drivers/staging/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/semaphore.h>
  28 #include <linux/firmware.h>
  29 #include <asm/unaligned.h>
  30 #include <defs.h>
  31 #include <brcmu_wifi.h>
  32 #include <brcmu_utils.h>
  33 #include <brcm_hw_ids.h>
  34 #include <soc.h>
  35 #include "sdio_host.h"
  36
  37 /* register access macros */
  38 #ifndef __BIG_ENDIAN
  39 #ifndef __mips__
  40 #define R_REG(r, typ) \
  41         brcmf_sdcard_reg_read(NULL, (r), sizeof(typ))
  42 #else                           /* __mips__ */
  43 #define R_REG(r, typ) \
  44         ({ \
  45                 __typeof(*(r)) __osl_v; \
  46                 __asm__ __volatile__("sync"); \
  47                 __osl_v = brcmf_sdcard_reg_read(NULL, (r),\
  48                                           sizeof(typ)); \
  49                 __asm__ __volatile__("sync"); \
  50                 __osl_v; \
  51         })
  52 #endif                          /* __mips__ */
  53
  54 #else                           /* __BIG_ENDIAN */
  55 #define R_REG(r, typ) \
  56         brcmf_sdcard_reg_read(NULL, (r), sizeof(typ))
  57 #endif                          /* __BIG_ENDIAN */
  58
  59 #define OR_REG(r, v, typ) \
  60         brcmf_sdcard_reg_write(NULL, (r), sizeof(typ), R_REG(r, typ) | (v))
  61
  62 #ifdef BCMDBG
  63
  64 /* ARM trap handling */
  65
  66 /* Trap types defined by ARM (see arminc.h) */
  67
  68 #if defined(__ARM_ARCH_4T__)
  69 #define MAX_TRAP_TYPE   (TR_FIQ + 1)
  70 #elif defined(__ARM_ARCH_7M__)
  71 #define MAX_TRAP_TYPE   (TR_ISR + ARMCM3_NUMINTS)
  72 #endif                          /* __ARM_ARCH_7M__ */
  73
  74 /* The trap structure is defined here as offsets for assembly */
  75 #define TR_TYPE         0x00
  76 #define TR_EPC          0x04
  77 #define TR_CPSR         0x08
  78 #define TR_SPSR         0x0c
  79 #define TR_REGS         0x10
  80 #define TR_REG(n)       (TR_REGS + (n) * 4)
  81 #define TR_SP           TR_REG(13)
  82 #define TR_LR           TR_REG(14)
  83 #define TR_PC           TR_REG(15)
  84
  85 #define TRAP_T_SIZE     80
  86
  87 struct brcmf_trap {
  88         u32 type;
  89         u32 epc;
  90         u32 cpsr;
  91         u32 spsr;
  92         u32 r0;
  93         u32 r1;
  94         u32 r2;
  95         u32 r3;
  96         u32 r4;
  97         u32 r5;
  98         u32 r6;
  99         u32 r7;
 100         u32 r8;
 101         u32 r9;
 102         u32 r10;
 103         u32 r11;
 104         u32 r12;
 105         u32 r13;
 106         u32 r14;
 107         u32 pc;
 108 };
 109
 110 #define CBUF_LEN        (128)
 111
 112 struct rte_log {
 113         u32 buf;                /* Can't be pointer on (64-bit) hosts */
 114         uint buf_size;
 115         uint idx;
 116         char *_buf_compat;      /* Redundant pointer for backward compat. */
 117 };
 118
 119 struct rte_console {
 120         /* Virtual UART
 121          * When there is no UART (e.g. Quickturn),
 122          * the host should write a complete
 123          * input line directly into cbuf and then write
 124          * the length into vcons_in.
 125          * This may also be used when there is a real UART
 126          * (at risk of conflicting with
 127          * the real UART).  vcons_out is currently unused.
 128          */
 129         volatile uint vcons_in;
 130         volatile uint vcons_out;
 131
 132         /* Output (logging) buffer
 133          * Console output is written to a ring buffer log_buf at index log_idx.
 134          * The host may read the output when it sees log_idx advance.
 135          * Output will be lost if the output wraps around faster than the host
 136          * polls.
 137          */
 138         struct rte_log log;
 139
 140         /* Console input line buffer
 141          * Characters are read one at a time into cbuf
 142          * until <CR> is received, then
 143          * the buffer is processed as a command line.
 144          * Also used for virtual UART.
 145          */
 146         uint cbuf_idx;
 147         char cbuf[CBUF_LEN];
 148 };
 149
 150 #endif                          /* BCMDBG */
 151 #include <chipcommon.h>
 152
 153 #include "dhd.h"
 154 #include "dhd_bus.h"
 155 #include "dhd_proto.h"
 156 #include "dhd_dbg.h"
 157 #include <bcmchip.h>
 158
 159 #define TXQLEN          2048    /* bulk tx queue length */
 160 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 161 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 162 #define PRIOMASK        7
 163
 164 #define TXRETRIES       2       /* # of retries for tx frames */
 165
 166 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 167                                  one scheduling */
 168
 169 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 170                                  one scheduling */
 171
 172 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 173
 174 #define MEMBLOCK        2048    /* Block size used for downloading
 175                                  of dongle image */
 176 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 177                                  biggest possible glom */
 178
 179 #ifndef BRCMF_FIRSTREAD
 180 #define BRCMF_FIRSTREAD 32
 181 #endif
 182
 183 #if !ISPOWEROF2(BRCMF_FIRSTREAD)
 184 #error BRCMF_FIRSTREAD is not a power of 2!
 185 #endif
 186
 187 /* SBSDIO_DEVICE_CTL */
 188 #define SBSDIO_DEVCTL_SETBUSY           0x01    /* 1: device will assert busy signal when
 189                                                  * receiving CMD53
 190                                                  */
 191 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02    /* 1: assertion of sdio interrupt is
 192                                                  * synchronous to the sdio clock
 193                                                  */
 194 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04    /* 1: mask all interrupts to host
 195                                                  * except the chipActive (rev 8)
 196                                                  */
 197 #define SBSDIO_DEVCTL_PADS_ISO          0x08    /* 1: isolate internal sdio signals, put
 198                                                  * external pads in tri-state; requires
 199                                                  * sdio bus power cycle to clear (rev 9)
 200                                                  */
 201 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30    /* Force SD->SB reset mapping (rev 11) */
 202 #define SBSDIO_DEVCTL_RST_CORECTL       0x00    /*   Determined by CoreControl bit */
 203 #define SBSDIO_DEVCTL_RST_BPRESET       0x10    /*   Force backplane reset */
 204 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20    /*   Force no backplane reset */
 205
 206 /* SBSDIO_FUNC1_CHIPCLKCSR */
 207 #define SBSDIO_FORCE_ALP                0x01    /* Force ALP request to backplane */
 208 #define SBSDIO_FORCE_HT                 0x02    /* Force HT request to backplane */
 209 #define SBSDIO_FORCE_ILP                0x04    /* Force ILP request to backplane */
 210 #define SBSDIO_ALP_AVAIL_REQ            0x08    /* Make ALP ready (power up xtal) */
 211 #define SBSDIO_HT_AVAIL_REQ             0x10    /* Make HT ready (power up PLL) */
 212 #define SBSDIO_FORCE_HW_CLKREQ_OFF      0x20    /* Squelch clock requests from HW */
 213 #define SBSDIO_ALP_AVAIL                0x40    /* Status: ALP is ready */
 214 #define SBSDIO_HT_AVAIL                 0x80    /* Status: HT is ready */
 215
 216 #define SBSDIO_AVBITS                   (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
 217 #define SBSDIO_ALPAV(regval)            ((regval) & SBSDIO_AVBITS)
 218 #define SBSDIO_HTAV(regval)             (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
 219 #define SBSDIO_ALPONLY(regval)          (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
 220 #define SBSDIO_CLKAV(regval, alponly)   (SBSDIO_ALPAV(regval) && \
 221                                         (alponly ? 1 : SBSDIO_HTAV(regval)))
 222 /* direct(mapped) cis space */
 223 #define SBSDIO_CIS_BASE_COMMON          0x1000  /* MAPPED common CIS address */
 224 #define SBSDIO_CIS_SIZE_LIMIT           0x200   /* maximum bytes in one CIS */
 225 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF /* cis offset addr is < 17 bits */
 226
 227 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6       /* manfid tuple length, include tuple,
 228                                                  * link bytes
 229                                                  */
 230
 231 /* intstatus */
 232 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 233 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 234 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 235 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 236 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 237 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 238 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 239 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 240 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 241 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 242 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 243 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 244 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 245 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 246 #define I_PC            (1 << 10)       /* descriptor error */
 247 #define I_PD            (1 << 11)       /* data error */
 248 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 249 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 250 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 251 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 252 #define I_RI            (1 << 16)       /* Receive Interrupt */
 253 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 254 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 255 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 256 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 257 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 258 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 259 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 260 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 261 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 262 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 263 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 264 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 265
 266 /* corecontrol */
 267 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 268 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 269 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 270 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 271 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 272 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 273
 274 /* SDA_FRAMECTRL */
 275 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 276 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 277 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 278 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 279
 280 /* HW frame tag */
 281 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 282
 283 /* Total length of frame header for dongle protocol */
 284 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 285 #ifdef SDTEST
 286 #define SDPCM_RESERVE   (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + BRCMF_SDALIGN)
 287 #else
 288 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 289 #endif
 290
 291 /*
 292  * Software allocation of To SB Mailbox resources
 293  */
 294
 295 /* tosbmailbox bits corresponding to intstatus bits */
 296 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 297 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 298 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 299 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 300
 301 /* tosbmailboxdata */
 302 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 303
 304 /*
 305  * Software allocation of To Host Mailbox resources
 306  */
 307
 308 /* intstatus bits */
 309 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 310 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 311 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 312 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 313
 314 /* tohostmailboxdata */
 315 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 316 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 317 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 318 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 319
 320 #define HMB_DATA_FCDATA_MASK    0xff000000
 321 #define HMB_DATA_FCDATA_SHIFT   24
 322
 323 #define HMB_DATA_VERSION_MASK   0x00ff0000
 324 #define HMB_DATA_VERSION_SHIFT  16
 325
 326 /*
 327  * Software-defined protocol header
 328  */
 329
 330 /* Current protocol version */
 331 #define SDPCM_PROT_VERSION      4
 332
 333 /* SW frame header */
 334 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 335
 336 #define SDPCM_CHANNEL_MASK              0x00000f00
 337 #define SDPCM_CHANNEL_SHIFT             8
 338 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 339
 340 #define SDPCM_NEXTLEN_OFFSET            2
 341
 342 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 343 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 344 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 345 #define SDPCM_DOFFSET_MASK              0xff000000
 346 #define SDPCM_DOFFSET_SHIFT             24
 347 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 348 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 349 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 350 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 351
 352 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 353
 354 /* logical channel numbers */
 355 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 356 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 357 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 358 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 359 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 360
 361 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 362
 363 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 364
 365 /* For TEST_CHANNEL packets, define another 4-byte header */
 366 #define SDPCM_TEST_HDRLEN       4       /*
 367                                          * Generally: Cmd(1), Ext(1), Len(2);
 368                                          * Semantics of Ext byte depend on
 369                                          * command. Len is current or requested
 370                                          * frame length, not including test
 371                                          * header; sent little-endian.
 372                                          */
 373 #define SDPCM_TEST_DISCARD      0x01    /* Receiver discards. Ext:pattern id. */
 374 #define SDPCM_TEST_ECHOREQ      0x02    /* Echo request. Ext:pattern id. */
 375 #define SDPCM_TEST_ECHORSP      0x03    /* Echo response. Ext:pattern id. */
 376 #define SDPCM_TEST_BURST        0x04    /*
 377                                          * Receiver to send a burst.
 378                                          * Ext is a frame count
 379                                          */
 380 #define SDPCM_TEST_SEND         0x05    /*
 381                                          * Receiver sets send mode.
 382                                          * Ext is boolean on/off
 383                                          */
 384
 385 /* Handy macro for filling in datagen packets with a pattern */
 386 #define SDPCM_TEST_FILL(byteno, id)     ((u8)(id + byteno))
 387
 388 /*
 389  * Shared structure between dongle and the host.
 390  * The structure contains pointers to trap or assert information.
 391  */
 392 #define SDPCM_SHARED_VERSION       0x0002
 393 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 394 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 395 #define SDPCM_SHARED_ASSERT        0x0200
 396 #define SDPCM_SHARED_TRAP          0x0400
 397
 398
 399 /* Space for header read, limit for data packets */
 400 #ifndef MAX_HDR_READ
 401 #define MAX_HDR_READ    32
 402 #endif
 403 #if !ISPOWEROF2(MAX_HDR_READ)
 404 #error MAX_HDR_READ is not a power of 2!
 405 #endif
 406
 407 #define MAX_RX_DATASZ   2048
 408
 409 /* Maximum milliseconds to wait for F2 to come up */
 410 #define BRCMF_WAIT_F2RDY        3000
 411
 412 /* Bump up limit on waiting for HT to account for first startup;
 413  * if the image is doing a CRC calculation before programming the PMU
 414  * for HT availability, it could take a couple hundred ms more, so
 415  * max out at a 1 second (1000000us).
 416  */
 417 #if (PMU_MAX_TRANSITION_DLY <= 1000000)
 418 #undef PMU_MAX_TRANSITION_DLY
 419 #define PMU_MAX_TRANSITION_DLY 1000000
 420 #endif
 421
 422 /* Value for ChipClockCSR during initial setup */
 423 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 424                                         SBSDIO_ALP_AVAIL_REQ)
 425
 426 /* Flags for SDH calls */
 427 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 428
 429 /* sbimstate */
 430 #define SBIM_IBE                0x20000 /* inbanderror */
 431 #define SBIM_TO                 0x40000 /* timeout */
 432 #define SBIM_BY                 0x01800000      /* busy (sonics >= 2.3) */
 433 #define SBIM_RJ                 0x02000000      /* reject (sonics >= 2.3) */
 434
 435 /* sbtmstatelow */
 436 #define SBTML_RESET             0x0001  /* reset */
 437 #define SBTML_REJ_MASK          0x0006  /* reject field */
 438 #define SBTML_REJ               0x0002  /* reject */
 439 #define SBTML_TMPREJ            0x0004  /* temporary reject, for error recovery */
 440
 441 #define SBTML_SICF_SHIFT        16      /* Shift to locate the SI control flags in sbtml */
 442
 443 /* sbtmstatehigh */
 444 #define SBTMH_SERR              0x0001  /* serror */
 445 #define SBTMH_INT               0x0002  /* interrupt */
 446 #define SBTMH_BUSY              0x0004  /* busy */
 447 #define SBTMH_TO                0x0020  /* timeout (sonics >= 2.3) */
 448
 449 #define SBTMH_SISF_SHIFT        16      /* Shift to locate the SI status flags in sbtmh */
 450
 451 /* sbidlow */
 452 #define SBIDL_INIT              0x80    /* initiator */
 453
 454 /* sbidhigh */
 455 #define SBIDH_RC_MASK           0x000f  /* revision code */
 456 #define SBIDH_RCE_MASK          0x7000  /* revision code extension field */
 457 #define SBIDH_RCE_SHIFT         8
 458 #define SBCOREREV(sbidh) \
 459         ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
 460 #define SBIDH_CC_MASK           0x8ff0  /* core code */
 461 #define SBIDH_CC_SHIFT          4
 462 #define SBIDH_VC_MASK           0xffff0000      /* vendor code */
 463 #define SBIDH_VC_SHIFT          16
 464
 465 /*
 466  * Conversion of 802.1D priority to precedence level
 467  */
 468 #define PRIO2PREC(prio) \
 469         (((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? \
 470         ((prio^2)) : (prio))
 471
 472 BRCMF_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
 473
 474 /*
 475  * Core reg address translation.
 476  * Both macro's returns a 32 bits byte address on the backplane bus.
 477  */
 478 #define CORE_CC_REG(base, field)        (base + offsetof(chipcregs_t, field))
 479 #define CORE_BUS_REG(base, field) \
 480                 (base + offsetof(struct sdpcmd_regs, field))
 481 #define CORE_SB(base, field) \
 482                 (base + SBCONFIGOFF + offsetof(struct sbconfig, field))
 483
 484 /* core registers */
 485 struct sdpcmd_regs {
 486         u32 corecontrol;                /* 0x00, rev8 */
 487         u32 corestatus;                 /* rev8 */
 488         u32 PAD[1];
 489         u32 biststatus;                 /* rev8 */
 490
 491         /* PCMCIA access */
 492         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 493         u16 PAD[1];
 494         u16 pcmciamesportalmask;        /* rev8 */
 495         u16 PAD[1];
 496         u16 pcmciawrframebc;            /* rev8 */
 497         u16 PAD[1];
 498         u16 pcmciaunderflowtimer;       /* rev8 */
 499         u16 PAD[1];
 500
 501         /* interrupt */
 502         u32 intstatus;                  /* 0x020, rev8 */
 503         u32 hostintmask;                /* rev8 */
 504         u32 intmask;                    /* rev8 */
 505         u32 sbintstatus;                /* rev8 */
 506         u32 sbintmask;                  /* rev8 */
 507         u32 funcintmask;                /* rev4 */
 508         u32 PAD[2];
 509         u32 tosbmailbox;                /* 0x040, rev8 */
 510         u32 tohostmailbox;              /* rev8 */
 511         u32 tosbmailboxdata;            /* rev8 */
 512         u32 tohostmailboxdata;          /* rev8 */
 513
 514         /* synchronized access to registers in SDIO clock domain */
 515         u32 sdioaccess;                 /* 0x050, rev8 */
 516         u32 PAD[3];
 517
 518         /* PCMCIA frame control */
 519         u8 pcmciaframectrl;             /* 0x060, rev8 */
 520         u8 PAD[3];
 521         u8 pcmciawatermark;             /* rev8 */
 522         u8 PAD[155];
 523
 524         /* interrupt batching control */
 525         u32 intrcvlazy;                 /* 0x100, rev8 */
 526         u32 PAD[3];
 527
 528         /* counters */
 529         u32 cmd52rd;                    /* 0x110, rev8 */
 530         u32 cmd52wr;                    /* rev8 */
 531         u32 cmd53rd;                    /* rev8 */
 532         u32 cmd53wr;                    /* rev8 */
 533         u32 abort;                      /* rev8 */
 534         u32 datacrcerror;               /* rev8 */
 535         u32 rdoutofsync;                /* rev8 */
 536         u32 wroutofsync;                /* rev8 */
 537         u32 writebusy;                  /* rev8 */
 538         u32 readwait;                   /* rev8 */
 539         u32 readterm;                   /* rev8 */
 540         u32 writeterm;                  /* rev8 */
 541         u32 PAD[40];
 542         u32 clockctlstatus;             /* rev8 */
 543         u32 PAD[7];
 544
 545         u32 PAD[128];                   /* DMA engines */
 546
 547         /* SDIO/PCMCIA CIS region */
 548         char cis[512];                  /* 0x400-0x5ff, rev6 */
 549
 550         /* PCMCIA function control registers */
 551         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 552         u16 PAD[55];
 553
 554         /* PCMCIA backplane access */
 555         u16 backplanecsr;               /* 0x76E, rev6 */
 556         u16 backplaneaddr0;             /* rev6 */
 557         u16 backplaneaddr1;             /* rev6 */
 558         u16 backplaneaddr2;             /* rev6 */
 559         u16 backplaneaddr3;             /* rev6 */
 560         u16 backplanedata0;             /* rev6 */
 561         u16 backplanedata1;             /* rev6 */
 562         u16 backplanedata2;             /* rev6 */
 563         u16 backplanedata3;             /* rev6 */
 564         u16 PAD[31];
 565
 566         /* sprom "size" & "blank" info */
 567         u16 spromstatus;                /* 0x7BE, rev2 */
 568         u32 PAD[464];
 569
 570         u16 PAD[0x80];
 571 };
 572
 573 #ifdef BCMDBG
 574 /* Device console log buffer state */
 575 struct brcmf_console {
 576         uint count;             /* Poll interval msec counter */
 577         uint log_addr;          /* Log struct address (fixed) */
 578         struct rte_log log;     /* Log struct (host copy) */
 579         uint bufsize;           /* Size of log buffer */
 580         u8 *buf;                /* Log buffer (host copy) */
 581         uint last;              /* Last buffer read index */
 582 };
 583 #endif                          /* BCMDBG */
 584
 585 struct sdpcm_shared {
 586         u32 flags;
 587         u32 trap_addr;
 588         u32 assert_exp_addr;
 589         u32 assert_file_addr;
 590         u32 assert_line;
 591         u32 console_addr;       /* Address of struct rte_console */
 592         u32 msgtrace_addr;
 593         u8 tag[32];
 594 };
 595
 596
 597 /* misc chip info needed by some of the routines */
 598 struct chip_info {
 599         u32 chip;
 600         u32 chiprev;
 601         u32 cccorebase;
 602         u32 ccrev;
 603         u32 cccaps;
 604         u32 buscorebase; /* 32 bits backplane bus address */
 605         u32 buscorerev;
 606         u32 buscoretype;
 607         u32 ramcorebase;
 608         u32 armcorebase;
 609         u32 pmurev;
 610         u32 ramsize;
 611 };
 612
 613 /* Private data for SDIO bus interaction */
 614 struct brcmf_bus {
 615         struct brcmf_pub *drvr;
 616
 617         struct brcmf_sdio_card *card;   /* Handle for sdio card calls */
 618         struct chip_info *ci;   /* Chip info struct */
 619         char *vars;             /* Variables (from CIS and/or other) */
 620         uint varsz;             /* Size of variables buffer */
 621
 622         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 623         u32 orig_ramsize;       /* Size of RAM in SOCRAM (bytes) */
 624
 625         u32 bus;                /* gSPI or SDIO bus */
 626         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 627         u32 intstatus;  /* Intstatus bits (events) pending */
 628         bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
 629         bool fcstate;           /* State of dongle flow-control */
 630
 631         u16 cl_devid;   /* cached devid for brcmf_sdio_probe_attach() */
 632
 633         uint blocksize;         /* Block size of SDIO transfers */
 634         uint roundup;           /* Max roundup limit */
 635
 636         struct pktq txq;        /* Queue length used for flow-control */
 637         u8 flowcontrol; /* per prio flow control bitmask */
 638         u8 tx_seq;              /* Transmit sequence number (next) */
 639         u8 tx_max;              /* Maximum transmit sequence allowed */
 640
 641         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 642         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 643         u16 nextlen;            /* Next Read Len from last header */
 644         u8 rx_seq;              /* Receive sequence number (expected) */
 645         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 646
 647         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 648         struct sk_buff *glom;   /* Packet chain for glommed superframe */
 649         uint glomerr;           /* Glom packet read errors */
 650
 651         u8 *rxbuf;              /* Buffer for receiving control packets */
 652         uint rxblen;            /* Allocated length of rxbuf */
 653         u8 *rxctl;              /* Aligned pointer into rxbuf */
 654         u8 *databuf;            /* Buffer for receiving big glom packet */
 655         u8 *dataptr;            /* Aligned pointer into databuf */
 656         uint rxlen;             /* Length of valid data in buffer */
 657
 658         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 659
 660         bool intr;              /* Use interrupts */
 661         bool poll;              /* Use polling */
 662         bool ipend;             /* Device interrupt is pending */
 663         bool intdis;            /* Interrupts disabled by isr */
 664         uint intrcount;         /* Count of device interrupt callbacks */
 665         uint lastintrs;         /* Count as of last watchdog timer */
 666         uint spurious;          /* Count of spurious interrupts */
 667         uint pollrate;          /* Ticks between device polls */
 668         uint polltick;          /* Tick counter */
 669         uint pollcnt;           /* Count of active polls */
 670
 671 #ifdef BCMDBG
 672         struct brcmf_console console;   /* Console output polling support */
 673         uint console_addr;      /* Console address from shared struct */
 674 #endif                          /* BCMDBG */
 675
 676         uint regfails;          /* Count of R_REG failures */
 677
 678         uint clkstate;          /* State of sd and backplane clock(s) */
 679         bool activity;          /* Activity flag for clock down */
 680         s32 idletime;           /* Control for activity timeout */
 681         s32 idlecount;  /* Activity timeout counter */
 682         s32 idleclock;  /* How to set bus driver when idle */
 683         s32 sd_rxchain;
 684         bool use_rxchain;       /* If brcmf should use PKT chains */
 685         bool sleeping;          /* Is SDIO bus sleeping? */
 686         bool rxflow_mode;       /* Rx flow control mode */
 687         bool rxflow;            /* Is rx flow control on */
 688         bool alp_only;          /* Don't use HT clock (ALP only) */
 689 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
 690         bool usebufpool;
 691
 692 #ifdef SDTEST
 693         /* external loopback */
 694         bool ext_loop;
 695         u8 loopid;
 696
 697         /* pktgen configuration */
 698         uint pktgen_freq;       /* Ticks between bursts */
 699         uint pktgen_count;      /* Packets to send each burst */
 700         uint pktgen_print;      /* Bursts between count displays */
 701         uint pktgen_total;      /* Stop after this many */
 702         uint pktgen_minlen;     /* Minimum packet data len */
 703         uint pktgen_maxlen;     /* Maximum packet data len */
 704         uint pktgen_mode;       /* Configured mode: tx, rx, or echo */
 705         uint pktgen_stop;       /* Number of tx failures causing stop */
 706
 707         /* active pktgen fields */
 708         uint pktgen_tick;       /* Tick counter for bursts */
 709         uint pktgen_ptick;      /* Burst counter for printing */
 710         uint pktgen_sent;       /* Number of test packets generated */
 711         uint pktgen_rcvd;       /* Number of test packets received */
 712         uint pktgen_fail;       /* Number of failed send attempts */
 713         u16 pktgen_len; /* Length of next packet to send */
 714 #endif                          /* SDTEST */
 715
 716         /* Some additional counters */
 717         uint tx_sderrs;         /* Count of tx attempts with sd errors */
 718         uint fcqueued;          /* Tx packets that got queued */
 719         uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 720         uint rx_toolong;        /* Receive frames too long to receive */
 721         uint rxc_errors;        /* SDIO errors when reading control frames */
 722         uint rx_hdrfail;        /* SDIO errors on header reads */
 723         uint rx_badhdr;         /* Bad received headers (roosync?) */
 724         uint rx_badseq;         /* Mismatched rx sequence number */
 725         uint fc_rcvd;           /* Number of flow-control events received */
 726         uint fc_xoff;           /* Number which turned on flow-control */
 727         uint fc_xon;            /* Number which turned off flow-control */
 728         uint rxglomfail;        /* Failed deglom attempts */
 729         uint rxglomframes;      /* Number of glom frames (superframes) */
 730         uint rxglompkts;        /* Number of packets from glom frames */
 731         uint f2rxhdrs;          /* Number of header reads */
 732         uint f2rxdata;          /* Number of frame data reads */
 733         uint f2txdata;          /* Number of f2 frame writes */
 734         uint f1regdata;         /* Number of f1 register accesses */
 735
 736         u8 *ctrl_frame_buf;
 737         u32 ctrl_frame_len;
 738         bool ctrl_frame_stat;
 739
 740         spinlock_t txqlock;
 741         wait_queue_head_t ctrl_wait;
 742
 743         struct timer_list timer;
 744         struct completion watchdog_wait;
 745         struct task_struct *watchdog_tsk;
 746         bool wd_timer_valid;
 747
 748         struct tasklet_struct tasklet;
 749         struct task_struct *dpc_tsk;
 750         struct completion dpc_wait;
 751
 752         bool threads_only;
 753         struct semaphore sdsem;
 754         spinlock_t sdlock;
 755
 756         const char *fw_name;
 757         const struct firmware *firmware;
 758         const char *nv_name;
 759         u32 fw_ptr;
 760 };
 761
 762 struct sbconfig {
 763         u32 PAD[2];
 764         u32 sbipsflag;  /* initiator port ocp slave flag */
 765         u32 PAD[3];
 766         u32 sbtpsflag;  /* target port ocp slave flag */
 767         u32 PAD[11];
 768         u32 sbtmerrloga;        /* (sonics >= 2.3) */
 769         u32 PAD;
 770         u32 sbtmerrlog; /* (sonics >= 2.3) */
 771         u32 PAD[3];
 772         u32 sbadmatch3; /* address match3 */
 773         u32 PAD;
 774         u32 sbadmatch2; /* address match2 */
 775         u32 PAD;
 776         u32 sbadmatch1; /* address match1 */
 777         u32 PAD[7];
 778         u32 sbimstate;  /* initiator agent state */
 779         u32 sbintvec;   /* interrupt mask */
 780         u32 sbtmstatelow;       /* target state */
 781         u32 sbtmstatehigh;      /* target state */
 782         u32 sbbwa0;             /* bandwidth allocation table0 */
 783         u32 PAD;
 784         u32 sbimconfiglow;      /* initiator configuration */
 785         u32 sbimconfighigh;     /* initiator configuration */
 786         u32 sbadmatch0; /* address match0 */
 787         u32 PAD;
 788         u32 sbtmconfiglow;      /* target configuration */
 789         u32 sbtmconfighigh;     /* target configuration */
 790         u32 sbbconfig;  /* broadcast configuration */
 791         u32 PAD;
 792         u32 sbbstate;   /* broadcast state */
 793         u32 PAD[3];
 794         u32 sbactcnfg;  /* activate configuration */
 795         u32 PAD[3];
 796         u32 sbflagst;   /* current sbflags */
 797         u32 PAD[3];
 798         u32 sbidlow;            /* identification */
 799         u32 sbidhigh;   /* identification */
 800 };
 801
 802 /* clkstate */
 803 #define CLK_NONE        0
 804 #define CLK_SDONLY      1
 805 #define CLK_PENDING     2       /* Not used yet */
 806 #define CLK_AVAIL       3
 807
 808 #define BRCMF_NOPMU(brcmf)      (false)
 809
 810 #ifdef BCMDBG
 811 static int qcount[NUMPRIO];
 812 static int tx_packets[NUMPRIO];
 813 #endif                          /* BCMDBG */
 814
 815 /* Deferred transmit */
 816 uint brcmf_deferred_tx = 1;
 817 module_param(brcmf_deferred_tx, uint, 0);
 818
 819 /* Watchdog thread priority, -1 to use kernel timer */
 820 int brcmf_watchdog_prio = 97;
 821 module_param(brcmf_watchdog_prio, int, 0);
 822
 823 /* Watchdog interval */
 824 uint brcmf_watchdog_ms = 10;
 825 module_param(brcmf_watchdog_ms, uint, 0);
 826
 827 /* DPC thread priority, -1 to use tasklet */
 828 int brcmf_dpc_prio = 98;
 829 module_param(brcmf_dpc_prio, int, 0);
 830
 831 #ifdef BCMDBG
 832 /* Console poll interval */
 833 uint brcmf_console_ms;
 834 module_param(brcmf_console_ms, uint, 0);
 835 #endif          /* BCMDBG */
 836
 837 /* Tx/Rx bounds */
 838 uint brcmf_txbound;
 839 uint brcmf_rxbound;
 840 uint brcmf_txminmax;
 841
 842 /* override the RAM size if possible */
 843 #define DONGLE_MIN_MEMSIZE (128 * 1024)
 844 int brcmf_dongle_memsize;
 845
 846 static bool brcmf_alignctl;
 847
 848 static bool sd1idle;
 849
 850 static bool retrydata;
 851 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
 852
 853 static const uint watermark = 8;
 854 static const uint firstread = BRCMF_FIRSTREAD;
 855
 856 /* Retry count for register access failures */
 857 static const uint retry_limit = 2;
 858
 859 /* Force even SD lengths (some host controllers mess up on odd bytes) */
 860 static bool forcealign;
 861
 862 #define ALIGNMENT  4
 863
 864 #define PKTALIGN(_p, _len, _align)                              \
 865         do {                                                            \
 866                 uint datalign;                                          \
 867                 datalign = (unsigned long)((_p)->data);                 \
 868                 datalign = roundup(datalign, (_align)) - datalign;      \
 869                 if (datalign)                                           \
 870                         skb_pull((_p), datalign);                       \
 871                 __skb_trim((_p), (_len));                               \
 872         } while (0)
 873
 874 /* Limit on rounding up frames */
 875 static const uint max_roundup = 512;
 876
 877 /* Try doing readahead */
 878 static bool brcmf_readahead;
 879
 880 /* To check if there's window offered */
 881 #define DATAOK(bus) \
 882         (((u8)(bus->tx_max - bus->tx_seq) != 0) && \
 883         (((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
 884
 885 /*
 886  * Reads a register in the SDIO hardware block. This block occupies a series of
 887  * adresses on the 32 bit backplane bus.
 888  */
 889 static void
 890 r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
 891 {
 892         *retryvar = 0;
 893         do {
 894                 *regvar = R_REG(bus->ci->buscorebase + reg_offset, u32);
 895         } while (brcmf_sdcard_regfail(bus->card) &&
 896                  (++(*retryvar) <= retry_limit));
 897         if (*retryvar) {
 898                 bus->regfails += (*retryvar-1);
 899                 if (*retryvar > retry_limit) {
 900                         BRCMF_ERROR(("FAILED READ %Xh\n", reg_offset));
 901                         *regvar = 0;
 902                 }
 903         }
 904 }
 905
 906 static void
 907 w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
 908 {
 909         *retryvar = 0;
 910         do {
 911                 brcmf_sdcard_reg_write(NULL, bus->ci->buscorebase + reg_offset,
 912                                        sizeof(u32), regval);
 913         } while (brcmf_sdcard_regfail(bus->card) &&
 914                  (++(*retryvar) <= retry_limit));
 915         if (*retryvar) {
 916                 bus->regfails += (*retryvar-1);
 917                 if (*retryvar > retry_limit)
 918                         BRCMF_ERROR(("FAILED REGISTER WRITE"
 919                                      " %Xh\n", reg_offset));
 920         }
 921 }
 922
 923 #define BRCMF_BUS                       SDIO_BUS
 924
 925 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 926
 927 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 928
 929 #ifdef SDTEST
 930 static void brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, void *pkt, uint seq);
 931 static void brcmf_sdbrcm_sdtest_set(struct brcmf_bus *bus, bool start);
 932 #endif
 933
 934 #ifdef BCMDBG
 935 static int brcmf_sdbrcm_bus_console_in(struct brcmf_pub *drvr,
 936                                        unsigned char *msg, uint msglen);
 937 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size);
 938 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus);
 939 #endif                          /* BCMDBG  */
 940 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter);
 941
 942 static void brcmf_sdbrcm_release(struct brcmf_bus *bus);
 943 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus);
 944 static void brcmf_sdbrcm_disconnect(void *ptr);
 945 static bool brcmf_sdbrcm_chipmatch(u16 chipid);
 946 static bool brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, void *card,
 947                                       u32 regsva, u16 devid);
 948 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus, void *card);
 949 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus, void *card);
 950 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus);
 951
 952 static uint brcmf_process_nvram_vars(char *varbuf, uint len);
 953
 954 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size);
 955 static int brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn,
 956                                uint flags, u8 *buf, uint nbytes,
 957                                struct sk_buff *pkt,
 958                                void (*complete)(void *handle, int status,
 959                                                       bool sync_waiting),
 960                                void *handle);
 961
 962 static bool brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus, void *card);
 963 static int  _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus);
 964
 965 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus);
 966 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus);
 967
 968 static void
 969 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_card *card, u32 corebase);
 970
 971 static int brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs);
 972
 973 static void
 974 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_card *card, u32 corebase);
 975
 976 static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
 977                                         u32 drivestrength);
 978 static void brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus);
 979 static void brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar);
 980 static void brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus);
 981 static void brcmf_sdbrcm_watchdog(unsigned long data);
 982 static int brcmf_sdbrcm_watchdog_thread(void *data);
 983 static int brcmf_sdbrcm_dpc_thread(void *data);
 984 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data);
 985 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus);
 986 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus);
 987 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus);
 988 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus);
 989
 990 /* Packet free applicable unconditionally for sdio and sdspi.
 991  * Conditional if bufpool was present for gspi bus.
 992  */
 993 static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
 994 {
 995         if ((bus->bus != SPI_BUS) || bus->usebufpool)
 996                 brcmu_pkt_buf_free_skb(pkt);
 997 }
 998
 999 static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size)
1000 {
1001         s32 min_size = DONGLE_MIN_MEMSIZE;
1002         /* Restrict the memsize to user specified limit */
1003         BRCMF_ERROR(("user: Restrict the dongle ram size to %d, min %d\n",
1004                      brcmf_dongle_memsize, min_size));
1005         if ((brcmf_dongle_memsize > min_size) &&
1006             (brcmf_dongle_memsize < (s32) bus->orig_ramsize))
1007                 bus->ramsize = brcmf_dongle_memsize;
1008 }
1009
1010 static int brcmf_sdbrcm_set_siaddr_window(struct brcmf_bus *bus, u32 address)
1011 {
1012         int err = 0;
1013         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
1014                          (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
1015         if (!err)
1016                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
1017                                  SBSDIO_FUNC1_SBADDRMID,
1018                                  (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
1019         if (!err)
1020                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
1021                                        SBSDIO_FUNC1_SBADDRHIGH,
1022                                        (address >> 24) & SBSDIO_SBADDRHIGH_MASK,
1023                                        &err);
1024         return err;
1025 }
1026
1027 /* Turn backplane clock on or off */
1028 static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
1029 {
1030         int err;
1031         u8 clkctl, clkreq, devctl;
1032         struct brcmf_sdio_card *card;
1033
1034         BRCMF_TRACE(("%s: Enter\n", __func__));
1035
1036         clkctl = 0;
1037         card = bus->card;
1038
1039         if (on) {
1040                 /* Request HT Avail */
1041                 clkreq =
1042                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
1043
1044                 if ((bus->ci->chip == BCM4329_CHIP_ID)
1045                     && (bus->ci->chiprev == 0))
1046                         clkreq |= SBSDIO_FORCE_ALP;
1047
1048                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1049                                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
1050                 if (err) {
1051                         BRCMF_ERROR(("%s: HT Avail request error: %d\n",
1052                                      __func__, err));
1053                         return -EBADE;
1054                 }
1055
1056                 if (pendok && ((bus->ci->buscoretype == PCMCIA_CORE_ID)
1057                                && (bus->ci->buscorerev == 9))) {
1058                         u32 dummy, retries;
1059                         r_sdreg32(bus, &dummy,
1060                                   offsetof(struct sdpcmd_regs, clockctlstatus),
1061                                   &retries);
1062                 }
1063
1064                 /* Check current status */
1065                 clkctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1066                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
1067                 if (err) {
1068                         BRCMF_ERROR(("%s: HT Avail read error: %d\n",
1069                                      __func__, err));
1070                         return -EBADE;
1071                 }
1072
1073                 /* Go to pending and await interrupt if appropriate */
1074                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
1075                         /* Allow only clock-available interrupt */
1076                         devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1077                                         SBSDIO_DEVICE_CTL, &err);
1078                         if (err) {
1079                                 BRCMF_ERROR(("%s: Devctl error setting CA:"
1080                                              " %d\n", __func__, err));
1081                                 return -EBADE;
1082                         }
1083
1084                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
1085                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1086                                                SBSDIO_DEVICE_CTL, devctl, &err);
1087                         BRCMF_INFO(("CLKCTL: set PENDING\n"));
1088                         bus->clkstate = CLK_PENDING;
1089
1090                         return 0;
1091                 } else if (bus->clkstate == CLK_PENDING) {
1092                         /* Cancel CA-only interrupt filter */
1093                         devctl =
1094                             brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1095                                                   SBSDIO_DEVICE_CTL, &err);
1096                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
1097                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1098                                 SBSDIO_DEVICE_CTL, devctl, &err);
1099                 }
1100
1101                 /* Otherwise, wait here (polling) for HT Avail */
1102                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
1103                         BRCMF_SPINWAIT_SLEEP(sdioh_spinwait_sleep,
1104                                ((clkctl =
1105                                  brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1106                                          SBSDIO_FUNC1_CHIPCLKCSR,
1107                                                  &err)),
1108                                 !SBSDIO_CLKAV(clkctl, bus->alp_only)),
1109                                PMU_MAX_TRANSITION_DLY);
1110                 }
1111                 if (err) {
1112                         BRCMF_ERROR(("%s: HT Avail request error: %d\n",
1113                                      __func__, err));
1114                         return -EBADE;
1115                 }
1116                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
1117                         BRCMF_ERROR(("%s: HT Avail timeout (%d): "
1118                                      "clkctl 0x%02x\n", __func__,
1119                                      PMU_MAX_TRANSITION_DLY, clkctl));
1120                         return -EBADE;
1121                 }
1122
1123                 /* Mark clock available */
1124                 bus->clkstate = CLK_AVAIL;
1125                 BRCMF_INFO(("CLKCTL: turned ON\n"));
1126
1127 #if defined(BCMDBG)
1128                 if (bus->alp_only != true) {
1129                         if (SBSDIO_ALPONLY(clkctl)) {
1130                                 BRCMF_ERROR(("%s: HT Clock should be on.\n",
1131                                              __func__));
1132                         }
1133                 }
1134 #endif                          /* defined (BCMDBG) */
1135
1136                 bus->activity = true;
1137         } else {
1138                 clkreq = 0;
1139
1140                 if (bus->clkstate == CLK_PENDING) {
1141                         /* Cancel CA-only interrupt filter */
1142                         devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1143                                         SBSDIO_DEVICE_CTL, &err);
1144                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
1145                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1146                                 SBSDIO_DEVICE_CTL, devctl, &err);
1147                 }
1148
1149                 bus->clkstate = CLK_SDONLY;
1150                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1151                         SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
1152                 BRCMF_INFO(("CLKCTL: turned OFF\n"));
1153                 if (err) {
1154                         BRCMF_ERROR(("%s: Failed access turning clock off:"
1155                                      " %d\n", __func__, err));
1156                         return -EBADE;
1157                 }
1158         }
1159         return 0;
1160 }
1161
1162 /* Change idle/active SD state */
1163 static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
1164 {
1165         BRCMF_TRACE(("%s: Enter\n", __func__));
1166
1167         if (on)
1168                 bus->clkstate = CLK_SDONLY;
1169         else
1170                 bus->clkstate = CLK_NONE;
1171
1172         return 0;
1173 }
1174
1175 /* Transition SD and backplane clock readiness */
1176 static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
1177 {
1178 #ifdef BCMDBG
1179         uint oldstate = bus->clkstate;
1180 #endif                          /* BCMDBG */
1181
1182         BRCMF_TRACE(("%s: Enter\n", __func__));
1183
1184         /* Early exit if we're already there */
1185         if (bus->clkstate == target) {
1186                 if (target == CLK_AVAIL) {
1187                         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1188                         bus->activity = true;
1189                 }
1190                 return 0;
1191         }
1192
1193         switch (target) {
1194         case CLK_AVAIL:
1195                 /* Make sure SD clock is available */
1196                 if (bus->clkstate == CLK_NONE)
1197                         brcmf_sdbrcm_sdclk(bus, true);
1198                 /* Now request HT Avail on the backplane */
1199                 brcmf_sdbrcm_htclk(bus, true, pendok);
1200                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1201                 bus->activity = true;
1202                 break;
1203
1204         case CLK_SDONLY:
1205                 /* Remove HT request, or bring up SD clock */
1206                 if (bus->clkstate == CLK_NONE)
1207                         brcmf_sdbrcm_sdclk(bus, true);
1208                 else if (bus->clkstate == CLK_AVAIL)
1209                         brcmf_sdbrcm_htclk(bus, false, false);
1210                 else
1211                         BRCMF_ERROR(("brcmf_sdbrcm_clkctl: request for %d -> %d"
1212                                      "\n", bus->clkstate, target));
1213                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
1214                 break;
1215
1216         case CLK_NONE:
1217                 /* Make sure to remove HT request */
1218                 if (bus->clkstate == CLK_AVAIL)
1219                         brcmf_sdbrcm_htclk(bus, false, false);
1220                 /* Now remove the SD clock */
1221                 brcmf_sdbrcm_sdclk(bus, false);
1222                 brcmf_sdbrcm_wd_timer(bus, 0);
1223                 break;
1224         }
1225 #ifdef BCMDBG
1226         BRCMF_INFO(("brcmf_sdbrcm_clkctl: %d -> %d\n",
1227                     oldstate, bus->clkstate));
1228 #endif                          /* BCMDBG */
1229
1230         return 0;
1231 }
1232
1233 int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
1234 {
1235         struct brcmf_sdio_card *card = bus->card;
1236         uint retries = 0;
1237
1238         BRCMF_INFO(("brcmf_sdbrcm_bussleep: request %s (currently %s)\n",
1239                     (sleep ? "SLEEP" : "WAKE"),
1240                     (bus->sleeping ? "SLEEP" : "WAKE")));
1241
1242         /* Done if we're already in the requested state */
1243         if (sleep == bus->sleeping)
1244                 return 0;
1245
1246         /* Going to sleep: set the alarm and turn off the lights... */
1247         if (sleep) {
1248                 /* Don't sleep if something is pending */
1249                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
1250                         return -EBUSY;
1251
1252                 /* Disable SDIO interrupts (no longer interested) */
1253                 brcmf_sdcard_intr_disable(bus->card);
1254
1255                 /* Make sure the controller has the bus up */
1256                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1257
1258                 /* Tell device to start using OOB wakeup */
1259                 w_sdreg32(bus, SMB_USE_OOB,
1260                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1261                 if (retries > retry_limit)
1262                         BRCMF_ERROR(("CANNOT SIGNAL CHIP, "
1263                                      "WILL NOT WAKE UP!!\n"));
1264
1265                 /* Turn off our contribution to the HT clock request */
1266                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1267
1268                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1269                         SBSDIO_FUNC1_CHIPCLKCSR,
1270                         SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
1271
1272                 /* Isolate the bus */
1273                 if (bus->ci->chip != BCM4329_CHIP_ID
1274                     && bus->ci->chip != BCM4319_CHIP_ID) {
1275                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1276                                 SBSDIO_DEVICE_CTL,
1277                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
1278                 }
1279
1280                 /* Change state */
1281                 bus->sleeping = true;
1282
1283         } else {
1284                 /* Waking up: bus power up is ok, set local state */
1285
1286                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1287                         SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
1288
1289                 /* Force pad isolation off if possible
1290                          (in case power never toggled) */
1291                 if ((bus->ci->buscoretype == PCMCIA_CORE_ID)
1292                     && (bus->ci->buscorerev >= 10))
1293                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1294                                 SBSDIO_DEVICE_CTL, 0, NULL);
1295
1296                 /* Make sure the controller has the bus up */
1297                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1298
1299                 /* Send misc interrupt to indicate OOB not needed */
1300                 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
1301                           &retries);
1302                 if (retries <= retry_limit)
1303                         w_sdreg32(bus, SMB_DEV_INT,
1304                                   offsetof(struct sdpcmd_regs, tosbmailbox),
1305                                   &retries);
1306
1307                 if (retries > retry_limit)
1308                         BRCMF_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
1309
1310                 /* Make sure we have SD bus access */
1311                 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
1312
1313                 /* Change state */
1314                 bus->sleeping = false;
1315
1316                 /* Enable interrupts again */
1317                 if (bus->intr && (bus->drvr->busstate == BRCMF_BUS_DATA)) {
1318                         bus->intdis = false;
1319                         brcmf_sdcard_intr_enable(bus->card);
1320                 }
1321         }
1322
1323         return 0;
1324 }
1325
1326 #define BUS_WAKE(bus) \
1327         do { \
1328                 if ((bus)->sleeping) \
1329                         brcmf_sdbrcm_bussleep((bus), false); \
1330         } while (0);
1331
1332 /* Writes a HW/SW header into the packet and sends it. */
1333 /* Assumes: (a) header space already there, (b) caller holds lock */
1334 static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt, uint chan,
1335                          bool free_pkt)
1336 {
1337         int ret;
1338         u8 *frame;
1339         u16 len, pad = 0;
1340         u32 swheader;
1341         uint retries = 0;
1342         struct brcmf_sdio_card *card;
1343         struct sk_buff *new;
1344         int i;
1345
1346         BRCMF_TRACE(("%s: Enter\n", __func__));
1347
1348         card = bus->card;
1349
1350         if (bus->drvr->dongle_reset) {
1351                 ret = -EPERM;
1352                 goto done;
1353         }
1354
1355         frame = (u8 *) (pkt->data);
1356
1357         /* Add alignment padding, allocate new packet if needed */
1358         pad = ((unsigned long)frame % BRCMF_SDALIGN);
1359         if (pad) {
1360                 if (skb_headroom(pkt) < pad) {
1361                         BRCMF_INFO(("%s: insufficient headroom %d for %d pad\n",
1362                                     __func__, skb_headroom(pkt), pad));
1363                         bus->drvr->tx_realloc++;
1364                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
1365                         if (!new) {
1366                                 BRCMF_ERROR(("%s: couldn't allocate new "
1367                                              "%d-byte packet\n", __func__,
1368                                              pkt->len + BRCMF_SDALIGN));
1369                                 ret = -ENOMEM;
1370                                 goto done;
1371                         }
1372
1373                         PKTALIGN(new, pkt->len, BRCMF_SDALIGN);
1374                         memcpy(new->data, pkt->data, pkt->len);
1375                         if (free_pkt)
1376                                 brcmu_pkt_buf_free_skb(pkt);
1377                         /* free the pkt if canned one is not used */
1378                         free_pkt = true;
1379                         pkt = new;
1380                         frame = (u8 *) (pkt->data);
1381                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
1382                         pad = 0;
1383                 } else {
1384                         skb_push(pkt, pad);
1385                         frame = (u8 *) (pkt->data);
1386                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
1387                         memset(frame, 0, pad + SDPCM_HDRLEN);
1388                 }
1389         }
1390         /* precondition: pad < BRCMF_SDALIGN */
1391
1392         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1393         len = (u16) (pkt->len);
1394         *(u16 *) frame = cpu_to_le16(len);
1395         *(((u16 *) frame) + 1) = cpu_to_le16(~len);
1396
1397         /* Software tag: channel, sequence number, data offset */
1398         swheader =
1399             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1400             (((pad +
1401                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1402
1403         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1404         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1405
1406 #ifdef BCMDBG
1407         tx_packets[pkt->priority]++;
1408         if (BRCMF_BYTES_ON() &&
1409             (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
1410               (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
1411                 printk(KERN_DEBUG "Tx Frame:\n");
1412                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
1413         } else if (BRCMF_HDRS_ON()) {
1414                 printk(KERN_DEBUG "TxHdr:\n");
1415                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1416                                      frame, min_t(u16, len, 16));
1417         }
1418 #endif
1419
1420         /* Raise len to next SDIO block to eliminate tail command */
1421         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1422                 u16 pad = bus->blocksize - (len % bus->blocksize);
1423                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1424                                 len += pad;
1425         } else if (len % BRCMF_SDALIGN) {
1426                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1427         }
1428
1429         /* Some controllers have trouble with odd bytes -- round to even */
1430         if (forcealign && (len & (ALIGNMENT - 1))) {
1431                         len = roundup(len, ALIGNMENT);
1432         }
1433
1434         do {
1435                 ret = brcmf_sdbrcm_send_buf(bus, brcmf_sdcard_cur_sbwad(card),
1436                         SDIO_FUNC_2, F2SYNC, frame, len, pkt, NULL, NULL);
1437                 bus->f2txdata++;
1438
1439                 if (ret < 0) {
1440                         /* On failure, abort the command
1441                          and terminate the frame */
1442                         BRCMF_INFO(("%s: sdio error %d, abort command and "
1443                                     "terminate frame.\n", __func__, ret));
1444                         bus->tx_sderrs++;
1445
1446                         brcmf_sdcard_abort(card, SDIO_FUNC_2);
1447                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1448                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
1449                                          NULL);
1450                         bus->f1regdata++;
1451
1452                         for (i = 0; i < 3; i++) {
1453                                 u8 hi, lo;
1454                                 hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1455                                                      SBSDIO_FUNC1_WFRAMEBCHI,
1456                                                      NULL);
1457                                 lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
1458                                                      SBSDIO_FUNC1_WFRAMEBCLO,
1459                                                      NULL);
1460                                 bus->f1regdata += 2;
1461                                 if ((hi == 0) && (lo == 0))
1462                                         break;
1463                         }
1464
1465                 }
1466                 if (ret == 0)
1467                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1468
1469         } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
1470
1471 done:
1472         /* restore pkt buffer pointer before calling tx complete routine */
1473         skb_pull(pkt, SDPCM_HDRLEN + pad);
1474         brcmf_sdbrcm_sdunlock(bus);
1475         brcmf_txcomplete(bus->drvr, pkt, ret != 0);
1476         brcmf_sdbrcm_sdlock(bus);
1477
1478         if (free_pkt)
1479                 brcmu_pkt_buf_free_skb(pkt);
1480
1481         return ret;
1482 }
1483
1484 int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
1485 {
1486         int ret = -EBADE;
1487         uint datalen, prec;
1488
1489         BRCMF_TRACE(("%s: Enter\n", __func__));
1490
1491         datalen = pkt->len;
1492
1493 #ifdef SDTEST
1494         /* Push the test header if doing loopback */
1495         if (bus->ext_loop) {
1496                 u8 *data;
1497                 skb_push(pkt, SDPCM_TEST_HDRLEN);
1498                 data = pkt->data;
1499                 *data++ = SDPCM_TEST_ECHOREQ;
1500                 *data++ = (u8) bus->loopid++;
1501                 *data++ = (datalen >> 0);
1502                 *data++ = (datalen >> 8);
1503                 datalen += SDPCM_TEST_HDRLEN;
1504         }
1505 #endif                          /* SDTEST */
1506
1507         /* Add space for the header */
1508         skb_push(pkt, SDPCM_HDRLEN);
1509         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
1510
1511         prec = PRIO2PREC((pkt->priority & PRIOMASK));
1512
1513         /* Check for existing queue, current flow-control,
1514                          pending event, or pending clock */
1515         if (brcmf_deferred_tx || bus->fcstate || pktq_len(&bus->txq)
1516             || bus->dpc_sched || (!DATAOK(bus))
1517             || (bus->flowcontrol & NBITVAL(prec))
1518             || (bus->clkstate != CLK_AVAIL)) {
1519                 BRCMF_TRACE(("%s: deferring pktq len %d\n", __func__,
1520                              pktq_len(&bus->txq)));
1521                 bus->fcqueued++;
1522
1523                 /* Priority based enq */
1524                 spin_lock_bh(&bus->txqlock);
1525                 if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) == false) {
1526                         skb_pull(pkt, SDPCM_HDRLEN);
1527                         brcmf_txcomplete(bus->drvr, pkt, false);
1528                         brcmu_pkt_buf_free_skb(pkt);
1529                         BRCMF_ERROR(("%s: out of bus->txq !!!\n", __func__));
1530                         ret = -ENOSR;
1531                 } else {
1532                         ret = 0;
1533                 }
1534                 spin_unlock_bh(&bus->txqlock);
1535
1536                 if (pktq_len(&bus->txq) >= TXHI)
1537                         brcmf_txflowcontrol(bus->drvr, 0, ON);
1538
1539 #ifdef BCMDBG
1540                 if (pktq_plen(&bus->txq, prec) > qcount[prec])
1541                         qcount[prec] = pktq_plen(&bus->txq, prec);
1542 #endif
1543                 /* Schedule DPC if needed to send queued packet(s) */
1544                 if (brcmf_deferred_tx && !bus->dpc_sched) {
1545                         bus->dpc_sched = true;
1546                         brcmf_sdbrcm_sched_dpc(bus);
1547                 }
1548         } else {
1549                 /* Lock: we're about to use shared data/code (and SDIO) */
1550                 brcmf_sdbrcm_sdlock(bus);
1551
1552                 /* Otherwise, send it now */
1553                 BUS_WAKE(bus);
1554                 /* Make sure back plane ht clk is on, no pending allowed */
1555                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
1556
1557 #ifndef SDTEST
1558                 BRCMF_TRACE(("%s: calling txpkt\n", __func__));
1559                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1560 #else
1561                 ret = brcmf_sdbrcm_txpkt(bus, pkt,
1562                                     (bus->ext_loop ? SDPCM_TEST_CHANNEL :
1563                                      SDPCM_DATA_CHANNEL), true);
1564 #endif
1565                 if (ret)
1566                         bus->drvr->tx_errors++;
1567                 else
1568                         bus->drvr->dstats.tx_bytes += datalen;
1569
1570                 if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
1571                     !bus->dpc_sched) {
1572                         bus->activity = false;
1573                         brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
1574                 }
1575
1576                 brcmf_sdbrcm_sdunlock(bus);
1577         }
1578
1579         return ret;
1580 }
1581
1582 static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
1583 {
1584         struct sk_buff *pkt;
1585         u32 intstatus = 0;
1586         uint retries = 0;
1587         int ret = 0, prec_out;
1588         uint cnt = 0;
1589         uint datalen;
1590         u8 tx_prec_map;
1591
1592         struct brcmf_pub *drvr = bus->drvr;
1593
1594         BRCMF_TRACE(("%s: Enter\n", __func__));
1595
1596         tx_prec_map = ~bus->flowcontrol;
1597
1598         /* Send frames until the limit or some other event */
1599         for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
1600                 spin_lock_bh(&bus->txqlock);
1601                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
1602                 if (pkt == NULL) {
1603                         spin_unlock_bh(&bus->txqlock);
1604                         break;
1605                 }
1606                 spin_unlock_bh(&bus->txqlock);
1607                 datalen = pkt->len - SDPCM_HDRLEN;
1608
1609 #ifndef SDTEST
1610                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1611 #else
1612                 ret = brcmf_sdbrcm_txpkt(bus, pkt,
1613                                     (bus->ext_loop ? SDPCM_TEST_CHANNEL :
1614                                      SDPCM_DATA_CHANNEL), true);
1615 #endif
1616                 if (ret)
1617                         bus->drvr->tx_errors++;
1618                 else
1619                         bus->drvr->dstats.tx_bytes += datalen;
1620
1621                 /* In poll mode, need to check for other events */
1622                 if (!bus->intr && cnt) {
1623                         /* Check device status, signal pending interrupt */
1624                         r_sdreg32(bus, &intstatus,
1625                                   offsetof(struct sdpcmd_regs, intstatus),
1626                                   &retries);
1627                         bus->f2txdata++;
1628                         if (brcmf_sdcard_regfail(bus->card))
1629                                 break;
1630                         if (intstatus & bus->hostintmask)
1631                                 bus->ipend = true;
1632                 }
1633         }
1634
1635         /* Deflow-control stack if needed */
1636         if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
1637             drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
1638                 brcmf_txflowcontrol(drvr, 0, OFF);
1639
1640         return cnt;
1641 }
1642
1643 int
1644 brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
1645 {
1646         u8 *frame;
1647         u16 len;
1648         u32 swheader;
1649         uint retries = 0;
1650         struct brcmf_sdio_card *card = bus->card;
1651         u8 doff = 0;
1652         int ret = -1;
1653         int i;
1654
1655         BRCMF_TRACE(("%s: Enter\n", __func__));
1656
1657         if (bus->drvr->dongle_reset)
1658                 return -EIO;
1659
1660         /* Back the pointer to make a room for bus header */
1661         frame = msg - SDPCM_HDRLEN;
1662         len = (msglen += SDPCM_HDRLEN);
1663
1664         /* Add alignment padding (optional for ctl frames) */
1665         if (brcmf_alignctl) {
1666                 doff = ((unsigned long)frame % BRCMF_SDALIGN);
1667                 if (doff) {
1668                         frame -= doff;
1669                         len += doff;
1670                         msglen += doff;
1671                         memset(frame, 0, doff + SDPCM_HDRLEN);
1672                 }
1673                 /* precondition: doff < BRCMF_SDALIGN */
1674         }
1675         doff += SDPCM_HDRLEN;
1676
1677         /* Round send length to next SDIO block */
1678         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1679                 u16 pad = bus->blocksize - (len % bus->blocksize);
1680                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1681                         len += pad;
1682         } else if (len % BRCMF_SDALIGN) {
1683                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1684         }
1685
1686         /* Satisfy length-alignment requirements */
1687         if (forcealign && (len & (ALIGNMENT - 1)))
1688                 len = roundup(len, ALIGNMENT);
1689
1690         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
1691
1692         /* Need to lock here to protect txseq and SDIO tx calls */
1693         brcmf_sdbrcm_sdlock(bus);
1694
1695         BUS_WAKE(bus);
1696
1697         /* Make sure backplane clock is on */
1698         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1699
1700         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1701         *(u16 *) frame = cpu_to_le16((u16) msglen);
1702         *(((u16 *) frame) + 1) = cpu_to_le16(~msglen);
1703
1704         /* Software tag: channel, sequence number, data offset */
1705         swheader =
1706             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
1707              SDPCM_CHANNEL_MASK)
1708             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
1709                              SDPCM_DOFFSET_MASK);
1710         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1711         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1712
1713         if (!DATAOK(bus)) {
1714                 BRCMF_INFO(("%s: No bus credit bus->tx_max %d,"
1715                             " bus->tx_seq %d\n", __func__,
1716                             bus->tx_max, bus->tx_seq));
1717                 bus->ctrl_frame_stat = true;
1718                 /* Send from dpc */
1719                 bus->ctrl_frame_buf = frame;
1720                 bus->ctrl_frame_len = len;
1721
1722                 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
1723
1724                 if (bus->ctrl_frame_stat == false) {
1725                         BRCMF_INFO(("%s: ctrl_frame_stat == false\n",
1726                                     __func__));
1727                         ret = 0;
1728                 } else {
1729                         BRCMF_INFO(("%s: ctrl_frame_stat == true\n", __func__));
1730                         ret = -1;
1731                 }
1732         }
1733
1734         if (ret == -1) {
1735 #ifdef BCMDBG
1736                 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1737                         printk(KERN_DEBUG "Tx Frame:\n");
1738                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1739                                              frame, len);
1740                 } else if (BRCMF_HDRS_ON()) {
1741                         printk(KERN_DEBUG "TxHdr:\n");
1742                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1743                                              frame, min_t(u16, len, 16));
1744                 }
1745 #endif
1746
1747                 do {
1748                         bus->ctrl_frame_stat = false;
1749                         ret = brcmf_sdbrcm_send_buf(bus,
1750                                 brcmf_sdcard_cur_sbwad(card), SDIO_FUNC_2,
1751                                 F2SYNC, frame, len, NULL, NULL, NULL);
1752
1753                         if (ret < 0) {
1754                                 /* On failure, abort the command and
1755                                  terminate the frame */
1756                                 BRCMF_INFO(("%s: sdio error %d, abort command "
1757                                             "and terminate frame.\n",
1758                                             __func__, ret));
1759                                 bus->tx_sderrs++;
1760
1761                                 brcmf_sdcard_abort(card, SDIO_FUNC_2);
1762
1763                                 brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
1764                                                  SBSDIO_FUNC1_FRAMECTRL,
1765                                                  SFC_WF_TERM, NULL);
1766                                 bus->f1regdata++;
1767
1768                                 for (i = 0; i < 3; i++) {
1769                                         u8 hi, lo;
1770                                         hi = brcmf_sdcard_cfg_read(card,
1771                                              SDIO_FUNC_1,
1772                                              SBSDIO_FUNC1_WFRAMEBCHI,
1773                                              NULL);
1774                                         lo = brcmf_sdcard_cfg_read(card,
1775                                              SDIO_FUNC_1,
1776                                              SBSDIO_FUNC1_WFRAMEBCLO,
1777                                              NULL);
1778                                         bus->f1regdata += 2;
1779                                         if ((hi == 0) && (lo == 0))
1780                                                 break;
1781                                 }
1782
1783                         }
1784                         if (ret == 0) {
1785                                 bus->tx_seq =
1786                                     (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1787                         }
1788                 } while ((ret < 0) && retries++ < TXRETRIES);
1789         }
1790
1791         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1792                 bus->activity = false;
1793                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
1794         }
1795
1796         brcmf_sdbrcm_sdunlock(bus);
1797
1798         if (ret)
1799                 bus->drvr->tx_ctlerrs++;
1800         else
1801                 bus->drvr->tx_ctlpkts++;
1802
1803         return ret ? -EIO : 0;
1804 }
1805
1806 int brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
1807 {
1808         int timeleft;
1809         uint rxlen = 0;
1810         bool pending;
1811
1812         BRCMF_TRACE(("%s: Enter\n", __func__));
1813
1814         if (bus->drvr->dongle_reset)
1815                 return -EIO;
1816
1817         /* Wait until control frame is available */
1818         timeleft = brcmf_os_ioctl_resp_wait(bus->drvr, &bus->rxlen, &pending);
1819
1820         brcmf_sdbrcm_sdlock(bus);
1821         rxlen = bus->rxlen;
1822         memcpy(msg, bus->rxctl, min(msglen, rxlen));
1823         bus->rxlen = 0;
1824         brcmf_sdbrcm_sdunlock(bus);
1825
1826         if (rxlen) {
1827                 BRCMF_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
1828                            __func__, rxlen, msglen));
1829         } else if (timeleft == 0) {
1830                 BRCMF_ERROR(("%s: resumed on timeout\n", __func__));
1831 #ifdef BCMDBG
1832                 brcmf_sdbrcm_sdlock(bus);
1833                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
1834                 brcmf_sdbrcm_sdunlock(bus);
1835 #endif                          /* BCMDBG */
1836         } else if (pending == true) {
1837                 BRCMF_CTL(("%s: cancelled\n", __func__));
1838                 return -ERESTARTSYS;
1839         } else {
1840                 BRCMF_CTL(("%s: resumed for unknown reason?\n", __func__));
1841 #ifdef BCMDBG
1842                 brcmf_sdbrcm_sdlock(bus);
1843                 brcmf_sdbrcm_checkdied(bus, NULL, 0);
1844                 brcmf_sdbrcm_sdunlock(bus);
1845 #endif                          /* BCMDBG */
1846         }
1847
1848         if (rxlen)
1849                 bus->drvr->rx_ctlpkts++;
1850         else
1851                 bus->drvr->rx_ctlerrs++;
1852
1853         return rxlen ? (int)rxlen : -ETIMEDOUT;
1854 }
1855
1856 /* IOVar table */
1857 enum {
1858         IOV_INTR = 1,
1859         IOV_POLLRATE,
1860         IOV_SDREG,
1861         IOV_SBREG,
1862         IOV_SDCIS,
1863         IOV_MEMBYTES,
1864         IOV_MEMSIZE,
1865 #ifdef BCMDBG
1866         IOV_CHECKDIED,
1867         IOV_CONS,
1868         IOV_DCONSOLE_POLL,
1869 #endif
1870         IOV_DOWNLOAD,
1871         IOV_FORCEEVEN,
1872         IOV_SDIOD_DRIVE,
1873         IOV_READAHEAD,
1874         IOV_SDRXCHAIN,
1875         IOV_ALIGNCTL,
1876         IOV_SDALIGN,
1877         IOV_DEVRESET,
1878         IOV_CPU,
1879 #ifdef SDTEST
1880         IOV_PKTGEN,
1881         IOV_EXTLOOP,
1882 #endif                          /* SDTEST */
1883         IOV_SPROM,
1884         IOV_TXBOUND,
1885         IOV_RXBOUND,
1886         IOV_TXMINMAX,
1887         IOV_IDLETIME,
1888         IOV_IDLECLOCK,
1889         IOV_SD1IDLE,
1890         IOV_SLEEP,
1891         IOV_WDTICK,
1892         IOV_VARS
1893 };
1894
1895 const struct brcmu_iovar brcmf_sdio_iovars[] = {
1896         {"intr", IOV_INTR, 0, IOVT_BOOL, 0},
1897         {"sleep", IOV_SLEEP, 0, IOVT_BOOL, 0},
1898         {"pollrate", IOV_POLLRATE, 0, IOVT_UINT32, 0},
1899         {"idletime", IOV_IDLETIME, 0, IOVT_INT32, 0},
1900         {"idleclock", IOV_IDLECLOCK, 0, IOVT_INT32, 0},
1901         {"sd1idle", IOV_SD1IDLE, 0, IOVT_BOOL, 0},
1902         {"membytes", IOV_MEMBYTES, 0, IOVT_BUFFER, 2 * sizeof(int)},
1903         {"memsize", IOV_MEMSIZE, 0, IOVT_UINT32, 0},
1904         {"download", IOV_DOWNLOAD, 0, IOVT_BOOL, 0},
1905         {"vars", IOV_VARS, 0, IOVT_BUFFER, 0},
1906         {"sdiod_drive", IOV_SDIOD_DRIVE, 0, IOVT_UINT32, 0},
1907         {"readahead", IOV_READAHEAD, 0, IOVT_BOOL, 0},
1908         {"sdrxchain", IOV_SDRXCHAIN, 0, IOVT_BOOL, 0},
1909         {"alignctl", IOV_ALIGNCTL, 0, IOVT_BOOL, 0},
1910         {"sdalign", IOV_SDALIGN, 0, IOVT_BOOL, 0},
1911         {"devreset", IOV_DEVRESET, 0, IOVT_BOOL, 0},
1912         {"wdtick", IOV_WDTICK, 0, IOVT_UINT32, 0},
1913 #ifdef BCMDBG
1914         {"cons", IOV_CONS, 0, IOVT_BUFFER, 0}
1915         ,
1916         {"dconpoll", IOV_DCONSOLE_POLL, 0, IOVT_UINT32, 0}
1917         ,
1918         {"sdreg", IOV_SDREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
1919         ,
1920         {"sbreg", IOV_SBREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
1921         ,
1922         {"sd_cis", IOV_SDCIS, 0, IOVT_BUFFER, BRCMF_IOCTL_MAXLEN}
1923         ,
1924         {"forcealign", IOV_FORCEEVEN, 0, IOVT_BOOL, 0}
1925         ,
1926         {"txbound", IOV_TXBOUND, 0, IOVT_UINT32, 0}
1927         ,
1928         {"rxbound", IOV_RXBOUND, 0, IOVT_UINT32, 0}
1929         ,
1930         {"txminmax", IOV_TXMINMAX, 0, IOVT_UINT32, 0}
1931         ,
1932         {"cpu", IOV_CPU, 0, IOVT_BOOL, 0}
1933         ,
1934         {"checkdied", IOV_CHECKDIED, 0, IOVT_BUFFER, 0}
1935         ,
1936 #endif                          /* BCMDBG */
1937 #ifdef SDTEST
1938         {"extloop", IOV_EXTLOOP, 0, IOVT_BOOL, 0}
1939         ,
1940         {"pktgen", IOV_PKTGEN, 0, IOVT_BUFFER, sizeof(struct brcmf_pktgen)}
1941         ,
1942 #endif                          /* SDTEST */
1943
1944         {NULL, 0, 0, 0, 0}
1945 };
1946
1947 static void
1948 brcmf_dump_pct(struct brcmu_strbuf *strbuf, char *desc, uint num, uint div)
1949 {
1950         uint q1, q2;
1951
1952         if (!div) {
1953                 brcmu_bprintf(strbuf, "%s N/A", desc);
1954         } else {
1955                 q1 = num / div;
1956                 q2 = (100 * (num - (q1 * div))) / div;
1957                 brcmu_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
1958         }
1959 }
1960
1961 void brcmf_sdbrcm_bus_dump(struct brcmf_pub *drvr, struct brcmu_strbuf *strbuf)
1962 {
1963         struct brcmf_bus *bus = drvr->bus;
1964
1965         brcmu_bprintf(strbuf, "Bus SDIO structure:\n");
1966         brcmu_bprintf(strbuf,
1967                     "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
1968                     bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
1969         brcmu_bprintf(strbuf,
1970                     "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
1971                     bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max,
1972                     bus->rxskip, bus->rxlen, bus->rx_seq);
1973         brcmu_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
1974                     bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
1975         brcmu_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
1976                     bus->pollrate, bus->pollcnt, bus->regfails);
1977
1978         brcmu_bprintf(strbuf, "\nAdditional counters:\n");
1979         brcmu_bprintf(strbuf,
1980                     "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
1981                     bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
1982                     bus->rxc_errors);
1983         brcmu_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
1984                     bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
1985         brcmu_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
1986                       bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
1987         brcmu_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
1988                     bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
1989         brcmu_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs"
1990                       " %d\n",
1991                       (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs,
1992                       bus->f2rxdata, bus->f2txdata, bus->f1regdata);
1993         {
1994                 brcmf_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->drvr->rx_packets,
1995                              (bus->f2rxhdrs + bus->f2rxdata));
1996                 brcmf_dump_pct(strbuf, ", pkts/f1sd", bus->drvr->rx_packets,
1997                              bus->f1regdata);
1998                 brcmf_dump_pct(strbuf, ", pkts/sd", bus->drvr->rx_packets,
1999                              (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
2000                 brcmf_dump_pct(strbuf, ", pkts/int", bus->drvr->rx_packets,
2001                              bus->intrcount);
2002                 brcmu_bprintf(strbuf, "\n");
2003
2004                 brcmf_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
2005                              bus->drvr->rx_packets);
2006                 brcmf_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts,
2007                              bus->rxglomframes);
2008                 brcmu_bprintf(strbuf, "\n");
2009
2010                 brcmf_dump_pct(strbuf, "Tx: pkts/f2wr", bus->drvr->tx_packets,
2011                              bus->f2txdata);
2012                 brcmf_dump_pct(strbuf, ", pkts/f1sd", bus->drvr->tx_packets,
2013                              bus->f1regdata);
2014                 brcmf_dump_pct(strbuf, ", pkts/sd", bus->drvr->tx_packets,
2015                              (bus->f2txdata + bus->f1regdata));
2016                 brcmf_dump_pct(strbuf, ", pkts/int", bus->drvr->tx_packets,
2017                              bus->intrcount);
2018                 brcmu_bprintf(strbuf, "\n");
2019
2020                 brcmf_dump_pct(strbuf, "Total: pkts/f2rw",
2021                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
2022                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
2023                 brcmf_dump_pct(strbuf, ", pkts/f1sd",
2024                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
2025                              bus->f1regdata);
2026                 brcmf_dump_pct(strbuf, ", pkts/sd",
2027                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
2028                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata +
2029                               bus->f1regdata));
2030                 brcmf_dump_pct(strbuf, ", pkts/int",
2031                              (bus->drvr->tx_packets + bus->drvr->rx_packets),
2032                              bus->intrcount);
2033                 brcmu_bprintf(strbuf, "\n\n");
2034         }
2035
2036 #ifdef SDTEST
2037         if (bus->pktgen_count) {
2038                 brcmu_bprintf(strbuf, "pktgen config and count:\n");
2039                 brcmu_bprintf(strbuf,
2040                             "freq %d count %d print %d total %d min %d len %d\n",
2041                             bus->pktgen_freq, bus->pktgen_count,
2042                             bus->pktgen_print, bus->pktgen_total,
2043                             bus->pktgen_minlen, bus->pktgen_maxlen);
2044                 brcmu_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
2045                             bus->pktgen_sent, bus->pktgen_rcvd,
2046                             bus->pktgen_fail);
2047         }
2048 #endif                          /* SDTEST */
2049 #ifdef BCMDBG
2050         brcmu_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
2051                       bus->dpc_sched, " not ");
2052         brcmu_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize,
2053                     bus->roundup);
2054 #endif                          /* BCMDBG */
2055         brcmu_bprintf(strbuf,
2056                     "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
2057                     bus->clkstate, bus->activity, bus->idletime, bus->idlecount,
2058                     bus->sleeping);
2059 }
2060
2061 void brcmf_bus_clearcounts(struct brcmf_pub *drvr)
2062 {
2063         struct brcmf_bus *bus = (struct brcmf_bus *) drvr->bus;
2064
2065         bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
2066         bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
2067         bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
2068         bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
2069         bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
2070         bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
2071 }
2072
2073 #ifdef SDTEST
2074 static int brcmf_sdbrcm_pktgen_get(struct brcmf_bus *bus, u8 *arg)
2075 {
2076         struct brcmf_pktgen pktgen;
2077
2078         pktgen.version = BRCMF_PKTGEN_VERSION;
2079         pktgen.freq = bus->pktgen_freq;
2080         pktgen.count = bus->pktgen_count;
2081         pktgen.print = bus->pktgen_print;
2082         pktgen.total = bus->pktgen_total;
2083         pktgen.minlen = bus->pktgen_minlen;
2084         pktgen.maxlen = bus->pktgen_maxlen;
2085         pktgen.numsent = bus->pktgen_sent;
2086         pktgen.numrcvd = bus->pktgen_rcvd;
2087         pktgen.numfail = bus->pktgen_fail;
2088         pktgen.mode = bus->pktgen_mode;
2089         pktgen.stop = bus->pktgen_stop;
2090
2091         memcpy(arg, &pktgen, sizeof(pktgen));
2092
2093         return 0;
2094 }
2095
2096 static int brcmf_sdbrcm_pktgen_set(struct brcmf_bus *bus, u8 *arg)
2097 {
2098         struct brcmf_pktgen pktgen;
2099         uint oldcnt, oldmode;
2100
2101         memcpy(&pktgen, arg, sizeof(pktgen));
2102         if (pktgen.version != BRCMF_PKTGEN_VERSION)
2103                 return -EINVAL;
2104
2105         oldcnt = bus->pktgen_count;
2106         oldmode = bus->pktgen_mode;
2107
2108         bus->pktgen_freq = pktgen.freq;
2109         bus->pktgen_count = pktgen.count;
2110         bus->pktgen_print = pktgen.print;
2111         bus->pktgen_total = pktgen.total;
2112         bus->pktgen_minlen = pktgen.minlen;
2113         bus->pktgen_maxlen = pktgen.maxlen;
2114         bus->pktgen_mode = pktgen.mode;
2115         bus->pktgen_stop = pktgen.stop;
2116
2117         bus->pktgen_tick = bus->pktgen_ptick = 0;
2118         bus->pktgen_len = max(bus->pktgen_len, bus->pktgen_minlen);
2119         bus->pktgen_len = min(bus->pktgen_len, bus->pktgen_maxlen);
2120
2121         /* Clear counts for a new pktgen (mode change, or was stopped) */
2122         if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
2123                 bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
2124
2125         return 0;
2126 }
2127 #endif                          /* SDTEST */
2128
2129 static int
2130 brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
2131                  uint size)
2132 {
2133         int bcmerror = 0;
2134         u32 sdaddr;
2135         uint dsize;
2136
2137         /* Determine initial transfer parameters */
2138         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2139         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2140                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2141         else
2142                 dsize = size;
2143
2144         /* Set the backplane window to include the start address */
2145         bcmerror = brcmf_sdbrcm_set_siaddr_window(bus, address);
2146         if (bcmerror) {
2147                 BRCMF_ERROR(("%s: window change failed\n", __func__));
2148                 goto xfer_done;
2149         }
2150
2151         /* Do the transfer(s) */
2152         while (size) {
2153                 BRCMF_INFO(("%s: %s %d bytes at offset 0x%08x in window"
2154                             " 0x%08x\n", __func__, (write ? "write" : "read"),
2155                             dsize, sdaddr, (address & SBSDIO_SBWINDOW_MASK)));
2156                 bcmerror =
2157                      brcmf_sdcard_rwdata(bus->card, write, sdaddr, data, dsize);
2158                 if (bcmerror) {
2159                         BRCMF_ERROR(("%s: membytes transfer failed\n",
2160                                      __func__));
2161                         break;
2162                 }
2163
2164                 /* Adjust for next transfer (if any) */
2165                 size -= dsize;
2166                 if (size) {
2167                         data += dsize;
2168                         address += dsize;
2169                         bcmerror = brcmf_sdbrcm_set_siaddr_window(bus, address);
2170                         if (bcmerror) {
2171                                 BRCMF_ERROR(("%s: window change failed\n",
2172                                              __func__));
2173                                 break;
2174                         }
2175                         sdaddr = 0;
2176                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2177                 }
2178         }
2179
2180 xfer_done:
2181         /* Return the window to backplane enumeration space for core access */
2182         if (brcmf_sdbrcm_set_siaddr_window(bus,
2183                                            brcmf_sdcard_cur_sbwad(bus->card))) {
2184                 BRCMF_ERROR(("%s: FAILED to set window back to 0x%x\n",
2185                              __func__, brcmf_sdcard_cur_sbwad(bus->card)));
2186         }
2187
2188         return bcmerror;
2189 }
2190
2191 #ifdef BCMDBG
2192 static int brcmf_sdbrcm_readshared(struct brcmf_bus *bus, struct sdpcm_shared *sh)
2193 {
2194         u32 addr;
2195         int rv;
2196
2197         /* Read last word in memory to determine address of
2198                          sdpcm_shared structure */
2199         rv = brcmf_sdbrcm_membytes(bus, false, bus->ramsize - 4, (u8 *)&addr,
2200                                    4);
2201         if (rv < 0)
2202                 return rv;
2203
2204         addr = le32_to_cpu(addr);
2205
2206         BRCMF_INFO(("sdpcm_shared address 0x%08X\n", addr));
2207
2208         /*
2209          * Check if addr is valid.
2210          * NVRAM length at the end of memory should have been overwritten.
2211          */
2212         if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
2213                 BRCMF_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n",
2214                              __func__, addr));
2215                 return -EBADE;
2216         }
2217
2218         /* Read rte_shared structure */
2219         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *) sh,
2220                               sizeof(struct sdpcm_shared));
2221         if (rv < 0)
2222                 return rv;
2223
2224         /* Endianness */
2225         sh->flags = le32_to_cpu(sh->flags);
2226         sh->trap_addr = le32_to_cpu(sh->trap_addr);
2227         sh->assert_exp_addr = le32_to_cpu(sh->assert_exp_addr);
2228         sh->assert_file_addr = le32_to_cpu(sh->assert_file_addr);
2229         sh->assert_line = le32_to_cpu(sh->assert_line);
2230         sh->console_addr = le32_to_cpu(sh->console_addr);
2231         sh->msgtrace_addr = le32_to_cpu(sh->msgtrace_addr);
2232
2233         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
2234                 BRCMF_ERROR(("%s: sdpcm_shared version %d in brcmf "
2235                              "is different than sdpcm_shared version %d in dongle\n",
2236                              __func__, SDPCM_SHARED_VERSION,
2237                              sh->flags & SDPCM_SHARED_VERSION_MASK));
2238                 return -EBADE;
2239         }
2240
2241         return 0;
2242 }
2243
2244 static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size)
2245 {
2246         int bcmerror = 0;
2247         uint msize = 512;
2248         char *mbuffer = NULL;
2249         uint maxstrlen = 256;
2250         char *str = NULL;
2251         struct brcmf_trap tr;
2252         struct sdpcm_shared sdpcm_shared;
2253         struct brcmu_strbuf strbuf;
2254
2255         BRCMF_TRACE(("%s: Enter\n", __func__));
2256
2257         if (data == NULL) {
2258                 /*
2259                  * Called after a rx ctrl timeout. "data" is NULL.
2260                  * allocate memory to trace the trap or assert.
2261                  */
2262                 size = msize;
2263                 mbuffer = data = kmalloc(msize, GFP_ATOMIC);
2264                 if (mbuffer == NULL) {
2265                         BRCMF_ERROR(("%s: kmalloc(%d) failed\n", __func__,
2266                                      msize));
2267                         bcmerror = -ENOMEM;
2268                         goto done;
2269                 }
2270         }
2271
2272         str = kmalloc(maxstrlen, GFP_ATOMIC);
2273         if (str == NULL) {
2274                 BRCMF_ERROR(("%s: kmalloc(%d) failed\n", __func__, maxstrlen));
2275                 bcmerror = -ENOMEM;
2276                 goto done;
2277         }
2278
2279         bcmerror = brcmf_sdbrcm_readshared(bus, &sdpcm_shared);
2280         if (bcmerror < 0)
2281                 goto done;
2282
2283         brcmu_binit(&strbuf, data, size);
2284
2285         brcmu_bprintf(&strbuf,
2286                     "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
2287                     sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
2288
2289         if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
2290                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
2291                  * (Avoids conflict with real asserts for programmatic
2292                  * parsing of output.)
2293                  */
2294                 brcmu_bprintf(&strbuf, "Assrt not built in dongle\n");
2295         }
2296
2297         if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) ==
2298             0) {
2299                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
2300                  * (Avoids conflict with real asserts for programmatic
2301                  * parsing of output.)
2302                  */
2303                 brcmu_bprintf(&strbuf, "No trap%s in dongle",
2304                             (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
2305                             ? "/assrt" : "");
2306         } else {
2307                 if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
2308                         /* Download assert */
2309                         brcmu_bprintf(&strbuf, "Dongle assert");
2310                         if (sdpcm_shared.assert_exp_addr != 0) {
2311                                 str[0] = '\0';
2312                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
2313                                                 sdpcm_shared.assert_exp_addr,
2314                                                 (u8 *) str, maxstrlen);
2315                                 if (bcmerror < 0)
2316                                         goto done;
2317
2318                                 str[maxstrlen - 1] = '\0';
2319                                 brcmu_bprintf(&strbuf, " expr \"%s\"", str);
2320                         }
2321
2322                         if (sdpcm_shared.assert_file_addr != 0) {
2323                                 str[0] = '\0';
2324                                 bcmerror = brcmf_sdbrcm_membytes(bus, false,
2325                                                 sdpcm_shared.assert_file_addr,
2326                                                 (u8 *) str, maxstrlen);
2327                                 if (bcmerror < 0)
2328                                         goto done;
2329
2330                                 str[maxstrlen - 1] = '\0';
2331                                 brcmu_bprintf(&strbuf, " file \"%s\"", str);
2332                         }
2333
2334                         brcmu_bprintf(&strbuf, " line %d ",
2335                                     sdpcm_shared.assert_line);
2336                 }
2337
2338                 if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
2339                         bcmerror = brcmf_sdbrcm_membytes(bus, false,
2340                                         sdpcm_shared.trap_addr, (u8 *)&tr,
2341                                         sizeof(struct brcmf_trap));
2342                         if (bcmerror < 0)
2343                                 goto done;
2344
2345                         brcmu_bprintf(&strbuf,
2346                                     "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
2347                                     "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
2348                                     "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n",
2349                                     tr.type, tr.epc, tr.cpsr, tr.spsr, tr.r13,
2350                                     tr.r14, tr.pc, sdpcm_shared.trap_addr,
2351                                     tr.r0, tr.r1, tr.r2, tr.r3, tr.r4, tr.r5,
2352                                     tr.r6, tr.r7);
2353                 }
2354         }
2355
2356         if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP))
2357                 BRCMF_ERROR(("%s: %s\n", __func__, strbuf.origbuf));
2358
2359 #ifdef BCMDBG
2360         if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
2361                 /* Mem dump to a file on device */
2362                 brcmf_sdbrcm_mem_dump(bus);
2363         }
2364 #endif                          /* BCMDBG */
2365
2366 done:
2367         kfree(mbuffer);
2368         kfree(str);
2369
2370         return bcmerror;
2371 }
2372
2373 static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus)
2374 {
2375         int ret = 0;
2376         int size;               /* Full mem size */
2377         int start = 0;          /* Start address */
2378         int read_size = 0;      /* Read size of each iteration */
2379         u8 *buf = NULL, *databuf = NULL;
2380
2381         /* Get full mem size */
2382         size = bus->ramsize;
2383         buf = kmalloc(size, GFP_ATOMIC);
2384         if (!buf) {
2385                 BRCMF_ERROR(("%s: Out of memory (%d bytes)\n", __func__, size));
2386                 return -1;
2387         }
2388
2389         /* Read mem content */
2390         printk(KERN_DEBUG "Dump dongle memory");
2391         databuf = buf;
2392         while (size) {
2393                 read_size = min(MEMBLOCK, size);
2394                 ret = brcmf_sdbrcm_membytes(bus, false, start, databuf,
2395                                           read_size);
2396                 if (ret) {
2397                         BRCMF_ERROR(("%s: Error membytes %d\n", __func__, ret));
2398                         kfree(buf);
2399                         return -1;
2400                 }
2401                 printk(".");
2402
2403                 /* Decrement size and increment start address */
2404                 size -= read_size;
2405                 start += read_size;
2406                 databuf += read_size;
2407         }
2408         printk(KERN_DEBUG "Done\n");
2409
2410         /* free buf before return !!! */
2411         if (brcmf_write_to_file(bus->drvr, buf, bus->ramsize)) {
2412                 BRCMF_ERROR(("%s: Error writing to files\n", __func__));
2413                 return -1;
2414         }
2415
2416         /* buf free handled in brcmf_write_to_file, not here */
2417         return 0;
2418 }
2419
2420 #define CONSOLE_LINE_MAX        192
2421
2422 static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
2423 {
2424         struct brcmf_console *c = &bus->console;
2425         u8 line[CONSOLE_LINE_MAX], ch;
2426         u32 n, idx, addr;
2427         int rv;
2428
2429         /* Don't do anything until FWREADY updates console address */
2430         if (bus->console_addr == 0)
2431                 return 0;
2432
2433         /* Read console log struct */
2434         addr = bus->console_addr + offsetof(struct rte_console, log);
2435         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log,
2436                                 sizeof(c->log));
2437         if (rv < 0)
2438                 return rv;
2439
2440         /* Allocate console buffer (one time only) */
2441         if (c->buf == NULL) {
2442                 c->bufsize = le32_to_cpu(c->log.buf_size);
2443                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2444                 if (c->buf == NULL)
2445                         return -ENOMEM;
2446         }
2447
2448         idx = le32_to_cpu(c->log.idx);
2449
2450         /* Protect against corrupt value */
2451         if (idx > c->bufsize)
2452                 return -EBADE;
2453
2454         /* Skip reading the console buffer if the index pointer
2455          has not moved */
2456         if (idx == c->last)
2457                 return 0;
2458
2459         /* Read the console buffer */
2460         addr = le32_to_cpu(c->log.buf);
2461         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2462         if (rv < 0)
2463                 return rv;
2464
2465         while (c->last != idx) {
2466                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2467                         if (c->last == idx) {
2468                                 /* This would output a partial line.
2469                                  * Instead, back up
2470                                  * the buffer pointer and output this
2471                                  * line next time around.
2472                                  */
2473                                 if (c->last >= n)
2474                                         c->last -= n;
2475                                 else
2476                                         c->last = c->bufsize - n;
2477                                 goto break2;
2478                         }
2479                         ch = c->buf[c->last];
2480                         c->last = (c->last + 1) % c->bufsize;
2481                         if (ch == '\n')
2482                                 break;
2483                         line[n] = ch;
2484                 }
2485
2486                 if (n > 0) {
2487                         if (line[n - 1] == '\r')
2488                                 n--;
2489                         line[n] = 0;
2490                         printk(KERN_DEBUG "CONSOLE: %s\n", line);
2491                 }
2492         }
2493 break2:
2494
2495         return 0;
2496 }
2497 #endif                          /* BCMDBG */
2498
2499 int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
2500 {
2501         int bcmerror = 0;
2502
2503         BRCMF_TRACE(("%s: Enter\n", __func__));
2504
2505         /* Basic sanity checks */
2506         if (bus->drvr->up) {
2507                 bcmerror = -EISCONN;
2508                 goto err;
2509         }
2510         if (!len) {
2511                 bcmerror = -EOVERFLOW;
2512                 goto err;
2513         }
2514
2515         /* Free the old ones and replace with passed variables */
2516         kfree(bus->vars);
2517
2518         bus->vars = kmalloc(len, GFP_ATOMIC);
2519         bus->varsz = bus->vars ? len : 0;
2520         if (bus->vars == NULL) {
2521                 bcmerror = -ENOMEM;
2522                 goto err;
2523         }
2524
2525         /* Copy the passed variables, which should include the
2526                  terminating double-null */
2527         memcpy(bus->vars, arg, bus->varsz);
2528 err:
2529         return bcmerror;
2530 }
2531
2532 static int
2533 brcmf_sdbrcm_doiovar(struct brcmf_bus *bus, const struct brcmu_iovar *vi, u32 actionid,
2534                 const char *name, void *params, int plen, void *arg, int len,
2535                 int val_size)
2536 {
2537         int bcmerror = 0;
2538         s32 int_val = 0;
2539         bool bool_val = 0;
2540
2541         BRCMF_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p "
2542                      "len %d val_size %d\n", __func__, actionid, name, params,
2543                      plen, arg, len, val_size));
2544
2545         bcmerror = brcmu_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid));
2546         if (bcmerror != 0)
2547                 goto exit;
2548
2549         if (plen >= (int)sizeof(int_val))
2550                 memcpy(&int_val, params, sizeof(int_val));
2551
2552         bool_val = (int_val != 0) ? true : false;
2553
2554         /* Some ioctls use the bus */
2555         brcmf_sdbrcm_sdlock(bus);
2556
2557         /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
2558         if (bus->drvr->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
2559                                         actionid == IOV_GVAL(IOV_DEVRESET))) {
2560                 bcmerror = -EPERM;
2561                 goto exit;
2562         }
2563
2564         /* Handle sleep stuff before any clock mucking */
2565         if (vi->varid == IOV_SLEEP) {
2566                 if (IOV_ISSET(actionid)) {
2567                         bcmerror = brcmf_sdbrcm_bussleep(bus, bool_val);
2568                 } else {
2569                         int_val = (s32) bus->sleeping;
2570                         memcpy(arg, &int_val, val_size);
2571                 }
2572                 goto exit;
2573         }
2574
2575         /* Request clock to allow SDIO accesses */
2576         if (!bus->drvr->dongle_reset) {
2577                 BUS_WAKE(bus);
2578                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2579         }
2580
2581         switch (actionid) {
2582         case IOV_GVAL(IOV_INTR):
2583                 int_val = (s32) bus->intr;
2584                 memcpy(arg, &int_val, val_size);
2585                 break;
2586
2587         case IOV_SVAL(IOV_INTR):
2588                 bus->intr = bool_val;
2589                 bus->intdis = false;
2590                 if (bus->drvr->up) {
2591                         BRCMF_INTR(("%s: %s SDIO interrupts\n", __func__,
2592                                     bus->intr ? "enable" : "disable"));
2593                         if (bus->intr) {
2594                                 brcmf_sdcard_intr_enable(bus->card);
2595                         } else {
2596                                 brcmf_sdcard_intr_disable(bus->card);
2597                         }
2598                 }
2599                 break;
2600
2601         case IOV_GVAL(IOV_POLLRATE):
2602                 int_val = (s32) bus->pollrate;
2603                 memcpy(arg, &int_val, val_size);
2604                 break;
2605
2606         case IOV_SVAL(IOV_POLLRATE):
2607                 bus->pollrate = (uint) int_val;
2608                 bus->poll = (bus->pollrate != 0);
2609                 break;
2610
2611         case IOV_GVAL(IOV_IDLETIME):
2612                 int_val = bus->idletime;
2613                 memcpy(arg, &int_val, val_size);
2614                 break;
2615
2616         case IOV_SVAL(IOV_IDLETIME):
2617                 if ((int_val < 0) && (int_val != BRCMF_IDLE_IMMEDIATE))
2618                         bcmerror = -EINVAL;
2619                 else
2620                         bus->idletime = int_val;
2621                 break;
2622
2623         case IOV_GVAL(IOV_IDLECLOCK):
2624                 int_val = (s32) bus->idleclock;
2625                 memcpy(arg, &int_val, val_size);
2626                 break;
2627
2628         case IOV_SVAL(IOV_IDLECLOCK):
2629                 bus->idleclock = int_val;
2630                 break;
2631
2632         case IOV_GVAL(IOV_SD1IDLE):
2633                 int_val = (s32) sd1idle;
2634                 memcpy(arg, &int_val, val_size);
2635                 break;
2636
2637         case IOV_SVAL(IOV_SD1IDLE):
2638                 sd1idle = bool_val;
2639                 break;
2640
2641         case IOV_SVAL(IOV_MEMBYTES):
2642         case IOV_GVAL(IOV_MEMBYTES):
2643                 {
2644                         u32 address;
2645                         uint size, dsize;
2646                         u8 *data;
2647
2648                         bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
2649
2650                         address = (u32) int_val;
2651                         memcpy(&int_val, (char *)params + sizeof(int_val),
2652                                sizeof(int_val));
2653                         size = (uint) int_val;
2654
2655                         /* Do some validation */
2656                         dsize = set ? plen - (2 * sizeof(int)) : len;
2657                         if (dsize < size) {
2658                                 BRCMF_ERROR(("%s: error on %s membytes, addr "
2659                                              "0x%08x size %d dsize %d\n",
2660                                              __func__, (set ? "set" : "get"),
2661                                              address, size, dsize));
2662                                 bcmerror = -EINVAL;
2663                                 break;
2664                         }
2665
2666                         BRCMF_INFO(("%s: Request to %s %d bytes at address "
2667                                     "0x%08x\n", __func__,
2668                                     (set ? "write" : "read"), size, address));
2669
2670                         /* If we know about SOCRAM, check for a fit */
2671                         if ((bus->orig_ramsize) &&
2672                             ((address > bus->orig_ramsize)
2673                              || (address + size > bus->orig_ramsize))) {
2674                                 BRCMF_ERROR(("%s: ramsize 0x%08x doesn't have"
2675                                              " %d bytes at 0x%08x\n", __func__,
2676                                              bus->orig_ramsize, size, address));
2677                                 bcmerror = -EINVAL;
2678                                 break;
2679                         }
2680
2681                         /* Generate the actual data pointer */
2682                         data =
2683                             set ? (u8 *) params +
2684                             2 * sizeof(int) : (u8 *) arg;
2685
2686                         /* Call to do the transfer */
2687                         bcmerror = brcmf_sdbrcm_membytes(bus, set, address,
2688                                                          data, size);
2689
2690                         break;
2691                 }
2692
2693         case IOV_GVAL(IOV_MEMSIZE):
2694                 int_val = (s32) bus->ramsize;
2695                 memcpy(arg, &int_val, val_size);
2696                 break;
2697
2698         case IOV_GVAL(IOV_SDIOD_DRIVE):
2699                 int_val = (s32) brcmf_sdiod_drive_strength;
2700                 memcpy(arg, &int_val, val_size);
2701                 break;
2702
2703         case IOV_SVAL(IOV_SDIOD_DRIVE):
2704                 brcmf_sdiod_drive_strength = int_val;
2705                 brcmf_sdbrcm_sdiod_drive_strength_init(bus,
2706                                              brcmf_sdiod_drive_strength);
2707                 break;
2708
2709         case IOV_SVAL(IOV_DOWNLOAD):
2710                 bcmerror = brcmf_sdbrcm_download_state(bus, bool_val);
2711                 break;
2712
2713         case IOV_SVAL(IOV_VARS):
2714                 bcmerror = brcmf_sdbrcm_downloadvars(bus, arg, len);
2715                 break;
2716
2717         case IOV_GVAL(IOV_READAHEAD):
2718                 int_val = (s32) brcmf_readahead;
2719                 memcpy(arg, &int_val, val_size);
2720                 break;
2721
2722         case IOV_SVAL(IOV_READAHEAD):
2723                 if (bool_val && !brcmf_readahead)
2724                         bus->nextlen = 0;
2725                 brcmf_readahead = bool_val;
2726                 break;
2727
2728         case IOV_GVAL(IOV_SDRXCHAIN):
2729                 int_val = (s32) bus->use_rxchain;
2730                 memcpy(arg, &int_val, val_size);
2731                 break;
2732
2733         case IOV_SVAL(IOV_SDRXCHAIN):
2734                 if (bool_val && !bus->sd_rxchain)
2735                         bcmerror = -ENOTSUPP;
2736                 else
2737                         bus->use_rxchain = bool_val;
2738                 break;
2739         case IOV_GVAL(IOV_ALIGNCTL):
2740                 int_val = (s32) brcmf_alignctl;
2741                 memcpy(arg, &int_val, val_size);
2742                 break;
2743
2744         case IOV_SVAL(IOV_ALIGNCTL):
2745                 brcmf_alignctl = bool_val;
2746                 break;
2747
2748         case IOV_GVAL(IOV_SDALIGN):
2749                 int_val = BRCMF_SDALIGN;
2750                 memcpy(arg, &int_val, val_size);
2751                 break;
2752
2753 #ifdef BCMDBG
2754         case IOV_GVAL(IOV_VARS):
2755                 if (bus->varsz < (uint) len)
2756                         memcpy(arg, bus->vars, bus->varsz);
2757                 else
2758                         bcmerror = -EOVERFLOW;
2759                 break;
2760 #endif                          /* BCMDBG */
2761
2762 #ifdef BCMDBG
2763         case IOV_GVAL(IOV_DCONSOLE_POLL):
2764                 int_val = (s32) brcmf_console_ms;
2765                 memcpy(arg, &int_val, val_size);
2766                 break;
2767
2768         case IOV_SVAL(IOV_DCONSOLE_POLL):
2769                 brcmf_console_ms = (uint) int_val;
2770                 break;
2771
2772         case IOV_SVAL(IOV_CONS):
2773                 if (len > 0)
2774                         bcmerror = brcmf_sdbrcm_bus_console_in(bus->drvr,
2775                                                                arg, len - 1);
2776                 break;
2777
2778         case IOV_GVAL(IOV_SDREG):
2779                 {
2780                         struct brcmf_sdreg *sd_ptr;
2781                         u32 addr, size;
2782
2783                         sd_ptr = (struct brcmf_sdreg *) params;
2784
2785                         addr = bus->ci->buscorebase + sd_ptr->offset;
2786                         size = sd_ptr->func;
2787                         int_val = (s32) brcmf_sdcard_reg_read(bus->card, addr,
2788                                                               size);
2789                         if (brcmf_sdcard_regfail(bus->card))
2790                                 bcmerror = -EIO;
2791                         memcpy(arg, &int_val, sizeof(s32));
2792                         break;
2793                 }
2794
2795         case IOV_SVAL(IOV_SDREG):
2796                 {
2797                         struct brcmf_sdreg *sd_ptr;
2798                         u32 addr, size;
2799
2800                         sd_ptr = (struct brcmf_sdreg *) params;
2801
2802                         addr = bus->ci->buscorebase + sd_ptr->offset;
2803                         size = sd_ptr->func;
2804                         brcmf_sdcard_reg_write(bus->card, addr, size,
2805                                                sd_ptr->value);
2806                         if (brcmf_sdcard_regfail(bus->card))
2807                                 bcmerror = -EIO;
2808                         break;
2809                 }
2810
2811                 /* Same as above, but offset is not backplane
2812                  (not SDIO core) */
2813         case IOV_GVAL(IOV_SBREG):
2814                 {
2815                         struct brcmf_sdreg sdreg;
2816                         u32 addr, size;
2817
2818                         memcpy(&sdreg, params, sizeof(sdreg));
2819
2820                         addr = SI_ENUM_BASE + sdreg.offset;
2821                         size = sdreg.func;
2822                         int_val = (s32) brcmf_sdcard_reg_read(bus->card, addr,
2823                                                               size);
2824                         if (brcmf_sdcard_regfail(bus->card))
2825                                 bcmerror = -EIO;
2826                         memcpy(arg, &int_val, sizeof(s32));
2827                         break;
2828                 }
2829
2830         case IOV_SVAL(IOV_SBREG):
2831                 {
2832                         struct brcmf_sdreg sdreg;
2833                         u32 addr, size;
2834
2835                         memcpy(&sdreg, params, sizeof(sdreg));
2836
2837                         addr = SI_ENUM_BASE + sdreg.offset;
2838                         size = sdreg.func;
2839                         brcmf_sdcard_reg_write(bus->card, addr, size,
2840                                                sdreg.value);
2841                         if (brcmf_sdcard_regfail(bus->card))
2842                                 bcmerror = -EIO;
2843                         break;
2844                 }
2845
2846         case IOV_GVAL(IOV_SDCIS):
2847                 {
2848                         *(char *)arg = 0;
2849
2850                         strcat(arg, "\nFunc 0\n");
2851                         brcmf_sdcard_cis_read(bus->card, 0x10,
2852                                         (u8 *) arg + strlen(arg),
2853                                         SBSDIO_CIS_SIZE_LIMIT);
2854                         strcat(arg, "\nFunc 1\n");
2855                         brcmf_sdcard_cis_read(bus->card, 0x11,
2856                                         (u8 *) arg + strlen(arg),
2857                                         SBSDIO_CIS_SIZE_LIMIT);
2858                         strcat(arg, "\nFunc 2\n");
2859                         brcmf_sdcard_cis_read(bus->card, 0x12,
2860                                         (u8 *) arg + strlen(arg),
2861                                         SBSDIO_CIS_SIZE_LIMIT);
2862                         break;
2863                 }
2864
2865         case IOV_GVAL(IOV_FORCEEVEN):
2866                 int_val = (s32) forcealign;
2867                 memcpy(arg, &int_val, val_size);
2868                 break;
2869
2870         case IOV_SVAL(IOV_FORCEEVEN):
2871                 forcealign = bool_val;
2872                 break;
2873
2874         case IOV_GVAL(IOV_TXBOUND):
2875                 int_val = (s32) brcmf_txbound;
2876                 memcpy(arg, &int_val, val_size);
2877                 break;
2878
2879         case IOV_SVAL(IOV_TXBOUND):
2880                 brcmf_txbound = (uint) int_val;
2881                 break;
2882
2883         case IOV_GVAL(IOV_RXBOUND):
2884                 int_val = (s32) brcmf_rxbound;
2885                 memcpy(arg, &int_val, val_size);
2886                 break;
2887
2888         case IOV_SVAL(IOV_RXBOUND):
2889                 brcmf_rxbound = (uint) int_val;
2890                 break;
2891
2892         case IOV_GVAL(IOV_TXMINMAX):
2893                 int_val = (s32) brcmf_txminmax;
2894                 memcpy(arg, &int_val, val_size);
2895                 break;
2896
2897         case IOV_SVAL(IOV_TXMINMAX):
2898                 brcmf_txminmax = (uint) int_val;
2899                 break;
2900 #endif                          /* BCMDBG */
2901
2902 #ifdef SDTEST
2903         case IOV_GVAL(IOV_EXTLOOP):
2904                 int_val = (s32) bus->ext_loop;
2905                 memcpy(arg, &int_val, val_size);
2906                 break;
2907
2908         case IOV_SVAL(IOV_EXTLOOP):
2909                 bus->ext_loop = bool_val;
2910                 break;
2911
2912         case IOV_GVAL(IOV_PKTGEN):
2913                 bcmerror = brcmf_sdbrcm_pktgen_get(bus, arg);
2914                 break;
2915
2916         case IOV_SVAL(IOV_PKTGEN):
2917                 bcmerror = brcmf_sdbrcm_pktgen_set(bus, arg);
2918                 break;
2919 #endif                          /* SDTEST */
2920
2921         case IOV_SVAL(IOV_DEVRESET):
2922                 BRCMF_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d "
2923                              "busstate=%d\n",
2924                              __func__, bool_val, bus->drvr->dongle_reset,
2925                              bus->drvr->busstate));
2926
2927                 brcmf_bus_devreset(bus->drvr, (u8) bool_val);
2928
2929                 break;
2930
2931         case IOV_GVAL(IOV_DEVRESET):
2932                 BRCMF_TRACE(("%s: Called get IOV_DEVRESET\n", __func__));
2933
2934                 /* Get its status */
2935                 int_val = (bool) bus->drvr->dongle_reset;
2936                 memcpy(arg, &int_val, val_size);
2937
2938                 break;
2939
2940         case IOV_GVAL(IOV_WDTICK):
2941                 int_val = (s32) brcmf_watchdog_ms;
2942                 memcpy(arg, &int_val, val_size);
2943                 break;
2944
2945         case IOV_SVAL(IOV_WDTICK):
2946                 if (!bus->drvr->up) {
2947                         bcmerror = -ENOLINK;
2948                         break;
2949                 }
2950                 brcmf_sdbrcm_wd_timer(bus, (uint) int_val);
2951                 break;
2952
2953         default:
2954                 bcmerror = -ENOTSUPP;
2955                 break;
2956         }
2957
2958 exit:
2959         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2960                 bus->activity = false;
2961                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2962         }
2963
2964         brcmf_sdbrcm_sdunlock(bus);
2965
2966         if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == false)
2967                 brcmf_c_preinit_ioctls(bus->drvr);
2968
2969         return bcmerror;
2970 }
2971
2972 static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
2973 {
2974         int bcmerror = 0;
2975         u32 varsize;
2976         u32 varaddr;
2977         u8 *vbuffer;
2978         u32 varsizew;
2979 #ifdef BCMDBG
2980         char *nvram_ularray;
2981 #endif                          /* BCMDBG */
2982
2983         /* Even if there are no vars are to be written, we still
2984                  need to set the ramsize. */
2985         varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
2986         varaddr = (bus->ramsize - 4) - varsize;
2987
2988         if (bus->vars) {
2989                 vbuffer = kzalloc(varsize, GFP_ATOMIC);
2990                 if (!vbuffer)
2991                         return -ENOMEM;
2992
2993                 memcpy(vbuffer, bus->vars, bus->varsz);
2994
2995                 /* Write the vars list */
2996                 bcmerror =
2997                     brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
2998 #ifdef BCMDBG
2999                 /* Verify NVRAM bytes */
3000                 BRCMF_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
3001                 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
3002                 if (!nvram_ularray)
3003                         return -ENOMEM;
3004
3005                 /* Upload image to verify downloaded contents. */
3006                 memset(nvram_ularray, 0xaa, varsize);
3007
3008                 /* Read the vars list to temp buffer for comparison */
3009                 bcmerror =
3010                     brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
3011                                      varsize);
3012                 if (bcmerror) {
3013                         BRCMF_ERROR(("%s: error %d on reading %d nvram bytes"
3014                                      " at 0x%08x\n", __func__, bcmerror,
3015                                      varsize, varaddr));
3016                 }
3017                 /* Compare the org NVRAM with the one read from RAM */
3018                 if (memcmp(vbuffer, nvram_ularray, varsize)) {
3019                         BRCMF_ERROR(("%s: Downloaded NVRAM image is "
3020                                      "corrupted.\n", __func__));
3021                 } else
3022                         BRCMF_ERROR(("%s: Download/Upload/Compare of"
3023                                      " NVRAM ok.\n", __func__));
3024
3025                 kfree(nvram_ularray);
3026 #endif                          /* BCMDBG */
3027
3028                 kfree(vbuffer);
3029         }
3030
3031         /* adjust to the user specified RAM */
3032         BRCMF_INFO(("Physical memory size: %d, usable memory size: %d\n",
3033                     bus->orig_ramsize, bus->ramsize));
3034         BRCMF_INFO(("Vars are at %d, orig varsize is %d\n", varaddr, varsize));
3035         varsize = ((bus->orig_ramsize - 4) - varaddr);
3036
3037         /*
3038          * Determine the length token:
3039          * Varsize, converted to words, in lower 16-bits, checksum
3040          * in upper 16-bits.
3041          */
3042         if (bcmerror) {
3043                 varsizew = 0;
3044         } else {
3045                 varsizew = varsize / 4;
3046                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3047                 varsizew = cpu_to_le32(varsizew);
3048         }
3049
3050         BRCMF_INFO(("New varsize is %d, length token=0x%08x\n", varsize,
3051                     varsizew));
3052
3053         /* Write the length token to the last word */
3054         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->orig_ramsize - 4),
3055                                     (u8 *)&varsizew, 4);
3056
3057         return bcmerror;
3058 }
3059
3060 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
3061 {
3062         uint retries;
3063         u32 regdata;
3064         int bcmerror = 0;
3065
3066         /* To enter download state, disable ARM and reset SOCRAM.
3067          * To exit download state, simply reset ARM (default is RAM boot).
3068          */
3069         if (enter) {
3070                 bus->alp_only = true;
3071
3072                 brcmf_sdbrcm_chip_disablecore(bus->card, bus->ci->armcorebase);
3073
3074                 brcmf_sdbrcm_chip_resetcore(bus->card, bus->ci->ramcorebase);
3075
3076                 /* Clear the top bit of memory */
3077                 if (bus->ramsize) {
3078                         u32 zeros = 0;
3079                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3080                                          (u8 *)&zeros, 4);
3081                 }
3082         } else {
3083                 regdata = brcmf_sdcard_reg_read(bus->card,
3084                         CORE_SB(bus->ci->ramcorebase, sbtmstatelow), 4);
3085                 regdata &= (SBTML_RESET | SBTML_REJ_MASK |
3086                         (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
3087                 if ((SICF_CLOCK_EN << SBTML_SICF_SHIFT) != regdata) {
3088                         BRCMF_ERROR(("%s: SOCRAM core is down after reset?\n",
3089                                      __func__));
3090                         bcmerror = -EBADE;
3091                         goto fail;
3092                 }
3093
3094                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3095                 if (bcmerror) {
3096                         BRCMF_ERROR(("%s: no vars written to RAM\n", __func__));
3097                         bcmerror = 0;
3098                 }
3099
3100                 w_sdreg32(bus, 0xFFFFFFFF,
3101                           offsetof(struct sdpcmd_regs, intstatus), &retries);
3102
3103                 brcmf_sdbrcm_chip_resetcore(bus->card, bus->ci->armcorebase);
3104
3105                 /* Allow HT Clock now that the ARM is running. */
3106                 bus->alp_only = false;
3107
3108                 bus->drvr->busstate = BRCMF_BUS_LOAD;
3109         }
3110 fail:
3111         return bcmerror;
3112 }
3113
3114 int
3115 brcmf_sdbrcm_bus_iovar_op(struct brcmf_pub *drvr, const char *name,
3116                           void *params, int plen, void *arg, int len, bool set)
3117 {
3118         struct brcmf_bus *bus = drvr->bus;
3119         const struct brcmu_iovar *vi = NULL;
3120         int bcmerror = 0;
3121         int val_size;
3122         u32 actionid;
3123
3124         BRCMF_TRACE(("%s: Enter\n", __func__));
3125
3126         if (name == NULL || len <= 0)
3127                 return -EINVAL;
3128
3129         /* Set does not take qualifiers */
3130         if (set && (params || plen))
3131                 return -EINVAL;
3132
3133         /* Get must have return space;*/
3134         if (!set && !(arg && len))
3135                 return -EINVAL;
3136
3137         /* Look up var locally; if not found pass to host driver */
3138         vi = brcmu_iovar_lookup(brcmf_sdio_iovars, name);
3139         if (vi == NULL) {
3140                 brcmf_sdbrcm_sdlock(bus);
3141
3142                 BUS_WAKE(bus);
3143
3144                 /* Turn on clock in case SD command needs backplane */
3145                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3146
3147                 bcmerror = brcmf_sdcard_iovar_op(bus->card, name, params, plen,
3148                                                  arg, len, set);
3149
3150                 /* Similar check for blocksize change */
3151                 if (set && strcmp(name, "sd_blocksize") == 0) {
3152                         s32 fnum = 2;
3153                         if (brcmf_sdcard_iovar_op
3154                             (bus->card, "sd_blocksize", &fnum, sizeof(s32),
3155                              &bus->blocksize, sizeof(s32),
3156                              false) != 0) {
3157                                 bus->blocksize = 0;
3158                                 BRCMF_ERROR(("%s: fail on %s get\n", __func__,
3159                                              "sd_blocksize"));
3160                         } else {
3161                                 BRCMF_INFO(("%s: noted sd_blocksize update,"
3162                                             " value now %d\n", __func__,
3163                                             bus->blocksize));
3164                         }
3165                 }
3166                 bus->roundup = min(max_roundup, bus->blocksize);
3167
3168                 if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
3169                     !bus->dpc_sched) {
3170                         bus->activity = false;
3171                         brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
3172                 }
3173
3174                 brcmf_sdbrcm_sdunlock(bus);
3175                 goto exit;
3176         }
3177
3178         BRCMF_CTL(("%s: %s %s, len %d plen %d\n", __func__,
3179                    name, (set ? "set" : "get"), len, plen));
3180
3181         /* set up 'params' pointer in case this is a set command so that
3182          * the convenience int and bool code can be common to set and get
3183          */
3184         if (params == NULL) {
3185                 params = arg;
3186                 plen = len;
3187         }
3188
3189         if (vi->type == IOVT_VOID)
3190                 val_size = 0;
3191         else if (vi->type == IOVT_BUFFER)
3192                 val_size = len;
3193         else
3194                 /* all other types are integer sized */
3195                 val_size = sizeof(int);
3196
3197         actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
3198         bcmerror = brcmf_sdbrcm_doiovar(bus, vi, actionid, name, params, plen,
3199                                         arg, len, val_size);
3200
3201 exit:
3202         return bcmerror;
3203 }
3204
3205 void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus, bool enforce_mutex)
3206 {
3207         u32 local_hostintmask;
3208         u8 saveclk;
3209         uint retries;
3210         int err;
3211
3212         BRCMF_TRACE(("%s: Enter\n", __func__));
3213
3214         if (enforce_mutex)
3215                 brcmf_sdbrcm_sdlock(bus);
3216
3217         BUS_WAKE(bus);
3218
3219         /* Enable clock for device interrupts */
3220         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3221
3222         if (bus->watchdog_tsk) {
3223                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
3224                 kthread_stop(bus->watchdog_tsk);
3225                 bus->watchdog_tsk = NULL;
3226         }
3227
3228         if (bus->dpc_tsk) {
3229                 send_sig(SIGTERM, bus->dpc_tsk, 1);
3230                 kthread_stop(bus->dpc_tsk);
3231                 bus->dpc_tsk = NULL;
3232         } else
3233                 tasklet_kill(&bus->tasklet);
3234
3235         /* Disable and clear interrupts at the chip level also */
3236         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
3237         local_hostintmask = bus->hostintmask;
3238         bus->hostintmask = 0;
3239
3240         /* Change our idea of bus state */
3241         bus->drvr->busstate = BRCMF_BUS_DOWN;
3242
3243         /* Force clocks on backplane to be sure F2 interrupt propagates */
3244         saveclk = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
3245                                         SBSDIO_FUNC1_CHIPCLKCSR, &err);
3246         if (!err) {
3247                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
3248                                        SBSDIO_FUNC1_CHIPCLKCSR,
3249                                        (saveclk | SBSDIO_FORCE_HT), &err);
3250         }
3251         if (err) {
3252                 BRCMF_ERROR(("%s: Failed to force clock for F2: err %d\n",
3253                              __func__, err));
3254         }
3255
3256         /* Turn off the bus (F2), free any pending packets */
3257         BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
3258         brcmf_sdcard_intr_disable(bus->card);
3259         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3260                          SDIO_FUNC_ENABLE_1, NULL);
3261
3262         /* Clear any pending interrupts now that F2 is disabled */
3263         w_sdreg32(bus, local_hostintmask,
3264                   offsetof(struct sdpcmd_regs, intstatus), &retries);
3265
3266         /* Turn off the backplane clock (only) */
3267         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3268
3269         /* Clear the data packet queues */
3270         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
3271
3272         /* Clear any held glomming stuff */
3273         if (bus->glomd)
3274                 brcmu_pkt_buf_free_skb(bus->glomd);
3275
3276         if (bus->glom)
3277                 brcmu_pkt_buf_free_skb(bus->glom);
3278
3279         bus->glom = bus->glomd = NULL;
3280
3281         /* Clear rx control and wake any waiters */
3282         bus->rxlen = 0;
3283         brcmf_os_ioctl_resp_wake(bus->drvr);
3284
3285         /* Reset some F2 state stuff */
3286         bus->rxskip = false;
3287         bus->tx_seq = bus->rx_seq = 0;
3288
3289         if (enforce_mutex)
3290                 brcmf_sdbrcm_sdunlock(bus);
3291 }
3292
3293 int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr, bool enforce_mutex)
3294 {
3295         struct brcmf_bus *bus = drvr->bus;
3296         struct brcmf_timeout tmo;
3297         uint retries = 0;
3298         u8 ready, enable;
3299         int err, ret = 0;
3300         u8 saveclk;
3301
3302         BRCMF_TRACE(("%s: Enter\n", __func__));
3303
3304         /* try to download image and nvram to the dongle */
3305         if (drvr->busstate == BRCMF_BUS_DOWN) {
3306                 if (!(brcmf_sdbrcm_download_firmware(bus, bus->card)))
3307                         return -1;
3308         }
3309
3310         if (!bus->drvr)
3311                 return 0;
3312
3313         /* Start the watchdog timer */
3314         bus->drvr->tickcnt = 0;
3315         brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
3316
3317         if (enforce_mutex)
3318                 brcmf_sdbrcm_sdlock(bus);
3319
3320         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3321         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3322         if (bus->clkstate != CLK_AVAIL)
3323                 goto exit;
3324
3325         /* Force clocks on backplane to be sure F2 interrupt propagates */
3326         saveclk =
3327             brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
3328                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
3329         if (!err) {
3330                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
3331                                        SBSDIO_FUNC1_CHIPCLKCSR,
3332                                        (saveclk | SBSDIO_FORCE_HT), &err);
3333         }
3334         if (err) {
3335                 BRCMF_ERROR(("%s: Failed to force clock for F2: err %d\n",
3336                              __func__, err));
3337                 goto exit;
3338         }
3339
3340         /* Enable function 2 (frame transfers) */
3341         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3342                   offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
3343         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3344
3345         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx, enable,
3346                                NULL);
3347
3348         /* Give the dongle some time to do its thing and set IOR2 */
3349         brcmf_timeout_start(&tmo, BRCMF_WAIT_F2RDY * 1000);
3350
3351         ready = 0;
3352         while (ready != enable && !brcmf_timeout_expired(&tmo))
3353                 ready = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_0,
3354                                               SDIO_CCCR_IORx, NULL);
3355
3356         BRCMF_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
3357                     __func__, enable, ready, tmo.elapsed));
3358
3359         /* If F2 successfully enabled, set core and enable interrupts */
3360         if (ready == enable) {
3361                 /* Set up the interrupt mask and enable interrupts */
3362                 bus->hostintmask = HOSTINTMASK;
3363                 w_sdreg32(bus, bus->hostintmask,
3364                           offsetof(struct sdpcmd_regs, hostintmask), &retries);
3365
3366                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_WATERMARK,
3367                                  (u8) watermark, &err);
3368
3369                 /* Set bus state according to enable result */
3370                 drvr->busstate = BRCMF_BUS_DATA;
3371
3372                 bus->intdis = false;
3373                 if (bus->intr) {
3374                         BRCMF_INTR(("%s: enable SDIO device interrupts\n",
3375                                     __func__));
3376                         brcmf_sdcard_intr_enable(bus->card);
3377                 } else {
3378                         BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
3379                         brcmf_sdcard_intr_disable(bus->card);
3380                 }
3381
3382         }
3383
3384         else {
3385                 /* Disable F2 again */
3386                 enable = SDIO_FUNC_ENABLE_1;
3387                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3388                                        enable, NULL);
3389         }
3390
3391         /* Restore previous clock setting */
3392         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
3393                          saveclk, &err);
3394
3395 #if defined(OOB_INTR_ONLY)
3396         /* Host registration for OOB interrupt */
3397         if (brcmf_sdio_register_oob_intr(bus->dhd)) {
3398                 brcmf_sdbrcm_wd_timer(bus, 0);
3399                 BRCMF_ERROR(("%s Host failed to resgister for OOB\n",
3400                              __func__));
3401                 ret = -ENODEV;
3402                 goto exit;
3403         }
3404
3405         /* Enable oob at firmware */
3406         brcmf_sdbrcm_enable_oob_intr(bus, true);
3407 #endif          /* defined(OOB_INTR_ONLY) */
3408
3409         /* If we didn't come up, turn off backplane clock */
3410         if (drvr->busstate != BRCMF_BUS_DATA)
3411                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3412
3413 exit:
3414         if (enforce_mutex)
3415                 brcmf_sdbrcm_sdunlock(bus);
3416
3417         return ret;
3418 }
3419
3420 static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
3421 {
3422         struct brcmf_sdio_card *card = bus->card;
3423         uint retries = 0;
3424         u16 lastrbc;
3425         u8 hi, lo;
3426         int err;
3427
3428         BRCMF_ERROR(("%s: %sterminate frame%s\n", __func__,
3429                      (abort ? "abort command, " : ""),
3430                      (rtx ? ", send NAK" : "")));
3431
3432         if (abort)
3433                 brcmf_sdcard_abort(card, SDIO_FUNC_2);
3434
3435         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
3436                                SFC_RF_TERM, &err);
3437         bus->f1regdata++;
3438
3439         /* Wait until the packet has been flushed (device/FIFO stable) */
3440         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
3441                 hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
3442                                            SBSDIO_FUNC1_RFRAMEBCHI, NULL);
3443                 lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
3444                                            SBSDIO_FUNC1_RFRAMEBCLO, NULL);
3445                 bus->f1regdata += 2;
3446
3447                 if ((hi == 0) && (lo == 0))
3448                         break;
3449
3450                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
3451                         BRCMF_ERROR(("%s: count growing: last 0x%04x now "
3452                                      "0x%04x\n",
3453                                      __func__, lastrbc, ((hi << 8) + lo)));
3454                 }
3455                 lastrbc = (hi << 8) + lo;
3456         }
3457
3458         if (!retries) {
3459                 BRCMF_ERROR(("%s: count never zeroed: last 0x%04x\n",
3460                              __func__, lastrbc));
3461         } else {
3462                 BRCMF_INFO(("%s: flush took %d iterations\n", __func__,
3463                             (0xffff - retries)));
3464         }
3465
3466         if (rtx) {
3467                 bus->rxrtx++;
3468                 w_sdreg32(bus, SMB_NAK,
3469                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
3470
3471                 bus->f1regdata++;
3472                 if (retries <= retry_limit)
3473                         bus->rxskip = true;
3474         }
3475
3476         /* Clear partial in any case */
3477         bus->nextlen = 0;
3478
3479         /* If we can't reach the device, signal failure */
3480         if (err || brcmf_sdcard_regfail(card))
3481                 bus->drvr->busstate = BRCMF_BUS_DOWN;
3482 }
3483
3484 static void
3485 brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
3486 {
3487         struct brcmf_sdio_card *card = bus->card;
3488         uint rdlen, pad;
3489
3490         int sdret;
3491
3492         BRCMF_TRACE(("%s: Enter\n", __func__));
3493
3494         /* Control data already received in aligned rxctl */
3495         if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
3496                 goto gotpkt;
3497
3498         /* Set rxctl for frame (w/optional alignment) */
3499         bus->rxctl = bus->rxbuf;
3500         if (brcmf_alignctl) {
3501                 bus->rxctl += firstread;
3502                 pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
3503                 if (pad)
3504                         bus->rxctl += (BRCMF_SDALIGN - pad);
3505                 bus->rxctl -= firstread;
3506         }
3507
3508         /* Copy the already-read portion over */
3509         memcpy(bus->rxctl, hdr, firstread);
3510         if (len <= firstread)
3511                 goto gotpkt;
3512
3513         /* Copy the full data pkt in gSPI case and process ioctl. */
3514         if (bus->bus == SPI_BUS) {
3515                 memcpy(bus->rxctl, hdr, len);
3516                 goto gotpkt;
3517         }
3518
3519         /* Raise rdlen to next SDIO block to avoid tail command */
3520         rdlen = len - firstread;
3521         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
3522                 pad = bus->blocksize - (rdlen % bus->blocksize);
3523                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3524                     ((len + pad) < bus->drvr->maxctl))
3525                         rdlen += pad;
3526         } else if (rdlen % BRCMF_SDALIGN) {
3527                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
3528         }
3529
3530         /* Satisfy length-alignment requirements */
3531         if (forcealign && (rdlen & (ALIGNMENT - 1)))
3532                 rdlen = roundup(rdlen, ALIGNMENT);
3533
3534         /* Drop if the read is too big or it exceeds our maximum */
3535         if ((rdlen + firstread) > bus->drvr->maxctl) {
3536                 BRCMF_ERROR(("%s: %d-byte control read exceeds %d-byte"
3537                              " buffer\n", __func__, rdlen, bus->drvr->maxctl));
3538                 bus->drvr->rx_errors++;
3539                 brcmf_sdbrcm_rxfail(bus, false, false);
3540                 goto done;
3541         }
3542
3543         if ((len - doff) > bus->drvr->maxctl) {
3544                 BRCMF_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds "
3545                              "%d-byte limit\n",
3546                              __func__, len, (len - doff), bus->drvr->maxctl));
3547                 bus->drvr->rx_errors++;
3548                 bus->rx_toolong++;
3549                 brcmf_sdbrcm_rxfail(bus, false, false);
3550                 goto done;
3551         }
3552
3553         /* Read remainder of frame body into the rxctl buffer */
3554         sdret = brcmf_sdcard_recv_buf(card, brcmf_sdcard_cur_sbwad(card),
3555                                 SDIO_FUNC_2,
3556                                 F2SYNC, (bus->rxctl + firstread), rdlen,
3557                                 NULL, NULL, NULL);
3558         bus->f2rxdata++;
3559
3560         /* Control frame failures need retransmission */
3561         if (sdret < 0) {
3562                 BRCMF_ERROR(("%s: read %d control bytes failed: %d\n",
3563                              __func__, rdlen, sdret));
3564                 bus->rxc_errors++;
3565                 brcmf_sdbrcm_rxfail(bus, true, true);
3566                 goto done;
3567         }
3568
3569 gotpkt:
3570
3571 #ifdef BCMDBG
3572         if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
3573                 printk(KERN_DEBUG "RxCtrl:\n");
3574                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
3575         }
3576 #endif
3577
3578         /* Point to valid data and indicate its length */
3579         bus->rxctl += doff;
3580         bus->rxlen = len - doff;
3581
3582 done:
3583         /* Awake any waiters */
3584         brcmf_os_ioctl_resp_wake(bus->drvr);
3585 }
3586
3587 static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
3588 {
3589         u16 dlen, totlen;
3590         u8 *dptr, num = 0;
3591
3592         u16 sublen, check;
3593         struct sk_buff *pfirst, *plast, *pnext, *save_pfirst;
3594
3595         int errcode;
3596         u8 chan, seq, doff, sfdoff;
3597         u8 txmax;
3598
3599         int ifidx = 0;
3600         bool usechain = bus->use_rxchain;
3601
3602         /* If packets, issue read(s) and send up packet chain */
3603         /* Return sequence numbers consumed? */
3604
3605         BRCMF_TRACE(("brcmf_sdbrcm_rxglom: start: glomd %p glom %p\n",
3606                      bus->glomd, bus->glom));
3607
3608         /* If there's a descriptor, generate the packet chain */
3609         if (bus->glomd) {
3610                 pfirst = plast = pnext = NULL;
3611                 dlen = (u16) (bus->glomd->len);
3612                 dptr = bus->glomd->data;
3613                 if (!dlen || (dlen & 1)) {
3614                         BRCMF_ERROR(("%s: bad glomd len(%d),"
3615                                      " ignore descriptor\n",
3616                                      __func__, dlen));
3617                         dlen = 0;
3618                 }
3619
3620                 for (totlen = num = 0; dlen; num++) {
3621                         /* Get (and move past) next length */
3622                         sublen = get_unaligned_le16(dptr);
3623                         dlen -= sizeof(u16);
3624                         dptr += sizeof(u16);
3625                         if ((sublen < SDPCM_HDRLEN) ||
3626                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
3627                                 BRCMF_ERROR(("%s: descriptor len %d bad: %d\n",
3628                                              __func__, num, sublen));
3629                                 pnext = NULL;
3630                                 break;
3631                         }
3632                         if (sublen % BRCMF_SDALIGN) {
3633                                 BRCMF_ERROR(("%s: sublen %d not multiple of"
3634                                              " %d\n", __func__, sublen,
3635                                              BRCMF_SDALIGN));
3636                                 usechain = false;
3637                         }
3638                         totlen += sublen;
3639
3640                         /* For last frame, adjust read len so total
3641                                  is a block multiple */
3642                         if (!dlen) {
3643                                 sublen +=
3644                                     (roundup(totlen, bus->blocksize) - totlen);
3645                                 totlen = roundup(totlen, bus->blocksize);
3646                         }
3647
3648                         /* Allocate/chain packet for next subframe */
3649                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
3650                         if (pnext == NULL) {
3651                                 BRCMF_ERROR(("%s: bcm_pkt_buf_get_skb failed, "
3652                                              "num %d len %d\n", __func__,
3653                                              num, sublen));
3654                                 break;
3655                         }
3656                         if (!pfirst) {
3657                                 pfirst = plast = pnext;
3658                         } else {
3659                                 plast->next = pnext;
3660                                 plast = pnext;
3661                         }
3662
3663                         /* Adhere to start alignment requirements */
3664                         PKTALIGN(pnext, sublen, BRCMF_SDALIGN);
3665                 }
3666
3667                 /* If all allocations succeeded, save packet chain
3668                          in bus structure */
3669                 if (pnext) {
3670                         BRCMF_GLOM(("%s: allocated %d-byte packet chain for %d "
3671                                     "subframes\n", __func__, totlen, num));
3672                         if (BRCMF_GLOM_ON() && bus->nextlen) {
3673                                 if (totlen != bus->nextlen) {
3674                                         BRCMF_GLOM(("%s: glomdesc mismatch: "
3675                                                     "nextlen %d glomdesc %d "
3676                                                     "rxseq %d\n", __func__,
3677                                                     bus->nextlen,
3678                                                     totlen, rxseq));
3679                                 }
3680                         }
3681                         bus->glom = pfirst;
3682                         pfirst = pnext = NULL;
3683                 } else {
3684                         if (pfirst)
3685                                 brcmu_pkt_buf_free_skb(pfirst);
3686                         bus->glom = NULL;
3687                         num = 0;
3688                 }
3689
3690                 /* Done with descriptor packet */
3691                 brcmu_pkt_buf_free_skb(bus->glomd);
3692                 bus->glomd = NULL;
3693                 bus->nextlen = 0;
3694         }
3695
3696         /* Ok -- either we just generated a packet chain,
3697                  or had one from before */
3698         if (bus->glom) {
3699                 if (BRCMF_GLOM_ON()) {
3700                         BRCMF_GLOM(("%s: try superframe read, packet chain:\n",
3701                                     __func__));
3702                         for (pnext = bus->glom; pnext; pnext = pnext->next) {
3703                                 BRCMF_GLOM(("    %p: %p len 0x%04x (%d)\n",
3704                                             pnext, (u8 *) (pnext->data),
3705                                             pnext->len, pnext->len));
3706                         }
3707                 }
3708
3709                 pfirst = bus->glom;
3710                 dlen = (u16) brcmu_pkttotlen(pfirst);
3711
3712                 /* Do an SDIO read for the superframe.  Configurable iovar to
3713                  * read directly into the chained packet, or allocate a large
3714                  * packet and and copy into the chain.
3715                  */
3716                 if (usechain) {
3717                         errcode = brcmf_sdcard_recv_buf(bus->card,
3718                                         brcmf_sdcard_cur_sbwad(bus->card),
3719                                         SDIO_FUNC_2,
3720                                         F2SYNC, (u8 *) pfirst->data, dlen,
3721                                         pfirst, NULL, NULL);
3722                 } else if (bus->dataptr) {
3723                         errcode = brcmf_sdcard_recv_buf(bus->card,
3724                                         brcmf_sdcard_cur_sbwad(bus->card),
3725                                         SDIO_FUNC_2,
3726                                         F2SYNC, bus->dataptr, dlen,
3727                                         NULL, NULL, NULL);
3728                         sublen = (u16) brcmu_pktfrombuf(pfirst, 0, dlen,
3729                                                 bus->dataptr);
3730                         if (sublen != dlen) {
3731                                 BRCMF_ERROR(("%s: FAILED TO COPY, dlen %d "
3732                                              "sublen %d\n",
3733                                              __func__, dlen, sublen));
3734                                 errcode = -1;
3735                         }
3736                         pnext = NULL;
3737                 } else {
3738                         BRCMF_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, "
3739                                      "FORCE FAILURE\n", dlen));
3740                         errcode = -1;
3741                 }
3742                 bus->f2rxdata++;
3743
3744                 /* On failure, kill the superframe, allow a couple retries */
3745                 if (errcode < 0) {
3746                         BRCMF_ERROR(("%s: glom read of %d bytes failed: %d\n",
3747                                      __func__, dlen, errcode));
3748                         bus->drvr->rx_errors++;
3749
3750                         if (bus->glomerr++ < 3) {
3751                                 brcmf_sdbrcm_rxfail(bus, true, true);
3752                         } else {
3753                                 bus->glomerr = 0;
3754                                 brcmf_sdbrcm_rxfail(bus, true, false);
3755                                 brcmu_pkt_buf_free_skb(bus->glom);
3756                                 bus->rxglomfail++;
3757                                 bus->glom = NULL;
3758                         }
3759                         return 0;
3760                 }
3761 #ifdef BCMDBG
3762                 if (BRCMF_GLOM_ON()) {
3763                         printk(KERN_DEBUG "SUPERFRAME:\n");
3764                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3765                                 pfirst->data, min_t(int, pfirst->len, 48));
3766                 }
3767 #endif
3768
3769                 /* Validate the superframe header */
3770                 dptr = (u8 *) (pfirst->data);
3771                 sublen = get_unaligned_le16(dptr);
3772                 check = get_unaligned_le16(dptr + sizeof(u16));
3773
3774                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3775                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3776                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3777                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3778                         BRCMF_INFO(("%s: nextlen too large (%d) seq %d\n",
3779                                     __func__, bus->nextlen, seq));
3780                         bus->nextlen = 0;
3781                 }
3782                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3783                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3784
3785                 errcode = 0;
3786                 if ((u16)~(sublen ^ check)) {
3787                         BRCMF_ERROR(("%s (superframe): HW hdr error: len/check "
3788                                      "0x%04x/0x%04x\n", __func__, sublen,
3789                                      check));
3790                         errcode = -1;
3791                 } else if (roundup(sublen, bus->blocksize) != dlen) {
3792                         BRCMF_ERROR(("%s (superframe): len 0x%04x, rounded "
3793                                      "0x%04x, expect 0x%04x\n",
3794                                      __func__, sublen,
3795                                      roundup(sublen, bus->blocksize), dlen));
3796                         errcode = -1;
3797                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
3798                            SDPCM_GLOM_CHANNEL) {
3799                         BRCMF_ERROR(("%s (superframe): bad channel %d\n",
3800                                    __func__,
3801                                    SDPCM_PACKET_CHANNEL(&dptr
3802                                                         [SDPCM_FRAMETAG_LEN])));
3803                         errcode = -1;
3804                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
3805                         BRCMF_ERROR(("%s (superframe): got 2nd descriptor?\n",
3806                                      __func__));
3807                         errcode = -1;
3808                 } else if ((doff < SDPCM_HDRLEN) ||
3809                            (doff > (pfirst->len - SDPCM_HDRLEN))) {
3810                         BRCMF_ERROR(("%s (superframe): Bad data offset %d: "
3811                                      "HW %d pkt %d min %d\n",
3812                                      __func__, doff, sublen,
3813                                      pfirst->len, SDPCM_HDRLEN));
3814                         errcode = -1;
3815                 }
3816
3817                 /* Check sequence number of superframe SW header */
3818                 if (rxseq != seq) {
3819                         BRCMF_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
3820                                     __func__, seq, rxseq));
3821                         bus->rx_badseq++;
3822                         rxseq = seq;
3823                 }
3824
3825                 /* Check window for sanity */
3826                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
3827                         BRCMF_ERROR(("%s: unlikely tx max %d with tx_seq %d\n",
3828                                      __func__, txmax, bus->tx_seq));
3829                         txmax = bus->tx_seq + 2;
3830                 }
3831                 bus->tx_max = txmax;
3832
3833                 /* Remove superframe header, remember offset */
3834                 skb_pull(pfirst, doff);
3835                 sfdoff = doff;
3836
3837                 /* Validate all the subframe headers */
3838                 for (num = 0, pnext = pfirst; pnext && !errcode;
3839                      num++, pnext = pnext->next) {
3840                         dptr = (u8 *) (pnext->data);
3841                         dlen = (u16) (pnext->len);
3842                         sublen = get_unaligned_le16(dptr);
3843                         check = get_unaligned_le16(dptr + sizeof(u16));
3844                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3845                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3846 #ifdef BCMDBG
3847                         if (BRCMF_GLOM_ON()) {
3848                                 printk(KERN_DEBUG "subframe:\n");
3849                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3850                                                      dptr, 32);
3851                         }
3852 #endif
3853
3854                         if ((u16)~(sublen ^ check)) {
3855                                 BRCMF_ERROR(("%s (subframe %d): HW hdr error: "
3856                                              "len/check 0x%04x/0x%04x\n",
3857                                              __func__, num, sublen, check));
3858                                 errcode = -1;
3859                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
3860                                 BRCMF_ERROR(("%s (subframe %d): length mismatch"
3861                                              ": len 0x%04x, expect 0x%04x\n",
3862                                              __func__, num, sublen, dlen));
3863                                 errcode = -1;
3864                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
3865                                    (chan != SDPCM_EVENT_CHANNEL)) {
3866                                 BRCMF_ERROR(("%s (subframe %d): bad channel"
3867                                              " %d\n", __func__, num, chan));
3868                                 errcode = -1;
3869                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
3870                                 BRCMF_ERROR(("%s (subframe %d): Bad data offset"
3871                                              " %d: HW %d min %d\n",
3872                                              __func__, num, doff, sublen,
3873                                              SDPCM_HDRLEN));
3874                                 errcode = -1;
3875                         }
3876                 }
3877
3878                 if (errcode) {
3879                         /* Terminate frame on error, request
3880                                  a couple retries */
3881                         if (bus->glomerr++ < 3) {
3882                                 /* Restore superframe header space */
3883                                 skb_push(pfirst, sfdoff);
3884                                 brcmf_sdbrcm_rxfail(bus, true, true);
3885                         } else {
3886                                 bus->glomerr = 0;
3887                                 brcmf_sdbrcm_rxfail(bus, true, false);
3888                                 brcmu_pkt_buf_free_skb(bus->glom);
3889                                 bus->rxglomfail++;
3890                                 bus->glom = NULL;
3891                         }
3892                         bus->nextlen = 0;
3893                         return 0;
3894                 }
3895
3896                 /* Basic SD framing looks ok - process each packet (header) */
3897                 save_pfirst = pfirst;
3898                 bus->glom = NULL;
3899                 plast = NULL;
3900
3901                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
3902                         pnext = pfirst->next;
3903                         pfirst->next = NULL;
3904
3905                         dptr = (u8 *) (pfirst->data);
3906                         sublen = get_unaligned_le16(dptr);
3907                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3908                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3909                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3910
3911                         BRCMF_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d "
3912                                     "chan %d seq %d\n",
3913                                     __func__, num, pfirst, pfirst->data,
3914                                     pfirst->len, sublen, chan, seq));
3915
3916                         /* precondition: chan == SDPCM_DATA_CHANNEL ||
3917                                          chan == SDPCM_EVENT_CHANNEL */
3918
3919                         if (rxseq != seq) {
3920                                 BRCMF_GLOM(("%s: rx_seq %d, expected %d\n",
3921                                             __func__, seq, rxseq));
3922                                 bus->rx_badseq++;
3923                                 rxseq = seq;
3924                         }
3925 #ifdef BCMDBG
3926                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
3927                                 printk(KERN_DEBUG "Rx Subframe Data:\n");
3928                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3929                                                      dptr, dlen);
3930                         }
3931 #endif
3932
3933                         __skb_trim(pfirst, sublen);
3934                         skb_pull(pfirst, doff);
3935
3936                         if (pfirst->len == 0) {
3937                                 brcmu_pkt_buf_free_skb(pfirst);
3938                                 if (plast) {
3939                                         plast->next = pnext;
3940                                 } else {
3941                                         save_pfirst = pnext;
3942                                 }
3943                                 continue;
3944                         } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pfirst)
3945                                         != 0) {
3946                                 BRCMF_ERROR(("%s: rx protocol error\n",
3947                                              __func__));
3948                                 bus->drvr->rx_errors++;
3949                                 brcmu_pkt_buf_free_skb(pfirst);
3950                                 if (plast) {
3951                                         plast->next = pnext;
3952                                 } else {
3953                                         save_pfirst = pnext;
3954                                 }
3955                                 continue;
3956                         }
3957
3958                         /* this packet will go up, link back into
3959                                  chain and count it */
3960                         pfirst->next = pnext;
3961                         plast = pfirst;
3962                         num++;
3963
3964 #ifdef BCMDBG
3965                         if (BRCMF_GLOM_ON()) {
3966                                 BRCMF_GLOM(("%s subframe %d to stack, %p"
3967                                             "(%p/%d) nxt/lnk %p/%p\n",
3968                                             __func__, num, pfirst, pfirst->data,
3969                                             pfirst->len, pfirst->next,
3970                                             pfirst->prev));
3971                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
3972                                                 pfirst->data,
3973                                                 min_t(int, pfirst->len, 32));
3974                         }
3975 #endif                          /* BCMDBG */
3976                 }
3977                 if (num) {
3978                         brcmf_sdbrcm_sdunlock(bus);
3979                         brcmf_rx_frame(bus->drvr, ifidx, save_pfirst, num);
3980                         brcmf_sdbrcm_sdlock(bus);
3981                 }
3982
3983                 bus->rxglomframes++;
3984                 bus->rxglompkts += num;
3985         }
3986         return num;
3987 }
3988
3989 /* Return true if there may be more frames to read */
3990 static uint
3991 brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
3992 {
3993         struct brcmf_sdio_card *card = bus->card;
3994
3995         u16 len, check; /* Extracted hardware header fields */
3996         u8 chan, seq, doff;     /* Extracted software header fields */
3997         u8 fcbits;              /* Extracted fcbits from software header */
3998
3999         struct sk_buff *pkt;            /* Packet for event or data frames */
4000         u16 pad;                /* Number of pad bytes to read */
4001         u16 rdlen;              /* Total number of bytes to read */
4002         u8 rxseq;               /* Next sequence number to expect */
4003         uint rxleft = 0;        /* Remaining number of frames allowed */
4004         int sdret;              /* Return code from calls */
4005         u8 txmax;               /* Maximum tx sequence offered */
4006         bool len_consistent;    /* Result of comparing readahead len and
4007                                          len from hw-hdr */
4008         u8 *rxbuf;
4009         int ifidx = 0;
4010         uint rxcount = 0;       /* Total frames read */
4011
4012 #if defined(BCMDBG) || defined(SDTEST)
4013         bool sdtest = false;    /* To limit message spew from test mode */
4014 #endif
4015
4016         BRCMF_TRACE(("%s: Enter\n", __func__));
4017
4018 #ifdef SDTEST
4019         /* Allow pktgen to override maxframes */
4020         if (bus->pktgen_count && (bus->pktgen_mode == BRCMF_PKTGEN_RECV)) {
4021                 maxframes = bus->pktgen_count;
4022                 sdtest = true;
4023         }
4024 #endif
4025
4026         /* Not finished unless we encounter no more frames indication */
4027         *finished = false;
4028
4029         for (rxseq = bus->rx_seq, rxleft = maxframes;
4030              !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
4031              rxseq++, rxleft--) {
4032
4033                 /* Handle glomming separately */
4034                 if (bus->glom || bus->glomd) {
4035                         u8 cnt;
4036                         BRCMF_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
4037                                     __func__, bus->glomd, bus->glom));
4038                         cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
4039                         BRCMF_GLOM(("%s: rxglom returned %d\n", __func__, cnt));
4040                         rxseq += cnt - 1;
4041                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
4042                         continue;
4043                 }
4044
4045                 /* Try doing single read if we can */
4046                 if (brcmf_readahead && bus->nextlen) {
4047                         u16 nextlen = bus->nextlen;
4048                         bus->nextlen = 0;
4049
4050                         if (bus->bus == SPI_BUS) {
4051                                 rdlen = len = nextlen;
4052                         } else {
4053                                 rdlen = len = nextlen << 4;
4054
4055                                 /* Pad read to blocksize for efficiency */
4056                                 if (bus->roundup && bus->blocksize
4057                                     && (rdlen > bus->blocksize)) {
4058                                         pad =
4059                                             bus->blocksize -
4060                                             (rdlen % bus->blocksize);
4061                                         if ((pad <= bus->roundup)
4062                                             && (pad < bus->blocksize)
4063                                             && ((rdlen + pad + firstread) <
4064                                                 MAX_RX_DATASZ))
4065                                                 rdlen += pad;
4066                                 } else if (rdlen % BRCMF_SDALIGN) {
4067                                         rdlen +=
4068                                             BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
4069                                 }
4070                         }
4071
4072                         /* We use bus->rxctl buffer in WinXP for initial
4073                          * control pkt receives.
4074                          * Later we use buffer-poll for data as well
4075                          * as control packets.
4076                          * This is required because dhd receives full
4077                          * frame in gSPI unlike SDIO.
4078                          * After the frame is received we have to
4079                          * distinguish whether it is data
4080                          * or non-data frame.
4081                          */
4082                         /* Allocate a packet buffer */
4083                         pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
4084                         if (!pkt) {
4085                                 if (bus->bus == SPI_BUS) {
4086                                         bus->usebufpool = false;
4087                                         bus->rxctl = bus->rxbuf;
4088                                         if (brcmf_alignctl) {
4089                                                 bus->rxctl += firstread;
4090                                                 pad = ((unsigned long)bus->rxctl %
4091                                                       BRCMF_SDALIGN);
4092                                                 if (pad)
4093                                                         bus->rxctl +=
4094                                                             (BRCMF_SDALIGN - pad);
4095                                                 bus->rxctl -= firstread;
4096                                         }
4097                                         rxbuf = bus->rxctl;
4098                                         /* Read the entire frame */
4099                                         sdret = brcmf_sdcard_recv_buf(card,
4100                                                    brcmf_sdcard_cur_sbwad(card),
4101                                                    SDIO_FUNC_2, F2SYNC,
4102                                                    rxbuf, rdlen,
4103                                                    NULL, NULL, NULL);
4104                                         bus->f2rxdata++;
4105
4106                                         /* Control frame failures need
4107                                          retransmission */
4108                                         if (sdret < 0) {
4109                                                 BRCMF_ERROR(("%s: read %d "
4110                                                              "control bytes "
4111                                                              "failed: %d\n",
4112                                                              __func__,
4113                                                              rdlen, sdret));
4114                                                 /* dhd.rx_ctlerrs is higher */
4115                                                 bus->rxc_errors++;
4116                                                 brcmf_sdbrcm_rxfail(bus, true,
4117                                                        (bus->bus ==
4118                                                         SPI_BUS) ? false
4119                                                        : true);
4120                                                 continue;
4121                                         }
4122                                 } else {
4123                                         /* Give up on data,
4124                                         request rtx of events */
4125                                         BRCMF_ERROR(("%s (nextlen): "
4126                                                      "brcmu_pkt_buf_get_skb "
4127                                                      "failed:"
4128                                                      " len %d rdlen %d expected"
4129                                                      " rxseq %d\n", __func__,
4130                                                      len, rdlen, rxseq));
4131                                         continue;
4132                                 }
4133                         } else {
4134                                 if (bus->bus == SPI_BUS)
4135                                         bus->usebufpool = true;
4136
4137                                 PKTALIGN(pkt, rdlen, BRCMF_SDALIGN);
4138                                 rxbuf = (u8 *) (pkt->data);
4139                                 /* Read the entire frame */
4140                                 sdret = brcmf_sdcard_recv_buf(card,
4141                                                 brcmf_sdcard_cur_sbwad(card),
4142                                                 SDIO_FUNC_2, F2SYNC,
4143                                                 rxbuf, rdlen,
4144                                                 pkt, NULL, NULL);
4145                                 bus->f2rxdata++;
4146
4147                                 if (sdret < 0) {
4148                                         BRCMF_ERROR(("%s (nextlen): read %d"
4149                                                      " bytes failed: %d\n",
4150                                                      __func__, rdlen, sdret));
4151                                         brcmu_pkt_buf_free_skb(pkt);
4152                                         bus->drvr->rx_errors++;
4153                                         /* Force retry w/normal header read.
4154                                          * Don't attempt NAK for
4155                                          * gSPI
4156                                          */
4157                                         brcmf_sdbrcm_rxfail(bus, true,
4158                                                        (bus->bus ==
4159                                                         SPI_BUS) ? false :
4160                                                        true);
4161                                         continue;
4162                                 }
4163                         }
4164
4165                         /* Now check the header */
4166                         memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
4167
4168                         /* Extract hardware header fields */
4169                         len = get_unaligned_le16(bus->rxhdr);
4170                         check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
4171
4172                         /* All zeros means readahead info was bad */
4173                         if (!(len | check)) {
4174                                 BRCMF_INFO(("%s (nextlen): read zeros in HW "
4175                                             "header???\n", __func__));
4176                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4177                                 continue;
4178                         }
4179
4180                         /* Validate check bytes */
4181                         if ((u16)~(len ^ check)) {
4182                                 BRCMF_ERROR(("%s (nextlen): HW hdr error:"
4183                                              " nextlen/len/check"
4184                                              " 0x%04x/0x%04x/0x%04x\n",
4185                                              __func__, nextlen, len, check));
4186                                 bus->rx_badhdr++;
4187                                 brcmf_sdbrcm_rxfail(bus, false, false);
4188                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4189                                 continue;
4190                         }
4191
4192                         /* Validate frame length */
4193                         if (len < SDPCM_HDRLEN) {
4194                                 BRCMF_ERROR(("%s (nextlen): HW hdr length "
4195                                              "invalid: %d\n", __func__, len));
4196                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4197                                 continue;
4198                         }
4199
4200                         /* Check for consistency withreadahead info */
4201                         len_consistent = (nextlen != (roundup(len, 16) >> 4));
4202                         if (len_consistent) {
4203                                 /* Mismatch, force retry w/normal
4204                                         header (may be >4K) */
4205                                 BRCMF_ERROR(("%s (nextlen): mismatch, "
4206                                              "nextlen %d len %d rnd %d; "
4207                                              "expected rxseq %d\n",
4208                                              __func__, nextlen,
4209                                              len, roundup(len, 16), rxseq));
4210                                 brcmf_sdbrcm_rxfail(bus, true,
4211                                                   bus->bus != SPI_BUS);
4212                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4213                                 continue;
4214                         }
4215
4216                         /* Extract software header fields */
4217                         chan = SDPCM_PACKET_CHANNEL(
4218                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4219                         seq = SDPCM_PACKET_SEQUENCE(
4220                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4221                         doff = SDPCM_DOFFSET_VALUE(
4222                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4223                         txmax = SDPCM_WINDOW_VALUE(
4224                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4225
4226                         bus->nextlen =
4227                             bus->rxhdr[SDPCM_FRAMETAG_LEN +
4228                                        SDPCM_NEXTLEN_OFFSET];
4229                         if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
4230                                 BRCMF_INFO(("%s (nextlen): got frame w/nextlen"
4231                                             " too large (%d), seq %d\n",
4232                                             __func__, bus->nextlen, seq));
4233                                 bus->nextlen = 0;
4234                         }
4235
4236                         bus->drvr->rx_readahead_cnt++;
4237
4238                         /* Handle Flow Control */
4239                         fcbits = SDPCM_FCMASK_VALUE(
4240                                         &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4241
4242                         if (bus->flowcontrol != fcbits) {
4243                                 if (~bus->flowcontrol & fcbits)
4244                                         bus->fc_xoff++;
4245
4246                                 if (bus->flowcontrol & ~fcbits)
4247                                         bus->fc_xon++;
4248
4249                                 bus->fc_rcvd++;
4250                                 bus->flowcontrol = fcbits;
4251                         }
4252
4253                         /* Check and update sequence number */
4254                         if (rxseq != seq) {
4255                                 BRCMF_INFO(("%s (nextlen): rx_seq %d, expected "
4256                                             "%d\n", __func__, seq, rxseq));
4257                                 bus->rx_badseq++;
4258                                 rxseq = seq;
4259                         }
4260
4261                         /* Check window for sanity */
4262                         if ((u8) (txmax - bus->tx_seq) > 0x40) {
4263                                 BRCMF_ERROR(("%s: got unlikely tx max %d with "
4264                                              "tx_seq %d\n",
4265                                              __func__, txmax, bus->tx_seq));
4266                                 txmax = bus->tx_seq + 2;
4267                         }
4268                         bus->tx_max = txmax;
4269
4270 #ifdef BCMDBG
4271                         if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
4272                                 printk(KERN_DEBUG "Rx Data:\n");
4273                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4274                                                      rxbuf, len);
4275                         } else if (BRCMF_HDRS_ON()) {
4276                                 printk(KERN_DEBUG "RxHdr:\n");
4277                                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4278                                                      bus->rxhdr, SDPCM_HDRLEN);
4279                         }
4280 #endif
4281
4282                         if (chan == SDPCM_CONTROL_CHANNEL) {
4283                                 if (bus->bus == SPI_BUS) {
4284                                         brcmf_sdbrcm_read_control(bus, rxbuf,
4285                                                                   len, doff);
4286                                 } else {
4287                                         BRCMF_ERROR(("%s (nextlen): readahead"
4288                                                      " on control packet %d?\n",
4289                                                      __func__, seq));
4290                                         /* Force retry w/normal header read */
4291                                         bus->nextlen = 0;
4292                                         brcmf_sdbrcm_rxfail(bus, false, true);
4293                                 }
4294                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4295                                 continue;
4296                         }
4297
4298                         if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
4299                                 BRCMF_ERROR(("Received %d bytes on %d channel."
4300                                              " Running out of " "rx pktbuf's or"
4301                                              " not yet malloced.\n",
4302                                              len, chan));
4303                                 continue;
4304                         }
4305
4306                         /* Validate data offset */
4307                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4308                                 BRCMF_ERROR(("%s (nextlen): bad data offset %d:"
4309                                              " HW len %d min %d\n", __func__,
4310                                              doff, len, SDPCM_HDRLEN));
4311                                 brcmf_sdbrcm_rxfail(bus, false, false);
4312                                 brcmf_sdbrcm_pktfree2(bus, pkt);
4313                                 continue;
4314                         }
4315
4316                         /* All done with this one -- now deliver the packet */
4317                         goto deliver;
4318                 }
4319                 /* gSPI frames should not be handled in fractions */
4320                 if (bus->bus == SPI_BUS)
4321                         break;
4322
4323                 /* Read frame header (hardware and software) */
4324                 sdret = brcmf_sdcard_recv_buf(card,
4325                                 brcmf_sdcard_cur_sbwad(card),
4326                                 SDIO_FUNC_2, F2SYNC, bus->rxhdr, firstread,
4327                                 NULL, NULL, NULL);
4328                 bus->f2rxhdrs++;
4329
4330                 if (sdret < 0) {
4331                         BRCMF_ERROR(("%s: RXHEADER FAILED: %d\n", __func__,
4332                                      sdret));
4333                         bus->rx_hdrfail++;
4334                         brcmf_sdbrcm_rxfail(bus, true, true);
4335                         continue;
4336                 }
4337 #ifdef BCMDBG
4338                 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
4339                         printk(KERN_DEBUG "RxHdr:\n");
4340                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4341                                              bus->rxhdr, SDPCM_HDRLEN);
4342                 }
4343 #endif
4344
4345                 /* Extract hardware header fields */
4346                 len = get_unaligned_le16(bus->rxhdr);
4347                 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
4348
4349                 /* All zeros means no more frames */
4350                 if (!(len | check)) {
4351                         *finished = true;
4352                         break;
4353                 }
4354
4355                 /* Validate check bytes */
4356                 if ((u16) ~(len ^ check)) {
4357                         BRCMF_ERROR(("%s: HW hdr err: len/check "
4358                                      "0x%04x/0x%04x\n", __func__, len, check));
4359                         bus->rx_badhdr++;
4360                         brcmf_sdbrcm_rxfail(bus, false, false);
4361                         continue;
4362                 }
4363
4364                 /* Validate frame length */
4365                 if (len < SDPCM_HDRLEN) {
4366                         BRCMF_ERROR(("%s: HW hdr length invalid: %d\n",
4367                                      __func__, len));
4368                         continue;
4369                 }
4370
4371                 /* Extract software header fields */
4372                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4373                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4374                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4375                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4376
4377                 /* Validate data offset */
4378                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4379                         BRCMF_ERROR(("%s: Bad data offset %d: HW len %d,"
4380                                      " min %d seq %d\n", __func__, doff,
4381                                      len, SDPCM_HDRLEN, seq));
4382                         bus->rx_badhdr++;
4383                         brcmf_sdbrcm_rxfail(bus, false, false);
4384                         continue;
4385                 }
4386
4387                 /* Save the readahead length if there is one */
4388                 bus->nextlen =
4389                     bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
4390                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
4391                         BRCMF_INFO(("%s (nextlen): got frame w/nextlen too"
4392                                     " large (%d), seq %d\n",
4393                                     __func__, bus->nextlen, seq));
4394                         bus->nextlen = 0;
4395                 }
4396
4397                 /* Handle Flow Control */
4398                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4399
4400                 if (bus->flowcontrol != fcbits) {
4401                         if (~bus->flowcontrol & fcbits)
4402                                 bus->fc_xoff++;
4403
4404                         if (bus->flowcontrol & ~fcbits)
4405                                 bus->fc_xon++;
4406
4407                         bus->fc_rcvd++;
4408                         bus->flowcontrol = fcbits;
4409                 }
4410
4411                 /* Check and update sequence number */
4412                 if (rxseq != seq) {
4413                         BRCMF_INFO(("%s: rx_seq %d, expected %d\n", __func__,
4414                                     seq, rxseq));
4415                         bus->rx_badseq++;
4416                         rxseq = seq;
4417                 }
4418
4419                 /* Check window for sanity */
4420                 if ((u8) (txmax - bus->tx_seq) > 0x40) {
4421                         BRCMF_ERROR(("%s: unlikely tx max %d with tx_seq %d\n",
4422                                      __func__, txmax, bus->tx_seq));
4423                         txmax = bus->tx_seq + 2;
4424                 }
4425                 bus->tx_max = txmax;
4426
4427                 /* Call a separate function for control frames */
4428                 if (chan == SDPCM_CONTROL_CHANNEL) {
4429                         brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
4430                         continue;
4431                 }
4432
4433                 /* precondition: chan is either SDPCM_DATA_CHANNEL,
4434                    SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
4435                    SDPCM_GLOM_CHANNEL */
4436
4437                 /* Length to read */
4438                 rdlen = (len > firstread) ? (len - firstread) : 0;
4439
4440                 /* May pad read to blocksize for efficiency */
4441                 if (bus->roundup && bus->blocksize &&
4442                         (rdlen > bus->blocksize)) {
4443                         pad = bus->blocksize - (rdlen % bus->blocksize);
4444                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
4445                             ((rdlen + pad + firstread) < MAX_RX_DATASZ))
4446                                 rdlen += pad;
4447                 } else if (rdlen % BRCMF_SDALIGN) {
4448                         rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
4449                 }
4450
4451                 /* Satisfy length-alignment requirements */
4452                 if (forcealign && (rdlen & (ALIGNMENT - 1)))
4453                         rdlen = roundup(rdlen, ALIGNMENT);
4454
4455                 if ((rdlen + firstread) > MAX_RX_DATASZ) {
4456                         /* Too long -- skip this frame */
4457                         BRCMF_ERROR(("%s: too long: len %d rdlen %d\n",
4458                                      __func__, len, rdlen));
4459                         bus->drvr->rx_errors++;
4460                         bus->rx_toolong++;
4461                         brcmf_sdbrcm_rxfail(bus, false, false);
4462                         continue;
4463                 }
4464
4465                 pkt = brcmu_pkt_buf_get_skb(rdlen + firstread + BRCMF_SDALIGN);
4466                 if (!pkt) {
4467                         /* Give up on data, request rtx of events */
4468                         BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed:"
4469                                      " rdlen %d chan %d\n", __func__, rdlen,
4470                                      chan));
4471                         bus->drvr->rx_dropped++;
4472                         brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
4473                         continue;
4474                 }
4475
4476                 /* Leave room for what we already read, and align remainder */
4477                 skb_pull(pkt, firstread);
4478                 PKTALIGN(pkt, rdlen, BRCMF_SDALIGN);
4479
4480                 /* Read the remaining frame data */
4481                 sdret = brcmf_sdcard_recv_buf(card,
4482                                 brcmf_sdcard_cur_sbwad(card),
4483                                 SDIO_FUNC_2, F2SYNC, ((u8 *) (pkt->data)),
4484                                 rdlen, pkt, NULL, NULL);
4485                 bus->f2rxdata++;
4486
4487                 if (sdret < 0) {
4488                         BRCMF_ERROR(("%s: read %d %s bytes failed: %d\n",
4489                                      __func__, rdlen,
4490                                      ((chan == SDPCM_EVENT_CHANNEL) ? "event"
4491                                      : ((chan == SDPCM_DATA_CHANNEL) ? "data"
4492                                      : "test")), sdret));
4493                         brcmu_pkt_buf_free_skb(pkt);
4494                         bus->drvr->rx_errors++;
4495                         brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
4496                         continue;
4497                 }
4498
4499                 /* Copy the already-read portion */
4500                 skb_push(pkt, firstread);
4501                 memcpy(pkt->data, bus->rxhdr, firstread);
4502
4503 #ifdef BCMDBG
4504                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
4505                         printk(KERN_DEBUG "Rx Data:\n");
4506                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
4507                                              pkt->data, len);
4508                 }
4509 #endif
4510
4511 deliver:
4512                 /* Save superframe descriptor and allocate packet frame */
4513                 if (chan == SDPCM_GLOM_CHANNEL) {
4514                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
4515                                 BRCMF_GLOM(("%s: glom descriptor, %d bytes:\n",
4516                                             __func__, len));
4517 #ifdef BCMDBG
4518                                 if (BRCMF_GLOM_ON()) {
4519                                         printk(KERN_DEBUG "Glom Data:\n");
4520                                         print_hex_dump_bytes("",
4521                                                              DUMP_PREFIX_OFFSET,
4522                                                              pkt->data, len);
4523                                 }
4524 #endif
4525                                 __skb_trim(pkt, len);
4526                                 skb_pull(pkt, SDPCM_HDRLEN);
4527                                 bus->glomd = pkt;
4528                         } else {
4529                                 BRCMF_ERROR(("%s: glom superframe w/o "
4530                                              "descriptor!\n", __func__));
4531                                 brcmf_sdbrcm_rxfail(bus, false, false);
4532                         }
4533                         continue;
4534                 }
4535
4536                 /* Fill in packet len and prio, deliver upward */
4537                 __skb_trim(pkt, len);
4538                 skb_pull(pkt, doff);
4539
4540 #ifdef SDTEST
4541                 /* Test channel packets are processed separately */
4542                 if (chan == SDPCM_TEST_CHANNEL) {
4543                         brcmf_sdbrcm_checkdied(bus, pkt, seq);
4544                         continue;
4545                 }
4546 #endif                          /* SDTEST */
4547
4548                 if (pkt->len == 0) {
4549                         brcmu_pkt_buf_free_skb(pkt);
4550                         continue;
4551                 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
4552                         BRCMF_ERROR(("%s: rx protocol error\n", __func__));
4553                         brcmu_pkt_buf_free_skb(pkt);
4554                         bus->drvr->rx_errors++;
4555                         continue;
4556                 }
4557
4558                 /* Unlock during rx call */
4559                 brcmf_sdbrcm_sdunlock(bus);
4560                 brcmf_rx_frame(bus->drvr, ifidx, pkt, 1);
4561                 brcmf_sdbrcm_sdlock(bus);
4562         }
4563         rxcount = maxframes - rxleft;
4564 #ifdef BCMDBG
4565         /* Message if we hit the limit */
4566         if (!rxleft && !sdtest)
4567                 BRCMF_DATA(("%s: hit rx limit of %d frames\n", __func__,
4568                             maxframes));
4569         else
4570 #endif                          /* BCMDBG */
4571                 BRCMF_DATA(("%s: processed %d frames\n", __func__, rxcount));
4572         /* Back off rxseq if awaiting rtx, update rx_seq */
4573         if (bus->rxskip)
4574                 rxseq--;
4575         bus->rx_seq = rxseq;
4576
4577         return rxcount;
4578 }
4579
4580 static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
4581 {
4582         u32 intstatus = 0;
4583         u32 hmb_data;
4584         u8 fcbits;
4585         uint retries = 0;
4586
4587         BRCMF_TRACE(("%s: Enter\n", __func__));
4588
4589         /* Read mailbox data and ack that we did so */
4590         r_sdreg32(bus, &hmb_data,
4591                   offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
4592
4593         if (retries <= retry_limit)
4594                 w_sdreg32(bus, SMB_INT_ACK,
4595                           offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
4596         bus->f1regdata += 2;
4597
4598         /* Dongle recomposed rx frames, accept them again */
4599         if (hmb_data & HMB_DATA_NAKHANDLED) {
4600                 BRCMF_INFO(("Dongle reports NAK handled, expect rtx of %d\n",
4601                             bus->rx_seq));
4602                 if (!bus->rxskip)
4603                         BRCMF_ERROR(("%s: unexpected NAKHANDLED!\n", __func__));
4604
4605                 bus->rxskip = false;
4606                 intstatus |= I_HMB_FRAME_IND;
4607         }
4608
4609         /*
4610          * DEVREADY does not occur with gSPI.
4611          */
4612         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
4613                 bus->sdpcm_ver =
4614                     (hmb_data & HMB_DATA_VERSION_MASK) >>
4615                     HMB_DATA_VERSION_SHIFT;
4616                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
4617                         BRCMF_ERROR(("Version mismatch, dongle reports %d, "
4618                                      "expecting %d\n",
4619                                      bus->sdpcm_ver, SDPCM_PROT_VERSION));
4620                 else
4621                         BRCMF_INFO(("Dongle ready, protocol version %d\n",
4622                                     bus->sdpcm_ver));
4623         }
4624
4625         /*
4626          * Flow Control has been moved into the RX headers and this out of band
4627          * method isn't used any more.
4628          * remaining backward compatible with older dongles.
4629          */
4630         if (hmb_data & HMB_DATA_FC) {
4631                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
4632                                                         HMB_DATA_FCDATA_SHIFT;
4633
4634                 if (fcbits & ~bus->flowcontrol)
4635                         bus->fc_xoff++;
4636
4637                 if (bus->flowcontrol & ~fcbits)
4638                         bus->fc_xon++;
4639
4640                 bus->fc_rcvd++;
4641                 bus->flowcontrol = fcbits;
4642         }
4643
4644         /* Shouldn't be any others */
4645         if (hmb_data & ~(HMB_DATA_DEVREADY |
4646                          HMB_DATA_NAKHANDLED |
4647                          HMB_DATA_FC |
4648                          HMB_DATA_FWREADY |
4649                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK)) {
4650                 BRCMF_ERROR(("Unknown mailbox data content: 0x%02x\n",
4651                              hmb_data));
4652         }
4653
4654         return intstatus;
4655 }
4656
4657 static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
4658 {
4659         struct brcmf_sdio_card *card = bus->card;
4660         u32 intstatus, newstatus = 0;
4661         uint retries = 0;
4662         uint rxlimit = brcmf_rxbound;   /* Rx frames to read before resched */
4663         uint txlimit = brcmf_txbound;   /* Tx frames to send before resched */
4664         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
4665         bool rxdone = true;     /* Flag for no more read data */
4666         bool resched = false;   /* Flag indicating resched wanted */
4667
4668         BRCMF_TRACE(("%s: Enter\n", __func__));
4669
4670         /* Start with leftover status bits */
4671         intstatus = bus->intstatus;
4672
4673         brcmf_sdbrcm_sdlock(bus);
4674
4675         /* If waiting for HTAVAIL, check status */
4676         if (bus->clkstate == CLK_PENDING) {
4677                 int err;
4678                 u8 clkctl, devctl = 0;
4679
4680 #ifdef BCMDBG
4681                 /* Check for inconsistent device control */
4682                 devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4683                                                SBSDIO_DEVICE_CTL, &err);
4684                 if (err) {
4685                         BRCMF_ERROR(("%s: error reading DEVCTL: %d\n",
4686                                      __func__, err));
4687                         bus->drvr->busstate = BRCMF_BUS_DOWN;
4688                 }
4689 #endif                          /* BCMDBG */
4690
4691                 /* Read CSR, if clock on switch to AVAIL, else ignore */
4692                 clkctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4693                                                SBSDIO_FUNC1_CHIPCLKCSR, &err);
4694                 if (err) {
4695                         BRCMF_ERROR(("%s: error reading CSR: %d\n", __func__,
4696                                      err));
4697                         bus->drvr->busstate = BRCMF_BUS_DOWN;
4698                 }
4699
4700                 BRCMF_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
4701                             devctl, clkctl));
4702
4703                 if (SBSDIO_HTAV(clkctl)) {
4704                         devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4705                                                        SBSDIO_DEVICE_CTL, &err);
4706                         if (err) {
4707                                 BRCMF_ERROR(("%s: error reading DEVCTL: %d\n",
4708                                              __func__, err));
4709                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
4710                         }
4711                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
4712                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
4713                                 SBSDIO_DEVICE_CTL, devctl, &err);
4714                         if (err) {
4715                                 BRCMF_ERROR(("%s: error writing DEVCTL: %d\n",
4716                                              __func__, err));
4717                                 bus->drvr->busstate = BRCMF_BUS_DOWN;
4718                         }
4719                         bus->clkstate = CLK_AVAIL;
4720                 } else {
4721                         goto clkwait;
4722                 }
4723         }
4724
4725         BUS_WAKE(bus);
4726
4727         /* Make sure backplane clock is on */
4728         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
4729         if (bus->clkstate == CLK_PENDING)
4730                 goto clkwait;
4731
4732         /* Pending interrupt indicates new device status */
4733         if (bus->ipend) {
4734                 bus->ipend = false;
4735                 r_sdreg32(bus, &newstatus,
4736                           offsetof(struct sdpcmd_regs, intstatus), &retries);
4737                 bus->f1regdata++;
4738                 if (brcmf_sdcard_regfail(bus->card))
4739                         newstatus = 0;
4740                 newstatus &= bus->hostintmask;
4741                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
4742                 if (newstatus) {
4743                         w_sdreg32(bus, newstatus,
4744                                   offsetof(struct sdpcmd_regs, intstatus),
4745                                   &retries);
4746                         bus->f1regdata++;
4747                 }
4748         }
4749
4750         /* Merge new bits with previous */
4751         intstatus |= newstatus;
4752         bus->intstatus = 0;
4753
4754         /* Handle flow-control change: read new state in case our ack
4755          * crossed another change interrupt.  If change still set, assume
4756          * FC ON for safety, let next loop through do the debounce.
4757          */
4758         if (intstatus & I_HMB_FC_CHANGE) {
4759                 intstatus &= ~I_HMB_FC_CHANGE;
4760                 w_sdreg32(bus, I_HMB_FC_CHANGE,
4761                           offsetof(struct sdpcmd_regs, intstatus), &retries);
4762
4763                 r_sdreg32(bus, &newstatus,
4764                           offsetof(struct sdpcmd_regs, intstatus), &retries);
4765                 bus->f1regdata += 2;
4766                 bus->fcstate =
4767                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
4768                 intstatus |= (newstatus & bus->hostintmask);
4769         }
4770
4771         /* Handle host mailbox indication */
4772         if (intstatus & I_HMB_HOST_INT) {
4773                 intstatus &= ~I_HMB_HOST_INT;
4774                 intstatus |= brcmf_sdbrcm_hostmail(bus);
4775         }
4776
4777         /* Generally don't ask for these, can get CRC errors... */
4778         if (intstatus & I_WR_OOSYNC) {
4779                 BRCMF_ERROR(("Dongle reports WR_OOSYNC\n"));
4780                 intstatus &= ~I_WR_OOSYNC;
4781         }
4782
4783         if (intstatus & I_RD_OOSYNC) {
4784                 BRCMF_ERROR(("Dongle reports RD_OOSYNC\n"));
4785                 intstatus &= ~I_RD_OOSYNC;
4786         }
4787
4788         if (intstatus & I_SBINT) {
4789                 BRCMF_ERROR(("Dongle reports SBINT\n"));
4790                 intstatus &= ~I_SBINT;
4791         }
4792
4793         /* Would be active due to wake-wlan in gSPI */
4794         if (intstatus & I_CHIPACTIVE) {
4795                 BRCMF_INFO(("Dongle reports CHIPACTIVE\n"));
4796                 intstatus &= ~I_CHIPACTIVE;
4797         }
4798
4799         /* Ignore frame indications if rxskip is set */
4800         if (bus->rxskip)
4801                 intstatus &= ~I_HMB_FRAME_IND;
4802
4803         /* On frame indication, read available frames */
4804         if (PKT_AVAILABLE()) {
4805                 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
4806                 if (rxdone || bus->rxskip)
4807                         intstatus &= ~I_HMB_FRAME_IND;
4808                 rxlimit -= min(framecnt, rxlimit);
4809         }
4810
4811         /* Keep still-pending events for next scheduling */
4812         bus->intstatus = intstatus;
4813
4814 clkwait:
4815         /* Re-enable interrupts to detect new device events (mailbox, rx frame)
4816          * or clock availability.  (Allows tx loop to check ipend if desired.)
4817          * (Unless register access seems hosed, as we may not be able to ACK...)
4818          */
4819         if (bus->intr && bus->intdis && !brcmf_sdcard_regfail(card)) {
4820                 BRCMF_INTR(("%s: enable SDIO interrupts, rxdone %d"
4821                             " framecnt %d\n", __func__, rxdone, framecnt));
4822                 bus->intdis = false;
4823                 brcmf_sdcard_intr_enable(card);
4824         }
4825
4826         if (DATAOK(bus) && bus->ctrl_frame_stat &&
4827                 (bus->clkstate == CLK_AVAIL)) {
4828                 int ret, i;
4829
4830                 ret = brcmf_sdbrcm_send_buf(bus, brcmf_sdcard_cur_sbwad(card),
4831                         SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
4832                         (u32) bus->ctrl_frame_len, NULL, NULL, NULL);
4833
4834                 if (ret < 0) {
4835                         /* On failure, abort the command and
4836                                 terminate the frame */
4837                         BRCMF_INFO(("%s: sdio error %d, abort command and "
4838                                     "terminate frame.\n", __func__, ret));
4839                         bus->tx_sderrs++;
4840
4841                         brcmf_sdcard_abort(card, SDIO_FUNC_2);
4842
4843                         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
4844                                          SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
4845                                          NULL);
4846                         bus->f1regdata++;
4847
4848                         for (i = 0; i < 3; i++) {
4849                                 u8 hi, lo;
4850                                 hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4851                                                      SBSDIO_FUNC1_WFRAMEBCHI,
4852                                                      NULL);
4853                                 lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
4854                                                      SBSDIO_FUNC1_WFRAMEBCLO,
4855                                                      NULL);
4856                                 bus->f1regdata += 2;
4857                                 if ((hi == 0) && (lo == 0))
4858                                         break;
4859                         }
4860
4861                 }
4862                 if (ret == 0)
4863                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
4864
4865                 BRCMF_INFO(("Return_dpc value is : %d\n", ret));
4866                 bus->ctrl_frame_stat = false;
4867                 brcmf_sdbrcm_wait_event_wakeup(bus);
4868         }
4869         /* Send queued frames (limit 1 if rx may still be pending) */
4870         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
4871                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
4872                  && DATAOK(bus)) {
4873                 framecnt = rxdone ? txlimit : min(txlimit, brcmf_txminmax);
4874                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
4875                 txlimit -= framecnt;
4876         }
4877
4878         /* Resched if events or tx frames are pending,
4879                  else await next interrupt */
4880         /* On failed register access, all bets are off:
4881                  no resched or interrupts */
4882         if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
4883             brcmf_sdcard_regfail(card)) {
4884                 BRCMF_ERROR(("%s: failed backplane access over SDIO, halting "
4885                              "operation %d\n", __func__,
4886                              brcmf_sdcard_regfail(card)));
4887                 bus->drvr->busstate = BRCMF_BUS_DOWN;
4888                 bus->intstatus = 0;
4889         } else if (bus->clkstate == CLK_PENDING) {
4890                 BRCMF_INFO(("%s: rescheduled due to CLK_PENDING awaiting "
4891                             "I_CHIPACTIVE interrupt\n", __func__));
4892                 resched = true;
4893         } else if (bus->intstatus || bus->ipend ||
4894                 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
4895                  && DATAOK(bus)) || PKT_AVAILABLE()) {
4896                 resched = true;
4897         }
4898
4899         bus->dpc_sched = resched;
4900
4901         /* If we're done for now, turn off clock request. */
4902         if ((bus->clkstate != CLK_PENDING)
4903             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
4904                 bus->activity = false;
4905                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
4906         }
4907
4908         brcmf_sdbrcm_sdunlock(bus);
4909
4910         return resched;
4911 }
4912
4913 void brcmf_sdbrcm_isr(void *arg)
4914 {
4915         struct brcmf_bus *bus = (struct brcmf_bus *) arg;
4916         struct brcmf_sdio_card *card;
4917
4918         BRCMF_TRACE(("%s: Enter\n", __func__));
4919
4920         if (!bus) {
4921                 BRCMF_ERROR(("%s : bus is null pointer , exit\n", __func__));
4922                 return;
4923         }
4924         card = bus->card;
4925
4926         if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
4927                 BRCMF_ERROR(("%s : bus is down. we have nothing to do\n",
4928                            __func__));
4929                 return;
4930         }
4931         /* Count the interrupt call */
4932         bus->intrcount++;
4933         bus->ipend = true;
4934
4935         /* Shouldn't get this interrupt if we're sleeping? */
4936         if (bus->sleeping) {
4937                 BRCMF_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
4938                 return;
4939         }
4940
4941         /* Disable additional interrupts (is this needed now)? */
4942         if (bus->intr)
4943                 BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
4944         else
4945                 BRCMF_ERROR(("brcmf_sdbrcm_isr() w/o interrupt configured!\n"));
4946
4947         brcmf_sdcard_intr_disable(card);
4948         bus->intdis = true;
4949
4950 #if defined(SDIO_ISR_THREAD)
4951         BRCMF_TRACE(("Calling brcmf_sdbrcm_dpc() from %s\n", __func__));
4952         while (brcmf_sdbrcm_dpc(bus))
4953                 ;
4954 #else
4955         bus->dpc_sched = true;
4956         brcmf_sdbrcm_sched_dpc(bus);
4957 #endif
4958
4959 }
4960
4961 #ifdef SDTEST
4962 static void brcmf_sdbrcm_pktgen_init(struct brcmf_bus *bus)
4963 {
4964         /* Default to specified length, or full range */
4965         if (brcmf_pktgen_len) {
4966                 bus->pktgen_maxlen = min(brcmf_pktgen_len,
4967                                          BRCMF_MAX_PKTGEN_LEN);
4968                 bus->pktgen_minlen = bus->pktgen_maxlen;
4969         } else {
4970                 bus->pktgen_maxlen = BRCMF_MAX_PKTGEN_LEN;
4971                 bus->pktgen_minlen = 0;
4972         }
4973         bus->pktgen_len = (u16) bus->pktgen_minlen;
4974
4975         /* Default to per-watchdog burst with 10s print time */
4976         bus->pktgen_freq = 1;
4977         bus->pktgen_print = 10000 / brcmf_watchdog_ms;
4978         bus->pktgen_count = (brcmf_pktgen * brcmf_watchdog_ms + 999) / 1000;
4979
4980         /* Default to echo mode */
4981         bus->pktgen_mode = BRCMF_PKTGEN_ECHO;
4982         bus->pktgen_stop = 1;
4983 }
4984
4985 static void brcmf_sdbrcm_pktgen(struct brcmf_bus *bus)
4986 {
4987         struct sk_buff *pkt;
4988         u8 *data;
4989         uint pktcount;
4990         uint fillbyte;
4991         u16 len;
4992
4993         /* Display current count if appropriate */
4994         if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
4995                 bus->pktgen_ptick = 0;
4996                 printk(KERN_DEBUG "%s: send attempts %d rcvd %d\n",
4997                        __func__, bus->pktgen_sent, bus->pktgen_rcvd);
4998         }
4999
5000         /* For recv mode, just make sure dongle has started sending */
5001         if (bus->pktgen_mode == BRCMF_PKTGEN_RECV) {
5002                 if (!bus->pktgen_rcvd)
5003                         brcmf_sdbrcm_sdtest_set(bus, true);
5004                 return;
5005         }
5006
5007         /* Otherwise, generate or request the specified number of packets */
5008         for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
5009                 /* Stop if total has been reached */
5010                 if (bus->pktgen_total
5011                     && (bus->pktgen_sent >= bus->pktgen_total)) {
5012                         bus->pktgen_count = 0;
5013                         break;
5014                 }
5015
5016                 /* Allocate an appropriate-sized packet */
5017                 len = bus->pktgen_len;
5018                 pkt = brcmu_pkt_buf_get_skb(
5019                         len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + BRCMF_SDALIGN,
5020                         true);
5021                 if (!pkt) {
5022                         BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed!\n",
5023                                      __func__));
5024                         break;
5025                 }
5026                 PKTALIGN(pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN),
5027                          BRCMF_SDALIGN);
5028                 data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
5029
5030                 /* Write test header cmd and extra based on mode */
5031                 switch (bus->pktgen_mode) {
5032                 case BRCMF_PKTGEN_ECHO:
5033                         *data++ = SDPCM_TEST_ECHOREQ;
5034                         *data++ = (u8) bus->pktgen_sent;
5035                         break;
5036
5037                 case BRCMF_PKTGEN_SEND:
5038                         *data++ = SDPCM_TEST_DISCARD;
5039                         *data++ = (u8) bus->pktgen_sent;
5040                         break;
5041
5042                 case BRCMF_PKTGEN_RXBURST:
5043                         *data++ = SDPCM_TEST_BURST;
5044                         *data++ = (u8) bus->pktgen_count;
5045                         break;
5046
5047                 default:
5048                         BRCMF_ERROR(("Unrecognized pktgen mode %d\n",
5049                                      bus->pktgen_mode));
5050                         brcmu_pkt_buf_free_skb(pkt, true);
5051                         bus->pktgen_count = 0;
5052                         return;
5053                 }
5054
5055                 /* Write test header length field */
5056                 *data++ = (len >> 0);
5057                 *data++ = (len >> 8);
5058
5059                 /* Then fill in the remainder -- N/A for burst,
5060                          but who cares... */
5061                 for (fillbyte = 0; fillbyte < len; fillbyte++)
5062                         *data++ =
5063                             SDPCM_TEST_FILL(fillbyte, (u8) bus->pktgen_sent);
5064
5065 #ifdef BCMDBG
5066                 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
5067                         data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
5068                         printk(KERN_DEBUG "brcmf_sdbrcm_pktgen: Tx Data:\n");
5069                         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, data,
5070                                              pkt->len - SDPCM_HDRLEN);
5071                 }
5072 #endif
5073
5074                 /* Send it */
5075                 if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true)) {
5076                         bus->pktgen_fail++;
5077                         if (bus->pktgen_stop
5078                             && bus->pktgen_stop == bus->pktgen_fail)
5079                                 bus->pktgen_count = 0;
5080                 }
5081                 bus->pktgen_sent++;
5082
5083                 /* Bump length if not fixed, wrap at max */
5084                 if (++bus->pktgen_len > bus->pktgen_maxlen)
5085                         bus->pktgen_len = (u16) bus->pktgen_minlen;
5086
5087                 /* Special case for burst mode: just send one request! */
5088                 if (bus->pktgen_mode == BRCMF_PKTGEN_RXBURST)
5089                         break;
5090         }
5091 }
5092
5093 static void brcmf_sdbrcm_sdtest_set(struct brcmf_bus *bus, bool start)
5094 {
5095         struct sk_buff *pkt;
5096         u8 *data;
5097
5098         /* Allocate the packet */
5099         pkt = brcmu_pkt_buf_get_skb(SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
5100                 BRCMF_SDALIGN, true);
5101         if (!pkt) {
5102                 BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed!\n", __func__));
5103                 return;
5104         }
5105         PKTALIGN(pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), BRCMF_SDALIGN);
5106         data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
5107
5108         /* Fill in the test header */
5109         *data++ = SDPCM_TEST_SEND;
5110         *data++ = start;
5111         *data++ = (bus->pktgen_maxlen >> 0);
5112         *data++ = (bus->pktgen_maxlen >> 8);
5113
5114         /* Send it */
5115         if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true))
5116                 bus->pktgen_fail++;
5117 }
5118
5119 static void
5120 brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, struct sk_buff *pkt, uint seq)
5121 {
5122         u8 *data;
5123         uint pktlen;
5124
5125         u8 cmd;
5126         u8 extra;
5127         u16 len;
5128         u16 offset;
5129
5130         /* Check for min length */
5131         pktlen = pkt->len;
5132         if (pktlen < SDPCM_TEST_HDRLEN) {
5133                 BRCMF_ERROR(("brcmf_sdbrcm_checkdied: toss runt frame, pktlen "
5134                              "%d\n", pktlen));
5135                 brcmu_pkt_buf_free_skb(pkt, false);
5136                 return;
5137         }
5138
5139         /* Extract header fields */
5140         data = pkt->data;
5141         cmd = *data++;
5142         extra = *data++;
5143         len = *data++;
5144         len += *data++ << 8;
5145
5146         /* Check length for relevant commands */
5147         if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ
5148             || cmd == SDPCM_TEST_ECHORSP) {
5149                 if (pktlen != len + SDPCM_TEST_HDRLEN) {
5150                         BRCMF_ERROR(("brcmf_sdbrcm_checkdied: frame length "
5151                                      "mismatch, pktlen %d seq %d"
5152                                      " cmd %d extra %d len %d\n",
5153                                      pktlen, seq, cmd, extra, len));
5154                         brcmu_pkt_buf_free_skb(pkt, false);
5155                         return;
5156                 }
5157         }
5158
5159         /* Process as per command */
5160         switch (cmd) {
5161         case SDPCM_TEST_ECHOREQ:
5162                 /* Rx->Tx turnaround ok (even on NDIS w/current
5163                          implementation) */
5164                 *(u8 *) (pkt->data) = SDPCM_TEST_ECHORSP;
5165                 if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true) == 0)
5166                         bus->pktgen_sent++;
5167                 else {
5168                         bus->pktgen_fail++;
5169                         brcmu_pkt_buf_free_skb(pkt, false);
5170                 }
5171                 bus->pktgen_rcvd++;
5172                 break;
5173
5174         case SDPCM_TEST_ECHORSP:
5175                 if (bus->ext_loop) {
5176                         brcmu_pkt_buf_free_skb(pkt, false);
5177                         bus->pktgen_rcvd++;
5178                         break;
5179                 }
5180
5181                 for (offset = 0; offset < len; offset++, data++) {
5182                         if (*data != SDPCM_TEST_FILL(offset, extra)) {
5183                                 BRCMF_ERROR(("brcmf_sdbrcm_checkdied: echo"
5184                                              " data mismatch: "
5185                                              "offset %d (len %d) "
5186                                              "expect 0x%02x rcvd 0x%02x\n",
5187                                              offset, len,
5188                                              SDPCM_TEST_FILL(offset, extra),
5189                                              *data));
5190                                 break;
5191                         }
5192                 }
5193                 brcmu_pkt_buf_free_skb(pkt, false);
5194                 bus->pktgen_rcvd++;
5195                 break;
5196
5197         case SDPCM_TEST_DISCARD:
5198                 brcmu_pkt_buf_free_skb(pkt, false);
5199                 bus->pktgen_rcvd++;
5200                 break;
5201
5202         case SDPCM_TEST_BURST:
5203         case SDPCM_TEST_SEND:
5204         default:
5205                 BRCMF_INFO(("brcmf_sdbrcm_checkdied: unsupported or unknown "
5206                             "command, pktlen %d seq %d" " cmd %d extra %d"
5207                             " len %d\n", pktlen, seq, cmd, extra, len));
5208                 brcmu_pkt_buf_free_skb(pkt, false);
5209                 break;
5210         }
5211
5212         /* For recv mode, stop at limie (and tell dongle to stop sending) */
5213         if (bus->pktgen_mode == BRCMF_PKTGEN_RECV) {
5214                 if (bus->pktgen_total
5215                     && (bus->pktgen_rcvd >= bus->pktgen_total)) {
5216                         bus->pktgen_count = 0;
5217                         brcmf_sdbrcm_sdtest_set(bus, false);
5218                 }
5219         }
5220 }
5221 #endif                          /* SDTEST */
5222
5223 extern bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
5224 {
5225         struct brcmf_bus *bus;
5226
5227         BRCMF_TIMER(("%s: Enter\n", __func__));
5228
5229         bus = drvr->bus;
5230
5231         if (bus->drvr->dongle_reset)
5232                 return false;
5233
5234         /* Ignore the timer if simulating bus down */
5235         if (bus->sleeping)
5236                 return false;
5237
5238         brcmf_sdbrcm_sdlock(bus);
5239
5240         /* Poll period: check device if appropriate. */
5241         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
5242                 u32 intstatus = 0;
5243
5244                 /* Reset poll tick */
5245                 bus->polltick = 0;
5246
5247                 /* Check device if no interrupts */
5248                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
5249
5250                         if (!bus->dpc_sched) {
5251                                 u8 devpend;
5252                                 devpend = brcmf_sdcard_cfg_read(bus->card,
5253                                                 SDIO_FUNC_0, SDIO_CCCR_INTx,
5254                                                 NULL);
5255                                 intstatus =
5256                                     devpend & (INTR_STATUS_FUNC1 |
5257                                                INTR_STATUS_FUNC2);
5258                         }
5259
5260                         /* If there is something, make like the ISR and
5261                                  schedule the DPC */
5262                         if (intstatus) {
5263                                 bus->pollcnt++;
5264                                 bus->ipend = true;
5265                                 if (bus->intr)
5266                                         brcmf_sdcard_intr_disable(bus->card);
5267
5268                                 bus->dpc_sched = true;
5269                                 brcmf_sdbrcm_sched_dpc(bus);
5270
5271                         }
5272                 }
5273
5274                 /* Update interrupt tracking */
5275                 bus->lastintrs = bus->intrcount;
5276         }
5277 #ifdef BCMDBG
5278         /* Poll for console output periodically */
5279         if (drvr->busstate == BRCMF_BUS_DATA && brcmf_console_ms != 0) {
5280                 bus->console.count += brcmf_watchdog_ms;
5281                 if (bus->console.count >= brcmf_console_ms) {
5282                         bus->console.count -= brcmf_console_ms;
5283                         /* Make sure backplane clock is on */
5284                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5285                         if (brcmf_sdbrcm_readconsole(bus) < 0)
5286                                 brcmf_console_ms = 0;   /* On error,
5287                                                          stop trying */
5288                 }
5289         }
5290 #endif                          /* BCMDBG */
5291
5292 #ifdef SDTEST
5293         /* Generate packets if configured */
5294         if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
5295                 /* Make sure backplane clock is on */
5296                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5297                 bus->pktgen_tick = 0;
5298                 brcmf_sdbrcm_pktgen(bus);
5299         }
5300 #endif
5301
5302         /* On idle timeout clear activity flag and/or turn off clock */
5303         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
5304                 if (++bus->idlecount >= bus->idletime) {
5305                         bus->idlecount = 0;
5306                         if (bus->activity) {
5307                                 bus->activity = false;
5308                                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
5309                         } else {
5310                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
5311                         }
5312                 }
5313         }
5314
5315         brcmf_sdbrcm_sdunlock(bus);
5316
5317         return bus->ipend;
5318 }
5319
5320 #ifdef BCMDBG
5321 static int brcmf_sdbrcm_bus_console_in(struct brcmf_pub *drvr,
5322                                        unsigned char *msg, uint msglen)
5323 {
5324         struct brcmf_bus *bus = drvr->bus;
5325         u32 addr, val;
5326         int rv;
5327         struct sk_buff *pkt;
5328
5329         /* Address could be zero if CONSOLE := 0 in dongle Makefile */
5330         if (bus->console_addr == 0)
5331                 return -ENOTSUPP;
5332
5333         /* Exclusive bus access */
5334         brcmf_sdbrcm_sdlock(bus);
5335
5336         /* Don't allow input if dongle is in reset */
5337         if (bus->drvr->dongle_reset) {
5338                 brcmf_sdbrcm_sdunlock(bus);
5339                 return -EPERM;
5340         }
5341
5342         /* Request clock to allow SDIO accesses */
5343         BUS_WAKE(bus);
5344         /* No pend allowed since txpkt is called later, ht clk has to be on */
5345         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5346
5347         /* Zero cbuf_index */
5348         addr = bus->console_addr + offsetof(struct rte_console, cbuf_idx);
5349         val = cpu_to_le32(0);
5350         rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)&val, sizeof(val));
5351         if (rv < 0)
5352                 goto done;
5353
5354         /* Write message into cbuf */
5355         addr = bus->console_addr + offsetof(struct rte_console, cbuf);
5356         rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)msg, msglen);
5357         if (rv < 0)
5358                 goto done;
5359
5360         /* Write length into vcons_in */
5361         addr = bus->console_addr + offsetof(struct rte_console, vcons_in);
5362         val = cpu_to_le32(msglen);
5363         rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)&val, sizeof(val));
5364         if (rv < 0)
5365                 goto done;
5366
5367         /* Bump dongle by sending an empty event pkt.
5368          * sdpcm_sendup (RX) checks for virtual console input.
5369          */
5370         pkt = brcmu_pkt_buf_get_skb(4 + SDPCM_RESERVE);
5371         if ((pkt != NULL) && bus->clkstate == CLK_AVAIL)
5372                 brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, true);
5373
5374 done:
5375         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
5376                 bus->activity = false;
5377                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
5378         }
5379
5380         brcmf_sdbrcm_sdunlock(bus);
5381
5382         return rv;
5383 }
5384 #endif                          /* BCMDBG */
5385
5386 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
5387 {
5388         if (chipid == BCM4325_CHIP_ID)
5389                 return true;
5390         if (chipid == BCM4329_CHIP_ID)
5391                 return true;
5392         if (chipid == BCM4319_CHIP_ID)
5393                 return true;
5394         return false;
5395 }
5396
5397 static void *brcmf_sdbrcm_probe(u16 venid, u16 devid, u16 bus_no,
5398                            u16 slot, u16 func, uint bustype, u32 regsva,
5399                            void *card)
5400 {
5401         int ret;
5402         struct brcmf_bus *bus;
5403
5404         /* Init global variables at run-time, not as part of the declaration.
5405          * This is required to support init/de-init of the driver.
5406          * Initialization
5407          * of globals as part of the declaration results in non-deterministic
5408          * behavior since the value of the globals may be different on the
5409          * first time that the driver is initialized vs subsequent
5410          * initializations.
5411          */
5412         brcmf_txbound = BRCMF_TXBOUND;
5413         brcmf_rxbound = BRCMF_RXBOUND;
5414         brcmf_alignctl = true;
5415         sd1idle = true;
5416         brcmf_readahead = true;
5417         retrydata = false;
5418         brcmf_dongle_memsize = 0;
5419         brcmf_txminmax = BRCMF_TXMINMAX;
5420
5421         forcealign = true;
5422
5423         brcmf_c_init();
5424
5425         BRCMF_TRACE(("%s: Enter\n", __func__));
5426         BRCMF_INFO(("%s: venid 0x%04x devid 0x%04x\n", __func__, venid, devid));
5427
5428         /* We make an assumption about address window mappings:
5429          * regsva == SI_ENUM_BASE*/
5430
5431         /* SDIO car passes venid and devid based on CIS parsing -- but
5432          * low-power start
5433          * means early parse could fail, so here we should get either an ID
5434          * we recognize OR (-1) indicating we must request power first.
5435          */
5436         /* Check the Vendor ID */
5437         switch (venid) {
5438         case 0x0000:
5439         case PCI_VENDOR_ID_BROADCOM:
5440                 break;
5441         default:
5442                 BRCMF_ERROR(("%s: unknown vendor: 0x%04x\n", __func__, venid));
5443                 return NULL;
5444         }
5445
5446         /* Check the Device ID and make sure it's one that we support */
5447         switch (devid) {
5448         case BCM4325_D11DUAL_ID:        /* 4325 802.11a/g id */
5449         case BCM4325_D11G_ID:   /* 4325 802.11g 2.4Ghz band id */
5450         case BCM4325_D11A_ID:   /* 4325 802.11a 5Ghz band id */
5451                 BRCMF_INFO(("%s: found 4325 Dongle\n", __func__));
5452                 break;
5453         case BCM4329_D11NDUAL_ID:       /* 4329 802.11n dualband device */
5454         case BCM4329_D11N2G_ID: /* 4329 802.11n 2.4G device */
5455         case BCM4329_D11N5G_ID: /* 4329 802.11n 5G device */
5456         case 0x4329:
5457                 BRCMF_INFO(("%s: found 4329 Dongle\n", __func__));
5458                 break;
5459         case BCM4319_D11N_ID:   /* 4319 802.11n id */
5460         case BCM4319_D11N2G_ID: /* 4319 802.11n2g id */
5461         case BCM4319_D11N5G_ID: /* 4319 802.11n5g id */
5462                 BRCMF_INFO(("%s: found 4319 Dongle\n", __func__));
5463                 break;
5464         case 0:
5465                 BRCMF_INFO(("%s: allow device id 0, will check chip"
5466                             " internals\n", __func__));
5467                 break;
5468
5469         default:
5470                 BRCMF_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
5471                              __func__, venid, devid));
5472                 return NULL;
5473         }
5474
5475         /* Allocate private bus interface state */
5476         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
5477         if (!bus) {
5478                 BRCMF_ERROR(("%s: kmalloc of struct dhd_bus failed\n",
5479                              __func__));
5480                 goto fail;
5481         }
5482         bus->card = card;
5483         bus->cl_devid = (u16) devid;
5484         bus->bus = BRCMF_BUS;
5485         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
5486         bus->usebufpool = false;        /* Use bufpool if allocated,
5487                                          else use locally malloced rxbuf */
5488
5489         /* attempt to attach to the dongle */
5490         if (!(brcmf_sdbrcm_probe_attach(bus, card, regsva, devid))) {
5491                 BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_attach failed\n",
5492                              __func__));
5493                 goto fail;
5494         }
5495
5496         spin_lock_init(&bus->txqlock);
5497         init_waitqueue_head(&bus->ctrl_wait);
5498
5499         /* Set up the watchdog timer */
5500         init_timer(&bus->timer);
5501         bus->timer.data = (unsigned long)bus;
5502         bus->timer.function = brcmf_sdbrcm_watchdog;
5503
5504         /* Initialize thread based operation and lock */
5505         if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)) {
5506                 bus->threads_only = true;
5507                 sema_init(&bus->sdsem, 1);
5508         } else {
5509                 bus->threads_only = false;
5510                 spin_lock_init(&bus->sdlock);
5511         }
5512
5513         if (brcmf_dpc_prio >= 0) {
5514                 /* Initialize watchdog thread */
5515                 init_completion(&bus->watchdog_wait);
5516                 bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
5517                                                 bus, "brcmf_watchdog");
5518                 if (IS_ERR(bus->watchdog_tsk)) {
5519                         printk(KERN_WARNING
5520                                "brcmf_watchdog thread failed to start\n");
5521                         bus->watchdog_tsk = NULL;
5522                 }
5523         } else
5524                 bus->watchdog_tsk = NULL;
5525
5526         /* Set up the bottom half handler */
5527         if (brcmf_dpc_prio >= 0) {
5528                 /* Initialize DPC thread */
5529                 init_completion(&bus->dpc_wait);
5530                 bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
5531                                            bus, "brcmf_dpc");
5532                 if (IS_ERR(bus->dpc_tsk)) {
5533                         printk(KERN_WARNING
5534                                "brcmf_dpc thread failed to start\n");
5535                         bus->dpc_tsk = NULL;
5536                 }
5537         } else {
5538                 tasklet_init(&bus->tasklet, brcmf_sdbrcm_dpc_tasklet,
5539                              (unsigned long)bus);
5540                 bus->dpc_tsk = NULL;
5541         }
5542
5543         /* Attach to the brcmf/OS/network interface */
5544         bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
5545         if (!bus->drvr) {
5546                 BRCMF_ERROR(("%s: brcmf_attach failed\n", __func__));
5547                 goto fail;
5548         }
5549
5550         /* Allocate buffers */
5551         if (!(brcmf_sdbrcm_probe_malloc(bus, card))) {
5552                 BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_malloc failed\n",
5553                              __func__));
5554                 goto fail;
5555         }
5556
5557         if (!(brcmf_sdbrcm_probe_init(bus, card))) {
5558                 BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_init failed\n", __func__));
5559                 goto fail;
5560         }
5561
5562         /* Register interrupt callback, but mask it (not operational yet). */
5563         BRCMF_INTR(("%s: disable SDIO interrupts (not interested yet)\n",
5564                     __func__));
5565         brcmf_sdcard_intr_disable(card);
5566         ret = brcmf_sdcard_intr_reg(card, brcmf_sdbrcm_isr, bus);
5567         if (ret != 0) {
5568                 BRCMF_ERROR(("%s: FAILED: sdcard_intr_reg returned %d\n",
5569                              __func__, ret));
5570                 goto fail;
5571         }
5572         BRCMF_INTR(("%s: registered SDIO interrupt function ok\n", __func__));
5573
5574         BRCMF_INFO(("%s: completed!!\n", __func__));
5575
5576         /* if firmware path present try to download and bring up bus */
5577         ret = brcmf_bus_start(bus->drvr);
5578         if (ret != 0) {
5579                 if (ret == -ENOLINK) {
5580                         BRCMF_ERROR(("%s: dongle is not responding\n",
5581                                      __func__));
5582                         goto fail;
5583                 }
5584         }
5585         /* Ok, have the per-port tell the stack we're open for business */
5586         if (brcmf_net_attach(bus->drvr, 0) != 0) {
5587                 BRCMF_ERROR(("%s: Net attach failed!!\n", __func__));
5588                 goto fail;
5589         }
5590
5591         return bus;
5592
5593 fail:
5594         brcmf_sdbrcm_release(bus);
5595         return NULL;
5596 }
5597
5598 static bool
5599 brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, void *card, u32 regsva,
5600                           u16 devid)
5601 {
5602         u8 clkctl = 0;
5603         int err = 0;
5604
5605         bus->alp_only = true;
5606
5607         /* Return the window to backplane enumeration space for core access */
5608         if (brcmf_sdbrcm_set_siaddr_window(bus, SI_ENUM_BASE))
5609                 BRCMF_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n",
5610                              __func__));
5611
5612 #ifdef BCMDBG
5613         printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
5614                brcmf_sdcard_reg_read(bus->card, SI_ENUM_BASE, 4));
5615
5616 #endif                          /* BCMDBG */
5617
5618         /*
5619          * Force PLL off until brcmf_sdbrcm_chip_attach()
5620          * programs PLL control regs
5621          */
5622
5623         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
5624                          BRCMF_INIT_CLKCTL1, &err);
5625         if (!err)
5626                 clkctl =
5627                     brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
5628                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
5629
5630         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
5631                 BRCMF_ERROR(("brcmf_sdbrcm_probe: ChipClkCSR access: err %d"
5632                              " wrote 0x%02x read 0x%02x\n",
5633                              err, BRCMF_INIT_CLKCTL1, clkctl));
5634                 goto fail;
5635         }
5636
5637         if (brcmf_sdbrcm_chip_attach(bus, regsva)) {
5638                 BRCMF_ERROR(("%s: brcmf_sdbrcm_chip_attach failed!\n",
5639                              __func__));
5640                 goto fail;
5641         }
5642
5643         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
5644                 BRCMF_ERROR(("%s: unsupported chip: 0x%04x\n",
5645                              __func__, bus->ci->chip));
5646                 goto fail;
5647         }
5648
5649         brcmf_sdbrcm_sdiod_drive_strength_init(bus, brcmf_sdiod_drive_strength);
5650
5651         /* Get info on the ARM and SOCRAM cores... */
5652         if (!BRCMF_NOPMU(bus)) {
5653                 brcmf_sdcard_reg_read(bus->card,
5654                           CORE_SB(bus->ci->armcorebase, sbidhigh), 4);
5655                 bus->orig_ramsize = bus->ci->ramsize;
5656                 if (!(bus->orig_ramsize)) {
5657                         BRCMF_ERROR(("%s: failed to find SOCRAM memory!\n",
5658                                      __func__));
5659                         goto fail;
5660                 }
5661                 bus->ramsize = bus->orig_ramsize;
5662                 if (brcmf_dongle_memsize)
5663                         brcmf_sdbrcm_setmemsize(bus, brcmf_dongle_memsize);
5664
5665                 BRCMF_ERROR(("DHD: dongle ram size is set to %d(orig %d)\n",
5666                              bus->ramsize, bus->orig_ramsize));
5667         }
5668
5669         /* Set core control so an SDIO reset does a backplane reset */
5670         OR_REG(bus->ci->buscorebase + offsetof(struct sdpcmd_regs,
5671                                                        corecontrol),
5672                CC_BPRESEN, u32);
5673
5674         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
5675
5676         /* Locate an appropriately-aligned portion of hdrbuf */
5677         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
5678                                     BRCMF_SDALIGN);
5679
5680         /* Set the poll and/or interrupt flags */
5681         bus->intr = (bool) brcmf_intr;
5682         bus->poll = (bool) brcmf_poll;
5683         if (bus->poll)
5684                 bus->pollrate = 1;
5685
5686         return true;
5687
5688 fail:
5689         return false;
5690 }
5691
5692 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus, void *card)
5693 {
5694         BRCMF_TRACE(("%s: Enter\n", __func__));
5695
5696         if (bus->drvr->maxctl) {
5697                 bus->rxblen =
5698                     roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
5699                             ALIGNMENT) + BRCMF_SDALIGN;
5700                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
5701                 if (!(bus->rxbuf)) {
5702                         BRCMF_ERROR(("%s: kmalloc of %d-byte rxbuf failed\n",
5703                                      __func__, bus->rxblen));
5704                         goto fail;
5705                 }
5706         }
5707
5708         /* Allocate buffer to receive glomed packet */
5709         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
5710         if (!(bus->databuf)) {
5711                 BRCMF_ERROR(("%s: kmalloc of %d-byte databuf failed\n",
5712                              __func__, MAX_DATA_BUF));
5713                 /* release rxbuf which was already located as above */
5714                 if (!bus->rxblen)
5715                         kfree(bus->rxbuf);
5716                 goto fail;
5717         }
5718
5719         /* Align the buffer */
5720         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
5721                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
5722                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
5723         else
5724                 bus->dataptr = bus->databuf;
5725
5726         return true;
5727
5728 fail:
5729         return false;
5730 }
5731
5732 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus, void *card)
5733 {
5734         s32 fnum;
5735
5736         BRCMF_TRACE(("%s: Enter\n", __func__));
5737
5738 #ifdef SDTEST
5739         brcmf_sdbrcm_pktgen_init(bus);
5740 #endif                          /* SDTEST */
5741
5742         /* Disable F2 to clear any intermediate frame state on the dongle */
5743         brcmf_sdcard_cfg_write(card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
5744                                SDIO_FUNC_ENABLE_1, NULL);
5745
5746         bus->drvr->busstate = BRCMF_BUS_DOWN;
5747         bus->sleeping = false;
5748         bus->rxflow = false;
5749
5750         /* Done with backplane-dependent accesses, can drop clock... */
5751         brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0,
5752                                NULL);
5753
5754         /* ...and initialize clock/power states */
5755         bus->clkstate = CLK_SDONLY;
5756         bus->idletime = (s32) brcmf_idletime;
5757         bus->idleclock = BRCMF_IDLE_ACTIVE;
5758
5759         /* Query the F2 block size, set roundup accordingly */
5760         fnum = 2;
5761         if (brcmf_sdcard_iovar_op(card, "sd_blocksize", &fnum, sizeof(s32),
5762                             &bus->blocksize, sizeof(s32), false) != 0) {
5763                 bus->blocksize = 0;
5764                 BRCMF_ERROR(("%s: fail on %s get\n", __func__, "sd_blocksize"));
5765         } else {
5766                 BRCMF_INFO(("%s: Initial value for %s is %d\n",
5767                             __func__, "sd_blocksize", bus->blocksize));
5768         }
5769         bus->roundup = min(max_roundup, bus->blocksize);
5770
5771         /* Query if bus module supports packet chaining,
5772                  default to use if supported */
5773         if (brcmf_sdcard_iovar_op(card, "sd_rxchain", NULL, 0,
5774                             &bus->sd_rxchain, sizeof(s32),
5775                             false) != 0) {
5776                 bus->sd_rxchain = false;
5777         } else {
5778                 BRCMF_INFO(("%s: bus module (through sdiocard API) %s"
5779                             " chaining\n", __func__, bus->sd_rxchain
5780                             ? "supports" : "does not support"));
5781         }
5782         bus->use_rxchain = (bool) bus->sd_rxchain;
5783
5784         return true;
5785 }
5786
5787 static bool
5788 brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus, void *card)
5789 {
5790         bool ret;
5791
5792         /* Download the firmware */
5793         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5794
5795         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
5796
5797         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
5798
5799         return ret;
5800 }
5801
5802 /* Detach and free everything */
5803 static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
5804 {
5805         BRCMF_TRACE(("%s: Enter\n", __func__));
5806
5807         if (bus) {
5808                 /* De-register interrupt handler */
5809                 brcmf_sdcard_intr_disable(bus->card);
5810                 brcmf_sdcard_intr_dereg(bus->card);
5811
5812                 if (bus->drvr) {
5813                         brcmf_detach(bus->drvr);
5814                         brcmf_sdbrcm_release_dongle(bus);
5815                         bus->drvr = NULL;
5816                 }
5817
5818                 brcmf_sdbrcm_release_malloc(bus);
5819
5820                 kfree(bus);
5821         }
5822
5823         BRCMF_TRACE(("%s: Disconnected\n", __func__));
5824 }
5825
5826 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
5827 {
5828         BRCMF_TRACE(("%s: Enter\n", __func__));
5829
5830         if (bus->drvr && bus->drvr->dongle_reset)
5831                 return;
5832
5833         kfree(bus->rxbuf);
5834         bus->rxctl = bus->rxbuf = NULL;
5835         bus->rxlen = 0;
5836
5837         kfree(bus->databuf);
5838         bus->databuf = NULL;
5839 }
5840
5841 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
5842 {
5843         BRCMF_TRACE(("%s: Enter\n", __func__));
5844
5845         if (bus->drvr && bus->drvr->dongle_reset)
5846                 return;
5847
5848         if (bus->ci) {
5849                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
5850                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
5851                 brcmf_sdbrcm_chip_detach(bus);
5852                 if (bus->vars && bus->varsz)
5853                         kfree(bus->vars);
5854                 bus->vars = NULL;
5855         }
5856
5857         BRCMF_TRACE(("%s: Disconnected\n", __func__));
5858 }
5859
5860 static void brcmf_sdbrcm_disconnect(void *ptr)
5861 {
5862         struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
5863
5864         BRCMF_TRACE(("%s: Enter\n", __func__));
5865
5866         if (bus) {
5867                 brcmf_sdbrcm_release(bus);
5868         }
5869
5870         BRCMF_TRACE(("%s: Disconnected\n", __func__));
5871 }
5872
5873 /* Register/Unregister functions are called by the main DHD entry
5874  * point (e.g. module insertion) to link with the bus driver, in
5875  * order to look for or await the device.
5876  */
5877
5878 static struct brcmf_sdioh_driver brcmf_sdio = {
5879         brcmf_sdbrcm_probe,
5880         brcmf_sdbrcm_disconnect
5881 };
5882
5883 int brcmf_bus_register(void)
5884 {
5885         BRCMF_TRACE(("%s: Enter\n", __func__));
5886
5887         /* Sanity check on the module parameters */
5888         do {
5889                 /* Both watchdog and DPC as tasklets are ok */
5890                 if ((brcmf_watchdog_prio < 0) && (brcmf_dpc_prio < 0))
5891                         break;
5892
5893                 /* If both watchdog and DPC are threads, TX must be deferred */
5894                 if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)
5895                     && brcmf_deferred_tx)
5896                         break;
5897
5898                 BRCMF_ERROR(("Invalid module parameters.\n"));
5899                 return -EINVAL;
5900         } while (0);
5901
5902         return brcmf_sdio_register(&brcmf_sdio);
5903 }
5904
5905 void brcmf_bus_unregister(void)
5906 {
5907         BRCMF_TRACE(("%s: Enter\n", __func__));
5908
5909         brcmf_sdio_unregister();
5910 }
5911
5912 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
5913 {
5914         int offset = 0;
5915         uint len;
5916         u8 *memblock = NULL, *memptr;
5917         int ret;
5918
5919         BRCMF_INFO(("%s: Enter\n", __func__));
5920
5921         bus->fw_name = BCM4329_FW_NAME;
5922         ret = request_firmware(&bus->firmware, bus->fw_name,
5923                                &gInstance->func[2]->dev);
5924         if (ret) {
5925                 BRCMF_ERROR(("%s: Fail to request firmware %d\n",
5926                              __func__, ret));
5927                 return ret;
5928         }
5929         bus->fw_ptr = 0;
5930
5931         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
5932         if (memblock == NULL) {
5933                 BRCMF_ERROR(("%s: Failed to allocate memory %d bytes\n",
5934                              __func__, MEMBLOCK));
5935                 ret = -ENOMEM;
5936                 goto err;
5937         }
5938         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
5939                 memptr += (BRCMF_SDALIGN -
5940                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
5941
5942         /* Download image */
5943         while ((len =
5944                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
5945                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
5946                 if (ret) {
5947                         BRCMF_ERROR(("%s: error %d on writing %d membytes at "
5948                                      "0x%08x\n", __func__, ret, MEMBLOCK,
5949                                      offset));
5950                         goto err;
5951                 }
5952
5953                 offset += MEMBLOCK;
5954         }
5955
5956 err:
5957         kfree(memblock);
5958
5959         release_firmware(bus->firmware);
5960         bus->fw_ptr = 0;
5961
5962         return ret;
5963 }
5964
5965 /*
5966  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
5967  * and ending in a NUL.
5968  * Removes carriage returns, empty lines, comment lines, and converts
5969  * newlines to NULs.
5970  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
5971  * by two NULs.
5972 */
5973
5974 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
5975 {
5976         char *dp;
5977         bool findNewline;
5978         int column;
5979         uint buf_len, n;
5980
5981         dp = varbuf;
5982
5983         findNewline = false;
5984         column = 0;
5985
5986         for (n = 0; n < len; n++) {
5987                 if (varbuf[n] == 0)
5988                         break;
5989                 if (varbuf[n] == '\r')
5990                         continue;
5991                 if (findNewline && varbuf[n] != '\n')
5992                         continue;
5993                 findNewline = false;
5994                 if (varbuf[n] == '#') {
5995                         findNewline = true;
5996                         continue;
5997                 }
5998                 if (varbuf[n] == '\n') {
5999                         if (column == 0)
6000                                 continue;
6001                         *dp++ = 0;
6002                         column = 0;
6003                         continue;
6004                 }
6005                 *dp++ = varbuf[n];
6006                 column++;
6007         }
6008         buf_len = dp - varbuf;
6009
6010         while (dp < varbuf + n)
6011                 *dp++ = 0;
6012
6013         return buf_len;
6014 }
6015
6016 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
6017 {
6018         uint len;
6019         char *memblock = NULL;
6020         char *bufp;
6021         int ret;
6022
6023         bus->nv_name = BCM4329_NV_NAME;
6024         ret = request_firmware(&bus->firmware, bus->nv_name,
6025                                &gInstance->func[2]->dev);
6026         if (ret) {
6027                 BRCMF_ERROR(("%s: Fail to request nvram %d\n", __func__, ret));
6028                 return ret;
6029         }
6030         bus->fw_ptr = 0;
6031
6032         memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
6033         if (memblock == NULL) {
6034                 BRCMF_ERROR(("%s: Failed to allocate memory %d bytes\n",
6035                              __func__, MEMBLOCK));
6036                 ret = -ENOMEM;
6037                 goto err;
6038         }
6039
6040         len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
6041
6042         if (len > 0 && len < MEMBLOCK) {
6043                 bufp = (char *)memblock;
6044                 bufp[len] = 0;
6045                 len = brcmf_process_nvram_vars(bufp, len);
6046                 bufp += len;
6047                 *bufp++ = 0;
6048                 if (len)
6049                         ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
6050                 if (ret)
6051                         BRCMF_ERROR(("%s: error downloading vars: %d\n",
6052                                      __func__, ret));
6053         } else {
6054                 BRCMF_ERROR(("%s: error reading nvram file: %d\n",
6055                              __func__, len));
6056                 ret = -EIO;
6057         }
6058
6059 err:
6060         kfree(memblock);
6061
6062         release_firmware(bus->firmware);
6063         bus->fw_ptr = 0;
6064
6065         return ret;
6066 }
6067
6068 static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
6069 {
6070         int bcmerror = -1;
6071
6072         /* Keep arm in reset */
6073         if (brcmf_sdbrcm_download_state(bus, true)) {
6074                 BRCMF_ERROR(("%s: error placing ARM core in reset\n",
6075                              __func__));
6076                 goto err;
6077         }
6078
6079         /* External image takes precedence if specified */
6080         if (brcmf_sdbrcm_download_code_file(bus)) {
6081                 BRCMF_ERROR(("%s: dongle image file download failed\n",
6082                              __func__));
6083                 goto err;
6084         }
6085
6086         /* External nvram takes precedence if specified */
6087         if (brcmf_sdbrcm_download_nvram(bus)) {
6088                 BRCMF_ERROR(("%s: dongle nvram file download failed\n",
6089                              __func__));
6090         }
6091
6092         /* Take arm out of reset */
6093         if (brcmf_sdbrcm_download_state(bus, false)) {
6094                 BRCMF_ERROR(("%s: error getting out of ARM core reset\n",
6095                              __func__));
6096                 goto err;
6097         }
6098
6099         bcmerror = 0;
6100
6101 err:
6102         return bcmerror;
6103 }
6104
6105
6106 static int
6107 brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn, uint flags,
6108                     u8 *buf, uint nbytes, struct sk_buff *pkt,
6109                     void (*complete)(void *handle, int status,
6110                                      bool sync_waiting),
6111                     void *handle)
6112 {
6113         return brcmf_sdcard_send_buf
6114                 (bus->card, addr, fn, flags, buf, nbytes, pkt, complete,
6115                  handle);
6116 }
6117
6118 int brcmf_bus_devreset(struct brcmf_pub *drvr, u8 flag)
6119 {
6120         int bcmerror = 0;
6121         struct brcmf_bus *bus;
6122
6123         bus = drvr->bus;
6124
6125         if (flag == true) {
6126                 brcmf_sdbrcm_wd_timer(bus, 0);
6127                 if (!bus->drvr->dongle_reset) {
6128                         /* Expect app to have torn down any
6129                          connection before calling */
6130                         /* Stop the bus, disable F2 */
6131                         brcmf_sdbrcm_bus_stop(bus, false);
6132
6133                         /* Clean tx/rx buffer pointers,
6134                          detach from the dongle */
6135                         brcmf_sdbrcm_release_dongle(bus);
6136
6137                         bus->drvr->dongle_reset = true;
6138                         bus->drvr->up = false;
6139
6140                         BRCMF_TRACE(("%s:  WLAN OFF DONE\n", __func__));
6141                         /* App can now remove power from device */
6142                 } else
6143                         bcmerror = -EIO;
6144         } else {
6145                 /* App must have restored power to device before calling */
6146
6147                 BRCMF_TRACE(("\n\n%s: == WLAN ON ==\n", __func__));
6148
6149                 if (bus->drvr->dongle_reset) {
6150                         /* Turn on WLAN */
6151
6152                         /* Attempt to re-attach & download */
6153                         if (brcmf_sdbrcm_probe_attach(bus, bus->card,
6154                                                       SI_ENUM_BASE,
6155                                                       bus->cl_devid)) {
6156                                 /* Attempt to download binary to the dongle */
6157                                 if (brcmf_sdbrcm_probe_init(bus, bus->card)) {
6158                                         /* Re-init bus, enable F2 transfer */
6159                                         brcmf_sdbrcm_bus_init(bus->drvr, false);
6160
6161                                         bus->drvr->dongle_reset = false;
6162                                         bus->drvr->up = true;
6163
6164                                         BRCMF_TRACE(("%s: WLAN ON DONE\n",
6165                                                      __func__));
6166                                 } else
6167                                         bcmerror = -EIO;
6168                         } else
6169                                 bcmerror = -EIO;
6170                 } else {
6171                         bcmerror = -EISCONN;
6172                         BRCMF_ERROR(("%s: Set DEVRESET=false invoked when"
6173                                      " device is on\n", __func__));
6174                         bcmerror = -EIO;
6175                 }
6176                 brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
6177         }
6178         return bcmerror;
6179 }
6180
6181 static int
6182 brcmf_sdbrcm_chip_recognition(struct brcmf_sdio_card *card,
6183                               struct chip_info *ci, u32 regs)
6184 {
6185         u32 regdata;
6186
6187         /*
6188          * Get CC core rev
6189          * Chipid is assume to be at offset 0 from regs arg
6190          * For different chiptypes or old sdio hosts w/o chipcommon,
6191          * other ways of recognition should be added here.
6192          */
6193         ci->cccorebase = regs;
6194         regdata = brcmf_sdcard_reg_read(card,
6195                                 CORE_CC_REG(ci->cccorebase, chipid), 4);
6196         ci->chip = regdata & CID_ID_MASK;
6197         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
6198
6199         BRCMF_INFO(("%s: chipid=0x%x chiprev=%d\n",
6200                     __func__, ci->chip, ci->chiprev));
6201
6202         /* Address of cores for new chips should be added here */
6203         switch (ci->chip) {
6204         case BCM4329_CHIP_ID:
6205                 ci->buscorebase = BCM4329_CORE_BUS_BASE;
6206                 ci->ramcorebase = BCM4329_CORE_SOCRAM_BASE;
6207                 ci->armcorebase = BCM4329_CORE_ARM_BASE;
6208                 ci->ramsize = BCM4329_RAMSIZE;
6209                 break;
6210         default:
6211                 BRCMF_ERROR(("%s: chipid 0x%x is not supported\n",
6212                              __func__, ci->chip));
6213                 return -ENODEV;
6214         }
6215
6216         regdata = brcmf_sdcard_reg_read(card,
6217                 CORE_SB(ci->cccorebase, sbidhigh), 4);
6218         ci->ccrev = SBCOREREV(regdata);
6219
6220         regdata = brcmf_sdcard_reg_read(card,
6221                 CORE_CC_REG(ci->cccorebase, pmucapabilities), 4);
6222         ci->pmurev = regdata & PCAP_REV_MASK;
6223
6224         regdata = brcmf_sdcard_reg_read(card,
6225                                         CORE_SB(ci->buscorebase, sbidhigh), 4);
6226         ci->buscorerev = SBCOREREV(regdata);
6227         ci->buscoretype = (regdata & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
6228
6229         BRCMF_INFO(("%s: ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
6230                     __func__, ci->ccrev, ci->pmurev,
6231                     ci->buscorerev, ci->buscoretype));
6232
6233         /* get chipcommon capabilites */
6234         ci->cccaps = brcmf_sdcard_reg_read(card,
6235                 CORE_CC_REG(ci->cccorebase, capabilities), 4);
6236
6237         return 0;
6238 }
6239
6240 static void
6241 brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_card *card, u32 corebase)
6242 {
6243         u32 regdata;
6244
6245         regdata = brcmf_sdcard_reg_read(card,
6246                 CORE_SB(corebase, sbtmstatelow), 4);
6247         if (regdata & SBTML_RESET)
6248                 return;
6249
6250         regdata = brcmf_sdcard_reg_read(card,
6251                 CORE_SB(corebase, sbtmstatelow), 4);
6252         if ((regdata & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) != 0) {
6253                 /*
6254                  * set target reject and spin until busy is clear
6255                  * (preserve core-specific bits)
6256                  */
6257                 regdata = brcmf_sdcard_reg_read(card,
6258                         CORE_SB(corebase, sbtmstatelow), 4);
6259                 brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6260                         regdata | SBTML_REJ);
6261
6262                 regdata = brcmf_sdcard_reg_read(card,
6263                         CORE_SB(corebase, sbtmstatelow), 4);
6264                 udelay(1);
6265                 SPINWAIT((brcmf_sdcard_reg_read(card,
6266                         CORE_SB(corebase, sbtmstatehigh), 4) &
6267                         SBTMH_BUSY), 100000);
6268
6269                 regdata = brcmf_sdcard_reg_read(card,
6270                         CORE_SB(corebase, sbtmstatehigh), 4);
6271                 if (regdata & SBTMH_BUSY)
6272                         BRCMF_ERROR(("%s: ARM core still busy\n", __func__));
6273
6274                 regdata = brcmf_sdcard_reg_read(card,
6275                         CORE_SB(corebase, sbidlow), 4);
6276                 if (regdata & SBIDL_INIT) {
6277                         regdata = brcmf_sdcard_reg_read(card,
6278                                 CORE_SB(corebase, sbimstate), 4) |
6279                                 SBIM_RJ;
6280                         brcmf_sdcard_reg_write(card,
6281                                 CORE_SB(corebase, sbimstate), 4,
6282                                 regdata);
6283                         regdata = brcmf_sdcard_reg_read(card,
6284                                 CORE_SB(corebase, sbimstate), 4);
6285                         udelay(1);
6286                         SPINWAIT((brcmf_sdcard_reg_read(card,
6287                                 CORE_SB(corebase, sbimstate), 4) &
6288                                 SBIM_BY), 100000);
6289                 }
6290
6291                 /* set reset and reject while enabling the clocks */
6292                 brcmf_sdcard_reg_write(card,
6293                         CORE_SB(corebase, sbtmstatelow), 4,
6294                         (((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
6295                         SBTML_REJ | SBTML_RESET));
6296                 regdata = brcmf_sdcard_reg_read(card,
6297                         CORE_SB(corebase, sbtmstatelow), 4);
6298                 udelay(10);
6299
6300                 /* clear the initiator reject bit */
6301                 regdata = brcmf_sdcard_reg_read(card,
6302                         CORE_SB(corebase, sbidlow), 4);
6303                 if (regdata & SBIDL_INIT) {
6304                         regdata = brcmf_sdcard_reg_read(card,
6305                                 CORE_SB(corebase, sbimstate), 4) &
6306                                 ~SBIM_RJ;
6307                         brcmf_sdcard_reg_write(card,
6308                                 CORE_SB(corebase, sbimstate), 4,
6309                                 regdata);
6310                 }
6311         }
6312
6313         /* leave reset and reject asserted */
6314         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6315                 (SBTML_REJ | SBTML_RESET));
6316         udelay(1);
6317 }
6318
6319 static int
6320 brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs)
6321 {
6322         struct chip_info *ci;
6323         int err;
6324         u8 clkval, clkset;
6325
6326         BRCMF_TRACE(("%s: Enter\n", __func__));
6327
6328         /* alloc chip_info_t */
6329         ci = kmalloc(sizeof(struct chip_info), GFP_ATOMIC);
6330         if (NULL == ci) {
6331                 BRCMF_ERROR(("%s: malloc failed!\n", __func__));
6332                 return -ENOMEM;
6333         }
6334
6335         memset((unsigned char *)ci, 0, sizeof(struct chip_info));
6336
6337         /* bus/core/clk setup for register access */
6338         /* Try forcing SDIO core to do ALPAvail request only */
6339         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
6340         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
6341                         clkset, &err);
6342         if (err) {
6343                 BRCMF_ERROR(("%s: error writing for HT off\n", __func__));
6344                 goto fail;
6345         }
6346
6347         /* If register supported, wait for ALPAvail and then force ALP */
6348         /* This may take up to 15 milliseconds */
6349         clkval = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
6350                         SBSDIO_FUNC1_CHIPCLKCSR, NULL);
6351         if ((clkval & ~SBSDIO_AVBITS) == clkset) {
6352                 SPINWAIT(((clkval =
6353                                 brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
6354                                                 SBSDIO_FUNC1_CHIPCLKCSR,
6355                                                 NULL)),
6356                                 !SBSDIO_ALPAV(clkval)),
6357                                 PMU_MAX_TRANSITION_DLY);
6358                 if (!SBSDIO_ALPAV(clkval)) {
6359                         BRCMF_ERROR(("%s: timeout on ALPAV wait,"
6360                                      " clkval 0x%02x\n", __func__, clkval));
6361                         err = -EBUSY;
6362                         goto fail;
6363                 }
6364                 clkset = SBSDIO_FORCE_HW_CLKREQ_OFF |
6365                                 SBSDIO_FORCE_ALP;
6366                 brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
6367                                 SBSDIO_FUNC1_CHIPCLKCSR,
6368                                 clkset, &err);
6369                 udelay(65);
6370         } else {
6371                 BRCMF_ERROR(("%s: ChipClkCSR access: wrote 0x%02x"
6372                              " read 0x%02x\n", __func__, clkset, clkval));
6373                 err = -EACCES;
6374                 goto fail;
6375         }
6376
6377         /* Also, disable the extra SDIO pull-ups */
6378         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP,
6379                                0, NULL);
6380
6381         err = brcmf_sdbrcm_chip_recognition(bus->card, ci, regs);
6382         if (err)
6383                 goto fail;
6384
6385         /*
6386          * Make sure any on-chip ARM is off (in case strapping is wrong),
6387          * or downloaded code was already running.
6388          */
6389         brcmf_sdbrcm_chip_disablecore(bus->card, ci->armcorebase);
6390
6391         brcmf_sdcard_reg_write(bus->card,
6392                 CORE_CC_REG(ci->cccorebase, gpiopullup), 4, 0);
6393         brcmf_sdcard_reg_write(bus->card,
6394                 CORE_CC_REG(ci->cccorebase, gpiopulldown), 4, 0);
6395
6396         /* Disable F2 to clear any intermediate frame state on the dongle */
6397         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
6398                 SDIO_FUNC_ENABLE_1, NULL);
6399
6400         /* WAR: cmd52 backplane read so core HW will drop ALPReq */
6401         clkval = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
6402                         0, NULL);
6403
6404         /* Done with backplane-dependent accesses, can drop clock... */
6405         brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
6406                                0, NULL);
6407
6408         bus->ci = ci;
6409         return 0;
6410 fail:
6411         bus->ci = NULL;
6412         kfree(ci);
6413         return err;
6414 }
6415
6416 static void
6417 brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_card *card, u32 corebase)
6418 {
6419         u32 regdata;
6420
6421         /*
6422          * Must do the disable sequence first to work for
6423          * arbitrary current core state.
6424          */
6425         brcmf_sdbrcm_chip_disablecore(card, corebase);
6426
6427         /*
6428          * Now do the initialization sequence.
6429          * set reset while enabling the clock and
6430          * forcing them on throughout the core
6431          */
6432         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6433                 ((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
6434                 SBTML_RESET);
6435         udelay(1);
6436
6437         regdata = brcmf_sdcard_reg_read(card, CORE_SB(corebase, sbtmstatehigh),
6438                                         4);
6439         if (regdata & SBTMH_SERR)
6440                 brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatehigh),
6441                                        4, 0);
6442
6443         regdata = brcmf_sdcard_reg_read(card, CORE_SB(corebase, sbimstate), 4);
6444         if (regdata & (SBIM_IBE | SBIM_TO))
6445                 brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbimstate), 4,
6446                         regdata & ~(SBIM_IBE | SBIM_TO));
6447
6448         /* clear reset and allow it to propagate throughout the core */
6449         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6450                 (SICF_FGC << SBTML_SICF_SHIFT) |
6451                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
6452         udelay(1);
6453
6454         /* leave clock enabled */
6455         brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
6456                 (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
6457         udelay(1);
6458 }
6459
6460 /* SDIO Pad drive strength to select value mappings */
6461 struct sdiod_drive_str {
6462         u8 strength;    /* Pad Drive Strength in mA */
6463         u8 sel;         /* Chip-specific select value */
6464 };
6465
6466 /* SDIO Drive Strength to sel value table for PMU Rev 1 */
6467 static const struct sdiod_drive_str sdiod_drive_strength_tab1[] = {
6468         {
6469         4, 0x2}, {
6470         2, 0x3}, {
6471         1, 0x0}, {
6472         0, 0x0}
6473         };
6474
6475 /* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
6476 static const struct sdiod_drive_str sdiod_drive_strength_tab2[] = {
6477         {
6478         12, 0x7}, {
6479         10, 0x6}, {
6480         8, 0x5}, {
6481         6, 0x4}, {
6482         4, 0x2}, {
6483         2, 0x1}, {
6484         0, 0x0}
6485         };
6486
6487 /* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
6488 static const struct sdiod_drive_str sdiod_drive_strength_tab3[] = {
6489         {
6490         32, 0x7}, {
6491         26, 0x6}, {
6492         22, 0x5}, {
6493         16, 0x4}, {
6494         12, 0x3}, {
6495         8, 0x2}, {
6496         4, 0x1}, {
6497         0, 0x0}
6498         };
6499
6500 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
6501
6502 static void
6503 brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus, u32 drivestrength) {
6504         struct sdiod_drive_str *str_tab = NULL;
6505         u32 str_mask = 0;
6506         u32 str_shift = 0;
6507         char chn[8];
6508
6509         if (!(bus->ci->cccaps & CC_CAP_PMU))
6510                 return;
6511
6512         switch (SDIOD_DRVSTR_KEY(bus->ci->chip, bus->ci->pmurev)) {
6513         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
6514                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab1;
6515                 str_mask = 0x30000000;
6516                 str_shift = 28;
6517                 break;
6518         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
6519         case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
6520                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab2;
6521                 str_mask = 0x00003800;
6522                 str_shift = 11;
6523                 break;
6524         case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
6525                 str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab3;
6526                 str_mask = 0x00003800;
6527                 str_shift = 11;
6528                 break;
6529         default:
6530                 BRCMF_ERROR(("No SDIO Drive strength init"
6531                              "done for chip %s rev %d pmurev %d\n",
6532                              brcmu_chipname(bus->ci->chip, chn, 8),
6533                              bus->ci->chiprev, bus->ci->pmurev));
6534                 break;
6535         }
6536
6537         if (str_tab != NULL) {
6538                 u32 drivestrength_sel = 0;
6539                 u32 cc_data_temp;
6540                 int i;
6541
6542                 for (i = 0; str_tab[i].strength != 0; i++) {
6543                         if (drivestrength >= str_tab[i].strength) {
6544                                 drivestrength_sel = str_tab[i].sel;
6545                                 break;
6546                         }
6547                 }
6548
6549                 brcmf_sdcard_reg_write(bus->card,
6550                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
6551                         4, 1);
6552                 cc_data_temp = brcmf_sdcard_reg_read(bus->card,
6553                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr), 4);
6554                 cc_data_temp &= ~str_mask;
6555                 drivestrength_sel <<= str_shift;
6556                 cc_data_temp |= drivestrength_sel;
6557                 brcmf_sdcard_reg_write(bus->card,
6558                         CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
6559                         4, cc_data_temp);
6560
6561                 BRCMF_INFO(("SDIO: %dmA drive strength selected, "
6562                             "set to 0x%08x\n", drivestrength, cc_data_temp));
6563         }
6564 }
6565
6566 static void
6567 brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus)
6568 {
6569         BRCMF_TRACE(("%s: Enter\n", __func__));
6570
6571         kfree(bus->ci);
6572         bus->ci = NULL;
6573 }
6574
6575 static void
6576 brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
6577 {
6578         brcmf_sdbrcm_sdunlock(bus);
6579         wait_event_interruptible_timeout(bus->ctrl_wait,
6580                                          (*lockvar == false), HZ * 2);
6581         brcmf_sdbrcm_sdlock(bus);
6582         return;
6583 }
6584
6585 static void
6586 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
6587 {
6588         if (waitqueue_active(&bus->ctrl_wait))
6589                 wake_up_interruptible(&bus->ctrl_wait);
6590         return;
6591 }
6592
6593 static int
6594 brcmf_sdbrcm_watchdog_thread(void *data)
6595 {
6596         struct brcmf_bus *bus = (struct brcmf_bus *)data;
6597
6598         /* This thread doesn't need any user-level access,
6599         * so get rid of all our resources
6600         */
6601         if (brcmf_watchdog_prio > 0) {
6602                 struct sched_param param;
6603                 param.sched_priority = (brcmf_watchdog_prio < MAX_RT_PRIO) ?
6604                                        brcmf_watchdog_prio : (MAX_RT_PRIO - 1);
6605                 sched_setscheduler(current, SCHED_FIFO, &param);
6606         }
6607
6608         allow_signal(SIGTERM);
6609         /* Run until signal received */
6610         while (1) {
6611                 if (kthread_should_stop())
6612                         break;
6613                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
6614                         if (bus->drvr->dongle_reset == false)
6615                                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
6616                         /* Count the tick for reference */
6617                         bus->drvr->tickcnt++;
6618                 } else
6619                         break;
6620         }
6621         return 0;
6622 }
6623
6624 static void
6625 brcmf_sdbrcm_watchdog(unsigned long data)
6626 {
6627         struct brcmf_bus *bus = (struct brcmf_bus *)data;
6628
6629         if (brcmf_watchdog_prio >= 0) {
6630                 if (bus->watchdog_tsk)
6631                         complete(&bus->watchdog_wait);
6632                 else
6633                         return;
6634         } else {
6635                 brcmf_sdbrcm_bus_watchdog(bus->drvr);
6636
6637                 /* Count the tick for reference */
6638                 bus->drvr->tickcnt++;
6639         }
6640
6641         /* Reschedule the watchdog */
6642         if (bus->wd_timer_valid)
6643                 mod_timer(&bus->timer, jiffies + brcmf_watchdog_ms * HZ / 1000);
6644 }
6645
6646 void
6647 brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
6648 {
6649         static uint save_ms;
6650
6651         /* don't start the wd until fw is loaded */
6652         if (bus->drvr->busstate == BRCMF_BUS_DOWN)
6653                 return;
6654
6655         /* Totally stop the timer */
6656         if (!wdtick && bus->wd_timer_valid == true) {
6657                 del_timer_sync(&bus->timer);
6658                 bus->wd_timer_valid = false;
6659                 save_ms = wdtick;
6660                 return;
6661         }
6662
6663         if (wdtick) {
6664                 brcmf_watchdog_ms = (uint) wdtick;
6665
6666                 if (save_ms != brcmf_watchdog_ms) {
6667                         if (bus->wd_timer_valid == true)
6668                                 /* Stop timer and restart at new value */
6669                                 del_timer_sync(&bus->timer);
6670
6671                         /* Create timer again when watchdog period is
6672                            dynamically changed or in the first instance
6673                          */
6674                         bus->timer.expires =
6675                                 jiffies + brcmf_watchdog_ms * HZ / 1000;
6676                         add_timer(&bus->timer);
6677
6678                 } else {
6679                         /* Re arm the timer, at last watchdog period */
6680                         mod_timer(&bus->timer,
6681                                 jiffies + brcmf_watchdog_ms * HZ / 1000);
6682                 }
6683
6684                 bus->wd_timer_valid = true;
6685                 save_ms = wdtick;
6686         }
6687 }
6688
6689 static int brcmf_sdbrcm_dpc_thread(void *data)
6690 {
6691         struct brcmf_bus *bus = (struct brcmf_bus *) data;
6692
6693         /* This thread doesn't need any user-level access,
6694          * so get rid of all our resources
6695          */
6696         if (brcmf_dpc_prio > 0) {
6697                 struct sched_param param;
6698                 param.sched_priority = (brcmf_dpc_prio < MAX_RT_PRIO) ?
6699                                        brcmf_dpc_prio : (MAX_RT_PRIO - 1);
6700                 sched_setscheduler(current, SCHED_FIFO, &param);
6701         }
6702
6703         allow_signal(SIGTERM);
6704         /* Run until signal received */
6705         while (1) {
6706                 if (kthread_should_stop())
6707                         break;
6708                 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
6709                         /* Call bus dpc unless it indicated down
6710                         (then clean stop) */
6711                         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
6712                                 if (brcmf_sdbrcm_dpc(bus))
6713                                         complete(&bus->dpc_wait);
6714                         } else {
6715                                 brcmf_sdbrcm_bus_stop(bus, true);
6716                         }
6717                 } else
6718                         break;
6719         }
6720         return 0;
6721 }
6722
6723 static void brcmf_sdbrcm_dpc_tasklet(unsigned long data)
6724 {
6725         struct brcmf_bus *bus = (struct brcmf_bus *) data;
6726
6727         /* Call bus dpc unless it indicated down (then clean stop) */
6728         if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
6729                 if (brcmf_sdbrcm_dpc(bus))
6730                         tasklet_schedule(&bus->tasklet);
6731         } else
6732                 brcmf_sdbrcm_bus_stop(bus, true);
6733 }
6734
6735 static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus)
6736 {
6737         if (bus->dpc_tsk) {
6738                 complete(&bus->dpc_wait);
6739                 return;
6740         }
6741
6742         tasklet_schedule(&bus->tasklet);
6743 }
6744
6745 static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus)
6746 {
6747         if (bus->threads_only)
6748                 down(&bus->sdsem);
6749         else
6750                 spin_lock_bh(&bus->sdlock);
6751 }
6752
6753 static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus)
6754 {
6755         if (bus->threads_only)
6756                 up(&bus->sdsem);
6757         else
6758                 spin_unlock_bh(&bus->sdlock);
6759 }
6760
6761 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
6762 {
6763         if (bus->firmware->size < bus->fw_ptr + len)
6764                 len = bus->firmware->size - bus->fw_ptr;
6765
6766         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
6767         bus->fw_ptr += len;
6768         return len;
6769 }
6770
6771 MODULE_FIRMWARE(BCM4329_FW_NAME);
6772 MODULE_FIRMWARE(BCM4329_NV_NAME);