drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <linux/module.h>
  31 #include <linux/bcma/bcma.h>
  32 #include <linux/debugfs.h>
  33 #include <linux/vmalloc.h>
  34 #include <asm/unaligned.h>
  35 #include <defs.h>
  36 #include <brcmu_wifi.h>
  37 #include <brcmu_utils.h>
  38 #include <brcm_hw_ids.h>
  39 #include <soc.h>
  40 #include "sdio_host.h"
  41 #include "sdio_chip.h"
  42
  43 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
  44
  45 #ifdef DEBUG
  46
  47 #define BRCMF_TRAP_INFO_SIZE    80
  48
  49 #define CBUF_LEN        (128)
  50
  51 /* Device console log buffer state */
  52 #define CONSOLE_BUFFER_MAX      2024
  53
  54 struct rte_log_le {
  55         __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  56         __le32 buf_size;
  57         __le32 idx;
  58         char *_buf_compat;      /* Redundant pointer for backward compat. */
  59 };
  60
  61 struct rte_console {
  62         /* Virtual UART
  63          * When there is no UART (e.g. Quickturn),
  64          * the host should write a complete
  65          * input line directly into cbuf and then write
  66          * the length into vcons_in.
  67          * This may also be used when there is a real UART
  68          * (at risk of conflicting with
  69          * the real UART).  vcons_out is currently unused.
  70          */
  71         uint vcons_in;
  72         uint vcons_out;
  73
  74         /* Output (logging) buffer
  75          * Console output is written to a ring buffer log_buf at index log_idx.
  76          * The host may read the output when it sees log_idx advance.
  77          * Output will be lost if the output wraps around faster than the host
  78          * polls.
  79          */
  80         struct rte_log_le log_le;
  81
  82         /* Console input line buffer
  83          * Characters are read one at a time into cbuf
  84          * until <CR> is received, then
  85          * the buffer is processed as a command line.
  86          * Also used for virtual UART.
  87          */
  88         uint cbuf_idx;
  89         char cbuf[CBUF_LEN];
  90 };
  91
  92 #endif                          /* DEBUG */
  93 #include <chipcommon.h>
  94
  95 #include "dhd_bus.h"
  96 #include "dhd_dbg.h"
  97
  98 #define TXQLEN          2048    /* bulk tx queue length */
  99 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 100 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 101 #define PRIOMASK        7
 102
 103 #define TXRETRIES       2       /* # of retries for tx frames */
 104
 105 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 106                                  one scheduling */
 107
 108 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 109                                  one scheduling */
 110
 111 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 112
 113 #define MEMBLOCK        2048    /* Block size used for downloading
 114                                  of dongle image */
 115 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 116                                  biggest possible glom */
 117
 118 #define BRCMF_FIRSTREAD (1 << 6)
 119
 120
 121 /* SBSDIO_DEVICE_CTL */
 122
 123 /* 1: device will assert busy signal when receiving CMD53 */
 124 #define SBSDIO_DEVCTL_SETBUSY           0x01
 125 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 126 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 127 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 128 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 129 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 130  * sdio bus power cycle to clear (rev 9) */
 131 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 132 /* Force SD->SB reset mapping (rev 11) */
 133 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 134 /*   Determined by CoreControl bit */
 135 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 136 /*   Force backplane reset */
 137 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 138 /*   Force no backplane reset */
 139 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 140
 141 /* direct(mapped) cis space */
 142
 143 /* MAPPED common CIS address */
 144 #define SBSDIO_CIS_BASE_COMMON          0x1000
 145 /* maximum bytes in one CIS */
 146 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 147 /* cis offset addr is < 17 bits */
 148 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 149
 150 /* manfid tuple length, include tuple, link bytes */
 151 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 152
 153 /* intstatus */
 154 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 155 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 156 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 157 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 158 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 159 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 160 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 161 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 162 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 163 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 164 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 165 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 166 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 167 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 168 #define I_PC            (1 << 10)       /* descriptor error */
 169 #define I_PD            (1 << 11)       /* data error */
 170 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 171 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 172 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 173 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 174 #define I_RI            (1 << 16)       /* Receive Interrupt */
 175 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 176 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 177 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 178 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 179 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 180 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 181 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 182 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 183 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 184 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 185 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 186 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 187
 188 /* corecontrol */
 189 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 190 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 191 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 192 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 193 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 194 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 195
 196 /* SDA_FRAMECTRL */
 197 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 198 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 199 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 200 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 201
 202 /* HW frame tag */
 203 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 204
 205 /* Total length of frame header for dongle protocol */
 206 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 207 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 208
 209 /*
 210  * Software allocation of To SB Mailbox resources
 211  */
 212
 213 /* tosbmailbox bits corresponding to intstatus bits */
 214 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 215 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 216 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 217 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 218
 219 /* tosbmailboxdata */
 220 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 221
 222 /*
 223  * Software allocation of To Host Mailbox resources
 224  */
 225
 226 /* intstatus bits */
 227 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 228 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 229 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 230 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 231
 232 /* tohostmailboxdata */
 233 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 234 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 235 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 236 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 237
 238 #define HMB_DATA_FCDATA_MASK    0xff000000
 239 #define HMB_DATA_FCDATA_SHIFT   24
 240
 241 #define HMB_DATA_VERSION_MASK   0x00ff0000
 242 #define HMB_DATA_VERSION_SHIFT  16
 243
 244 /*
 245  * Software-defined protocol header
 246  */
 247
 248 /* Current protocol version */
 249 #define SDPCM_PROT_VERSION      4
 250
 251 /* SW frame header */
 252 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 253
 254 #define SDPCM_CHANNEL_MASK              0x00000f00
 255 #define SDPCM_CHANNEL_SHIFT             8
 256 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 257
 258 #define SDPCM_NEXTLEN_OFFSET            2
 259
 260 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 261 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 262 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 263 #define SDPCM_DOFFSET_MASK              0xff000000
 264 #define SDPCM_DOFFSET_SHIFT             24
 265 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 266 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 267 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 268 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 269
 270 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 271
 272 /* logical channel numbers */
 273 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 274 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 275 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 276 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 277 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 278
 279 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 280
 281 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 282
 283 /*
 284  * Shared structure between dongle and the host.
 285  * The structure contains pointers to trap or assert information.
 286  */
 287 #define SDPCM_SHARED_VERSION       0x0003
 288 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 289 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 290 #define SDPCM_SHARED_ASSERT        0x0200
 291 #define SDPCM_SHARED_TRAP          0x0400
 292
 293 /* Space for header read, limit for data packets */
 294 #define MAX_HDR_READ    (1 << 6)
 295 #define MAX_RX_DATASZ   2048
 296
 297 /* Maximum milliseconds to wait for F2 to come up */
 298 #define BRCMF_WAIT_F2RDY        3000
 299
 300 /* Bump up limit on waiting for HT to account for first startup;
 301  * if the image is doing a CRC calculation before programming the PMU
 302  * for HT availability, it could take a couple hundred ms more, so
 303  * max out at a 1 second (1000000us).
 304  */
 305 #undef PMU_MAX_TRANSITION_DLY
 306 #define PMU_MAX_TRANSITION_DLY 1000000
 307
 308 /* Value for ChipClockCSR during initial setup */
 309 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 310                                         SBSDIO_ALP_AVAIL_REQ)
 311
 312 /* Flags for SDH calls */
 313 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 314
 315 #define BRCMF_SDIO_FW_NAME      "brcm/brcmfmac-sdio.bin"
 316 #define BRCMF_SDIO_NV_NAME      "brcm/brcmfmac-sdio.txt"
 317 MODULE_FIRMWARE(BRCMF_SDIO_FW_NAME);
 318 MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
 319
 320 #define BRCMF_IDLE_IMMEDIATE    (-1)    /* Enter idle immediately */
 321 #define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
 322                                          * when idle
 323                                          */
 324 #define BRCMF_IDLE_INTERVAL     1
 325
 326 /*
 327  * Conversion of 802.1D priority to precedence level
 328  */
 329 static uint prio2prec(u32 prio)
 330 {
 331         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 332                (prio^2) : prio;
 333 }
 334
 335 /* core registers */
 336 struct sdpcmd_regs {
 337         u32 corecontrol;                /* 0x00, rev8 */
 338         u32 corestatus;                 /* rev8 */
 339         u32 PAD[1];
 340         u32 biststatus;                 /* rev8 */
 341
 342         /* PCMCIA access */
 343         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 344         u16 PAD[1];
 345         u16 pcmciamesportalmask;        /* rev8 */
 346         u16 PAD[1];
 347         u16 pcmciawrframebc;            /* rev8 */
 348         u16 PAD[1];
 349         u16 pcmciaunderflowtimer;       /* rev8 */
 350         u16 PAD[1];
 351
 352         /* interrupt */
 353         u32 intstatus;                  /* 0x020, rev8 */
 354         u32 hostintmask;                /* rev8 */
 355         u32 intmask;                    /* rev8 */
 356         u32 sbintstatus;                /* rev8 */
 357         u32 sbintmask;                  /* rev8 */
 358         u32 funcintmask;                /* rev4 */
 359         u32 PAD[2];
 360         u32 tosbmailbox;                /* 0x040, rev8 */
 361         u32 tohostmailbox;              /* rev8 */
 362         u32 tosbmailboxdata;            /* rev8 */
 363         u32 tohostmailboxdata;          /* rev8 */
 364
 365         /* synchronized access to registers in SDIO clock domain */
 366         u32 sdioaccess;                 /* 0x050, rev8 */
 367         u32 PAD[3];
 368
 369         /* PCMCIA frame control */
 370         u8 pcmciaframectrl;             /* 0x060, rev8 */
 371         u8 PAD[3];
 372         u8 pcmciawatermark;             /* rev8 */
 373         u8 PAD[155];
 374
 375         /* interrupt batching control */
 376         u32 intrcvlazy;                 /* 0x100, rev8 */
 377         u32 PAD[3];
 378
 379         /* counters */
 380         u32 cmd52rd;                    /* 0x110, rev8 */
 381         u32 cmd52wr;                    /* rev8 */
 382         u32 cmd53rd;                    /* rev8 */
 383         u32 cmd53wr;                    /* rev8 */
 384         u32 abort;                      /* rev8 */
 385         u32 datacrcerror;               /* rev8 */
 386         u32 rdoutofsync;                /* rev8 */
 387         u32 wroutofsync;                /* rev8 */
 388         u32 writebusy;                  /* rev8 */
 389         u32 readwait;                   /* rev8 */
 390         u32 readterm;                   /* rev8 */
 391         u32 writeterm;                  /* rev8 */
 392         u32 PAD[40];
 393         u32 clockctlstatus;             /* rev8 */
 394         u32 PAD[7];
 395
 396         u32 PAD[128];                   /* DMA engines */
 397
 398         /* SDIO/PCMCIA CIS region */
 399         char cis[512];                  /* 0x400-0x5ff, rev6 */
 400
 401         /* PCMCIA function control registers */
 402         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 403         u16 PAD[55];
 404
 405         /* PCMCIA backplane access */
 406         u16 backplanecsr;               /* 0x76E, rev6 */
 407         u16 backplaneaddr0;             /* rev6 */
 408         u16 backplaneaddr1;             /* rev6 */
 409         u16 backplaneaddr2;             /* rev6 */
 410         u16 backplaneaddr3;             /* rev6 */
 411         u16 backplanedata0;             /* rev6 */
 412         u16 backplanedata1;             /* rev6 */
 413         u16 backplanedata2;             /* rev6 */
 414         u16 backplanedata3;             /* rev6 */
 415         u16 PAD[31];
 416
 417         /* sprom "size" & "blank" info */
 418         u16 spromstatus;                /* 0x7BE, rev2 */
 419         u32 PAD[464];
 420
 421         u16 PAD[0x80];
 422 };
 423
 424 #ifdef DEBUG
 425 /* Device console log buffer state */
 426 struct brcmf_console {
 427         uint count;             /* Poll interval msec counter */
 428         uint log_addr;          /* Log struct address (fixed) */
 429         struct rte_log_le log_le;       /* Log struct (host copy) */
 430         uint bufsize;           /* Size of log buffer */
 431         u8 *buf;                /* Log buffer (host copy) */
 432         uint last;              /* Last buffer read index */
 433 };
 434
 435 struct brcmf_trap_info {
 436         __le32          type;
 437         __le32          epc;
 438         __le32          cpsr;
 439         __le32          spsr;
 440         __le32          r0;     /* a1 */
 441         __le32          r1;     /* a2 */
 442         __le32          r2;     /* a3 */
 443         __le32          r3;     /* a4 */
 444         __le32          r4;     /* v1 */
 445         __le32          r5;     /* v2 */
 446         __le32          r6;     /* v3 */
 447         __le32          r7;     /* v4 */
 448         __le32          r8;     /* v5 */
 449         __le32          r9;     /* sb/v6 */
 450         __le32          r10;    /* sl/v7 */
 451         __le32          r11;    /* fp/v8 */
 452         __le32          r12;    /* ip */
 453         __le32          r13;    /* sp */
 454         __le32          r14;    /* lr */
 455         __le32          pc;     /* r15 */
 456 };
 457 #endif                          /* DEBUG */
 458
 459 struct sdpcm_shared {
 460         u32 flags;
 461         u32 trap_addr;
 462         u32 assert_exp_addr;
 463         u32 assert_file_addr;
 464         u32 assert_line;
 465         u32 console_addr;       /* Address of struct rte_console */
 466         u32 msgtrace_addr;
 467         u8 tag[32];
 468         u32 brpt_addr;
 469 };
 470
 471 struct sdpcm_shared_le {
 472         __le32 flags;
 473         __le32 trap_addr;
 474         __le32 assert_exp_addr;
 475         __le32 assert_file_addr;
 476         __le32 assert_line;
 477         __le32 console_addr;    /* Address of struct rte_console */
 478         __le32 msgtrace_addr;
 479         u8 tag[32];
 480         __le32 brpt_addr;
 481 };
 482
 483 /* SDIO read frame info */
 484 struct brcmf_sdio_read {
 485         u8 seq_num;
 486         u8 channel;
 487         u16 len;
 488         u16 len_left;
 489         u16 len_nxtfrm;
 490         u8 dat_offset;
 491 };
 492
 493 /* misc chip info needed by some of the routines */
 494 /* Private data for SDIO bus interaction */
 495 struct brcmf_sdio {
 496         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 497         struct chip_info *ci;   /* Chip info struct */
 498         char *vars;             /* Variables (from CIS and/or other) */
 499         uint varsz;             /* Size of variables buffer */
 500
 501         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 502
 503         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 504         atomic_t intstatus;     /* Intstatus bits (events) pending */
 505         atomic_t fcstate;       /* State of dongle flow-control */
 506
 507         uint blocksize;         /* Block size of SDIO transfers */
 508         uint roundup;           /* Max roundup limit */
 509
 510         struct pktq txq;        /* Queue length used for flow-control */
 511         u8 flowcontrol; /* per prio flow control bitmask */
 512         u8 tx_seq;              /* Transmit sequence number (next) */
 513         u8 tx_max;              /* Maximum transmit sequence allowed */
 514
 515         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 516         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 517         u8 rx_seq;              /* Receive sequence number (expected) */
 518         struct brcmf_sdio_read cur_read;
 519                                 /* info of current read frame */
 520         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 521         bool rxpending;         /* Data frame pending in dongle */
 522
 523         uint rxbound;           /* Rx frames to read before resched */
 524         uint txbound;           /* Tx frames to send before resched */
 525         uint txminmax;
 526
 527         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 528         struct sk_buff_head glom; /* Packet list for glommed superframe */
 529         uint glomerr;           /* Glom packet read errors */
 530
 531         u8 *rxbuf;              /* Buffer for receiving control packets */
 532         uint rxblen;            /* Allocated length of rxbuf */
 533         u8 *rxctl;              /* Aligned pointer into rxbuf */
 534         u8 *rxctl_orig;         /* pointer for freeing rxctl */
 535         u8 *databuf;            /* Buffer for receiving big glom packet */
 536         u8 *dataptr;            /* Aligned pointer into databuf */
 537         uint rxlen;             /* Length of valid data in buffer */
 538         spinlock_t rxctl_lock;  /* protection lock for ctrl frame resources */
 539
 540         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 541
 542         bool intr;              /* Use interrupts */
 543         bool poll;              /* Use polling */
 544         atomic_t ipend;         /* Device interrupt is pending */
 545         uint spurious;          /* Count of spurious interrupts */
 546         uint pollrate;          /* Ticks between device polls */
 547         uint polltick;          /* Tick counter */
 548
 549 #ifdef DEBUG
 550         uint console_interval;
 551         struct brcmf_console console;   /* Console output polling support */
 552         uint console_addr;      /* Console address from shared struct */
 553 #endif                          /* DEBUG */
 554
 555         uint clkstate;          /* State of sd and backplane clock(s) */
 556         bool activity;          /* Activity flag for clock down */
 557         s32 idletime;           /* Control for activity timeout */
 558         s32 idlecount;  /* Activity timeout counter */
 559         s32 idleclock;  /* How to set bus driver when idle */
 560         s32 sd_rxchain;
 561         bool use_rxchain;       /* If brcmf should use PKT chains */
 562         bool rxflow_mode;       /* Rx flow control mode */
 563         bool rxflow;            /* Is rx flow control on */
 564         bool alp_only;          /* Don't use HT clock (ALP only) */
 565
 566         u8 *ctrl_frame_buf;
 567         u32 ctrl_frame_len;
 568         bool ctrl_frame_stat;
 569
 570         spinlock_t txqlock;
 571         wait_queue_head_t ctrl_wait;
 572         wait_queue_head_t dcmd_resp_wait;
 573
 574         struct timer_list timer;
 575         struct completion watchdog_wait;
 576         struct task_struct *watchdog_tsk;
 577         bool wd_timer_valid;
 578         uint save_ms;
 579
 580         struct workqueue_struct *brcmf_wq;
 581         struct work_struct datawork;
 582         struct list_head dpc_tsklst;
 583         spinlock_t dpc_tl_lock;
 584
 585         const struct firmware *firmware;
 586         u32 fw_ptr;
 587
 588         bool txoff;             /* Transmit flow-controlled */
 589         struct brcmf_sdio_count sdcnt;
 590 };
 591
 592 /* clkstate */
 593 #define CLK_NONE        0
 594 #define CLK_SDONLY      1
 595 #define CLK_PENDING     2       /* Not used yet */
 596 #define CLK_AVAIL       3
 597
 598 #ifdef DEBUG
 599 static int qcount[NUMPRIO];
 600 static int tx_packets[NUMPRIO];
 601 #endif                          /* DEBUG */
 602
 603 #define SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 604
 605 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 606
 607 /* Retry count for register access failures */
 608 static const uint retry_limit = 2;
 609
 610 /* Limit on rounding up frames */
 611 static const uint max_roundup = 512;
 612
 613 #define ALIGNMENT  4
 614
 615 enum brcmf_sdio_frmtype {
 616         BRCMF_SDIO_FT_NORMAL,
 617         BRCMF_SDIO_FT_SUPER,
 618         BRCMF_SDIO_FT_SUB,
 619 };
 620
 621 static void pkt_align(struct sk_buff *p, int len, int align)
 622 {
 623         uint datalign;
 624         datalign = (unsigned long)(p->data);
 625         datalign = roundup(datalign, (align)) - datalign;
 626         if (datalign)
 627                 skb_pull(p, datalign);
 628         __skb_trim(p, len);
 629 }
 630
 631 /* To check if there's window offered */
 632 static bool data_ok(struct brcmf_sdio *bus)
 633 {
 634         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 635                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 636 }
 637
 638 /*
 639  * Reads a register in the SDIO hardware block. This block occupies a series of
 640  * adresses on the 32 bit backplane bus.
 641  */
 642 static int
 643 r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
 644 {
 645         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 646         int ret;
 647
 648         *regvar = brcmf_sdio_regrl(bus->sdiodev,
 649                                    bus->ci->c_inf[idx].base + offset, &ret);
 650
 651         return ret;
 652 }
 653
 654 static int
 655 w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
 656 {
 657         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 658         int ret;
 659
 660         brcmf_sdio_regwl(bus->sdiodev,
 661                          bus->ci->c_inf[idx].base + reg_offset,
 662                          regval, &ret);
 663
 664         return ret;
 665 }
 666
 667 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 668
 669 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 670
 671 /* Turn backplane clock on or off */
 672 static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 673 {
 674         int err;
 675         u8 clkctl, clkreq, devctl;
 676         unsigned long timeout;
 677
 678         brcmf_dbg(TRACE, "Enter\n");
 679
 680         clkctl = 0;
 681
 682         if (on) {
 683                 /* Request HT Avail */
 684                 clkreq =
 685                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 686
 687                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 688                                  clkreq, &err);
 689                 if (err) {
 690                         brcmf_err("HT Avail request error: %d\n", err);
 691                         return -EBADE;
 692                 }
 693
 694                 /* Check current status */
 695                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
 696                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
 697                 if (err) {
 698                         brcmf_err("HT Avail read error: %d\n", err);
 699                         return -EBADE;
 700                 }
 701
 702                 /* Go to pending and await interrupt if appropriate */
 703                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 704                         /* Allow only clock-available interrupt */
 705                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 706                                                   SBSDIO_DEVICE_CTL, &err);
 707                         if (err) {
 708                                 brcmf_err("Devctl error setting CA: %d\n",
 709                                           err);
 710                                 return -EBADE;
 711                         }
 712
 713                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 714                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 715                                          devctl, &err);
 716                         brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
 717                         bus->clkstate = CLK_PENDING;
 718
 719                         return 0;
 720                 } else if (bus->clkstate == CLK_PENDING) {
 721                         /* Cancel CA-only interrupt filter */
 722                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 723                                                   SBSDIO_DEVICE_CTL, &err);
 724                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 725                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 726                                          devctl, &err);
 727                 }
 728
 729                 /* Otherwise, wait here (polling) for HT Avail */
 730                 timeout = jiffies +
 731                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 732                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 733                         clkctl = brcmf_sdio_regrb(bus->sdiodev,
 734                                                   SBSDIO_FUNC1_CHIPCLKCSR,
 735                                                   &err);
 736                         if (time_after(jiffies, timeout))
 737                                 break;
 738                         else
 739                                 usleep_range(5000, 10000);
 740                 }
 741                 if (err) {
 742                         brcmf_err("HT Avail request error: %d\n", err);
 743                         return -EBADE;
 744                 }
 745                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 746                         brcmf_err("HT Avail timeout (%d): clkctl 0x%02x\n",
 747                                   PMU_MAX_TRANSITION_DLY, clkctl);
 748                         return -EBADE;
 749                 }
 750
 751                 /* Mark clock available */
 752                 bus->clkstate = CLK_AVAIL;
 753                 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
 754
 755 #if defined(DEBUG)
 756                 if (!bus->alp_only) {
 757                         if (SBSDIO_ALPONLY(clkctl))
 758                                 brcmf_err("HT Clock should be on\n");
 759                 }
 760 #endif                          /* defined (DEBUG) */
 761
 762                 bus->activity = true;
 763         } else {
 764                 clkreq = 0;
 765
 766                 if (bus->clkstate == CLK_PENDING) {
 767                         /* Cancel CA-only interrupt filter */
 768                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 769                                                   SBSDIO_DEVICE_CTL, &err);
 770                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 771                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 772                                          devctl, &err);
 773                 }
 774
 775                 bus->clkstate = CLK_SDONLY;
 776                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 777                                  clkreq, &err);
 778                 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
 779                 if (err) {
 780                         brcmf_err("Failed access turning clock off: %d\n",
 781                                   err);
 782                         return -EBADE;
 783                 }
 784         }
 785         return 0;
 786 }
 787
 788 /* Change idle/active SD state */
 789 static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
 790 {
 791         brcmf_dbg(TRACE, "Enter\n");
 792
 793         if (on)
 794                 bus->clkstate = CLK_SDONLY;
 795         else
 796                 bus->clkstate = CLK_NONE;
 797
 798         return 0;
 799 }
 800
 801 /* Transition SD and backplane clock readiness */
 802 static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 803 {
 804 #ifdef DEBUG
 805         uint oldstate = bus->clkstate;
 806 #endif                          /* DEBUG */
 807
 808         brcmf_dbg(TRACE, "Enter\n");
 809
 810         /* Early exit if we're already there */
 811         if (bus->clkstate == target) {
 812                 if (target == CLK_AVAIL) {
 813                         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 814                         bus->activity = true;
 815                 }
 816                 return 0;
 817         }
 818
 819         switch (target) {
 820         case CLK_AVAIL:
 821                 /* Make sure SD clock is available */
 822                 if (bus->clkstate == CLK_NONE)
 823                         brcmf_sdbrcm_sdclk(bus, true);
 824                 /* Now request HT Avail on the backplane */
 825                 brcmf_sdbrcm_htclk(bus, true, pendok);
 826                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 827                 bus->activity = true;
 828                 break;
 829
 830         case CLK_SDONLY:
 831                 /* Remove HT request, or bring up SD clock */
 832                 if (bus->clkstate == CLK_NONE)
 833                         brcmf_sdbrcm_sdclk(bus, true);
 834                 else if (bus->clkstate == CLK_AVAIL)
 835                         brcmf_sdbrcm_htclk(bus, false, false);
 836                 else
 837                         brcmf_err("request for %d -> %d\n",
 838                                   bus->clkstate, target);
 839                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 840                 break;
 841
 842         case CLK_NONE:
 843                 /* Make sure to remove HT request */
 844                 if (bus->clkstate == CLK_AVAIL)
 845                         brcmf_sdbrcm_htclk(bus, false, false);
 846                 /* Now remove the SD clock */
 847                 brcmf_sdbrcm_sdclk(bus, false);
 848                 brcmf_sdbrcm_wd_timer(bus, 0);
 849                 break;
 850         }
 851 #ifdef DEBUG
 852         brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
 853 #endif                          /* DEBUG */
 854
 855         return 0;
 856 }
 857
 858 static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
 859 {
 860         u32 intstatus = 0;
 861         u32 hmb_data;
 862         u8 fcbits;
 863         int ret;
 864
 865         brcmf_dbg(TRACE, "Enter\n");
 866
 867         /* Read mailbox data and ack that we did so */
 868         ret = r_sdreg32(bus, &hmb_data,
 869                         offsetof(struct sdpcmd_regs, tohostmailboxdata));
 870
 871         if (ret == 0)
 872                 w_sdreg32(bus, SMB_INT_ACK,
 873                           offsetof(struct sdpcmd_regs, tosbmailbox));
 874         bus->sdcnt.f1regdata += 2;
 875
 876         /* Dongle recomposed rx frames, accept them again */
 877         if (hmb_data & HMB_DATA_NAKHANDLED) {
 878                 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
 879                           bus->rx_seq);
 880                 if (!bus->rxskip)
 881                         brcmf_err("unexpected NAKHANDLED!\n");
 882
 883                 bus->rxskip = false;
 884                 intstatus |= I_HMB_FRAME_IND;
 885         }
 886
 887         /*
 888          * DEVREADY does not occur with gSPI.
 889          */
 890         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
 891                 bus->sdpcm_ver =
 892                     (hmb_data & HMB_DATA_VERSION_MASK) >>
 893                     HMB_DATA_VERSION_SHIFT;
 894                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
 895                         brcmf_err("Version mismatch, dongle reports %d, "
 896                                   "expecting %d\n",
 897                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
 898                 else
 899                         brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
 900                                   bus->sdpcm_ver);
 901         }
 902
 903         /*
 904          * Flow Control has been moved into the RX headers and this out of band
 905          * method isn't used any more.
 906          * remaining backward compatible with older dongles.
 907          */
 908         if (hmb_data & HMB_DATA_FC) {
 909                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
 910                                                         HMB_DATA_FCDATA_SHIFT;
 911
 912                 if (fcbits & ~bus->flowcontrol)
 913                         bus->sdcnt.fc_xoff++;
 914
 915                 if (bus->flowcontrol & ~fcbits)
 916                         bus->sdcnt.fc_xon++;
 917
 918                 bus->sdcnt.fc_rcvd++;
 919                 bus->flowcontrol = fcbits;
 920         }
 921
 922         /* Shouldn't be any others */
 923         if (hmb_data & ~(HMB_DATA_DEVREADY |
 924                          HMB_DATA_NAKHANDLED |
 925                          HMB_DATA_FC |
 926                          HMB_DATA_FWREADY |
 927                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
 928                 brcmf_err("Unknown mailbox data content: 0x%02x\n",
 929                           hmb_data);
 930
 931         return intstatus;
 932 }
 933
 934 static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 935 {
 936         uint retries = 0;
 937         u16 lastrbc;
 938         u8 hi, lo;
 939         int err;
 940
 941         brcmf_err("%sterminate frame%s\n",
 942                   abort ? "abort command, " : "",
 943                   rtx ? ", send NAK" : "");
 944
 945         if (abort)
 946                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
 947
 948         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
 949                          SFC_RF_TERM, &err);
 950         bus->sdcnt.f1regdata++;
 951
 952         /* Wait until the packet has been flushed (device/FIFO stable) */
 953         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
 954                 hi = brcmf_sdio_regrb(bus->sdiodev,
 955                                       SBSDIO_FUNC1_RFRAMEBCHI, &err);
 956                 lo = brcmf_sdio_regrb(bus->sdiodev,
 957                                       SBSDIO_FUNC1_RFRAMEBCLO, &err);
 958                 bus->sdcnt.f1regdata += 2;
 959
 960                 if ((hi == 0) && (lo == 0))
 961                         break;
 962
 963                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
 964                         brcmf_err("count growing: last 0x%04x now 0x%04x\n",
 965                                   lastrbc, (hi << 8) + lo);
 966                 }
 967                 lastrbc = (hi << 8) + lo;
 968         }
 969
 970         if (!retries)
 971                 brcmf_err("count never zeroed: last 0x%04x\n", lastrbc);
 972         else
 973                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
 974
 975         if (rtx) {
 976                 bus->sdcnt.rxrtx++;
 977                 err = w_sdreg32(bus, SMB_NAK,
 978                                 offsetof(struct sdpcmd_regs, tosbmailbox));
 979
 980                 bus->sdcnt.f1regdata++;
 981                 if (err == 0)
 982                         bus->rxskip = true;
 983         }
 984
 985         /* Clear partial in any case */
 986         bus->cur_read.len = 0;
 987
 988         /* If we can't reach the device, signal failure */
 989         if (err)
 990                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
 991 }
 992
 993 /* copy a buffer into a pkt buffer chain */
 994 static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_sdio *bus, uint len)
 995 {
 996         uint n, ret = 0;
 997         struct sk_buff *p;
 998         u8 *buf;
 999
1000         buf = bus->dataptr;
1001
1002         /* copy the data */
1003         skb_queue_walk(&bus->glom, p) {
1004                 n = min_t(uint, p->len, len);
1005                 memcpy(p->data, buf, n);
1006                 buf += n;
1007                 len -= n;
1008                 ret += n;
1009                 if (!len)
1010                         break;
1011         }
1012
1013         return ret;
1014 }
1015
1016 /* return total length of buffer chain */
1017 static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
1018 {
1019         struct sk_buff *p;
1020         uint total;
1021
1022         total = 0;
1023         skb_queue_walk(&bus->glom, p)
1024                 total += p->len;
1025         return total;
1026 }
1027
1028 static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
1029 {
1030         struct sk_buff *cur, *next;
1031
1032         skb_queue_walk_safe(&bus->glom, cur, next) {
1033                 skb_unlink(cur, &bus->glom);
1034                 brcmu_pkt_buf_free_skb(cur);
1035         }
1036 }
1037
1038 static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
1039                                struct brcmf_sdio_read *rd,
1040                                enum brcmf_sdio_frmtype type)
1041 {
1042         u16 len, checksum;
1043         u8 rx_seq, fc, tx_seq_max;
1044
1045         /*
1046          * 4 bytes hardware header (frame tag)
1047          * Byte 0~1: Frame length
1048          * Byte 2~3: Checksum, bit-wise inverse of frame length
1049          */
1050         len = get_unaligned_le16(header);
1051         checksum = get_unaligned_le16(header + sizeof(u16));
1052         /* All zero means no more to read */
1053         if (!(len | checksum)) {
1054                 bus->rxpending = false;
1055                 return -ENODATA;
1056         }
1057         if ((u16)(~(len ^ checksum))) {
1058                 brcmf_err("HW header checksum error\n");
1059                 bus->sdcnt.rx_badhdr++;
1060                 brcmf_sdbrcm_rxfail(bus, false, false);
1061                 return -EIO;
1062         }
1063         if (len < SDPCM_HDRLEN) {
1064                 brcmf_err("HW header length error\n");
1065                 return -EPROTO;
1066         }
1067         if (type == BRCMF_SDIO_FT_SUPER &&
1068             (roundup(len, bus->blocksize) != rd->len)) {
1069                 brcmf_err("HW superframe header length error\n");
1070                 return -EPROTO;
1071         }
1072         if (type == BRCMF_SDIO_FT_SUB && len > rd->len) {
1073                 brcmf_err("HW subframe header length error\n");
1074                 return -EPROTO;
1075         }
1076         rd->len = len;
1077
1078         /*
1079          * 8 bytes hardware header
1080          * Byte 0: Rx sequence number
1081          * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
1082          * Byte 2: Length of next data frame
1083          * Byte 3: Data offset
1084          * Byte 4: Flow control bits
1085          * Byte 5: Maximum Sequence number allow for Tx
1086          * Byte 6~7: Reserved
1087          */
1088         if (type == BRCMF_SDIO_FT_SUPER &&
1089             SDPCM_GLOMDESC(&header[SDPCM_FRAMETAG_LEN])) {
1090                 brcmf_err("Glom descriptor found in superframe head\n");
1091                 rd->len = 0;
1092                 return -EINVAL;
1093         }
1094         rx_seq = SDPCM_PACKET_SEQUENCE(&header[SDPCM_FRAMETAG_LEN]);
1095         rd->channel = SDPCM_PACKET_CHANNEL(&header[SDPCM_FRAMETAG_LEN]);
1096         if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
1097             type != BRCMF_SDIO_FT_SUPER) {
1098                 brcmf_err("HW header length too long\n");
1099                 bus->sdiodev->bus_if->dstats.rx_errors++;
1100                 bus->sdcnt.rx_toolong++;
1101                 brcmf_sdbrcm_rxfail(bus, false, false);
1102                 rd->len = 0;
1103                 return -EPROTO;
1104         }
1105         if (type == BRCMF_SDIO_FT_SUPER && rd->channel != SDPCM_GLOM_CHANNEL) {
1106                 brcmf_err("Wrong channel for superframe\n");
1107                 rd->len = 0;
1108                 return -EINVAL;
1109         }
1110         if (type == BRCMF_SDIO_FT_SUB && rd->channel != SDPCM_DATA_CHANNEL &&
1111             rd->channel != SDPCM_EVENT_CHANNEL) {
1112                 brcmf_err("Wrong channel for subframe\n");
1113                 rd->len = 0;
1114                 return -EINVAL;
1115         }
1116         rd->dat_offset = SDPCM_DOFFSET_VALUE(&header[SDPCM_FRAMETAG_LEN]);
1117         if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
1118                 brcmf_err("seq %d: bad data offset\n", rx_seq);
1119                 bus->sdcnt.rx_badhdr++;
1120                 brcmf_sdbrcm_rxfail(bus, false, false);
1121                 rd->len = 0;
1122                 return -ENXIO;
1123         }
1124         if (rd->seq_num != rx_seq) {
1125                 brcmf_err("seq %d: sequence number error, expect %d\n",
1126                           rx_seq, rd->seq_num);
1127                 bus->sdcnt.rx_badseq++;
1128                 rd->seq_num = rx_seq;
1129         }
1130         /* no need to check the reset for subframe */
1131         if (type == BRCMF_SDIO_FT_SUB)
1132                 return 0;
1133         rd->len_nxtfrm = header[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1134         if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
1135                 /* only warm for NON glom packet */
1136                 if (rd->channel != SDPCM_GLOM_CHANNEL)
1137                         brcmf_err("seq %d: next length error\n", rx_seq);
1138                 rd->len_nxtfrm = 0;
1139         }
1140         fc = SDPCM_FCMASK_VALUE(&header[SDPCM_FRAMETAG_LEN]);
1141         if (bus->flowcontrol != fc) {
1142                 if (~bus->flowcontrol & fc)
1143                         bus->sdcnt.fc_xoff++;
1144                 if (bus->flowcontrol & ~fc)
1145                         bus->sdcnt.fc_xon++;
1146                 bus->sdcnt.fc_rcvd++;
1147                 bus->flowcontrol = fc;
1148         }
1149         tx_seq_max = SDPCM_WINDOW_VALUE(&header[SDPCM_FRAMETAG_LEN]);
1150         if ((u8)(tx_seq_max - bus->tx_seq) > 0x40) {
1151                 brcmf_err("seq %d: max tx seq number error\n", rx_seq);
1152                 tx_seq_max = bus->tx_seq + 2;
1153         }
1154         bus->tx_max = tx_seq_max;
1155
1156         return 0;
1157 }
1158
1159 static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1160 {
1161         u16 dlen, totlen;
1162         u8 *dptr, num = 0;
1163
1164         u16 sublen;
1165         struct sk_buff *pfirst, *pnext;
1166
1167         int errcode;
1168         u8 doff, sfdoff;
1169
1170         int ifidx = 0;
1171         bool usechain = bus->use_rxchain;
1172
1173         struct brcmf_sdio_read rd_new;
1174
1175         /* If packets, issue read(s) and send up packet chain */
1176         /* Return sequence numbers consumed? */
1177
1178         brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
1179                   bus->glomd, skb_peek(&bus->glom));
1180
1181         /* If there's a descriptor, generate the packet chain */
1182         if (bus->glomd) {
1183                 pfirst = pnext = NULL;
1184                 dlen = (u16) (bus->glomd->len);
1185                 dptr = bus->glomd->data;
1186                 if (!dlen || (dlen & 1)) {
1187                         brcmf_err("bad glomd len(%d), ignore descriptor\n",
1188                                   dlen);
1189                         dlen = 0;
1190                 }
1191
1192                 for (totlen = num = 0; dlen; num++) {
1193                         /* Get (and move past) next length */
1194                         sublen = get_unaligned_le16(dptr);
1195                         dlen -= sizeof(u16);
1196                         dptr += sizeof(u16);
1197                         if ((sublen < SDPCM_HDRLEN) ||
1198                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1199                                 brcmf_err("descriptor len %d bad: %d\n",
1200                                           num, sublen);
1201                                 pnext = NULL;
1202                                 break;
1203                         }
1204                         if (sublen % BRCMF_SDALIGN) {
1205                                 brcmf_err("sublen %d not multiple of %d\n",
1206                                           sublen, BRCMF_SDALIGN);
1207                                 usechain = false;
1208                         }
1209                         totlen += sublen;
1210
1211                         /* For last frame, adjust read len so total
1212                                  is a block multiple */
1213                         if (!dlen) {
1214                                 sublen +=
1215                                     (roundup(totlen, bus->blocksize) - totlen);
1216                                 totlen = roundup(totlen, bus->blocksize);
1217                         }
1218
1219                         /* Allocate/chain packet for next subframe */
1220                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1221                         if (pnext == NULL) {
1222                                 brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
1223                                           num, sublen);
1224                                 break;
1225                         }
1226                         skb_queue_tail(&bus->glom, pnext);
1227
1228                         /* Adhere to start alignment requirements */
1229                         pkt_align(pnext, sublen, BRCMF_SDALIGN);
1230                 }
1231
1232                 /* If all allocations succeeded, save packet chain
1233                          in bus structure */
1234                 if (pnext) {
1235                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1236                                   totlen, num);
1237                         if (BRCMF_GLOM_ON() && bus->cur_read.len &&
1238                             totlen != bus->cur_read.len) {
1239                                 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1240                                           bus->cur_read.len, totlen, rxseq);
1241                         }
1242                         pfirst = pnext = NULL;
1243                 } else {
1244                         brcmf_sdbrcm_free_glom(bus);
1245                         num = 0;
1246                 }
1247
1248                 /* Done with descriptor packet */
1249                 brcmu_pkt_buf_free_skb(bus->glomd);
1250                 bus->glomd = NULL;
1251                 bus->cur_read.len = 0;
1252         }
1253
1254         /* Ok -- either we just generated a packet chain,
1255                  or had one from before */
1256         if (!skb_queue_empty(&bus->glom)) {
1257                 if (BRCMF_GLOM_ON()) {
1258                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1259                         skb_queue_walk(&bus->glom, pnext) {
1260                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1261                                           pnext, (u8 *) (pnext->data),
1262                                           pnext->len, pnext->len);
1263                         }
1264                 }
1265
1266                 pfirst = skb_peek(&bus->glom);
1267                 dlen = (u16) brcmf_sdbrcm_glom_len(bus);
1268
1269                 /* Do an SDIO read for the superframe.  Configurable iovar to
1270                  * read directly into the chained packet, or allocate a large
1271                  * packet and and copy into the chain.
1272                  */
1273                 sdio_claim_host(bus->sdiodev->func[1]);
1274                 if (usechain) {
1275                         errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
1276                                         bus->sdiodev->sbwad,
1277                                         SDIO_FUNC_2, F2SYNC, &bus->glom);
1278                 } else if (bus->dataptr) {
1279                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1280                                         bus->sdiodev->sbwad,
1281                                         SDIO_FUNC_2, F2SYNC,
1282                                         bus->dataptr, dlen);
1283                         sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
1284                         if (sublen != dlen) {
1285                                 brcmf_err("FAILED TO COPY, dlen %d sublen %d\n",
1286                                           dlen, sublen);
1287                                 errcode = -1;
1288                         }
1289                         pnext = NULL;
1290                 } else {
1291                         brcmf_err("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1292                                   dlen);
1293                         errcode = -1;
1294                 }
1295                 sdio_release_host(bus->sdiodev->func[1]);
1296                 bus->sdcnt.f2rxdata++;
1297
1298                 /* On failure, kill the superframe, allow a couple retries */
1299                 if (errcode < 0) {
1300                         brcmf_err("glom read of %d bytes failed: %d\n",
1301                                   dlen, errcode);
1302                         bus->sdiodev->bus_if->dstats.rx_errors++;
1303
1304                         sdio_claim_host(bus->sdiodev->func[1]);
1305                         if (bus->glomerr++ < 3) {
1306                                 brcmf_sdbrcm_rxfail(bus, true, true);
1307                         } else {
1308                                 bus->glomerr = 0;
1309                                 brcmf_sdbrcm_rxfail(bus, true, false);
1310                                 bus->sdcnt.rxglomfail++;
1311                                 brcmf_sdbrcm_free_glom(bus);
1312                         }
1313                         sdio_release_host(bus->sdiodev->func[1]);
1314                         return 0;
1315                 }
1316
1317                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1318                                    pfirst->data, min_t(int, pfirst->len, 48),
1319                                    "SUPERFRAME:\n");
1320
1321                 rd_new.seq_num = rxseq;
1322                 rd_new.len = dlen;
1323                 sdio_claim_host(bus->sdiodev->func[1]);
1324                 errcode = brcmf_sdio_hdparser(bus, pfirst->data, &rd_new,
1325                                               BRCMF_SDIO_FT_SUPER);
1326                 sdio_release_host(bus->sdiodev->func[1]);
1327                 bus->cur_read.len = rd_new.len_nxtfrm << 4;
1328
1329                 /* Remove superframe header, remember offset */
1330                 skb_pull(pfirst, rd_new.dat_offset);
1331                 sfdoff = rd_new.dat_offset;
1332                 num = 0;
1333
1334                 /* Validate all the subframe headers */
1335                 skb_queue_walk(&bus->glom, pnext) {
1336                         /* leave when invalid subframe is found */
1337                         if (errcode)
1338                                 break;
1339
1340                         rd_new.len = pnext->len;
1341                         rd_new.seq_num = rxseq++;
1342                         sdio_claim_host(bus->sdiodev->func[1]);
1343                         errcode = brcmf_sdio_hdparser(bus, pnext->data, &rd_new,
1344                                                       BRCMF_SDIO_FT_SUB);
1345                         sdio_release_host(bus->sdiodev->func[1]);
1346                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1347                                            pnext->data, 32, "subframe:\n");
1348
1349                         num++;
1350                 }
1351
1352                 if (errcode) {
1353                         /* Terminate frame on error, request
1354                                  a couple retries */
1355                         sdio_claim_host(bus->sdiodev->func[1]);
1356                         if (bus->glomerr++ < 3) {
1357                                 /* Restore superframe header space */
1358                                 skb_push(pfirst, sfdoff);
1359                                 brcmf_sdbrcm_rxfail(bus, true, true);
1360                         } else {
1361                                 bus->glomerr = 0;
1362                                 brcmf_sdbrcm_rxfail(bus, true, false);
1363                                 bus->sdcnt.rxglomfail++;
1364                                 brcmf_sdbrcm_free_glom(bus);
1365                         }
1366                         sdio_release_host(bus->sdiodev->func[1]);
1367                         bus->cur_read.len = 0;
1368                         return 0;
1369                 }
1370
1371                 /* Basic SD framing looks ok - process each packet (header) */
1372
1373                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1374                         dptr = (u8 *) (pfirst->data);
1375                         sublen = get_unaligned_le16(dptr);
1376                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1377
1378                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1379                                            dptr, pfirst->len,
1380                                            "Rx Subframe Data:\n");
1381
1382                         __skb_trim(pfirst, sublen);
1383                         skb_pull(pfirst, doff);
1384
1385                         if (pfirst->len == 0) {
1386                                 skb_unlink(pfirst, &bus->glom);
1387                                 brcmu_pkt_buf_free_skb(pfirst);
1388                                 continue;
1389                         } else if (brcmf_proto_hdrpull(bus->sdiodev->dev,
1390                                                        &ifidx, pfirst) != 0) {
1391                                 brcmf_err("rx protocol error\n");
1392                                 bus->sdiodev->bus_if->dstats.rx_errors++;
1393                                 skb_unlink(pfirst, &bus->glom);
1394                                 brcmu_pkt_buf_free_skb(pfirst);
1395                                 continue;
1396                         }
1397
1398                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1399                                            pfirst->data,
1400                                            min_t(int, pfirst->len, 32),
1401                                            "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1402                                            bus->glom.qlen, pfirst, pfirst->data,
1403                                            pfirst->len, pfirst->next,
1404                                            pfirst->prev);
1405                 }
1406                 /* sent any remaining packets up */
1407                 if (bus->glom.qlen)
1408                         brcmf_rx_frame(bus->sdiodev->dev, ifidx, &bus->glom);
1409
1410                 bus->sdcnt.rxglomframes++;
1411                 bus->sdcnt.rxglompkts += bus->glom.qlen;
1412         }
1413         return num;
1414 }
1415
1416 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1417                                         bool *pending)
1418 {
1419         DECLARE_WAITQUEUE(wait, current);
1420         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1421
1422         /* Wait until control frame is available */
1423         add_wait_queue(&bus->dcmd_resp_wait, &wait);
1424         set_current_state(TASK_INTERRUPTIBLE);
1425
1426         while (!(*condition) && (!signal_pending(current) && timeout))
1427                 timeout = schedule_timeout(timeout);
1428
1429         if (signal_pending(current))
1430                 *pending = true;
1431
1432         set_current_state(TASK_RUNNING);
1433         remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1434
1435         return timeout;
1436 }
1437
1438 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
1439 {
1440         if (waitqueue_active(&bus->dcmd_resp_wait))
1441                 wake_up_interruptible(&bus->dcmd_resp_wait);
1442
1443         return 0;
1444 }
1445 static void
1446 brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1447 {
1448         uint rdlen, pad;
1449         u8 *buf = NULL, *rbuf;
1450         int sdret;
1451
1452         brcmf_dbg(TRACE, "Enter\n");
1453
1454         if (bus->rxblen)
1455                 buf = vzalloc(bus->rxblen);
1456         if (!buf) {
1457                 brcmf_err("no memory for control frame\n");
1458                 goto done;
1459         }
1460         rbuf = bus->rxbuf;
1461         pad = ((unsigned long)rbuf % BRCMF_SDALIGN);
1462         if (pad)
1463                 rbuf += (BRCMF_SDALIGN - pad);
1464
1465         /* Copy the already-read portion over */
1466         memcpy(buf, hdr, BRCMF_FIRSTREAD);
1467         if (len <= BRCMF_FIRSTREAD)
1468                 goto gotpkt;
1469
1470         /* Raise rdlen to next SDIO block to avoid tail command */
1471         rdlen = len - BRCMF_FIRSTREAD;
1472         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1473                 pad = bus->blocksize - (rdlen % bus->blocksize);
1474                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1475                     ((len + pad) < bus->sdiodev->bus_if->maxctl))
1476                         rdlen += pad;
1477         } else if (rdlen % BRCMF_SDALIGN) {
1478                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1479         }
1480
1481         /* Satisfy length-alignment requirements */
1482         if (rdlen & (ALIGNMENT - 1))
1483                 rdlen = roundup(rdlen, ALIGNMENT);
1484
1485         /* Drop if the read is too big or it exceeds our maximum */
1486         if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
1487                 brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
1488                           rdlen, bus->sdiodev->bus_if->maxctl);
1489                 bus->sdiodev->bus_if->dstats.rx_errors++;
1490                 brcmf_sdbrcm_rxfail(bus, false, false);
1491                 goto done;
1492         }
1493
1494         if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
1495                 brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1496                           len, len - doff, bus->sdiodev->bus_if->maxctl);
1497                 bus->sdiodev->bus_if->dstats.rx_errors++;
1498                 bus->sdcnt.rx_toolong++;
1499                 brcmf_sdbrcm_rxfail(bus, false, false);
1500                 goto done;
1501         }
1502
1503         /* Read remain of frame body */
1504         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1505                                 bus->sdiodev->sbwad,
1506                                 SDIO_FUNC_2,
1507                                 F2SYNC, rbuf, rdlen);
1508         bus->sdcnt.f2rxdata++;
1509
1510         /* Control frame failures need retransmission */
1511         if (sdret < 0) {
1512                 brcmf_err("read %d control bytes failed: %d\n",
1513                           rdlen, sdret);
1514                 bus->sdcnt.rxc_errors++;
1515                 brcmf_sdbrcm_rxfail(bus, true, true);
1516                 goto done;
1517         } else
1518                 memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
1519
1520 gotpkt:
1521
1522         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
1523                            buf, len, "RxCtrl:\n");
1524
1525         /* Point to valid data and indicate its length */
1526         spin_lock_bh(&bus->rxctl_lock);
1527         if (bus->rxctl) {
1528                 brcmf_err("last control frame is being processed.\n");
1529                 spin_unlock_bh(&bus->rxctl_lock);
1530                 vfree(buf);
1531                 goto done;
1532         }
1533         bus->rxctl = buf + doff;
1534         bus->rxctl_orig = buf;
1535         bus->rxlen = len - doff;
1536         spin_unlock_bh(&bus->rxctl_lock);
1537
1538 done:
1539         /* Awake any waiters */
1540         brcmf_sdbrcm_dcmd_resp_wake(bus);
1541 }
1542
1543 /* Pad read to blocksize for efficiency */
1544 static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1545 {
1546         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1547                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1548                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1549                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1550                         *rdlen += *pad;
1551         } else if (*rdlen % BRCMF_SDALIGN) {
1552                 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1553         }
1554 }
1555
1556 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
1557 {
1558         struct sk_buff *pkt;            /* Packet for event or data frames */
1559         u16 pad;                /* Number of pad bytes to read */
1560         uint rxleft = 0;        /* Remaining number of frames allowed */
1561         int sdret;              /* Return code from calls */
1562         int ifidx = 0;
1563         uint rxcount = 0;       /* Total frames read */
1564         struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
1565         u8 head_read = 0;
1566
1567         brcmf_dbg(TRACE, "Enter\n");
1568
1569         /* Not finished unless we encounter no more frames indication */
1570         bus->rxpending = true;
1571
1572         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
1573              !bus->rxskip && rxleft &&
1574              bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
1575              rd->seq_num++, rxleft--) {
1576
1577                 /* Handle glomming separately */
1578                 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1579                         u8 cnt;
1580                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1581                                   bus->glomd, skb_peek(&bus->glom));
1582                         cnt = brcmf_sdbrcm_rxglom(bus, rd->seq_num);
1583                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1584                         rd->seq_num += cnt - 1;
1585                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1586                         continue;
1587                 }
1588
1589                 rd->len_left = rd->len;
1590                 /* read header first for unknow frame length */
1591                 sdio_claim_host(bus->sdiodev->func[1]);
1592                 if (!rd->len) {
1593                         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1594                                                       bus->sdiodev->sbwad,
1595                                                       SDIO_FUNC_2, F2SYNC,
1596                                                       bus->rxhdr,
1597                                                       BRCMF_FIRSTREAD);
1598                         bus->sdcnt.f2rxhdrs++;
1599                         if (sdret < 0) {
1600                                 brcmf_err("RXHEADER FAILED: %d\n",
1601                                           sdret);
1602                                 bus->sdcnt.rx_hdrfail++;
1603                                 brcmf_sdbrcm_rxfail(bus, true, true);
1604                                 sdio_release_host(bus->sdiodev->func[1]);
1605                                 continue;
1606                         }
1607
1608                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() || BRCMF_HDRS_ON(),
1609                                            bus->rxhdr, SDPCM_HDRLEN,
1610                                            "RxHdr:\n");
1611
1612                         if (brcmf_sdio_hdparser(bus, bus->rxhdr, rd,
1613                                                 BRCMF_SDIO_FT_NORMAL)) {
1614                                 sdio_release_host(bus->sdiodev->func[1]);
1615                                 if (!bus->rxpending)
1616                                         break;
1617                                 else
1618                                         continue;
1619                         }
1620
1621                         if (rd->channel == SDPCM_CONTROL_CHANNEL) {
1622                                 brcmf_sdbrcm_read_control(bus, bus->rxhdr,
1623                                                           rd->len,
1624                                                           rd->dat_offset);
1625                                 /* prepare the descriptor for the next read */
1626                                 rd->len = rd->len_nxtfrm << 4;
1627                                 rd->len_nxtfrm = 0;
1628                                 /* treat all packet as event if we don't know */
1629                                 rd->channel = SDPCM_EVENT_CHANNEL;
1630                                 sdio_release_host(bus->sdiodev->func[1]);
1631                                 continue;
1632                         }
1633                         rd->len_left = rd->len > BRCMF_FIRSTREAD ?
1634                                        rd->len - BRCMF_FIRSTREAD : 0;
1635                         head_read = BRCMF_FIRSTREAD;
1636                 }
1637
1638                 brcmf_pad(bus, &pad, &rd->len_left);
1639
1640                 pkt = brcmu_pkt_buf_get_skb(rd->len_left + head_read +
1641                                             BRCMF_SDALIGN);
1642                 if (!pkt) {
1643                         /* Give up on data, request rtx of events */
1644                         brcmf_err("brcmu_pkt_buf_get_skb failed\n");
1645                         bus->sdiodev->bus_if->dstats.rx_dropped++;
1646                         brcmf_sdbrcm_rxfail(bus, false,
1647                                             RETRYCHAN(rd->channel));
1648                         sdio_release_host(bus->sdiodev->func[1]);
1649                         continue;
1650                 }
1651                 skb_pull(pkt, head_read);
1652                 pkt_align(pkt, rd->len_left, BRCMF_SDALIGN);
1653
1654                 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1655                                               SDIO_FUNC_2, F2SYNC, pkt);
1656                 bus->sdcnt.f2rxdata++;
1657                 sdio_release_host(bus->sdiodev->func[1]);
1658
1659                 if (sdret < 0) {
1660                         brcmf_err("read %d bytes from channel %d failed: %d\n",
1661                                   rd->len, rd->channel, sdret);
1662                         brcmu_pkt_buf_free_skb(pkt);
1663                         bus->sdiodev->bus_if->dstats.rx_errors++;
1664                         sdio_claim_host(bus->sdiodev->func[1]);
1665                         brcmf_sdbrcm_rxfail(bus, true,
1666                                             RETRYCHAN(rd->channel));
1667                         sdio_release_host(bus->sdiodev->func[1]);
1668                         continue;
1669                 }
1670
1671                 if (head_read) {
1672                         skb_push(pkt, head_read);
1673                         memcpy(pkt->data, bus->rxhdr, head_read);
1674                         head_read = 0;
1675                 } else {
1676                         memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
1677                         rd_new.seq_num = rd->seq_num;
1678                         sdio_claim_host(bus->sdiodev->func[1]);
1679                         if (brcmf_sdio_hdparser(bus, bus->rxhdr, &rd_new,
1680                                                 BRCMF_SDIO_FT_NORMAL)) {
1681                                 rd->len = 0;
1682                                 brcmu_pkt_buf_free_skb(pkt);
1683                         }
1684                         bus->sdcnt.rx_readahead_cnt++;
1685                         if (rd->len != roundup(rd_new.len, 16)) {
1686                                 brcmf_err("frame length mismatch:read %d, should be %d\n",
1687                                           rd->len,
1688                                           roundup(rd_new.len, 16) >> 4);
1689                                 rd->len = 0;
1690                                 brcmf_sdbrcm_rxfail(bus, true, true);
1691                                 sdio_release_host(bus->sdiodev->func[1]);
1692                                 brcmu_pkt_buf_free_skb(pkt);
1693                                 continue;
1694                         }
1695                         sdio_release_host(bus->sdiodev->func[1]);
1696                         rd->len_nxtfrm = rd_new.len_nxtfrm;
1697                         rd->channel = rd_new.channel;
1698                         rd->dat_offset = rd_new.dat_offset;
1699
1700                         brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1701                                              BRCMF_DATA_ON()) &&
1702                                            BRCMF_HDRS_ON(),
1703                                            bus->rxhdr, SDPCM_HDRLEN,
1704                                            "RxHdr:\n");
1705
1706                         if (rd_new.channel == SDPCM_CONTROL_CHANNEL) {
1707                                 brcmf_err("readahead on control packet %d?\n",
1708                                           rd_new.seq_num);
1709                                 /* Force retry w/normal header read */
1710                                 rd->len = 0;
1711                                 sdio_claim_host(bus->sdiodev->func[1]);
1712                                 brcmf_sdbrcm_rxfail(bus, false, true);
1713                                 sdio_release_host(bus->sdiodev->func[1]);
1714                                 brcmu_pkt_buf_free_skb(pkt);
1715                                 continue;
1716                         }
1717                 }
1718
1719                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1720                                    pkt->data, rd->len, "Rx Data:\n");
1721
1722                 /* Save superframe descriptor and allocate packet frame */
1723                 if (rd->channel == SDPCM_GLOM_CHANNEL) {
1724                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
1725                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
1726                                           rd->len);
1727                                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1728                                                    pkt->data, rd->len,
1729                                                    "Glom Data:\n");
1730                                 __skb_trim(pkt, rd->len);
1731                                 skb_pull(pkt, SDPCM_HDRLEN);
1732                                 bus->glomd = pkt;
1733                         } else {
1734                                 brcmf_err("%s: glom superframe w/o "
1735                                           "descriptor!\n", __func__);
1736                                 sdio_claim_host(bus->sdiodev->func[1]);
1737                                 brcmf_sdbrcm_rxfail(bus, false, false);
1738                                 sdio_release_host(bus->sdiodev->func[1]);
1739                         }
1740                         /* prepare the descriptor for the next read */
1741                         rd->len = rd->len_nxtfrm << 4;
1742                         rd->len_nxtfrm = 0;
1743                         /* treat all packet as event if we don't know */
1744                         rd->channel = SDPCM_EVENT_CHANNEL;
1745                         continue;
1746                 }
1747
1748                 /* Fill in packet len and prio, deliver upward */
1749                 __skb_trim(pkt, rd->len);
1750                 skb_pull(pkt, rd->dat_offset);
1751
1752                 /* prepare the descriptor for the next read */
1753                 rd->len = rd->len_nxtfrm << 4;
1754                 rd->len_nxtfrm = 0;
1755                 /* treat all packet as event if we don't know */
1756                 rd->channel = SDPCM_EVENT_CHANNEL;
1757
1758                 if (pkt->len == 0) {
1759                         brcmu_pkt_buf_free_skb(pkt);
1760                         continue;
1761                 } else if (brcmf_proto_hdrpull(bus->sdiodev->dev, &ifidx,
1762                            pkt) != 0) {
1763                         brcmf_err("rx protocol error\n");
1764                         brcmu_pkt_buf_free_skb(pkt);
1765                         bus->sdiodev->bus_if->dstats.rx_errors++;
1766                         continue;
1767                 }
1768
1769                 brcmf_rx_packet(bus->sdiodev->dev, ifidx, pkt);
1770         }
1771
1772         rxcount = maxframes - rxleft;
1773         /* Message if we hit the limit */
1774         if (!rxleft)
1775                 brcmf_dbg(DATA, "hit rx limit of %d frames\n", maxframes);
1776         else
1777                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
1778         /* Back off rxseq if awaiting rtx, update rx_seq */
1779         if (bus->rxskip)
1780                 rd->seq_num--;
1781         bus->rx_seq = rd->seq_num;
1782
1783         return rxcount;
1784 }
1785
1786 static void
1787 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
1788 {
1789         if (waitqueue_active(&bus->ctrl_wait))
1790                 wake_up_interruptible(&bus->ctrl_wait);
1791         return;
1792 }
1793
1794 /* Writes a HW/SW header into the packet and sends it. */
1795 /* Assumes: (a) header space already there, (b) caller holds lock */
1796 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
1797                               uint chan, bool free_pkt)
1798 {
1799         int ret;
1800         u8 *frame;
1801         u16 len, pad = 0;
1802         u32 swheader;
1803         struct sk_buff *new;
1804         int i;
1805
1806         brcmf_dbg(TRACE, "Enter\n");
1807
1808         frame = (u8 *) (pkt->data);
1809
1810         /* Add alignment padding, allocate new packet if needed */
1811         pad = ((unsigned long)frame % BRCMF_SDALIGN);
1812         if (pad) {
1813                 if (skb_headroom(pkt) < pad) {
1814                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
1815                                   skb_headroom(pkt), pad);
1816                         bus->sdiodev->bus_if->tx_realloc++;
1817                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
1818                         if (!new) {
1819                                 brcmf_err("couldn't allocate new %d-byte packet\n",
1820                                           pkt->len + BRCMF_SDALIGN);
1821                                 ret = -ENOMEM;
1822                                 goto done;
1823                         }
1824
1825                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
1826                         memcpy(new->data, pkt->data, pkt->len);
1827                         if (free_pkt)
1828                                 brcmu_pkt_buf_free_skb(pkt);
1829                         /* free the pkt if canned one is not used */
1830                         free_pkt = true;
1831                         pkt = new;
1832                         frame = (u8 *) (pkt->data);
1833                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
1834                         pad = 0;
1835                 } else {
1836                         skb_push(pkt, pad);
1837                         frame = (u8 *) (pkt->data);
1838                         /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
1839                         memset(frame, 0, pad + SDPCM_HDRLEN);
1840                 }
1841         }
1842         /* precondition: pad < BRCMF_SDALIGN */
1843
1844         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1845         len = (u16) (pkt->len);
1846         *(__le16 *) frame = cpu_to_le16(len);
1847         *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
1848
1849         /* Software tag: channel, sequence number, data offset */
1850         swheader =
1851             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1852             (((pad +
1853                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1854
1855         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
1856         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1857
1858 #ifdef DEBUG
1859         tx_packets[pkt->priority]++;
1860 #endif
1861
1862         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() &&
1863                            ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
1864                             (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)),
1865                            frame, len, "Tx Frame:\n");
1866         brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1867                              ((BRCMF_CTL_ON() &&
1868                                chan == SDPCM_CONTROL_CHANNEL) ||
1869                               (BRCMF_DATA_ON() &&
1870                                chan != SDPCM_CONTROL_CHANNEL))) &&
1871                            BRCMF_HDRS_ON(),
1872                            frame, min_t(u16, len, 16), "TxHdr:\n");
1873
1874         /* Raise len to next SDIO block to eliminate tail command */
1875         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1876                 u16 pad = bus->blocksize - (len % bus->blocksize);
1877                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1878                                 len += pad;
1879         } else if (len % BRCMF_SDALIGN) {
1880                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1881         }
1882
1883         /* Some controllers have trouble with odd bytes -- round to even */
1884         if (len & (ALIGNMENT - 1))
1885                         len = roundup(len, ALIGNMENT);
1886
1887         sdio_claim_host(bus->sdiodev->func[1]);
1888         ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1889                                     SDIO_FUNC_2, F2SYNC, pkt);
1890         bus->sdcnt.f2txdata++;
1891
1892         if (ret < 0) {
1893                 /* On failure, abort the command and terminate the frame */
1894                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
1895                           ret);
1896                 bus->sdcnt.tx_sderrs++;
1897
1898                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1899                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
1900                                  SFC_WF_TERM, NULL);
1901                 bus->sdcnt.f1regdata++;
1902
1903                 for (i = 0; i < 3; i++) {
1904                         u8 hi, lo;
1905                         hi = brcmf_sdio_regrb(bus->sdiodev,
1906                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1907                         lo = brcmf_sdio_regrb(bus->sdiodev,
1908                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1909                         bus->sdcnt.f1regdata += 2;
1910                         if ((hi == 0) && (lo == 0))
1911                                 break;
1912                 }
1913
1914         }
1915         sdio_release_host(bus->sdiodev->func[1]);
1916         if (ret == 0)
1917                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1918
1919 done:
1920         /* restore pkt buffer pointer before calling tx complete routine */
1921         skb_pull(pkt, SDPCM_HDRLEN + pad);
1922         brcmf_txcomplete(bus->sdiodev->dev, pkt, ret != 0);
1923
1924         if (free_pkt)
1925                 brcmu_pkt_buf_free_skb(pkt);
1926
1927         return ret;
1928 }
1929
1930 static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
1931 {
1932         struct sk_buff *pkt;
1933         u32 intstatus = 0;
1934         int ret = 0, prec_out;
1935         uint cnt = 0;
1936         uint datalen;
1937         u8 tx_prec_map;
1938
1939         brcmf_dbg(TRACE, "Enter\n");
1940
1941         tx_prec_map = ~bus->flowcontrol;
1942
1943         /* Send frames until the limit or some other event */
1944         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
1945                 spin_lock_bh(&bus->txqlock);
1946                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
1947                 if (pkt == NULL) {
1948                         spin_unlock_bh(&bus->txqlock);
1949                         break;
1950                 }
1951                 spin_unlock_bh(&bus->txqlock);
1952                 datalen = pkt->len - SDPCM_HDRLEN;
1953
1954                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
1955                 if (ret)
1956                         bus->sdiodev->bus_if->dstats.tx_errors++;
1957                 else
1958                         bus->sdiodev->bus_if->dstats.tx_bytes += datalen;
1959
1960                 /* In poll mode, need to check for other events */
1961                 if (!bus->intr && cnt) {
1962                         /* Check device status, signal pending interrupt */
1963                         sdio_claim_host(bus->sdiodev->func[1]);
1964                         ret = r_sdreg32(bus, &intstatus,
1965                                         offsetof(struct sdpcmd_regs,
1966                                                  intstatus));
1967                         sdio_release_host(bus->sdiodev->func[1]);
1968                         bus->sdcnt.f2txdata++;
1969                         if (ret != 0)
1970                                 break;
1971                         if (intstatus & bus->hostintmask)
1972                                 atomic_set(&bus->ipend, 1);
1973                 }
1974         }
1975
1976         /* Deflow-control stack if needed */
1977         if (bus->sdiodev->bus_if->drvr_up &&
1978             (bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
1979             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
1980                 bus->txoff = false;
1981                 brcmf_txflowblock(bus->sdiodev->dev, false);
1982         }
1983
1984         return cnt;
1985 }
1986
1987 static void brcmf_sdbrcm_bus_stop(struct device *dev)
1988 {
1989         u32 local_hostintmask;
1990         u8 saveclk;
1991         int err;
1992         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1993         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
1994         struct brcmf_sdio *bus = sdiodev->bus;
1995
1996         brcmf_dbg(TRACE, "Enter\n");
1997
1998         if (bus->watchdog_tsk) {
1999                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
2000                 kthread_stop(bus->watchdog_tsk);
2001                 bus->watchdog_tsk = NULL;
2002         }
2003
2004         sdio_claim_host(bus->sdiodev->func[1]);
2005
2006         /* Enable clock for device interrupts */
2007         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2008
2009         /* Disable and clear interrupts at the chip level also */
2010         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
2011         local_hostintmask = bus->hostintmask;
2012         bus->hostintmask = 0;
2013
2014         /* Change our idea of bus state */
2015         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2016
2017         /* Force clocks on backplane to be sure F2 interrupt propagates */
2018         saveclk = brcmf_sdio_regrb(bus->sdiodev,
2019                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
2020         if (!err) {
2021                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
2022                                  (saveclk | SBSDIO_FORCE_HT), &err);
2023         }
2024         if (err)
2025                 brcmf_err("Failed to force clock for F2: err %d\n", err);
2026
2027         /* Turn off the bus (F2), free any pending packets */
2028         brcmf_dbg(INTR, "disable SDIO interrupts\n");
2029         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, SDIO_FUNC_ENABLE_1,
2030                          NULL);
2031
2032         /* Clear any pending interrupts now that F2 is disabled */
2033         w_sdreg32(bus, local_hostintmask,
2034                   offsetof(struct sdpcmd_regs, intstatus));
2035
2036         /* Turn off the backplane clock (only) */
2037         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
2038         sdio_release_host(bus->sdiodev->func[1]);
2039
2040         /* Clear the data packet queues */
2041         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2042
2043         /* Clear any held glomming stuff */
2044         if (bus->glomd)
2045                 brcmu_pkt_buf_free_skb(bus->glomd);
2046         brcmf_sdbrcm_free_glom(bus);
2047
2048         /* Clear rx control and wake any waiters */
2049         spin_lock_bh(&bus->rxctl_lock);
2050         bus->rxlen = 0;
2051         spin_unlock_bh(&bus->rxctl_lock);
2052         brcmf_sdbrcm_dcmd_resp_wake(bus);
2053
2054         /* Reset some F2 state stuff */
2055         bus->rxskip = false;
2056         bus->tx_seq = bus->rx_seq = 0;
2057 }
2058
2059 #ifdef CONFIG_BRCMFMAC_SDIO_OOB
2060 static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
2061 {
2062         unsigned long flags;
2063
2064         spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
2065         if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
2066                 enable_irq(bus->sdiodev->irq);
2067                 bus->sdiodev->irq_en = true;
2068         }
2069         spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
2070 }
2071 #else
2072 static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
2073 {
2074 }
2075 #endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
2076
2077 static inline void brcmf_sdbrcm_adddpctsk(struct brcmf_sdio *bus)
2078 {
2079         struct list_head *new_hd;
2080         unsigned long flags;
2081
2082         if (in_interrupt())
2083                 new_hd = kzalloc(sizeof(struct list_head), GFP_ATOMIC);
2084         else
2085                 new_hd = kzalloc(sizeof(struct list_head), GFP_KERNEL);
2086         if (new_hd == NULL)
2087                 return;
2088
2089         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
2090         list_add_tail(new_hd, &bus->dpc_tsklst);
2091         spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2092 }
2093
2094 static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
2095 {
2096         u8 idx;
2097         u32 addr;
2098         unsigned long val;
2099         int n, ret;
2100
2101         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
2102         addr = bus->ci->c_inf[idx].base +
2103                offsetof(struct sdpcmd_regs, intstatus);
2104
2105         ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, false);
2106         bus->sdcnt.f1regdata++;
2107         if (ret != 0)
2108                 val = 0;
2109
2110         val &= bus->hostintmask;
2111         atomic_set(&bus->fcstate, !!(val & I_HMB_FC_STATE));
2112
2113         /* Clear interrupts */
2114         if (val) {
2115                 ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, true);
2116                 bus->sdcnt.f1regdata++;
2117         }
2118
2119         if (ret) {
2120                 atomic_set(&bus->intstatus, 0);
2121         } else if (val) {
2122                 for_each_set_bit(n, &val, 32)
2123                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2124         }
2125
2126         return ret;
2127 }
2128
2129 static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
2130 {
2131         u32 newstatus = 0;
2132         unsigned long intstatus;
2133         uint rxlimit = bus->rxbound;    /* Rx frames to read before resched */
2134         uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2135         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2136         int err = 0, n;
2137
2138         brcmf_dbg(TRACE, "Enter\n");
2139
2140         sdio_claim_host(bus->sdiodev->func[1]);
2141
2142         /* If waiting for HTAVAIL, check status */
2143         if (bus->clkstate == CLK_PENDING) {
2144                 u8 clkctl, devctl = 0;
2145
2146 #ifdef DEBUG
2147                 /* Check for inconsistent device control */
2148                 devctl = brcmf_sdio_regrb(bus->sdiodev,
2149                                           SBSDIO_DEVICE_CTL, &err);
2150                 if (err) {
2151                         brcmf_err("error reading DEVCTL: %d\n", err);
2152                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2153                 }
2154 #endif                          /* DEBUG */
2155
2156                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2157                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
2158                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
2159                 if (err) {
2160                         brcmf_err("error reading CSR: %d\n",
2161                                   err);
2162                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2163                 }
2164
2165                 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2166                           devctl, clkctl);
2167
2168                 if (SBSDIO_HTAV(clkctl)) {
2169                         devctl = brcmf_sdio_regrb(bus->sdiodev,
2170                                                   SBSDIO_DEVICE_CTL, &err);
2171                         if (err) {
2172                                 brcmf_err("error reading DEVCTL: %d\n",
2173                                           err);
2174                                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2175                         }
2176                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2177                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
2178                                          devctl, &err);
2179                         if (err) {
2180                                 brcmf_err("error writing DEVCTL: %d\n",
2181                                           err);
2182                                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2183                         }
2184                         bus->clkstate = CLK_AVAIL;
2185                 }
2186         }
2187
2188         /* Make sure backplane clock is on */
2189         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2190
2191         /* Pending interrupt indicates new device status */
2192         if (atomic_read(&bus->ipend) > 0) {
2193                 atomic_set(&bus->ipend, 0);
2194                 err = brcmf_sdio_intr_rstatus(bus);
2195         }
2196
2197         /* Start with leftover status bits */
2198         intstatus = atomic_xchg(&bus->intstatus, 0);
2199
2200         /* Handle flow-control change: read new state in case our ack
2201          * crossed another change interrupt.  If change still set, assume
2202          * FC ON for safety, let next loop through do the debounce.
2203          */
2204         if (intstatus & I_HMB_FC_CHANGE) {
2205                 intstatus &= ~I_HMB_FC_CHANGE;
2206                 err = w_sdreg32(bus, I_HMB_FC_CHANGE,
2207                                 offsetof(struct sdpcmd_regs, intstatus));
2208
2209                 err = r_sdreg32(bus, &newstatus,
2210                                 offsetof(struct sdpcmd_regs, intstatus));
2211                 bus->sdcnt.f1regdata += 2;
2212                 atomic_set(&bus->fcstate,
2213                            !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
2214                 intstatus |= (newstatus & bus->hostintmask);
2215         }
2216
2217         /* Handle host mailbox indication */
2218         if (intstatus & I_HMB_HOST_INT) {
2219                 intstatus &= ~I_HMB_HOST_INT;
2220                 intstatus |= brcmf_sdbrcm_hostmail(bus);
2221         }
2222
2223         sdio_release_host(bus->sdiodev->func[1]);
2224
2225         /* Generally don't ask for these, can get CRC errors... */
2226         if (intstatus & I_WR_OOSYNC) {
2227                 brcmf_err("Dongle reports WR_OOSYNC\n");
2228                 intstatus &= ~I_WR_OOSYNC;
2229         }
2230
2231         if (intstatus & I_RD_OOSYNC) {
2232                 brcmf_err("Dongle reports RD_OOSYNC\n");
2233                 intstatus &= ~I_RD_OOSYNC;
2234         }
2235
2236         if (intstatus & I_SBINT) {
2237                 brcmf_err("Dongle reports SBINT\n");
2238                 intstatus &= ~I_SBINT;
2239         }
2240
2241         /* Would be active due to wake-wlan in gSPI */
2242         if (intstatus & I_CHIPACTIVE) {
2243                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2244                 intstatus &= ~I_CHIPACTIVE;
2245         }
2246
2247         /* Ignore frame indications if rxskip is set */
2248         if (bus->rxskip)
2249                 intstatus &= ~I_HMB_FRAME_IND;
2250
2251         /* On frame indication, read available frames */
2252         if (PKT_AVAILABLE() && bus->clkstate == CLK_AVAIL) {
2253                 framecnt = brcmf_sdio_readframes(bus, rxlimit);
2254                 if (!bus->rxpending)
2255                         intstatus &= ~I_HMB_FRAME_IND;
2256                 rxlimit -= min(framecnt, rxlimit);
2257         }
2258
2259         /* Keep still-pending events for next scheduling */
2260         if (intstatus) {
2261                 for_each_set_bit(n, &intstatus, 32)
2262                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2263         }
2264
2265         brcmf_sdbrcm_clrintr(bus);
2266
2267         if (data_ok(bus) && bus->ctrl_frame_stat &&
2268                 (bus->clkstate == CLK_AVAIL)) {
2269                 int i;
2270
2271                 sdio_claim_host(bus->sdiodev->func[1]);
2272                 err = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2273                         SDIO_FUNC_2, F2SYNC, bus->ctrl_frame_buf,
2274                         (u32) bus->ctrl_frame_len);
2275
2276                 if (err < 0) {
2277                         /* On failure, abort the command and
2278                                 terminate the frame */
2279                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2280                                   err);
2281                         bus->sdcnt.tx_sderrs++;
2282
2283                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2284
2285                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2286                                          SFC_WF_TERM, &err);
2287                         bus->sdcnt.f1regdata++;
2288
2289                         for (i = 0; i < 3; i++) {
2290                                 u8 hi, lo;
2291                                 hi = brcmf_sdio_regrb(bus->sdiodev,
2292                                                       SBSDIO_FUNC1_WFRAMEBCHI,
2293                                                       &err);
2294                                 lo = brcmf_sdio_regrb(bus->sdiodev,
2295                                                       SBSDIO_FUNC1_WFRAMEBCLO,
2296                                                       &err);
2297                                 bus->sdcnt.f1regdata += 2;
2298                                 if ((hi == 0) && (lo == 0))
2299                                         break;
2300                         }
2301
2302                 } else {
2303                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2304                 }
2305                 sdio_release_host(bus->sdiodev->func[1]);
2306                 bus->ctrl_frame_stat = false;
2307                 brcmf_sdbrcm_wait_event_wakeup(bus);
2308         }
2309         /* Send queued frames (limit 1 if rx may still be pending) */
2310         else if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
2311                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2312                  && data_ok(bus)) {
2313                 framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
2314                                             txlimit;
2315                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2316                 txlimit -= framecnt;
2317         }
2318
2319         if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) || (err != 0)) {
2320                 brcmf_err("failed backplane access over SDIO, halting operation\n");
2321                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2322                 atomic_set(&bus->intstatus, 0);
2323         } else if (atomic_read(&bus->intstatus) ||
2324                    atomic_read(&bus->ipend) > 0 ||
2325                    (!atomic_read(&bus->fcstate) &&
2326                     brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
2327                     data_ok(bus)) || PKT_AVAILABLE()) {
2328                 brcmf_sdbrcm_adddpctsk(bus);
2329         }
2330
2331         /* If we're done for now, turn off clock request. */
2332         if ((bus->clkstate != CLK_PENDING)
2333             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2334                 bus->activity = false;
2335                 sdio_claim_host(bus->sdiodev->func[1]);
2336                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2337                 sdio_release_host(bus->sdiodev->func[1]);
2338         }
2339 }
2340
2341 static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
2342 {
2343         int ret = -EBADE;
2344         uint datalen, prec;
2345         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2346         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2347         struct brcmf_sdio *bus = sdiodev->bus;
2348         unsigned long flags;
2349
2350         brcmf_dbg(TRACE, "Enter\n");
2351
2352         datalen = pkt->len;
2353
2354         /* Add space for the header */
2355         skb_push(pkt, SDPCM_HDRLEN);
2356         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2357
2358         prec = prio2prec((pkt->priority & PRIOMASK));
2359
2360         /* Check for existing queue, current flow-control,
2361                          pending event, or pending clock */
2362         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2363         bus->sdcnt.fcqueued++;
2364
2365         /* Priority based enq */
2366         spin_lock_bh(&bus->txqlock);
2367         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
2368                 skb_pull(pkt, SDPCM_HDRLEN);
2369                 brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
2370                 brcmu_pkt_buf_free_skb(pkt);
2371                 brcmf_err("out of bus->txq !!!\n");
2372                 ret = -ENOSR;
2373         } else {
2374                 ret = 0;
2375         }
2376         spin_unlock_bh(&bus->txqlock);
2377
2378         if (pktq_len(&bus->txq) >= TXHI) {
2379                 bus->txoff = true;
2380                 brcmf_txflowblock(bus->sdiodev->dev, true);
2381         }
2382
2383 #ifdef DEBUG
2384         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2385                 qcount[prec] = pktq_plen(&bus->txq, prec);
2386 #endif
2387
2388         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
2389         if (list_empty(&bus->dpc_tsklst)) {
2390                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2391
2392                 brcmf_sdbrcm_adddpctsk(bus);
2393                 queue_work(bus->brcmf_wq, &bus->datawork);
2394         } else {
2395                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2396         }
2397
2398         return ret;
2399 }
2400
2401 static int
2402 brcmf_sdbrcm_membytes(struct brcmf_sdio *bus, bool write, u32 address, u8 *data,
2403                  uint size)
2404 {
2405         int bcmerror = 0;
2406         u32 sdaddr;
2407         uint dsize;
2408
2409         /* Determine initial transfer parameters */
2410         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2411         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2412                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2413         else
2414                 dsize = size;
2415
2416         sdio_claim_host(bus->sdiodev->func[1]);
2417
2418         /* Set the backplane window to include the start address */
2419         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2420         if (bcmerror) {
2421                 brcmf_err("window change failed\n");
2422                 goto xfer_done;
2423         }
2424
2425         /* Do the transfer(s) */
2426         while (size) {
2427                 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2428                           write ? "write" : "read", dsize,
2429                           sdaddr, address & SBSDIO_SBWINDOW_MASK);
2430                 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2431                                                sdaddr, data, dsize);
2432                 if (bcmerror) {
2433                         brcmf_err("membytes transfer failed\n");
2434                         break;
2435                 }
2436
2437                 /* Adjust for next transfer (if any) */
2438                 size -= dsize;
2439                 if (size) {
2440                         data += dsize;
2441                         address += dsize;
2442                         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2443                                                                   address);
2444                         if (bcmerror) {
2445                                 brcmf_err("window change failed\n");
2446                                 break;
2447                         }
2448                         sdaddr = 0;
2449                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2450                 }
2451         }
2452
2453 xfer_done:
2454         /* Return the window to backplane enumeration space for core access */
2455         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2456                 brcmf_err("FAILED to set window back to 0x%x\n",
2457                           bus->sdiodev->sbwad);
2458
2459         sdio_release_host(bus->sdiodev->func[1]);
2460
2461         return bcmerror;
2462 }
2463
2464 #ifdef DEBUG
2465 #define CONSOLE_LINE_MAX        192
2466
2467 static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
2468 {
2469         struct brcmf_console *c = &bus->console;
2470         u8 line[CONSOLE_LINE_MAX], ch;
2471         u32 n, idx, addr;
2472         int rv;
2473
2474         /* Don't do anything until FWREADY updates console address */
2475         if (bus->console_addr == 0)
2476                 return 0;
2477
2478         /* Read console log struct */
2479         addr = bus->console_addr + offsetof(struct rte_console, log_le);
2480         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
2481                                    sizeof(c->log_le));
2482         if (rv < 0)
2483                 return rv;
2484
2485         /* Allocate console buffer (one time only) */
2486         if (c->buf == NULL) {
2487                 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2488                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2489                 if (c->buf == NULL)
2490                         return -ENOMEM;
2491         }
2492
2493         idx = le32_to_cpu(c->log_le.idx);
2494
2495         /* Protect against corrupt value */
2496         if (idx > c->bufsize)
2497                 return -EBADE;
2498
2499         /* Skip reading the console buffer if the index pointer
2500          has not moved */
2501         if (idx == c->last)
2502                 return 0;
2503
2504         /* Read the console buffer */
2505         addr = le32_to_cpu(c->log_le.buf);
2506         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2507         if (rv < 0)
2508                 return rv;
2509
2510         while (c->last != idx) {
2511                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2512                         if (c->last == idx) {
2513                                 /* This would output a partial line.
2514                                  * Instead, back up
2515                                  * the buffer pointer and output this
2516                                  * line next time around.
2517                                  */
2518                                 if (c->last >= n)
2519                                         c->last -= n;
2520                                 else
2521                                         c->last = c->bufsize - n;
2522                                 goto break2;
2523                         }
2524                         ch = c->buf[c->last];
2525                         c->last = (c->last + 1) % c->bufsize;
2526                         if (ch == '\n')
2527                                 break;
2528                         line[n] = ch;
2529                 }
2530
2531                 if (n > 0) {
2532                         if (line[n - 1] == '\r')
2533                                 n--;
2534                         line[n] = 0;
2535                         pr_debug("CONSOLE: %s\n", line);
2536                 }
2537         }
2538 break2:
2539
2540         return 0;
2541 }
2542 #endif                          /* DEBUG */
2543
2544 static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
2545 {
2546         int i;
2547         int ret;
2548
2549         bus->ctrl_frame_stat = false;
2550         ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2551                                     SDIO_FUNC_2, F2SYNC, frame, len);
2552
2553         if (ret < 0) {
2554                 /* On failure, abort the command and terminate the frame */
2555                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2556                           ret);
2557                 bus->sdcnt.tx_sderrs++;
2558
2559                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2560
2561                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2562                                  SFC_WF_TERM, NULL);
2563                 bus->sdcnt.f1regdata++;
2564
2565                 for (i = 0; i < 3; i++) {
2566                         u8 hi, lo;
2567                         hi = brcmf_sdio_regrb(bus->sdiodev,
2568                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
2569                         lo = brcmf_sdio_regrb(bus->sdiodev,
2570                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
2571                         bus->sdcnt.f1regdata += 2;
2572                         if (hi == 0 && lo == 0)
2573                                 break;
2574                 }
2575                 return ret;
2576         }
2577
2578         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2579
2580         return ret;
2581 }
2582
2583 static int
2584 brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2585 {
2586         u8 *frame;
2587         u16 len;
2588         u32 swheader;
2589         uint retries = 0;
2590         u8 doff = 0;
2591         int ret = -1;
2592         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2593         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2594         struct brcmf_sdio *bus = sdiodev->bus;
2595         unsigned long flags;
2596
2597         brcmf_dbg(TRACE, "Enter\n");
2598
2599         /* Back the pointer to make a room for bus header */
2600         frame = msg - SDPCM_HDRLEN;
2601         len = (msglen += SDPCM_HDRLEN);
2602
2603         /* Add alignment padding (optional for ctl frames) */
2604         doff = ((unsigned long)frame % BRCMF_SDALIGN);
2605         if (doff) {
2606                 frame -= doff;
2607                 len += doff;
2608                 msglen += doff;
2609                 memset(frame, 0, doff + SDPCM_HDRLEN);
2610         }
2611         /* precondition: doff < BRCMF_SDALIGN */
2612         doff += SDPCM_HDRLEN;
2613
2614         /* Round send length to next SDIO block */
2615         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2616                 u16 pad = bus->blocksize - (len % bus->blocksize);
2617                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2618                         len += pad;
2619         } else if (len % BRCMF_SDALIGN) {
2620                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2621         }
2622
2623         /* Satisfy length-alignment requirements */
2624         if (len & (ALIGNMENT - 1))
2625                 len = roundup(len, ALIGNMENT);
2626
2627         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2628
2629         /* Make sure backplane clock is on */
2630         sdio_claim_host(bus->sdiodev->func[1]);
2631         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2632         sdio_release_host(bus->sdiodev->func[1]);
2633
2634         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2635         *(__le16 *) frame = cpu_to_le16((u16) msglen);
2636         *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
2637
2638         /* Software tag: channel, sequence number, data offset */
2639         swheader =
2640             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
2641              SDPCM_CHANNEL_MASK)
2642             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
2643                              SDPCM_DOFFSET_MASK);
2644         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2645         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2646
2647         if (!data_ok(bus)) {
2648                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2649                           bus->tx_max, bus->tx_seq);
2650                 bus->ctrl_frame_stat = true;
2651                 /* Send from dpc */
2652                 bus->ctrl_frame_buf = frame;
2653                 bus->ctrl_frame_len = len;
2654
2655                 wait_event_interruptible_timeout(bus->ctrl_wait,
2656                                                  !bus->ctrl_frame_stat,
2657                                                  msecs_to_jiffies(2000));
2658
2659                 if (!bus->ctrl_frame_stat) {
2660                         brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
2661                         ret = 0;
2662                 } else {
2663                         brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
2664                         ret = -1;
2665                 }
2666         }
2667
2668         if (ret == -1) {
2669                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
2670                                    frame, len, "Tx Frame:\n");
2671                 brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
2672                                    BRCMF_HDRS_ON(),
2673                                    frame, min_t(u16, len, 16), "TxHdr:\n");
2674
2675                 do {
2676                         sdio_claim_host(bus->sdiodev->func[1]);
2677                         ret = brcmf_tx_frame(bus, frame, len);
2678                         sdio_release_host(bus->sdiodev->func[1]);
2679                 } while (ret < 0 && retries++ < TXRETRIES);
2680         }
2681
2682         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
2683         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) &&
2684             list_empty(&bus->dpc_tsklst)) {
2685                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2686
2687                 bus->activity = false;
2688                 sdio_claim_host(bus->sdiodev->func[1]);
2689                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2690                 sdio_release_host(bus->sdiodev->func[1]);
2691         } else {
2692                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2693         }
2694
2695         if (ret)
2696                 bus->sdcnt.tx_ctlerrs++;
2697         else
2698                 bus->sdcnt.tx_ctlpkts++;
2699
2700         return ret ? -EIO : 0;
2701 }
2702
2703 #ifdef DEBUG
2704 static inline bool brcmf_sdio_valid_shared_address(u32 addr)
2705 {
2706         return !(addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff));
2707 }
2708
2709 static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
2710                                  struct sdpcm_shared *sh)
2711 {
2712         u32 addr;
2713         int rv;
2714         u32 shaddr = 0;
2715         struct sdpcm_shared_le sh_le;
2716         __le32 addr_le;
2717
2718         shaddr = bus->ramsize - 4;
2719
2720         /*
2721          * Read last word in socram to determine
2722          * address of sdpcm_shared structure
2723          */
2724         sdio_claim_host(bus->sdiodev->func[1]);
2725         rv = brcmf_sdbrcm_membytes(bus, false, shaddr,
2726                                    (u8 *)&addr_le, 4);
2727         sdio_claim_host(bus->sdiodev->func[1]);
2728         if (rv < 0)
2729                 return rv;
2730
2731         addr = le32_to_cpu(addr_le);
2732
2733         brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
2734
2735         /*
2736          * Check if addr is valid.
2737          * NVRAM length at the end of memory should have been overwritten.
2738          */
2739         if (!brcmf_sdio_valid_shared_address(addr)) {
2740                         brcmf_err("invalid sdpcm_shared address 0x%08X\n",
2741                                   addr);
2742                         return -EINVAL;
2743         }
2744
2745         /* Read hndrte_shared structure */
2746         sdio_claim_host(bus->sdiodev->func[1]);
2747         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&sh_le,
2748                                    sizeof(struct sdpcm_shared_le));
2749         sdio_release_host(bus->sdiodev->func[1]);
2750         if (rv < 0)
2751                 return rv;
2752
2753         /* Endianness */
2754         sh->flags = le32_to_cpu(sh_le.flags);
2755         sh->trap_addr = le32_to_cpu(sh_le.trap_addr);
2756         sh->assert_exp_addr = le32_to_cpu(sh_le.assert_exp_addr);
2757         sh->assert_file_addr = le32_to_cpu(sh_le.assert_file_addr);
2758         sh->assert_line = le32_to_cpu(sh_le.assert_line);
2759         sh->console_addr = le32_to_cpu(sh_le.console_addr);
2760         sh->msgtrace_addr = le32_to_cpu(sh_le.msgtrace_addr);
2761
2762         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
2763                 brcmf_err("sdpcm_shared version mismatch: dhd %d dongle %d\n",
2764                           SDPCM_SHARED_VERSION,
2765                           sh->flags & SDPCM_SHARED_VERSION_MASK);
2766                 return -EPROTO;
2767         }
2768
2769         return 0;
2770 }
2771
2772 static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
2773                                    struct sdpcm_shared *sh, char __user *data,
2774                                    size_t count)
2775 {
2776         u32 addr, console_ptr, console_size, console_index;
2777         char *conbuf = NULL;
2778         __le32 sh_val;
2779         int rv;
2780         loff_t pos = 0;
2781         int nbytes = 0;
2782
2783         /* obtain console information from device memory */
2784         addr = sh->console_addr + offsetof(struct rte_console, log_le);
2785         rv = brcmf_sdbrcm_membytes(bus, false, addr,
2786                         (u8 *)&sh_val, sizeof(u32));
2787         if (rv < 0)
2788                 return rv;
2789         console_ptr = le32_to_cpu(sh_val);
2790
2791         addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
2792         rv = brcmf_sdbrcm_membytes(bus, false, addr,
2793                         (u8 *)&sh_val, sizeof(u32));
2794         if (rv < 0)
2795                 return rv;
2796         console_size = le32_to_cpu(sh_val);
2797
2798         addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
2799         rv = brcmf_sdbrcm_membytes(bus, false, addr,
2800                         (u8 *)&sh_val, sizeof(u32));
2801         if (rv < 0)
2802                 return rv;
2803         console_index = le32_to_cpu(sh_val);
2804
2805         /* allocate buffer for console data */
2806         if (console_size <= CONSOLE_BUFFER_MAX)
2807                 conbuf = vzalloc(console_size+1);
2808
2809         if (!conbuf)
2810                 return -ENOMEM;
2811
2812         /* obtain the console data from device */
2813         conbuf[console_size] = '\0';
2814         rv = brcmf_sdbrcm_membytes(bus, false, console_ptr, (u8 *)conbuf,
2815                                    console_size);
2816         if (rv < 0)
2817                 goto done;
2818
2819         rv = simple_read_from_buffer(data, count, &pos,
2820                                      conbuf + console_index,
2821                                      console_size - console_index);
2822         if (rv < 0)
2823                 goto done;
2824
2825         nbytes = rv;
2826         if (console_index > 0) {
2827                 pos = 0;
2828                 rv = simple_read_from_buffer(data+nbytes, count, &pos,
2829                                              conbuf, console_index - 1);
2830                 if (rv < 0)
2831                         goto done;
2832                 rv += nbytes;
2833         }
2834 done:
2835         vfree(conbuf);
2836         return rv;
2837 }
2838
2839 static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
2840                                 char __user *data, size_t count)
2841 {
2842         int error, res;
2843         char buf[350];
2844         struct brcmf_trap_info tr;
2845         int nbytes;
2846         loff_t pos = 0;
2847
2848         if ((sh->flags & SDPCM_SHARED_TRAP) == 0)
2849                 return 0;
2850
2851         sdio_claim_host(bus->sdiodev->func[1]);
2852         error = brcmf_sdbrcm_membytes(bus, false, sh->trap_addr, (u8 *)&tr,
2853                                       sizeof(struct brcmf_trap_info));
2854         if (error < 0)
2855                 return error;
2856
2857         nbytes = brcmf_sdio_dump_console(bus, sh, data, count);
2858         sdio_release_host(bus->sdiodev->func[1]);
2859         if (nbytes < 0)
2860                 return nbytes;
2861
2862         res = scnprintf(buf, sizeof(buf),
2863                         "dongle trap info: type 0x%x @ epc 0x%08x\n"
2864                         "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
2865                         "  lr   0x%08x pc   0x%08x offset 0x%x\n"
2866                         "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
2867                         "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
2868                         le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
2869                         le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
2870                         le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
2871                         le32_to_cpu(tr.pc), sh->trap_addr,
2872                         le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
2873                         le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
2874                         le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
2875                         le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
2876
2877         error = simple_read_from_buffer(data+nbytes, count, &pos, buf, res);
2878         if (error < 0)
2879                 return error;
2880
2881         nbytes += error;
2882         return nbytes;
2883 }
2884
2885 static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
2886                                   struct sdpcm_shared *sh, char __user *data,
2887                                   size_t count)
2888 {
2889         int error = 0;
2890         char buf[200];
2891         char file[80] = "?";
2892         char expr[80] = "<???>";
2893         int res;
2894         loff_t pos = 0;
2895
2896         if ((sh->flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
2897                 brcmf_dbg(INFO, "firmware not built with -assert\n");
2898                 return 0;
2899         } else if ((sh->flags & SDPCM_SHARED_ASSERT) == 0) {
2900                 brcmf_dbg(INFO, "no assert in dongle\n");
2901                 return 0;
2902         }
2903
2904         sdio_claim_host(bus->sdiodev->func[1]);
2905         if (sh->assert_file_addr != 0) {
2906                 error = brcmf_sdbrcm_membytes(bus, false, sh->assert_file_addr,
2907                                               (u8 *)file, 80);
2908                 if (error < 0)
2909                         return error;
2910         }
2911         if (sh->assert_exp_addr != 0) {
2912                 error = brcmf_sdbrcm_membytes(bus, false, sh->assert_exp_addr,
2913                                               (u8 *)expr, 80);
2914                 if (error < 0)
2915                         return error;
2916         }
2917         sdio_release_host(bus->sdiodev->func[1]);
2918
2919         res = scnprintf(buf, sizeof(buf),
2920                         "dongle assert: %s:%d: assert(%s)\n",
2921                         file, sh->assert_line, expr);
2922         return simple_read_from_buffer(data, count, &pos, buf, res);
2923 }
2924
2925 static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
2926 {
2927         int error;
2928         struct sdpcm_shared sh;
2929
2930         error = brcmf_sdio_readshared(bus, &sh);
2931
2932         if (error < 0)
2933                 return error;
2934
2935         if ((sh.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
2936                 brcmf_dbg(INFO, "firmware not built with -assert\n");
2937         else if (sh.flags & SDPCM_SHARED_ASSERT)
2938                 brcmf_err("assertion in dongle\n");
2939
2940         if (sh.flags & SDPCM_SHARED_TRAP)
2941                 brcmf_err("firmware trap in dongle\n");
2942
2943         return 0;
2944 }
2945
2946 static int brcmf_sdbrcm_died_dump(struct brcmf_sdio *bus, char __user *data,
2947                                   size_t count, loff_t *ppos)
2948 {
2949         int error = 0;
2950         struct sdpcm_shared sh;
2951         int nbytes = 0;
2952         loff_t pos = *ppos;
2953
2954         if (pos != 0)
2955                 return 0;
2956
2957         error = brcmf_sdio_readshared(bus, &sh);
2958         if (error < 0)
2959                 goto done;
2960
2961         error = brcmf_sdio_assert_info(bus, &sh, data, count);
2962         if (error < 0)
2963                 goto done;
2964
2965         nbytes = error;
2966         error = brcmf_sdio_trap_info(bus, &sh, data, count);
2967         if (error < 0)
2968                 goto done;
2969
2970         error += nbytes;
2971         *ppos += error;
2972 done:
2973         return error;
2974 }
2975
2976 static ssize_t brcmf_sdio_forensic_read(struct file *f, char __user *data,
2977                                         size_t count, loff_t *ppos)
2978 {
2979         struct brcmf_sdio *bus = f->private_data;
2980         int res;
2981
2982         res = brcmf_sdbrcm_died_dump(bus, data, count, ppos);
2983         if (res > 0)
2984                 *ppos += res;
2985         return (ssize_t)res;
2986 }
2987
2988 static const struct file_operations brcmf_sdio_forensic_ops = {
2989         .owner = THIS_MODULE,
2990         .open = simple_open,
2991         .read = brcmf_sdio_forensic_read
2992 };
2993
2994 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
2995 {
2996         struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
2997         struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
2998
2999         if (IS_ERR_OR_NULL(dentry))
3000                 return;
3001
3002         debugfs_create_file("forensics", S_IRUGO, dentry, bus,
3003                             &brcmf_sdio_forensic_ops);
3004         brcmf_debugfs_create_sdio_count(drvr, &bus->sdcnt);
3005 }
3006 #else
3007 static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
3008 {
3009         return 0;
3010 }
3011
3012 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
3013 {
3014 }
3015 #endif /* DEBUG */
3016
3017 static int
3018 brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
3019 {
3020         int timeleft;
3021         uint rxlen = 0;
3022         bool pending;
3023         u8 *buf;
3024         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3025         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3026         struct brcmf_sdio *bus = sdiodev->bus;
3027
3028         brcmf_dbg(TRACE, "Enter\n");
3029
3030         /* Wait until control frame is available */
3031         timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
3032
3033         spin_lock_bh(&bus->rxctl_lock);
3034         rxlen = bus->rxlen;
3035         memcpy(msg, bus->rxctl, min(msglen, rxlen));
3036         bus->rxctl = NULL;
3037         buf = bus->rxctl_orig;
3038         bus->rxctl_orig = NULL;
3039         bus->rxlen = 0;
3040         spin_unlock_bh(&bus->rxctl_lock);
3041         vfree(buf);
3042
3043         if (rxlen) {
3044                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
3045                           rxlen, msglen);
3046         } else if (timeleft == 0) {
3047                 brcmf_err("resumed on timeout\n");
3048                 brcmf_sdbrcm_checkdied(bus);
3049         } else if (pending) {
3050                 brcmf_dbg(CTL, "cancelled\n");
3051                 return -ERESTARTSYS;
3052         } else {
3053                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
3054                 brcmf_sdbrcm_checkdied(bus);
3055         }
3056
3057         if (rxlen)
3058                 bus->sdcnt.rx_ctlpkts++;
3059         else
3060                 bus->sdcnt.rx_ctlerrs++;
3061
3062         return rxlen ? (int)rxlen : -ETIMEDOUT;
3063 }
3064
3065 static int brcmf_sdbrcm_write_vars(struct brcmf_sdio *bus)
3066 {
3067         int bcmerror = 0;
3068         u32 varaddr;
3069         u32 varsizew;
3070         __le32 varsizew_le;
3071 #ifdef DEBUG
3072         char *nvram_ularray;
3073 #endif                          /* DEBUG */
3074
3075         /* Even if there are no vars are to be written, we still
3076                  need to set the ramsize. */
3077         varaddr = (bus->ramsize - 4) - bus->varsz;
3078
3079         if (bus->vars) {
3080                 /* Write the vars list */
3081                 bcmerror = brcmf_sdbrcm_membytes(bus, true, varaddr,
3082                                                  bus->vars, bus->varsz);
3083 #ifdef DEBUG
3084                 /* Verify NVRAM bytes */
3085                 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n",
3086                           bus->varsz);
3087                 nvram_ularray = kmalloc(bus->varsz, GFP_ATOMIC);
3088                 if (!nvram_ularray)
3089                         return -ENOMEM;
3090
3091                 /* Upload image to verify downloaded contents. */
3092                 memset(nvram_ularray, 0xaa, bus->varsz);
3093
3094                 /* Read the vars list to temp buffer for comparison */
3095                 bcmerror = brcmf_sdbrcm_membytes(bus, false, varaddr,
3096                                                  nvram_ularray, bus->varsz);
3097                 if (bcmerror) {
3098                         brcmf_err("error %d on reading %d nvram bytes at 0x%08x\n",
3099                                   bcmerror, bus->varsz, varaddr);
3100                 }
3101                 /* Compare the org NVRAM with the one read from RAM */
3102                 if (memcmp(bus->vars, nvram_ularray, bus->varsz))
3103                         brcmf_err("Downloaded NVRAM image is corrupted\n");
3104                 else
3105                         brcmf_err("Download/Upload/Compare of NVRAM ok\n");
3106
3107                 kfree(nvram_ularray);
3108 #endif                          /* DEBUG */
3109         }
3110
3111         /* adjust to the user specified RAM */
3112         brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
3113         brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3114                   varaddr, bus->varsz);
3115
3116         /*
3117          * Determine the length token:
3118          * Varsize, converted to words, in lower 16-bits, checksum
3119          * in upper 16-bits.
3120          */
3121         if (bcmerror) {
3122                 varsizew = 0;
3123                 varsizew_le = cpu_to_le32(0);
3124         } else {
3125                 varsizew = bus->varsz / 4;
3126                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3127                 varsizew_le = cpu_to_le32(varsizew);
3128         }
3129
3130         brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3131                   bus->varsz, varsizew);
3132
3133         /* Write the length token to the last word */
3134         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
3135                                          (u8 *)&varsizew_le, 4);
3136
3137         return bcmerror;
3138 }
3139
3140 static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
3141 {
3142         int bcmerror = 0;
3143         struct chip_info *ci = bus->ci;
3144
3145         /* To enter download state, disable ARM and reset SOCRAM.
3146          * To exit download state, simply reset ARM (default is RAM boot).
3147          */
3148         if (enter) {
3149                 bus->alp_only = true;
3150
3151                 ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3152
3153                 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
3154
3155                 /* Clear the top bit of memory */
3156                 if (bus->ramsize) {
3157                         u32 zeros = 0;
3158                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3159                                          (u8 *)&zeros, 4);
3160                 }
3161         } else {
3162                 if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
3163                         brcmf_err("SOCRAM core is down after reset?\n");
3164                         bcmerror = -EBADE;
3165                         goto fail;
3166                 }
3167
3168                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3169                 if (bcmerror) {
3170                         brcmf_err("no vars written to RAM\n");
3171                         bcmerror = 0;
3172                 }
3173
3174                 w_sdreg32(bus, 0xFFFFFFFF,
3175                           offsetof(struct sdpcmd_regs, intstatus));
3176
3177                 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3178
3179                 /* Allow HT Clock now that the ARM is running. */
3180                 bus->alp_only = false;
3181
3182                 bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
3183         }
3184 fail:
3185         return bcmerror;
3186 }
3187
3188 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
3189 {
3190         if (bus->firmware->size < bus->fw_ptr + len)
3191                 len = bus->firmware->size - bus->fw_ptr;
3192
3193         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3194         bus->fw_ptr += len;
3195         return len;
3196 }
3197
3198 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
3199 {
3200         int offset = 0;
3201         uint len;
3202         u8 *memblock = NULL, *memptr;
3203         int ret;
3204
3205         brcmf_dbg(INFO, "Enter\n");
3206
3207         ret = request_firmware(&bus->firmware, BRCMF_SDIO_FW_NAME,
3208                                &bus->sdiodev->func[2]->dev);
3209         if (ret) {
3210                 brcmf_err("Fail to request firmware %d\n", ret);
3211                 return ret;
3212         }
3213         bus->fw_ptr = 0;
3214
3215         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3216         if (memblock == NULL) {
3217                 ret = -ENOMEM;
3218                 goto err;
3219         }
3220         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3221                 memptr += (BRCMF_SDALIGN -
3222                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3223
3224         /* Download image */
3225         while ((len =
3226                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3227                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3228                 if (ret) {
3229                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
3230                                   ret, MEMBLOCK, offset);
3231                         goto err;
3232                 }
3233
3234                 offset += MEMBLOCK;
3235         }
3236
3237 err:
3238         kfree(memblock);
3239
3240         release_firmware(bus->firmware);
3241         bus->fw_ptr = 0;
3242
3243         return ret;
3244 }
3245
3246 /*
3247  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3248  * and ending in a NUL.
3249  * Removes carriage returns, empty lines, comment lines, and converts
3250  * newlines to NULs.
3251  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
3252  * by two NULs.
3253 */
3254
3255 static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
3256 {
3257         char *varbuf;
3258         char *dp;
3259         bool findNewline;
3260         int column;
3261         int ret = 0;
3262         uint buf_len, n, len;
3263
3264         len = bus->firmware->size;
3265         varbuf = vmalloc(len);
3266         if (!varbuf)
3267                 return -ENOMEM;
3268
3269         memcpy(varbuf, bus->firmware->data, len);
3270         dp = varbuf;
3271
3272         findNewline = false;
3273         column = 0;
3274
3275         for (n = 0; n < len; n++) {
3276                 if (varbuf[n] == 0)
3277                         break;
3278                 if (varbuf[n] == '\r')
3279                         continue;
3280                 if (findNewline && varbuf[n] != '\n')
3281                         continue;
3282                 findNewline = false;
3283                 if (varbuf[n] == '#') {
3284                         findNewline = true;
3285                         continue;
3286                 }
3287                 if (varbuf[n] == '\n') {
3288                         if (column == 0)
3289                                 continue;
3290                         *dp++ = 0;
3291                         column = 0;
3292                         continue;
3293                 }
3294                 *dp++ = varbuf[n];
3295                 column++;
3296         }
3297         buf_len = dp - varbuf;
3298         while (dp < varbuf + n)
3299                 *dp++ = 0;
3300
3301         kfree(bus->vars);
3302         /* roundup needed for download to device */
3303         bus->varsz = roundup(buf_len + 1, 4);
3304         bus->vars = kmalloc(bus->varsz, GFP_KERNEL);
3305         if (bus->vars == NULL) {
3306                 bus->varsz = 0;
3307                 ret = -ENOMEM;
3308                 goto err;
3309         }
3310
3311         /* copy the processed variables and add null termination */
3312         memcpy(bus->vars, varbuf, buf_len);
3313         bus->vars[buf_len] = 0;
3314 err:
3315         vfree(varbuf);
3316         return ret;
3317 }
3318
3319 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
3320 {
3321         int ret;
3322
3323         if (bus->sdiodev->bus_if->drvr_up)
3324                 return -EISCONN;
3325
3326         ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
3327                                &bus->sdiodev->func[2]->dev);
3328         if (ret) {
3329                 brcmf_err("Fail to request nvram %d\n", ret);
3330                 return ret;
3331         }
3332
3333         ret = brcmf_process_nvram_vars(bus);
3334
3335         release_firmware(bus->firmware);
3336
3337         return ret;
3338 }
3339
3340 static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3341 {
3342         int bcmerror = -1;
3343
3344         /* Keep arm in reset */
3345         if (brcmf_sdbrcm_download_state(bus, true)) {
3346                 brcmf_err("error placing ARM core in reset\n");
3347                 goto err;
3348         }
3349
3350         /* External image takes precedence if specified */
3351         if (brcmf_sdbrcm_download_code_file(bus)) {
3352                 brcmf_err("dongle image file download failed\n");
3353                 goto err;
3354         }
3355
3356         /* External nvram takes precedence if specified */
3357         if (brcmf_sdbrcm_download_nvram(bus))
3358                 brcmf_err("dongle nvram file download failed\n");
3359
3360         /* Take arm out of reset */
3361         if (brcmf_sdbrcm_download_state(bus, false)) {
3362                 brcmf_err("error getting out of ARM core reset\n");
3363                 goto err;
3364         }
3365
3366         bcmerror = 0;
3367
3368 err:
3369         return bcmerror;
3370 }
3371
3372 static bool
3373 brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3374 {
3375         bool ret;
3376
3377         sdio_claim_host(bus->sdiodev->func[1]);
3378
3379         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3380
3381         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3382
3383         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3384
3385         sdio_release_host(bus->sdiodev->func[1]);
3386
3387         return ret;
3388 }
3389
3390 static int brcmf_sdbrcm_bus_init(struct device *dev)
3391 {
3392         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3393         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3394         struct brcmf_sdio *bus = sdiodev->bus;
3395         unsigned long timeout;
3396         u8 ready, enable;
3397         int err, ret = 0;
3398         u8 saveclk;
3399
3400         brcmf_dbg(TRACE, "Enter\n");
3401
3402         /* try to download image and nvram to the dongle */
3403         if (bus_if->state == BRCMF_BUS_DOWN) {
3404                 if (!(brcmf_sdbrcm_download_firmware(bus)))
3405                         return -1;
3406         }
3407
3408         if (!bus->sdiodev->bus_if->drvr)
3409                 return 0;
3410
3411         /* Start the watchdog timer */
3412         bus->sdcnt.tickcnt = 0;
3413         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3414
3415         sdio_claim_host(bus->sdiodev->func[1]);
3416
3417         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3418         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3419         if (bus->clkstate != CLK_AVAIL)
3420                 goto exit;
3421
3422         /* Force clocks on backplane to be sure F2 interrupt propagates */
3423         saveclk = brcmf_sdio_regrb(bus->sdiodev,
3424                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
3425         if (!err) {
3426                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3427                                  (saveclk | SBSDIO_FORCE_HT), &err);
3428         }
3429         if (err) {
3430                 brcmf_err("Failed to force clock for F2: err %d\n", err);
3431                 goto exit;
3432         }
3433
3434         /* Enable function 2 (frame transfers) */
3435         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3436                   offsetof(struct sdpcmd_regs, tosbmailboxdata));
3437         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3438
3439         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
3440
3441         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3442         ready = 0;
3443         while (enable != ready) {
3444                 ready = brcmf_sdio_regrb(bus->sdiodev,
3445                                          SDIO_CCCR_IORx, NULL);
3446                 if (time_after(jiffies, timeout))
3447                         break;
3448                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3449                         /* prevent busy waiting if it takes too long */
3450                         msleep_interruptible(20);
3451         }
3452
3453         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3454
3455         /* If F2 successfully enabled, set core and enable interrupts */
3456         if (ready == enable) {
3457                 /* Set up the interrupt mask and enable interrupts */
3458                 bus->hostintmask = HOSTINTMASK;
3459                 w_sdreg32(bus, bus->hostintmask,
3460                           offsetof(struct sdpcmd_regs, hostintmask));
3461
3462                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
3463         } else {
3464                 /* Disable F2 again */
3465                 enable = SDIO_FUNC_ENABLE_1;
3466                 brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
3467                 ret = -ENODEV;
3468         }
3469
3470         /* Restore previous clock setting */
3471         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3472
3473         if (ret == 0) {
3474                 ret = brcmf_sdio_intr_register(bus->sdiodev);
3475                 if (ret != 0)
3476                         brcmf_err("intr register failed:%d\n", ret);
3477         }
3478
3479         /* If we didn't come up, turn off backplane clock */
3480         if (bus_if->state != BRCMF_BUS_DATA)
3481                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3482
3483 exit:
3484         sdio_release_host(bus->sdiodev->func[1]);
3485
3486         return ret;
3487 }
3488
3489 void brcmf_sdbrcm_isr(void *arg)
3490 {
3491         struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
3492
3493         brcmf_dbg(TRACE, "Enter\n");
3494
3495         if (!bus) {
3496                 brcmf_err("bus is null pointer, exiting\n");
3497                 return;
3498         }
3499
3500         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
3501                 brcmf_err("bus is down. we have nothing to do\n");
3502                 return;
3503         }
3504         /* Count the interrupt call */
3505         bus->sdcnt.intrcount++;
3506         if (in_interrupt())
3507                 atomic_set(&bus->ipend, 1);
3508         else
3509                 if (brcmf_sdio_intr_rstatus(bus)) {
3510                         brcmf_err("failed backplane access\n");
3511                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3512                 }
3513
3514         /* Disable additional interrupts (is this needed now)? */
3515         if (!bus->intr)
3516                 brcmf_err("isr w/o interrupt configured!\n");
3517
3518         brcmf_sdbrcm_adddpctsk(bus);
3519         queue_work(bus->brcmf_wq, &bus->datawork);
3520 }
3521
3522 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
3523 {
3524 #ifdef DEBUG
3525         struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
3526 #endif  /* DEBUG */
3527         unsigned long flags;
3528
3529         brcmf_dbg(TIMER, "Enter\n");
3530
3531         /* Poll period: check device if appropriate. */
3532         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3533                 u32 intstatus = 0;
3534
3535                 /* Reset poll tick */
3536                 bus->polltick = 0;
3537
3538                 /* Check device if no interrupts */
3539                 if (!bus->intr ||
3540                     (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
3541
3542                         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
3543                         if (list_empty(&bus->dpc_tsklst)) {
3544                                 u8 devpend;
3545                                 spin_unlock_irqrestore(&bus->dpc_tl_lock,
3546                                                        flags);
3547                                 sdio_claim_host(bus->sdiodev->func[1]);
3548                                 devpend = brcmf_sdio_regrb(bus->sdiodev,
3549                                                            SDIO_CCCR_INTx,
3550                                                            NULL);
3551                                 sdio_release_host(bus->sdiodev->func[1]);
3552                                 intstatus =
3553                                     devpend & (INTR_STATUS_FUNC1 |
3554                                                INTR_STATUS_FUNC2);
3555                         } else {
3556                                 spin_unlock_irqrestore(&bus->dpc_tl_lock,
3557                                                        flags);
3558                         }
3559
3560                         /* If there is something, make like the ISR and
3561                                  schedule the DPC */
3562                         if (intstatus) {
3563                                 bus->sdcnt.pollcnt++;
3564                                 atomic_set(&bus->ipend, 1);
3565
3566                                 brcmf_sdbrcm_adddpctsk(bus);
3567                                 queue_work(bus->brcmf_wq, &bus->datawork);
3568                         }
3569                 }
3570
3571                 /* Update interrupt tracking */
3572                 bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
3573         }
3574 #ifdef DEBUG
3575         /* Poll for console output periodically */
3576         if (bus_if && bus_if->state == BRCMF_BUS_DATA &&
3577             bus->console_interval != 0) {
3578                 bus->console.count += BRCMF_WD_POLL_MS;
3579                 if (bus->console.count >= bus->console_interval) {
3580                         bus->console.count -= bus->console_interval;
3581                         sdio_claim_host(bus->sdiodev->func[1]);
3582                         /* Make sure backplane clock is on */
3583                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3584                         if (brcmf_sdbrcm_readconsole(bus) < 0)
3585                                 /* stop on error */
3586                                 bus->console_interval = 0;
3587                         sdio_release_host(bus->sdiodev->func[1]);
3588                 }
3589         }
3590 #endif                          /* DEBUG */
3591
3592         /* On idle timeout clear activity flag and/or turn off clock */
3593         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3594                 if (++bus->idlecount >= bus->idletime) {
3595                         bus->idlecount = 0;
3596                         if (bus->activity) {
3597                                 bus->activity = false;
3598                                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3599                         } else {
3600                                 sdio_claim_host(bus->sdiodev->func[1]);
3601                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3602                                 sdio_release_host(bus->sdiodev->func[1]);
3603                         }
3604                 }
3605         }
3606
3607         return (atomic_read(&bus->ipend) > 0);
3608 }
3609
3610 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3611 {
3612         if (chipid == BCM43241_CHIP_ID)
3613                 return true;
3614         if (chipid == BCM4329_CHIP_ID)
3615                 return true;
3616         if (chipid == BCM4330_CHIP_ID)
3617                 return true;
3618         if (chipid == BCM4334_CHIP_ID)
3619                 return true;
3620         return false;
3621 }
3622
3623 static void brcmf_sdio_dataworker(struct work_struct *work)
3624 {
3625         struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
3626                                               datawork);
3627         struct list_head *cur_hd, *tmp_hd;
3628         unsigned long flags;
3629
3630         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
3631         list_for_each_safe(cur_hd, tmp_hd, &bus->dpc_tsklst) {
3632                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
3633
3634                 brcmf_sdbrcm_dpc(bus);
3635
3636                 spin_lock_irqsave(&bus->dpc_tl_lock, flags);
3637                 list_del(cur_hd);
3638                 kfree(cur_hd);
3639         }
3640         spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
3641 }
3642
3643 static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
3644 {
3645         brcmf_dbg(TRACE, "Enter\n");
3646
3647         kfree(bus->rxbuf);
3648         bus->rxctl = bus->rxbuf = NULL;
3649         bus->rxlen = 0;
3650
3651         kfree(bus->databuf);
3652         bus->databuf = NULL;
3653 }
3654
3655 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
3656 {
3657         brcmf_dbg(TRACE, "Enter\n");
3658
3659         if (bus->sdiodev->bus_if->maxctl) {
3660                 bus->rxblen =
3661                     roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
3662                             ALIGNMENT) + BRCMF_SDALIGN;
3663                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3664                 if (!(bus->rxbuf))
3665                         goto fail;
3666         }
3667
3668         /* Allocate buffer to receive glomed packet */
3669         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
3670         if (!(bus->databuf)) {
3671                 /* release rxbuf which was already located as above */
3672                 if (!bus->rxblen)
3673                         kfree(bus->rxbuf);
3674                 goto fail;
3675         }
3676
3677         /* Align the buffer */
3678         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
3679                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
3680                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
3681         else
3682                 bus->dataptr = bus->databuf;
3683
3684         return true;
3685
3686 fail:
3687         return false;
3688 }
3689
3690 static bool
3691 brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
3692 {
3693         u8 clkctl = 0;
3694         int err = 0;
3695         int reg_addr;
3696         u32 reg_val;
3697         u8 idx;
3698
3699         bus->alp_only = true;
3700
3701         sdio_claim_host(bus->sdiodev->func[1]);
3702
3703         pr_debug("F1 signature read @0x18000000=0x%4x\n",
3704                  brcmf_sdio_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
3705
3706         /*
3707          * Force PLL off until brcmf_sdio_chip_attach()
3708          * programs PLL control regs
3709          */
3710
3711         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3712                          BRCMF_INIT_CLKCTL1, &err);
3713         if (!err)
3714                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
3715                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
3716
3717         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3718                 brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3719                           err, BRCMF_INIT_CLKCTL1, clkctl);
3720                 goto fail;
3721         }
3722
3723         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3724                 brcmf_err("brcmf_sdio_chip_attach failed!\n");
3725                 goto fail;
3726         }
3727
3728         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
3729                 brcmf_err("unsupported chip: 0x%04x\n", bus->ci->chip);
3730                 goto fail;
3731         }
3732
3733         brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
3734                                           SDIO_DRIVE_STRENGTH);
3735
3736         /* Get info on the SOCRAM cores... */
3737         bus->ramsize = bus->ci->ramsize;
3738         if (!(bus->ramsize)) {
3739                 brcmf_err("failed to find SOCRAM memory!\n");
3740                 goto fail;
3741         }
3742
3743         /* Set core control so an SDIO reset does a backplane reset */
3744         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3745         reg_addr = bus->ci->c_inf[idx].base +
3746                    offsetof(struct sdpcmd_regs, corecontrol);
3747         reg_val = brcmf_sdio_regrl(bus->sdiodev, reg_addr, NULL);
3748         brcmf_sdio_regwl(bus->sdiodev, reg_addr, reg_val | CC_BPRESEN, NULL);
3749
3750         sdio_release_host(bus->sdiodev->func[1]);
3751
3752         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3753
3754         /* Locate an appropriately-aligned portion of hdrbuf */
3755         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3756                                     BRCMF_SDALIGN);
3757
3758         /* Set the poll and/or interrupt flags */
3759         bus->intr = true;
3760         bus->poll = false;
3761         if (bus->poll)
3762                 bus->pollrate = 1;
3763
3764         return true;
3765
3766 fail:
3767         sdio_release_host(bus->sdiodev->func[1]);
3768         return false;
3769 }
3770
3771 static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
3772 {
3773         brcmf_dbg(TRACE, "Enter\n");
3774
3775         sdio_claim_host(bus->sdiodev->func[1]);
3776
3777         /* Disable F2 to clear any intermediate frame state on the dongle */
3778         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx,
3779                          SDIO_FUNC_ENABLE_1, NULL);
3780
3781         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3782         bus->rxflow = false;
3783
3784         /* Done with backplane-dependent accesses, can drop clock... */
3785         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3786
3787         sdio_release_host(bus->sdiodev->func[1]);
3788
3789         /* ...and initialize clock/power states */
3790         bus->clkstate = CLK_SDONLY;
3791         bus->idletime = BRCMF_IDLE_INTERVAL;
3792         bus->idleclock = BRCMF_IDLE_ACTIVE;
3793
3794         /* Query the F2 block size, set roundup accordingly */
3795         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3796         bus->roundup = min(max_roundup, bus->blocksize);
3797
3798         /* bus module does not support packet chaining */
3799         bus->use_rxchain = false;
3800         bus->sd_rxchain = false;
3801
3802         return true;
3803 }
3804
3805 static int
3806 brcmf_sdbrcm_watchdog_thread(void *data)
3807 {
3808         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3809
3810         allow_signal(SIGTERM);
3811         /* Run until signal received */
3812         while (1) {
3813                 if (kthread_should_stop())
3814                         break;
3815                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3816                         brcmf_sdbrcm_bus_watchdog(bus);
3817                         /* Count the tick for reference */
3818                         bus->sdcnt.tickcnt++;
3819                 } else
3820                         break;
3821         }
3822         return 0;
3823 }
3824
3825 static void
3826 brcmf_sdbrcm_watchdog(unsigned long data)
3827 {
3828         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3829
3830         if (bus->watchdog_tsk) {
3831                 complete(&bus->watchdog_wait);
3832                 /* Reschedule the watchdog */
3833                 if (bus->wd_timer_valid)
3834                         mod_timer(&bus->timer,
3835                                   jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3836         }
3837 }
3838
3839 static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
3840 {
3841         brcmf_dbg(TRACE, "Enter\n");
3842
3843         if (bus->ci) {
3844                 sdio_claim_host(bus->sdiodev->func[1]);
3845                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3846                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3847                 sdio_release_host(bus->sdiodev->func[1]);
3848                 brcmf_sdio_chip_detach(&bus->ci);
3849                 if (bus->vars && bus->varsz)
3850                         kfree(bus->vars);
3851                 bus->vars = NULL;
3852         }
3853
3854         brcmf_dbg(TRACE, "Disconnected\n");
3855 }
3856
3857 /* Detach and free everything */
3858 static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
3859 {
3860         brcmf_dbg(TRACE, "Enter\n");
3861
3862         if (bus) {
3863                 /* De-register interrupt handler */
3864                 brcmf_sdio_intr_unregister(bus->sdiodev);
3865
3866                 cancel_work_sync(&bus->datawork);
3867                 if (bus->brcmf_wq)
3868                         destroy_workqueue(bus->brcmf_wq);
3869
3870                 if (bus->sdiodev->bus_if->drvr) {
3871                         brcmf_detach(bus->sdiodev->dev);
3872                         brcmf_sdbrcm_release_dongle(bus);
3873                 }
3874
3875                 brcmf_sdbrcm_release_malloc(bus);
3876
3877                 kfree(bus);
3878         }
3879
3880         brcmf_dbg(TRACE, "Disconnected\n");
3881 }
3882
3883 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
3884         .stop = brcmf_sdbrcm_bus_stop,
3885         .init = brcmf_sdbrcm_bus_init,
3886         .txdata = brcmf_sdbrcm_bus_txdata,
3887         .txctl = brcmf_sdbrcm_bus_txctl,
3888         .rxctl = brcmf_sdbrcm_bus_rxctl,
3889 };
3890
3891 void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
3892 {
3893         int ret;
3894         struct brcmf_sdio *bus;
3895         struct brcmf_bus_dcmd *dlst;
3896         u32 dngl_txglom;
3897         u32 dngl_txglomalign;
3898         u8 idx;
3899
3900         brcmf_dbg(TRACE, "Enter\n");
3901
3902         /* We make an assumption about address window mappings:
3903          * regsva == SI_ENUM_BASE*/
3904
3905         /* Allocate private bus interface state */
3906         bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
3907         if (!bus)
3908                 goto fail;
3909
3910         bus->sdiodev = sdiodev;
3911         sdiodev->bus = bus;
3912         skb_queue_head_init(&bus->glom);
3913         bus->txbound = BRCMF_TXBOUND;
3914         bus->rxbound = BRCMF_RXBOUND;
3915         bus->txminmax = BRCMF_TXMINMAX;
3916         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
3917
3918         INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
3919         bus->brcmf_wq = create_singlethread_workqueue("brcmf_wq");
3920         if (bus->brcmf_wq == NULL) {
3921                 brcmf_err("insufficient memory to create txworkqueue\n");
3922                 goto fail;
3923         }
3924
3925         /* attempt to attach to the dongle */
3926         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3927                 brcmf_err("brcmf_sdbrcm_probe_attach failed\n");
3928                 goto fail;
3929         }
3930
3931         spin_lock_init(&bus->rxctl_lock);
3932         spin_lock_init(&bus->txqlock);
3933         init_waitqueue_head(&bus->ctrl_wait);
3934         init_waitqueue_head(&bus->dcmd_resp_wait);
3935
3936         /* Set up the watchdog timer */
3937         init_timer(&bus->timer);
3938         bus->timer.data = (unsigned long)bus;
3939         bus->timer.function = brcmf_sdbrcm_watchdog;
3940
3941         /* Initialize watchdog thread */
3942         init_completion(&bus->watchdog_wait);
3943         bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3944                                         bus, "brcmf_watchdog");
3945         if (IS_ERR(bus->watchdog_tsk)) {
3946                 pr_warn("brcmf_watchdog thread failed to start\n");
3947                 bus->watchdog_tsk = NULL;
3948         }
3949         /* Initialize DPC thread */
3950         INIT_LIST_HEAD(&bus->dpc_tsklst);
3951         spin_lock_init(&bus->dpc_tl_lock);
3952
3953         /* Assign bus interface call back */
3954         bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
3955         bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
3956
3957         /* Attach to the brcmf/OS/network interface */
3958         ret = brcmf_attach(SDPCM_RESERVE, bus->sdiodev->dev);
3959         if (ret != 0) {
3960                 brcmf_err("brcmf_attach failed\n");
3961                 goto fail;
3962         }
3963
3964         /* Allocate buffers */
3965         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
3966                 brcmf_err("brcmf_sdbrcm_probe_malloc failed\n");
3967                 goto fail;
3968         }
3969
3970         if (!(brcmf_sdbrcm_probe_init(bus))) {
3971                 brcmf_err("brcmf_sdbrcm_probe_init failed\n");
3972                 goto fail;
3973         }
3974
3975         brcmf_sdio_debugfs_create(bus);
3976         brcmf_dbg(INFO, "completed!!\n");
3977
3978         /* sdio bus core specific dcmd */
3979         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3980         dlst = kzalloc(sizeof(struct brcmf_bus_dcmd), GFP_KERNEL);
3981         if (dlst) {
3982                 if (bus->ci->c_inf[idx].rev < 12) {
3983                         /* for sdio core rev < 12, disable txgloming */
3984                         dngl_txglom = 0;
3985                         dlst->name = "bus:txglom";
3986                         dlst->param = (char *)&dngl_txglom;
3987                         dlst->param_len = sizeof(u32);
3988                 } else {
3989                         /* otherwise, set txglomalign */
3990                         dngl_txglomalign = bus->sdiodev->bus_if->align;
3991                         dlst->name = "bus:txglomalign";
3992                         dlst->param = (char *)&dngl_txglomalign;
3993                         dlst->param_len = sizeof(u32);
3994                 }
3995                 list_add(&dlst->list, &bus->sdiodev->bus_if->dcmd_list);
3996         }
3997
3998         /* if firmware path present try to download and bring up bus */
3999         ret = brcmf_bus_start(bus->sdiodev->dev);
4000         if (ret != 0) {
4001                 brcmf_err("dongle is not responding\n");
4002                 goto fail;
4003         }
4004
4005         return bus;
4006
4007 fail:
4008         brcmf_sdbrcm_release(bus);
4009         return NULL;
4010 }
4011
4012 void brcmf_sdbrcm_disconnect(void *ptr)
4013 {
4014         struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
4015
4016         brcmf_dbg(TRACE, "Enter\n");
4017
4018         if (bus)
4019                 brcmf_sdbrcm_release(bus);
4020
4021         brcmf_dbg(TRACE, "Disconnected\n");
4022 }
4023
4024 void
4025 brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
4026 {
4027         /* Totally stop the timer */
4028         if (!wdtick && bus->wd_timer_valid) {
4029                 del_timer_sync(&bus->timer);
4030                 bus->wd_timer_valid = false;
4031                 bus->save_ms = wdtick;
4032                 return;
4033         }
4034
4035         /* don't start the wd until fw is loaded */
4036         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
4037                 return;
4038
4039         if (wdtick) {
4040                 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4041                         if (bus->wd_timer_valid)
4042                                 /* Stop timer and restart at new value */
4043                                 del_timer_sync(&bus->timer);
4044
4045                         /* Create timer again when watchdog period is
4046                            dynamically changed or in the first instance
4047                          */
4048                         bus->timer.expires =
4049                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4050                         add_timer(&bus->timer);
4051
4052                 } else {
4053                         /* Re arm the timer, at last watchdog period */
4054                         mod_timer(&bus->timer,
4055                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4056                 }
4057
4058                 bus->wd_timer_valid = true;
4059                 bus->save_ms = wdtick;
4060         }
4061 }