drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <linux/module.h>
  31 #include <linux/bcma/bcma.h>
  32 #include <asm/unaligned.h>
  33 #include <defs.h>
  34 #include <brcmu_wifi.h>
  35 #include <brcmu_utils.h>
  36 #include <brcm_hw_ids.h>
  37 #include <soc.h>
  38 #include "sdio_host.h"
  39 #include "sdio_chip.h"
  40
  41 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
  42
  43 #ifdef BCMDBG
  44
  45 #define BRCMF_TRAP_INFO_SIZE    80
  46
  47 #define CBUF_LEN        (128)
  48
  49 struct rte_log_le {
  50         __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  51         __le32 buf_size;
  52         __le32 idx;
  53         char *_buf_compat;      /* Redundant pointer for backward compat. */
  54 };
  55
  56 struct rte_console {
  57         /* Virtual UART
  58          * When there is no UART (e.g. Quickturn),
  59          * the host should write a complete
  60          * input line directly into cbuf and then write
  61          * the length into vcons_in.
  62          * This may also be used when there is a real UART
  63          * (at risk of conflicting with
  64          * the real UART).  vcons_out is currently unused.
  65          */
  66         uint vcons_in;
  67         uint vcons_out;
  68
  69         /* Output (logging) buffer
  70          * Console output is written to a ring buffer log_buf at index log_idx.
  71          * The host may read the output when it sees log_idx advance.
  72          * Output will be lost if the output wraps around faster than the host
  73          * polls.
  74          */
  75         struct rte_log_le log_le;
  76
  77         /* Console input line buffer
  78          * Characters are read one at a time into cbuf
  79          * until <CR> is received, then
  80          * the buffer is processed as a command line.
  81          * Also used for virtual UART.
  82          */
  83         uint cbuf_idx;
  84         char cbuf[CBUF_LEN];
  85 };
  86
  87 #endif                          /* BCMDBG */
  88 #include <chipcommon.h>
  89
  90 #include "dhd.h"
  91 #include "dhd_bus.h"
  92 #include "dhd_proto.h"
  93 #include "dhd_dbg.h"
  94
  95 #define TXQLEN          2048    /* bulk tx queue length */
  96 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
  97 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
  98 #define PRIOMASK        7
  99
 100 #define TXRETRIES       2       /* # of retries for tx frames */
 101
 102 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 103                                  one scheduling */
 104
 105 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 106                                  one scheduling */
 107
 108 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 109
 110 #define MEMBLOCK        2048    /* Block size used for downloading
 111                                  of dongle image */
 112 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 113                                  biggest possible glom */
 114
 115 #define BRCMF_FIRSTREAD (1 << 6)
 116
 117
 118 /* SBSDIO_DEVICE_CTL */
 119
 120 /* 1: device will assert busy signal when receiving CMD53 */
 121 #define SBSDIO_DEVCTL_SETBUSY           0x01
 122 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 123 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 124 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 125 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 126 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 127  * sdio bus power cycle to clear (rev 9) */
 128 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 129 /* Force SD->SB reset mapping (rev 11) */
 130 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 131 /*   Determined by CoreControl bit */
 132 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 133 /*   Force backplane reset */
 134 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 135 /*   Force no backplane reset */
 136 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 137
 138 /* direct(mapped) cis space */
 139
 140 /* MAPPED common CIS address */
 141 #define SBSDIO_CIS_BASE_COMMON          0x1000
 142 /* maximum bytes in one CIS */
 143 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 144 /* cis offset addr is < 17 bits */
 145 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 146
 147 /* manfid tuple length, include tuple, link bytes */
 148 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 149
 150 /* intstatus */
 151 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 152 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 153 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 154 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 155 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 156 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 157 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 158 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 159 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 160 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 161 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 162 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 163 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 164 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 165 #define I_PC            (1 << 10)       /* descriptor error */
 166 #define I_PD            (1 << 11)       /* data error */
 167 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 168 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 169 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 170 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 171 #define I_RI            (1 << 16)       /* Receive Interrupt */
 172 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 173 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 174 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 175 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 176 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 177 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 178 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 179 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 180 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 181 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 182 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 183 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 184
 185 /* corecontrol */
 186 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 187 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 188 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 189 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 190 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 191 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 192
 193 /* SDA_FRAMECTRL */
 194 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 195 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 196 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 197 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 198
 199 /* HW frame tag */
 200 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 201
 202 /* Total length of frame header for dongle protocol */
 203 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 204 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 205
 206 /*
 207  * Software allocation of To SB Mailbox resources
 208  */
 209
 210 /* tosbmailbox bits corresponding to intstatus bits */
 211 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 212 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 213 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 214 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 215
 216 /* tosbmailboxdata */
 217 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 218
 219 /*
 220  * Software allocation of To Host Mailbox resources
 221  */
 222
 223 /* intstatus bits */
 224 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 225 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 226 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 227 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 228
 229 /* tohostmailboxdata */
 230 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 231 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 232 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 233 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 234
 235 #define HMB_DATA_FCDATA_MASK    0xff000000
 236 #define HMB_DATA_FCDATA_SHIFT   24
 237
 238 #define HMB_DATA_VERSION_MASK   0x00ff0000
 239 #define HMB_DATA_VERSION_SHIFT  16
 240
 241 /*
 242  * Software-defined protocol header
 243  */
 244
 245 /* Current protocol version */
 246 #define SDPCM_PROT_VERSION      4
 247
 248 /* SW frame header */
 249 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 250
 251 #define SDPCM_CHANNEL_MASK              0x00000f00
 252 #define SDPCM_CHANNEL_SHIFT             8
 253 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 254
 255 #define SDPCM_NEXTLEN_OFFSET            2
 256
 257 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 258 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 259 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 260 #define SDPCM_DOFFSET_MASK              0xff000000
 261 #define SDPCM_DOFFSET_SHIFT             24
 262 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 263 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 264 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 265 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 266
 267 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 268
 269 /* logical channel numbers */
 270 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 271 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 272 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 273 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 274 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 275
 276 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 277
 278 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 279
 280 /*
 281  * Shared structure between dongle and the host.
 282  * The structure contains pointers to trap or assert information.
 283  */
 284 #define SDPCM_SHARED_VERSION       0x0002
 285 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 286 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 287 #define SDPCM_SHARED_ASSERT        0x0200
 288 #define SDPCM_SHARED_TRAP          0x0400
 289
 290 /* Space for header read, limit for data packets */
 291 #define MAX_HDR_READ    (1 << 6)
 292 #define MAX_RX_DATASZ   2048
 293
 294 /* Maximum milliseconds to wait for F2 to come up */
 295 #define BRCMF_WAIT_F2RDY        3000
 296
 297 /* Bump up limit on waiting for HT to account for first startup;
 298  * if the image is doing a CRC calculation before programming the PMU
 299  * for HT availability, it could take a couple hundred ms more, so
 300  * max out at a 1 second (1000000us).
 301  */
 302 #undef PMU_MAX_TRANSITION_DLY
 303 #define PMU_MAX_TRANSITION_DLY 1000000
 304
 305 /* Value for ChipClockCSR during initial setup */
 306 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 307                                         SBSDIO_ALP_AVAIL_REQ)
 308
 309 /* Flags for SDH calls */
 310 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 311
 312 #define BRCMFMAC_FW_NAME        "brcm/brcmfmac.bin"
 313 #define BRCMFMAC_NV_NAME        "brcm/brcmfmac.txt"
 314 MODULE_FIRMWARE(BRCMFMAC_FW_NAME);
 315 MODULE_FIRMWARE(BRCMFMAC_NV_NAME);
 316
 317 /*
 318  * Conversion of 802.1D priority to precedence level
 319  */
 320 static uint prio2prec(u32 prio)
 321 {
 322         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 323                (prio^2) : prio;
 324 }
 325
 326 /* core registers */
 327 struct sdpcmd_regs {
 328         u32 corecontrol;                /* 0x00, rev8 */
 329         u32 corestatus;                 /* rev8 */
 330         u32 PAD[1];
 331         u32 biststatus;                 /* rev8 */
 332
 333         /* PCMCIA access */
 334         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 335         u16 PAD[1];
 336         u16 pcmciamesportalmask;        /* rev8 */
 337         u16 PAD[1];
 338         u16 pcmciawrframebc;            /* rev8 */
 339         u16 PAD[1];
 340         u16 pcmciaunderflowtimer;       /* rev8 */
 341         u16 PAD[1];
 342
 343         /* interrupt */
 344         u32 intstatus;                  /* 0x020, rev8 */
 345         u32 hostintmask;                /* rev8 */
 346         u32 intmask;                    /* rev8 */
 347         u32 sbintstatus;                /* rev8 */
 348         u32 sbintmask;                  /* rev8 */
 349         u32 funcintmask;                /* rev4 */
 350         u32 PAD[2];
 351         u32 tosbmailbox;                /* 0x040, rev8 */
 352         u32 tohostmailbox;              /* rev8 */
 353         u32 tosbmailboxdata;            /* rev8 */
 354         u32 tohostmailboxdata;          /* rev8 */
 355
 356         /* synchronized access to registers in SDIO clock domain */
 357         u32 sdioaccess;                 /* 0x050, rev8 */
 358         u32 PAD[3];
 359
 360         /* PCMCIA frame control */
 361         u8 pcmciaframectrl;             /* 0x060, rev8 */
 362         u8 PAD[3];
 363         u8 pcmciawatermark;             /* rev8 */
 364         u8 PAD[155];
 365
 366         /* interrupt batching control */
 367         u32 intrcvlazy;                 /* 0x100, rev8 */
 368         u32 PAD[3];
 369
 370         /* counters */
 371         u32 cmd52rd;                    /* 0x110, rev8 */
 372         u32 cmd52wr;                    /* rev8 */
 373         u32 cmd53rd;                    /* rev8 */
 374         u32 cmd53wr;                    /* rev8 */
 375         u32 abort;                      /* rev8 */
 376         u32 datacrcerror;               /* rev8 */
 377         u32 rdoutofsync;                /* rev8 */
 378         u32 wroutofsync;                /* rev8 */
 379         u32 writebusy;                  /* rev8 */
 380         u32 readwait;                   /* rev8 */
 381         u32 readterm;                   /* rev8 */
 382         u32 writeterm;                  /* rev8 */
 383         u32 PAD[40];
 384         u32 clockctlstatus;             /* rev8 */
 385         u32 PAD[7];
 386
 387         u32 PAD[128];                   /* DMA engines */
 388
 389         /* SDIO/PCMCIA CIS region */
 390         char cis[512];                  /* 0x400-0x5ff, rev6 */
 391
 392         /* PCMCIA function control registers */
 393         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 394         u16 PAD[55];
 395
 396         /* PCMCIA backplane access */
 397         u16 backplanecsr;               /* 0x76E, rev6 */
 398         u16 backplaneaddr0;             /* rev6 */
 399         u16 backplaneaddr1;             /* rev6 */
 400         u16 backplaneaddr2;             /* rev6 */
 401         u16 backplaneaddr3;             /* rev6 */
 402         u16 backplanedata0;             /* rev6 */
 403         u16 backplanedata1;             /* rev6 */
 404         u16 backplanedata2;             /* rev6 */
 405         u16 backplanedata3;             /* rev6 */
 406         u16 PAD[31];
 407
 408         /* sprom "size" & "blank" info */
 409         u16 spromstatus;                /* 0x7BE, rev2 */
 410         u32 PAD[464];
 411
 412         u16 PAD[0x80];
 413 };
 414
 415 #ifdef BCMDBG
 416 /* Device console log buffer state */
 417 struct brcmf_console {
 418         uint count;             /* Poll interval msec counter */
 419         uint log_addr;          /* Log struct address (fixed) */
 420         struct rte_log_le log_le;       /* Log struct (host copy) */
 421         uint bufsize;           /* Size of log buffer */
 422         u8 *buf;                /* Log buffer (host copy) */
 423         uint last;              /* Last buffer read index */
 424 };
 425 #endif                          /* BCMDBG */
 426
 427 struct sdpcm_shared {
 428         u32 flags;
 429         u32 trap_addr;
 430         u32 assert_exp_addr;
 431         u32 assert_file_addr;
 432         u32 assert_line;
 433         u32 console_addr;       /* Address of struct rte_console */
 434         u32 msgtrace_addr;
 435         u8 tag[32];
 436 };
 437
 438 struct sdpcm_shared_le {
 439         __le32 flags;
 440         __le32 trap_addr;
 441         __le32 assert_exp_addr;
 442         __le32 assert_file_addr;
 443         __le32 assert_line;
 444         __le32 console_addr;    /* Address of struct rte_console */
 445         __le32 msgtrace_addr;
 446         u8 tag[32];
 447 };
 448
 449
 450 /* misc chip info needed by some of the routines */
 451 /* Private data for SDIO bus interaction */
 452 struct brcmf_sdio {
 453         struct brcmf_pub *drvr;
 454
 455         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 456         struct chip_info *ci;   /* Chip info struct */
 457         char *vars;             /* Variables (from CIS and/or other) */
 458         uint varsz;             /* Size of variables buffer */
 459
 460         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 461
 462         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 463         u32 intstatus;  /* Intstatus bits (events) pending */
 464         bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
 465         bool fcstate;           /* State of dongle flow-control */
 466
 467         uint blocksize;         /* Block size of SDIO transfers */
 468         uint roundup;           /* Max roundup limit */
 469
 470         struct pktq txq;        /* Queue length used for flow-control */
 471         u8 flowcontrol; /* per prio flow control bitmask */
 472         u8 tx_seq;              /* Transmit sequence number (next) */
 473         u8 tx_max;              /* Maximum transmit sequence allowed */
 474
 475         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 476         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 477         u16 nextlen;            /* Next Read Len from last header */
 478         u8 rx_seq;              /* Receive sequence number (expected) */
 479         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 480
 481         uint rxbound;           /* Rx frames to read before resched */
 482         uint txbound;           /* Tx frames to send before resched */
 483         uint txminmax;
 484
 485         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 486         struct sk_buff_head glom; /* Packet list for glommed superframe */
 487         uint glomerr;           /* Glom packet read errors */
 488
 489         u8 *rxbuf;              /* Buffer for receiving control packets */
 490         uint rxblen;            /* Allocated length of rxbuf */
 491         u8 *rxctl;              /* Aligned pointer into rxbuf */
 492         u8 *databuf;            /* Buffer for receiving big glom packet */
 493         u8 *dataptr;            /* Aligned pointer into databuf */
 494         uint rxlen;             /* Length of valid data in buffer */
 495
 496         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 497
 498         bool intr;              /* Use interrupts */
 499         bool poll;              /* Use polling */
 500         bool ipend;             /* Device interrupt is pending */
 501         uint intrcount;         /* Count of device interrupt callbacks */
 502         uint lastintrs;         /* Count as of last watchdog timer */
 503         uint spurious;          /* Count of spurious interrupts */
 504         uint pollrate;          /* Ticks between device polls */
 505         uint polltick;          /* Tick counter */
 506         uint pollcnt;           /* Count of active polls */
 507
 508 #ifdef BCMDBG
 509         uint console_interval;
 510         struct brcmf_console console;   /* Console output polling support */
 511         uint console_addr;      /* Console address from shared struct */
 512 #endif                          /* BCMDBG */
 513
 514         uint regfails;          /* Count of R_REG failures */
 515
 516         uint clkstate;          /* State of sd and backplane clock(s) */
 517         bool activity;          /* Activity flag for clock down */
 518         s32 idletime;           /* Control for activity timeout */
 519         s32 idlecount;  /* Activity timeout counter */
 520         s32 idleclock;  /* How to set bus driver when idle */
 521         s32 sd_rxchain;
 522         bool use_rxchain;       /* If brcmf should use PKT chains */
 523         bool sleeping;          /* Is SDIO bus sleeping? */
 524         bool rxflow_mode;       /* Rx flow control mode */
 525         bool rxflow;            /* Is rx flow control on */
 526         bool alp_only;          /* Don't use HT clock (ALP only) */
 527 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
 528         bool usebufpool;
 529
 530         /* Some additional counters */
 531         uint tx_sderrs;         /* Count of tx attempts with sd errors */
 532         uint fcqueued;          /* Tx packets that got queued */
 533         uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 534         uint rx_toolong;        /* Receive frames too long to receive */
 535         uint rxc_errors;        /* SDIO errors when reading control frames */
 536         uint rx_hdrfail;        /* SDIO errors on header reads */
 537         uint rx_badhdr;         /* Bad received headers (roosync?) */
 538         uint rx_badseq;         /* Mismatched rx sequence number */
 539         uint fc_rcvd;           /* Number of flow-control events received */
 540         uint fc_xoff;           /* Number which turned on flow-control */
 541         uint fc_xon;            /* Number which turned off flow-control */
 542         uint rxglomfail;        /* Failed deglom attempts */
 543         uint rxglomframes;      /* Number of glom frames (superframes) */
 544         uint rxglompkts;        /* Number of packets from glom frames */
 545         uint f2rxhdrs;          /* Number of header reads */
 546         uint f2rxdata;          /* Number of frame data reads */
 547         uint f2txdata;          /* Number of f2 frame writes */
 548         uint f1regdata;         /* Number of f1 register accesses */
 549         uint tickcnt;           /* Number of watchdog been schedule */
 550         unsigned long tx_ctlerrs;       /* Err of sending ctrl frames */
 551         unsigned long tx_ctlpkts;       /* Ctrl frames sent to dongle */
 552         unsigned long rx_ctlerrs;       /* Err of processing rx ctrl frames */
 553         unsigned long rx_ctlpkts;       /* Ctrl frames processed from dongle */
 554         unsigned long rx_readahead_cnt; /* Number of packets where header
 555                                          * read-ahead was used. */
 556
 557         u8 *ctrl_frame_buf;
 558         u32 ctrl_frame_len;
 559         bool ctrl_frame_stat;
 560
 561         spinlock_t txqlock;
 562         wait_queue_head_t ctrl_wait;
 563         wait_queue_head_t dcmd_resp_wait;
 564
 565         struct timer_list timer;
 566         struct completion watchdog_wait;
 567         struct task_struct *watchdog_tsk;
 568         bool wd_timer_valid;
 569         uint save_ms;
 570
 571         struct task_struct *dpc_tsk;
 572         struct completion dpc_wait;
 573
 574         struct semaphore sdsem;
 575
 576         const struct firmware *firmware;
 577         u32 fw_ptr;
 578 };
 579
 580 /* clkstate */
 581 #define CLK_NONE        0
 582 #define CLK_SDONLY      1
 583 #define CLK_PENDING     2       /* Not used yet */
 584 #define CLK_AVAIL       3
 585
 586 #ifdef BCMDBG
 587 static int qcount[NUMPRIO];
 588 static int tx_packets[NUMPRIO];
 589 #endif                          /* BCMDBG */
 590
 591 #define SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 592
 593 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 594
 595 /* Retry count for register access failures */
 596 static const uint retry_limit = 2;
 597
 598 /* Limit on rounding up frames */
 599 static const uint max_roundup = 512;
 600
 601 #define ALIGNMENT  4
 602
 603 static void pkt_align(struct sk_buff *p, int len, int align)
 604 {
 605         uint datalign;
 606         datalign = (unsigned long)(p->data);
 607         datalign = roundup(datalign, (align)) - datalign;
 608         if (datalign)
 609                 skb_pull(p, datalign);
 610         __skb_trim(p, len);
 611 }
 612
 613 /* To check if there's window offered */
 614 static bool data_ok(struct brcmf_sdio *bus)
 615 {
 616         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 617                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 618 }
 619
 620 /*
 621  * Reads a register in the SDIO hardware block. This block occupies a series of
 622  * adresses on the 32 bit backplane bus.
 623  */
 624 static void
 625 r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
 626 {
 627         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 628         *retryvar = 0;
 629         do {
 630                 *regvar = brcmf_sdcard_reg_read(bus->sdiodev,
 631                                 bus->ci->c_inf[idx].base + reg_offset,
 632                                 sizeof(u32));
 633         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 634                  (++(*retryvar) <= retry_limit));
 635         if (*retryvar) {
 636                 bus->regfails += (*retryvar-1);
 637                 if (*retryvar > retry_limit) {
 638                         brcmf_dbg(ERROR, "FAILED READ %Xh\n", reg_offset);
 639                         *regvar = 0;
 640                 }
 641         }
 642 }
 643
 644 static void
 645 w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset, u32 *retryvar)
 646 {
 647         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 648         *retryvar = 0;
 649         do {
 650                 brcmf_sdcard_reg_write(bus->sdiodev,
 651                                        bus->ci->c_inf[idx].base + reg_offset,
 652                                        sizeof(u32), regval);
 653         } while (brcmf_sdcard_regfail(bus->sdiodev) &&
 654                  (++(*retryvar) <= retry_limit));
 655         if (*retryvar) {
 656                 bus->regfails += (*retryvar-1);
 657                 if (*retryvar > retry_limit)
 658                         brcmf_dbg(ERROR, "FAILED REGISTER WRITE %Xh\n",
 659                                   reg_offset);
 660         }
 661 }
 662
 663 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 664
 665 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 666
 667 /* Packet free applicable unconditionally for sdio and sdspi.
 668  * Conditional if bufpool was present for gspi bus.
 669  */
 670 static void brcmf_sdbrcm_pktfree2(struct brcmf_sdio *bus, struct sk_buff *pkt)
 671 {
 672         if (bus->usebufpool)
 673                 brcmu_pkt_buf_free_skb(pkt);
 674 }
 675
 676 /* Turn backplane clock on or off */
 677 static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 678 {
 679         int err;
 680         u8 clkctl, clkreq, devctl;
 681         unsigned long timeout;
 682
 683         brcmf_dbg(TRACE, "Enter\n");
 684
 685         clkctl = 0;
 686
 687         if (on) {
 688                 /* Request HT Avail */
 689                 clkreq =
 690                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 691
 692                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 693                                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 694                 if (err) {
 695                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 696                         return -EBADE;
 697                 }
 698
 699                 /* Check current status */
 700                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 701                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
 702                 if (err) {
 703                         brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
 704                         return -EBADE;
 705                 }
 706
 707                 /* Go to pending and await interrupt if appropriate */
 708                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 709                         /* Allow only clock-available interrupt */
 710                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 711                                         SDIO_FUNC_1,
 712                                         SBSDIO_DEVICE_CTL, &err);
 713                         if (err) {
 714                                 brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
 715                                           err);
 716                                 return -EBADE;
 717                         }
 718
 719                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 720                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 721                                                SBSDIO_DEVICE_CTL, devctl, &err);
 722                         brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
 723                         bus->clkstate = CLK_PENDING;
 724
 725                         return 0;
 726                 } else if (bus->clkstate == CLK_PENDING) {
 727                         /* Cancel CA-only interrupt filter */
 728                         devctl =
 729                             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
 730                                                   SBSDIO_DEVICE_CTL, &err);
 731                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 732                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 733                                 SBSDIO_DEVICE_CTL, devctl, &err);
 734                 }
 735
 736                 /* Otherwise, wait here (polling) for HT Avail */
 737                 timeout = jiffies +
 738                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 739                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 740                         clkctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 741                                                        SDIO_FUNC_1,
 742                                                        SBSDIO_FUNC1_CHIPCLKCSR,
 743                                                        &err);
 744                         if (time_after(jiffies, timeout))
 745                                 break;
 746                         else
 747                                 usleep_range(5000, 10000);
 748                 }
 749                 if (err) {
 750                         brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
 751                         return -EBADE;
 752                 }
 753                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 754                         brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
 755                                   PMU_MAX_TRANSITION_DLY, clkctl);
 756                         return -EBADE;
 757                 }
 758
 759                 /* Mark clock available */
 760                 bus->clkstate = CLK_AVAIL;
 761                 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
 762
 763 #if defined(BCMDBG)
 764                 if (bus->alp_only != true) {
 765                         if (SBSDIO_ALPONLY(clkctl))
 766                                 brcmf_dbg(ERROR, "HT Clock should be on\n");
 767                 }
 768 #endif                          /* defined (BCMDBG) */
 769
 770                 bus->activity = true;
 771         } else {
 772                 clkreq = 0;
 773
 774                 if (bus->clkstate == CLK_PENDING) {
 775                         /* Cancel CA-only interrupt filter */
 776                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
 777                                         SDIO_FUNC_1,
 778                                         SBSDIO_DEVICE_CTL, &err);
 779                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 780                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 781                                 SBSDIO_DEVICE_CTL, devctl, &err);
 782                 }
 783
 784                 bus->clkstate = CLK_SDONLY;
 785                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 786                         SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
 787                 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
 788                 if (err) {
 789                         brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
 790                                   err);
 791                         return -EBADE;
 792                 }
 793         }
 794         return 0;
 795 }
 796
 797 /* Change idle/active SD state */
 798 static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
 799 {
 800         brcmf_dbg(TRACE, "Enter\n");
 801
 802         if (on)
 803                 bus->clkstate = CLK_SDONLY;
 804         else
 805                 bus->clkstate = CLK_NONE;
 806
 807         return 0;
 808 }
 809
 810 /* Transition SD and backplane clock readiness */
 811 static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 812 {
 813 #ifdef BCMDBG
 814         uint oldstate = bus->clkstate;
 815 #endif                          /* BCMDBG */
 816
 817         brcmf_dbg(TRACE, "Enter\n");
 818
 819         /* Early exit if we're already there */
 820         if (bus->clkstate == target) {
 821                 if (target == CLK_AVAIL) {
 822                         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 823                         bus->activity = true;
 824                 }
 825                 return 0;
 826         }
 827
 828         switch (target) {
 829         case CLK_AVAIL:
 830                 /* Make sure SD clock is available */
 831                 if (bus->clkstate == CLK_NONE)
 832                         brcmf_sdbrcm_sdclk(bus, true);
 833                 /* Now request HT Avail on the backplane */
 834                 brcmf_sdbrcm_htclk(bus, true, pendok);
 835                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 836                 bus->activity = true;
 837                 break;
 838
 839         case CLK_SDONLY:
 840                 /* Remove HT request, or bring up SD clock */
 841                 if (bus->clkstate == CLK_NONE)
 842                         brcmf_sdbrcm_sdclk(bus, true);
 843                 else if (bus->clkstate == CLK_AVAIL)
 844                         brcmf_sdbrcm_htclk(bus, false, false);
 845                 else
 846                         brcmf_dbg(ERROR, "request for %d -> %d\n",
 847                                   bus->clkstate, target);
 848                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 849                 break;
 850
 851         case CLK_NONE:
 852                 /* Make sure to remove HT request */
 853                 if (bus->clkstate == CLK_AVAIL)
 854                         brcmf_sdbrcm_htclk(bus, false, false);
 855                 /* Now remove the SD clock */
 856                 brcmf_sdbrcm_sdclk(bus, false);
 857                 brcmf_sdbrcm_wd_timer(bus, 0);
 858                 break;
 859         }
 860 #ifdef BCMDBG
 861         brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
 862 #endif                          /* BCMDBG */
 863
 864         return 0;
 865 }
 866
 867 static int brcmf_sdbrcm_bussleep(struct brcmf_sdio *bus, bool sleep)
 868 {
 869         uint retries = 0;
 870
 871         brcmf_dbg(INFO, "request %s (currently %s)\n",
 872                   sleep ? "SLEEP" : "WAKE",
 873                   bus->sleeping ? "SLEEP" : "WAKE");
 874
 875         /* Done if we're already in the requested state */
 876         if (sleep == bus->sleeping)
 877                 return 0;
 878
 879         /* Going to sleep: set the alarm and turn off the lights... */
 880         if (sleep) {
 881                 /* Don't sleep if something is pending */
 882                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
 883                         return -EBUSY;
 884
 885                 /* Make sure the controller has the bus up */
 886                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
 887
 888                 /* Tell device to start using OOB wakeup */
 889                 w_sdreg32(bus, SMB_USE_OOB,
 890                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
 891                 if (retries > retry_limit)
 892                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
 893
 894                 /* Turn off our contribution to the HT clock request */
 895                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
 896
 897                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 898                         SBSDIO_FUNC1_CHIPCLKCSR,
 899                         SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
 900
 901                 /* Isolate the bus */
 902                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 903                         SBSDIO_DEVICE_CTL,
 904                         SBSDIO_DEVCTL_PADS_ISO, NULL);
 905
 906                 /* Change state */
 907                 bus->sleeping = true;
 908
 909         } else {
 910                 /* Waking up: bus power up is ok, set local state */
 911
 912                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
 913                         SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
 914
 915                 /* Make sure the controller has the bus up */
 916                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
 917
 918                 /* Send misc interrupt to indicate OOB not needed */
 919                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
 920                           &retries);
 921                 if (retries <= retry_limit)
 922                         w_sdreg32(bus, SMB_DEV_INT,
 923                                   offsetof(struct sdpcmd_regs, tosbmailbox),
 924                                   &retries);
 925
 926                 if (retries > retry_limit)
 927                         brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
 928
 929                 /* Make sure we have SD bus access */
 930                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
 931
 932                 /* Change state */
 933                 bus->sleeping = false;
 934         }
 935
 936         return 0;
 937 }
 938
 939 static void bus_wake(struct brcmf_sdio *bus)
 940 {
 941         if (bus->sleeping)
 942                 brcmf_sdbrcm_bussleep(bus, false);
 943 }
 944
 945 static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
 946 {
 947         u32 intstatus = 0;
 948         u32 hmb_data;
 949         u8 fcbits;
 950         uint retries = 0;
 951
 952         brcmf_dbg(TRACE, "Enter\n");
 953
 954         /* Read mailbox data and ack that we did so */
 955         r_sdreg32(bus, &hmb_data,
 956                   offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
 957
 958         if (retries <= retry_limit)
 959                 w_sdreg32(bus, SMB_INT_ACK,
 960                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
 961         bus->f1regdata += 2;
 962
 963         /* Dongle recomposed rx frames, accept them again */
 964         if (hmb_data & HMB_DATA_NAKHANDLED) {
 965                 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
 966                           bus->rx_seq);
 967                 if (!bus->rxskip)
 968                         brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
 969
 970                 bus->rxskip = false;
 971                 intstatus |= I_HMB_FRAME_IND;
 972         }
 973
 974         /*
 975          * DEVREADY does not occur with gSPI.
 976          */
 977         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
 978                 bus->sdpcm_ver =
 979                     (hmb_data & HMB_DATA_VERSION_MASK) >>
 980                     HMB_DATA_VERSION_SHIFT;
 981                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
 982                         brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
 983                                   "expecting %d\n",
 984                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
 985                 else
 986                         brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
 987                                   bus->sdpcm_ver);
 988         }
 989
 990         /*
 991          * Flow Control has been moved into the RX headers and this out of band
 992          * method isn't used any more.
 993          * remaining backward compatible with older dongles.
 994          */
 995         if (hmb_data & HMB_DATA_FC) {
 996                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
 997                                                         HMB_DATA_FCDATA_SHIFT;
 998
 999                 if (fcbits & ~bus->flowcontrol)
1000                         bus->fc_xoff++;
1001
1002                 if (bus->flowcontrol & ~fcbits)
1003                         bus->fc_xon++;
1004
1005                 bus->fc_rcvd++;
1006                 bus->flowcontrol = fcbits;
1007         }
1008
1009         /* Shouldn't be any others */
1010         if (hmb_data & ~(HMB_DATA_DEVREADY |
1011                          HMB_DATA_NAKHANDLED |
1012                          HMB_DATA_FC |
1013                          HMB_DATA_FWREADY |
1014                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1015                 brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
1016                           hmb_data);
1017
1018         return intstatus;
1019 }
1020
1021 static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
1022 {
1023         uint retries = 0;
1024         u16 lastrbc;
1025         u8 hi, lo;
1026         int err;
1027
1028         brcmf_dbg(ERROR, "%sterminate frame%s\n",
1029                   abort ? "abort command, " : "",
1030                   rtx ? ", send NAK" : "");
1031
1032         if (abort)
1033                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1034
1035         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1036                                SBSDIO_FUNC1_FRAMECTRL,
1037                                SFC_RF_TERM, &err);
1038         bus->f1regdata++;
1039
1040         /* Wait until the packet has been flushed (device/FIFO stable) */
1041         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1042                 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1043                                            SBSDIO_FUNC1_RFRAMEBCHI, NULL);
1044                 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1045                                            SBSDIO_FUNC1_RFRAMEBCLO, NULL);
1046                 bus->f1regdata += 2;
1047
1048                 if ((hi == 0) && (lo == 0))
1049                         break;
1050
1051                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1052                         brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
1053                                   lastrbc, (hi << 8) + lo);
1054                 }
1055                 lastrbc = (hi << 8) + lo;
1056         }
1057
1058         if (!retries)
1059                 brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
1060         else
1061                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
1062
1063         if (rtx) {
1064                 bus->rxrtx++;
1065                 w_sdreg32(bus, SMB_NAK,
1066                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1067
1068                 bus->f1regdata++;
1069                 if (retries <= retry_limit)
1070                         bus->rxskip = true;
1071         }
1072
1073         /* Clear partial in any case */
1074         bus->nextlen = 0;
1075
1076         /* If we can't reach the device, signal failure */
1077         if (err || brcmf_sdcard_regfail(bus->sdiodev))
1078                 bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
1079 }
1080
1081 /* copy a buffer into a pkt buffer chain */
1082 static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_sdio *bus, uint len)
1083 {
1084         uint n, ret = 0;
1085         struct sk_buff *p;
1086         u8 *buf;
1087
1088         buf = bus->dataptr;
1089
1090         /* copy the data */
1091         skb_queue_walk(&bus->glom, p) {
1092                 n = min_t(uint, p->len, len);
1093                 memcpy(p->data, buf, n);
1094                 buf += n;
1095                 len -= n;
1096                 ret += n;
1097                 if (!len)
1098                         break;
1099         }
1100
1101         return ret;
1102 }
1103
1104 /* return total length of buffer chain */
1105 static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
1106 {
1107         struct sk_buff *p;
1108         uint total;
1109
1110         total = 0;
1111         skb_queue_walk(&bus->glom, p)
1112                 total += p->len;
1113         return total;
1114 }
1115
1116 static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
1117 {
1118         struct sk_buff *cur, *next;
1119
1120         skb_queue_walk_safe(&bus->glom, cur, next) {
1121                 skb_unlink(cur, &bus->glom);
1122                 brcmu_pkt_buf_free_skb(cur);
1123         }
1124 }
1125
1126 static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1127 {
1128         u16 dlen, totlen;
1129         u8 *dptr, num = 0;
1130
1131         u16 sublen, check;
1132         struct sk_buff *pfirst, *pnext;
1133
1134         int errcode;
1135         u8 chan, seq, doff, sfdoff;
1136         u8 txmax;
1137
1138         int ifidx = 0;
1139         bool usechain = bus->use_rxchain;
1140
1141         /* If packets, issue read(s) and send up packet chain */
1142         /* Return sequence numbers consumed? */
1143
1144         brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
1145                   bus->glomd, skb_peek(&bus->glom));
1146
1147         /* If there's a descriptor, generate the packet chain */
1148         if (bus->glomd) {
1149                 pfirst = pnext = NULL;
1150                 dlen = (u16) (bus->glomd->len);
1151                 dptr = bus->glomd->data;
1152                 if (!dlen || (dlen & 1)) {
1153                         brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
1154                                   dlen);
1155                         dlen = 0;
1156                 }
1157
1158                 for (totlen = num = 0; dlen; num++) {
1159                         /* Get (and move past) next length */
1160                         sublen = get_unaligned_le16(dptr);
1161                         dlen -= sizeof(u16);
1162                         dptr += sizeof(u16);
1163                         if ((sublen < SDPCM_HDRLEN) ||
1164                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1165                                 brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
1166                                           num, sublen);
1167                                 pnext = NULL;
1168                                 break;
1169                         }
1170                         if (sublen % BRCMF_SDALIGN) {
1171                                 brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
1172                                           sublen, BRCMF_SDALIGN);
1173                                 usechain = false;
1174                         }
1175                         totlen += sublen;
1176
1177                         /* For last frame, adjust read len so total
1178                                  is a block multiple */
1179                         if (!dlen) {
1180                                 sublen +=
1181                                     (roundup(totlen, bus->blocksize) - totlen);
1182                                 totlen = roundup(totlen, bus->blocksize);
1183                         }
1184
1185                         /* Allocate/chain packet for next subframe */
1186                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1187                         if (pnext == NULL) {
1188                                 brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
1189                                           num, sublen);
1190                                 break;
1191                         }
1192                         skb_queue_tail(&bus->glom, pnext);
1193
1194                         /* Adhere to start alignment requirements */
1195                         pkt_align(pnext, sublen, BRCMF_SDALIGN);
1196                 }
1197
1198                 /* If all allocations succeeded, save packet chain
1199                          in bus structure */
1200                 if (pnext) {
1201                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1202                                   totlen, num);
1203                         if (BRCMF_GLOM_ON() && bus->nextlen &&
1204                             totlen != bus->nextlen) {
1205                                 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1206                                           bus->nextlen, totlen, rxseq);
1207                         }
1208                         pfirst = pnext = NULL;
1209                 } else {
1210                         brcmf_sdbrcm_free_glom(bus);
1211                         num = 0;
1212                 }
1213
1214                 /* Done with descriptor packet */
1215                 brcmu_pkt_buf_free_skb(bus->glomd);
1216                 bus->glomd = NULL;
1217                 bus->nextlen = 0;
1218         }
1219
1220         /* Ok -- either we just generated a packet chain,
1221                  or had one from before */
1222         if (!skb_queue_empty(&bus->glom)) {
1223                 if (BRCMF_GLOM_ON()) {
1224                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1225                         skb_queue_walk(&bus->glom, pnext) {
1226                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1227                                           pnext, (u8 *) (pnext->data),
1228                                           pnext->len, pnext->len);
1229                         }
1230                 }
1231
1232                 pfirst = skb_peek(&bus->glom);
1233                 dlen = (u16) brcmf_sdbrcm_glom_len(bus);
1234
1235                 /* Do an SDIO read for the superframe.  Configurable iovar to
1236                  * read directly into the chained packet, or allocate a large
1237                  * packet and and copy into the chain.
1238                  */
1239                 if (usechain) {
1240                         errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
1241                                         bus->sdiodev->sbwad,
1242                                         SDIO_FUNC_2, F2SYNC, &bus->glom);
1243                 } else if (bus->dataptr) {
1244                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1245                                         bus->sdiodev->sbwad,
1246                                         SDIO_FUNC_2, F2SYNC,
1247                                         bus->dataptr, dlen);
1248                         sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
1249                         if (sublen != dlen) {
1250                                 brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
1251                                           dlen, sublen);
1252                                 errcode = -1;
1253                         }
1254                         pnext = NULL;
1255                 } else {
1256                         brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1257                                   dlen);
1258                         errcode = -1;
1259                 }
1260                 bus->f2rxdata++;
1261
1262                 /* On failure, kill the superframe, allow a couple retries */
1263                 if (errcode < 0) {
1264                         brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
1265                                   dlen, errcode);
1266                         bus->drvr->rx_errors++;
1267
1268                         if (bus->glomerr++ < 3) {
1269                                 brcmf_sdbrcm_rxfail(bus, true, true);
1270                         } else {
1271                                 bus->glomerr = 0;
1272                                 brcmf_sdbrcm_rxfail(bus, true, false);
1273                                 bus->rxglomfail++;
1274                                 brcmf_sdbrcm_free_glom(bus);
1275                         }
1276                         return 0;
1277                 }
1278 #ifdef BCMDBG
1279                 if (BRCMF_GLOM_ON()) {
1280                         printk(KERN_DEBUG "SUPERFRAME:\n");
1281                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1282                                 pfirst->data, min_t(int, pfirst->len, 48));
1283                 }
1284 #endif
1285
1286                 /* Validate the superframe header */
1287                 dptr = (u8 *) (pfirst->data);
1288                 sublen = get_unaligned_le16(dptr);
1289                 check = get_unaligned_le16(dptr + sizeof(u16));
1290
1291                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1292                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1293                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1294                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1295                         brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
1296                                   bus->nextlen, seq);
1297                         bus->nextlen = 0;
1298                 }
1299                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1300                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1301
1302                 errcode = 0;
1303                 if ((u16)~(sublen ^ check)) {
1304                         brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
1305                                   sublen, check);
1306                         errcode = -1;
1307                 } else if (roundup(sublen, bus->blocksize) != dlen) {
1308                         brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
1309                                   sublen, roundup(sublen, bus->blocksize),
1310                                   dlen);
1311                         errcode = -1;
1312                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
1313                            SDPCM_GLOM_CHANNEL) {
1314                         brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
1315                                   SDPCM_PACKET_CHANNEL(
1316                                           &dptr[SDPCM_FRAMETAG_LEN]));
1317                         errcode = -1;
1318                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
1319                         brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
1320                         errcode = -1;
1321                 } else if ((doff < SDPCM_HDRLEN) ||
1322                            (doff > (pfirst->len - SDPCM_HDRLEN))) {
1323                         brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
1324                                   doff, sublen, pfirst->len, SDPCM_HDRLEN);
1325                         errcode = -1;
1326                 }
1327
1328                 /* Check sequence number of superframe SW header */
1329                 if (rxseq != seq) {
1330                         brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
1331                                   seq, rxseq);
1332                         bus->rx_badseq++;
1333                         rxseq = seq;
1334                 }
1335
1336                 /* Check window for sanity */
1337                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1338                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1339                                   txmax, bus->tx_seq);
1340                         txmax = bus->tx_seq + 2;
1341                 }
1342                 bus->tx_max = txmax;
1343
1344                 /* Remove superframe header, remember offset */
1345                 skb_pull(pfirst, doff);
1346                 sfdoff = doff;
1347                 num = 0;
1348
1349                 /* Validate all the subframe headers */
1350                 skb_queue_walk(&bus->glom, pnext) {
1351                         /* leave when invalid subframe is found */
1352                         if (errcode)
1353                                 break;
1354
1355                         dptr = (u8 *) (pnext->data);
1356                         dlen = (u16) (pnext->len);
1357                         sublen = get_unaligned_le16(dptr);
1358                         check = get_unaligned_le16(dptr + sizeof(u16));
1359                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1360                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1361 #ifdef BCMDBG
1362                         if (BRCMF_GLOM_ON()) {
1363                                 printk(KERN_DEBUG "subframe:\n");
1364                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1365                                                      dptr, 32);
1366                         }
1367 #endif
1368
1369                         if ((u16)~(sublen ^ check)) {
1370                                 brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
1371                                           num, sublen, check);
1372                                 errcode = -1;
1373                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
1374                                 brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
1375                                           num, sublen, dlen);
1376                                 errcode = -1;
1377                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
1378                                    (chan != SDPCM_EVENT_CHANNEL)) {
1379                                 brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
1380                                           num, chan);
1381                                 errcode = -1;
1382                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
1383                                 brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
1384                                           num, doff, sublen, SDPCM_HDRLEN);
1385                                 errcode = -1;
1386                         }
1387                         /* increase the subframe count */
1388                         num++;
1389                 }
1390
1391                 if (errcode) {
1392                         /* Terminate frame on error, request
1393                                  a couple retries */
1394                         if (bus->glomerr++ < 3) {
1395                                 /* Restore superframe header space */
1396                                 skb_push(pfirst, sfdoff);
1397                                 brcmf_sdbrcm_rxfail(bus, true, true);
1398                         } else {
1399                                 bus->glomerr = 0;
1400                                 brcmf_sdbrcm_rxfail(bus, true, false);
1401                                 bus->rxglomfail++;
1402                                 brcmf_sdbrcm_free_glom(bus);
1403                         }
1404                         bus->nextlen = 0;
1405                         return 0;
1406                 }
1407
1408                 /* Basic SD framing looks ok - process each packet (header) */
1409
1410                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1411                         dptr = (u8 *) (pfirst->data);
1412                         sublen = get_unaligned_le16(dptr);
1413                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1414                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1415                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1416
1417                         brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
1418                                   num, pfirst, pfirst->data,
1419                                   pfirst->len, sublen, chan, seq);
1420
1421                         /* precondition: chan == SDPCM_DATA_CHANNEL ||
1422                                          chan == SDPCM_EVENT_CHANNEL */
1423
1424                         if (rxseq != seq) {
1425                                 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
1426                                           seq, rxseq);
1427                                 bus->rx_badseq++;
1428                                 rxseq = seq;
1429                         }
1430                         rxseq++;
1431
1432 #ifdef BCMDBG
1433                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1434                                 printk(KERN_DEBUG "Rx Subframe Data:\n");
1435                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1436                                                      dptr, dlen);
1437                         }
1438 #endif
1439
1440                         __skb_trim(pfirst, sublen);
1441                         skb_pull(pfirst, doff);
1442
1443                         if (pfirst->len == 0) {
1444                                 skb_unlink(pfirst, &bus->glom);
1445                                 brcmu_pkt_buf_free_skb(pfirst);
1446                                 continue;
1447                         } else if (brcmf_proto_hdrpull(bus->sdiodev->dev,
1448                                                        &ifidx, pfirst) != 0) {
1449                                 brcmf_dbg(ERROR, "rx protocol error\n");
1450                                 bus->drvr->rx_errors++;
1451                                 skb_unlink(pfirst, &bus->glom);
1452                                 brcmu_pkt_buf_free_skb(pfirst);
1453                                 continue;
1454                         }
1455
1456 #ifdef BCMDBG
1457                         if (BRCMF_GLOM_ON()) {
1458                                 brcmf_dbg(GLOM, "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1459                                           bus->glom.qlen, pfirst, pfirst->data,
1460                                           pfirst->len, pfirst->next,
1461                                           pfirst->prev);
1462                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1463                                                 pfirst->data,
1464                                                 min_t(int, pfirst->len, 32));
1465                         }
1466 #endif                          /* BCMDBG */
1467                 }
1468                 /* sent any remaining packets up */
1469                 if (bus->glom.qlen) {
1470                         up(&bus->sdsem);
1471                         brcmf_rx_frame(bus->sdiodev->dev, ifidx, &bus->glom);
1472                         down(&bus->sdsem);
1473                 }
1474
1475                 bus->rxglomframes++;
1476                 bus->rxglompkts += bus->glom.qlen;
1477         }
1478         return num;
1479 }
1480
1481 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1482                                         bool *pending)
1483 {
1484         DECLARE_WAITQUEUE(wait, current);
1485         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1486
1487         /* Wait until control frame is available */
1488         add_wait_queue(&bus->dcmd_resp_wait, &wait);
1489         set_current_state(TASK_INTERRUPTIBLE);
1490
1491         while (!(*condition) && (!signal_pending(current) && timeout))
1492                 timeout = schedule_timeout(timeout);
1493
1494         if (signal_pending(current))
1495                 *pending = true;
1496
1497         set_current_state(TASK_RUNNING);
1498         remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1499
1500         return timeout;
1501 }
1502
1503 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
1504 {
1505         if (waitqueue_active(&bus->dcmd_resp_wait))
1506                 wake_up_interruptible(&bus->dcmd_resp_wait);
1507
1508         return 0;
1509 }
1510 static void
1511 brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1512 {
1513         uint rdlen, pad;
1514
1515         int sdret;
1516
1517         brcmf_dbg(TRACE, "Enter\n");
1518
1519         /* Set rxctl for frame (w/optional alignment) */
1520         bus->rxctl = bus->rxbuf;
1521         bus->rxctl += BRCMF_FIRSTREAD;
1522         pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
1523         if (pad)
1524                 bus->rxctl += (BRCMF_SDALIGN - pad);
1525         bus->rxctl -= BRCMF_FIRSTREAD;
1526
1527         /* Copy the already-read portion over */
1528         memcpy(bus->rxctl, hdr, BRCMF_FIRSTREAD);
1529         if (len <= BRCMF_FIRSTREAD)
1530                 goto gotpkt;
1531
1532         /* Raise rdlen to next SDIO block to avoid tail command */
1533         rdlen = len - BRCMF_FIRSTREAD;
1534         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1535                 pad = bus->blocksize - (rdlen % bus->blocksize);
1536                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1537                     ((len + pad) < bus->drvr->maxctl))
1538                         rdlen += pad;
1539         } else if (rdlen % BRCMF_SDALIGN) {
1540                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1541         }
1542
1543         /* Satisfy length-alignment requirements */
1544         if (rdlen & (ALIGNMENT - 1))
1545                 rdlen = roundup(rdlen, ALIGNMENT);
1546
1547         /* Drop if the read is too big or it exceeds our maximum */
1548         if ((rdlen + BRCMF_FIRSTREAD) > bus->drvr->maxctl) {
1549                 brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
1550                           rdlen, bus->drvr->maxctl);
1551                 bus->drvr->rx_errors++;
1552                 brcmf_sdbrcm_rxfail(bus, false, false);
1553                 goto done;
1554         }
1555
1556         if ((len - doff) > bus->drvr->maxctl) {
1557                 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1558                           len, len - doff, bus->drvr->maxctl);
1559                 bus->drvr->rx_errors++;
1560                 bus->rx_toolong++;
1561                 brcmf_sdbrcm_rxfail(bus, false, false);
1562                 goto done;
1563         }
1564
1565         /* Read remainder of frame body into the rxctl buffer */
1566         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1567                                 bus->sdiodev->sbwad,
1568                                 SDIO_FUNC_2,
1569                                 F2SYNC, (bus->rxctl + BRCMF_FIRSTREAD), rdlen);
1570         bus->f2rxdata++;
1571
1572         /* Control frame failures need retransmission */
1573         if (sdret < 0) {
1574                 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
1575                           rdlen, sdret);
1576                 bus->rxc_errors++;
1577                 brcmf_sdbrcm_rxfail(bus, true, true);
1578                 goto done;
1579         }
1580
1581 gotpkt:
1582
1583 #ifdef BCMDBG
1584         if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1585                 printk(KERN_DEBUG "RxCtrl:\n");
1586                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
1587         }
1588 #endif
1589
1590         /* Point to valid data and indicate its length */
1591         bus->rxctl += doff;
1592         bus->rxlen = len - doff;
1593
1594 done:
1595         /* Awake any waiters */
1596         brcmf_sdbrcm_dcmd_resp_wake(bus);
1597 }
1598
1599 /* Pad read to blocksize for efficiency */
1600 static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1601 {
1602         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1603                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1604                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1605                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1606                         *rdlen += *pad;
1607         } else if (*rdlen % BRCMF_SDALIGN) {
1608                 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1609         }
1610 }
1611
1612 static void
1613 brcmf_alloc_pkt_and_read(struct brcmf_sdio *bus, u16 rdlen,
1614                          struct sk_buff **pkt, u8 **rxbuf)
1615 {
1616         int sdret;              /* Return code from calls */
1617
1618         *pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
1619         if (*pkt == NULL)
1620                 return;
1621
1622         pkt_align(*pkt, rdlen, BRCMF_SDALIGN);
1623         *rxbuf = (u8 *) ((*pkt)->data);
1624         /* Read the entire frame */
1625         sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1626                                       SDIO_FUNC_2, F2SYNC, *pkt);
1627         bus->f2rxdata++;
1628
1629         if (sdret < 0) {
1630                 brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
1631                           rdlen, sdret);
1632                 brcmu_pkt_buf_free_skb(*pkt);
1633                 bus->drvr->rx_errors++;
1634                 /* Force retry w/normal header read.
1635                  * Don't attempt NAK for
1636                  * gSPI
1637                  */
1638                 brcmf_sdbrcm_rxfail(bus, true, true);
1639                 *pkt = NULL;
1640         }
1641 }
1642
1643 /* Checks the header */
1644 static int
1645 brcmf_check_rxbuf(struct brcmf_sdio *bus, struct sk_buff *pkt, u8 *rxbuf,
1646                   u8 rxseq, u16 nextlen, u16 *len)
1647 {
1648         u16 check;
1649         bool len_consistent;    /* Result of comparing readahead len and
1650                                    len from hw-hdr */
1651
1652         memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
1653
1654         /* Extract hardware header fields */
1655         *len = get_unaligned_le16(bus->rxhdr);
1656         check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1657
1658         /* All zeros means readahead info was bad */
1659         if (!(*len | check)) {
1660                 brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
1661                 goto fail;
1662         }
1663
1664         /* Validate check bytes */
1665         if ((u16)~(*len ^ check)) {
1666                 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
1667                           nextlen, *len, check);
1668                 bus->rx_badhdr++;
1669                 brcmf_sdbrcm_rxfail(bus, false, false);
1670                 goto fail;
1671         }
1672
1673         /* Validate frame length */
1674         if (*len < SDPCM_HDRLEN) {
1675                 brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
1676                           *len);
1677                 goto fail;
1678         }
1679
1680         /* Check for consistency with readahead info */
1681         len_consistent = (nextlen != (roundup(*len, 16) >> 4));
1682         if (len_consistent) {
1683                 /* Mismatch, force retry w/normal
1684                         header (may be >4K) */
1685                 brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
1686                           nextlen, *len, roundup(*len, 16),
1687                           rxseq);
1688                 brcmf_sdbrcm_rxfail(bus, true, true);
1689                 goto fail;
1690         }
1691
1692         return 0;
1693
1694 fail:
1695         brcmf_sdbrcm_pktfree2(bus, pkt);
1696         return -EINVAL;
1697 }
1698
1699 /* Return true if there may be more frames to read */
1700 static uint
1701 brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
1702 {
1703         u16 len, check; /* Extracted hardware header fields */
1704         u8 chan, seq, doff;     /* Extracted software header fields */
1705         u8 fcbits;              /* Extracted fcbits from software header */
1706
1707         struct sk_buff *pkt;            /* Packet for event or data frames */
1708         u16 pad;                /* Number of pad bytes to read */
1709         u16 rdlen;              /* Total number of bytes to read */
1710         u8 rxseq;               /* Next sequence number to expect */
1711         uint rxleft = 0;        /* Remaining number of frames allowed */
1712         int sdret;              /* Return code from calls */
1713         u8 txmax;               /* Maximum tx sequence offered */
1714         u8 *rxbuf;
1715         int ifidx = 0;
1716         uint rxcount = 0;       /* Total frames read */
1717
1718         brcmf_dbg(TRACE, "Enter\n");
1719
1720         /* Not finished unless we encounter no more frames indication */
1721         *finished = false;
1722
1723         for (rxseq = bus->rx_seq, rxleft = maxframes;
1724              !bus->rxskip && rxleft &&
1725              bus->drvr->bus_if->state != BRCMF_BUS_DOWN;
1726              rxseq++, rxleft--) {
1727
1728                 /* Handle glomming separately */
1729                 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1730                         u8 cnt;
1731                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1732                                   bus->glomd, skb_peek(&bus->glom));
1733                         cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
1734                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1735                         rxseq += cnt - 1;
1736                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1737                         continue;
1738                 }
1739
1740                 /* Try doing single read if we can */
1741                 if (bus->nextlen) {
1742                         u16 nextlen = bus->nextlen;
1743                         bus->nextlen = 0;
1744
1745                         rdlen = len = nextlen << 4;
1746                         brcmf_pad(bus, &pad, &rdlen);
1747
1748                         /*
1749                          * After the frame is received we have to
1750                          * distinguish whether it is data
1751                          * or non-data frame.
1752                          */
1753                         brcmf_alloc_pkt_and_read(bus, rdlen, &pkt, &rxbuf);
1754                         if (pkt == NULL) {
1755                                 /* Give up on data, request rtx of events */
1756                                 brcmf_dbg(ERROR, "(nextlen): brcmf_alloc_pkt_and_read failed: len %d rdlen %d expected rxseq %d\n",
1757                                           len, rdlen, rxseq);
1758                                 continue;
1759                         }
1760
1761                         if (brcmf_check_rxbuf(bus, pkt, rxbuf, rxseq, nextlen,
1762                                               &len) < 0)
1763                                 continue;
1764
1765                         /* Extract software header fields */
1766                         chan = SDPCM_PACKET_CHANNEL(
1767                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1768                         seq = SDPCM_PACKET_SEQUENCE(
1769                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1770                         doff = SDPCM_DOFFSET_VALUE(
1771                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1772                         txmax = SDPCM_WINDOW_VALUE(
1773                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1774
1775                         bus->nextlen =
1776                             bus->rxhdr[SDPCM_FRAMETAG_LEN +
1777                                        SDPCM_NEXTLEN_OFFSET];
1778                         if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1779                                 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1780                                           bus->nextlen, seq);
1781                                 bus->nextlen = 0;
1782                         }
1783
1784                         bus->rx_readahead_cnt++;
1785
1786                         /* Handle Flow Control */
1787                         fcbits = SDPCM_FCMASK_VALUE(
1788                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1789
1790                         if (bus->flowcontrol != fcbits) {
1791                                 if (~bus->flowcontrol & fcbits)
1792                                         bus->fc_xoff++;
1793
1794                                 if (bus->flowcontrol & ~fcbits)
1795                                         bus->fc_xon++;
1796
1797                                 bus->fc_rcvd++;
1798                                 bus->flowcontrol = fcbits;
1799                         }
1800
1801                         /* Check and update sequence number */
1802                         if (rxseq != seq) {
1803                                 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
1804                                           seq, rxseq);
1805                                 bus->rx_badseq++;
1806                                 rxseq = seq;
1807                         }
1808
1809                         /* Check window for sanity */
1810                         if ((u8) (txmax - bus->tx_seq) > 0x40) {
1811                                 brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
1812                                           txmax, bus->tx_seq);
1813                                 txmax = bus->tx_seq + 2;
1814                         }
1815                         bus->tx_max = txmax;
1816
1817 #ifdef BCMDBG
1818                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1819                                 printk(KERN_DEBUG "Rx Data:\n");
1820                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1821                                                      rxbuf, len);
1822                         } else if (BRCMF_HDRS_ON()) {
1823                                 printk(KERN_DEBUG "RxHdr:\n");
1824                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1825                                                      bus->rxhdr, SDPCM_HDRLEN);
1826                         }
1827 #endif
1828
1829                         if (chan == SDPCM_CONTROL_CHANNEL) {
1830                                 brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
1831                                           seq);
1832                                 /* Force retry w/normal header read */
1833                                 bus->nextlen = 0;
1834                                 brcmf_sdbrcm_rxfail(bus, false, true);
1835                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1836                                 continue;
1837                         }
1838
1839                         /* Validate data offset */
1840                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1841                                 brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
1842                                           doff, len, SDPCM_HDRLEN);
1843                                 brcmf_sdbrcm_rxfail(bus, false, false);
1844                                 brcmf_sdbrcm_pktfree2(bus, pkt);
1845                                 continue;
1846                         }
1847
1848                         /* All done with this one -- now deliver the packet */
1849                         goto deliver;
1850                 }
1851
1852                 /* Read frame header (hardware and software) */
1853                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
1854                                               SDIO_FUNC_2, F2SYNC, bus->rxhdr,
1855                                               BRCMF_FIRSTREAD);
1856                 bus->f2rxhdrs++;
1857
1858                 if (sdret < 0) {
1859                         brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
1860                         bus->rx_hdrfail++;
1861                         brcmf_sdbrcm_rxfail(bus, true, true);
1862                         continue;
1863                 }
1864 #ifdef BCMDBG
1865                 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
1866                         printk(KERN_DEBUG "RxHdr:\n");
1867                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1868                                              bus->rxhdr, SDPCM_HDRLEN);
1869                 }
1870 #endif
1871
1872                 /* Extract hardware header fields */
1873                 len = get_unaligned_le16(bus->rxhdr);
1874                 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1875
1876                 /* All zeros means no more frames */
1877                 if (!(len | check)) {
1878                         *finished = true;
1879                         break;
1880                 }
1881
1882                 /* Validate check bytes */
1883                 if ((u16) ~(len ^ check)) {
1884                         brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
1885                                   len, check);
1886                         bus->rx_badhdr++;
1887                         brcmf_sdbrcm_rxfail(bus, false, false);
1888                         continue;
1889                 }
1890
1891                 /* Validate frame length */
1892                 if (len < SDPCM_HDRLEN) {
1893                         brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
1894                         continue;
1895                 }
1896
1897                 /* Extract software header fields */
1898                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1899                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1900                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1901                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1902
1903                 /* Validate data offset */
1904                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1905                         brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
1906                                   doff, len, SDPCM_HDRLEN, seq);
1907                         bus->rx_badhdr++;
1908                         brcmf_sdbrcm_rxfail(bus, false, false);
1909                         continue;
1910                 }
1911
1912                 /* Save the readahead length if there is one */
1913                 bus->nextlen =
1914                     bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1915                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1916                         brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1917                                   bus->nextlen, seq);
1918                         bus->nextlen = 0;
1919                 }
1920
1921                 /* Handle Flow Control */
1922                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1923
1924                 if (bus->flowcontrol != fcbits) {
1925                         if (~bus->flowcontrol & fcbits)
1926                                 bus->fc_xoff++;
1927
1928                         if (bus->flowcontrol & ~fcbits)
1929                                 bus->fc_xon++;
1930
1931                         bus->fc_rcvd++;
1932                         bus->flowcontrol = fcbits;
1933                 }
1934
1935                 /* Check and update sequence number */
1936                 if (rxseq != seq) {
1937                         brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
1938                         bus->rx_badseq++;
1939                         rxseq = seq;
1940                 }
1941
1942                 /* Check window for sanity */
1943                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1944                         brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1945                                   txmax, bus->tx_seq);
1946                         txmax = bus->tx_seq + 2;
1947                 }
1948                 bus->tx_max = txmax;
1949
1950                 /* Call a separate function for control frames */
1951                 if (chan == SDPCM_CONTROL_CHANNEL) {
1952                         brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
1953                         continue;
1954                 }
1955
1956                 /* precondition: chan is either SDPCM_DATA_CHANNEL,
1957                    SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
1958                    SDPCM_GLOM_CHANNEL */
1959
1960                 /* Length to read */
1961                 rdlen = (len > BRCMF_FIRSTREAD) ? (len - BRCMF_FIRSTREAD) : 0;
1962
1963                 /* May pad read to blocksize for efficiency */
1964                 if (bus->roundup && bus->blocksize &&
1965                         (rdlen > bus->blocksize)) {
1966                         pad = bus->blocksize - (rdlen % bus->blocksize);
1967                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1968                             ((rdlen + pad + BRCMF_FIRSTREAD) < MAX_RX_DATASZ))
1969                                 rdlen += pad;
1970                 } else if (rdlen % BRCMF_SDALIGN) {
1971                         rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1972                 }
1973
1974                 /* Satisfy length-alignment requirements */
1975                 if (rdlen & (ALIGNMENT - 1))
1976                         rdlen = roundup(rdlen, ALIGNMENT);
1977
1978                 if ((rdlen + BRCMF_FIRSTREAD) > MAX_RX_DATASZ) {
1979                         /* Too long -- skip this frame */
1980                         brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
1981                                   len, rdlen);
1982                         bus->drvr->rx_errors++;
1983                         bus->rx_toolong++;
1984                         brcmf_sdbrcm_rxfail(bus, false, false);
1985                         continue;
1986                 }
1987
1988                 pkt = brcmu_pkt_buf_get_skb(rdlen +
1989                                             BRCMF_FIRSTREAD + BRCMF_SDALIGN);
1990                 if (!pkt) {
1991                         /* Give up on data, request rtx of events */
1992                         brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
1993                                   rdlen, chan);
1994                         bus->drvr->rx_dropped++;
1995                         brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
1996                         continue;
1997                 }
1998
1999                 /* Leave room for what we already read, and align remainder */
2000                 skb_pull(pkt, BRCMF_FIRSTREAD);
2001                 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
2002
2003                 /* Read the remaining frame data */
2004                 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
2005                                               SDIO_FUNC_2, F2SYNC, pkt);
2006                 bus->f2rxdata++;
2007
2008                 if (sdret < 0) {
2009                         brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
2010                                   ((chan == SDPCM_EVENT_CHANNEL) ? "event"
2011                                    : ((chan == SDPCM_DATA_CHANNEL) ? "data"
2012                                       : "test")), sdret);
2013                         brcmu_pkt_buf_free_skb(pkt);
2014                         bus->drvr->rx_errors++;
2015                         brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
2016                         continue;
2017                 }
2018
2019                 /* Copy the already-read portion */
2020                 skb_push(pkt, BRCMF_FIRSTREAD);
2021                 memcpy(pkt->data, bus->rxhdr, BRCMF_FIRSTREAD);
2022
2023 #ifdef BCMDBG
2024                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2025                         printk(KERN_DEBUG "Rx Data:\n");
2026                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2027                                              pkt->data, len);
2028                 }
2029 #endif
2030
2031 deliver:
2032                 /* Save superframe descriptor and allocate packet frame */
2033                 if (chan == SDPCM_GLOM_CHANNEL) {
2034                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
2035                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
2036                                           len);
2037 #ifdef BCMDBG
2038                                 if (BRCMF_GLOM_ON()) {
2039                                         printk(KERN_DEBUG "Glom Data:\n");
2040                                         print_hex_dump_bytes("",
2041                                                              DUMP_PREFIX_OFFSET,
2042                                                              pkt->data, len);
2043                                 }
2044 #endif
2045                                 __skb_trim(pkt, len);
2046                                 skb_pull(pkt, SDPCM_HDRLEN);
2047                                 bus->glomd = pkt;
2048                         } else {
2049                                 brcmf_dbg(ERROR, "%s: glom superframe w/o "
2050                                           "descriptor!\n", __func__);
2051                                 brcmf_sdbrcm_rxfail(bus, false, false);
2052                         }
2053                         continue;
2054                 }
2055
2056                 /* Fill in packet len and prio, deliver upward */
2057                 __skb_trim(pkt, len);
2058                 skb_pull(pkt, doff);
2059
2060                 if (pkt->len == 0) {
2061                         brcmu_pkt_buf_free_skb(pkt);
2062                         continue;
2063                 } else if (brcmf_proto_hdrpull(bus->sdiodev->dev, &ifidx,
2064                            pkt) != 0) {
2065                         brcmf_dbg(ERROR, "rx protocol error\n");
2066                         brcmu_pkt_buf_free_skb(pkt);
2067                         bus->drvr->rx_errors++;
2068                         continue;
2069                 }
2070
2071                 /* Unlock during rx call */
2072                 up(&bus->sdsem);
2073                 brcmf_rx_packet(bus->sdiodev->dev, ifidx, pkt);
2074                 down(&bus->sdsem);
2075         }
2076         rxcount = maxframes - rxleft;
2077 #ifdef BCMDBG
2078         /* Message if we hit the limit */
2079         if (!rxleft)
2080                 brcmf_dbg(DATA, "hit rx limit of %d frames\n",
2081                           maxframes);
2082         else
2083 #endif                          /* BCMDBG */
2084                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2085         /* Back off rxseq if awaiting rtx, update rx_seq */
2086         if (bus->rxskip)
2087                 rxseq--;
2088         bus->rx_seq = rxseq;
2089
2090         return rxcount;
2091 }
2092
2093 static void
2094 brcmf_sdbrcm_wait_for_event(struct brcmf_sdio *bus, bool *lockvar)
2095 {
2096         up(&bus->sdsem);
2097         wait_event_interruptible_timeout(bus->ctrl_wait,
2098                                          (*lockvar == false), HZ * 2);
2099         down(&bus->sdsem);
2100         return;
2101 }
2102
2103 static void
2104 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
2105 {
2106         if (waitqueue_active(&bus->ctrl_wait))
2107                 wake_up_interruptible(&bus->ctrl_wait);
2108         return;
2109 }
2110
2111 /* Writes a HW/SW header into the packet and sends it. */
2112 /* Assumes: (a) header space already there, (b) caller holds lock */
2113 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
2114                               uint chan, bool free_pkt)
2115 {
2116         int ret;
2117         u8 *frame;
2118         u16 len, pad = 0;
2119         u32 swheader;
2120         struct sk_buff *new;
2121         int i;
2122
2123         brcmf_dbg(TRACE, "Enter\n");
2124
2125         frame = (u8 *) (pkt->data);
2126
2127         /* Add alignment padding, allocate new packet if needed */
2128         pad = ((unsigned long)frame % BRCMF_SDALIGN);
2129         if (pad) {
2130                 if (skb_headroom(pkt) < pad) {
2131                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
2132                                   skb_headroom(pkt), pad);
2133                         bus->drvr->tx_realloc++;
2134                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
2135                         if (!new) {
2136                                 brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
2137                                           pkt->len + BRCMF_SDALIGN);
2138                                 ret = -ENOMEM;
2139                                 goto done;
2140                         }
2141
2142                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
2143                         memcpy(new->data, pkt->data, pkt->len);
2144                         if (free_pkt)
2145                                 brcmu_pkt_buf_free_skb(pkt);
2146                         /* free the pkt if canned one is not used */
2147                         free_pkt = true;
2148                         pkt = new;
2149                         frame = (u8 *) (pkt->data);
2150                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
2151                         pad = 0;
2152                 } else {
2153                         skb_push(pkt, pad);
2154                         frame = (u8 *) (pkt->data);
2155                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
2156                         memset(frame, 0, pad + SDPCM_HDRLEN);
2157                 }
2158         }
2159         /* precondition: pad < BRCMF_SDALIGN */
2160
2161         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2162         len = (u16) (pkt->len);
2163         *(__le16 *) frame = cpu_to_le16(len);
2164         *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
2165
2166         /* Software tag: channel, sequence number, data offset */
2167         swheader =
2168             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
2169             (((pad +
2170                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
2171
2172         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2173         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2174
2175 #ifdef BCMDBG
2176         tx_packets[pkt->priority]++;
2177         if (BRCMF_BYTES_ON() &&
2178             (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
2179               (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
2180                 printk(KERN_DEBUG "Tx Frame:\n");
2181                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
2182         } else if (BRCMF_HDRS_ON()) {
2183                 printk(KERN_DEBUG "TxHdr:\n");
2184                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2185                                      frame, min_t(u16, len, 16));
2186         }
2187 #endif
2188
2189         /* Raise len to next SDIO block to eliminate tail command */
2190         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2191                 u16 pad = bus->blocksize - (len % bus->blocksize);
2192                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2193                                 len += pad;
2194         } else if (len % BRCMF_SDALIGN) {
2195                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2196         }
2197
2198         /* Some controllers have trouble with odd bytes -- round to even */
2199         if (len & (ALIGNMENT - 1))
2200                         len = roundup(len, ALIGNMENT);
2201
2202         ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
2203                                     SDIO_FUNC_2, F2SYNC, pkt);
2204         bus->f2txdata++;
2205
2206         if (ret < 0) {
2207                 /* On failure, abort the command and terminate the frame */
2208                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2209                           ret);
2210                 bus->tx_sderrs++;
2211
2212                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2213                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2214                                  SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2215                                  NULL);
2216                 bus->f1regdata++;
2217
2218                 for (i = 0; i < 3; i++) {
2219                         u8 hi, lo;
2220                         hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2221                                              SDIO_FUNC_1,
2222                                              SBSDIO_FUNC1_WFRAMEBCHI,
2223                                              NULL);
2224                         lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2225                                              SDIO_FUNC_1,
2226                                              SBSDIO_FUNC1_WFRAMEBCLO,
2227                                              NULL);
2228                         bus->f1regdata += 2;
2229                         if ((hi == 0) && (lo == 0))
2230                                 break;
2231                 }
2232
2233         }
2234         if (ret == 0)
2235                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2236
2237 done:
2238         /* restore pkt buffer pointer before calling tx complete routine */
2239         skb_pull(pkt, SDPCM_HDRLEN + pad);
2240         up(&bus->sdsem);
2241         brcmf_txcomplete(bus->sdiodev->dev, pkt, ret != 0);
2242         down(&bus->sdsem);
2243
2244         if (free_pkt)
2245                 brcmu_pkt_buf_free_skb(pkt);
2246
2247         return ret;
2248 }
2249
2250 static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
2251 {
2252         struct sk_buff *pkt;
2253         u32 intstatus = 0;
2254         uint retries = 0;
2255         int ret = 0, prec_out;
2256         uint cnt = 0;
2257         uint datalen;
2258         u8 tx_prec_map;
2259
2260         struct brcmf_pub *drvr = bus->drvr;
2261
2262         brcmf_dbg(TRACE, "Enter\n");
2263
2264         tx_prec_map = ~bus->flowcontrol;
2265
2266         /* Send frames until the limit or some other event */
2267         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
2268                 spin_lock_bh(&bus->txqlock);
2269                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
2270                 if (pkt == NULL) {
2271                         spin_unlock_bh(&bus->txqlock);
2272                         break;
2273                 }
2274                 spin_unlock_bh(&bus->txqlock);
2275                 datalen = pkt->len - SDPCM_HDRLEN;
2276
2277                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
2278                 if (ret)
2279                         bus->drvr->tx_errors++;
2280                 else
2281                         bus->drvr->dstats.tx_bytes += datalen;
2282
2283                 /* In poll mode, need to check for other events */
2284                 if (!bus->intr && cnt) {
2285                         /* Check device status, signal pending interrupt */
2286                         r_sdreg32(bus, &intstatus,
2287                                   offsetof(struct sdpcmd_regs, intstatus),
2288                                   &retries);
2289                         bus->f2txdata++;
2290                         if (brcmf_sdcard_regfail(bus->sdiodev))
2291                                 break;
2292                         if (intstatus & bus->hostintmask)
2293                                 bus->ipend = true;
2294                 }
2295         }
2296
2297         /* Deflow-control stack if needed */
2298         if (drvr->up && (drvr->bus_if->state == BRCMF_BUS_DATA) &&
2299             drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
2300                 brcmf_txflowcontrol(bus->sdiodev->dev, 0, OFF);
2301
2302         return cnt;
2303 }
2304
2305 static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
2306 {
2307         u32 intstatus, newstatus = 0;
2308         uint retries = 0;
2309         uint rxlimit = bus->rxbound;    /* Rx frames to read before resched */
2310         uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2311         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2312         bool rxdone = true;     /* Flag for no more read data */
2313         bool resched = false;   /* Flag indicating resched wanted */
2314
2315         brcmf_dbg(TRACE, "Enter\n");
2316
2317         /* Start with leftover status bits */
2318         intstatus = bus->intstatus;
2319
2320         down(&bus->sdsem);
2321
2322         /* If waiting for HTAVAIL, check status */
2323         if (bus->clkstate == CLK_PENDING) {
2324                 int err;
2325                 u8 clkctl, devctl = 0;
2326
2327 #ifdef BCMDBG
2328                 /* Check for inconsistent device control */
2329                 devctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2330                                                SBSDIO_DEVICE_CTL, &err);
2331                 if (err) {
2332                         brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
2333                         bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
2334                 }
2335 #endif                          /* BCMDBG */
2336
2337                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2338                 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2339                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
2340                 if (err) {
2341                         brcmf_dbg(ERROR, "error reading CSR: %d\n",
2342                                   err);
2343                         bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
2344                 }
2345
2346                 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2347                           devctl, clkctl);
2348
2349                 if (SBSDIO_HTAV(clkctl)) {
2350                         devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
2351                                                        SDIO_FUNC_1,
2352                                                        SBSDIO_DEVICE_CTL, &err);
2353                         if (err) {
2354                                 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
2355                                           err);
2356                                 bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
2357                         }
2358                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2359                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2360                                 SBSDIO_DEVICE_CTL, devctl, &err);
2361                         if (err) {
2362                                 brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
2363                                           err);
2364                                 bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
2365                         }
2366                         bus->clkstate = CLK_AVAIL;
2367                 } else {
2368                         goto clkwait;
2369                 }
2370         }
2371
2372         bus_wake(bus);
2373
2374         /* Make sure backplane clock is on */
2375         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2376         if (bus->clkstate == CLK_PENDING)
2377                 goto clkwait;
2378
2379         /* Pending interrupt indicates new device status */
2380         if (bus->ipend) {
2381                 bus->ipend = false;
2382                 r_sdreg32(bus, &newstatus,
2383                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2384                 bus->f1regdata++;
2385                 if (brcmf_sdcard_regfail(bus->sdiodev))
2386                         newstatus = 0;
2387                 newstatus &= bus->hostintmask;
2388                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
2389                 if (newstatus) {
2390                         w_sdreg32(bus, newstatus,
2391                                   offsetof(struct sdpcmd_regs, intstatus),
2392                                   &retries);
2393                         bus->f1regdata++;
2394                 }
2395         }
2396
2397         /* Merge new bits with previous */
2398         intstatus |= newstatus;
2399         bus->intstatus = 0;
2400
2401         /* Handle flow-control change: read new state in case our ack
2402          * crossed another change interrupt.  If change still set, assume
2403          * FC ON for safety, let next loop through do the debounce.
2404          */
2405         if (intstatus & I_HMB_FC_CHANGE) {
2406                 intstatus &= ~I_HMB_FC_CHANGE;
2407                 w_sdreg32(bus, I_HMB_FC_CHANGE,
2408                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2409
2410                 r_sdreg32(bus, &newstatus,
2411                           offsetof(struct sdpcmd_regs, intstatus), &retries);
2412                 bus->f1regdata += 2;
2413                 bus->fcstate =
2414                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
2415                 intstatus |= (newstatus & bus->hostintmask);
2416         }
2417
2418         /* Handle host mailbox indication */
2419         if (intstatus & I_HMB_HOST_INT) {
2420                 intstatus &= ~I_HMB_HOST_INT;
2421                 intstatus |= brcmf_sdbrcm_hostmail(bus);
2422         }
2423
2424         /* Generally don't ask for these, can get CRC errors... */
2425         if (intstatus & I_WR_OOSYNC) {
2426                 brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
2427                 intstatus &= ~I_WR_OOSYNC;
2428         }
2429
2430         if (intstatus & I_RD_OOSYNC) {
2431                 brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
2432                 intstatus &= ~I_RD_OOSYNC;
2433         }
2434
2435         if (intstatus & I_SBINT) {
2436                 brcmf_dbg(ERROR, "Dongle reports SBINT\n");
2437                 intstatus &= ~I_SBINT;
2438         }
2439
2440         /* Would be active due to wake-wlan in gSPI */
2441         if (intstatus & I_CHIPACTIVE) {
2442                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2443                 intstatus &= ~I_CHIPACTIVE;
2444         }
2445
2446         /* Ignore frame indications if rxskip is set */
2447         if (bus->rxskip)
2448                 intstatus &= ~I_HMB_FRAME_IND;
2449
2450         /* On frame indication, read available frames */
2451         if (PKT_AVAILABLE()) {
2452                 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
2453                 if (rxdone || bus->rxskip)
2454                         intstatus &= ~I_HMB_FRAME_IND;
2455                 rxlimit -= min(framecnt, rxlimit);
2456         }
2457
2458         /* Keep still-pending events for next scheduling */
2459         bus->intstatus = intstatus;
2460
2461 clkwait:
2462         if (data_ok(bus) && bus->ctrl_frame_stat &&
2463                 (bus->clkstate == CLK_AVAIL)) {
2464                 int ret, i;
2465
2466                 ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2467                         SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
2468                         (u32) bus->ctrl_frame_len);
2469
2470                 if (ret < 0) {
2471                         /* On failure, abort the command and
2472                                 terminate the frame */
2473                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2474                                   ret);
2475                         bus->tx_sderrs++;
2476
2477                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2478
2479                         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2480                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2481                                          NULL);
2482                         bus->f1regdata++;
2483
2484                         for (i = 0; i < 3; i++) {
2485                                 u8 hi, lo;
2486                                 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2487                                                      SDIO_FUNC_1,
2488                                                      SBSDIO_FUNC1_WFRAMEBCHI,
2489                                                      NULL);
2490                                 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2491                                                      SDIO_FUNC_1,
2492                                                      SBSDIO_FUNC1_WFRAMEBCLO,
2493                                                      NULL);
2494                                 bus->f1regdata += 2;
2495                                 if ((hi == 0) && (lo == 0))
2496                                         break;
2497                         }
2498
2499                 }
2500                 if (ret == 0)
2501                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2502
2503                 brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
2504                 bus->ctrl_frame_stat = false;
2505                 brcmf_sdbrcm_wait_event_wakeup(bus);
2506         }
2507         /* Send queued frames (limit 1 if rx may still be pending) */
2508         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
2509                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2510                  && data_ok(bus)) {
2511                 framecnt = rxdone ? txlimit : min(txlimit, bus->txminmax);
2512                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2513                 txlimit -= framecnt;
2514         }
2515
2516         /* Resched if events or tx frames are pending,
2517                  else await next interrupt */
2518         /* On failed register access, all bets are off:
2519                  no resched or interrupts */
2520         if ((bus->drvr->bus_if->state == BRCMF_BUS_DOWN) ||
2521             brcmf_sdcard_regfail(bus->sdiodev)) {
2522                 brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation %d\n",
2523                           brcmf_sdcard_regfail(bus->sdiodev));
2524                 bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
2525                 bus->intstatus = 0;
2526         } else if (bus->clkstate == CLK_PENDING) {
2527                 brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
2528                 resched = true;
2529         } else if (bus->intstatus || bus->ipend ||
2530                 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
2531                  && data_ok(bus)) || PKT_AVAILABLE()) {
2532                 resched = true;
2533         }
2534
2535         bus->dpc_sched = resched;
2536
2537         /* If we're done for now, turn off clock request. */
2538         if ((bus->clkstate != CLK_PENDING)
2539             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2540                 bus->activity = false;
2541                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2542         }
2543
2544         up(&bus->sdsem);
2545
2546         return resched;
2547 }
2548
2549 static int brcmf_sdbrcm_dpc_thread(void *data)
2550 {
2551         struct brcmf_sdio *bus = (struct brcmf_sdio *) data;
2552
2553         allow_signal(SIGTERM);
2554         /* Run until signal received */
2555         while (1) {
2556                 if (kthread_should_stop())
2557                         break;
2558                 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
2559                         /* Call bus dpc unless it indicated down
2560                         (then clean stop) */
2561                         if (bus->drvr->bus_if->state != BRCMF_BUS_DOWN) {
2562                                 if (brcmf_sdbrcm_dpc(bus))
2563                                         complete(&bus->dpc_wait);
2564                         } else {
2565                                 /* after stopping the bus, exit thread */
2566                                 brcmf_sdbrcm_bus_stop(bus->sdiodev->dev);
2567                                 bus->dpc_tsk = NULL;
2568                                 break;
2569                         }
2570                 } else
2571                         break;
2572         }
2573         return 0;
2574 }
2575
2576 int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
2577 {
2578         int ret = -EBADE;
2579         uint datalen, prec;
2580         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2581         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
2582         struct brcmf_sdio *bus = sdiodev->bus;
2583
2584         brcmf_dbg(TRACE, "Enter\n");
2585
2586         datalen = pkt->len;
2587
2588         /* Add space for the header */
2589         skb_push(pkt, SDPCM_HDRLEN);
2590         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2591
2592         prec = prio2prec((pkt->priority & PRIOMASK));
2593
2594         /* Check for existing queue, current flow-control,
2595                          pending event, or pending clock */
2596         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2597         bus->fcqueued++;
2598
2599         /* Priority based enq */
2600         spin_lock_bh(&bus->txqlock);
2601         if (brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec) ==
2602             false) {
2603                 skb_pull(pkt, SDPCM_HDRLEN);
2604                 brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
2605                 brcmu_pkt_buf_free_skb(pkt);
2606                 brcmf_dbg(ERROR, "out of bus->txq !!!\n");
2607                 ret = -ENOSR;
2608         } else {
2609                 ret = 0;
2610         }
2611         spin_unlock_bh(&bus->txqlock);
2612
2613         if (pktq_len(&bus->txq) >= TXHI)
2614                 brcmf_txflowcontrol(bus->sdiodev->dev, 0, ON);
2615
2616 #ifdef BCMDBG
2617         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2618                 qcount[prec] = pktq_plen(&bus->txq, prec);
2619 #endif
2620         /* Schedule DPC if needed to send queued packet(s) */
2621         if (!bus->dpc_sched) {
2622                 bus->dpc_sched = true;
2623                 if (bus->dpc_tsk)
2624                         complete(&bus->dpc_wait);
2625         }
2626
2627         return ret;
2628 }
2629
2630 static int
2631 brcmf_sdbrcm_membytes(struct brcmf_sdio *bus, bool write, u32 address, u8 *data,
2632                  uint size)
2633 {
2634         int bcmerror = 0;
2635         u32 sdaddr;
2636         uint dsize;
2637
2638         /* Determine initial transfer parameters */
2639         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2640         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2641                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2642         else
2643                 dsize = size;
2644
2645         /* Set the backplane window to include the start address */
2646         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2647         if (bcmerror) {
2648                 brcmf_dbg(ERROR, "window change failed\n");
2649                 goto xfer_done;
2650         }
2651
2652         /* Do the transfer(s) */
2653         while (size) {
2654                 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2655                           write ? "write" : "read", dsize,
2656                           sdaddr, address & SBSDIO_SBWINDOW_MASK);
2657                 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2658                                                sdaddr, data, dsize);
2659                 if (bcmerror) {
2660                         brcmf_dbg(ERROR, "membytes transfer failed\n");
2661                         break;
2662                 }
2663
2664                 /* Adjust for next transfer (if any) */
2665                 size -= dsize;
2666                 if (size) {
2667                         data += dsize;
2668                         address += dsize;
2669                         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2670                                                                   address);
2671                         if (bcmerror) {
2672                                 brcmf_dbg(ERROR, "window change failed\n");
2673                                 break;
2674                         }
2675                         sdaddr = 0;
2676                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2677                 }
2678         }
2679
2680 xfer_done:
2681         /* Return the window to backplane enumeration space for core access */
2682         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2683                 brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
2684                           bus->sdiodev->sbwad);
2685
2686         return bcmerror;
2687 }
2688
2689 #ifdef BCMDBG
2690 #define CONSOLE_LINE_MAX        192
2691
2692 static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
2693 {
2694         struct brcmf_console *c = &bus->console;
2695         u8 line[CONSOLE_LINE_MAX], ch;
2696         u32 n, idx, addr;
2697         int rv;
2698
2699         /* Don't do anything until FWREADY updates console address */
2700         if (bus->console_addr == 0)
2701                 return 0;
2702
2703         /* Read console log struct */
2704         addr = bus->console_addr + offsetof(struct rte_console, log_le);
2705         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
2706                                    sizeof(c->log_le));
2707         if (rv < 0)
2708                 return rv;
2709
2710         /* Allocate console buffer (one time only) */
2711         if (c->buf == NULL) {
2712                 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2713                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2714                 if (c->buf == NULL)
2715                         return -ENOMEM;
2716         }
2717
2718         idx = le32_to_cpu(c->log_le.idx);
2719
2720         /* Protect against corrupt value */
2721         if (idx > c->bufsize)
2722                 return -EBADE;
2723
2724         /* Skip reading the console buffer if the index pointer
2725          has not moved */
2726         if (idx == c->last)
2727                 return 0;
2728
2729         /* Read the console buffer */
2730         addr = le32_to_cpu(c->log_le.buf);
2731         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2732         if (rv < 0)
2733                 return rv;
2734
2735         while (c->last != idx) {
2736                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2737                         if (c->last == idx) {
2738                                 /* This would output a partial line.
2739                                  * Instead, back up
2740                                  * the buffer pointer and output this
2741                                  * line next time around.
2742                                  */
2743                                 if (c->last >= n)
2744                                         c->last -= n;
2745                                 else
2746                                         c->last = c->bufsize - n;
2747                                 goto break2;
2748                         }
2749                         ch = c->buf[c->last];
2750                         c->last = (c->last + 1) % c->bufsize;
2751                         if (ch == '\n')
2752                                 break;
2753                         line[n] = ch;
2754                 }
2755
2756                 if (n > 0) {
2757                         if (line[n - 1] == '\r')
2758                                 n--;
2759                         line[n] = 0;
2760                         printk(KERN_DEBUG "CONSOLE: %s\n", line);
2761                 }
2762         }
2763 break2:
2764
2765         return 0;
2766 }
2767 #endif                          /* BCMDBG */
2768
2769 static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
2770 {
2771         int i;
2772         int ret;
2773
2774         bus->ctrl_frame_stat = false;
2775         ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2776                                     SDIO_FUNC_2, F2SYNC, frame, len);
2777
2778         if (ret < 0) {
2779                 /* On failure, abort the command and terminate the frame */
2780                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2781                           ret);
2782                 bus->tx_sderrs++;
2783
2784                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2785
2786                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2787                                        SBSDIO_FUNC1_FRAMECTRL,
2788                                        SFC_WF_TERM, NULL);
2789                 bus->f1regdata++;
2790
2791                 for (i = 0; i < 3; i++) {
2792                         u8 hi, lo;
2793                         hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2794                                                    SBSDIO_FUNC1_WFRAMEBCHI,
2795                                                    NULL);
2796                         lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2797                                                    SBSDIO_FUNC1_WFRAMEBCLO,
2798                                                    NULL);
2799                         bus->f1regdata += 2;
2800                         if (hi == 0 && lo == 0)
2801                                 break;
2802                 }
2803                 return ret;
2804         }
2805
2806         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2807
2808         return ret;
2809 }
2810
2811 int
2812 brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2813 {
2814         u8 *frame;
2815         u16 len;
2816         u32 swheader;
2817         uint retries = 0;
2818         u8 doff = 0;
2819         int ret = -1;
2820         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2821         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
2822         struct brcmf_sdio *bus = sdiodev->bus;
2823
2824         brcmf_dbg(TRACE, "Enter\n");
2825
2826         /* Back the pointer to make a room for bus header */
2827         frame = msg - SDPCM_HDRLEN;
2828         len = (msglen += SDPCM_HDRLEN);
2829
2830         /* Add alignment padding (optional for ctl frames) */
2831         doff = ((unsigned long)frame % BRCMF_SDALIGN);
2832         if (doff) {
2833                 frame -= doff;
2834                 len += doff;
2835                 msglen += doff;
2836                 memset(frame, 0, doff + SDPCM_HDRLEN);
2837         }
2838         /* precondition: doff < BRCMF_SDALIGN */
2839         doff += SDPCM_HDRLEN;
2840
2841         /* Round send length to next SDIO block */
2842         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2843                 u16 pad = bus->blocksize - (len % bus->blocksize);
2844                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2845                         len += pad;
2846         } else if (len % BRCMF_SDALIGN) {
2847                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2848         }
2849
2850         /* Satisfy length-alignment requirements */
2851         if (len & (ALIGNMENT - 1))
2852                 len = roundup(len, ALIGNMENT);
2853
2854         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2855
2856         /* Need to lock here to protect txseq and SDIO tx calls */
2857         down(&bus->sdsem);
2858
2859         bus_wake(bus);
2860
2861         /* Make sure backplane clock is on */
2862         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2863
2864         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2865         *(__le16 *) frame = cpu_to_le16((u16) msglen);
2866         *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
2867
2868         /* Software tag: channel, sequence number, data offset */
2869         swheader =
2870             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
2871              SDPCM_CHANNEL_MASK)
2872             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
2873                              SDPCM_DOFFSET_MASK);
2874         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2875         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2876
2877         if (!data_ok(bus)) {
2878                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2879                           bus->tx_max, bus->tx_seq);
2880                 bus->ctrl_frame_stat = true;
2881                 /* Send from dpc */
2882                 bus->ctrl_frame_buf = frame;
2883                 bus->ctrl_frame_len = len;
2884
2885                 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
2886
2887                 if (bus->ctrl_frame_stat == false) {
2888                         brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
2889                         ret = 0;
2890                 } else {
2891                         brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
2892                         ret = -1;
2893                 }
2894         }
2895
2896         if (ret == -1) {
2897 #ifdef BCMDBG
2898                 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
2899                         printk(KERN_DEBUG "Tx Frame:\n");
2900                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2901                                              frame, len);
2902                 } else if (BRCMF_HDRS_ON()) {
2903                         printk(KERN_DEBUG "TxHdr:\n");
2904                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2905                                              frame, min_t(u16, len, 16));
2906                 }
2907 #endif
2908
2909                 do {
2910                         ret = brcmf_tx_frame(bus, frame, len);
2911                 } while (ret < 0 && retries++ < TXRETRIES);
2912         }
2913
2914         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2915                 bus->activity = false;
2916                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2917         }
2918
2919         up(&bus->sdsem);
2920
2921         if (ret)
2922                 bus->tx_ctlerrs++;
2923         else
2924                 bus->tx_ctlpkts++;
2925
2926         return ret ? -EIO : 0;
2927 }
2928
2929 int
2930 brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
2931 {
2932         int timeleft;
2933         uint rxlen = 0;
2934         bool pending;
2935         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2936         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
2937         struct brcmf_sdio *bus = sdiodev->bus;
2938
2939         brcmf_dbg(TRACE, "Enter\n");
2940
2941         /* Wait until control frame is available */
2942         timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
2943
2944         down(&bus->sdsem);
2945         rxlen = bus->rxlen;
2946         memcpy(msg, bus->rxctl, min(msglen, rxlen));
2947         bus->rxlen = 0;
2948         up(&bus->sdsem);
2949
2950         if (rxlen) {
2951                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
2952                           rxlen, msglen);
2953         } else if (timeleft == 0) {
2954                 brcmf_dbg(ERROR, "resumed on timeout\n");
2955         } else if (pending == true) {
2956                 brcmf_dbg(CTL, "cancelled\n");
2957                 return -ERESTARTSYS;
2958         } else {
2959                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
2960         }
2961
2962         if (rxlen)
2963                 bus->rx_ctlpkts++;
2964         else
2965                 bus->rx_ctlerrs++;
2966
2967         return rxlen ? (int)rxlen : -ETIMEDOUT;
2968 }
2969
2970 static int brcmf_sdbrcm_downloadvars(struct brcmf_sdio *bus, void *arg, int len)
2971 {
2972         int bcmerror = 0;
2973
2974         brcmf_dbg(TRACE, "Enter\n");
2975
2976         /* Basic sanity checks */
2977         if (bus->drvr->up) {
2978                 bcmerror = -EISCONN;
2979                 goto err;
2980         }
2981         if (!len) {
2982                 bcmerror = -EOVERFLOW;
2983                 goto err;
2984         }
2985
2986         /* Free the old ones and replace with passed variables */
2987         kfree(bus->vars);
2988
2989         bus->vars = kmalloc(len, GFP_ATOMIC);
2990         bus->varsz = bus->vars ? len : 0;
2991         if (bus->vars == NULL) {
2992                 bcmerror = -ENOMEM;
2993                 goto err;
2994         }
2995
2996         /* Copy the passed variables, which should include the
2997                  terminating double-null */
2998         memcpy(bus->vars, arg, bus->varsz);
2999 err:
3000         return bcmerror;
3001 }
3002
3003 static int brcmf_sdbrcm_write_vars(struct brcmf_sdio *bus)
3004 {
3005         int bcmerror = 0;
3006         u32 varsize;
3007         u32 varaddr;
3008         u8 *vbuffer;
3009         u32 varsizew;
3010         __le32 varsizew_le;
3011 #ifdef BCMDBG
3012         char *nvram_ularray;
3013 #endif                          /* BCMDBG */
3014
3015         /* Even if there are no vars are to be written, we still
3016                  need to set the ramsize. */
3017         varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
3018         varaddr = (bus->ramsize - 4) - varsize;
3019
3020         if (bus->vars) {
3021                 vbuffer = kzalloc(varsize, GFP_ATOMIC);
3022                 if (!vbuffer)
3023                         return -ENOMEM;
3024
3025                 memcpy(vbuffer, bus->vars, bus->varsz);
3026
3027                 /* Write the vars list */
3028                 bcmerror =
3029                     brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
3030 #ifdef BCMDBG
3031                 /* Verify NVRAM bytes */
3032                 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
3033                 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
3034                 if (!nvram_ularray)
3035                         return -ENOMEM;
3036
3037                 /* Upload image to verify downloaded contents. */
3038                 memset(nvram_ularray, 0xaa, varsize);
3039
3040                 /* Read the vars list to temp buffer for comparison */
3041                 bcmerror =
3042                     brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
3043                                      varsize);
3044                 if (bcmerror) {
3045                         brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
3046                                   bcmerror, varsize, varaddr);
3047                 }
3048                 /* Compare the org NVRAM with the one read from RAM */
3049                 if (memcmp(vbuffer, nvram_ularray, varsize))
3050                         brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
3051                 else
3052                         brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
3053
3054                 kfree(nvram_ularray);
3055 #endif                          /* BCMDBG */
3056
3057                 kfree(vbuffer);
3058         }
3059
3060         /* adjust to the user specified RAM */
3061         brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
3062         brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3063                   varaddr, varsize);
3064         varsize = ((bus->ramsize - 4) - varaddr);
3065
3066         /*
3067          * Determine the length token:
3068          * Varsize, converted to words, in lower 16-bits, checksum
3069          * in upper 16-bits.
3070          */
3071         if (bcmerror) {
3072                 varsizew = 0;
3073                 varsizew_le = cpu_to_le32(0);
3074         } else {
3075                 varsizew = varsize / 4;
3076                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3077                 varsizew_le = cpu_to_le32(varsizew);
3078         }
3079
3080         brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3081                   varsize, varsizew);
3082
3083         /* Write the length token to the last word */
3084         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
3085                                          (u8 *)&varsizew_le, 4);
3086
3087         return bcmerror;
3088 }
3089
3090 static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
3091 {
3092         uint retries;
3093         int bcmerror = 0;
3094         struct chip_info *ci = bus->ci;
3095
3096         /* To enter download state, disable ARM and reset SOCRAM.
3097          * To exit download state, simply reset ARM (default is RAM boot).
3098          */
3099         if (enter) {
3100                 bus->alp_only = true;
3101
3102                 ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3103
3104                 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
3105
3106                 /* Clear the top bit of memory */
3107                 if (bus->ramsize) {
3108                         u32 zeros = 0;
3109                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3110                                          (u8 *)&zeros, 4);
3111                 }
3112         } else {
3113                 if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
3114                         brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
3115                         bcmerror = -EBADE;
3116                         goto fail;
3117                 }
3118
3119                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3120                 if (bcmerror) {
3121                         brcmf_dbg(ERROR, "no vars written to RAM\n");
3122                         bcmerror = 0;
3123                 }
3124
3125                 w_sdreg32(bus, 0xFFFFFFFF,
3126                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3127
3128                 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3129
3130                 /* Allow HT Clock now that the ARM is running. */
3131                 bus->alp_only = false;
3132
3133                 bus->drvr->bus_if->state = BRCMF_BUS_LOAD;
3134         }
3135 fail:
3136         return bcmerror;
3137 }
3138
3139 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
3140 {
3141         if (bus->firmware->size < bus->fw_ptr + len)
3142                 len = bus->firmware->size - bus->fw_ptr;
3143
3144         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3145         bus->fw_ptr += len;
3146         return len;
3147 }
3148
3149 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
3150 {
3151         int offset = 0;
3152         uint len;
3153         u8 *memblock = NULL, *memptr;
3154         int ret;
3155
3156         brcmf_dbg(INFO, "Enter\n");
3157
3158         ret = request_firmware(&bus->firmware, BRCMFMAC_FW_NAME,
3159                                &bus->sdiodev->func[2]->dev);
3160         if (ret) {
3161                 brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
3162                 return ret;
3163         }
3164         bus->fw_ptr = 0;
3165
3166         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3167         if (memblock == NULL) {
3168                 ret = -ENOMEM;
3169                 goto err;
3170         }
3171         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3172                 memptr += (BRCMF_SDALIGN -
3173                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3174
3175         /* Download image */
3176         while ((len =
3177                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3178                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3179                 if (ret) {
3180                         brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
3181                                   ret, MEMBLOCK, offset);
3182                         goto err;
3183                 }
3184
3185                 offset += MEMBLOCK;
3186         }
3187
3188 err:
3189         kfree(memblock);
3190
3191         release_firmware(bus->firmware);
3192         bus->fw_ptr = 0;
3193
3194         return ret;
3195 }
3196
3197 /*
3198  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3199  * and ending in a NUL.
3200  * Removes carriage returns, empty lines, comment lines, and converts
3201  * newlines to NULs.
3202  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
3203  * by two NULs.
3204 */
3205
3206 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
3207 {
3208         char *dp;
3209         bool findNewline;
3210         int column;
3211         uint buf_len, n;
3212
3213         dp = varbuf;
3214
3215         findNewline = false;
3216         column = 0;
3217
3218         for (n = 0; n < len; n++) {
3219                 if (varbuf[n] == 0)
3220                         break;
3221                 if (varbuf[n] == '\r')
3222                         continue;
3223                 if (findNewline && varbuf[n] != '\n')
3224                         continue;
3225                 findNewline = false;
3226                 if (varbuf[n] == '#') {
3227                         findNewline = true;
3228                         continue;
3229                 }
3230                 if (varbuf[n] == '\n') {
3231                         if (column == 0)
3232                                 continue;
3233                         *dp++ = 0;
3234                         column = 0;
3235                         continue;
3236                 }
3237                 *dp++ = varbuf[n];
3238                 column++;
3239         }
3240         buf_len = dp - varbuf;
3241
3242         while (dp < varbuf + n)
3243                 *dp++ = 0;
3244
3245         return buf_len;
3246 }
3247
3248 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
3249 {
3250         uint len;
3251         char *memblock = NULL;
3252         char *bufp;
3253         int ret;
3254
3255         ret = request_firmware(&bus->firmware, BRCMFMAC_NV_NAME,
3256                                &bus->sdiodev->func[2]->dev);
3257         if (ret) {
3258                 brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
3259                 return ret;
3260         }
3261         bus->fw_ptr = 0;
3262
3263         memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
3264         if (memblock == NULL) {
3265                 ret = -ENOMEM;
3266                 goto err;
3267         }
3268
3269         len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
3270
3271         if (len > 0 && len < MEMBLOCK) {
3272                 bufp = (char *)memblock;
3273                 bufp[len] = 0;
3274                 len = brcmf_process_nvram_vars(bufp, len);
3275                 bufp += len;
3276                 *bufp++ = 0;
3277                 if (len)
3278                         ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
3279                 if (ret)
3280                         brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
3281         } else {
3282                 brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
3283                 ret = -EIO;
3284         }
3285
3286 err:
3287         kfree(memblock);
3288
3289         release_firmware(bus->firmware);
3290         bus->fw_ptr = 0;
3291
3292         return ret;
3293 }
3294
3295 static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3296 {
3297         int bcmerror = -1;
3298
3299         /* Keep arm in reset */
3300         if (brcmf_sdbrcm_download_state(bus, true)) {
3301                 brcmf_dbg(ERROR, "error placing ARM core in reset\n");
3302                 goto err;
3303         }
3304
3305         /* External image takes precedence if specified */
3306         if (brcmf_sdbrcm_download_code_file(bus)) {
3307                 brcmf_dbg(ERROR, "dongle image file download failed\n");
3308                 goto err;
3309         }
3310
3311         /* External nvram takes precedence if specified */
3312         if (brcmf_sdbrcm_download_nvram(bus))
3313                 brcmf_dbg(ERROR, "dongle nvram file download failed\n");
3314
3315         /* Take arm out of reset */
3316         if (brcmf_sdbrcm_download_state(bus, false)) {
3317                 brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
3318                 goto err;
3319         }
3320
3321         bcmerror = 0;
3322
3323 err:
3324         return bcmerror;
3325 }
3326
3327 static bool
3328 brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3329 {
3330         bool ret;
3331
3332         /* Download the firmware */
3333         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3334
3335         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3336
3337         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3338
3339         return ret;
3340 }
3341
3342 void brcmf_sdbrcm_bus_stop(struct device *dev)
3343 {
3344         u32 local_hostintmask;
3345         u8 saveclk;
3346         uint retries;
3347         int err;
3348         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3349         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
3350         struct brcmf_sdio *bus = sdiodev->bus;
3351
3352         brcmf_dbg(TRACE, "Enter\n");
3353
3354         if (bus->watchdog_tsk) {
3355                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
3356                 kthread_stop(bus->watchdog_tsk);
3357                 bus->watchdog_tsk = NULL;
3358         }
3359
3360         if (bus->dpc_tsk && bus->dpc_tsk != current) {
3361                 send_sig(SIGTERM, bus->dpc_tsk, 1);
3362                 kthread_stop(bus->dpc_tsk);
3363                 bus->dpc_tsk = NULL;
3364         }
3365
3366         down(&bus->sdsem);
3367
3368         bus_wake(bus);
3369
3370         /* Enable clock for device interrupts */
3371         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3372
3373         /* Disable and clear interrupts at the chip level also */
3374         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
3375         local_hostintmask = bus->hostintmask;
3376         bus->hostintmask = 0;
3377
3378         /* Change our idea of bus state */
3379         bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
3380
3381         /* Force clocks on backplane to be sure F2 interrupt propagates */
3382         saveclk = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3383                                         SBSDIO_FUNC1_CHIPCLKCSR, &err);
3384         if (!err) {
3385                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3386                                        SBSDIO_FUNC1_CHIPCLKCSR,
3387                                        (saveclk | SBSDIO_FORCE_HT), &err);
3388         }
3389         if (err)
3390                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3391
3392         /* Turn off the bus (F2), free any pending packets */
3393         brcmf_dbg(INTR, "disable SDIO interrupts\n");
3394         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3395                          SDIO_FUNC_ENABLE_1, NULL);
3396
3397         /* Clear any pending interrupts now that F2 is disabled */
3398         w_sdreg32(bus, local_hostintmask,
3399                   offsetof(struct sdpcmd_regs, intstatus), &retries);
3400
3401         /* Turn off the backplane clock (only) */
3402         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3403
3404         /* Clear the data packet queues */
3405         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
3406
3407         /* Clear any held glomming stuff */
3408         if (bus->glomd)
3409                 brcmu_pkt_buf_free_skb(bus->glomd);
3410         brcmf_sdbrcm_free_glom(bus);
3411
3412         /* Clear rx control and wake any waiters */
3413         bus->rxlen = 0;
3414         brcmf_sdbrcm_dcmd_resp_wake(bus);
3415
3416         /* Reset some F2 state stuff */
3417         bus->rxskip = false;
3418         bus->tx_seq = bus->rx_seq = 0;
3419
3420         up(&bus->sdsem);
3421 }
3422
3423 int brcmf_sdbrcm_bus_init(struct device *dev)
3424 {
3425         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3426         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
3427         struct brcmf_sdio *bus = sdiodev->bus;
3428         unsigned long timeout;
3429         uint retries = 0;
3430         u8 ready, enable;
3431         int err, ret = 0;
3432         u8 saveclk;
3433
3434         brcmf_dbg(TRACE, "Enter\n");
3435
3436         /* try to download image and nvram to the dongle */
3437         if (bus_if->state == BRCMF_BUS_DOWN) {
3438                 if (!(brcmf_sdbrcm_download_firmware(bus)))
3439                         return -1;
3440         }
3441
3442         if (!bus->drvr)
3443                 return 0;
3444
3445         /* Start the watchdog timer */
3446         bus->tickcnt = 0;
3447         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3448
3449         down(&bus->sdsem);
3450
3451         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3452         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3453         if (bus->clkstate != CLK_AVAIL)
3454                 goto exit;
3455
3456         /* Force clocks on backplane to be sure F2 interrupt propagates */
3457         saveclk =
3458             brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3459                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
3460         if (!err) {
3461                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3462                                        SBSDIO_FUNC1_CHIPCLKCSR,
3463                                        (saveclk | SBSDIO_FORCE_HT), &err);
3464         }
3465         if (err) {
3466                 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3467                 goto exit;
3468         }
3469
3470         /* Enable function 2 (frame transfers) */
3471         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3472                   offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
3473         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3474
3475         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3476                                enable, NULL);
3477
3478         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3479         ready = 0;
3480         while (enable != ready) {
3481                 ready = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_0,
3482                                               SDIO_CCCR_IORx, NULL);
3483                 if (time_after(jiffies, timeout))
3484                         break;
3485                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3486                         /* prevent busy waiting if it takes too long */
3487                         msleep_interruptible(20);
3488         }
3489
3490         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3491
3492         /* If F2 successfully enabled, set core and enable interrupts */
3493         if (ready == enable) {
3494                 /* Set up the interrupt mask and enable interrupts */
3495                 bus->hostintmask = HOSTINTMASK;
3496                 w_sdreg32(bus, bus->hostintmask,
3497                           offsetof(struct sdpcmd_regs, hostintmask), &retries);
3498
3499                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3500                                        SBSDIO_WATERMARK, 8, &err);
3501
3502                 /* Set bus state according to enable result */
3503                 bus_if->state = BRCMF_BUS_DATA;
3504         }
3505
3506         else {
3507                 /* Disable F2 again */
3508                 enable = SDIO_FUNC_ENABLE_1;
3509                 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0,
3510                                        SDIO_CCCR_IOEx, enable, NULL);
3511         }
3512
3513         /* Restore previous clock setting */
3514         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3515                                SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3516
3517         /* If we didn't come up, turn off backplane clock */
3518         if (bus_if->state != BRCMF_BUS_DATA)
3519                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3520
3521 exit:
3522         up(&bus->sdsem);
3523
3524         return ret;
3525 }
3526
3527 void brcmf_sdbrcm_isr(void *arg)
3528 {
3529         struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
3530
3531         brcmf_dbg(TRACE, "Enter\n");
3532
3533         if (!bus) {
3534                 brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
3535                 return;
3536         }
3537
3538         if (bus->drvr->bus_if->state == BRCMF_BUS_DOWN) {
3539                 brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
3540                 return;
3541         }
3542         /* Count the interrupt call */
3543         bus->intrcount++;
3544         bus->ipend = true;
3545
3546         /* Shouldn't get this interrupt if we're sleeping? */
3547         if (bus->sleeping) {
3548                 brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
3549                 return;
3550         }
3551
3552         /* Disable additional interrupts (is this needed now)? */
3553         if (!bus->intr)
3554                 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
3555
3556         bus->dpc_sched = true;
3557         if (bus->dpc_tsk)
3558                 complete(&bus->dpc_wait);
3559 }
3560
3561 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
3562 {
3563 #ifdef BCMDBG
3564         struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
3565 #endif  /* BCMDBG */
3566
3567         brcmf_dbg(TIMER, "Enter\n");
3568
3569         /* Ignore the timer if simulating bus down */
3570         if (bus->sleeping)
3571                 return false;
3572
3573         down(&bus->sdsem);
3574
3575         /* Poll period: check device if appropriate. */
3576         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3577                 u32 intstatus = 0;
3578
3579                 /* Reset poll tick */
3580                 bus->polltick = 0;
3581
3582                 /* Check device if no interrupts */
3583                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
3584
3585                         if (!bus->dpc_sched) {
3586                                 u8 devpend;
3587                                 devpend = brcmf_sdcard_cfg_read(bus->sdiodev,
3588                                                 SDIO_FUNC_0, SDIO_CCCR_INTx,
3589                                                 NULL);
3590                                 intstatus =
3591                                     devpend & (INTR_STATUS_FUNC1 |
3592                                                INTR_STATUS_FUNC2);
3593                         }
3594
3595                         /* If there is something, make like the ISR and
3596                                  schedule the DPC */
3597                         if (intstatus) {
3598                                 bus->pollcnt++;
3599                                 bus->ipend = true;
3600
3601                                 bus->dpc_sched = true;
3602                                 if (bus->dpc_tsk)
3603                                         complete(&bus->dpc_wait);
3604                         }
3605                 }
3606
3607                 /* Update interrupt tracking */
3608                 bus->lastintrs = bus->intrcount;
3609         }
3610 #ifdef BCMDBG
3611         /* Poll for console output periodically */
3612         if (bus_if->state == BRCMF_BUS_DATA &&
3613             bus->console_interval != 0) {
3614                 bus->console.count += BRCMF_WD_POLL_MS;
3615                 if (bus->console.count >= bus->console_interval) {
3616                         bus->console.count -= bus->console_interval;
3617                         /* Make sure backplane clock is on */
3618                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3619                         if (brcmf_sdbrcm_readconsole(bus) < 0)
3620                                 /* stop on error */
3621                                 bus->console_interval = 0;
3622                 }
3623         }
3624 #endif                          /* BCMDBG */
3625
3626         /* On idle timeout clear activity flag and/or turn off clock */
3627         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3628                 if (++bus->idlecount >= bus->idletime) {
3629                         bus->idlecount = 0;
3630                         if (bus->activity) {
3631                                 bus->activity = false;
3632                                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3633                         } else {
3634                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3635                         }
3636                 }
3637         }
3638
3639         up(&bus->sdsem);
3640
3641         return bus->ipend;
3642 }
3643
3644 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3645 {
3646         if (chipid == BCM4329_CHIP_ID)
3647                 return true;
3648         if (chipid == BCM4330_CHIP_ID)
3649                 return true;
3650         return false;
3651 }
3652
3653 static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
3654 {
3655         brcmf_dbg(TRACE, "Enter\n");
3656
3657         kfree(bus->rxbuf);
3658         bus->rxctl = bus->rxbuf = NULL;
3659         bus->rxlen = 0;
3660
3661         kfree(bus->databuf);
3662         bus->databuf = NULL;
3663 }
3664
3665 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
3666 {
3667         brcmf_dbg(TRACE, "Enter\n");
3668
3669         if (bus->drvr->maxctl) {
3670                 bus->rxblen =
3671                     roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
3672                             ALIGNMENT) + BRCMF_SDALIGN;
3673                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3674                 if (!(bus->rxbuf))
3675                         goto fail;
3676         }
3677
3678         /* Allocate buffer to receive glomed packet */
3679         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
3680         if (!(bus->databuf)) {
3681                 /* release rxbuf which was already located as above */
3682                 if (!bus->rxblen)
3683                         kfree(bus->rxbuf);
3684                 goto fail;
3685         }
3686
3687         /* Align the buffer */
3688         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
3689                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
3690                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
3691         else
3692                 bus->dataptr = bus->databuf;
3693
3694         return true;
3695
3696 fail:
3697         return false;
3698 }
3699
3700 static bool
3701 brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
3702 {
3703         u8 clkctl = 0;
3704         int err = 0;
3705         int reg_addr;
3706         u32 reg_val;
3707         u8 idx;
3708
3709         bus->alp_only = true;
3710
3711         /* Return the window to backplane enumeration space for core access */
3712         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, SI_ENUM_BASE))
3713                 brcmf_dbg(ERROR, "FAILED to return to SI_ENUM_BASE\n");
3714
3715 #ifdef BCMDBG
3716         printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
3717                brcmf_sdcard_reg_read(bus->sdiodev, SI_ENUM_BASE, 4));
3718
3719 #endif                          /* BCMDBG */
3720
3721         /*
3722          * Force PLL off until brcmf_sdio_chip_attach()
3723          * programs PLL control regs
3724          */
3725
3726         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3727                                SBSDIO_FUNC1_CHIPCLKCSR,
3728                                BRCMF_INIT_CLKCTL1, &err);
3729         if (!err)
3730                 clkctl =
3731                     brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3732                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
3733
3734         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3735                 brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3736                           err, BRCMF_INIT_CLKCTL1, clkctl);
3737                 goto fail;
3738         }
3739
3740         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3741                 brcmf_dbg(ERROR, "brcmf_sdio_chip_attach failed!\n");
3742                 goto fail;
3743         }
3744
3745         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
3746                 brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
3747                 goto fail;
3748         }
3749
3750         brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
3751                                           SDIO_DRIVE_STRENGTH);
3752
3753         /* Get info on the SOCRAM cores... */
3754         bus->ramsize = bus->ci->ramsize;
3755         if (!(bus->ramsize)) {
3756                 brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
3757                 goto fail;
3758         }
3759
3760         /* Set core control so an SDIO reset does a backplane reset */
3761         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3762         reg_addr = bus->ci->c_inf[idx].base +
3763                    offsetof(struct sdpcmd_regs, corecontrol);
3764         reg_val = brcmf_sdcard_reg_read(bus->sdiodev, reg_addr, sizeof(u32));
3765         brcmf_sdcard_reg_write(bus->sdiodev, reg_addr, sizeof(u32),
3766                                reg_val | CC_BPRESEN);
3767
3768         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3769
3770         /* Locate an appropriately-aligned portion of hdrbuf */
3771         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3772                                     BRCMF_SDALIGN);
3773
3774         /* Set the poll and/or interrupt flags */
3775         bus->intr = true;
3776         bus->poll = false;
3777         if (bus->poll)
3778                 bus->pollrate = 1;
3779
3780         return true;
3781
3782 fail:
3783         return false;
3784 }
3785
3786 static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
3787 {
3788         brcmf_dbg(TRACE, "Enter\n");
3789
3790         /* Disable F2 to clear any intermediate frame state on the dongle */
3791         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3792                                SDIO_FUNC_ENABLE_1, NULL);
3793
3794         bus->drvr->bus_if->state = BRCMF_BUS_DOWN;
3795         bus->sleeping = false;
3796         bus->rxflow = false;
3797
3798         /* Done with backplane-dependent accesses, can drop clock... */
3799         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3800                                SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3801
3802         /* ...and initialize clock/power states */
3803         bus->clkstate = CLK_SDONLY;
3804         bus->idletime = BRCMF_IDLE_INTERVAL;
3805         bus->idleclock = BRCMF_IDLE_ACTIVE;
3806
3807         /* Query the F2 block size, set roundup accordingly */
3808         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3809         bus->roundup = min(max_roundup, bus->blocksize);
3810
3811         /* bus module does not support packet chaining */
3812         bus->use_rxchain = false;
3813         bus->sd_rxchain = false;
3814
3815         return true;
3816 }
3817
3818 static int
3819 brcmf_sdbrcm_watchdog_thread(void *data)
3820 {
3821         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3822
3823         allow_signal(SIGTERM);
3824         /* Run until signal received */
3825         while (1) {
3826                 if (kthread_should_stop())
3827                         break;
3828                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3829                         brcmf_sdbrcm_bus_watchdog(bus);
3830                         /* Count the tick for reference */
3831                         bus->tickcnt++;
3832                 } else
3833                         break;
3834         }
3835         return 0;
3836 }
3837
3838 static void
3839 brcmf_sdbrcm_watchdog(unsigned long data)
3840 {
3841         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3842
3843         if (bus->watchdog_tsk) {
3844                 complete(&bus->watchdog_wait);
3845                 /* Reschedule the watchdog */
3846                 if (bus->wd_timer_valid)
3847                         mod_timer(&bus->timer,
3848                                   jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3849         }
3850 }
3851
3852 static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
3853 {
3854         brcmf_dbg(TRACE, "Enter\n");
3855
3856         if (bus->ci) {
3857                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3858                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3859                 brcmf_sdio_chip_detach(&bus->ci);
3860                 if (bus->vars && bus->varsz)
3861                         kfree(bus->vars);
3862                 bus->vars = NULL;
3863         }
3864
3865         brcmf_dbg(TRACE, "Disconnected\n");
3866 }
3867
3868 /* Detach and free everything */
3869 static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
3870 {
3871         brcmf_dbg(TRACE, "Enter\n");
3872
3873         if (bus) {
3874                 /* De-register interrupt handler */
3875                 brcmf_sdcard_intr_dereg(bus->sdiodev);
3876
3877                 if (bus->sdiodev->bus_if->drvr) {
3878                         brcmf_detach(bus->sdiodev->dev);
3879                         brcmf_sdbrcm_release_dongle(bus);
3880                         bus->drvr = NULL;
3881                 }
3882
3883                 brcmf_sdbrcm_release_malloc(bus);
3884
3885                 kfree(bus);
3886         }
3887
3888         brcmf_dbg(TRACE, "Disconnected\n");
3889 }
3890
3891 void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
3892 {
3893         int ret;
3894         struct brcmf_sdio *bus;
3895
3896         brcmf_dbg(TRACE, "Enter\n");
3897
3898         /* We make an assumption about address window mappings:
3899          * regsva == SI_ENUM_BASE*/
3900
3901         /* Allocate private bus interface state */
3902         bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
3903         if (!bus)
3904                 goto fail;
3905
3906         bus->sdiodev = sdiodev;
3907         sdiodev->bus = bus;
3908         skb_queue_head_init(&bus->glom);
3909         bus->txbound = BRCMF_TXBOUND;
3910         bus->rxbound = BRCMF_RXBOUND;
3911         bus->txminmax = BRCMF_TXMINMAX;
3912         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
3913         bus->usebufpool = false;        /* Use bufpool if allocated,
3914                                          else use locally malloced rxbuf */
3915
3916         /* attempt to attach to the dongle */
3917         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3918                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
3919                 goto fail;
3920         }
3921
3922         spin_lock_init(&bus->txqlock);
3923         init_waitqueue_head(&bus->ctrl_wait);
3924         init_waitqueue_head(&bus->dcmd_resp_wait);
3925
3926         /* Set up the watchdog timer */
3927         init_timer(&bus->timer);
3928         bus->timer.data = (unsigned long)bus;
3929         bus->timer.function = brcmf_sdbrcm_watchdog;
3930
3931         /* Initialize thread based operation and lock */
3932         sema_init(&bus->sdsem, 1);
3933
3934         /* Initialize watchdog thread */
3935         init_completion(&bus->watchdog_wait);
3936         bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3937                                         bus, "brcmf_watchdog");
3938         if (IS_ERR(bus->watchdog_tsk)) {
3939                 printk(KERN_WARNING
3940                        "brcmf_watchdog thread failed to start\n");
3941                 bus->watchdog_tsk = NULL;
3942         }
3943         /* Initialize DPC thread */
3944         init_completion(&bus->dpc_wait);
3945         bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
3946                                    bus, "brcmf_dpc");
3947         if (IS_ERR(bus->dpc_tsk)) {
3948                 printk(KERN_WARNING
3949                        "brcmf_dpc thread failed to start\n");
3950                 bus->dpc_tsk = NULL;
3951         }
3952
3953         /* Attach to the brcmf/OS/network interface */
3954         bus->drvr = brcmf_attach(bus, SDPCM_RESERVE, bus->sdiodev->dev);
3955         if (!bus->drvr) {
3956                 brcmf_dbg(ERROR, "brcmf_attach failed\n");
3957                 goto fail;
3958         }
3959
3960         /* Allocate buffers */
3961         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
3962                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
3963                 goto fail;
3964         }
3965
3966         if (!(brcmf_sdbrcm_probe_init(bus))) {
3967                 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
3968                 goto fail;
3969         }
3970
3971         /* Register interrupt callback, but mask it (not operational yet). */
3972         brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
3973         ret = brcmf_sdcard_intr_reg(bus->sdiodev);
3974         if (ret != 0) {
3975                 brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
3976                 goto fail;
3977         }
3978         brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
3979
3980         brcmf_dbg(INFO, "completed!!\n");
3981
3982         /* if firmware path present try to download and bring up bus */
3983         ret = brcmf_bus_start(bus->sdiodev->dev);
3984         if (ret != 0) {
3985                 if (ret == -ENOLINK) {
3986                         brcmf_dbg(ERROR, "dongle is not responding\n");
3987                         goto fail;
3988                 }
3989         }
3990
3991         /* add interface and open for business */
3992         if (brcmf_add_if(bus->sdiodev->dev, 0, "wlan%d", NULL)) {
3993                 brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
3994                 goto fail;
3995         }
3996
3997         return bus;
3998
3999 fail:
4000         brcmf_sdbrcm_release(bus);
4001         return NULL;
4002 }
4003
4004 void brcmf_sdbrcm_disconnect(void *ptr)
4005 {
4006         struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
4007
4008         brcmf_dbg(TRACE, "Enter\n");
4009
4010         if (bus)
4011                 brcmf_sdbrcm_release(bus);
4012
4013         brcmf_dbg(TRACE, "Disconnected\n");
4014 }
4015
4016 void
4017 brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
4018 {
4019         /* Totally stop the timer */
4020         if (!wdtick && bus->wd_timer_valid == true) {
4021                 del_timer_sync(&bus->timer);
4022                 bus->wd_timer_valid = false;
4023                 bus->save_ms = wdtick;
4024                 return;
4025         }
4026
4027         /* don't start the wd until fw is loaded */
4028         if (bus->drvr->bus_if->state == BRCMF_BUS_DOWN)
4029                 return;
4030
4031         if (wdtick) {
4032                 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4033                         if (bus->wd_timer_valid == true)
4034                                 /* Stop timer and restart at new value */
4035                                 del_timer_sync(&bus->timer);
4036
4037                         /* Create timer again when watchdog period is
4038                            dynamically changed or in the first instance
4039                          */
4040                         bus->timer.expires =
4041                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4042                         add_timer(&bus->timer);
4043
4044                 } else {
4045                         /* Re arm the timer, at last watchdog period */
4046                         mod_timer(&bus->timer,
4047                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4048                 }
4049
4050                 bus->wd_timer_valid = true;
4051                 bus->save_ms = wdtick;
4052         }
4053 }