms = (uint) int_val;
2675                 break;
2676
2677         case IOV_SVAL(IOV_CONS):
2678                 if (len > 0)
2679                         bcmerror = brcmf_sdbrcm_bus_console_in(bus->drvr,
2680                                                                arg, len - 1);
2681                 break;
2682
2683         case IOV_GVAL(IOV_SDREG):
2684                 {
2685                         struct brcmf_sdreg *sd_ptr;
2686                         u32 addr, size;
2687
2688                         sd_ptr = (struct brcmf_sdreg *) params;
2689
2690                         addr = bus->ci->buscorebase + sd_ptr->offset;
2691                         size = sd_ptr->func;
2692                         int_val = (s32) brcmf_sdcard_reg_read(bus->card, addr,
2693                                                               size);
2694                         if (brcmf_sdcard_regfail(bus->card))
2695                                 bcmerror = -EIO;
2696                         memcpy(arg, &int_val, sizeof(s32));
2697                         break;
2698                 }
2699
2700         case IOV_SVAL(IOV_SDREG):
2701                 {
2702                         struct brcmf_sdreg *sd_ptr;
2703                         u32 addr, size;
2704
2705                         sd_ptr = (struct brcmf_sdreg *) params;
2706
2707                         addr = bus->ci->buscorebase + sd_ptr->offset;
2708                         size = sd_ptr->func;
2709                         brcmf_sdcard_reg_write(bus->card, addr, size,
2710                                                sd_ptr->value);
2711                         if (brcmf_sdcard_regfail(bus->card))
2712                                 bcmerror = -EIO;
2713                         break;
2714                 }
2715
2716                 /* Same as above, but offset is not backplane
2717                  (not SDIO core) */
2718         case IOV_GVAL(IOV_SBREG):
2719                 {
2720                         struct brcmf_sdreg sdreg;
2721                         u32 addr, size;
2722
2723                         memcpy(&sdreg, params, sizeof(sdreg));
2724
2725                         addr = SI_ENUM_BASE + sdreg.offset;
2726                         size = sdreg.func;
2727                         int_val = (s32) brcmf_sdcard_reg_read(bus->card, addr,
2728                                                               size);
2729                         if (brcmf_sdcard_regfail(bus->card))
2730                                 bcmerror = -EIO;
2731                         memcpy(arg, &int_val, sizeof(s32));
2732                         break;
2733                 }
2734
2735         case IOV_SVAL(IOV_SBREG):
2736                 {
2737                         struct brcmf_sdreg sdreg;
2738                         u32 addr, size;
2739
2740                         memcpy(&sdreg, params, sizeof(sdreg));
2741
2742                         addr = SI_ENUM_BASE + sdreg.offset;
2743                         size = sdreg.func;
2744                         brcmf_sdcard_reg_write(bus->card, addr, size,
2745                                                sdreg.value);
2746                         if (brcmf_sdcard_regfail(bus->card))
2747                                 bcmerror = -EIO;
2748                         break;
2749                 }
2750
2751         case IOV_GVAL(IOV_SDCIS):
2752                 {
2753                         *(char *)arg = 0;
2754
2755                         strcat(arg, "\nFunc 0\n");
2756                         brcmf_sdcard_cis_read(bus->card, 0x10,
2757                                         (u8 *) arg + strlen(arg),
2758                                         SBSDIO_CIS_SIZE_LIMIT);
2759                         strcat(arg, "\nFunc 1\n");
2760                         brcmf_sdcard_cis_read(bus->card, 0x11,
2761                                         (u8 *) arg + strlen(arg),
2762                                         SBSDIO_CIS_SIZE_LIMIT);
2763                         strcat(arg, "\nFunc 2\n");
2764                         brcmf_sdcard_cis_read(bus->card, 0x12,
2765                                         (u8 *) arg + strlen(arg),
2766                                         SBSDIO_CIS_SIZE_LIMIT);
2767                         break;
2768                 }
2769
2770         case IOV_GVAL(IOV_FORCEEVEN):
2771                 int_val = (s32) forcealign;
2772                 memcpy(arg, &int_val, val_size);
2773                 break;
2774
2775         case IOV_SVAL(IOV_FORCEEVEN):
2776                 forcealign = bool_val;
2777                 break;
2778
2779         case IOV_GVAL(IOV_TXBOUND):
2780                 int_val = (s32) brcmf_txbound;
2781                 memcpy(arg, &int_val, val_size);
2782                 break;
2783
2784         case IOV_SVAL(IOV_TXBOUND):
2785                 brcmf_txbound = (uint) int_val;
2786                 break;
2787
2788         case IOV_GVAL(IOV_RXBOUND):
2789                 int_val = (s32) brcmf_rxbound;
2790                 memcpy(arg, &int_val, val_size);
2791                 break;
2792
2793         case IOV_SVAL(IOV_RXBOUND):
2794                 brcmf_rxbound = (uint) int_val;
2795                 break;
2796
2797         case IOV_GVAL(IOV_TXMINMAX):
2798                 int_val = (s32) brcmf_txminmax;
2799                 memcpy(arg, &int_val, val_size);
2800                 break;
2801
2802         case IOV_SVAL(IOV_TXMINMAX):
2803                 brcmf_txminmax = (uint) int_val;
2804                 break;
2805 #endif                          /* BCMDBG */
2806
2807 #ifdef SDTEST
2808         case IOV_GVAL(IOV_EXTLOOP):
2809                 int_val = (s32) bus->ext_loop;
2810                 memcpy(arg, &int_val, val_size);
2811                 break;
2812
2813         case IOV_SVAL(IOV_EXTLOOP):
2814                 bus->ext_loop = bool_val;
2815                 break;
2816
2817         case IOV_GVAL(IOV_PKTGEN):
2818                 bcmerror = brcmf_sdbrcm_pktgen_get(bus, arg);
2819                 break;
2820
2821         case IOV_SVAL(IOV_PKTGEN):
2822                 bcmerror = brcmf_sdbrcm_pktgen_set(bus, arg);
2823                 break;
2824 #endif                          /* SDTEST */
2825
2826         case IOV_SVAL(IOV_DEVRESET):
2827                 BRCMF_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d "
2828                              "busstate=%d\n",
2829                              __func__, bool_val, bus->drvr->dongle_reset,
2830                              bus->drvr->busstate));
2831
2832                 brcmf_bus_devreset(bus->drvr, (u8) bool_val);
2833
2834                 break;
2835
2836         case IOV_GVAL(IOV_DEVRESET):
2837                 BRCMF_TRACE(("%s: Called get IOV_DEVRESET\n", __func__));
2838
2839                 /* Get its status */
2840                 int_val = (bool) bus->drvr->dongle_reset;
2841                 memcpy(arg, &int_val, val_size);
2842
2843                 break;
2844
2845         case IOV_GVAL(IOV_WDTICK):
2846                 int_val = (s32) brcmf_watchdog_ms;
2847                 memcpy(arg, &int_val, val_size);
2848                 break;
2849
2850         case IOV_SVAL(IOV_WDTICK):
2851                 if (!bus->drvr->up) {
2852                         bcmerror = -ENOLINK;
2853                         break;
2854                 }
2855                 brcmf_sdbrcm_wd_timer(bus, (uint) int_val);
2856                 break;
2857
2858         default:
2859                 bcmerror = -ENOTSUPP;
2860                 break;
2861         }
2862
2863 exit:
2864         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2865                 bus->activity = false;
2866                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2867         }
2868
2869         brcmf_sdbrcm_sdunlock(bus);
2870
2871         if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == false)
2872                 brcmf_c_preinit_ioctls(bus->drvr);
2873
2874         return bcmerror;
2875 }
2876
2877 static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
2878 {
2879         int bcmerror = 0;
2880         u32 varsize;
2881         u32 varaddr;
2882         u8 *vbuffer;
2883         u32 varsizew;
2884 #ifdef BCMDBG
2885         char *nvram_ularray;
2886 #endif                          /* BCMDBG */
2887
2888         /* Even if there are no vars are to be written, we still
2889                  need to set the ramsize. */
2890         varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
2891         varaddr = (bus->ramsize - 4) - varsize;
2892
2893         if (bus->vars) {
2894                 vbuffer = kzalloc(varsize, GFP_ATOMIC);
2895                 if (!vbuffer)
2896                         return -ENOMEM;
2897
2898                 memcpy(vbuffer, bus->vars, bus->varsz);
2899
2900                 /* Write the vars list */
2901                 bcmerror =
2902                     brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
2903 #ifdef BCMDBG
2904                 /* Verify NVRAM bytes */
2905                 BRCMF_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
2906                 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
2907                 if (!nvram_ularray)
2908                         return -ENOMEM;
2909
2910                 /* Upload image to verify downloaded contents. */
2911                 memset(nvram_ularray, 0xaa, varsize);
2912
2913                 /* Read the vars list to temp buffer for comparison */
2914                 bcmerror =
2915                     brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
2916                                      varsize);
2917                 if (bcmerror) {
2918                         BRCMF_ERROR(("%s: error %d on reading %d nvram bytes"
2919                                      " at 0x%08x\n", __func__, bcmerror,
2920                                      varsize, varaddr));
2921                 }
2922                 /* Compare the org NVRAM with the one read from RAM */
2923                 if (memcmp(vbuffer, nvram_ularray, varsize)) {
2924                         BRCMF_ERROR(("%s: Downloaded NVRAM image is "
2925                                      "corrupted.\n", __func__));
2926                 } else
2927                         BRCMF_ERROR(("%s: Download/Upload/Compare of"
2928                                      " NVRAM ok.\n", __func__));
2929
2930                 kfree(nvram_ularray);
2931 #endif                          /* BCMDBG */
2932
2933                 kfree(vbuffer);
2934         }
2935
2936         /* adjust to the user specified RAM */
2937         BRCMF_INFO(("Physical memory size: %d, usable memory size: %d\n",
2938                     bus->orig_ramsize, bus->ramsize));
2939         BRCMF_INFO(("Vars are at %d, orig varsize is %d\n", varaddr, varsize));
2940         varsize = ((bus->orig_ramsize - 4) - varaddr);
2941
2942         /*
2943          * Determine the length token:
2944          * Varsize, converted to words, in lower 16-bits, checksum
2945          * in upper 16-bits.
2946          */
2947         if (bcmerror) {
2948                 varsizew = 0;
2949         } else {
2950                 varsizew = varsize / 4;
2951                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
2952                 varsizew = cpu_to_le32(varsizew);
2953         }
2954
2955         BRCMF_INFO(("New varsize is %d, length token=0x%08x\n", varsize,
2956                     varsizew));
2957
2958         /* Write the length token to the last word */
2959         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->orig_ramsize - 4),
2960                                     (u8 *)&varsizew, 4);
2961
2962         return bcmerror;
2963 }
2964
2965 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
2966 {
2967         uint retries;
2968         u32 regdata;
2969         int bcmerror = 0;
2970
2971         /* To enter download state, disable ARM and reset SOCRAM.
2972          * To exit download state, simply reset ARM (default is RAM boot).
2973          */
2974         if (enter) {
2975                 bus->alp_only = true;
2976
2977                 brcmf_sdbrcm_chip_disablecore(bus->card, bus->ci->armcorebase);
2978
2979                 brcmf_sdbrcm_chip_resetcore(bus->card, bus->ci->ramcorebase);
2980
2981                 /* Clear the top bit of memory */
2982                 if (bus->ramsize) {
2983                         u32 zeros = 0;
2984                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
2985                                          (u8 *)&zeros, 4);
2986                 }
2987         } else {
2988                 regdata = brcmf_sdcard_reg_read(bus->card,
2989                         CORE_SB(bus->ci->ramcorebase, sbtmstatelow), 4);
2990                 regdata &= (SBTML_RESET | SBTML_REJ_MASK |
2991                         (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
2992                 if ((SICF_CLOCK_EN << SBTML_SICF_SHIFT) != regdata) {
2993                         BRCMF_ERROR(("%s: SOCRAM core is down after reset?\n",
2994                                      __func__));
2995                         bcmerror = -EBADE;
2996                         goto fail;
2997                 }
2998
2999                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3000                 if (bcmerror) {
3001                         BRCMF_ERROR(("%s: no vars written to RAM\n", __func__));
3002                         bcmerror = 0;
3003                 }
3004
3005                 w_sdreg32(bus, 0xFFFFFFFF,
3006                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3007
3008                 brcmf_sdbrcm_chip_resetcore(bus->card, bus->ci->armcorebase);
3009
3010                 /* Allow HT Clock now that the ARM is running. */
3011                 bus->alp_only = false;
3012
3013                 bus->drvr->busstate = BRCMF_BUS_LOAD;
3014         }
3015 fail:
3016         return bcmerror;
3017 }
3018
3019 int
3020 brcmf_sdbrcm_bus_iovar_op(struct brcmf_pub *drvr, const char *name,
3021                           void *params, int plen, void *arg, int len, bool set)
3022 {
3023         struct brcmf_bus *bus = drvr->bus;
3024         const struct brcmu_iovar *vi = NULL;
3025         int bcmerror = 0;
3026         int val_size;
3027         u32 actionid;
3028
3029         BRCMF_TRACE(("%s: Enter\n", __func__));
3030
3031         if (name == NULL || len <= 0)
3032                 return -EINVAL;
3033
3034         /* Set does not take qualifiers */
3035         if (set && (params || plen))
3036                 return -EINVAL;
3037
3038         /* Get must have return space;*/
3039         if (!set && !(arg && len))
3040                 return -EINVAL;
3041
3042         /* Look up var locally; if not found pass to host driver */
3043         vi = brcmu_iovar_lookup(brcmf_sdio_iovars, name);
3044         if (vi == NULL) {
3045                 brcmf_sdbrcm_sdlock(bus);
3046
3047                 BUS_WAKE(bus);
3048
3049                 /* Turn on clock in case SD command needs backplane */
3050                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3051
3052                 bcmerror = brcmf_sdcard_iovar_op(bus->card, name, params, plen,
3053                                                  arg, len, set);
3054
3055                 /* Similar check for blocksize change */
3056                 if (set && strcmp(name, "sd_blocksize") == 0) {
3057                         s32 fnum = 2;
3058                         if (brcmf_sdcard_iovar_op
3059                             (bus->card, "sd_blocksize", &fnum, sizeof(s32),
3060                              &bus->blocksize, sizeof(s32),
3061                              false) != 0) {
3062                                 bus->blocksize = 0;
3063                                 BRCMF_ERROR(("%s: fail on %s get\n", __func__,
3064                                              "sd_blocksize"));
3065                         } else {
3066                                 BRCMF_INFO(("%s: noted sd_blocksize update,"
3067                                             " value now %d\n", __func__,
3068                                             bus->blocksize));
3069                         }
3070                 }
3071                 bus->roundup = min(max_roundup, bus->blocksize);
3072
3073                 if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
3074                     !bus->dpc_sched) {
3075                         bus->activity = false;
3076                         brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
3077                 }
3078
3079                 brcmf_sdbrcm_sdunlock(bus);
3080                 goto exit;
3081         }
3082
3083         BRCMF_CTL(("%s: %s %s, len %d plen %d\n", __func__,
3084                    name, (set ? "set" : "get"), len, plen));
3085
3086         /* set up 'params' pointer in case this is a set command so that
3087          * the convenience int and bool code can be common to set and get
3088          */
3089         if (params == NULL) {
3090                 params = arg;
3091                 plen = len;
3092         }
3093
3094         if (vi->type == IOVT_VOID)
3095                 val_size = 0;
3096         else if (vi->type == IOVT_BUFFER)
3097                 val_size = len;
3098         else
3099                 /* all other types are integer sized */
3100                 val_size = sizeof(int);
3101
3102         actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
3103         bcmerror = brcmf_sdbrcm_doiovar(bus, vi, actionid, name, params, plen,
3104                                         arg, len, val_size);
3105
3106 exit:
3107         return bcmerror;
3108 }
3109
3110 void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus, bool enforce_mutex)
3111 {
3112         u32 local_hostintmask;
3113         u8 saveclk;
3114         uint retries;
3115         int err;
3116
3117         BRCMF_TRACE(("%s: Enter\n", __func__));
3118
3119         if (enforce_mutex)
3120                 brcmf_sdbrcm_sdlock(bus);
3121
3122         BUS_WAKE(bus);
3123
3124         /* Enable clock for device interrupts */
3125         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3126
3127         if (bus->watchdog_tsk) {
3128                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
3129                 kthread_stop(bus->watchdog_tsk);
3130                 bus->watchdog_tsk = NULL;
3131         }
3132
3133         if (bus->dpc_tsk) {
3134                 send_sig(SIGTERM, bus->dpc_tsk, 1);
3135                 kthread_stop(bus->dpc_tsk);
3136                 bus->dpc_tsk = NULL;
3137         } else
3138                 tasklet_kill(&bus->tasklet);
3139
3140         /* Disable and clear interrupts at the chip level also */
3141         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
3142         local_hostintmask = bus->hostintmask;
3143         bus->hostintmask = 0;
3144
3145         /* Change our idea of bus state */
3146         bus->drvr->busstate = BRCMF_BUS_DOWN;
3147
3148         /* Force clocks on backplane to be sure F2 interrupt propagates */
3149         saveclk = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
3150                                         SBSDIO_FUNC1_CHIPCLKCSR, &err);
3151         if (!err) {
3152                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
3153                                        SBSDIO_FUNC1_CHIPCLKCSR,
3154                                        (saveclk | SBSDIO_FORCE_HT), &err);
3155         }
3156         if (err) {
3157                 BRCMF_ERROR(("%s: Failed to force clock for F2: err %d\n",
3158                              __func__, err));
3159         }
3160
3161         /* Turn off the bus (F2), free any pending packets */
3162         BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
3163         brcmf_sdcard_intr_disable(bus->card);
3164         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3165                          SDIO_FUNC_ENABLE_1, NULL);
3166
3167         /* Clear any pending interrupts now that F2 is disabled */
3168         w_sdreg32(bus, local_hostintmask,
3169                   offsetof(struct sdpcmd_regs, intstatus), &retries);
3170
3171         /* Turn off the backplane clock (only) */
3172         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3173
3174         /* Clear the data packet queues */
3175         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
3176
3177         /* Clear any held glomming stuff */
3178         if (bus->glomd)
3179                 brcmu_pkt_buf_free_skb(bus->glomd);
3180
3181         if (bus->glom)
3182                 brcmu_pkt_buf_free_skb(bus->glom);
3183
3184         bus->glom = bus->glomd = NULL;
3185
3186         /* Clear rx control and wake any waiters */
3187         bus->rxlen = 0;
3188         brcmf_os_ioctl_resp_wake(bus->drvr);
3189
3190         /* Reset some F2 state stuff */
3191         bus->rxskip = false;
3192         bus->tx_seq = bus->rx_seq = 0;
3193
3194         if (enforce_mutex)
3195                 brcmf_sdbrcm_sdunlock(bus);
3196 }
3197
3198 int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr, bool enforce_mutex)
3199 {
3200         struct brcmf_bus *bus = drvr->bus;
3201         struct brcmf_timeout tmo;
3202         uint retries = 0;
3203         u8 ready, enable;
3204         int err, ret = 0;
3205         u8 saveclk;
3206
3207         BRCMF_TRACE(("%s: Enter\n", __func__));
3208
3209         /* try to download image and nvram to the dongle */
3210         if (drvr->busstate == BRCMF_BUS_DOWN) {
3211                 if (!(brcmf_sdbrcm_download_firmware(bus, bus->card)))
3212                         return -1;
3213         }
3214
3215         if (!bus->drvr)
3216                 return 0;
3217
3218         /* Start the watchdog timer */
3219         bus->drvr->tickcnt = 0;
3220         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
3221
3222         if (enforce_mutex)
3223                 brcmf_sdbrcm_sdlock(bus);
3224
3225         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3226         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3227         if (bus->clkstate != CLK_AVAIL)
3228                 goto exit;
3229
3230         /* Force clocks on backplane to be sure F2 interrupt propagates */
3231         saveclk =
3232             brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
3233                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
3234         if (!err) {
3235                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
3236                                        SBSDIO_FUNC1_CHIPCLKCSR,
3237                                        (saveclk | SBSDIO_FORCE_HT), &err);
3238         }
3239         if (err) {
3240                 BRCMF_ERROR(("%s: Failed to force clock for F2: err %d\n",
3241                              __func__, err));
3242                 goto exit;
3243         }
3244
3245         /* Enable function 2 (frame transfers) */
3246         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3247                   offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
3248         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3249
3250         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx, enable,
3251                                NULL);
3252
3253         /* Give the dongle some time to do its thing and set IOR2 */
3254         brcmf_timeout_start(&tmo, BRCMF_WAIT_F2RDY * 1000);
3255
3256         ready = 0;
3257         while (ready != enable && !brcmf_timeout_expired(&tmo))
3258                 ready = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_0,
3259                                               SDIO_CCCR_IORx, NULL);
3260
3261         BRCMF_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
3262                     __func__, enable, ready, tmo.elapsed));
3263
3264         /* If F2 successfully enabled, set core and enable interrupts */
3265         if (ready == enable) {
3266                 /* Set up the interrupt mask and enable interrupts */
3267                 bus->hostintmask = HOSTINTMASK;
3268                 w_sdreg32(bus, bus->hostintmask,
3269                           offsetof(struct sdpcmd_regs, hostintmask), &retries);
3270
3271                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_WATERMARK,
3272                                  (u8) watermark, &err);
3273
3274                 /* Set bus state according to enable result */
3275                 drvr->busstate = BRCMF_BUS_DATA;
3276
3277                 bus->intdis = false;
3278                 if (bus->intr) {
3279                         BRCMF_INTR(("%s: enable SDIO device interrupts\n",
3280                                     __func__));
3281                         brcmf_sdcard_intr_enable(bus->card);
3282                 } else {
3283                         BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
3284                         brcmf_sdcard_intr_disable(bus->card);
3285                 }
3286
3287         }
3288
3289         else {
3290                 /* Disable F2 again */
3291                 enable = SDIO_FUNC_ENABLE_1;
3292                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3293                                        enable, NULL);
3294         }
3295
3296         /* Restore previous clock setting */
3297         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
3298                          saveclk, &err);
3299
3300 #if defined(OOB_INTR_ONLY)
3301         /* Host registration for OOB interrupt */
3302         if (brcmf_sdio_register_oob_intr(bus->dhd)) {
3303                 brcmf_sdbrcm_wd_timer(bus, 0);
3304                 BRCMF_ERROR(("%s Host failed to resgister for OOB\n",
3305                              __func__));
3306                 ret = -ENODEV;
3307                 goto exit;
3308         }
3309
3310         /* Enable oob at firmware */
3311         brcmf_sdbrcm_enable_oob_intr(bus, true);
3312 #endif          /* defined(OOB_INTR_ONLY) */
3313
3314         /* If we didn't come up, turn off backplane clock */
3315         if (drvr->busstate != BRCMF_BUS_DATA)
3316                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3317
3318 exit:
3319         if (enforce_mutex)
3320                 brcmf_sdbrcm_sdunlock(bus);
3321
3322         return ret;
3323 }
3324
3325 static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
3326 {
3327         struct brcmf_sdio_card *card = bus->card;
3328         uint retries = 0;
3329         u16 lastrbc;
3330         u8 hi, lo;
3331         int err;
3332
3333         BRCMF_ERROR(("%s: %sterminate frame%s\n", __func__,
3334                      (abort ? "abort command, " : ""),
3335                      (rtx ? ", send NAK" : "")));
3336
3337         if (abort)
3338                 brcmf_sdcard_abort(card, SDIO_FUNC_2);
3339
3340         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
3341                                SFC_RF_TERM, &err);
3342         bus->f1regdata++;
3343
3344         /* Wait until the packet has been flushed (device/FIFO stable) */
3345         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
3346                 hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
3347                                            SBSDIO_FUNC1_RFRAMEBCHI, NULL);
3348                 lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
3349                                            SBSDIO_FUNC1_RFRAMEBCLO, NULL);
3350                 bus->f1regdata += 2;
3351
3352                 if ((hi == 0) && (lo == 0))
3353                         break;
3354
3355                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
3356                         BRCMF_ERROR(("%s: count growing: last 0x%04x now "
3357                                      "0x%04x\n",
3358                                      __func__, lastrbc, ((hi << 8) + lo)));
3359                 }
3360                 lastrbc = (hi << 8) + lo;
3361         }
3362
3363         if (!retries) {
3364                 BRCMF_ERROR(("%s: count never zeroed: last 0x%04x\n",
3365                              __func__, lastrbc));
3366         } else {
3367                 BRCMF_INFO(("%s: flush took %d iterations\n", __func__,
3368                             (0xffff - retries)));
3369         }
3370
3371         if (rtx) {
3372                 bus->rxrtx++;
3373                 w_sdreg32(bus, SMB_NAK,
3374                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
3375
3376                 bus->f1regdata++;
3377                 if (retries <= retry_limit)
3378                         bus->rxskip = true;
3379         }
3380
3381         /* Clear partial in any case */
3382         bus->nextlen = 0;
3383
3384         /* If we can't reach the device, signal failure */
3385         if (err || brcmf_sdcard_regfail(card))
3386                 bus->drvr->busstate = BRCMF_BUS_DOWN;
3387 }
3388
3389 static void
3390 brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
3391 {
3392         struct brcmf_sdio_card *card = bus->card;
3393         uint rdlen, pad;
3394
3395         int sdret;
3396
3397         BRCMF_TRACE(("%s: Enter\n", __func__));
3398
3399         /* Control data already received in aligned rxctl */
3400         if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
3401                 goto gotpkt;
3402
3403         /* Set rxctl for frame (w/optional alignment) */
3404         bus->rxctl = bus->rxbuf;
3405         if (brcmf_alignctl) {
3406                 bus->rxctl += firstread;
3407                 pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
3408                 if (pad)
3409                         bus->rxctl += (BRCMF_SDALIGN - pad);
3410                 bus->rxctl -= firstread;
3411         }
3412
3413         /* Copy the already-read portion over */
3414         memcpy(bus->rxctl, hdr, firstread);
3415         if (len <= firstread)
3416                 goto gotpkt;
3417
3418         /* Copy the full data pkt in gSPI case and process ioctl. */
3419         if (bus->bus == SPI_BUS) {
3420                 memcpy(bus->rxctl, hdr, len);
3421                 goto gotpkt;
3422         }
3423
3424         /* Raise rdlen to next SDIO block to avoid tail command */
3425         rdlen = len - firstread;
3426         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
3427                 pad = bus->blocksize - (rdlen % bus->blocksize);
3428                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3429                     ((len + pad) < bus->drvr->maxctl))
3430                         rdlen += pad;
3431         } else if (rdlen % BRCMF_SDALIGN) {
3432                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
3433         }
3434
3435         /* Satisfy length-alignment requirements */
3436         if (forcealign && (rdlen & (ALIGNMENT - 1)))
3437                 rdlen = roundup(rdlen, ALIGNMENT);
3438
3439         /* Drop if the read is too big or it exceeds our maximum */
3440         if ((rdlen + firstread) > bus->drvr->maxctl) {
3441                 BRCMF_ERROR(("%s: %d-byte control read exceeds %d-byte"
3442                              " buffer\n", __func__, rdlen, bus->drvr->maxctl));
3443                 bus->drvr->rx_errors++;
3444                 brcmf_sdbrcm_rxfail(bus, false, false);
3445                 goto done;
3446         }
3447
3448         if ((len - doff) > bus->drvr->maxctl) {
3449                 BRCMF_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds "
3450                              "%d-byte limit\n",
3451                              __func__, len, (len - doff), bus->drvr->maxctl));
3452                 bus->drvr->rx_errors++;
3453                 bus->rx_toolong++;
3454                 brcmf_sdbrcm_rxfail(bus, false, false);
3455                 goto done;
3456         }
3457
3458         /* Read remainder of frame body into the rxctl buffer */
3459         sdret = brcmf_sdcard_recv_buf(card, brcmf_sdcard_cur_sbwad(card),
3460                                 SDIO_FUNC_2,
3461                                 F2SYNC, (bus->rxctl + firstread), rdlen,
3462                                 NULL, NULL, NULL);
3463         bus->f2rxdata++;
3464
3465         /* Control frame failures need retransmission */
3466         if (sdret < 0) {
3467                 BRCMF_ERROR(("%s: read %d control bytes failed: %d\n",
3468                              __func__, rdlen, sdret));
3469                 bus->rxc_errors++;
3470                 brcmf_sdbrcm_rxfail(bus, true, true);
3471                 goto done;
3472         }
3473
3474 gotpkt:
3475
3476 #ifdef BCMDBG
3477         if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
3478                 printk(KERN_DEBUG "RxCtrl:\n");
3479                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
3480         }
3481 #endif
3482
3483         /* Point to valid data and indicate its length */
3484         bus->rxctl += doff;
3485         bus->rxlen = len - doff;
3486
3487 done:
3488         /* Awake any waiters */
3489         brcmf_os_ioctl_resp_wake(bus->drvr);
3490 }
3491
3492 static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
3493 {
3494         u16 dlen, totlen;
3495         u8 *dptr, num = 0;
3496
3497         u16 sublen, check;
3498         struct sk_buff *pfirst, *plast, *pnext, *save_pfirst;
3499
3500         int errcode;
3501         u8 chan, seq, doff, sfdoff;
3502         u8 txmax;
3503
3504         int ifidx = 0;
3505         bool usechain = bus->use_rxchain;
3506
3507         /* If packets, issue read(s) and send up packet chain */
3508         /* Return sequence numbers consumed? */
3509
3510         BRCMF_TRACE(("brcmf_sdbrcm_rxglom: start: glomd %p glom %p\n",
3511                      bus->glomd, bus->glom));
3512
3513         /* If there's a descriptor, generate the packet chain */
3514         if (bus->glomd) {
3515                 pfirst = plast = pnext = NULL;
3516                 dlen = (u16) (bus->glomd->len);
3517                 dptr = bus->glomd->data;
3518                 if (!dlen || (dlen & 1)) {
3519                         BRCMF_ERROR(("%s: bad glomd len(%d),"
3520                                      " ignore descriptor\n",
3521                                      __func__, dlen));
3522                         dlen = 0;
3523                 }
3524
3525                 for (totlen = num = 0; dlen; num++) {
3526                         /* Get (and move past) next length */
3527                         sublen = get_unaligned_le16(dptr);
3528                         dlen -= sizeof(u16);
3529                         dptr += sizeof(u16);
3530                         if ((sublen < SDPCM_HDRLEN) ||
3531                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
3532                                 BRCMF_ERROR(("%s: descriptor len %d bad: %d\n",
3533                                              __func__, num, sublen));
3534                                 pnext = NULL;
3535                                 break;
3536                         }
3537                         if (sublen % BRCMF_SDALIGN) {
3538                                 BRCMF_ERROR(("%s: sublen %d not multiple of"
3539                                              " %d\n", __func__, sublen,
3540                                              BRCMF_SDALIGN));
3541                                 usechain = false;
3542                         }
3543                         totlen += sublen;
3544
3545                         /* For last frame, adjust read len so total
3546                                  is a block multiple */
3547                         if (!dlen) {
3548                                 sublen +=
3549                                     (roundup(totlen, bus->blocksize) - totlen);
3550                                 totlen = roundup(totlen, bus->blocksize);
3551                         }
3552
3553                         /* Allocate/chain packet for next subframe */
3554                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
3555                         if (pnext == NULL) {
3556                                 BRCMF_ERROR(("%s: bcm_pkt_buf_get_skb failed, "
3557                                              "num %d len %d\n", __func__,
3558                                              num, sublen));
3559                                 break;
3560                         }
3561                         if (!pfirst) {
3562                                 pfirst = plast = pnext;
3563                         } else {
3564                                 plast->next = pnext;
3565                                 plast = pnext;
3566                         }
3567
3568                         /* Adhere to start alignment requirements */
3569                         PKTALIGN(pnext, sublen, BRCMF_SDALIGN);
3570                 }
3571
3572                 /* If all allocations succeeded, save packet chain
3573                          in bus structure */
3574                 if (pnext) {
3575                         BRCMF_GLOM(("%s: allocated %d-byte packet chain for %d "
3576                                     "subframes\n", __func__, totlen, num));
3577                         if (BRCMF_GLOM_ON() && bus->nextlen) {
3578                                 if (totlen != bus->nextlen) {
3579                                         BRCMF_GLOM(("%s: glomdesc mismatch: "
3580                                                     "nextlen %d glomdesc %d "
3581                                                     "rxseq %d\n", __func__,
3582                                                     bus->nextlen,
3583                                                     totlen, rxseq));
3584                                 }
3585                         }
3586                         bus->glom = pfirst;
3587                         pfirst = pnext = NULL;
3588                 } else {
3589                         if (pfirst)
3590                                 brcmu_pkt_buf_free_skb(pfirst);
3591                         bus->glom = NULL;
3592                         num = 0;
3593                 }
3594
3595                 /* Done with descriptor packet */
3596                 brcmu_pkt_buf_free_skb(bus->glomd);
3597                 bus->glomd = NULL;
3598                 bus->nextlen = 0;
3599         }
3600
3601         /* Ok -- either we just generated a packet chain,
3602                  or had one from before */
3603         if (bus->glom) {
3604                 if (BRCMF_GLOM_ON()) {
3605                         BRCMF_GLOM(("%s: try superframe read, packet chain:\n",
3606                                     __func__));
3607                         for (pnext = bus->glom; pnext; pnext = pnext->next) {
3608                                 BRCMF_GLOM(("    %p: %p len 0x%04x (%d)\n",
3609                                             pnext, (u8 *) (pnext->data),
3610                                             pnext->len, pnext->len));
3611                         }
3612                 }
3613
3614                 pfirst = bus->glom;
3615                 dlen = (u16) brcmu_pkttotlen(pfirst);
3616
3617                 /* Do an SDIO read for the superframe.  Configurable iovar to
3618                  * read directly into the chained packet, or allocate a large
3619                  * packet and and copy into the chain.
3620                  */
3621                 if (usechain) {
3622                         errcode = brcmf_sdcard_recv_buf(bus->card,
3623                                         brcmf_sdcard_cur_sbwad(bus->card),
3624                                         SDIO_FUNC_2,
3625                                         F2SYNC, (u8 *) pfirst->data, dlen,
3626                                         pfirst, NULL, NULL);
3627                 } else if (bus->dataptr) {
3628                         errcode = brcmf_sdcard_recv_buf(bus->card,
3629                                         brcmf_sdcard_cur_sbwad(bus->card),
3630                                         SDIO_FUNC_2,
3631                                         F2SYNC, bus->dataptr, dlen,
3632                                         NULL, NULL, NULL);
3633                         sublen = (u16) brcmu_pktfrombuf(pfirst, 0, dlen,
3634                                                 bus->dataptr);
3635                         if (sublen != dlen) {
3636                                 BRCMF_ERROR(("%s: FAILED TO COPY, dlen %d "
3637                                              "sublen %d\n",
3638                                              __func__, dlen, sublen));
3639                                 errcode = -1;
3640                         }
3641                         pnext = NULL;
3642                 } else {
3643                         BRCMF_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, "
3644                                      "FORCE FAILURE\n", dlen));
3645                         errcode = -1;
3646                 }
3647                 bus->f2rxdata++;
3648
3649                 /* On failure, kill the superframe, allow a couple retries */
3650                 if (errcode < 0) {
3651                         BRCMF_ERROR(("%s: glom read of %d bytes failed: %d\n",
3652                                      __func__, dlen, errcode));
3653                         bus->drvr->rx_errors++;
3654
3655                         if (bus->glomerr++ < 3) {
3656                                 brcmf_sdbrcm_rxfail(bus, true, true);
3657                         } else {
3658                                 bus->glomerr = 0;
3659                                 brcmf_sdbrcm_rxfail(bus, true, false);
3660                                 brcmu_pkt_buf_free_skb(bus->glom);
3661                                 bus->rxglomfail++;
3662                                 bus->glom = NULL;
3663                         }
3664                         return 0;
3665                 }
3666 #ifdef BCMDBG
3667                 if (BRCMF_GLOM_ON()) {
3668                         printk(KERN_DEBUG "SUPERFRAME:\n");
3669                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3670                                 pfirst->data, min_t(int, pfirst->len, 48));
3671                 }
3672 #endif
3673
3674                 /* Validate the superframe header */
3675                 dptr = (u8 *) (pfirst->data);
3676                 sublen = get_unaligned_le16(dptr);
3677                 check = get_unaligned_le16(dptr + sizeof(u16));
3678
3679                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3680                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3681                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3682                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3683                         BRCMF_INFO(("%s: nextlen too large (%d) seq %d\n",
3684                                     __func__, bus->nextlen, seq));
3685                         bus->nextlen = 0;
3686                 }
3687                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3688                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3689
3690                 errcode = 0;
3691                 if ((u16)~(sublen ^ check)) {
3692                         BRCMF_ERROR(("%s (superframe): HW hdr error: len/check "
3693                                      "0x%04x/0x%04x\n", __func__, sublen,
3694                                      check));
3695                         errcode = -1;
3696                 } else if (roundup(sublen, bus->blocksize) != dlen) {
3697                         BRCMF_ERROR(("%s (superframe): len 0x%04x, rounded "
3698                                      "0x%04x, expect 0x%04x\n",
3699                                      __func__, sublen,
3700                                      roundup(sublen, bus->blocksize), dlen));
3701                         errcode = -1;
3702                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
3703                            SDPCM_GLOM_CHANNEL) {
3704                         BRCMF_ERROR(("%s (superframe): bad channel %d\n",
3705                                    __func__,
3706                                    SDPCM_PACKET_CHANNEL(&dptr
3707                                                         [SDPCM_FRAMETAG_LEN])));
3708                         errcode = -1;
3709                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
3710                         BRCMF_ERROR(("%s (superframe): got 2nd descriptor?\n",
3711                                      __func__));
3712                         errcode = -1;
3713                 } else if ((doff < SDPCM_HDRLEN) ||
3714                            (doff > (pfirst->len - SDPCM_HDRLEN))) {
3715                         BRCMF_ERROR(("%s (superframe): Bad data offset %d: "
3716                                      "HW %d pkt %d min %d\n",
3717                                      __func__, doff, sublen,
3718                                      pfirst->len, SDPCM_HDRLEN));
3719                         errcode = -1;
3720                 }
3721
3722                 /* Check sequence number of superframe SW header */
3723                 if (rxseq != seq) {
3724                         BRCMF_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
3725                                     __func__, seq, rxseq));
3726                         bus->rx_badseq++;
3727                         rxseq = seq;
3728                 }
3729
3730                 /* Check window for sanity */
3731                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
3732                         BRCMF_ERROR(("%s: unlikely tx max %d with tx_seq %d\n",
3733                                      __func__, txmax, bus->tx_seq));
3734                         txmax = bus->tx_seq + 2;
3735                 }
3736                 bus->tx_max = txmax;
3737
3738                 /* Remove superframe header, remember offset */
3739                 skb_pull(pfirst, doff);
3740                 sfdoff = doff;
3741
3742                 /* Validate all the subframe headers */
3743                 for (num = 0, pnext = pfirst; pnext && !errcode;
3744                      num++, pnext = pnext->next) {
3745                         dptr = (u8 *) (pnext->data);
3746                         dlen = (u16) (pnext->len);
3747                         sublen = get_unaligned_le16(dptr);
3748                         check = get_unaligned_le16(dptr + sizeof(u16));
3749                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3750                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3751 #ifdef BCMDBG
3752                         if (BRCMF_GLOM_ON()) {
3753                                 printk(KERN_DEBUG "subframe:\n");
3754                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3755                                                      dptr, 32);
3756                         }
3757 #endif
3758
3759                         if ((u16)~(sublen ^ check)) {
3760                                 BRCMF_ERROR(("%s (subframe %d): HW hdr error: "
3761                                              "len/check 0x%04x/0x%04x\n",
3762                                              __func__, num, sublen, check));
3763                                 errcode = -1;
3764                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
3765                                 BRCMF_ERROR(("%s (subframe %d): length mismatch"
3766                                              ": len 0x%04x, expect 0x%04x\n",
3767                                              __func__, num, sublen, dlen));
3768                                 errcode = -1;
3769                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
3770                                    (chan != SDPCM_EVENT_CHANNEL)) {
3771                                 BRCMF_ERROR(("%s (subframe %d): bad channel"
3772                                              " %d\n", __func__, num, chan));
3773                                 errcode = -1;
3774                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
3775                                 BRCMF_ERROR(("%s (subframe %d): Bad data offset"
3776                                              " %d: HW %d min %d\n",
3777                                              __func__, num, doff, sublen,
3778                                              SDPCM_HDRLEN));
3779                                 errcode = -1;
3780                         }
3781                 }
3782
3783                 if (errcode) {
3784                         /* Terminate frame on error, request
3785                                  a couple retries */
3786                         if (bus->glomerr++ < 3) {
3787                                 /* Restore superframe header space */
3788                                 skb_push(pfirst, sfdoff);
3789                                 brcmf_sdbrcm_rxfail(bus, true, true);
3790                         } else {
3791                                 bus->glomerr = 0;
3792                                 brcmf_sdbrcm_rxfail(bus, true, false);
3793                                 brcmu_pkt_buf_free_skb(bus->glom);
3794                                 bus->rxglomfail++;
3795                                 bus->glom = NULL;
3796                         }
3797                         bus->nextlen = 0;
3798                         return 0;
3799                 }
3800
3801                 /* Basic SD framing looks ok - process each packet (header) */
3802                 save_pfirst = pfirst;
3803                 bus->glom = NULL;
3804                 plast = NULL;
3805
3806                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
3807                         pnext = pfirst->next;
3808                         pfirst->next = NULL;
3809
3810                         dptr = (u8 *) (pfirst->data);
3811                         sublen = get_unaligned_le16(dptr);
3812                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3813                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3814                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3815
3816                         BRCMF_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d "
3817                                     "chan %d seq %d\n",
3818                                     __func__, num, pfirst, pfirst->data,
3819                                     pfirst->len, sublen, chan, seq));
3820
3821                         /* precondition: chan == SDPCM_DATA_CHANNEL ||
3822                                          chan == SDPCM_EVENT_CHANNEL */
3823
3824                         if (rxseq != seq) {
3825                                 BRCMF_GLOM(("%s: rx_seq %d, expected %d\n",
3826                                             __func__, seq, rxseq));
3827                                 bus->rx_badseq++;
3828                                 rxseq = seq;
3829                         }
3830 #ifdef BCMDBG
3831                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
3832                                 printk(KERN_DEBUG "Rx Subframe Data:\n");
3833                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3834                                                      dptr, dlen);
3835                         }
3836 #endif
3837
3838                         __skb_trim(pfirst, sublen);
3839                         skb_pull(pfirst, doff);
3840
3841                         if (pfirst->len == 0) {
3842                                 brcmu_pkt_buf_free_skb(pfirst);
3843                                 if (plast) {
3844                                         plast->next = pnext;
3845                                 } else {
3846                                         save_pfirst = pnext;
3847                                 }
3848                                 continue;
3849                         } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pfirst)
3850                                         != 0) {
3851                                 BRCMF_ERROR(("%s: rx protocol error\n",
3852                                              __func__));
3853                                 bus->drvr->rx_errors++;
3854                                 brcmu_pkt_buf_free_skb(pfirst);
3855                                 if (plast) {
3856                                         plast->next = pnext;
3857                                 } else {
3858                                         save_pfirst = pnext;
3859                                 }
3860                                 continue;
3861                         }
3862
3863                         /* this packet will go up, link back into
3864                                  chain and count it */
3865                         pfirst->next = pnext;
3866                         plast = pfirst;
3867                         num++;
3868
3869 #ifdef BCMDBG
3870                         if (BRCMF_GLOM_ON()) {
3871                                 BRCMF_GLOM(("%s subframe %d to stack, %p"
3872                                             "(%p/%d) nxt/lnk %p/%p\n",
3873                                             __func__, num, pfirst, pfirst->data,
3874                                             pfirst->len, pfirst->next,
3875                                             pfirst->prev));
3876                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3877                                                 pfirst->data,
3878                                                 min_t(int, pfirst->len, 32));
3879                         }
3880 #endif                          /* BCMDBG */
3881                 }
3882                 if (num) {
3883                         brcmf_sdbrcm_sdunlock(bus);
3884                         brcmf_rx_frame(bus->drvr, ifidx, save_pfirst, num);
3885                         brcmf_sdbrcm_sdlock(bus);
3886                 }
3887
3888                 bus->rxglomframes++;
3889                 bus->rxglompkts += num;
3890         }
3891         return num;
3892 }
3893
3894 /* Return true if there may be more frames to read */
3895 static uint
3896 brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
3897 {
3898         struct brcmf_sdio_card *card = bus->card;
3899
3900         u16 len, check; /* Extracted hardware header fields */
3901         u8 chan, seq, doff;     /* Extracted software header fields */
3902         u8 fcbits;              /* Extracted fcbits from software header */
3903
3904         struct sk_buff *pkt;            /* Packet for event or data frames */
3905         u16 pad;                /* Number of pad bytes to read */
3906         u16 rdlen;              /* Total number of bytes to read */
3907         u8 rxseq;               /* Next sequence number to expect */
3908         uint rxleft = 0;        /* Remaining number of frames allowed */
3909         int sdret;              /* Return code from calls */
3910         u8 txmax;               /* Maximum tx sequence offered */
3911         bool len_consistent;    /* Result of comparing readahead len and
3912                                          len from hw-hdr */
3913         u8 *rxbuf;
3914         int ifidx = 0;
3915         uint rxcount = 0;       /* Total frames read */
3916
3917 #if defined(BCMDBG) || defined(SDTEST)
3918         bool sdtest = false;    /* To limit message spew from test mode */
3919 #endif
3920
3921         BRCMF_TRACE(("%s: Enter\n", __func__));
3922
3923 #ifdef SDTEST
3924         /* Allow pktgen to override maxframes */
3925         if (bus->pktgen_count && (bus->pktgen_mode == BRCMF_PKTGEN_RECV)) {
3926                 maxframes = bus->pktgen_count;
3927                 sdtest = true;
3928         }
3929 #endif
3930
3931         /* Not finished unless we encounter no more frames indication */
3932         *finished = false;
3933
3934         for (rxseq = bus->rx_seq, rxleft = maxframes;
3935              !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
3936              rxseq++, rxleft--) {
3937
3938                 /* Handle glomming separately */
3939                 if (bus->glom || bus->glomd) {
3940                         u8 cnt;
3941                         BRCMF_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
3942                                     __func__, bus->glomd, bus->glom));
3943                         cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
3944                         BRCMF_GLOM(("%s: rxglom returned %d\n", __func__, cnt));
3945                         rxseq += cnt - 1;
3946                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
3947                         continue;
3948                 }
3949
3950                 /* Try doing single read if we can */
3951                 if (brcmf_readahead && bus->nextlen) {
3952                         u16 nextlen = bus->nextlen;
3953                         bus->nextlen = 0;
3954
3955                         if (bus->bus == SPI_BUS) {
3956                                 rdlen = len = nextlen;
3957                         } else {
3958                                 rdlen = len = nextlen << 4;
3959
3960                                 /* Pad read to blocksize for efficiency */
3961                                 if (bus->roundup && bus->blocksize
3962                                     && (rdlen > bus->blocksize)) {
3963                                         pad =
3964                                             bus->blocksize -
3965                                             (rdlen % bus->blocksize);
3966                                         if ((pad <= bus->roundup)
3967                                             && (pad < bus->blocksize)
3968                                             && ((rdlen + pad + firstread) <
3969                                                 MAX_RX_DATASZ))
3970                                                 rdlen += pad;
3971                                 } else if (rdlen % BRCMF_SDALIGN) {
3972                                         rdlen +=
3973                                             BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
3974                                 }
3975                         }
3976
3977                         /* We use bus->rxctl buffer in WinXP for initial
3978                          * control pkt receives.
3979                          * Later we use buffer-poll for data as well
3980                          * as control packets.
3981                          * This is required because dhd receives full
3982                          * frame in gSPI unlike SDIO.
3983                          * After the frame is received we have to
3984                          * distinguish whether it is data
3985                          * or non-data frame.
3986                          */
3987                         /* Allocate a packet buffer */
3988                         pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
3989                         if (!pkt) {
3990                                 if (bus->bus == SPI_BUS) {
3991                                         bus->usebufpool = false;
3992                                         bus->rxctl = bus->rxbuf;
3993                                         if (brcmf_alignctl) {
3994                                                 bus->rxctl += firstread;
3995                                                 pad = ((unsigned long)bus->rxctl %
3996                                                       BRCMF_SDALIGN);
3997                                                 if (pad)
3998                                                         bus->rxctl +=
3999                                                             (BRCMF_SDALIGN - pad);
4000                                                 bus->rxctl -= firstread;
4001                                         }
4002                                         rxbuf = bus->rxctl;
4003                                         /* Read the entire frame */
4004                                         sdret = brcmf_sdcard_recv_buf(card,
4005                                                    brcmf_sdcard_cur_sbwad(card),
4006                                                    SDIO_FUNC_2, F2SYNC,
4007                                                    rxbuf, rdlen,
4008                                                    NULL, NULL, NULL);
4009                                         bus->f2rxdata++;
4010
4011                                         /* Control frame failures need
4012                                          retransmission */
4013                                         if (sdret < 0) {
4014                                                 BRCMF_ERROR(("%s: read %d "
4015                                                              "control bytes "
4016                                                              "failed: %d\n",
4017                                                              __func__,
4018                                                              rdlen, sdret));
4019                                                 /* dhd.rx_ctlerrs is higher */
4020                                                 bus->rxc_errors++;
4021                                                 brcmf_sdbrcm_rxfail(bus, true,
4022                                                        (bus->bus ==
4023                                                         SPI_BUS) ? false
4024                                                        : true);
4025                                                 continue;
4026                                         }
4027                                 } else {
4028                                         /* Give up on data,
4029                                         request rtx of events */
4030                                         BRCMF_ERROR(("%s (nextlen): "
4031                                                      "brcmu_pkt_buf_get_skb "
4032                                                      "failed:"
4033                                                      " len %d rdlen %d expected"
4034                                                      " rxseq %d\n", __func__,
4035                                                      len, rdlen, rxseq));
4036                                         continue;
4037                                 }
4038                         } else {
4039                                 if (bus->bus == SPI_BUS)
4040                                         bus->usebufpool = true;
4041
4042                                 PKTALIGN(pkt, rdlen, BRCMF_SDALIGN);
4043                                 rxbuf = (u8 *) (pkt->data);
4044                                 /* Read the entire frame */
4045                                 sdret = brcmf_sdcard_recv_buf(card,
4046                                                 brcmf_sdcard_cur_sbwad(card),
4047                                                 SDIO_FUNC_2, F2SYNC,
4048                                                 rxbuf, rdlen,
4049                                                 pkt, NULL, NULL);
4050                                 bus->f2rxdata++;
4051
4052                                 if (sdret < 0) {
4053                                         BRCMF_ERROR(("%s (nextlen): read %d"
4054                                                      " bytes failed: %d\n",
4055                                                      __func__, rdlen, sdret));
4056                                         brcmu_pkt_buf_free_skb(pkt);
4057                                         bus->drvr->rx_errors++;
4058                                         /* Force retry w/normal header read.
4059                                          * Don't attempt NAK for
4060                                          * gSPI
4061                                          */
4062                                         brcmf_sdbrcm_rxfail(bus, true,
4063                                                        (bus->bus ==
4064                                                         SPI_BUS) ? false :
4065                                                        true);
4066                                         continue;
4067                                 }
4068                         }
4069
4070                         /* Now check the header */
4071                         memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
4072
4073                         /* Extract hardware header fields */
4074                         len = get_unaligned_le16(bus->rxhdr);
4075                         check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
4076
4077                         /* All zeros means readahead info was bad */
4078                         if (!(len | check)) {
4079                                 BRCMF_INFO(("%s (nextlen): read zeros in HW "
4080                                             "header???\n", __func__));
4081                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4082                                 continue;
4083                         }
4084
4085                         /* Validate check bytes */
4086                         if ((u16)~(len ^ check)) {
4087                                 BRCMF_ERROR(("%s (nextlen): HW hdr error:"
4088                                              " nextlen/len/check"
4089                                              " 0x%04x/0x%04x/0x%04x\n",
4090                                              __func__, nextlen, len, check));
4091                                 bus->rx_badhdr++;
4092                                 brcmf_sdbrcm_rxfail(bus, false, false);
4093                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4094                                 continue;
4095                         }
4096
4097                         /* Validate frame length */
4098                         if (len < SDPCM_HDRLEN) {
4099                                 BRCMF_ERROR(("%s (nextlen): HW hdr length "
4100                                              "invalid: %d\n", __func__, len));
4101                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4102                                 continue;
4103                         }
4104
4105                         /* Check for consistency withreadahead info */
4106                         len_consistent = (nextlen != (roundup(len, 16) >> 4));
4107                         if (len_consistent) {
4108                                 /* Mismatch, force retry w/normal
4109                                         header (may be >4K) */
4110                                 BRCMF_ERROR(("%s (nextlen): mismatch, "
4111                                              "nextlen %d len %d rnd %d; "
4112                                              "expected rxseq %d\n",
4113                                              __func__, nextlen,
4114                                              len, roundup(len, 16), rxseq));
4115                                 brcmf_sdbrcm_rxfail(bus, true,
4116                                                   bus->bus != SPI_BUS);
4117                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4118                                 continue;
4119                         }
4120
4121                         /* Extract software header fields */
4122                         chan = SDPCM_PACKET_CHANNEL(
4123                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4124                         seq = SDPCM_PACKET_SEQUENCE(
4125                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4126                         doff = SDPCM_DOFFSET_VALUE(
4127                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4128                         txmax = SDPCM_WINDOW_VALUE(
4129                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4130
4131                         bus->nextlen =
4132                             bus->rxhdr[SDPCM_FRAMETAG_LEN +
4133                                        SDPCM_NEXTLEN_OFFSET];
4134                         if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
4135                                 BRCMF_INFO(("%s (nextlen): got frame w/nextlen"
4136                                             " too large (%d), seq %d\n",
4137                                             __func__, bus->nextlen, seq));
4138                                 bus->nextlen = 0;
4139                         }
4140
4141                         bus->drvr->rx_readahead_cnt++;
4142
4143                         /* Handle Flow Control */
4144                         fcbits = SDPCM_FCMASK_VALUE(
4145                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4146
4147                         if (bus->flowcontrol != fcbits) {
4148                                 if (~bus->flowcontrol & fcbits)
4149                                         bus->fc_xoff++;
4150
4151                                 if (bus->flowcontrol & ~fcbits)
4152                                         bus->fc_xon++;
4153
4154                                 bus->fc_rcvd++;
4155                                 bus->flowcontrol = fcbits;
4156                         }
4157
4158                         /* Check and update sequence number */
4159                         if (rxseq != seq) {
4160                                 BRCMF_INFO(("%s (nextlen): rx_seq %d, expected "
4161                                             "%d\n", __func__, seq, rxseq));
4162                                 bus->rx_badseq++;
4163                                 rxseq = seq;
4164                         }
4165
4166                         /* Check window for sanity */
4167                         if ((u8) (txmax - bus->tx_seq) > 0x40) {
4168                                 BRCMF_ERROR(("%s: got unlikely tx max %d with "
4169                                              "tx_seq %d\n",
4170                                              __func__, txmax, bus->tx_seq));
4171                                 txmax = bus->tx_seq + 2;
4172                         }
4173                         bus->tx_max = txmax;
4174
4175 #ifdef BCMDBG
4176                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
4177                                 printk(KERN_DEBUG "Rx Data:\n");
4178                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4179                                                      rxbuf, len);
4180                         } else if (BRCMF_HDRS_ON()) {
4181                                 printk(KERN_DEBUG "RxHdr:\n");
4182                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4183                                                      bus->rxhdr, SDPCM_HDRLEN);
4184                         }
4185 #endif
4186
4187                         if (chan == SDPCM_CONTROL_CHANNEL) {
4188                                 if (bus->bus == SPI_BUS) {
4189                                         brcmf_sdbrcm_read_control(bus, rxbuf,
4190                                                                   len, doff);
4191                                 } else {
4192                                         BRCMF_ERROR(("%s (nextlen): readahead"
4193                                                      " on control packet %d?\n",
4194                                                      __func__, seq));
4195                                         /* Force retry w/normal header read */
4196                                         bus->nextlen = 0;
4197                                         brcmf_sdbrcm_rxfail(bus, false, true);
4198                                 }
4199                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4200                                 continue;
4201                         }
4202
4203                         if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
4204                                 BRCMF_ERROR(("Received %d bytes on %d channel."
4205                                              " Running out of " "rx pktbuf's or"
4206                                              " not yet malloced.\n",
4207                                              len, chan));
4208                                 continue;
4209                         }
4210
4211                         /* Validate data offset */
4212                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4213                                 BRCMF_ERROR(("%s (nextlen): bad data offset %d:"
4214                                              " HW len %d min %d\n", __func__,
4215                                              doff, len, SDPCM_HDRLEN));
4216                                 brcmf_sdbrcm_rxfail(bus, false, false);
4217                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4218                                 continue;
4219                         }
4220
4221                         /* All done with this one -- now deliver the packet */
4222                         goto deliver;
4223                 }
4224                 /* gSPI frames should not be handled in fractions */
4225                 if (bus->bus == SPI_BUS)
4226                         break;
4227
4228                 /* Read frame header (hardware and software) */
4229                 sdret = brcmf_sdcard_recv_buf(card,
4230                                 brcmf_sdcard_cur_sbwad(card),
4231                                 SDIO_FUNC_2, F2SYNC, bus->rxhdr, firstread,
4232                                 NULL, NULL, NULL);
4233                 bus->f2rxhdrs++;
4234
4235                 if (sdret < 0) {
4236                         BRCMF_ERROR(("%s: RXHEADER FAILED: %d\n", __func__,
4237                                      sdret));
4238                         bus->rx_hdrfail++;
4239                         brcmf_sdbrcm_rxfail(bus, true, true);
4240                         continue;
4241                 }
4242 #ifdef BCMDBG
4243                 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
4244                         printk(KERN_DEBUG "RxHdr:\n");
4245                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4246                                              bus->rxhdr, SDPCM_HDRLEN);
4247                 }
4248 #endif
4249
4250                 /* Extract hardware header fields */
4251                 len = get_unaligned_le16(bus->rxhdr);
4252                 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
4253
4254                 /* All zeros means no more frames */
4255                 if (!(len | check)) {
4256                         *finished = true;
4257                         break;
4258                 }
4259
4260                 /* Validate check bytes */
4261                 if ((u16) ~(len ^ check)) {
4262                         BRCMF_ERROR(("%s: HW hdr err: len/check "
4263                                      "0x%04x/0x%04x\n", __func__, len, check));
4264                         bus->rx_badhdr++;
4265                         brcmf_sdbrcm_rxfail(bus, false, false);
4266                         continue;
4267                 }
4268
4269                 /* Validate frame length */
4270                 if (len < SDPCM_HDRLEN) {
4271                         BRCMF_ERROR(("%s: HW hdr length invalid: %d\n",
4272                                      __func__, len));
4273                         continue;
4274                 }
4275
4276                 /* Extract software header fields */
4277                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4278                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4279                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4280                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4281
4282                 /* Validate data offset */
4283                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4284                         BRCMF_ERROR(("%s: Bad data offset %d: HW len %d,"
4285                                      " min %d seq %d\n", __func__, doff,
4286                                      len, SDPCM_HDRLEN, seq));
4287                         bus->rx_badhdr++;
4288                         brcmf_sdbrcm_rxfail(bus, false, false);
4289                         continue;
4290                 }
4291
4292                 /* Save the readahead length if there is one */
4293                 bus->nextlen =
4294                     bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
4295                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
4296                         BRCMF_INFO(("%s (nextlen): got frame w/nextlen too"
4297                                     " large (%d), seq %d\n",
4298                                     __func__, bus->nextlen, seq));
4299                         bus->nextlen = 0;
4300                 }
4301
4302                 /* Handle Flow Control */
4303                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4304
4305                 if (bus->flowcontrol != fcbits) {
4306                         if (~bus->flowcontrol & fcbits)
4307                                 bus->fc_xoff++;
4308
4309                         if (bus->flowcontrol & ~fcbits)
4310                                 bus->fc_xon++;
4311
4312                         bus->fc_rcvd++;
4313                         bus->flowcontrol = fcbits;
4314                 }
4315
4316                 /* Check and update sequence number */
4317                 if (rxseq != seq) {
4318                         BRCMF_INFO(("%s: rx_seq %d, expected %d\n", __func__,
4319                                     seq, rxseq));
4320                         bus->rx_badseq++;
4321                         rxseq = seq;
4322                 }
4323
4324                 /* Check window for sanity */
4325                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
4326                         BRCMF_ERROR(("%s: unlikely tx max %d with tx_seq %d\n",
4327                                      __func__, txmax, bus->tx_seq));
4328                         txmax = bus->tx_seq + 2;
4329                 }
4330                 bus->tx_max = txmax;
4331
4332                 /* Call a separate function for control frames */
4333                 if (chan == SDPCM_CONTROL_CHANNEL) {
4334                         brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
4335                         continue;
4336                 }
4337
4338                 /* precondition: chan is either SDPCM_DATA_CHANNEL,
4339                    SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
4340                    SDPCM_GLOM_CHANNEL */
4341
4342                 /* Length to read */
4343                 rdlen = (len > firstread) ? (len - firstread) : 0;
4344
4345                 /* May pad read to blocksize for efficiency */
4346                 if (bus->roundup && bus->blocksize &&
4347                         (rdlen > bus->blocksize)) {
4348                         pad = bus->blocksize - (rdlen % bus->blocksize);
4349                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
4350                             ((rdlen + pad + firstread) < MAX_RX_DATASZ))
4351                                 rdlen += pad;
4352                 } else if (rdlen % BRCMF_SDALIGN) {
4353                         rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
4354                 }
4355
4356                 /* Satisfy length-alignment requirements */
4357                 if (forcealign && (rdlen & (ALIGNMENT - 1)))
4358                         rdlen = roundup(rdlen, ALIGNMENT);
4359
4360                 if ((rdlen + firstread) > MAX_RX_DATASZ) {
4361                         /* Too long -- skip this frame */
4362                         BRCMF_ERROR(("%s: too long: len %d rdlen %d\n",
4363                                      __func__, len, rdlen));
4364                         bus->drvr->rx_errors++;
4365                         bus->rx_toolong++;
4366                         brcmf_sdbrcm_rxfail(bus, false, false);
4367                         continue;
4368                 }
4369
4370                 pkt = brcmu_pkt_buf_get_skb(rdlen + firstread + BRCMF_SDALIGN);
4371                 if (!pkt) {
4372                         /* Give up on data, request rtx of events */
4373                         BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed:"
4374                                      " rdlen %d chan %d\n", __func__, rdlen,
4375                                      chan));
4376                         bus->drvr->rx_dropped++;
4377                         brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
4378                         continue;
4379                 }
4380
4381                 /* Leave room for what we already read, and align remainder */
4382                 skb_pull(pkt, firstread);
4383                 PKTALIGN(pkt, rdlen, BRCMF_SDALIGN);
4384
4385                 /* Read the remaining frame data */
4386                 sdret = brcmf_sdcard_recv_buf(card,
4387                                 brcmf_sdcard_cur_sbwad(card),
4388                                 SDIO_FUNC_2, F2SYNC, ((u8 *) (pkt->data)),
4389                                 rdlen, pkt, NULL, NULL);
4390                 bus->f2rxdata++;
4391
4392                 if (sdret < 0) {
4393                         BRCMF_ERROR(("%s: read %d %s bytes failed: %d\n",
4394                                      __func__, rdlen,
4395                                      ((chan == SDPCM_EVENT_CHANNEL) ? "event"
4396                                      : ((chan == SDPCM_DATA_CHANNEL) ? "data"
4397                                      : "test")), sdret));
4398                         brcmu_pkt_buf_free_skb(pkt);
4399                         bus->drvr->rx_errors++;
4400                         brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
4401                         continue;
4402                 }
4403
4404                 /* Copy the already-read portion */
4405                 skb_push(pkt, firstread);
4406                 memcpy(pkt->data, bus->rxhdr, firstread);
4407
4408 #ifdef BCMDBG
4409                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
4410                         printk(KERN_DEBUG "Rx Data:\n");
4411                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4412                                              pkt->data, len);
4413                 }
4414 #endif
4415
4416 deliver:
4417                 /* Save superframe descriptor and allocate packet frame */
4418                 if (chan == SDPCM_GLOM_CHANNEL) {
4419                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
4420                                 BRCMF_GLOM(("%s: glom descriptor, %d bytes:\n",
4421                                             __func__, len));
4422 #ifdef BCMDBG
4423                                 if (BRCMF_GLOM_ON()) {
4424                                         printk(KERN_DEBUG "Glom Data:\n");
4425                                         print_hex_dump_bytes("",
4426                                                              DUMP_PREFIX_OFFSET,
4427                                                              pkt->data, len);
4428                                 }
4429 #endif
4430                                 __skb_trim(pkt, len);
4431                                 skb_pull(pkt, SDPCM_HDRLEN);
4432                                 bus->glomd = pkt;
4433                         } else {
4434                                 BRCMF_ERROR(("%s: glom superframe w/o "
4435                                              "descriptor!\n", __func__));
4436                                 brcmf_sdbrcm_rxfail(bus, false, false);
4437                         }
4438                         continue;
4439                 }
4440
4441                 /* Fill in packet len and prio, deliver upward */
4442                 __skb_trim(pkt, len);
4443                 skb_pull(pkt, doff);
4444
4445 #ifdef SDTEST
4446                 /* Test channel packets are processed separately */
4447                 if (chan == SDPCM_TEST_CHANNEL) {
4448                         brcmf_sdbrcm_checkdied(bus, pkt, seq);
4449                         continue;
4450                 }
4451 #endif                          /* SDTEST */
4452
4453                 if (pkt->len == 0) {
4454                         brcmu_pkt_buf_free_skb(pkt);
4455                         continue;
4456                 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
4457                         BRCMF_ERROR(("%s: rx protocol error\n", __func__));
4458                         brcmu_pkt_buf_free_skb(pkt);
4459                         bus->drvr->rx_errors++;
4460                         continue;
4461                 }
4462
4463                 /* Unlock during rx call */
4464                 brcmf_sdbrcm_sdunlock(bus);
4465                 brcmf_rx_frame(bus->drvr, ifidx, pkt, 1);
4466                 brcmf_sdbrcm_sdlock(bus);
4467         }
4468         rxcount = maxframes - rxleft;
4469 #ifdef BCMDBG
4470         /* Message if we hit the limit */
4471         if (!rxleft && !sdtest)
4472                 BRCMF_DATA(("%s: hit rx limit of %d frames\n", __func__,
4473                             maxframes));
4474         else
4475 #endif                          /* BCMDBG */
4476                 BRCMF_DATA(("%s: processed %d frames\n", __func__, rxcount));
4477         /* Back off rxseq if awaiting rtx, update rx_seq */
4478         if (bus->rxskip)
4479                 rxseq--;
4480         bus->rx_seq = rxseq;
4481
4482         return rxcount;
4483 }
4484
4485 static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
4486 {
4487         u32 intstatus = 0;
4488         u32 hmb_data;
4489         u8 fcbits;
4490         uint retries = 0;
4491
4492         BRCMF_TRACE(("%s: Enter\n", __func__));
4493
4494         /* Read mailbox data and ack that we did so */
4495         r_sdreg32(bus, &hmb_data,
4496                   offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
4497
4498         if (retries <= retry_limit)
4499                 w_sdreg32(bus, SMB_INT_ACK,
4500                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
4501         bus->f1regdata += 2;
4502
4503         /* Dongle recomposed rx frames, accept them again */
4504         if (hmb_data & HMB_DATA_NAKHANDLED) {
4505                 BRCMF_INFO(("Dongle reports NAK handled, expect rtx of %d\n",
4506                             bus->rx_seq));
4507                 if (!bus->rxskip)
4508                         BRCMF_ERROR(("%s: unexpected NAKHANDLED!\n", __func__));
4509
4510                 bus->rxskip = false;
4511                 intstatus |= I_HMB_FRAME_IND;
4512         }
4513
4514         /*
4515          * DEVREADY does not occur with gSPI.
4516          */
4517         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
4518                 bus->sdpcm_ver =
4519                     (hmb_data & HMB_DATA_VERSION_MASK) >>
4520                     HMB_DATA_VERSION_SHIFT;
4521                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
4522                         BRCMF_ERROR(("Version mismatch, dongle reports %d, "
4523                                      "expecting %d\n",
4524                                      bus->sdpcm_ver, SDPCM_PROT_VERSION));
4525                 else
4526                         BRCMF_INFO(("Dongle ready, protocol version %d\n",
4527                                     bus->sdpcm_ver));
4528         }
4529
4530         /*
4531          * Flow Control has been moved into the RX headers and this out of band
4532          * method isn't used any more.
4533          * remaining backward compatible with older dongles.
4534          */
4535         if (hmb_data & HMB_DATA_FC) {
4536                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
4537                                                         HMB_DATA_FCDATA_SHIFT;
4538
4539                 if (fcbits & ~bus->flowcontrol)
4540                         bus->fc_xoff++;
4541
4542                 if (bus->flowcontrol & ~fcbits)
4543                         bus->fc_xon++;
4544
4545                 bus->fc_rcvd++;
4546                 bus->flowcontrol = fcbits;
4547         }
4548
4549         /* Shouldn't be any others */
4550         if (hmb_data & ~(HMB_DATA_DEVREADY |
4551                          HMB_DATA_NAKHANDLED |
4552                          HMB_DATA_FC |
4553                          HMB_DATA_FWREADY |
4554                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK)) {
4555                 BRCMF_ERROR(("Unknown mailbox data content: 0x%02x\n",
4556                              hmb_data));
4557         }
4558
4559         return intstatus;
4560 }
4561
4562 static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
4563 {
4564         struct brcmf_sdio_card *card = bus->card;
4565         u32 intstatus, newstatus = 0;
4566         uint retries = 0;
4567         uint rxlimit = brcmf_rxbound;   /* Rx frames to read before resched */
4568         uint txlimit = brcmf_txbound;   /* Tx frames to send before resched */
4569         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
4570         bool rxdone = true;     /* Flag for no more read data */
4571         bool resched = false;   /* Flag indicating resched wanted */
4572
4573         BRCMF_TRACE(("%s: Enter\n", __func__));
4574
4575         /* Start with leftover status bits */
4576         intstatus = bus->intstatus;
4577
4578         brcmf_sdbrcm_sdlock(bus);
4579
4580         /* If waiting for HTAVAIL, check status */
4581         if (bus->clkstate == CLK_PENDING) {
4582                 int err;
4583                 u8 clkctl, devctl = 0;
4584
4585 #ifdef BCMDBG
4586                 /* Check for inconsistent device control */
4587                 devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4588                                                SBSDIO_DEVICE_CTL, &err);
4589                 if (err) {
4590                         BRCMF_ERROR(("%s: error reading DEVCTL: %d\n",
4591                                      __func__, err));
4592                         bus->drvr->busstate = BRCMF_BUS_DOWN;
4593                 }
4594 #endif                          /* BCMDBG */
4595
4596                 /* Read CSR, if clock on switch to AVAIL, else ignore */
4597                 clkctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4598                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
4599                 if (err) {
4600                         BRCMF_ERROR(("%s: error reading CSR: %d\n", __func__,
4601                                      err));
4602                         bus->drvr->busstate = BRCMF_BUS_DOWN;
4603                 }
4604
4605                 BRCMF_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
4606                             devctl, clkctl));
4607
4608                 if (SBSDIO_HTAV(clkctl)) {
4609                         devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4610                                                        SBSDIO_DEVICE_CTL, &err);
4611                         if (err) {
4612                                 BRCMF_ERROR(("%s: error reading DEVCTL: %d\n",
4613                                              __func__, err));
4614                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
4615                         }
4616                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
4617                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
4618                                 SBSDIO_DEVICE_CTL, devctl, &err);
4619                         if (err) {
4620                                 BRCMF_ERROR(("%s: error writing DEVCTL: %d\n",
4621                                              __func__, err));
4622                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
4623                         }
4624                         bus->clkstate = CLK_AVAIL;
4625                 } else {
4626                         goto clkwait;
4627                 }
4628         }
4629
4630         BUS_WAKE(bus);
4631
4632         /* Make sure backplane clock is on */
4633         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
4634         if (bus->clkstate == CLK_PENDING)
4635                 goto clkwait;
4636
4637         /* Pending interrupt indicates new device status */
4638         if (bus->ipend) {
4639                 bus->ipend = false;
4640                 r_sdreg32(bus, &newstatus,
4641                           offsetof(struct sdpcmd_regs, intstatus), &retries);
4642                 bus->f1regdata++;
4643                 if (brcmf_sdcard_regfail(bus->card))
4644                         newstatus = 0;
4645                 newstatus &= bus->hostintmask;
4646                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
4647                 if (newstatus) {
4648                         w_sdreg32(bus, newstatus,
4649                                   offsetof(struct sdpcmd_regs, intstatus),
4650                                   &retries);
4651                         bus->f1regdata++;
4652                 }
4653         }
4654
4655         /* Merge new bits with previous */
4656         intstatus |= newstatus;
4657         bus->intstatus = 0;
4658
4659         /* Handle flow-control change: read new state in case our ack
4660          * crossed another change interrupt.  If change still set, assume
4661          * FC ON for safety, let next loop through do the debounce.
4662          */
4663         if (intstatus & I_HMB_FC_CHANGE) {
4664                 intstatus &= ~I_HMB_FC_CHANGE;
4665                 w_sdreg32(bus, I_HMB_FC_CHANGE,
4666                           offsetof(struct sdpcmd_regs, intstatus), &retries);
4667
4668                 r_sdreg32(bus, &newstatus,
4669                           offsetof(struct sdpcmd_regs, intstatus), &retries);
4670                 bus->f1regdata += 2;
4671                 bus->fcstate =
4672                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
4673                 intstatus |= (newstatus & bus->hostintmask);
4674         }
4675
4676         /* Handle host mailbox indication */
4677         if (intstatus & I_HMB_HOST_INT) {
4678                 intstatus &= ~I_HMB_HOST_INT;
4679                 intstatus |= brcmf_sdbrcm_hostmail(bus);
4680         }
4681
4682         /* Generally don't ask for these, can get CRC errors... */
4683         if (intstatus & I_WR_OOSYNC) {
4684                 BRCMF_ERROR(("Dongle reports WR_OOSYNC\n"));
4685                 intstatus &= ~I_WR_OOSYNC;
4686         }
4687
4688         if (intstatus & I_RD_OOSYNC) {
4689                 BRCMF_ERROR(("Dongle reports RD_OOSYNC\n"));
4690                 intstatus &= ~I_RD_OOSYNC;
4691         }
4692
4693         if (intstatus & I_SBINT) {
4694                 BRCMF_ERROR(("Dongle reports SBINT\n"));
4695                 intstatus &= ~I_SBINT;
4696         }
4697
4698         /* Would be active due to wake-wlan in gSPI */
4699         if (intstatus & I_CHIPACTIVE) {
4700                 BRCMF_INFO(("Dongle reports CHIPACTIVE\n"));
4701                 intstatus &= ~I_CHIPACTIVE;
4702         }
4703
4704         /* Ignore frame indications if rxskip is set */
4705         if (bus->rxskip)
4706                 intstatus &= ~I_HMB_FRAME_IND;
4707
4708         /* On frame indication, read available frames */
4709         if (PKT_AVAILABLE()) {
4710                 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
4711                 if (rxdone || bus->rxskip)
4712                         intstatus &= ~I_HMB_FRAME_IND;
4713                 rxlimit -= min(framecnt, rxlimit);
4714         }
4715
4716         /* Keep still-pending events for next scheduling */
4717         bus->intstatus = intstatus;
4718
4719 clkwait:
4720         /* Re-enable interrupts to detect new device events (mailbox, rx frame)
4721          * or clock availability.  (Allows tx loop to check ipend if desired.)
4722          * (Unless register access seems hosed, as we may not be able to ACK...)
4723          */
4724         if (bus->intr && bus->intdis && !brcmf_sdcard_regfail(card)) {
4725                 BRCMF_INTR(("%s: enable SDIO interrupts, rxdone %d"
4726                             " framecnt %d\n", __func__, rxdone, framecnt));
4727                 bus->intdis = false;
4728                 brcmf_sdcard_intr_enable(card);
4729         }
4730
4731         if (DATAOK(bus) && bus->ctrl_frame_stat &&
4732                 (bus->clkstate == CLK_AVAIL)) {
4733                 int ret, i;
4734
4735                 ret = brcmf_sdbrcm_send_buf(bus, brcmf_sdcard_cur_sbwad(card),
4736                         SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
4737                         (u32) bus->ctrl_frame_len, NULL, NULL, NULL);
4738
4739                 if (ret < 0) {
4740                         /* On failure, abort the command and
4741                                 terminate the frame */
4742                         BRCMF_INFO(("%s: sdio error %d, abort command and "
4743                                     "terminate frame.\n", __func__, ret));
4744                         bus->tx_sderrs++;
4745
4746                         brcmf_sdcard_abort(card, SDIO_FUNC_2);
4747
4748                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
4749                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
4750                                          NULL);
4751                         bus->f1regdata++;
4752
4753                         for (i = 0; i < 3; i++) {
4754                                 u8 hi, lo;
4755                                 hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4756                                                      SBSDIO_FUNC1_WFRAMEBCHI,
4757                                                      NULL);
4758                                 lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4759                                                      SBSDIO_FUNC1_WFRAMEBCLO,
4760                                                      NULL);
4761                                 bus->f1regdata += 2;
4762                                 if ((hi == 0) && (lo == 0))
4763                                         break;
4764                         }
4765
4766                 }
4767                 if (ret == 0)
4768                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
4769
4770                 BRCMF_INFO(("Return_dpc value is : %d\n", ret));
4771                 bus->ctrl_frame_stat = false;
4772                 brcmf_sdbrcm_wait_event_wakeup(bus);
4773         }
4774         /* Send queued frames (limit 1 if rx may still be pending) */
4775         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
4776                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
4777                  && DATAOK(bus)) {
4778                 framecnt = rxdone ? txlimit : min(txlimit, brcmf_txminmax);
4779                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
4780                 txlimit -= framecnt;
4781         }
4782
4783         /* Resched if events or tx frames are pending,
4784                  else await next interrupt */
4785         /* On failed register access, all bets are off:
4786                  no resched or interrupts */
4787         if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
4788             brcmf_sdcard_regfail(card)) {
4789                 BRCMF_ERROR(("%s: failed backplane access over SDIO, halting "
4790                              "operation %d\n", __func__,
4791                              brcmf_sdcard_regfail(card)));
4792                 bus->drvr->busstate = BRCMF_BUS_DOWN;
4793                 bus->intstatus = 0;
4794         } else if (bus->clkstate == CLK_PENDING) {
4795                 BRCMF_INFO(("%s: rescheduled due to CLK_PENDING awaiting "
4796                             "I_CHIPACTIVE interrupt\n", __func__));
4797                 resched = true;
4798         } else if (bus->intstatus || bus->ipend ||
4799                 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
4800                  && DATAOK(bus)) || PKT_AVAILABLE()) {
4801                 resched = true;
4802         }
4803
4804         bus->dpc_sched = resched;
4805
4806         /* If we're done for now, turn off clock request. */
4807         if ((bus->clkstate != CLK_PENDING)
4808             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
4809                 bus->activity = false;
4810                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
4811         }
4812
4813         brcmf_sdbrcm_sdunlock(bus);
4814
4815         return resched;
4816 }
4817
4818 void brcmf_sdbrcm_isr(void *arg)
4819 {
4820         struct brcmf_bus *bus = (struct brcmf_bus *) arg;
4821         struct brcmf_sdio_card *card;
4822
4823         BRCMF_TRACE(("%s: Enter\n", __func__));
4824
4825         if (!bus) {
4826                 BRCMF_ERROR(("%s : bus is null pointer , exit\n", __func__));
4827                 return;
4828         }
4829         card = bus->card;
4830
4831         if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
4832                 BRCMF_ERROR(("%s : bus is down. we have nothing to do\n",
4833                            __func__));
4834                 return;
4835         }
4836         /* Count the interrupt call */
4837         bus->intrcount++;
4838         bus->ipend = true;
4839
4840         /* Shouldn't get this interrupt if we're sleeping? */
4841         if (bus->sleeping) {
4842                 BRCMF_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
4843                 return;
4844         }
4845
4846         /* Disable additional interrupts (is this needed now)? */
4847         if (bus->intr)
4848                 BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
4849         else
4850                 BRCMF_ERROR(("brcmf_sdbrcm_isr() w/o interrupt configured!\n"));
4851
4852         brcmf_sdcard_intr_disable(card);
4853         bus->intdis = true;
4854
4855 #if defined(SDIO_ISR_THREAD)
4856         BRCMF_TRACE(("Calling brcmf_sdbrcm_dpc() from %s\n", __func__));
4857         while (brcmf_sdbrcm_dpc(bus))
4858                 ;
4859 #else
4860         bus->dpc_sched = true;
4861         brcmf_sdbrcm_sched_dpc(bus);
4862 #endif
4863
4864 }
4865
4866 #ifdef SDTEST
4867 static void brcmf_sdbrcm_pktgen_init(struct brcmf_bus *bus)
4868 {
4869         /* Default to specified length, or full range */
4870         if (brcmf_pktgen_len) {
4871                 bus->pktgen_maxlen = min(brcmf_pktgen_len,
4872                                          BRCMF_MAX_PKTGEN_LEN);
4873                 bus->pktgen_minlen = bus->pktgen_maxlen;
4874         } else {
4875                 bus->pktgen_maxlen = BRCMF_MAX_PKTGEN_LEN;
4876                 bus->pktgen_minlen = 0;
4877         }
4878         bus->pktgen_len = (u16) bus->pktgen_minlen;
4879
4880         /* Default to per-watchdog burst with 10s print time */
4881         bus->pktgen_freq = 1;
4882         bus->pktgen_print = 10000 / brcmf_watchdog_ms;
4883         bus->pktgen_count = (brcmf_pktgen * brcmf_watchdog_ms + 999) / 1000;
4884
4885         /* Default to echo mode */
4886         bus->pktgen_mode = BRCMF_PKTGEN_ECHO;
4887         bus->pktgen_stop = 1;
4888 }
4889
4890 static void brcmf_sdbrcm_pktgen(struct brcmf_bus *bus)
4891 {
4892         struct sk_buff *pkt;
4893         u8 *data;
4894         uint pktcount;
4895         uint fillbyte;
4896         u16 len;
4897
4898         /* Display current count if appropriate */
4899         if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
4900                 bus->pktgen_ptick = 0;
4901                 printk(KERN_DEBUG "%s: send attempts %d rcvd %d\n",
4902                        __func__, bus->pktgen_sent, bus->pktgen_rcvd);
4903         }
4904
4905         /* For recv mode, just make sure dongle has started sending */
4906         if (bus->pktgen_mode == BRCMF_PKTGEN_RECV) {
4907                 if (!bus->pktgen_rcvd)
4908                         brcmf_sdbrcm_sdtest_set(bus, true);
4909                 return;
4910         }
4911
4912         /* Otherwise, generate or request the specified number of packets */
4913         for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
4914                 /* Stop if total has been reached */
4915                 if (bus->pktgen_total
4916                     && (bus->pktgen_sent >= bus->pktgen_total)) {
4917                         bus->pktgen_count = 0;
4918                         break;
4919                 }
4920
4921                 /* Allocate an appropriate-sized packet */
4922                 len = bus->pktgen_len;
4923                 pkt = brcmu_pkt_buf_get_skb(
4924                         len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + BRCMF_SDALIGN,
4925                         true);
4926                 if (!pkt) {
4927                         BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed!\n",
4928                                      __func__));
4929                         break;
4930                 }
4931                 PKTALIGN(pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN),
4932                          BRCMF_SDALIGN);
4933                 data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
4934
4935                 /* Write test header cmd and extra based on mode */
4936                 switch (bus->pktgen_mode) {
4937                 case BRCMF_PKTGEN_ECHO:
4938                         *data++ = SDPCM_TEST_ECHOREQ;
4939                         *data++ = (u8) bus->pktgen_sent;
4940                         break;
4941
4942                 case BRCMF_PKTGEN_SEND:
4943                         *data++ = SDPCM_TEST_DISCARD;
4944                         *data++ = (u8) bus->pktgen_sent;
4945                         break;
4946
4947                 case BRCMF_PKTGEN_RXBURST:
4948                         *data++ = SDPCM_TEST_BURST;
4949                         *data++ = (u8) bus->pktgen_count;
4950                         break;
4951
4952                 default:
4953                         BRCMF_ERROR(("Unrecognized pktgen mode %d\n",
4954                                      bus->pktgen_mode));
4955                         brcmu_pkt_buf_free_skb(pkt, true);
4956                         bus->pktgen_count = 0;
4957                         return;
4958                 }
4959
4960                 /* Write test header length field */
4961                 *data++ = (len >> 0);
4962                 *data++ = (len >> 8);
4963
4964                 /* Then fill in the remainder -- N/A for burst,
4965                          but who cares... */
4966                 for (fillbyte = 0; fillbyte < len; fillbyte++)
4967                         *data++ =
4968                             SDPCM_TEST_FILL(fillbyte, (u8) bus->pktgen_sent);
4969
4970 #ifdef BCMDBG
4971                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
4972                         data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
4973                         printk(KERN_DEBUG "brcmf_sdbrcm_pktgen: Tx Data:\n");
4974                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, data,
4975                                              pkt->len - SDPCM_HDRLEN);
4976                 }
4977 #endif
4978
4979                 /* Send it */
4980                 if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true)) {
4981                         bus->pktgen_fail++;
4982                         if (bus->pktgen_stop
4983                             && bus->pktgen_stop == bus->pktgen_fail)
4984                                 bus->pktgen_count = 0;
4985                 }
4986                 bus->pktgen_sent++;
4987
4988                 /* Bump length if not fixed, wrap at max */
4989                 if (++bus->pktgen_len > bus->pktgen_maxlen)
4990                         bus->pktgen_len = (u16) bus->pktgen_minlen;
4991
4992                 /* Special case for burst mode: just send one request! */
4993                 if (bus->pktgen_mode == BRCMF_PKTGEN_RXBURST)
4994                         break;
4995         }
4996 }
4997
4998 static void brcmf_sdbrcm_sdtest_set(struct brcmf_bus *bus, bool start)
4999 {
5000         struct sk_buff *pkt;
5001         u8 *data;
5002
5003         /* Allocate the packet */
5004         pkt = brcmu_pkt_buf_get_skb(SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
5005                 BRCMF_SDALIGN, true);
5006         if (!pkt) {
5007                 BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed!\n", __func__));
5008                 return;
5009         }
5010         PKTALIGN(pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), BRCMF_SDALIGN);
5011         data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
5012
5013         /* Fill in the test header */
5014         *data++ = SDPCM_TEST_SEND;
5015         *data++ = start;
5016         *data++ = (bus->pktgen_maxlen >> 0);
5017         *data++ = (bus->pktgen_maxlen >> 8);
5018
5019         /* Send it */
5020         if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true))
5021                 bus->pktgen_fail++;
5022 }
5023
5024 static void
5025 brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, struct sk_buff *pkt, uint seq)
5026 {
5027         u8 *data;
5028         uint pktlen;
5029
5030         u8 cmd;
5031         u8 extra;
5032         u16 len;
5033         u16 offset;
5034
5035         /* Check for min length */
5036         pktlen = pkt->len;
5037         if (pktlen < SDPCM_TEST_HDRLEN) {
5038                 BRCMF_ERROR(("brcmf_sdbrcm_checkdied: toss runt frame, pktlen "
5039                              "%d\n", pktlen));
5040                 brcmu_pkt_buf_free_skb(pkt, false);
5041                 return;
5042         }
5043
5044         /* Extract header fields */
5045         data = pkt->data;
5046         cmd = *data++;
5047         extra = *data++;
5048         len = *data++;
5049         len += *data++ << 8;
5050
5051         /* Check length for relevant commands */
5052         if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ
5053             || cmd == SDPCM_TEST_ECHORSP) {
5054                 if (pktlen != len + SDPCM_TEST_HDRLEN) {
5055                         BRCMF_ERROR(("brcmf_sdbrcm_checkdied: frame length "
5056                                      "mismatch, pktlen %d seq %d"
5057                                      " cmd %d extra %d len %d\n",
5058                                      pktlen, seq, cmd, extra, len));
5059                         brcmu_pkt_buf_free_skb(pkt, false);
5060                         return;
5061                 }
5062         }
5063
5064         /* Process as per command */
5065         switch (cmd) {
5066         case SDPCM_TEST_ECHOREQ:
5067                 /* Rx->Tx turnaround ok (even on NDIS w/current
5068                          implementation) */
5069                 *(u8 *) (pkt->data) = SDPCM_TEST_ECHORSP;
5070                 if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true) == 0)
5071                         bus->pktgen_sent++;
5072                 else {
5073                         bus->pktgen_fail++;
5074                         brcmu_pkt_buf_free_skb(pkt, false);
5075                 }
5076                 bus->pktgen_rcvd++;
5077                 break;
5078
5079         case SDPCM_TEST_ECHORSP:
5080                 if (bus->ext_loop) {
5081                         brcmu_pkt_buf_free_skb(pkt, false);
5082                         bus->pktgen_rcvd++;
5083                         break;
5084                 }
5085
5086                 for (offset = 0; offset < len; offset++, data++) {
5087                         if (*data != SDPCM_TEST_FILL(offset, extra)) {
5088                                 BRCMF_ERROR(("brcmf_sdbrcm_checkdied: echo"
5089                                              " data mismatch: "
5090                                              "offset %d (len %d) "
5091                                              "expect 0x%02x rcvd 0x%02x\n",
5092                                              offset, len,
5093                                              SDPCM_TEST_FILL(offset, extra),
5094                                              *data));
5095                                 break;
5096                         }
5097                 }
5098                 brcmu_pkt_buf_free_skb(pkt, false);
5099                 bus->pktgen_rcvd++;
5100                 break;
5101
5102         case SDPCM_TEST_DISCARD:
5103                 brcmu_pkt_buf_free_skb(pkt, false);
5104                 bus->pktgen_rcvd++;
5105                 break;
5106
5107         case SDPCM_TEST_BURST:
5108         case SDPCM_TEST_SEND:
5109         default:
5110                 BRCMF_INFO(("brcmf_sdbrcm_checkdied: unsupported or unknown "
5111                             "command, pktlen %d seq %d" " cmd %d extra %d"
5112                             " len %d\n", pktlen, seq, cmd, extra, len));
5113                 brcmu_pkt_buf_free_skb(pkt, false);
5114                 break;
5115         }
5116
5117         /* For recv mode, stop at limie (and tell dongle to stop sending) */
5118         if (bus->pktgen_mode == BRCMF_PKTGEN_RECV) {
5119                 if (bus->pktgen_total
5120                     && (bus->pktgen_rcvd >= bus->pktgen_total)) {
5121                         bus->pktgen_count = 0;
5122                         brcmf_sdbrcm_sdtest_set(bus, false);
5123                 }
5124         }
5125 }
5126 #endif                          /* SDTEST */
5127
5128 extern bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
5129 {
5130         struct brcmf_bus *bus;
5131
5132         BRCMF_TIMER(("%s: Enter\n", __func__));
5133
5134         bus = drvr->bus;
5135
5136         if (bus->drvr->dongle_reset)
5137                 return false;
5138
5139         /* Ignore the timer if simulating bus down */
5140         if (bus->sleeping)
5141                 return false;
5142
5143         brcmf_sdbrcm_sdlock(bus);
5144
5145         /* Poll period: check device if appropriate. */
5146         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
5147                 u32 intstatus = 0;
5148
5149                 /* Reset poll tick */
5150                 bus->polltick = 0;
5151
5152                 /* Check device if no interrupts */
5153                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
5154
5155                         if (!bus->dpc_sched) {
5156                                 u8 devpend;
5157                                 devpend = brcmf_sdcard_cfg_read(bus->card,
5158                                                 SDIO_FUNC_0, SDIO_CCCR_INTx,
5159                                                 NULL);
5160                                 intstatus =
5161                                     devpend & (INTR_STATUS_FUNC1 |
5162                                                INTR_STATUS_FUNC2);
5163                         }
5164
5165                         /* If there is something, make like the ISR and
5166                                  schedule the DPC */
5167                         if (intstatus) {
5168                                 bus->pollcnt++;
5169                                 bus->ipend = true;
5170                                 if (bus->intr)
5171                                         brcmf_sdcard_intr_disable(bus->card);
5172
5173                                 bus->dpc_sched = true;
5174                                 brcmf_sdbrcm_sched_dpc(bus);
5175
5176                         }
5177                 }
5178
5179                 /* Update interrupt tracking */
5180                 bus->lastintrs = bus->intrcount;
5181         }
5182 #ifdef BCMDBG
5183         /* Poll for console output periodically */
5184         if (drvr->busstate == BRCMF_BUS_DATA && brcmf_console_ms != 0) {
5185                 bus->console.count += brcmf_watchdog_ms;
5186                 if (bus->console.count >= brcmf_console_ms) {
5187                         bus->console.count -= brcmf_console_ms;
5188                         /* Make sure backplane clock is on */
5189                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5190                         if (brcmf_sdbrcm_readconsole(bus) < 0)
5191                                 brcmf_console_ms = 0;   /* On error,
5192                                                          stop trying */
5193                 }
5194         }
5195 #endif                          /* BCMDBG */
5196
5197 #ifdef SDTEST
5198         /* Generate packets if configured */
5199         if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
5200                 /* Make sure backplane clock is on */
5201                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5202                 bus->pktgen_tick = 0;
5203                 brcmf_sdbrcm_pktgen(bus);
5204         }
5205 #endif
5206
5207         /* On idle timeout clear activity flag and/or turn off clock */
5208         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
5209                 if (++bus->idlecount >= bus->idletime) {
5210                         bus->idlecount = 0;
5211                         if (bus->activity) {
5212                                 bus->activity = false;
5213                                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
5214                         } else {
5215                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
5216                         }
5217                 }
5218         }
5219
5220         brcmf_sdbrcm_sdunlock(bus);
5221
5222         return bus->ipend;
5223 }
5224
5225 #ifdef BCMDBG
5226 static int brcmf_sdbrcm_bus_console_in(struct brcmf_pub *drvr,
5227                                        unsigned char *msg, uint msglen)
5228 {
5229         struct brcmf_bus *bus = drvr->bus;
5230         u32 addr, val;
5231         int rv;
5232         struct sk_buff *pkt;
5233
5234         /* Address could be zero if CONSOLE := 0 in dongle Makefile */
5235         if (bus->console_addr == 0)
5236                 return -ENOTSUPP;
5237
5238         /* Exclusive bus access */
5239         brcmf_sdbrcm_sdlock(bus);
5240
5241         /* Don't allow input if dongle is in reset */
5242         if (bus->drvr->dongle_reset) {
5243                 brcmf_sdbrcm_sdunlock(bus);
5244                 return -EPERM;
5245         }
5246
5247         /* Request clock to allow SDIO accesses */
5248         BUS_WAKE(bus);
5249         /* No pend allowed since txpkt is called later, ht clk has to be on */
5250         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5251
5252         /* Zero cbuf_index */
5253         addr = bus->console_addr + offsetof(struct rte_console, cbuf_idx);
5254         val = cpu_to_le32(0);
5255         rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)&val, sizeof(val));
5256         if (rv < 0)
5257                 goto done;
5258
5259         /* Write message into cbuf */
5260         addr = bus->console_addr + offsetof(struct rte_console, cbuf);
5261         rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)msg, msglen);
5262         if (rv < 0)
5263                 goto done;
5264
5265         /* Write length into vcons_in */
5266         addr = bus->console_addr + offsetof(struct rte_console, vcons_in);
5267         val = cpu_to_le32(msglen);
5268         rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)&val, sizeof(val));
5269         if (rv < 0)
5270                 goto done;
5271
5272         /* Bump dongle by sending an empty event pkt.
5273          * sdpcm_sendup (RX) checks for virtual console input.
5274          */
5275         pkt = brcmu_pkt_buf_get_skb(4 + SDPCM_RESERVE);
5276         if ((pkt != NULL) && bus->clkstate == CLK_AVAIL)
5277                 brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, true);
5278
5279 done:
5280         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
5281                 bus->activity = false;
5282                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
5283         }
5284
5285         brcmf_sdbrcm_sdunlock(bus);
5286
5287         return rv;
5288 }
5289 #endif                          /* BCMDBG */
5290
5291 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
5292 {
5293         if (chipid == BCM4325_CHIP_ID)
5294                 return true;
5295         if (chipid == BCM4329_CHIP_ID)
5296                 return true;
5297         if (chipid == BCM4319_CHIP_ID)
5298                 return true;
5299         return false;
5300 }
5301
5302 static void *brcmf_sdbrcm_probe(u16 venid, u16 devid, u16 bus_no,
5303                            u16 slot, u16 func, uint bustype, u32 regsva,
5304                            void *card)
5305 {
5306         int ret;
5307         struct brcmf_bus *bus;
5308
5309         /* Init global variables at run-time, not as part of the declaration.
5310          * This is required to support init/de-init of the driver.
5311          * Initialization
5312          * of globals as part of the declaration results in non-deterministic
5313          * behavior since the value of the globals may be different on the
5314          * first time that the driver is initialized vs subsequent
5315          * initializations.
5316          */
5317         brcmf_txbound = BRCMF_TXBOUND;
5318         brcmf_rxbound = BRCMF_RXBOUND;
5319         brcmf_alignctl = true;
5320         sd1idle = true;
5321         brcmf_readahead = true;
5322         retrydata = false;
5323         brcmf_dongle_memsize = 0;
5324         brcmf_txminmax = BRCMF_TXMINMAX;
5325
5326         forcealign = true;
5327
5328         brcmf_c_init();
5329
5330         BRCMF_TRACE(("%s: Enter\n", __func__));
5331         BRCMF_INFO(("%s: venid 0x%04x devid 0x%04x\n", __func__, venid, devid));
5332
5333         /* We make an assumption about address window mappings:
5334          * regsva == SI_ENUM_BASE*/
5335
5336         /* SDIO car passes venid and devid based on CIS parsing -- but
5337          * low-power start
5338          * means early parse could fail, so here we should get either an ID
5339          * we recognize OR (-1) indicating we must request power first.
5340          */
5341         /* Check the Vendor ID */
5342         switch (venid) {
5343         case 0x0000:
5344         case PCI_VENDOR_ID_BROADCOM:
5345                 break;
5346         default:
5347                 BRCMF_ERROR(("%s: unknown vendor: 0x%04x\n", __func__, venid));
5348                 return NULL;
5349         }
5350
5351         /* Check the Device ID and make sure it's one that we support */
5352         switch (devid) {
5353         case BCM4325_D11DUAL_ID:        /* 4325 802.11a/g id */
5354         case BCM4325_D11G_ID:   /* 4325 802.11g 2.4Ghz band id */
5355         case BCM4325_D11A_ID:   /* 4325 802.11a 5Ghz band id */
5356                 BRCMF_INFO(("%s: found 4325 Dongle\n", __func__));
5357                 break;
5358         case BCM4329_D11NDUAL_ID:       /* 4329 802.11n dualband device */
5359         case BCM4329_D11N2G_ID: /* 4329 802.11n 2.4G device */
5360         case BCM4329_D11N5G_ID: /* 4329 802.11n 5G device */
5361         case 0x4329:
5362                 BRCMF_INFO(("%s: found 4329 Dongle\n", __func__));
5363                 break;
5364         case BCM4319_D11N_ID:   /* 4319 802.11n id */
5365         case BCM4319_D11N2G_ID: /* 4319 802.11n2g id */
5366         case BCM4319_D11N5G_ID: /* 4319 802.11n5g id */
5367                 BRCMF_INFO(("%s: found 4319 Dongle\n", __func__));
5368                 break;
5369         case 0:
5370                 BRCMF_INFO(("%s: allow device id 0, will check chip"
5371                             " internals\n", __func__));
5372                 break;
5373
5374         default:
5375                 BRCMF_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
5376                              __func__, venid, devid));
5377                 return NULL;
5378         }
5379
5380         /* Allocate private bus interface state */
5381         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
5382         if (!bus) {
5383                 BRCMF_ERROR(("%s: kmalloc of struct dhd_bus failed\n",
5384                              __func__));
5385                 goto fail;
5386         }
5387         bus->card = card;
5388         bus->cl_devid = (u16) devid;
5389         bus->bus = BRCMF_BUS;
5390         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
5391         bus->usebufpool = false;        /* Use bufpool if allocated,
5392                                          else use locally malloced rxbuf */
5393
5394         /* attempt to attach to the dongle */
5395         if (!(brcmf_sdbrcm_probe_attach(bus, card, regsva, devid))) {
5396                 BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_attach failed\n",
5397                              __func__));
5398                 goto fail;
5399         }
5400
5401         spin_lock_init(&bus->txqlock);
5402         init_waitqueue_head(&bus->ctrl_wait);
5403
5404         /* Set up the watchdog timer */
5405         init_timer(&bus->timer);
5406         bus->timer.data = (unsigned long)bus;
5407         bus->timer.function = brcmf_sdbrcm_watchdog;
5408
5409         /* Initialize thread based operation and lock */
5410         if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)) {
5411                 bus->threads_only = true;
5412                 sema_init(&bus->sdsem, 1);
5413         } else {
5414                 bus->threads_only = false;
5415                 spin_lock_init(&bus->sdlock);
5416         }
5417
5418         if (brcmf_dpc_prio >= 0) {
5419                 /* Initialize watchdog thread */
5420                 init_completion(&bus->watchdog_wait);
5421                 bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
5422                                                 bus, "brcmf_watchdog");
5423                 if (IS_ERR(bus->watchdog_tsk)) {
5424                         printk(KERN_WARNING
5425                                "brcmf_watchdog thread failed to start\n");
5426                         bus->watchdog_tsk = NULL;
5427                 }
5428         } else
5429                 bus->watchdog_tsk = NULL;
5430
5431         /* Set up the bottom half handler */
5432         if (brcmf_dpc_prio >= 0) {
5433                 /* Initialize DPC thread */
5434                 init_completion(&bus->dpc_wait);
5435                 bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
5436                                            bus, "brcmf_dpc");
5437                 if (IS_ERR(bus->dpc_tsk)) {
5438                         printk(KERN_WARNING
5439                                "brcmf_dpc thread failed to start\n");
5440                         bus->dpc_tsk = NULL;
5441                 }
5442         } else {
5443                 tasklet_init(&bus->tasklet, brcmf_sdbrcm_dpc_tasklet,
5444                              (unsigned long)bus);
5445                 bus->dpc_tsk = NULL;
5446         }
5447
5448         /* Attach to the brcmf/OS/network interface */
5449         bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
5450         if (!bus->drvr) {
5451                 BRCMF_ERROR(("%s: brcmf_attach failed\n", __func__));
5452                 goto fail;
5453         }
5454
5455         /* Allocate buffers */
5456         if (!(brcmf_sdbrcm_probe_malloc(bus, card))) {
5457                 BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_malloc failed\n",
5458                              __func__));
5459                 goto fail;
5460         }
5461
5462         if (!(brcmf_sdbrcm_probe_init(bus, card))) {
5463                 BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_init failed\n", __func__));
5464                 goto fail;
5465         }
5466
5467         /* Register interrupt callback, but mask it (not operational yet). */
5468         BRCMF_INTR(("%s: disable SDIO interrupts (not interested yet)\n",
5469                     __func__));
5470         brcmf_sdcard_intr_disable(card);
5471         ret = brcmf_sdcard_intr_reg(card, brcmf_sdbrcm_isr, bus);
5472         if (ret != 0) {
5473                 BRCMF_ERROR(("%s: FAILED: sdcard_intr_reg returned %d\n",
5474                              __func__, ret));
5475                 goto fail;
5476         }
5477         BRCMF_INTR(("%s: registered SDIO interrupt function ok\n", __func__));
5478
5479         BRCMF_INFO(("%s: completed!!\n", __func__));
5480
5481         /* if firmware path present try to download and bring up bus */
5482         ret = brcmf_bus_start(bus->drvr);
5483         if (ret != 0) {
5484                 if (ret == -ENOLINK) {
5485                         BRCMF_ERROR(("%s: dongle is not responding\n",
5486                                      __func__));
5487                         goto fail;
5488                 }
5489         }
5490         /* Ok, have the per-port tell the stack we're open for business */
5491         if (brcmf_net_attach(bus->drvr, 0) != 0) {
5492                 BRCMF_ERROR(("%s: Net attach failed!!\n", __func__));
5493                 goto fail;
5494         }
5495
5496         return bus;
5497
5498 fail:
5499         brcmf_sdbrcm_release(bus);
5500         return NULL;
5501 }
5502
5503 static bool
5504 brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, void *card, u32 regsva,
5505                           u16 devid)
5506 {
5507         u8 clkctl = 0;
5508         int err = 0;
5509
5510         bus->alp_only = true;
5511
5512         /* Return the window to backplane enumeration space for core access */
5513         if (brcmf_sdbrcm_set_siaddr_window(bus, SI_ENUM_BASE))
5514                 BRCMF_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n",
5515                              __func__));
5516
5517 #ifdef BCMDBG
5518         printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
5519                brcmf_sdcard_reg_read(bus->card, SI_ENUM_BASE, 4));
5520
5521 #endif                          /* BCMDBG */
5522
5523         /*
5524          * Force PLL off until brcmf_sdbrcm_chip_attach()
5525          * programs PLL control regs
5526          */
5527
5528         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
5529                          BRCMF_INIT_CLKCTL1, &err);
5530         if (!err)
5531                 clkctl =
5532                     brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
5533                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
5534
5535         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
5536                 BRCMF_ERROR(("brcmf_sdbrcm_probe: ChipClkCSR access: err %d"
5537                              " wrote 0x%02x read 0x%02x\n",
5538                              err, BRCMF_INIT_CLKCTL1, clkctl));
5539                 goto fail;
5540         }
5541
5542         if (brcmf_sdbrcm_chip_attach(bus, regsva)) {
5543                 BRCMF_ERROR(("%s: brcmf_sdbrcm_chip_attach failed!\n",
5544                              __func__));
5545                 goto fail;
5546         }
5547
5548         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
5549                 BRCMF_ERROR(("%s: unsupported chip: 0x%04x\n",
5550                              __func__, bus->ci->chip));
5551                 goto fail;
5552         }
5553
5554         brcmf_sdbrcm_sdiod_drive_strength_init(bus, brcmf_sdiod_drive_strength);
5555
5556         /* Get info on the ARM and SOCRAM cores... */
5557         if (!BRCMF_NOPMU(bus)) {
5558                 brcmf_sdcard_reg_read(bus->card,
5559                           CORE_SB(bus->ci->armcorebase, sbidhigh), 4);
5560                 bus->orig_ramsize = bus->ci->ramsize;
5561                 if (!(bus->orig_ramsize)) {
5562                         BRCMF_ERROR(("%s: failed to find SOCRAM memory!\n",
5563                                      __func__));
5564                         goto fail;
5565                 }
5566                 bus->ramsize = bus->orig_ramsize;
5567                 if (brcmf_dongle_memsize)
5568                         brcmf_sdbrcm_setmemsize(bus, brcmf_dongle_memsize);
5569
5570                 BRCMF_ERROR(("DHD: dongle ram size is set to %d(orig %d)\n",
5571                              bus->ramsize, bus->orig_ramsize));
5572         }
5573
5574         /* Set core control so an SDIO reset does a backplane reset */
5575         OR_REG(bus->ci->buscorebase + offsetof(struct sdpcmd_regs,
5576                                                        corecontrol),
5577                CC_BPRESEN, u32);
5578
5579         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
5580
5581         /* Locate an appropriately-aligned portion of hdrbuf */
5582         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
5583                                     BRCMF_SDALIGN);
5584
5585         /* Set the poll and/or interrupt flags */
5586         bus->intr = (bool) brcmf_intr;
5587         bus->poll = (bool) brcmf_poll;
5588         if (bus->poll)
5589                 bus->pollrate = 1;
5590
5591         return true;
5592
5593 fail:
5594         return false;
5595 }
5596
5597 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus, void *card)
5598 {
5599         BRCMF_TRACE(("%s: Enter\n", __func__));
5600
5601         if (bus->drvr->maxctl) {
5602                 bus->rxblen =
5603                     roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
5604                             ALIGNMENT) + BRCMF_SDALIGN;
5605                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
5606                 if (!(bus->rxbuf)) {
5607                         BRCMF_ERROR(("%s: kmalloc of %d-byte rxbuf failed\n",
5608                                      __func__, bus->rxblen));
5609                         goto fail;
5610                 }
5611         }
5612
5613         /* Allocate buffer to receive glomed packet */
5614         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
5615         if (!(bus->databuf)) {
5616                 BRCMF_ERROR(("%s: kmalloc of %d-byte databuf failed\n",
5617                              __func__, MAX_DATA_BUF));
5618                 /* release rxbuf which was already located as above */
5619                 if (!bus->rxblen)
5620                         kfree(bus->rxbuf);
5621                 goto fail;
5622         }
5623
5624         /* Align the buffer */
5625         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
5626                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
5627                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
5628         else
5629                 bus->dataptr = bus->databuf;
5630
5631         return true;
5632
5633 fail:
5634         return false;
5635 }
5636
5637 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus, void *card)
5638 {
5639         s32 fnum;
5640
5641         BRCMF_TRACE(("%s: Enter\n", __func__));
5642
5643 #ifdef SDTEST
5644         brcmf_sdbrcm_pktgen_init(bus);
5645 #endif                          /* SDTEST */
5646
5647         /* Disable F2 to clear any intermediate frame state on the dongle */
5648         brcmf_sdcard_cfg_write(card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
5649                                SDIO_FUNC_ENABLE_1, NULL);
5650
5651         bus->drvr->busstate = BRCMF_BUS_DOWN;
5652         bus->sleeping = false;
5653         bus->rxflow = false;
5654
5655         /* Done with backplane-dependent accesses, can drop clock... */
5656         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0,
5657                                NULL);
5658
5659         /* ...and initialize clock/power states */
5660         bus->clkstate = CLK_SDONLY;
5661         bus->idletime = (s32) brcmf_idletime;
5662         bus->idleclock = BRCMF_IDLE_ACTIVE;
5663
5664         /* Query the F2 block size, set roundup accordingly */
5665         fnum = 2;
5666         if (brcmf_sdcard_iovar_op(card, "sd_blocksize", &fnum, sizeof(s32),
5667                             &bus->blocksize, sizeof(s32), false) != 0) {
5668                 bus->blocksize = 0;
5669                 BRCMF_ERROR(("%s: fail on %s get\n", __func__, "sd_blocksize"));
5670         } else {
5671                 BRCMF_INFO(("%s: Initial value for %s is %d\n",
5672                             __func__, "sd_blocksize", bus->blocksize));
5673         }
5674         bus->roundup = min(max_roundup, bus->blocksize);
5675
5676         /* Query if bus module supports packet chaining,
5677                  default to use if supported */
5678         if (brcmf_sdcard_iovar_op(card, "sd_rxchain", NULL, 0,
5679                             &bus->sd_rxchain, sizeof(s32),
5680                             false) != 0) {
5681                 bus->sd_rxchain = false;
5682         } else {
5683                 BRCMF_INFO(("%s: bus module (through sdiocard API) %s"
5684                             " chaining\n", __func__, bus->sd_rxchain
5685                             ? "supports" : "does not support"));
5686         }
5687         bus->use_rxchain = (bool) bus->sd_rxchain;
5688
5689         return true;
5690 }
5691
5692 static bool
5693 brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus, void *card)
5694 {
5695         bool ret;
5696
5697         /* Download the firmware */
5698         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5699
5700         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
5701
5702         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
5703
5704         return ret;
5705 }
5706
5707 /* Detach and free everything */
5708 static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
5709 {
5710         BRCMF_TRACE(("%s: Enter\n", __func__));
5711
5712         if (bus) {
5713                 /* De-register interrupt handler */
5714                 brcmf_sdcard_intr_disable(bus->card);
5715                 brcmf_sdcard_intr_dereg(bus->card);
5716
5717                 if (bus->drvr) {
5718                         brcmf_detach(bus->drvr);
5719                         brcmf_sdbrcm_release_dongle(bus);
5720                         bus->drvr = NULL;
5721                 }
5722
5723                 brcmf_sdbrcm_release_malloc(bus);
5724
5725                 kfree(bus);
5726         }
5727
5728         BRCMF_TRACE(("%s: Disconnected\n", __func__));
5729 }
5730
5731 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
5732 {
5733         BRCMF_TRACE(("%s: Enter\n", __func__));
5734
5735         if (bus->drvr && bus->drvr->dongle_reset)
5736                 return;
5737
5738         kfree(bus->rxbuf);
5739         bus->rxctl = bus->rxbuf = NULL;
5740         bus->rxlen = 0;
5741
5742         kfree(bus->databuf);
5743         bus->databuf = NULL;
5744 }
5745
5746 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
5747 {
5748         BRCMF_TRACE(("%s: Enter\n", __func__));
5749
5750         if (bus->drvr && bus->drvr->dongle_reset)
5751                 return;
5752
5753         if (bus->ci) {
5754                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5755                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
5756                 brcmf_sdbrcm_chip_detach(bus);
5757                 if (bus->vars && bus->varsz)
5758                         kfree(bus->vars);
5759                 bus->vars = NULL;
5760         }
5761
5762         BRCMF_TRACE(("%s: Disconnected\n", __func__));
5763 }
5764
5765 static void brcmf_sdbrcm_disconnect(void *ptr)
5766 {
5767         struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
5768
5769         BRCMF_TRACE(("%s: Enter\n", __func__));
5770
5771         if (bus) {
5772                 brcmf_sdbrcm_release(bus);
5773         }
5774
5775         BRCMF_TRACE(("%s: Disconnected\n", __func__));
5776 }
5777
5778 /* Register/Unregister functions are called by the main DHD entry
5779  * point (e.g. module insertion) to link with the bus driver, in
5780  * order to look for or await the device.
5781  */
5782
5783 static struct brcmf_sdioh_driver brcmf_sdio = {
5784         brcmf_sdbrcm_probe,
5785         brcmf_sdbrcm_disconnect
5786 };
5787
5788 int brcmf_bus_register(void)
5789 {
5790         BRCMF_TRACE(("%s: Enter\n", __func__));
5791
5792         /* Sanity check on the module parameters */
5793         do {
5794                 /* Both watchdog and DPC as tasklets are ok */
5795                 if ((brcmf_watchdog_prio < 0) && (brcmf_dpc_prio < 0))
5796                         break;
5797
5798                 /* If both watchdog and DPC are threads, TX must be deferred */
5799                 if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)
5800                     && brcmf_deferred_tx)
5801                         break;
5802
5803                 BRCMF_ERROR(("Invalid module parameters.\n"));
5804                 return -EINVAL;
5805         } while (0);
5806
5807         return brcmf_sdio_register(&brcmf_sdio);
5808 }
5809
5810 void brcmf_bus_unregister(void)
5811 {
5812         BRCMF_TRACE(("%s: Enter\n", __func__));
5813
5814         brcmf_sdio_unregister();
5815 }
5816
5817 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
5818 {
5819         int offset = 0;
5820         uint len;
5821         u8 *memblock = NULL, *memptr;
5822         int ret;
5823
5824         BRCMF_INFO(("%s: Enter\n", __func__));
5825
5826         bus->fw_name = BCM4329_FW_NAME;
5827         ret = request_firmware(&bus->firmware, bus->fw_name,
5828                                &gInstance->func[2]->dev);
5829         if (ret) {
5830                 BRCMF_ERROR(("%s: Fail to request firmware %d\n",
5831                              __func__, ret));
5832                 return ret;
5833         }
5834         bus->fw_ptr = 0;
5835
5836         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
5837         if (memblock == NULL) {
5838                 BRCMF_ERROR(("%s: Failed to allocate memory %d bytes\n",
5839                              __func__, MEMBLOCK));
5840                 ret = -ENOMEM;
5841                 goto err;
5842         }
5843         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
5844                 memptr += (BRCMF_SDALIGN -
5845                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
5846
5847         /* Download image */
5848         while ((len =
5849                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
5850                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
5851                 if (ret) {
5852                         BRCMF_ERROR(("%s: error %d on writing %d membytes at "
5853                                      "0x%08x\n", __func__, ret, MEMBLOCK,
5854                                      offset));
5855                         goto err;
5856                 }
5857
5858                 offset += MEMBLOCK;
5859         }
5860
5861 err:
5862         kfree(memblock);
5863
5864         release_firmware(bus->firmware);
5865         bus->fw_ptr = 0;
5866
5867         return ret;
5868 }
5869
5870 /*
5871  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
5872  * and ending in a NUL.
5873  * Removes carriage returns, empty lines, comment lines, and converts
5874  * newlines to NULs.
5875  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
5876  * by two NULs.
5877 */
5878
5879 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
5880 {
5881         char *dp;
5882         bool findNewline;
5883         int column;
5884         uint buf_len, n;
5885
5886         dp = varbuf;
5887
5888         findNewline = false;
5889         column = 0;
5890
5891         for (n = 0; n < len; n++) {
5892                 if (varbuf[n] == 0)
5893                         break;
5894                 if (varbuf[n] == '\r')
5895                         continue;
5896                 if (findNewline && varbuf[n] != '\n')
5897                         continue;
5898                 findNewline = false;
5899                 if (varbuf[n] == '#') {
5900                         findNewline = true;
5901                         continue;
5902                 }
5903                 if (varbuf[n] == '\n') {
5904                         if (column == 0)
5905                                 continue;
5906                         *dp++ = 0;
5907                         column = 0;
5908                         continue;
5909                 }
5910                 *dp++ = varbuf[n];
5911                 column++;
5912         }
5913         buf_len = dp - varbuf;
5914
5915         while (dp < varbuf + n)
5916                 *dp++ = 0;
5917
5918         return buf_len;
5919 }
5920
5921 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
5922 {
5923         uint len;
5924         char *memblock = NULL;
5925         char *bufp;
5926         int ret;
5927
5928         bus->nv_name = BCM4329_NV_NAME;
5929         ret = request_firmware(&bus->firmware, bus->nv_name,
5930                                &gInstance->func[2]->dev);
5931         if (ret) {
5932                 BRCMF_ERROR(("%s: Fail to request nvram %d\n", __func__, ret));
5933                 return ret;
5934         }
5935         bus->fw_ptr = 0;
5936
5937         memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
5938         if (memblock == NULL) {
5939                 BRCMF_ERROR(("%s: Failed to allocate memory %d bytes\n",
5940                              __func__, MEMBLOCK));
5941                 ret = -ENOMEM;
5942                 goto err;
5943         }
5944
5945         len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
5946
5947         if (len > 0 && len < MEMBLOCK) {
5948                 bufp = (char *)memblock;
5949                 bufp[len] = 0;
5950                 len = brcmf_process_nvram_vars(bufp, len);
5951                 bufp += len;
5952                 *bufp++ = 0;
5953                 if (len)
5954                         ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
5955                 if (ret)
5956                         BRCMF_ERROR(("%s: error downloading vars: %d\n",
5957                                      __func__, ret));
5958         } else {
5959                 BRCMF_ERROR(("%s: error reading nvram file: %d\n",
5960                              __func__, len));
5961                 ret = -EIO;
5962         }
5963
5964 err:
5965         kfree(memblock);
5966
5967         release_firmware(bus->firmware);
5968         bus->fw_ptr = 0;
5969
5970         return ret;
5971 }
5972
5973 static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
5974 {
5975         int bcmerror = -1;
5976
5977         /* Keep arm in reset */
5978         if (brcmf_sdbrcm_download_state(bus, true)) {
5979                 BRCMF_ERROR(("%s: error placing ARM core in reset\n",
5980                              __func__));
5981                 goto err;
5982         }
5983
5984         /* External image takes precedence if specified */
5985         if (brcmf_sdbrcm_download_code_file(bus)) {
5986                 BRCMF_ERROR(("%s: dongle image file download failed\n",
5987                              __func__));
5988                 goto err;
5989         }
5990
5991         /* External nvram takes precedence if specified */
5992         if (brcmf_sdbrcm_download_nvram(bus)) {
5993                 BRCMF_ERROR(("%s: dongle nvram file download failed\n",
5994                              __func__));
5995         }
5996
5997         /* Take arm out of reset */
5998         if (brcmf_sdbrcm_download_state(bus, false)) {
5999                 BRCMF_ERROR(("%s: error getting out of ARM core reset\n",
6000                              __func__));
6001                 goto err;
6002         }
6003
6004         bcmerror = 0;
6005
6006 err:
6007         return bcmerror;
6008 }
6009
6010
6011 static int
6012 brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn, uint flags,
6013                     u8 *buf, uint nbytes, struct sk_buff *pkt,
6014                     void (*complete)(void *handle, int status,
6015                                      bool sync_waiting),
6016                     void *handle)
6017 {
6018         return brcmf_sdcard_send_buf
6019                 (bus->card, addr, fn, flags, buf, nbytes, pkt, complete,
6020                  handle);
6021 }
6022
6023 int brcmf_bus_devreset(struct brcmf_pub *drvr, u8 flag)
6024 {
6025         int bcmerror = 0;
6026         struct brcmf_bus *bus;
6027
6028         bus = drvr->bus;
6029
6030         if (flag == true) {
6031                 brcmf_sdbrcm_wd_timer(bus, 0);
6032                 if (!bus->drvr->dongle_reset) {
6033                         /* Expect app to have torn down any
6034                          connection before calling */
6035                         /* Stop the bus, disable F2 */
6036                         brcmf_sdbrcm_bus_stop(bus, false);
6037
6038                         /* Clean tx/rx buffer pointers,
6039                          detach from the dongle */
6040                         brcmf_sdbrcm_release_dongle(bus);
6041
6042                         bus->drvr->dongle_reset = true;
6043                         bus->drvr->up = false;
6044
6045                         BRCMF_TRACE(("%s:  WLAN OFF DONE\n", __func__));
6046                         /* App can now remove power from device */
6047                 } else
6048                         bcmerror = -EIO;
6049         } else {
6050                 /* App must have restored power to device before calling */
6051
6052                 BRCMF_TRACE(("\n\n%s: == WLAN ON ==\n", __func__));
6053
6054                 if (bus->drvr->dongle_reset) {
6055                         /* Turn on WLAN */
6056
6057                         /* Attempt to re-attach & download */
6058                         if (brcmf_sdbrcm_probe_attach(bus, bus->card,
6059                                                       SI_ENUM_BASE,
6060                                                       bus->cl_devid)) {
6061                                 /* Attempt to download binary to the dongle */
6062                                 if (brcmf_sdbrcm_probe_init(bus, bus->card)) {
6063                                         /* Re-init bus, enable F2 transfer */
6064                                         brcmf_sdbrcm_bus_init(bus->drvr, false);
6065
6066                                         bus->drvr->dongle_reset = false;
6067                                         bus->drvr->up = true;
6068
6069                                         BRCMF_TRACE(("%s: WLAN ON DONE\n",
6070                                                      __func__));
6071                                 } else
6072                                         bcmerror = -EIO;
6073                         } else
6074                                 bcmerror = -EIO;
6075                 } else {
6076                         bcmerror = -EISCONN;
6077                         BRCMF_ERROR(("%s: Set DEVRESET=false invoked when"
6078                                      " device is on\n", __func__));
6079                         bcmerror = -EIO;
6080                 }
6081                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
6082         }
6083         return bcmerror;
6084 }
6085
6086 static int
6087 brcmf_sdbrcm_chip_recognition(struct brcmf_sdio_card *card,
6088                               struct chip_info *ci, u32 regs)
6089 {
6090         u32 regdata;
6091
6092         /*
6093          * Get CC core rev
6094          * Chipid is assume to be at offset 0 from regs arg
6095          * For different chiptypes or old sdio hosts w/o chipcommon,
6096          * other ways of recognition should be added here.
6097          */
6098         ci->cccorebase = regs;
6099         regdata = brcmf_sdcard_reg_read(card,
6100                                 CORE_CC_REG(ci->cccorebase, chipid), 4);
6101         ci->chip = regdata & CID_ID_MASK;
6102         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
6103
6104         BRCMF_INFO(("%s: chipid=0x%x chiprev=%d\n",
6105                     __func__, ci->chip, ci->chiprev));
6106
6107         /* Address of cores for new chips should be added here */
6108         switch (ci->chip) {
6109         case BCM4329_CHIP_ID:
6110                 ci->buscorebase = BCM4329_CORE_BUS_BASE;
6111                 ci->ramcorebase = BCM4329_CORE_SOCRAM_BASE;
6112                 ci->armcorebase = BCM4329_CORE_ARM_BASE;
6113                 ci->ramsize = BCM4329_RAMSIZE;
6114                 break;
6115         default:
6116                 BRCMF_ERROR(("%s: chipid 0x%x is not supported\n",
6117                              __func__, ci->chip));
6118                 return -ENODEV;
6119         }
6120
6121         regdata = brcmf_sdcard_reg_read(card,
6122                 CORE_SB(ci->cccorebase, sbidhigh), 4);
6123         ci->ccrev = SBCOREREV(regdata);
6124
6125         regdata = brcmf_sdcard_reg_read(card,
6126                 CORE_CC_REG(ci->cccorebase, pmucapabilities), 4);
6127         ci->pmurev = regdata & PCAP_REV_MASK;
6128
6129         regdata = brcmf_sdcard_reg_read(card,
6130                                         CORE_SB(ci->buscorebase, sbidhigh), 4);
6131         ci->buscorerev = SBCOREREV(regdata);
6132         ci->buscoretype = (regdata & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
6133
6134         BRCMF_INFO(("%s: ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
6135                     __func__, ci->ccrev, ci->pmurev,
6136                     ci->buscorerev, ci->buscoretype));
6137
6138         /* get chipcommon capabilites */
6139         ci->cccaps = brcmf_sdcard_reg_read(card,
6140                 CORE_CC_REG(ci->cccorebase, capabilities), 4);
6141
6142         return 0;
6143 }
6144
6145 static void
6146 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_card *card, u32 corebase)
6147 {
6148         u32 regdata;
6149
6150         regdata = brcmf_sdcard_reg_read(card,
6151                 CORE_SB(corebase, sbtmstatelow), 4);
6152         if (regdata & SBTML_RESET)
6153                 return;
6154
6155         regdata = brcmf_sdcard_reg_read(card,
6156                 CORE_SB(corebase, sbtmstatelow), 4);
6157         if ((regdata & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) != 0) {
6158                 /*
6159                  * set target reject and spin until busy is clear
6160                  * (preserve core-specific bits)
6161                  */
6162                 regdata = brcmf_sdcard_reg_read(card,
6163                         CORE_SB(corebase, sbtmstatelow), 4);
6164                 brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6165                         regdata | SBTML_REJ);
6166
6167                 regdata = brcmf_sdcard_reg_read(card,
6168                         CORE_SB(corebase, sbtmstatelow), 4);
6169                 udelay(1);
6170                 SPINWAIT((brcmf_sdcard_reg_read(card,
6171                         CORE_SB(corebase, sbtmstatehigh), 4) &
6172                         SBTMH_BUSY), 100000);
6173
6174                 regdata = brcmf_sdcard_reg_read(card,
6175                         CORE_SB(corebase, sbtmstatehigh), 4);
6176                 if (regdata & SBTMH_BUSY)
6177                         BRCMF_ERROR(("%s: ARM core still busy\n", __func__));
6178
6179                 regdata = brcmf_sdcard_reg_read(card,
6180                         CORE_SB(corebase, sbidlow), 4);
6181                 if (regdata & SBIDL_INIT) {
6182                         regdata = brcmf_sdcard_reg_read(card,
6183                                 CORE_SB(corebase, sbimstate), 4) |
6184                                 SBIM_RJ;
6185                         brcmf_sdcard_reg_write(card,
6186                                 CORE_SB(corebase, sbimstate), 4,
6187                                 regdata);
6188                         regdata = brcmf_sdcard_reg_read(card,
6189                                 CORE_SB(corebase, sbimstate), 4);
6190                         udelay(1);
6191                         SPINWAIT((brcmf_sdcard_reg_read(card,
6192                                 CORE_SB(corebase, sbimstate), 4) &
6193                                 SBIM_BY), 100000);
6194                 }
6195
6196                 /* set reset and reject while enabling the clocks */
6197                 brcmf_sdcard_reg_write(card,
6198                         CORE_SB(corebase, sbtmstatelow), 4,
6199                         (((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
6200                         SBTML_REJ | SBTML_RESET));
6201                 regdata = brcmf_sdcard_reg_read(card,
6202                         CORE_SB(corebase, sbtmstatelow), 4);
6203                 udelay(10);
6204
6205                 /* clear the initiator reject bit */
6206                 regdata = brcmf_sdcard_reg_read(card,
6207                         CORE_SB(corebase, sbidlow), 4);
6208                 if (regdata & SBIDL_INIT) {
6209                         regdata = brcmf_sdcard_reg_read(card,
6210                                 CORE_SB(corebase, sbimstate), 4) &
6211                                 ~SBIM_RJ;
6212                         brcmf_sdcard_reg_write(card,
6213                                 CORE_SB(corebase, sbimstate), 4,
6214                                 regdata);
6215                 }
6216         }
6217
6218         /* leave reset and reject asserted */
6219         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6220                 (SBTML_REJ | SBTML_RESET));
6221         udelay(1);
6222 }
6223
6224 static int
6225 brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs)
6226 {
6227         struct chip_info *ci;
6228         int err;
6229         u8 clkval, clkset;
6230
6231         BRCMF_TRACE(("%s: Enter\n", __func__));
6232
6233         /* alloc chip_info_t */
6234         ci = kmalloc(sizeof(struct chip_info), GFP_ATOMIC);
6235         if (NULL == ci) {
6236                 BRCMF_ERROR(("%s: malloc failed!\n", __func__));
6237                 return -ENOMEM;
6238         }
6239
6240         memset((unsigned char *)ci, 0, sizeof(struct chip_info));
6241
6242         /* bus/core/clk setup for register access */
6243         /* Try forcing SDIO core to do ALPAvail request only */
6244         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
6245         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
6246                         clkset, &err);
6247         if (err) {
6248                 BRCMF_ERROR(("%s: error writing for HT off\n", __func__));
6249                 goto fail;
6250         }
6251
6252         /* If register supported, wait for ALPAvail and then force ALP */
6253         /* This may take up to 15 milliseconds */
6254         clkval = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
6255                         SBSDIO_FUNC1_CHIPCLKCSR, NULL);
6256         if ((clkval & ~SBSDIO_AVBITS) == clkset) {
6257                 SPINWAIT(((clkval =
6258                                 brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
6259                                                 SBSDIO_FUNC1_CHIPCLKCSR,
6260                                                 NULL)),
6261                                 !SBSDIO_ALPAV(clkval)),
6262                                 PMU_MAX_TRANSITION_DLY);
6263                 if (!SBSDIO_ALPAV(clkval)) {
6264                         BRCMF_ERROR(("%s: timeout on ALPAV wait,"
6265                                      " clkval 0x%02x\n", __func__, clkval));
6266                         err = -EBUSY;
6267                         goto fail;
6268                 }
6269                 clkset = SBSDIO_FORCE_HW_CLKREQ_OFF |
6270                                 SBSDIO_FORCE_ALP;
6271                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
6272                                 SBSDIO_FUNC1_CHIPCLKCSR,
6273                                 clkset, &err);
6274                 udelay(65);
6275         } else {
6276                 BRCMF_ERROR(("%s: ChipClkCSR access: wrote 0x%02x"
6277                              " read 0x%02x\n", __func__, clkset, clkval));
6278                 err = -EACCES;
6279                 goto fail;
6280         }
6281
6282         /* Also, disable the extra SDIO pull-ups */
6283         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP,
6284                                0, NULL);
6285
6286         err = brcmf_sdbrcm_chip_recognition(bus->card, ci, regs);
6287         if (err)
6288                 goto fail;
6289
6290         /*
6291          * Make sure any on-chip ARM is off (in case strapping is wrong),
6292          * or downloaded code was already running.
6293          */
6294         brcmf_sdbrcm_chip_disablecore(bus->card, ci->armcorebase);
6295
6296         brcmf_sdcard_reg_write(bus->card,
6297                 CORE_CC_REG(ci->cccorebase, gpiopullup), 4, 0);
6298         brcmf_sdcard_reg_write(bus->card,
6299                 CORE_CC_REG(ci->cccorebase, gpiopulldown), 4, 0);
6300
6301         /* Disable F2 to clear any intermediate frame state on the dongle */
6302         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
6303                 SDIO_FUNC_ENABLE_1, NULL);
6304
6305         /* WAR: cmd52 backplane read so core HW will drop ALPReq */
6306         clkval = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
6307                         0, NULL);
6308
6309         /* Done with backplane-dependent accesses, can drop clock... */
6310         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
6311                                0, NULL);
6312
6313         bus->ci = ci;
6314         return 0;
6315 fail:
6316         bus->ci = NULL;
6317         kfree(ci);
6318         return err;
6319 }
6320
6321 static void
6322 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_card *card, u32 corebase)
6323 {
6324         u32 regdata;
6325
6326         /*
6327          * Must do the disable sequence first to work for
6328          * arbitrary current core state.
6329          */
6330         brcmf_sdbrcm_chip_disablecore(card, corebase);
6331
6332         /*
6333          * Now do the initialization sequence.
6334          * set reset while enabling the clock and
6335          * forcing them on throughout the core
6336          */
6337         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6338                 ((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
6339                 SBTML_RESET);
6340         udelay(1);
6341
6342         regdata = brcmf_sdcard_reg_read(card, CORE_SB(corebase, sbtmstatehigh),
6343                                         4);
6344         if (regdata & SBTMH_SERR)
6345                 brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatehigh),
6346                                        4, 0);
6347
6348         regdata = brcmf_sdcard_reg_read(card, CORE_SB(corebase, sbimstate), 4);
6349         if (regdata & (SBIM_IBE | SBIM_TO))
6350                 brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbimstate), 4,
6351                         regdata & ~(SBIM_IBE | SBIM_TO));
6352
6353         /* clear reset and allow it to propagate throughout the core */
6354         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6355                 (SICF_FGC << SBTML_SICF_SHIFT) |
6356                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
6357         udelay(1);
6358
6359         /* leave clock enabled */
6360         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6361                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
6362         udelay(1);
6363 }
6364
6365 /* SDIO Pad drive strength to select value mappings */
6366 struct sdiod_drive_str {
6367         u8 strength;    /* Pad Drive Strength in mA */
6368         u8 sel;         /* Chip-specific select value */
6369 };
6370
6371 /* SDIO Drive Strength to sel value table for PMU Rev 1 */
6372 static const struct sdiod_drive_str sdiod_drive_strength_tab1[] = {
6373         {
6374         4, 0x2}, {
6375         2, 0x3}, {
6376         1, 0x0}, {
6377         0, 0x0}
6378         };
6379
6380 /* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
6381 static const struct sdiod_drive_str sdiod_drive_strength_tab2[] = {
6382         {
6383         12, 0x7}, {
6384         10, 0x6}, {
6385         8, 0x5}, {
6386         6, 0x4}, {
6387         4, 0x2}, {
6388         2, 0x1}, {
6389         0, 0x0}
6390         };
6391
6392 /* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
6393 static const struct sdiod_drive_str sdiod_drive_strength_tab3[] = {
6394         {
6395         32, 0x7}, {
6396         26, 0x6}, {
6397         22, 0x5}, {
6398         16, 0x4}, {
6399         12, 0x3}, {
6400         8, 0x2}, {
6401         4, 0x1}, {
6402         0, 0x0}
6403         };
6404
6405 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
6406
6407 static void
6408 brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus, u32 drivestrength) {
6409         struct sdiod_drive_str *str_tab = NULL;
6410         u32 str_mask = 0;
6411         u32 str_shift = 0;
6412         char chn[8];
6413
6414         if (!(bus->ci->cccaps & CC_CAP_PMU))
6415                 return;
6416
6417         switch (SDIOD_DRVSTR_KEY(bus->ci->chip, bus->ci->pmurev)) {
6418         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
6419                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab1;
6420                 str_mask = 0x30000000;
6421                 str_shift = 28;
6422                 break;
6423         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
6424         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
6425                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab2;
6426                 str_mask = 0x00003800;
6427                 str_shift = 11;
6428                 break;
6429         case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
6430                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab3;
6431                 str_mask = 0x00003800;
6432                 str_shift = 11;
6433                 break;
6434         default:
6435                 BRCMF_ERROR(("No SDIO Drive strength init"
6436                              "done for chip %s rev %d pmurev %d\n",
6437                              brcmu_chipname(bus->ci->chip, chn, 8),
6438                              bus->ci->chiprev, bus->ci->pmurev));
6439                 break;
6440         }
6441
6442         if (str_tab != NULL) {
6443                 u32 drivestrength_sel = 0;
6444                 u32 cc_data_temp;
6445                 int i;
6446
6447                 for (i = 0; str_tab[i].strength != 0; i++) {
6448                         if (drivestrength >= str_tab[i].strength) {
6449                                 drivestrength_sel = str_tab[i].sel;
6450                                 break;
6451                         }
6452                 }
6453
6454                 brcmf_sdcard_reg_write(bus->card,
6455                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
6456                         4, 1);
6457                 cc_data_temp = brcmf_sdcard_reg_read(bus->card,
6458                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr), 4);
6459                 cc_data_temp &= ~str_mask;
6460                 drivestrength_sel <<= str_shift;
6461                 cc_data_temp |= drivestrength_sel;
6462                 brcmf_sdcard_reg_write(bus->card,
6463                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
6464                         4, cc_data_temp);
6465
6466                 BRCMF_INFO(("SDIO: %dmA drive strength selected, "
6467                             "set to 0x%08x\n", drivestrength, cc_data_temp));
6468         }
6469 }
6470
6471 static void
6472 brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus)
6473 {
6474         BRCMF_TRACE(("%s: Enter\n", __func__));
6475
6476         kfree(bus->ci);
6477         bus->ci = NULL;
6478 }
6479
6480 static void
6481 brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
6482 {
6483         brcmf_sdbrcm_sdunlock(bus);
6484         wait_event_interruptible_timeout(bus->ctrl_wait,
6485                                          (*lockvar == false), HZ * 2);
6486         brcmf_sdbrcm_sdlock(bus);
6487         return;
6488 }
6489
6490 static void
6491 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
6492 {
6493         if (waitqueue_active(&bus->ctrl_wait))
6494                 wake_up_interruptible(&bus->ctrl_wait);
6495         return;
6496 }
6497
6498 static int
6499 brcmf_sdbrcm_watchdog_thread(void *data)
6500 {
6501         struct brcmf_bus *bus = (struct brcmf_bus *)data;
6502
6503         /* This thread doesn't need any user-level access,
6504         * so get rid of all our resources
6505         */
6506         if (brcmf_watchdog_prio > 0) {
6507                 struct sched_param param;
6508                 param.sched_priority = (brcmf_watchdog_prio < MAX_RT_PRIO) ?
6509                                        brcmf_watchdog_prio : (MAX_RT_PRIO - 1);
6510                 sched_setscheduler(current, SCHED_FIFO, &param);
6511         }
6512
6513         allow_signal(SIGTERM);
6514         /* Run until signal received */
6515         while (1) {
6516                 if (kthread_should_stop())
6517                         break;
6518                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
6519                         if (bus->drvr->dongle_reset == false)
6520                                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
6521                         /* Count the tick for reference */
6522                         bus->drvr->tickcnt++;
6523                 } else
6524                         break;
6525         }
6526         return 0;
6527 }
6528
6529 static void
6530 brcmf_sdbrcm_watchdog(unsigned long data)
6531 {
6532         struct brcmf_bus *bus = (struct brcmf_bus *)data;
6533
6534         if (brcmf_watchdog_prio >= 0) {
6535                 if (bus->watchdog_tsk)
6536                         complete(&bus->watchdog_wait);
6537                 else
6538                         return;
6539         } else {
6540                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
6541
6542                 /* Count the tick for reference */
6543                 bus->drvr->tickcnt++;
6544         }
6545
6546         /* Reschedule the watchdog */
6547         if (bus->wd_timer_valid)
6548                 mod_timer(&bus->timer, jiffies + brcmf_watchdog_ms * HZ / 1000);
6549 }
6550
6551 void
6552 brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
6553 {
6554         static uint save_ms;
6555
6556         /* don't start the wd until fw is loaded */
6557         if (bus->drvr->busstate == BRCMF_BUS_DOWN)
6558                 return;
6559
6560         /* Totally stop the timer */
6561         if (!wdtick && bus->wd_timer_valid == true) {
6562                 del_timer_sync(&bus->timer);
6563                 bus->wd_timer_valid = false;
6564                 save_ms = wdtick;
6565                 return;
6566         }
6567
6568         if (wdtick) {
6569                 brcmf_watchdog_ms = (uint) wdtick;
6570
6571                 if (save_ms != brcmf_watchdog_ms) {
6572                         if (bus->wd_timer_valid == true)
6573                                 /* Stop timer and restart at new value */
6574                                 del_timer_sync(&bus->timer);
6575
6576                         /* Create timer again when watchdog period is
6577                            dynamically changed or in the first instance
6578                          */
6579                         bus->timer.expires =
6580                                 jiffies + brcmf_watchdog_ms * HZ / 1000;
6581                         add_timer(&bus->timer);
6582
6583                 } else {
6584                         /* Re arm the timer, at last watchdog period */
6585                         mod_timer(&bus->timer,
6586                                 jiffies + brcmf_watchdog_ms * HZ / 1000);
6587                 }
6588
6589                 bus->wd_timer_valid = true;
6590                 save_ms = wdtick;
6591         }
6592 }
6593
6594 static int brcmf_sdbrcm_dpc_thread(void *data)
6595 {
6596         struct brcmf_bus *bus = (struct brcmf_bus *) data;
6597
6598         /* This thread doesn't need any user-level access,
6599          * so get rid of all our resources
6600          */
6601         if (brcmf_dpc_prio > 0) {
6602                 struct sched_param param;
6603                 param.sched_priority = (brcmf_dpc_prio < MAX_RT_PRIO) ?
6604                                        brcmf_dpc_prio : (MAX_RT_PRIO - 1);
6605                 sched_setscheduler(current, SCHED_FIFO, &param);
6606         }
6607
6608         allow_signal(SIGTERM);
6609         /* Run until signal received */
6610         while (1) {
6611                 if (kthread_should_stop())
6612                         break;
6613                 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
6614                         /* Call bus dpc unless it indicated down
6615                         (then clean stop) */
6616                         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
6617                                 if (brcmf_sdbrcm_dpc(bus))
6618                                         complete(&bus->dpc_wait);
6619                         } else {
6620                                 brcmf_sdbrcm_bus_stop(bus, true);
6621                         }
6622                 } else
6623                         break;
6624         }
6625         return 0;
6626 }
6627
6628 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data)
6629 {
6630         struct brcmf_bus *bus = (struct brcmf_bus *) data;
6631
6632         /* Call bus dpc unless it indicated down (then clean stop) */
6633         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
6634                 if (brcmf_sdbrcm_dpc(bus))
6635                         tasklet_schedule(&bus->tasklet);
6636         } else
6637                 brcmf_sdbrcm_bus_stop(bus, true);
6638 }
6639
6640 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus)
6641 {
6642         if (bus->dpc_tsk) {
6643                 complete(&bus->dpc_wait);
6644                 return;
6645         }
6646
6647         tasklet_schedule(&bus->tasklet);
6648 }
6649
6650 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus)
6651 {
6652         if (bus->threads_only)
6653                 down(&bus->sdsem);
6654         else
6655                 spin_lock_bh(&bus->sdlock);
6656 }
6657
6658 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus)
6659 {
6660         if (bus->threads_only)
6661                 up(&bus->sdsem);
6662         else
6663                 spin_unlock_bh(&bus->sdlock);
6664 }
6665
6666 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
6667 {
6668         if (bus->firmware->size < bus->fw_ptr + len)
6669                 len = bus->firmware->size - bus->fw_ptr;
6670
6671         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
6672         bus->fw_ptr += len;
6673         return len;
6674 }
6675
6676 MODULE_FIRMWARE(BCM4329_FW_NAME);
6677 MODULE_FIRMWARE(BCM4329_NV_NAME);