drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <linux/module.h>
  31 #include <linux/bcma/bcma.h>
  32 #include <linux/debugfs.h>
  33 #include <linux/vmalloc.h>
  34 #include <linux/platform_data/brcmfmac-sdio.h>
  35 #include <asm/unaligned.h>
  36 #include <defs.h>
  37 #include <brcmu_wifi.h>
  38 #include <brcmu_utils.h>
  39 #include <brcm_hw_ids.h>
  40 #include <soc.h>
  41 #include "sdio_host.h"
  42 #include "sdio_chip.h"
  43
  44 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
  45
  46 #ifdef DEBUG
  47
  48 #define BRCMF_TRAP_INFO_SIZE    80
  49
  50 #define CBUF_LEN        (128)
  51
  52 /* Device console log buffer state */
  53 #define CONSOLE_BUFFER_MAX      2024
  54
  55 struct rte_log_le {
  56         __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  57         __le32 buf_size;
  58         __le32 idx;
  59         char *_buf_compat;      /* Redundant pointer for backward compat. */
  60 };
  61
  62 struct rte_console {
  63         /* Virtual UART
  64          * When there is no UART (e.g. Quickturn),
  65          * the host should write a complete
  66          * input line directly into cbuf and then write
  67          * the length into vcons_in.
  68          * This may also be used when there is a real UART
  69          * (at risk of conflicting with
  70          * the real UART).  vcons_out is currently unused.
  71          */
  72         uint vcons_in;
  73         uint vcons_out;
  74
  75         /* Output (logging) buffer
  76          * Console output is written to a ring buffer log_buf at index log_idx.
  77          * The host may read the output when it sees log_idx advance.
  78          * Output will be lost if the output wraps around faster than the host
  79          * polls.
  80          */
  81         struct rte_log_le log_le;
  82
  83         /* Console input line buffer
  84          * Characters are read one at a time into cbuf
  85          * until <CR> is received, then
  86          * the buffer is processed as a command line.
  87          * Also used for virtual UART.
  88          */
  89         uint cbuf_idx;
  90         char cbuf[CBUF_LEN];
  91 };
  92
  93 #endif                          /* DEBUG */
  94 #include <chipcommon.h>
  95
  96 #include "dhd_bus.h"
  97 #include "dhd_dbg.h"
  98 #include "tracepoint.h"
  99
 100 #define TXQLEN          2048    /* bulk tx queue length */
 101 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 102 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 103 #define PRIOMASK        7
 104
 105 #define TXRETRIES       2       /* # of retries for tx frames */
 106
 107 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 108                                  one scheduling */
 109
 110 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 111                                  one scheduling */
 112
 113 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 114
 115 #define MEMBLOCK        2048    /* Block size used for downloading
 116                                  of dongle image */
 117 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 118                                  biggest possible glom */
 119
 120 #define BRCMF_FIRSTREAD (1 << 6)
 121
 122
 123 /* SBSDIO_DEVICE_CTL */
 124
 125 /* 1: device will assert busy signal when receiving CMD53 */
 126 #define SBSDIO_DEVCTL_SETBUSY           0x01
 127 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 128 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 129 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 130 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 131 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 132  * sdio bus power cycle to clear (rev 9) */
 133 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 134 /* Force SD->SB reset mapping (rev 11) */
 135 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 136 /*   Determined by CoreControl bit */
 137 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 138 /*   Force backplane reset */
 139 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 140 /*   Force no backplane reset */
 141 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 142
 143 /* direct(mapped) cis space */
 144
 145 /* MAPPED common CIS address */
 146 #define SBSDIO_CIS_BASE_COMMON          0x1000
 147 /* maximum bytes in one CIS */
 148 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 149 /* cis offset addr is < 17 bits */
 150 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 151
 152 /* manfid tuple length, include tuple, link bytes */
 153 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 154
 155 /* intstatus */
 156 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 157 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 158 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 159 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 160 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 161 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 162 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 163 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 164 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 165 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 166 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 167 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 168 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 169 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 170 #define I_PC            (1 << 10)       /* descriptor error */
 171 #define I_PD            (1 << 11)       /* data error */
 172 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 173 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 174 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 175 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 176 #define I_RI            (1 << 16)       /* Receive Interrupt */
 177 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 178 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 179 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 180 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 181 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 182 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 183 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 184 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 185 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 186 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 187 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 188 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 189
 190 /* corecontrol */
 191 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 192 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 193 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 194 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 195 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 196 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 197
 198 /* SDA_FRAMECTRL */
 199 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 200 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 201 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 202 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 203
 204 /*
 205  * Software allocation of To SB Mailbox resources
 206  */
 207
 208 /* tosbmailbox bits corresponding to intstatus bits */
 209 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 210 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 211 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 212 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 213
 214 /* tosbmailboxdata */
 215 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 216
 217 /*
 218  * Software allocation of To Host Mailbox resources
 219  */
 220
 221 /* intstatus bits */
 222 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 223 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 224 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 225 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 226
 227 /* tohostmailboxdata */
 228 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 229 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 230 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 231 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 232
 233 #define HMB_DATA_FCDATA_MASK    0xff000000
 234 #define HMB_DATA_FCDATA_SHIFT   24
 235
 236 #define HMB_DATA_VERSION_MASK   0x00ff0000
 237 #define HMB_DATA_VERSION_SHIFT  16
 238
 239 /*
 240  * Software-defined protocol header
 241  */
 242
 243 /* Current protocol version */
 244 #define SDPCM_PROT_VERSION      4
 245
 246 /*
 247  * Shared structure between dongle and the host.
 248  * The structure contains pointers to trap or assert information.
 249  */
 250 #define SDPCM_SHARED_VERSION       0x0003
 251 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 252 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 253 #define SDPCM_SHARED_ASSERT        0x0200
 254 #define SDPCM_SHARED_TRAP          0x0400
 255
 256 /* Space for header read, limit for data packets */
 257 #define MAX_HDR_READ    (1 << 6)
 258 #define MAX_RX_DATASZ   2048
 259
 260 /* Maximum milliseconds to wait for F2 to come up */
 261 #define BRCMF_WAIT_F2RDY        3000
 262
 263 /* Bump up limit on waiting for HT to account for first startup;
 264  * if the image is doing a CRC calculation before programming the PMU
 265  * for HT availability, it could take a couple hundred ms more, so
 266  * max out at a 1 second (1000000us).
 267  */
 268 #undef PMU_MAX_TRANSITION_DLY
 269 #define PMU_MAX_TRANSITION_DLY 1000000
 270
 271 /* Value for ChipClockCSR during initial setup */
 272 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 273                                         SBSDIO_ALP_AVAIL_REQ)
 274
 275 /* Flags for SDH calls */
 276 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 277
 278 #define BRCMF_SDIO_FW_NAME      "brcm/brcmfmac-sdio.bin"
 279 #define BRCMF_SDIO_NV_NAME      "brcm/brcmfmac-sdio.txt"
 280 MODULE_FIRMWARE(BRCMF_SDIO_FW_NAME);
 281 MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
 282
 283 #define BRCMF_IDLE_IMMEDIATE    (-1)    /* Enter idle immediately */
 284 #define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
 285                                          * when idle
 286                                          */
 287 #define BRCMF_IDLE_INTERVAL     1
 288
 289 #define KSO_WAIT_US 50
 290 #define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
 291
 292 /*
 293  * Conversion of 802.1D priority to precedence level
 294  */
 295 static uint prio2prec(u32 prio)
 296 {
 297         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 298                (prio^2) : prio;
 299 }
 300
 301 #ifdef DEBUG
 302 /* Device console log buffer state */
 303 struct brcmf_console {
 304         uint count;             /* Poll interval msec counter */
 305         uint log_addr;          /* Log struct address (fixed) */
 306         struct rte_log_le log_le;       /* Log struct (host copy) */
 307         uint bufsize;           /* Size of log buffer */
 308         u8 *buf;                /* Log buffer (host copy) */
 309         uint last;              /* Last buffer read index */
 310 };
 311
 312 struct brcmf_trap_info {
 313         __le32          type;
 314         __le32          epc;
 315         __le32          cpsr;
 316         __le32          spsr;
 317         __le32          r0;     /* a1 */
 318         __le32          r1;     /* a2 */
 319         __le32          r2;     /* a3 */
 320         __le32          r3;     /* a4 */
 321         __le32          r4;     /* v1 */
 322         __le32          r5;     /* v2 */
 323         __le32          r6;     /* v3 */
 324         __le32          r7;     /* v4 */
 325         __le32          r8;     /* v5 */
 326         __le32          r9;     /* sb/v6 */
 327         __le32          r10;    /* sl/v7 */
 328         __le32          r11;    /* fp/v8 */
 329         __le32          r12;    /* ip */
 330         __le32          r13;    /* sp */
 331         __le32          r14;    /* lr */
 332         __le32          pc;     /* r15 */
 333 };
 334 #endif                          /* DEBUG */
 335
 336 struct sdpcm_shared {
 337         u32 flags;
 338         u32 trap_addr;
 339         u32 assert_exp_addr;
 340         u32 assert_file_addr;
 341         u32 assert_line;
 342         u32 console_addr;       /* Address of struct rte_console */
 343         u32 msgtrace_addr;
 344         u8 tag[32];
 345         u32 brpt_addr;
 346 };
 347
 348 struct sdpcm_shared_le {
 349         __le32 flags;
 350         __le32 trap_addr;
 351         __le32 assert_exp_addr;
 352         __le32 assert_file_addr;
 353         __le32 assert_line;
 354         __le32 console_addr;    /* Address of struct rte_console */
 355         __le32 msgtrace_addr;
 356         u8 tag[32];
 357         __le32 brpt_addr;
 358 };
 359
 360 /* dongle SDIO bus specific header info */
 361 struct brcmf_sdio_hdrinfo {
 362         u8 seq_num;
 363         u8 channel;
 364         u16 len;
 365         u16 len_left;
 366         u16 len_nxtfrm;
 367         u8 dat_offset;
 368 };
 369
 370 /* misc chip info needed by some of the routines */
 371 /* Private data for SDIO bus interaction */
 372 struct brcmf_sdio {
 373         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 374         struct chip_info *ci;   /* Chip info struct */
 375         char *vars;             /* Variables (from CIS and/or other) */
 376         uint varsz;             /* Size of variables buffer */
 377
 378         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 379
 380         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 381         atomic_t intstatus;     /* Intstatus bits (events) pending */
 382         atomic_t fcstate;       /* State of dongle flow-control */
 383
 384         uint blocksize;         /* Block size of SDIO transfers */
 385         uint roundup;           /* Max roundup limit */
 386
 387         struct pktq txq;        /* Queue length used for flow-control */
 388         u8 flowcontrol; /* per prio flow control bitmask */
 389         u8 tx_seq;              /* Transmit sequence number (next) */
 390         u8 tx_max;              /* Maximum transmit sequence allowed */
 391
 392         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 393         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 394         u8 rx_seq;              /* Receive sequence number (expected) */
 395         struct brcmf_sdio_hdrinfo cur_read;
 396                                 /* info of current read frame */
 397         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 398         bool rxpending;         /* Data frame pending in dongle */
 399
 400         uint rxbound;           /* Rx frames to read before resched */
 401         uint txbound;           /* Tx frames to send before resched */
 402         uint txminmax;
 403
 404         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 405         struct sk_buff_head glom; /* Packet list for glommed superframe */
 406         uint glomerr;           /* Glom packet read errors */
 407
 408         u8 *rxbuf;              /* Buffer for receiving control packets */
 409         uint rxblen;            /* Allocated length of rxbuf */
 410         u8 *rxctl;              /* Aligned pointer into rxbuf */
 411         u8 *rxctl_orig;         /* pointer for freeing rxctl */
 412         uint rxlen;             /* Length of valid data in buffer */
 413         spinlock_t rxctl_lock;  /* protection lock for ctrl frame resources */
 414
 415         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 416
 417         bool intr;              /* Use interrupts */
 418         bool poll;              /* Use polling */
 419         atomic_t ipend;         /* Device interrupt is pending */
 420         uint spurious;          /* Count of spurious interrupts */
 421         uint pollrate;          /* Ticks between device polls */
 422         uint polltick;          /* Tick counter */
 423
 424 #ifdef DEBUG
 425         uint console_interval;
 426         struct brcmf_console console;   /* Console output polling support */
 427         uint console_addr;      /* Console address from shared struct */
 428 #endif                          /* DEBUG */
 429
 430         uint clkstate;          /* State of sd and backplane clock(s) */
 431         bool activity;          /* Activity flag for clock down */
 432         s32 idletime;           /* Control for activity timeout */
 433         s32 idlecount;  /* Activity timeout counter */
 434         s32 idleclock;  /* How to set bus driver when idle */
 435         bool rxflow_mode;       /* Rx flow control mode */
 436         bool rxflow;            /* Is rx flow control on */
 437         bool alp_only;          /* Don't use HT clock (ALP only) */
 438
 439         u8 *ctrl_frame_buf;
 440         u32 ctrl_frame_len;
 441         bool ctrl_frame_stat;
 442
 443         spinlock_t txqlock;
 444         wait_queue_head_t ctrl_wait;
 445         wait_queue_head_t dcmd_resp_wait;
 446
 447         struct timer_list timer;
 448         struct completion watchdog_wait;
 449         struct task_struct *watchdog_tsk;
 450         bool wd_timer_valid;
 451         uint save_ms;
 452
 453         struct workqueue_struct *brcmf_wq;
 454         struct work_struct datawork;
 455         atomic_t dpc_tskcnt;
 456
 457         const struct firmware *firmware;
 458         u32 fw_ptr;
 459
 460         bool txoff;             /* Transmit flow-controlled */
 461         struct brcmf_sdio_count sdcnt;
 462         bool sr_enabled; /* SaveRestore enabled */
 463         bool sleeping; /* SDIO bus sleeping */
 464
 465         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
 466 };
 467
 468 /* clkstate */
 469 #define CLK_NONE        0
 470 #define CLK_SDONLY      1
 471 #define CLK_PENDING     2
 472 #define CLK_AVAIL       3
 473
 474 #ifdef DEBUG
 475 static int qcount[NUMPRIO];
 476 #endif                          /* DEBUG */
 477
 478 #define DEFAULT_SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 479
 480 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 481
 482 /* Retry count for register access failures */
 483 static const uint retry_limit = 2;
 484
 485 /* Limit on rounding up frames */
 486 static const uint max_roundup = 512;
 487
 488 #define ALIGNMENT  4
 489
 490 enum brcmf_sdio_frmtype {
 491         BRCMF_SDIO_FT_NORMAL,
 492         BRCMF_SDIO_FT_SUPER,
 493         BRCMF_SDIO_FT_SUB,
 494 };
 495
 496 static void pkt_align(struct sk_buff *p, int len, int align)
 497 {
 498         uint datalign;
 499         datalign = (unsigned long)(p->data);
 500         datalign = roundup(datalign, (align)) - datalign;
 501         if (datalign)
 502                 skb_pull(p, datalign);
 503         __skb_trim(p, len);
 504 }
 505
 506 /* To check if there's window offered */
 507 static bool data_ok(struct brcmf_sdio *bus)
 508 {
 509         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 510                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 511 }
 512
 513 /*
 514  * Reads a register in the SDIO hardware block. This block occupies a series of
 515  * adresses on the 32 bit backplane bus.
 516  */
 517 static int
 518 r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
 519 {
 520         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 521         int ret;
 522
 523         *regvar = brcmf_sdio_regrl(bus->sdiodev,
 524                                    bus->ci->c_inf[idx].base + offset, &ret);
 525
 526         return ret;
 527 }
 528
 529 static int
 530 w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
 531 {
 532         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 533         int ret;
 534
 535         brcmf_sdio_regwl(bus->sdiodev,
 536                          bus->ci->c_inf[idx].base + reg_offset,
 537                          regval, &ret);
 538
 539         return ret;
 540 }
 541
 542 static int
 543 brcmf_sdbrcm_kso_control(struct brcmf_sdio *bus, bool on)
 544 {
 545         u8 wr_val = 0, rd_val, cmp_val, bmask;
 546         int err = 0;
 547         int try_cnt = 0;
 548
 549         brcmf_dbg(TRACE, "Enter\n");
 550
 551         wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
 552         /* 1st KSO write goes to AOS wake up core if device is asleep  */
 553         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 554                          wr_val, &err);
 555         if (err) {
 556                 brcmf_err("SDIO_AOS KSO write error: %d\n", err);
 557                 return err;
 558         }
 559
 560         if (on) {
 561                 /* device WAKEUP through KSO:
 562                  * write bit 0 & read back until
 563                  * both bits 0 (kso bit) & 1 (dev on status) are set
 564                  */
 565                 cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |
 566                           SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
 567                 bmask = cmp_val;
 568                 usleep_range(2000, 3000);
 569         } else {
 570                 /* Put device to sleep, turn off KSO */
 571                 cmp_val = 0;
 572                 /* only check for bit0, bit1(dev on status) may not
 573                  * get cleared right away
 574                  */
 575                 bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
 576         }
 577
 578         do {
 579                 /* reliable KSO bit set/clr:
 580                  * the sdiod sleep write access is synced to PMU 32khz clk
 581                  * just one write attempt may fail,
 582                  * read it back until it matches written value
 583                  */
 584                 rd_val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 585                                           &err);
 586                 if (((rd_val & bmask) == cmp_val) && !err)
 587                         break;
 588                 brcmf_dbg(SDIO, "KSO wr/rd retry:%d (max: %d) ERR:%x\n",
 589                           try_cnt, MAX_KSO_ATTEMPTS, err);
 590                 udelay(KSO_WAIT_US);
 591                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 592                                  wr_val, &err);
 593         } while (try_cnt++ < MAX_KSO_ATTEMPTS);
 594
 595         return err;
 596 }
 597
 598 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 599
 600 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 601
 602 /* Turn backplane clock on or off */
 603 static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 604 {
 605         int err;
 606         u8 clkctl, clkreq, devctl;
 607         unsigned long timeout;
 608
 609         brcmf_dbg(SDIO, "Enter\n");
 610
 611         clkctl = 0;
 612
 613         if (bus->sr_enabled) {
 614                 bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
 615                 return 0;
 616         }
 617
 618         if (on) {
 619                 /* Request HT Avail */
 620                 clkreq =
 621                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 622
 623                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 624                                  clkreq, &err);
 625                 if (err) {
 626                         brcmf_err("HT Avail request error: %d\n", err);
 627                         return -EBADE;
 628                 }
 629
 630                 /* Check current status */
 631                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
 632                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
 633                 if (err) {
 634                         brcmf_err("HT Avail read error: %d\n", err);
 635                         return -EBADE;
 636                 }
 637
 638                 /* Go to pending and await interrupt if appropriate */
 639                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 640                         /* Allow only clock-available interrupt */
 641                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 642                                                   SBSDIO_DEVICE_CTL, &err);
 643                         if (err) {
 644                                 brcmf_err("Devctl error setting CA: %d\n",
 645                                           err);
 646                                 return -EBADE;
 647                         }
 648
 649                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 650                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 651                                          devctl, &err);
 652                         brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
 653                         bus->clkstate = CLK_PENDING;
 654
 655                         return 0;
 656                 } else if (bus->clkstate == CLK_PENDING) {
 657                         /* Cancel CA-only interrupt filter */
 658                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 659                                                   SBSDIO_DEVICE_CTL, &err);
 660                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 661                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 662                                          devctl, &err);
 663                 }
 664
 665                 /* Otherwise, wait here (polling) for HT Avail */
 666                 timeout = jiffies +
 667                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 668                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 669                         clkctl = brcmf_sdio_regrb(bus->sdiodev,
 670                                                   SBSDIO_FUNC1_CHIPCLKCSR,
 671                                                   &err);
 672                         if (time_after(jiffies, timeout))
 673                                 break;
 674                         else
 675                                 usleep_range(5000, 10000);
 676                 }
 677                 if (err) {
 678                         brcmf_err("HT Avail request error: %d\n", err);
 679                         return -EBADE;
 680                 }
 681                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 682                         brcmf_err("HT Avail timeout (%d): clkctl 0x%02x\n",
 683                                   PMU_MAX_TRANSITION_DLY, clkctl);
 684                         return -EBADE;
 685                 }
 686
 687                 /* Mark clock available */
 688                 bus->clkstate = CLK_AVAIL;
 689                 brcmf_dbg(SDIO, "CLKCTL: turned ON\n");
 690
 691 #if defined(DEBUG)
 692                 if (!bus->alp_only) {
 693                         if (SBSDIO_ALPONLY(clkctl))
 694                                 brcmf_err("HT Clock should be on\n");
 695                 }
 696 #endif                          /* defined (DEBUG) */
 697
 698                 bus->activity = true;
 699         } else {
 700                 clkreq = 0;
 701
 702                 if (bus->clkstate == CLK_PENDING) {
 703                         /* Cancel CA-only interrupt filter */
 704                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 705                                                   SBSDIO_DEVICE_CTL, &err);
 706                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 707                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 708                                          devctl, &err);
 709                 }
 710
 711                 bus->clkstate = CLK_SDONLY;
 712                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 713                                  clkreq, &err);
 714                 brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
 715                 if (err) {
 716                         brcmf_err("Failed access turning clock off: %d\n",
 717                                   err);
 718                         return -EBADE;
 719                 }
 720         }
 721         return 0;
 722 }
 723
 724 /* Change idle/active SD state */
 725 static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
 726 {
 727         brcmf_dbg(SDIO, "Enter\n");
 728
 729         if (on)
 730                 bus->clkstate = CLK_SDONLY;
 731         else
 732                 bus->clkstate = CLK_NONE;
 733
 734         return 0;
 735 }
 736
 737 /* Transition SD and backplane clock readiness */
 738 static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 739 {
 740 #ifdef DEBUG
 741         uint oldstate = bus->clkstate;
 742 #endif                          /* DEBUG */
 743
 744         brcmf_dbg(SDIO, "Enter\n");
 745
 746         /* Early exit if we're already there */
 747         if (bus->clkstate == target) {
 748                 if (target == CLK_AVAIL) {
 749                         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 750                         bus->activity = true;
 751                 }
 752                 return 0;
 753         }
 754
 755         switch (target) {
 756         case CLK_AVAIL:
 757                 /* Make sure SD clock is available */
 758                 if (bus->clkstate == CLK_NONE)
 759                         brcmf_sdbrcm_sdclk(bus, true);
 760                 /* Now request HT Avail on the backplane */
 761                 brcmf_sdbrcm_htclk(bus, true, pendok);
 762                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 763                 bus->activity = true;
 764                 break;
 765
 766         case CLK_SDONLY:
 767                 /* Remove HT request, or bring up SD clock */
 768                 if (bus->clkstate == CLK_NONE)
 769                         brcmf_sdbrcm_sdclk(bus, true);
 770                 else if (bus->clkstate == CLK_AVAIL)
 771                         brcmf_sdbrcm_htclk(bus, false, false);
 772                 else
 773                         brcmf_err("request for %d -> %d\n",
 774                                   bus->clkstate, target);
 775                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 776                 break;
 777
 778         case CLK_NONE:
 779                 /* Make sure to remove HT request */
 780                 if (bus->clkstate == CLK_AVAIL)
 781                         brcmf_sdbrcm_htclk(bus, false, false);
 782                 /* Now remove the SD clock */
 783                 brcmf_sdbrcm_sdclk(bus, false);
 784                 brcmf_sdbrcm_wd_timer(bus, 0);
 785                 break;
 786         }
 787 #ifdef DEBUG
 788         brcmf_dbg(SDIO, "%d -> %d\n", oldstate, bus->clkstate);
 789 #endif                          /* DEBUG */
 790
 791         return 0;
 792 }
 793
 794 static int
 795 brcmf_sdbrcm_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 796 {
 797         int err = 0;
 798         brcmf_dbg(TRACE, "Enter\n");
 799         brcmf_dbg(SDIO, "request %s currently %s\n",
 800                   (sleep ? "SLEEP" : "WAKE"),
 801                   (bus->sleeping ? "SLEEP" : "WAKE"));
 802
 803         /* If SR is enabled control bus state with KSO */
 804         if (bus->sr_enabled) {
 805                 /* Done if we're already in the requested state */
 806                 if (sleep == bus->sleeping)
 807                         goto end;
 808
 809                 /* Going to sleep */
 810                 if (sleep) {
 811                         /* Don't sleep if something is pending */
 812                         if (atomic_read(&bus->intstatus) ||
 813                             atomic_read(&bus->ipend) > 0 ||
 814                             (!atomic_read(&bus->fcstate) &&
 815                             brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
 816                             data_ok(bus)))
 817                                  return -EBUSY;
 818                         err = brcmf_sdbrcm_kso_control(bus, false);
 819                         /* disable watchdog */
 820                         if (!err)
 821                                 brcmf_sdbrcm_wd_timer(bus, 0);
 822                 } else {
 823                         bus->idlecount = 0;
 824                         err = brcmf_sdbrcm_kso_control(bus, true);
 825                 }
 826                 if (!err) {
 827                         /* Change state */
 828                         bus->sleeping = sleep;
 829                         brcmf_dbg(SDIO, "new state %s\n",
 830                                   (sleep ? "SLEEP" : "WAKE"));
 831                 } else {
 832                         brcmf_err("error while changing bus sleep state %d\n",
 833                                   err);
 834                         return err;
 835                 }
 836         }
 837
 838 end:
 839         /* control clocks */
 840         if (sleep) {
 841                 if (!bus->sr_enabled)
 842                         brcmf_sdbrcm_clkctl(bus, CLK_NONE, pendok);
 843         } else {
 844                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, pendok);
 845         }
 846
 847         return err;
 848
 849 }
 850
 851 static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
 852 {
 853         u32 intstatus = 0;
 854         u32 hmb_data;
 855         u8 fcbits;
 856         int ret;
 857
 858         brcmf_dbg(SDIO, "Enter\n");
 859
 860         /* Read mailbox data and ack that we did so */
 861         ret = r_sdreg32(bus, &hmb_data,
 862                         offsetof(struct sdpcmd_regs, tohostmailboxdata));
 863
 864         if (ret == 0)
 865                 w_sdreg32(bus, SMB_INT_ACK,
 866                           offsetof(struct sdpcmd_regs, tosbmailbox));
 867         bus->sdcnt.f1regdata += 2;
 868
 869         /* Dongle recomposed rx frames, accept them again */
 870         if (hmb_data & HMB_DATA_NAKHANDLED) {
 871                 brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
 872                           bus->rx_seq);
 873                 if (!bus->rxskip)
 874                         brcmf_err("unexpected NAKHANDLED!\n");
 875
 876                 bus->rxskip = false;
 877                 intstatus |= I_HMB_FRAME_IND;
 878         }
 879
 880         /*
 881          * DEVREADY does not occur with gSPI.
 882          */
 883         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
 884                 bus->sdpcm_ver =
 885                     (hmb_data & HMB_DATA_VERSION_MASK) >>
 886                     HMB_DATA_VERSION_SHIFT;
 887                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
 888                         brcmf_err("Version mismatch, dongle reports %d, "
 889                                   "expecting %d\n",
 890                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
 891                 else
 892                         brcmf_dbg(SDIO, "Dongle ready, protocol version %d\n",
 893                                   bus->sdpcm_ver);
 894         }
 895
 896         /*
 897          * Flow Control has been moved into the RX headers and this out of band
 898          * method isn't used any more.
 899          * remaining backward compatible with older dongles.
 900          */
 901         if (hmb_data & HMB_DATA_FC) {
 902                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
 903                                                         HMB_DATA_FCDATA_SHIFT;
 904
 905                 if (fcbits & ~bus->flowcontrol)
 906                         bus->sdcnt.fc_xoff++;
 907
 908                 if (bus->flowcontrol & ~fcbits)
 909                         bus->sdcnt.fc_xon++;
 910
 911                 bus->sdcnt.fc_rcvd++;
 912                 bus->flowcontrol = fcbits;
 913         }
 914
 915         /* Shouldn't be any others */
 916         if (hmb_data & ~(HMB_DATA_DEVREADY |
 917                          HMB_DATA_NAKHANDLED |
 918                          HMB_DATA_FC |
 919                          HMB_DATA_FWREADY |
 920                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
 921                 brcmf_err("Unknown mailbox data content: 0x%02x\n",
 922                           hmb_data);
 923
 924         return intstatus;
 925 }
 926
 927 static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 928 {
 929         uint retries = 0;
 930         u16 lastrbc;
 931         u8 hi, lo;
 932         int err;
 933
 934         brcmf_err("%sterminate frame%s\n",
 935                   abort ? "abort command, " : "",
 936                   rtx ? ", send NAK" : "");
 937
 938         if (abort)
 939                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
 940
 941         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
 942                          SFC_RF_TERM, &err);
 943         bus->sdcnt.f1regdata++;
 944
 945         /* Wait until the packet has been flushed (device/FIFO stable) */
 946         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
 947                 hi = brcmf_sdio_regrb(bus->sdiodev,
 948                                       SBSDIO_FUNC1_RFRAMEBCHI, &err);
 949                 lo = brcmf_sdio_regrb(bus->sdiodev,
 950                                       SBSDIO_FUNC1_RFRAMEBCLO, &err);
 951                 bus->sdcnt.f1regdata += 2;
 952
 953                 if ((hi == 0) && (lo == 0))
 954                         break;
 955
 956                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
 957                         brcmf_err("count growing: last 0x%04x now 0x%04x\n",
 958                                   lastrbc, (hi << 8) + lo);
 959                 }
 960                 lastrbc = (hi << 8) + lo;
 961         }
 962
 963         if (!retries)
 964                 brcmf_err("count never zeroed: last 0x%04x\n", lastrbc);
 965         else
 966                 brcmf_dbg(SDIO, "flush took %d iterations\n", 0xffff - retries);
 967
 968         if (rtx) {
 969                 bus->sdcnt.rxrtx++;
 970                 err = w_sdreg32(bus, SMB_NAK,
 971                                 offsetof(struct sdpcmd_regs, tosbmailbox));
 972
 973                 bus->sdcnt.f1regdata++;
 974                 if (err == 0)
 975                         bus->rxskip = true;
 976         }
 977
 978         /* Clear partial in any case */
 979         bus->cur_read.len = 0;
 980
 981         /* If we can't reach the device, signal failure */
 982         if (err)
 983                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
 984 }
 985
 986 /* return total length of buffer chain */
 987 static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
 988 {
 989         struct sk_buff *p;
 990         uint total;
 991
 992         total = 0;
 993         skb_queue_walk(&bus->glom, p)
 994                 total += p->len;
 995         return total;
 996 }
 997
 998 static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
 999 {
1000         struct sk_buff *cur, *next;
1001
1002         skb_queue_walk_safe(&bus->glom, cur, next) {
1003                 skb_unlink(cur, &bus->glom);
1004                 brcmu_pkt_buf_free_skb(cur);
1005         }
1006 }
1007
1008 /**
1009  * brcmfmac sdio bus specific header
1010  * This is the lowest layer header wrapped on the packets transmitted between
1011  * host and WiFi dongle which contains information needed for SDIO core and
1012  * firmware
1013  *
1014  * It consists of 2 parts: hw header and software header
1015  * hardware header (frame tag) - 4 bytes
1016  * Byte 0~1: Frame length
1017  * Byte 2~3: Checksum, bit-wise inverse of frame length
1018  * software header - 8 bytes
1019  * Byte 0: Rx/Tx sequence number
1020  * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
1021  * Byte 2: Length of next data frame, reserved for Tx
1022  * Byte 3: Data offset
1023  * Byte 4: Flow control bits, reserved for Tx
1024  * Byte 5: Maximum Sequence number allowed by firmware for Tx, N/A for Tx packet
1025  * Byte 6~7: Reserved
1026  */
1027 #define SDPCM_HWHDR_LEN                 4
1028 #define SDPCM_SWHDR_LEN                 8
1029 #define SDPCM_HDRLEN                    (SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN)
1030 /* software header */
1031 #define SDPCM_SEQ_MASK                  0x000000ff
1032 #define SDPCM_SEQ_WRAP                  256
1033 #define SDPCM_CHANNEL_MASK              0x00000f00
1034 #define SDPCM_CHANNEL_SHIFT             8
1035 #define SDPCM_CONTROL_CHANNEL           0       /* Control */
1036 #define SDPCM_EVENT_CHANNEL             1       /* Asyc Event Indication */
1037 #define SDPCM_DATA_CHANNEL              2       /* Data Xmit/Recv */
1038 #define SDPCM_GLOM_CHANNEL              3       /* Coalesced packets */
1039 #define SDPCM_TEST_CHANNEL              15      /* Test/debug packets */
1040 #define SDPCM_GLOMDESC(p)               (((u8 *)p)[1] & 0x80)
1041 #define SDPCM_NEXTLEN_MASK              0x00ff0000
1042 #define SDPCM_NEXTLEN_SHIFT             16
1043 #define SDPCM_DOFFSET_MASK              0xff000000
1044 #define SDPCM_DOFFSET_SHIFT             24
1045 #define SDPCM_FCMASK_MASK               0x000000ff
1046 #define SDPCM_WINDOW_MASK               0x0000ff00
1047 #define SDPCM_WINDOW_SHIFT              8
1048
1049 static inline u8 brcmf_sdio_getdatoffset(u8 *swheader)
1050 {
1051         u32 hdrvalue;
1052         hdrvalue = *(u32 *)swheader;
1053         return (u8)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT);
1054 }
1055
1056 static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
1057                               struct brcmf_sdio_hdrinfo *rd,
1058                               enum brcmf_sdio_frmtype type)
1059 {
1060         u16 len, checksum;
1061         u8 rx_seq, fc, tx_seq_max;
1062         u32 swheader;
1063
1064         /* hw header */
1065         len = get_unaligned_le16(header);
1066         checksum = get_unaligned_le16(header + sizeof(u16));
1067         /* All zero means no more to read */
1068         if (!(len | checksum)) {
1069                 bus->rxpending = false;
1070                 return -ENODATA;
1071         }
1072         if ((u16)(~(len ^ checksum))) {
1073                 brcmf_err("HW header checksum error\n");
1074                 bus->sdcnt.rx_badhdr++;
1075                 brcmf_sdbrcm_rxfail(bus, false, false);
1076                 return -EIO;
1077         }
1078         if (len < SDPCM_HDRLEN) {
1079                 brcmf_err("HW header length error\n");
1080                 return -EPROTO;
1081         }
1082         if (type == BRCMF_SDIO_FT_SUPER &&
1083             (roundup(len, bus->blocksize) != rd->len)) {
1084                 brcmf_err("HW superframe header length error\n");
1085                 return -EPROTO;
1086         }
1087         if (type == BRCMF_SDIO_FT_SUB && len > rd->len) {
1088                 brcmf_err("HW subframe header length error\n");
1089                 return -EPROTO;
1090         }
1091         rd->len = len;
1092
1093         /* software header */
1094         header += SDPCM_HWHDR_LEN;
1095         swheader = le32_to_cpu(*(__le32 *)header);
1096         if (type == BRCMF_SDIO_FT_SUPER && SDPCM_GLOMDESC(header)) {
1097                 brcmf_err("Glom descriptor found in superframe head\n");
1098                 rd->len = 0;
1099                 return -EINVAL;
1100         }
1101         rx_seq = (u8)(swheader & SDPCM_SEQ_MASK);
1102         rd->channel = (swheader & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT;
1103         if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
1104             type != BRCMF_SDIO_FT_SUPER) {
1105                 brcmf_err("HW header length too long\n");
1106                 bus->sdcnt.rx_toolong++;
1107                 brcmf_sdbrcm_rxfail(bus, false, false);
1108                 rd->len = 0;
1109                 return -EPROTO;
1110         }
1111         if (type == BRCMF_SDIO_FT_SUPER && rd->channel != SDPCM_GLOM_CHANNEL) {
1112                 brcmf_err("Wrong channel for superframe\n");
1113                 rd->len = 0;
1114                 return -EINVAL;
1115         }
1116         if (type == BRCMF_SDIO_FT_SUB && rd->channel != SDPCM_DATA_CHANNEL &&
1117             rd->channel != SDPCM_EVENT_CHANNEL) {
1118                 brcmf_err("Wrong channel for subframe\n");
1119                 rd->len = 0;
1120                 return -EINVAL;
1121         }
1122         rd->dat_offset = brcmf_sdio_getdatoffset(header);
1123         if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
1124                 brcmf_err("seq %d: bad data offset\n", rx_seq);
1125                 bus->sdcnt.rx_badhdr++;
1126                 brcmf_sdbrcm_rxfail(bus, false, false);
1127                 rd->len = 0;
1128                 return -ENXIO;
1129         }
1130         if (rd->seq_num != rx_seq) {
1131                 brcmf_err("seq %d: sequence number error, expect %d\n",
1132                           rx_seq, rd->seq_num);
1133                 bus->sdcnt.rx_badseq++;
1134                 rd->seq_num = rx_seq;
1135         }
1136         /* no need to check the reset for subframe */
1137         if (type == BRCMF_SDIO_FT_SUB)
1138                 return 0;
1139         rd->len_nxtfrm = (swheader & SDPCM_NEXTLEN_MASK) >> SDPCM_NEXTLEN_SHIFT;
1140         if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
1141                 /* only warm for NON glom packet */
1142                 if (rd->channel != SDPCM_GLOM_CHANNEL)
1143                         brcmf_err("seq %d: next length error\n", rx_seq);
1144                 rd->len_nxtfrm = 0;
1145         }
1146         swheader = le32_to_cpu(*(__le32 *)(header + 4));
1147         fc = swheader & SDPCM_FCMASK_MASK;
1148         if (bus->flowcontrol != fc) {
1149                 if (~bus->flowcontrol & fc)
1150                         bus->sdcnt.fc_xoff++;
1151                 if (bus->flowcontrol & ~fc)
1152                         bus->sdcnt.fc_xon++;
1153                 bus->sdcnt.fc_rcvd++;
1154                 bus->flowcontrol = fc;
1155         }
1156         tx_seq_max = (swheader & SDPCM_WINDOW_MASK) >> SDPCM_WINDOW_SHIFT;
1157         if ((u8)(tx_seq_max - bus->tx_seq) > 0x40) {
1158                 brcmf_err("seq %d: max tx seq number error\n", rx_seq);
1159                 tx_seq_max = bus->tx_seq + 2;
1160         }
1161         bus->tx_max = tx_seq_max;
1162
1163         return 0;
1164 }
1165
1166 static inline void brcmf_sdio_update_hwhdr(u8 *header, u16 frm_length)
1167 {
1168         *(__le16 *)header = cpu_to_le16(frm_length);
1169         *(((__le16 *)header) + 1) = cpu_to_le16(~frm_length);
1170 }
1171
1172 static void brcmf_sdio_hdpack(struct brcmf_sdio *bus, u8 *header,
1173                               struct brcmf_sdio_hdrinfo *hd_info)
1174 {
1175         u32 sw_header;
1176
1177         brcmf_sdio_update_hwhdr(header, hd_info->len);
1178
1179         sw_header = bus->tx_seq;
1180         sw_header |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) &
1181                      SDPCM_CHANNEL_MASK;
1182         sw_header |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) &
1183                      SDPCM_DOFFSET_MASK;
1184         *(((__le32 *)header) + 1) = cpu_to_le32(sw_header);
1185         *(((__le32 *)header) + 2) = 0;
1186 }
1187
1188 static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1189 {
1190         u16 dlen, totlen;
1191         u8 *dptr, num = 0;
1192         u32 align = 0;
1193         u16 sublen;
1194         struct sk_buff *pfirst, *pnext;
1195
1196         int errcode;
1197         u8 doff, sfdoff;
1198
1199         struct brcmf_sdio_hdrinfo rd_new;
1200
1201         /* If packets, issue read(s) and send up packet chain */
1202         /* Return sequence numbers consumed? */
1203
1204         brcmf_dbg(SDIO, "start: glomd %p glom %p\n",
1205                   bus->glomd, skb_peek(&bus->glom));
1206
1207         if (bus->sdiodev->pdata)
1208                 align = bus->sdiodev->pdata->sd_sgentry_align;
1209         if (align < 4)
1210                 align = 4;
1211
1212         /* If there's a descriptor, generate the packet chain */
1213         if (bus->glomd) {
1214                 pfirst = pnext = NULL;
1215                 dlen = (u16) (bus->glomd->len);
1216                 dptr = bus->glomd->data;
1217                 if (!dlen || (dlen & 1)) {
1218                         brcmf_err("bad glomd len(%d), ignore descriptor\n",
1219                                   dlen);
1220                         dlen = 0;
1221                 }
1222
1223                 for (totlen = num = 0; dlen; num++) {
1224                         /* Get (and move past) next length */
1225                         sublen = get_unaligned_le16(dptr);
1226                         dlen -= sizeof(u16);
1227                         dptr += sizeof(u16);
1228                         if ((sublen < SDPCM_HDRLEN) ||
1229                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1230                                 brcmf_err("descriptor len %d bad: %d\n",
1231                                           num, sublen);
1232                                 pnext = NULL;
1233                                 break;
1234                         }
1235                         if (sublen % align) {
1236                                 brcmf_err("sublen %d not multiple of %d\n",
1237                                           sublen, align);
1238                         }
1239                         totlen += sublen;
1240
1241                         /* For last frame, adjust read len so total
1242                                  is a block multiple */
1243                         if (!dlen) {
1244                                 sublen +=
1245                                     (roundup(totlen, bus->blocksize) - totlen);
1246                                 totlen = roundup(totlen, bus->blocksize);
1247                         }
1248
1249                         /* Allocate/chain packet for next subframe */
1250                         pnext = brcmu_pkt_buf_get_skb(sublen + align);
1251                         if (pnext == NULL) {
1252                                 brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
1253                                           num, sublen);
1254                                 break;
1255                         }
1256                         skb_queue_tail(&bus->glom, pnext);
1257
1258                         /* Adhere to start alignment requirements */
1259                         pkt_align(pnext, sublen, align);
1260                 }
1261
1262                 /* If all allocations succeeded, save packet chain
1263                          in bus structure */
1264                 if (pnext) {
1265                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1266                                   totlen, num);
1267                         if (BRCMF_GLOM_ON() && bus->cur_read.len &&
1268                             totlen != bus->cur_read.len) {
1269                                 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1270                                           bus->cur_read.len, totlen, rxseq);
1271                         }
1272                         pfirst = pnext = NULL;
1273                 } else {
1274                         brcmf_sdbrcm_free_glom(bus);
1275                         num = 0;
1276                 }
1277
1278                 /* Done with descriptor packet */
1279                 brcmu_pkt_buf_free_skb(bus->glomd);
1280                 bus->glomd = NULL;
1281                 bus->cur_read.len = 0;
1282         }
1283
1284         /* Ok -- either we just generated a packet chain,
1285                  or had one from before */
1286         if (!skb_queue_empty(&bus->glom)) {
1287                 if (BRCMF_GLOM_ON()) {
1288                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1289                         skb_queue_walk(&bus->glom, pnext) {
1290                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1291                                           pnext, (u8 *) (pnext->data),
1292                                           pnext->len, pnext->len);
1293                         }
1294                 }
1295
1296                 pfirst = skb_peek(&bus->glom);
1297                 dlen = (u16) brcmf_sdbrcm_glom_len(bus);
1298
1299                 /* Do an SDIO read for the superframe.  Configurable iovar to
1300                  * read directly into the chained packet, or allocate a large
1301                  * packet and and copy into the chain.
1302                  */
1303                 sdio_claim_host(bus->sdiodev->func[1]);
1304                 errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
1305                                 bus->sdiodev->sbwad,
1306                                 SDIO_FUNC_2, F2SYNC, &bus->glom);
1307                 sdio_release_host(bus->sdiodev->func[1]);
1308                 bus->sdcnt.f2rxdata++;
1309
1310                 /* On failure, kill the superframe, allow a couple retries */
1311                 if (errcode < 0) {
1312                         brcmf_err("glom read of %d bytes failed: %d\n",
1313                                   dlen, errcode);
1314
1315                         sdio_claim_host(bus->sdiodev->func[1]);
1316                         if (bus->glomerr++ < 3) {
1317                                 brcmf_sdbrcm_rxfail(bus, true, true);
1318                         } else {
1319                                 bus->glomerr = 0;
1320                                 brcmf_sdbrcm_rxfail(bus, true, false);
1321                                 bus->sdcnt.rxglomfail++;
1322                                 brcmf_sdbrcm_free_glom(bus);
1323                         }
1324                         sdio_release_host(bus->sdiodev->func[1]);
1325                         return 0;
1326                 }
1327
1328                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1329                                    pfirst->data, min_t(int, pfirst->len, 48),
1330                                    "SUPERFRAME:\n");
1331
1332                 rd_new.seq_num = rxseq;
1333                 rd_new.len = dlen;
1334                 sdio_claim_host(bus->sdiodev->func[1]);
1335                 errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
1336                                              BRCMF_SDIO_FT_SUPER);
1337                 sdio_release_host(bus->sdiodev->func[1]);
1338                 bus->cur_read.len = rd_new.len_nxtfrm << 4;
1339
1340                 /* Remove superframe header, remember offset */
1341                 skb_pull(pfirst, rd_new.dat_offset);
1342                 sfdoff = rd_new.dat_offset;
1343                 num = 0;
1344
1345                 /* Validate all the subframe headers */
1346                 skb_queue_walk(&bus->glom, pnext) {
1347                         /* leave when invalid subframe is found */
1348                         if (errcode)
1349                                 break;
1350
1351                         rd_new.len = pnext->len;
1352                         rd_new.seq_num = rxseq++;
1353                         sdio_claim_host(bus->sdiodev->func[1]);
1354                         errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
1355                                                      BRCMF_SDIO_FT_SUB);
1356                         sdio_release_host(bus->sdiodev->func[1]);
1357                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1358                                            pnext->data, 32, "subframe:\n");
1359
1360                         num++;
1361                 }
1362
1363                 if (errcode) {
1364                         /* Terminate frame on error, request
1365                                  a couple retries */
1366                         sdio_claim_host(bus->sdiodev->func[1]);
1367                         if (bus->glomerr++ < 3) {
1368                                 /* Restore superframe header space */
1369                                 skb_push(pfirst, sfdoff);
1370                                 brcmf_sdbrcm_rxfail(bus, true, true);
1371                         } else {
1372                                 bus->glomerr = 0;
1373                                 brcmf_sdbrcm_rxfail(bus, true, false);
1374                                 bus->sdcnt.rxglomfail++;
1375                                 brcmf_sdbrcm_free_glom(bus);
1376                         }
1377                         sdio_release_host(bus->sdiodev->func[1]);
1378                         bus->cur_read.len = 0;
1379                         return 0;
1380                 }
1381
1382                 /* Basic SD framing looks ok - process each packet (header) */
1383
1384                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1385                         dptr = (u8 *) (pfirst->data);
1386                         sublen = get_unaligned_le16(dptr);
1387                         doff = brcmf_sdio_getdatoffset(&dptr[SDPCM_HWHDR_LEN]);
1388
1389                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1390                                            dptr, pfirst->len,
1391                                            "Rx Subframe Data:\n");
1392
1393                         __skb_trim(pfirst, sublen);
1394                         skb_pull(pfirst, doff);
1395
1396                         if (pfirst->len == 0) {
1397                                 skb_unlink(pfirst, &bus->glom);
1398                                 brcmu_pkt_buf_free_skb(pfirst);
1399                                 continue;
1400                         }
1401
1402                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1403                                            pfirst->data,
1404                                            min_t(int, pfirst->len, 32),
1405                                            "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1406                                            bus->glom.qlen, pfirst, pfirst->data,
1407                                            pfirst->len, pfirst->next,
1408                                            pfirst->prev);
1409                 }
1410                 /* sent any remaining packets up */
1411                 if (bus->glom.qlen)
1412                         brcmf_rx_frames(bus->sdiodev->dev, &bus->glom);
1413
1414                 bus->sdcnt.rxglomframes++;
1415                 bus->sdcnt.rxglompkts += bus->glom.qlen;
1416         }
1417         return num;
1418 }
1419
1420 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1421                                         bool *pending)
1422 {
1423         DECLARE_WAITQUEUE(wait, current);
1424         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1425
1426         /* Wait until control frame is available */
1427         add_wait_queue(&bus->dcmd_resp_wait, &wait);
1428         set_current_state(TASK_INTERRUPTIBLE);
1429
1430         while (!(*condition) && (!signal_pending(current) && timeout))
1431                 timeout = schedule_timeout(timeout);
1432
1433         if (signal_pending(current))
1434                 *pending = true;
1435
1436         set_current_state(TASK_RUNNING);
1437         remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1438
1439         return timeout;
1440 }
1441
1442 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
1443 {
1444         if (waitqueue_active(&bus->dcmd_resp_wait))
1445                 wake_up_interruptible(&bus->dcmd_resp_wait);
1446
1447         return 0;
1448 }
1449 static void
1450 brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1451 {
1452         uint rdlen, pad;
1453         u8 *buf = NULL, *rbuf;
1454         int sdret;
1455
1456         brcmf_dbg(TRACE, "Enter\n");
1457
1458         if (bus->rxblen)
1459                 buf = vzalloc(bus->rxblen);
1460         if (!buf)
1461                 goto done;
1462
1463         rbuf = bus->rxbuf;
1464         pad = ((unsigned long)rbuf % BRCMF_SDALIGN);
1465         if (pad)
1466                 rbuf += (BRCMF_SDALIGN - pad);
1467
1468         /* Copy the already-read portion over */
1469         memcpy(buf, hdr, BRCMF_FIRSTREAD);
1470         if (len <= BRCMF_FIRSTREAD)
1471                 goto gotpkt;
1472
1473         /* Raise rdlen to next SDIO block to avoid tail command */
1474         rdlen = len - BRCMF_FIRSTREAD;
1475         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1476                 pad = bus->blocksize - (rdlen % bus->blocksize);
1477                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1478                     ((len + pad) < bus->sdiodev->bus_if->maxctl))
1479                         rdlen += pad;
1480         } else if (rdlen % BRCMF_SDALIGN) {
1481                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1482         }
1483
1484         /* Satisfy length-alignment requirements */
1485         if (rdlen & (ALIGNMENT - 1))
1486                 rdlen = roundup(rdlen, ALIGNMENT);
1487
1488         /* Drop if the read is too big or it exceeds our maximum */
1489         if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
1490                 brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
1491                           rdlen, bus->sdiodev->bus_if->maxctl);
1492                 brcmf_sdbrcm_rxfail(bus, false, false);
1493                 goto done;
1494         }
1495
1496         if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
1497                 brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1498                           len, len - doff, bus->sdiodev->bus_if->maxctl);
1499                 bus->sdcnt.rx_toolong++;
1500                 brcmf_sdbrcm_rxfail(bus, false, false);
1501                 goto done;
1502         }
1503
1504         /* Read remain of frame body */
1505         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1506                                 bus->sdiodev->sbwad,
1507                                 SDIO_FUNC_2,
1508                                 F2SYNC, rbuf, rdlen);
1509         bus->sdcnt.f2rxdata++;
1510
1511         /* Control frame failures need retransmission */
1512         if (sdret < 0) {
1513                 brcmf_err("read %d control bytes failed: %d\n",
1514                           rdlen, sdret);
1515                 bus->sdcnt.rxc_errors++;
1516                 brcmf_sdbrcm_rxfail(bus, true, true);
1517                 goto done;
1518         } else
1519                 memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
1520
1521 gotpkt:
1522
1523         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
1524                            buf, len, "RxCtrl:\n");
1525
1526         /* Point to valid data and indicate its length */
1527         spin_lock_bh(&bus->rxctl_lock);
1528         if (bus->rxctl) {
1529                 brcmf_err("last control frame is being processed.\n");
1530                 spin_unlock_bh(&bus->rxctl_lock);
1531                 vfree(buf);
1532                 goto done;
1533         }
1534         bus->rxctl = buf + doff;
1535         bus->rxctl_orig = buf;
1536         bus->rxlen = len - doff;
1537         spin_unlock_bh(&bus->rxctl_lock);
1538
1539 done:
1540         /* Awake any waiters */
1541         brcmf_sdbrcm_dcmd_resp_wake(bus);
1542 }
1543
1544 /* Pad read to blocksize for efficiency */
1545 static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1546 {
1547         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1548                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1549                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1550                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1551                         *rdlen += *pad;
1552         } else if (*rdlen % BRCMF_SDALIGN) {
1553                 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1554         }
1555 }
1556
1557 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
1558 {
1559         struct sk_buff *pkt;            /* Packet for event or data frames */
1560         struct sk_buff_head pktlist;    /* needed for bus interface */
1561         u16 pad;                /* Number of pad bytes to read */
1562         uint rxleft = 0;        /* Remaining number of frames allowed */
1563         int ret;                /* Return code from calls */
1564         uint rxcount = 0;       /* Total frames read */
1565         struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
1566         u8 head_read = 0;
1567
1568         brcmf_dbg(TRACE, "Enter\n");
1569
1570         /* Not finished unless we encounter no more frames indication */
1571         bus->rxpending = true;
1572
1573         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
1574              !bus->rxskip && rxleft &&
1575              bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
1576              rd->seq_num++, rxleft--) {
1577
1578                 /* Handle glomming separately */
1579                 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1580                         u8 cnt;
1581                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1582                                   bus->glomd, skb_peek(&bus->glom));
1583                         cnt = brcmf_sdbrcm_rxglom(bus, rd->seq_num);
1584                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1585                         rd->seq_num += cnt - 1;
1586                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1587                         continue;
1588                 }
1589
1590                 rd->len_left = rd->len;
1591                 /* read header first for unknow frame length */
1592                 sdio_claim_host(bus->sdiodev->func[1]);
1593                 if (!rd->len) {
1594                         ret = brcmf_sdcard_recv_buf(bus->sdiodev,
1595                                                       bus->sdiodev->sbwad,
1596                                                       SDIO_FUNC_2, F2SYNC,
1597                                                       bus->rxhdr,
1598                                                       BRCMF_FIRSTREAD);
1599                         bus->sdcnt.f2rxhdrs++;
1600                         if (ret < 0) {
1601                                 brcmf_err("RXHEADER FAILED: %d\n",
1602                                           ret);
1603                                 bus->sdcnt.rx_hdrfail++;
1604                                 brcmf_sdbrcm_rxfail(bus, true, true);
1605                                 sdio_release_host(bus->sdiodev->func[1]);
1606                                 continue;
1607                         }
1608
1609                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() || BRCMF_HDRS_ON(),
1610                                            bus->rxhdr, SDPCM_HDRLEN,
1611                                            "RxHdr:\n");
1612
1613                         if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
1614                                                BRCMF_SDIO_FT_NORMAL)) {
1615                                 sdio_release_host(bus->sdiodev->func[1]);
1616                                 if (!bus->rxpending)
1617                                         break;
1618                                 else
1619                                         continue;
1620                         }
1621
1622                         if (rd->channel == SDPCM_CONTROL_CHANNEL) {
1623                                 brcmf_sdbrcm_read_control(bus, bus->rxhdr,
1624                                                           rd->len,
1625                                                           rd->dat_offset);
1626                                 /* prepare the descriptor for the next read */
1627                                 rd->len = rd->len_nxtfrm << 4;
1628                                 rd->len_nxtfrm = 0;
1629                                 /* treat all packet as event if we don't know */
1630                                 rd->channel = SDPCM_EVENT_CHANNEL;
1631                                 sdio_release_host(bus->sdiodev->func[1]);
1632                                 continue;
1633                         }
1634                         rd->len_left = rd->len > BRCMF_FIRSTREAD ?
1635                                        rd->len - BRCMF_FIRSTREAD : 0;
1636                         head_read = BRCMF_FIRSTREAD;
1637                 }
1638
1639                 brcmf_pad(bus, &pad, &rd->len_left);
1640
1641                 pkt = brcmu_pkt_buf_get_skb(rd->len_left + head_read +
1642                                             BRCMF_SDALIGN);
1643                 if (!pkt) {
1644                         /* Give up on data, request rtx of events */
1645                         brcmf_err("brcmu_pkt_buf_get_skb failed\n");
1646                         brcmf_sdbrcm_rxfail(bus, false,
1647                                             RETRYCHAN(rd->channel));
1648                         sdio_release_host(bus->sdiodev->func[1]);
1649                         continue;
1650                 }
1651                 skb_pull(pkt, head_read);
1652                 pkt_align(pkt, rd->len_left, BRCMF_SDALIGN);
1653
1654                 ret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1655                                               SDIO_FUNC_2, F2SYNC, pkt);
1656                 bus->sdcnt.f2rxdata++;
1657                 sdio_release_host(bus->sdiodev->func[1]);
1658
1659                 if (ret < 0) {
1660                         brcmf_err("read %d bytes from channel %d failed: %d\n",
1661                                   rd->len, rd->channel, ret);
1662                         brcmu_pkt_buf_free_skb(pkt);
1663                         sdio_claim_host(bus->sdiodev->func[1]);
1664                         brcmf_sdbrcm_rxfail(bus, true,
1665                                             RETRYCHAN(rd->channel));
1666                         sdio_release_host(bus->sdiodev->func[1]);
1667                         continue;
1668                 }
1669
1670                 if (head_read) {
1671                         skb_push(pkt, head_read);
1672                         memcpy(pkt->data, bus->rxhdr, head_read);
1673                         head_read = 0;
1674                 } else {
1675                         memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
1676                         rd_new.seq_num = rd->seq_num;
1677                         sdio_claim_host(bus->sdiodev->func[1]);
1678                         if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
1679                                                BRCMF_SDIO_FT_NORMAL)) {
1680                                 rd->len = 0;
1681                                 brcmu_pkt_buf_free_skb(pkt);
1682                         }
1683                         bus->sdcnt.rx_readahead_cnt++;
1684                         if (rd->len != roundup(rd_new.len, 16)) {
1685                                 brcmf_err("frame length mismatch:read %d, should be %d\n",
1686                                           rd->len,
1687                                           roundup(rd_new.len, 16) >> 4);
1688                                 rd->len = 0;
1689                                 brcmf_sdbrcm_rxfail(bus, true, true);
1690                                 sdio_release_host(bus->sdiodev->func[1]);
1691                                 brcmu_pkt_buf_free_skb(pkt);
1692                                 continue;
1693                         }
1694                         sdio_release_host(bus->sdiodev->func[1]);
1695                         rd->len_nxtfrm = rd_new.len_nxtfrm;
1696                         rd->channel = rd_new.channel;
1697                         rd->dat_offset = rd_new.dat_offset;
1698
1699                         brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1700                                              BRCMF_DATA_ON()) &&
1701                                            BRCMF_HDRS_ON(),
1702                                            bus->rxhdr, SDPCM_HDRLEN,
1703                                            "RxHdr:\n");
1704
1705                         if (rd_new.channel == SDPCM_CONTROL_CHANNEL) {
1706                                 brcmf_err("readahead on control packet %d?\n",
1707                                           rd_new.seq_num);
1708                                 /* Force retry w/normal header read */
1709                                 rd->len = 0;
1710                                 sdio_claim_host(bus->sdiodev->func[1]);
1711                                 brcmf_sdbrcm_rxfail(bus, false, true);
1712                                 sdio_release_host(bus->sdiodev->func[1]);
1713                                 brcmu_pkt_buf_free_skb(pkt);
1714                                 continue;
1715                         }
1716                 }
1717
1718                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1719                                    pkt->data, rd->len, "Rx Data:\n");
1720
1721                 /* Save superframe descriptor and allocate packet frame */
1722                 if (rd->channel == SDPCM_GLOM_CHANNEL) {
1723                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_HWHDR_LEN])) {
1724                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
1725                                           rd->len);
1726                                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1727                                                    pkt->data, rd->len,
1728                                                    "Glom Data:\n");
1729                                 __skb_trim(pkt, rd->len);
1730                                 skb_pull(pkt, SDPCM_HDRLEN);
1731                                 bus->glomd = pkt;
1732                         } else {
1733                                 brcmf_err("%s: glom superframe w/o "
1734                                           "descriptor!\n", __func__);
1735                                 sdio_claim_host(bus->sdiodev->func[1]);
1736                                 brcmf_sdbrcm_rxfail(bus, false, false);
1737                                 sdio_release_host(bus->sdiodev->func[1]);
1738                         }
1739                         /* prepare the descriptor for the next read */
1740                         rd->len = rd->len_nxtfrm << 4;
1741                         rd->len_nxtfrm = 0;
1742                         /* treat all packet as event if we don't know */
1743                         rd->channel = SDPCM_EVENT_CHANNEL;
1744                         continue;
1745                 }
1746
1747                 /* Fill in packet len and prio, deliver upward */
1748                 __skb_trim(pkt, rd->len);
1749                 skb_pull(pkt, rd->dat_offset);
1750
1751                 /* prepare the descriptor for the next read */
1752                 rd->len = rd->len_nxtfrm << 4;
1753                 rd->len_nxtfrm = 0;
1754                 /* treat all packet as event if we don't know */
1755                 rd->channel = SDPCM_EVENT_CHANNEL;
1756
1757                 if (pkt->len == 0) {
1758                         brcmu_pkt_buf_free_skb(pkt);
1759                         continue;
1760                 }
1761
1762                 skb_queue_head_init(&pktlist);
1763                 skb_queue_tail(&pktlist, pkt);
1764                 brcmf_rx_frames(bus->sdiodev->dev, &pktlist);
1765         }
1766
1767         rxcount = maxframes - rxleft;
1768         /* Message if we hit the limit */
1769         if (!rxleft)
1770                 brcmf_dbg(DATA, "hit rx limit of %d frames\n", maxframes);
1771         else
1772                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
1773         /* Back off rxseq if awaiting rtx, update rx_seq */
1774         if (bus->rxskip)
1775                 rd->seq_num--;
1776         bus->rx_seq = rd->seq_num;
1777
1778         return rxcount;
1779 }
1780
1781 static void
1782 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
1783 {
1784         if (waitqueue_active(&bus->ctrl_wait))
1785                 wake_up_interruptible(&bus->ctrl_wait);
1786         return;
1787 }
1788
1789 /* flag marking a dummy skb added for DMA alignment requirement */
1790 #define DUMMY_SKB_FLAG          0x10000
1791 /* bit mask of data length chopped from the previous packet */
1792 #define DUMMY_SKB_CHOP_LEN_MASK 0xffff
1793 /**
1794  * brcmf_sdio_txpkt_prep - packet preparation for transmit
1795  * @bus: brcmf_sdio structure pointer
1796  * @pktq: packet list pointer
1797  * @chan: virtual channel to transmit the packet
1798  *
1799  * Processes to be applied to the packet
1800  *      - Align data buffer pointer
1801  *      - Align data buffer length
1802  *      - Prepare header
1803  * Return: negative value if there is error
1804  */
1805 static int
1806 brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
1807                       uint chan)
1808 {
1809         u16 head_pad, tail_pad, tail_chop, head_align, sg_align;
1810         int ntail;
1811         struct sk_buff *pkt_next, *pkt_new;
1812         u8 *dat_buf;
1813         unsigned blksize = bus->sdiodev->func[SDIO_FUNC_2]->cur_blksize;
1814         struct brcmf_sdio_hdrinfo hd_info = {0};
1815
1816         /* SDIO ADMA requires at least 32 bit alignment */
1817         head_align = 4;
1818         sg_align = 4;
1819         if (bus->sdiodev->pdata) {
1820                 head_align = bus->sdiodev->pdata->sd_head_align > 4 ?
1821                              bus->sdiodev->pdata->sd_head_align : 4;
1822                 sg_align = bus->sdiodev->pdata->sd_sgentry_align > 4 ?
1823                            bus->sdiodev->pdata->sd_sgentry_align : 4;
1824         }
1825         /* sg entry alignment should be a divisor of block size */
1826         WARN_ON(blksize % sg_align);
1827
1828         pkt_next = pktq->next;
1829         dat_buf = (u8 *)(pkt_next->data);
1830
1831         /* Check head padding */
1832         head_pad = ((unsigned long)dat_buf % head_align);
1833         if (head_pad) {
1834                 if (skb_headroom(pkt_next) < head_pad) {
1835                         bus->sdiodev->bus_if->tx_realloc++;
1836                         head_pad = 0;
1837                         if (skb_cow(pkt_next, head_pad))
1838                                 return -ENOMEM;
1839                 }
1840                 skb_push(pkt_next, head_pad);
1841                 dat_buf = (u8 *)(pkt_next->data);
1842                 memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
1843         }
1844
1845         /* Check tail padding */
1846         pkt_new = NULL;
1847         tail_chop = pkt_next->len % sg_align;
1848         tail_pad = sg_align - tail_chop;
1849         tail_pad += blksize - (pkt_next->len + tail_pad) % blksize;
1850         if (skb_tailroom(pkt_next) < tail_pad && pkt_next->len > blksize) {
1851                 pkt_new = brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
1852                 if (pkt_new == NULL)
1853                         return -ENOMEM;
1854                 memcpy(pkt_new->data,
1855                        pkt_next->data + pkt_next->len - tail_chop,
1856                        tail_chop);
1857                 *(u32 *)(pkt_new->cb) = DUMMY_SKB_FLAG + tail_chop;
1858                 skb_trim(pkt_next, pkt_next->len - tail_chop);
1859                 __skb_queue_after(pktq, pkt_next, pkt_new);
1860         } else {
1861                 ntail = pkt_next->data_len + tail_pad -
1862                         (pkt_next->end - pkt_next->tail);
1863                 if (skb_cloned(pkt_next) || ntail > 0)
1864                         if (pskb_expand_head(pkt_next, 0, ntail, GFP_ATOMIC))
1865                                 return -ENOMEM;
1866                 if (skb_linearize(pkt_next))
1867                         return -ENOMEM;
1868                 dat_buf = (u8 *)(pkt_next->data);
1869                 __skb_put(pkt_next, tail_pad);
1870         }
1871
1872         /* Now prep the header */
1873         if (pkt_new)
1874                 hd_info.len = pkt_next->len + tail_chop;
1875         else
1876                 hd_info.len = pkt_next->len - tail_pad;
1877         hd_info.channel = chan;
1878         hd_info.dat_offset = head_pad + bus->tx_hdrlen;
1879         brcmf_sdio_hdpack(bus, dat_buf, &hd_info);
1880
1881         if (BRCMF_BYTES_ON() &&
1882             ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
1883              (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)))
1884                 brcmf_dbg_hex_dump(true, pkt_next, hd_info.len, "Tx Frame:\n");
1885         else if (BRCMF_HDRS_ON())
1886                 brcmf_dbg_hex_dump(true, pkt_next, head_pad + bus->tx_hdrlen,
1887                                    "Tx Header:\n");
1888
1889         return 0;
1890 }
1891
1892 /**
1893  * brcmf_sdio_txpkt_postp - packet post processing for transmit
1894  * @bus: brcmf_sdio structure pointer
1895  * @pktq: packet list pointer
1896  *
1897  * Processes to be applied to the packet
1898  *      - Remove head padding
1899  *      - Remove tail padding
1900  */
1901 static void
1902 brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
1903 {
1904         u8 *hdr;
1905         u32 dat_offset;
1906         u32 dummy_flags, chop_len;
1907         struct sk_buff *pkt_next, *tmp, *pkt_prev;
1908
1909         skb_queue_walk_safe(pktq, pkt_next, tmp) {
1910                 dummy_flags = *(u32 *)(pkt_next->cb);
1911                 if (dummy_flags & DUMMY_SKB_FLAG) {
1912                         chop_len = dummy_flags & DUMMY_SKB_CHOP_LEN_MASK;
1913                         if (chop_len) {
1914                                 pkt_prev = pkt_next->prev;
1915                                 memcpy(pkt_prev->data + pkt_prev->len,
1916                                        pkt_next->data, chop_len);
1917                                 skb_put(pkt_prev, chop_len);
1918                         }
1919                         __skb_unlink(pkt_next, pktq);
1920                         brcmu_pkt_buf_free_skb(pkt_next);
1921                 } else {
1922                         hdr = pkt_next->data + SDPCM_HWHDR_LEN;
1923                         dat_offset = le32_to_cpu(*(__le32 *)hdr);
1924                         dat_offset = (dat_offset & SDPCM_DOFFSET_MASK) >>
1925                                      SDPCM_DOFFSET_SHIFT;
1926                         skb_pull(pkt_next, dat_offset);
1927                 }
1928         }
1929 }
1930
1931 /* Writes a HW/SW header into the packet and sends it. */
1932 /* Assumes: (a) header space already there, (b) caller holds lock */
1933 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
1934                               uint chan)
1935 {
1936         int ret;
1937         int i;
1938         struct sk_buff_head localq;
1939
1940         brcmf_dbg(TRACE, "Enter\n");
1941
1942         __skb_queue_head_init(&localq);
1943         __skb_queue_tail(&localq, pkt);
1944         ret = brcmf_sdio_txpkt_prep(bus, &localq, chan);
1945         if (ret)
1946                 goto done;
1947
1948         sdio_claim_host(bus->sdiodev->func[1]);
1949         ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1950                                     SDIO_FUNC_2, F2SYNC, &localq);
1951         bus->sdcnt.f2txdata++;
1952
1953         if (ret < 0) {
1954                 /* On failure, abort the command and terminate the frame */
1955                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
1956                           ret);
1957                 bus->sdcnt.tx_sderrs++;
1958
1959                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1960                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
1961                                  SFC_WF_TERM, NULL);
1962                 bus->sdcnt.f1regdata++;
1963
1964                 for (i = 0; i < 3; i++) {
1965                         u8 hi, lo;
1966                         hi = brcmf_sdio_regrb(bus->sdiodev,
1967                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1968                         lo = brcmf_sdio_regrb(bus->sdiodev,
1969                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1970                         bus->sdcnt.f1regdata += 2;
1971                         if ((hi == 0) && (lo == 0))
1972                                 break;
1973                 }
1974
1975         }
1976         sdio_release_host(bus->sdiodev->func[1]);
1977         if (ret == 0)
1978                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
1979
1980 done:
1981         brcmf_sdio_txpkt_postp(bus, &localq);
1982         __skb_dequeue_tail(&localq);
1983         brcmf_txcomplete(bus->sdiodev->dev, pkt, ret == 0);
1984         return ret;
1985 }
1986
1987 static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
1988 {
1989         struct sk_buff *pkt;
1990         u32 intstatus = 0;
1991         int ret = 0, prec_out;
1992         uint cnt = 0;
1993         u8 tx_prec_map;
1994
1995         brcmf_dbg(TRACE, "Enter\n");
1996
1997         tx_prec_map = ~bus->flowcontrol;
1998
1999         /* Send frames until the limit or some other event */
2000         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
2001                 spin_lock_bh(&bus->txqlock);
2002                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
2003                 if (pkt == NULL) {
2004                         spin_unlock_bh(&bus->txqlock);
2005                         break;
2006                 }
2007                 spin_unlock_bh(&bus->txqlock);
2008
2009                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL);
2010
2011                 /* In poll mode, need to check for other events */
2012                 if (!bus->intr && cnt) {
2013                         /* Check device status, signal pending interrupt */
2014                         sdio_claim_host(bus->sdiodev->func[1]);
2015                         ret = r_sdreg32(bus, &intstatus,
2016                                         offsetof(struct sdpcmd_regs,
2017                                                  intstatus));
2018                         sdio_release_host(bus->sdiodev->func[1]);
2019                         bus->sdcnt.f2txdata++;
2020                         if (ret != 0)
2021                                 break;
2022                         if (intstatus & bus->hostintmask)
2023                                 atomic_set(&bus->ipend, 1);
2024                 }
2025         }
2026
2027         /* Deflow-control stack if needed */
2028         if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
2029             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
2030                 bus->txoff = false;
2031                 brcmf_txflowblock(bus->sdiodev->dev, false);
2032         }
2033
2034         return cnt;
2035 }
2036
2037 static void brcmf_sdbrcm_bus_stop(struct device *dev)
2038 {
2039         u32 local_hostintmask;
2040         u8 saveclk;
2041         int err;
2042         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2043         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2044         struct brcmf_sdio *bus = sdiodev->bus;
2045
2046         brcmf_dbg(TRACE, "Enter\n");
2047
2048         if (bus->watchdog_tsk) {
2049                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
2050                 kthread_stop(bus->watchdog_tsk);
2051                 bus->watchdog_tsk = NULL;
2052         }
2053
2054         sdio_claim_host(bus->sdiodev->func[1]);
2055
2056         /* Enable clock for device interrupts */
2057         brcmf_sdbrcm_bus_sleep(bus, false, false);
2058
2059         /* Disable and clear interrupts at the chip level also */
2060         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
2061         local_hostintmask = bus->hostintmask;
2062         bus->hostintmask = 0;
2063
2064         /* Change our idea of bus state */
2065         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2066
2067         /* Force clocks on backplane to be sure F2 interrupt propagates */
2068         saveclk = brcmf_sdio_regrb(bus->sdiodev,
2069                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
2070         if (!err) {
2071                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
2072                                  (saveclk | SBSDIO_FORCE_HT), &err);
2073         }
2074         if (err)
2075                 brcmf_err("Failed to force clock for F2: err %d\n", err);
2076
2077         /* Turn off the bus (F2), free any pending packets */
2078         brcmf_dbg(INTR, "disable SDIO interrupts\n");
2079         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, SDIO_FUNC_ENABLE_1,
2080                          NULL);
2081
2082         /* Clear any pending interrupts now that F2 is disabled */
2083         w_sdreg32(bus, local_hostintmask,
2084                   offsetof(struct sdpcmd_regs, intstatus));
2085
2086         /* Turn off the backplane clock (only) */
2087         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
2088         sdio_release_host(bus->sdiodev->func[1]);
2089
2090         /* Clear the data packet queues */
2091         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2092
2093         /* Clear any held glomming stuff */
2094         if (bus->glomd)
2095                 brcmu_pkt_buf_free_skb(bus->glomd);
2096         brcmf_sdbrcm_free_glom(bus);
2097
2098         /* Clear rx control and wake any waiters */
2099         spin_lock_bh(&bus->rxctl_lock);
2100         bus->rxlen = 0;
2101         spin_unlock_bh(&bus->rxctl_lock);
2102         brcmf_sdbrcm_dcmd_resp_wake(bus);
2103
2104         /* Reset some F2 state stuff */
2105         bus->rxskip = false;
2106         bus->tx_seq = bus->rx_seq = 0;
2107 }
2108
2109 static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
2110 {
2111         unsigned long flags;
2112
2113         if (bus->sdiodev->oob_irq_requested) {
2114                 spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
2115                 if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
2116                         enable_irq(bus->sdiodev->pdata->oob_irq_nr);
2117                         bus->sdiodev->irq_en = true;
2118                 }
2119                 spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
2120         }
2121 }
2122
2123 static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
2124 {
2125         u8 idx;
2126         u32 addr;
2127         unsigned long val;
2128         int n, ret;
2129
2130         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
2131         addr = bus->ci->c_inf[idx].base +
2132                offsetof(struct sdpcmd_regs, intstatus);
2133
2134         ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, false);
2135         bus->sdcnt.f1regdata++;
2136         if (ret != 0)
2137                 val = 0;
2138
2139         val &= bus->hostintmask;
2140         atomic_set(&bus->fcstate, !!(val & I_HMB_FC_STATE));
2141
2142         /* Clear interrupts */
2143         if (val) {
2144                 ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, true);
2145                 bus->sdcnt.f1regdata++;
2146         }
2147
2148         if (ret) {
2149                 atomic_set(&bus->intstatus, 0);
2150         } else if (val) {
2151                 for_each_set_bit(n, &val, 32)
2152                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2153         }
2154
2155         return ret;
2156 }
2157
2158 static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
2159 {
2160         u32 newstatus = 0;
2161         unsigned long intstatus;
2162         uint rxlimit = bus->rxbound;    /* Rx frames to read before resched */
2163         uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2164         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2165         int err = 0, n;
2166
2167         brcmf_dbg(TRACE, "Enter\n");
2168
2169         sdio_claim_host(bus->sdiodev->func[1]);
2170
2171         /* If waiting for HTAVAIL, check status */
2172         if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
2173                 u8 clkctl, devctl = 0;
2174
2175 #ifdef DEBUG
2176                 /* Check for inconsistent device control */
2177                 devctl = brcmf_sdio_regrb(bus->sdiodev,
2178                                           SBSDIO_DEVICE_CTL, &err);
2179                 if (err) {
2180                         brcmf_err("error reading DEVCTL: %d\n", err);
2181                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2182                 }
2183 #endif                          /* DEBUG */
2184
2185                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2186                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
2187                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
2188                 if (err) {
2189                         brcmf_err("error reading CSR: %d\n",
2190                                   err);
2191                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2192                 }
2193
2194                 brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2195                           devctl, clkctl);
2196
2197                 if (SBSDIO_HTAV(clkctl)) {
2198                         devctl = brcmf_sdio_regrb(bus->sdiodev,
2199                                                   SBSDIO_DEVICE_CTL, &err);
2200                         if (err) {
2201                                 brcmf_err("error reading DEVCTL: %d\n",
2202                                           err);
2203                                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2204                         }
2205                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2206                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
2207                                          devctl, &err);
2208                         if (err) {
2209                                 brcmf_err("error writing DEVCTL: %d\n",
2210                                           err);
2211                                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2212                         }
2213                         bus->clkstate = CLK_AVAIL;
2214                 }
2215         }
2216
2217         /* Make sure backplane clock is on */
2218         brcmf_sdbrcm_bus_sleep(bus, false, true);
2219
2220         /* Pending interrupt indicates new device status */
2221         if (atomic_read(&bus->ipend) > 0) {
2222                 atomic_set(&bus->ipend, 0);
2223                 err = brcmf_sdio_intr_rstatus(bus);
2224         }
2225
2226         /* Start with leftover status bits */
2227         intstatus = atomic_xchg(&bus->intstatus, 0);
2228
2229         /* Handle flow-control change: read new state in case our ack
2230          * crossed another change interrupt.  If change still set, assume
2231          * FC ON for safety, let next loop through do the debounce.
2232          */
2233         if (intstatus & I_HMB_FC_CHANGE) {
2234                 intstatus &= ~I_HMB_FC_CHANGE;
2235                 err = w_sdreg32(bus, I_HMB_FC_CHANGE,
2236                                 offsetof(struct sdpcmd_regs, intstatus));
2237
2238                 err = r_sdreg32(bus, &newstatus,
2239                                 offsetof(struct sdpcmd_regs, intstatus));
2240                 bus->sdcnt.f1regdata += 2;
2241                 atomic_set(&bus->fcstate,
2242                            !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
2243                 intstatus |= (newstatus & bus->hostintmask);
2244         }
2245
2246         /* Handle host mailbox indication */
2247         if (intstatus & I_HMB_HOST_INT) {
2248                 intstatus &= ~I_HMB_HOST_INT;
2249                 intstatus |= brcmf_sdbrcm_hostmail(bus);
2250         }
2251
2252         sdio_release_host(bus->sdiodev->func[1]);
2253
2254         /* Generally don't ask for these, can get CRC errors... */
2255         if (intstatus & I_WR_OOSYNC) {
2256                 brcmf_err("Dongle reports WR_OOSYNC\n");
2257                 intstatus &= ~I_WR_OOSYNC;
2258         }
2259
2260         if (intstatus & I_RD_OOSYNC) {
2261                 brcmf_err("Dongle reports RD_OOSYNC\n");
2262                 intstatus &= ~I_RD_OOSYNC;
2263         }
2264
2265         if (intstatus & I_SBINT) {
2266                 brcmf_err("Dongle reports SBINT\n");
2267                 intstatus &= ~I_SBINT;
2268         }
2269
2270         /* Would be active due to wake-wlan in gSPI */
2271         if (intstatus & I_CHIPACTIVE) {
2272                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2273                 intstatus &= ~I_CHIPACTIVE;
2274         }
2275
2276         /* Ignore frame indications if rxskip is set */
2277         if (bus->rxskip)
2278                 intstatus &= ~I_HMB_FRAME_IND;
2279
2280         /* On frame indication, read available frames */
2281         if (PKT_AVAILABLE() && bus->clkstate == CLK_AVAIL) {
2282                 framecnt = brcmf_sdio_readframes(bus, rxlimit);
2283                 if (!bus->rxpending)
2284                         intstatus &= ~I_HMB_FRAME_IND;
2285                 rxlimit -= min(framecnt, rxlimit);
2286         }
2287
2288         /* Keep still-pending events for next scheduling */
2289         if (intstatus) {
2290                 for_each_set_bit(n, &intstatus, 32)
2291                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2292         }
2293
2294         brcmf_sdbrcm_clrintr(bus);
2295
2296         if (data_ok(bus) && bus->ctrl_frame_stat &&
2297                 (bus->clkstate == CLK_AVAIL)) {
2298                 int i;
2299
2300                 sdio_claim_host(bus->sdiodev->func[1]);
2301                 err = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2302                         SDIO_FUNC_2, F2SYNC, bus->ctrl_frame_buf,
2303                         (u32) bus->ctrl_frame_len);
2304
2305                 if (err < 0) {
2306                         /* On failure, abort the command and
2307                                 terminate the frame */
2308                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2309                                   err);
2310                         bus->sdcnt.tx_sderrs++;
2311
2312                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2313
2314                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2315                                          SFC_WF_TERM, &err);
2316                         bus->sdcnt.f1regdata++;
2317
2318                         for (i = 0; i < 3; i++) {
2319                                 u8 hi, lo;
2320                                 hi = brcmf_sdio_regrb(bus->sdiodev,
2321                                                       SBSDIO_FUNC1_WFRAMEBCHI,
2322                                                       &err);
2323                                 lo = brcmf_sdio_regrb(bus->sdiodev,
2324                                                       SBSDIO_FUNC1_WFRAMEBCLO,
2325                                                       &err);
2326                                 bus->sdcnt.f1regdata += 2;
2327                                 if ((hi == 0) && (lo == 0))
2328                                         break;
2329                         }
2330
2331                 } else {
2332                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
2333                 }
2334                 sdio_release_host(bus->sdiodev->func[1]);
2335                 bus->ctrl_frame_stat = false;
2336                 brcmf_sdbrcm_wait_event_wakeup(bus);
2337         }
2338         /* Send queued frames (limit 1 if rx may still be pending) */
2339         else if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
2340                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2341                  && data_ok(bus)) {
2342                 framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
2343                                             txlimit;
2344                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2345                 txlimit -= framecnt;
2346         }
2347
2348         if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) || (err != 0)) {
2349                 brcmf_err("failed backplane access over SDIO, halting operation\n");
2350                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2351                 atomic_set(&bus->intstatus, 0);
2352         } else if (atomic_read(&bus->intstatus) ||
2353                    atomic_read(&bus->ipend) > 0 ||
2354                    (!atomic_read(&bus->fcstate) &&
2355                     brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
2356                     data_ok(bus)) || PKT_AVAILABLE()) {
2357                 atomic_inc(&bus->dpc_tskcnt);
2358         }
2359
2360         /* If we're done for now, turn off clock request. */
2361         if ((bus->clkstate != CLK_PENDING)
2362             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2363                 bus->activity = false;
2364                 brcmf_dbg(SDIO, "idle state\n");
2365                 sdio_claim_host(bus->sdiodev->func[1]);
2366                 brcmf_sdbrcm_bus_sleep(bus, true, false);
2367                 sdio_release_host(bus->sdiodev->func[1]);
2368         }
2369 }
2370
2371 static struct pktq *brcmf_sdbrcm_bus_gettxq(struct device *dev)
2372 {
2373         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2374         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2375         struct brcmf_sdio *bus = sdiodev->bus;
2376
2377         return &bus->txq;
2378 }
2379
2380 static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
2381 {
2382         int ret = -EBADE;
2383         uint datalen, prec;
2384         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2385         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2386         struct brcmf_sdio *bus = sdiodev->bus;
2387         ulong flags;
2388
2389         brcmf_dbg(TRACE, "Enter\n");
2390
2391         datalen = pkt->len;
2392
2393         /* Add space for the header */
2394         skb_push(pkt, bus->tx_hdrlen);
2395         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2396
2397         prec = prio2prec((pkt->priority & PRIOMASK));
2398
2399         /* Check for existing queue, current flow-control,
2400                          pending event, or pending clock */
2401         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2402         bus->sdcnt.fcqueued++;
2403
2404         /* Priority based enq */
2405         spin_lock_irqsave(&bus->txqlock, flags);
2406         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
2407                 skb_pull(pkt, bus->tx_hdrlen);
2408                 brcmf_err("out of bus->txq !!!\n");
2409                 ret = -ENOSR;
2410         } else {
2411                 ret = 0;
2412         }
2413
2414         if (pktq_len(&bus->txq) >= TXHI) {
2415                 bus->txoff = true;
2416                 brcmf_txflowblock(bus->sdiodev->dev, true);
2417         }
2418         spin_unlock_irqrestore(&bus->txqlock, flags);
2419
2420 #ifdef DEBUG
2421         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2422                 qcount[prec] = pktq_plen(&bus->txq, prec);
2423 #endif
2424
2425         if (atomic_read(&bus->dpc_tskcnt) == 0) {
2426                 atomic_inc(&bus->dpc_tskcnt);
2427                 queue_work(bus->brcmf_wq, &bus->datawork);
2428         }
2429
2430         return ret;
2431 }
2432
2433 #ifdef DEBUG
2434 #define CONSOLE_LINE_MAX        192
2435
2436 static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
2437 {
2438         struct brcmf_console *c = &bus->console;
2439         u8 line[CONSOLE_LINE_MAX], ch;
2440         u32 n, idx, addr;
2441         int rv;
2442
2443         /* Don't do anything until FWREADY updates console address */
2444         if (bus->console_addr == 0)
2445                 return 0;
2446
2447         /* Read console log struct */
2448         addr = bus->console_addr + offsetof(struct rte_console, log_le);
2449         rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, (u8 *)&c->log_le,
2450                               sizeof(c->log_le));
2451         if (rv < 0)
2452                 return rv;
2453
2454         /* Allocate console buffer (one time only) */
2455         if (c->buf == NULL) {
2456                 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2457                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2458                 if (c->buf == NULL)
2459                         return -ENOMEM;
2460         }
2461
2462         idx = le32_to_cpu(c->log_le.idx);
2463
2464         /* Protect against corrupt value */
2465         if (idx > c->bufsize)
2466                 return -EBADE;
2467
2468         /* Skip reading the console buffer if the index pointer
2469          has not moved */
2470         if (idx == c->last)
2471                 return 0;
2472
2473         /* Read the console buffer */
2474         addr = le32_to_cpu(c->log_le.buf);
2475         rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
2476         if (rv < 0)
2477                 return rv;
2478
2479         while (c->last != idx) {
2480                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2481                         if (c->last == idx) {
2482                                 /* This would output a partial line.
2483                                  * Instead, back up
2484                                  * the buffer pointer and output this
2485                                  * line next time around.
2486                                  */
2487                                 if (c->last >= n)
2488                                         c->last -= n;
2489                                 else
2490                                         c->last = c->bufsize - n;
2491                                 goto break2;
2492                         }
2493                         ch = c->buf[c->last];
2494                         c->last = (c->last + 1) % c->bufsize;
2495                         if (ch == '\n')
2496                                 break;
2497                         line[n] = ch;
2498                 }
2499
2500                 if (n > 0) {
2501                         if (line[n - 1] == '\r')
2502                                 n--;
2503                         line[n] = 0;
2504                         pr_debug("CONSOLE: %s\n", line);
2505                 }
2506         }
2507 break2:
2508
2509         return 0;
2510 }
2511 #endif                          /* DEBUG */
2512
2513 static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
2514 {
2515         int i;
2516         int ret;
2517
2518         bus->ctrl_frame_stat = false;
2519         ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2520                                     SDIO_FUNC_2, F2SYNC, frame, len);
2521
2522         if (ret < 0) {
2523                 /* On failure, abort the command and terminate the frame */
2524                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2525                           ret);
2526                 bus->sdcnt.tx_sderrs++;
2527
2528                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2529
2530                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2531                                  SFC_WF_TERM, NULL);
2532                 bus->sdcnt.f1regdata++;
2533
2534                 for (i = 0; i < 3; i++) {
2535                         u8 hi, lo;
2536                         hi = brcmf_sdio_regrb(bus->sdiodev,
2537                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
2538                         lo = brcmf_sdio_regrb(bus->sdiodev,
2539                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
2540                         bus->sdcnt.f1regdata += 2;
2541                         if (hi == 0 && lo == 0)
2542                                 break;
2543                 }
2544                 return ret;
2545         }
2546
2547         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
2548
2549         return ret;
2550 }
2551
2552 static int
2553 brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2554 {
2555         u8 *frame;
2556         u16 len;
2557         uint retries = 0;
2558         u8 doff = 0;
2559         int ret = -1;
2560         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2561         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2562         struct brcmf_sdio *bus = sdiodev->bus;
2563         struct brcmf_sdio_hdrinfo hd_info = {0};
2564
2565         brcmf_dbg(TRACE, "Enter\n");
2566
2567         /* Back the pointer to make a room for bus header */
2568         frame = msg - bus->tx_hdrlen;
2569         len = (msglen += bus->tx_hdrlen);
2570
2571         /* Add alignment padding (optional for ctl frames) */
2572         doff = ((unsigned long)frame % BRCMF_SDALIGN);
2573         if (doff) {
2574                 frame -= doff;
2575                 len += doff;
2576                 msglen += doff;
2577                 memset(frame, 0, doff + bus->tx_hdrlen);
2578         }
2579         /* precondition: doff < BRCMF_SDALIGN */
2580         doff += bus->tx_hdrlen;
2581
2582         /* Round send length to next SDIO block */
2583         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2584                 u16 pad = bus->blocksize - (len % bus->blocksize);
2585                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2586                         len += pad;
2587         } else if (len % BRCMF_SDALIGN) {
2588                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2589         }
2590
2591         /* Satisfy length-alignment requirements */
2592         if (len & (ALIGNMENT - 1))
2593                 len = roundup(len, ALIGNMENT);
2594
2595         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2596
2597         /* Make sure backplane clock is on */
2598         sdio_claim_host(bus->sdiodev->func[1]);
2599         brcmf_sdbrcm_bus_sleep(bus, false, false);
2600         sdio_release_host(bus->sdiodev->func[1]);
2601
2602         hd_info.len = (u16)msglen;
2603         hd_info.channel = SDPCM_CONTROL_CHANNEL;
2604         hd_info.dat_offset = doff;
2605         brcmf_sdio_hdpack(bus, frame, &hd_info);
2606
2607         if (!data_ok(bus)) {
2608                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2609                           bus->tx_max, bus->tx_seq);
2610                 bus->ctrl_frame_stat = true;
2611                 /* Send from dpc */
2612                 bus->ctrl_frame_buf = frame;
2613                 bus->ctrl_frame_len = len;
2614
2615                 wait_event_interruptible_timeout(bus->ctrl_wait,
2616                                                  !bus->ctrl_frame_stat,
2617                                                  msecs_to_jiffies(2000));
2618
2619                 if (!bus->ctrl_frame_stat) {
2620                         brcmf_dbg(SDIO, "ctrl_frame_stat == false\n");
2621                         ret = 0;
2622                 } else {
2623                         brcmf_dbg(SDIO, "ctrl_frame_stat == true\n");
2624                         ret = -1;
2625                 }
2626         }
2627
2628         if (ret == -1) {
2629                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
2630                                    frame, len, "Tx Frame:\n");
2631                 brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
2632                                    BRCMF_HDRS_ON(),
2633                                    frame, min_t(u16, len, 16), "TxHdr:\n");
2634
2635                 do {
2636                         sdio_claim_host(bus->sdiodev->func[1]);
2637                         ret = brcmf_tx_frame(bus, frame, len);
2638                         sdio_release_host(bus->sdiodev->func[1]);
2639                 } while (ret < 0 && retries++ < TXRETRIES);
2640         }
2641
2642         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) &&
2643             atomic_read(&bus->dpc_tskcnt) == 0) {
2644                 bus->activity = false;
2645                 sdio_claim_host(bus->sdiodev->func[1]);
2646                 brcmf_dbg(INFO, "idle\n");
2647                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2648                 sdio_release_host(bus->sdiodev->func[1]);
2649         }
2650
2651         if (ret)
2652                 bus->sdcnt.tx_ctlerrs++;
2653         else
2654                 bus->sdcnt.tx_ctlpkts++;
2655
2656         return ret ? -EIO : 0;
2657 }
2658
2659 #ifdef DEBUG
2660 static inline bool brcmf_sdio_valid_shared_address(u32 addr)
2661 {
2662         return !(addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff));
2663 }
2664
2665 static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
2666                                  struct sdpcm_shared *sh)
2667 {
2668         u32 addr;
2669         int rv;
2670         u32 shaddr = 0;
2671         struct sdpcm_shared_le sh_le;
2672         __le32 addr_le;
2673
2674         shaddr = bus->ci->rambase + bus->ramsize - 4;
2675
2676         /*
2677          * Read last word in socram to determine
2678          * address of sdpcm_shared structure
2679          */
2680         sdio_claim_host(bus->sdiodev->func[1]);
2681         brcmf_sdbrcm_bus_sleep(bus, false, false);
2682         rv = brcmf_sdio_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
2683         sdio_release_host(bus->sdiodev->func[1]);
2684         if (rv < 0)
2685                 return rv;
2686
2687         addr = le32_to_cpu(addr_le);
2688
2689         brcmf_dbg(SDIO, "sdpcm_shared address 0x%08X\n", addr);
2690
2691         /*
2692          * Check if addr is valid.
2693          * NVRAM length at the end of memory should have been overwritten.
2694          */
2695         if (!brcmf_sdio_valid_shared_address(addr)) {
2696                         brcmf_err("invalid sdpcm_shared address 0x%08X\n",
2697                                   addr);
2698                         return -EINVAL;
2699         }
2700
2701         /* Read hndrte_shared structure */
2702         rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
2703                               sizeof(struct sdpcm_shared_le));
2704         if (rv < 0)
2705                 return rv;
2706
2707         /* Endianness */
2708         sh->flags = le32_to_cpu(sh_le.flags);
2709         sh->trap_addr = le32_to_cpu(sh_le.trap_addr);
2710         sh->assert_exp_addr = le32_to_cpu(sh_le.assert_exp_addr);
2711         sh->assert_file_addr = le32_to_cpu(sh_le.assert_file_addr);
2712         sh->assert_line = le32_to_cpu(sh_le.assert_line);
2713         sh->console_addr = le32_to_cpu(sh_le.console_addr);
2714         sh->msgtrace_addr = le32_to_cpu(sh_le.msgtrace_addr);
2715
2716         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) > SDPCM_SHARED_VERSION) {
2717                 brcmf_err("sdpcm shared version unsupported: dhd %d dongle %d\n",
2718                           SDPCM_SHARED_VERSION,
2719                           sh->flags & SDPCM_SHARED_VERSION_MASK);
2720                 return -EPROTO;
2721         }
2722
2723         return 0;
2724 }
2725
2726 static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
2727                                    struct sdpcm_shared *sh, char __user *data,
2728                                    size_t count)
2729 {
2730         u32 addr, console_ptr, console_size, console_index;
2731         char *conbuf = NULL;
2732         __le32 sh_val;
2733         int rv;
2734         loff_t pos = 0;
2735         int nbytes = 0;
2736
2737         /* obtain console information from device memory */
2738         addr = sh->console_addr + offsetof(struct rte_console, log_le);
2739         rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
2740                               (u8 *)&sh_val, sizeof(u32));
2741         if (rv < 0)
2742                 return rv;
2743         console_ptr = le32_to_cpu(sh_val);
2744
2745         addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
2746         rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
2747                               (u8 *)&sh_val, sizeof(u32));
2748         if (rv < 0)
2749                 return rv;
2750         console_size = le32_to_cpu(sh_val);
2751
2752         addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
2753         rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
2754                               (u8 *)&sh_val, sizeof(u32));
2755         if (rv < 0)
2756                 return rv;
2757         console_index = le32_to_cpu(sh_val);
2758
2759         /* allocate buffer for console data */
2760         if (console_size <= CONSOLE_BUFFER_MAX)
2761                 conbuf = vzalloc(console_size+1);
2762
2763         if (!conbuf)
2764                 return -ENOMEM;
2765
2766         /* obtain the console data from device */
2767         conbuf[console_size] = '\0';
2768         rv = brcmf_sdio_ramrw(bus->sdiodev, false, console_ptr, (u8 *)conbuf,
2769                               console_size);
2770         if (rv < 0)
2771                 goto done;
2772
2773         rv = simple_read_from_buffer(data, count, &pos,
2774                                      conbuf + console_index,
2775                                      console_size - console_index);
2776         if (rv < 0)
2777                 goto done;
2778
2779         nbytes = rv;
2780         if (console_index > 0) {
2781                 pos = 0;
2782                 rv = simple_read_from_buffer(data+nbytes, count, &pos,
2783                                              conbuf, console_index - 1);
2784                 if (rv < 0)
2785                         goto done;
2786                 rv += nbytes;
2787         }
2788 done:
2789         vfree(conbuf);
2790         return rv;
2791 }
2792
2793 static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
2794                                 char __user *data, size_t count)
2795 {
2796         int error, res;
2797         char buf[350];
2798         struct brcmf_trap_info tr;
2799         loff_t pos = 0;
2800
2801         if ((sh->flags & SDPCM_SHARED_TRAP) == 0) {
2802                 brcmf_dbg(INFO, "no trap in firmware\n");
2803                 return 0;
2804         }
2805
2806         error = brcmf_sdio_ramrw(bus->sdiodev, false, sh->trap_addr, (u8 *)&tr,
2807                                  sizeof(struct brcmf_trap_info));
2808         if (error < 0)
2809                 return error;
2810
2811         res = scnprintf(buf, sizeof(buf),
2812                         "dongle trap info: type 0x%x @ epc 0x%08x\n"
2813                         "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
2814                         "  lr   0x%08x pc   0x%08x offset 0x%x\n"
2815                         "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
2816                         "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
2817                         le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
2818                         le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
2819                         le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
2820                         le32_to_cpu(tr.pc), sh->trap_addr,
2821                         le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
2822                         le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
2823                         le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
2824                         le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
2825
2826         return simple_read_from_buffer(data, count, &pos, buf, res);
2827 }
2828
2829 static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
2830                                   struct sdpcm_shared *sh, char __user *data,
2831                                   size_t count)
2832 {
2833         int error = 0;
2834         char buf[200];
2835         char file[80] = "?";
2836         char expr[80] = "<???>";
2837         int res;
2838         loff_t pos = 0;
2839
2840         if ((sh->flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
2841                 brcmf_dbg(INFO, "firmware not built with -assert\n");
2842                 return 0;
2843         } else if ((sh->flags & SDPCM_SHARED_ASSERT) == 0) {
2844                 brcmf_dbg(INFO, "no assert in dongle\n");
2845                 return 0;
2846         }
2847
2848         sdio_claim_host(bus->sdiodev->func[1]);
2849         if (sh->assert_file_addr != 0) {
2850                 error = brcmf_sdio_ramrw(bus->sdiodev, false,
2851                                          sh->assert_file_addr, (u8 *)file, 80);
2852                 if (error < 0)
2853                         return error;
2854         }
2855         if (sh->assert_exp_addr != 0) {
2856                 error = brcmf_sdio_ramrw(bus->sdiodev, false,
2857                                          sh->assert_exp_addr, (u8 *)expr, 80);
2858                 if (error < 0)
2859                         return error;
2860         }
2861         sdio_release_host(bus->sdiodev->func[1]);
2862
2863         res = scnprintf(buf, sizeof(buf),
2864                         "dongle assert: %s:%d: assert(%s)\n",
2865                         file, sh->assert_line, expr);
2866         return simple_read_from_buffer(data, count, &pos, buf, res);
2867 }
2868
2869 static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
2870 {
2871         int error;
2872         struct sdpcm_shared sh;
2873
2874         error = brcmf_sdio_readshared(bus, &sh);
2875
2876         if (error < 0)
2877                 return error;
2878
2879         if ((sh.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
2880                 brcmf_dbg(INFO, "firmware not built with -assert\n");
2881         else if (sh.flags & SDPCM_SHARED_ASSERT)
2882                 brcmf_err("assertion in dongle\n");
2883
2884         if (sh.flags & SDPCM_SHARED_TRAP)
2885                 brcmf_err("firmware trap in dongle\n");
2886
2887         return 0;
2888 }
2889
2890 static int brcmf_sdbrcm_died_dump(struct brcmf_sdio *bus, char __user *data,
2891                                   size_t count, loff_t *ppos)
2892 {
2893         int error = 0;
2894         struct sdpcm_shared sh;
2895         int nbytes = 0;
2896         loff_t pos = *ppos;
2897
2898         if (pos != 0)
2899                 return 0;
2900
2901         error = brcmf_sdio_readshared(bus, &sh);
2902         if (error < 0)
2903                 goto done;
2904
2905         error = brcmf_sdio_assert_info(bus, &sh, data, count);
2906         if (error < 0)
2907                 goto done;
2908         nbytes = error;
2909
2910         error = brcmf_sdio_trap_info(bus, &sh, data+nbytes, count);
2911         if (error < 0)
2912                 goto done;
2913         nbytes += error;
2914
2915         error = brcmf_sdio_dump_console(bus, &sh, data+nbytes, count);
2916         if (error < 0)
2917                 goto done;
2918         nbytes += error;
2919
2920         error = nbytes;
2921         *ppos += nbytes;
2922 done:
2923         return error;
2924 }
2925
2926 static ssize_t brcmf_sdio_forensic_read(struct file *f, char __user *data,
2927                                         size_t count, loff_t *ppos)
2928 {
2929         struct brcmf_sdio *bus = f->private_data;
2930         int res;
2931
2932         res = brcmf_sdbrcm_died_dump(bus, data, count, ppos);
2933         if (res > 0)
2934                 *ppos += res;
2935         return (ssize_t)res;
2936 }
2937
2938 static const struct file_operations brcmf_sdio_forensic_ops = {
2939         .owner = THIS_MODULE,
2940         .open = simple_open,
2941         .read = brcmf_sdio_forensic_read
2942 };
2943
2944 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
2945 {
2946         struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
2947         struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
2948
2949         if (IS_ERR_OR_NULL(dentry))
2950                 return;
2951
2952         debugfs_create_file("forensics", S_IRUGO, dentry, bus,
2953                             &brcmf_sdio_forensic_ops);
2954         brcmf_debugfs_create_sdio_count(drvr, &bus->sdcnt);
2955 }
2956 #else
2957 static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
2958 {
2959         return 0;
2960 }
2961
2962 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
2963 {
2964 }
2965 #endif /* DEBUG */
2966
2967 static int
2968 brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
2969 {
2970         int timeleft;
2971         uint rxlen = 0;
2972         bool pending;
2973         u8 *buf;
2974         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2975         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2976         struct brcmf_sdio *bus = sdiodev->bus;
2977
2978         brcmf_dbg(TRACE, "Enter\n");
2979
2980         /* Wait until control frame is available */
2981         timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
2982
2983         spin_lock_bh(&bus->rxctl_lock);
2984         rxlen = bus->rxlen;
2985         memcpy(msg, bus->rxctl, min(msglen, rxlen));
2986         bus->rxctl = NULL;
2987         buf = bus->rxctl_orig;
2988         bus->rxctl_orig = NULL;
2989         bus->rxlen = 0;
2990         spin_unlock_bh(&bus->rxctl_lock);
2991         vfree(buf);
2992
2993         if (rxlen) {
2994                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
2995                           rxlen, msglen);
2996         } else if (timeleft == 0) {
2997                 brcmf_err("resumed on timeout\n");
2998                 brcmf_sdbrcm_checkdied(bus);
2999         } else if (pending) {
3000                 brcmf_dbg(CTL, "cancelled\n");
3001                 return -ERESTARTSYS;
3002         } else {
3003                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
3004                 brcmf_sdbrcm_checkdied(bus);
3005         }
3006
3007         if (rxlen)
3008                 bus->sdcnt.rx_ctlpkts++;
3009         else
3010                 bus->sdcnt.rx_ctlerrs++;
3011
3012         return rxlen ? (int)rxlen : -ETIMEDOUT;
3013 }
3014
3015 static bool brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
3016 {
3017         struct chip_info *ci = bus->ci;
3018
3019         /* To enter download state, disable ARM and reset SOCRAM.
3020          * To exit download state, simply reset ARM (default is RAM boot).
3021          */
3022         if (enter) {
3023                 bus->alp_only = true;
3024
3025                 brcmf_sdio_chip_enter_download(bus->sdiodev, ci);
3026         } else {
3027                 if (!brcmf_sdio_chip_exit_download(bus->sdiodev, ci, bus->vars,
3028                                                    bus->varsz))
3029                         return false;
3030
3031                 /* Allow HT Clock now that the ARM is running. */
3032                 bus->alp_only = false;
3033
3034                 bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
3035         }
3036
3037         return true;
3038 }
3039
3040 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
3041 {
3042         if (bus->firmware->size < bus->fw_ptr + len)
3043                 len = bus->firmware->size - bus->fw_ptr;
3044
3045         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3046         bus->fw_ptr += len;
3047         return len;
3048 }
3049
3050 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
3051 {
3052         int offset;
3053         uint len;
3054         u8 *memblock = NULL, *memptr;
3055         int ret;
3056         u8 idx;
3057
3058         brcmf_dbg(INFO, "Enter\n");
3059
3060         ret = request_firmware(&bus->firmware, BRCMF_SDIO_FW_NAME,
3061                                &bus->sdiodev->func[2]->dev);
3062         if (ret) {
3063                 brcmf_err("Fail to request firmware %d\n", ret);
3064                 return ret;
3065         }
3066         bus->fw_ptr = 0;
3067
3068         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3069         if (memblock == NULL) {
3070                 ret = -ENOMEM;
3071                 goto err;
3072         }
3073         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3074                 memptr += (BRCMF_SDALIGN -
3075                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3076
3077         offset = bus->ci->rambase;
3078
3079         /* Download image */
3080         len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
3081         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4);
3082         if (BRCMF_MAX_CORENUM != idx)
3083                 memcpy(&bus->ci->rst_vec, memptr, sizeof(bus->ci->rst_vec));
3084         while (len) {
3085                 ret = brcmf_sdio_ramrw(bus->sdiodev, true, offset, memptr, len);
3086                 if (ret) {
3087                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
3088                                   ret, MEMBLOCK, offset);
3089                         goto err;
3090                 }
3091
3092                 offset += MEMBLOCK;
3093                 len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
3094         }
3095
3096 err:
3097         kfree(memblock);
3098
3099         release_firmware(bus->firmware);
3100         bus->fw_ptr = 0;
3101
3102         return ret;
3103 }
3104
3105 /*
3106  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3107  * and ending in a NUL.
3108  * Removes carriage returns, empty lines, comment lines, and converts
3109  * newlines to NULs.
3110  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
3111  * by two NULs.
3112 */
3113
3114 static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
3115 {
3116         char *varbuf;
3117         char *dp;
3118         bool findNewline;
3119         int column;
3120         int ret = 0;
3121         uint buf_len, n, len;
3122
3123         len = bus->firmware->size;
3124         varbuf = vmalloc(len);
3125         if (!varbuf)
3126                 return -ENOMEM;
3127
3128         memcpy(varbuf, bus->firmware->data, len);
3129         dp = varbuf;
3130
3131         findNewline = false;
3132         column = 0;
3133
3134         for (n = 0; n < len; n++) {
3135                 if (varbuf[n] == 0)
3136                         break;
3137                 if (varbuf[n] == '\r')
3138                         continue;
3139                 if (findNewline && varbuf[n] != '\n')
3140                         continue;
3141                 findNewline = false;
3142                 if (varbuf[n] == '#') {
3143                         findNewline = true;
3144                         continue;
3145                 }
3146                 if (varbuf[n] == '\n') {
3147                         if (column == 0)
3148                                 continue;
3149                         *dp++ = 0;
3150                         column = 0;
3151                         continue;
3152                 }
3153                 *dp++ = varbuf[n];
3154                 column++;
3155         }
3156         buf_len = dp - varbuf;
3157         while (dp < varbuf + n)
3158                 *dp++ = 0;
3159
3160         kfree(bus->vars);
3161         /* roundup needed for download to device */
3162         bus->varsz = roundup(buf_len + 1, 4);
3163         bus->vars = kmalloc(bus->varsz, GFP_KERNEL);
3164         if (bus->vars == NULL) {
3165                 bus->varsz = 0;
3166                 ret = -ENOMEM;
3167                 goto err;
3168         }
3169
3170         /* copy the processed variables and add null termination */
3171         memcpy(bus->vars, varbuf, buf_len);
3172         bus->vars[buf_len] = 0;
3173 err:
3174         vfree(varbuf);
3175         return ret;
3176 }
3177
3178 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
3179 {
3180         int ret;
3181
3182         ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
3183                                &bus->sdiodev->func[2]->dev);
3184         if (ret) {
3185                 brcmf_err("Fail to request nvram %d\n", ret);
3186                 return ret;
3187         }
3188
3189         ret = brcmf_process_nvram_vars(bus);
3190
3191         release_firmware(bus->firmware);
3192
3193         return ret;
3194 }
3195
3196 static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3197 {
3198         int bcmerror = -1;
3199
3200         /* Keep arm in reset */
3201         if (!brcmf_sdbrcm_download_state(bus, true)) {
3202                 brcmf_err("error placing ARM core in reset\n");
3203                 goto err;
3204         }
3205
3206         if (brcmf_sdbrcm_download_code_file(bus)) {
3207                 brcmf_err("dongle image file download failed\n");
3208                 goto err;
3209         }
3210
3211         if (brcmf_sdbrcm_download_nvram(bus)) {
3212                 brcmf_err("dongle nvram file download failed\n");
3213                 goto err;
3214         }
3215
3216         /* Take arm out of reset */
3217         if (!brcmf_sdbrcm_download_state(bus, false)) {
3218                 brcmf_err("error getting out of ARM core reset\n");
3219                 goto err;
3220         }
3221
3222         bcmerror = 0;
3223
3224 err:
3225         return bcmerror;
3226 }
3227
3228 static bool brcmf_sdbrcm_sr_capable(struct brcmf_sdio *bus)
3229 {
3230         u32 addr, reg;
3231
3232         brcmf_dbg(TRACE, "Enter\n");
3233
3234         /* old chips with PMU version less than 17 don't support save restore */
3235         if (bus->ci->pmurev < 17)
3236                 return false;
3237
3238         /* read PMU chipcontrol register 3*/
3239         addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
3240         brcmf_sdio_regwl(bus->sdiodev, addr, 3, NULL);
3241         addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
3242         reg = brcmf_sdio_regrl(bus->sdiodev, addr, NULL);
3243
3244         return (bool)reg;
3245 }
3246
3247 static void brcmf_sdbrcm_sr_init(struct brcmf_sdio *bus)
3248 {
3249         int err = 0;
3250         u8 val;
3251
3252         brcmf_dbg(TRACE, "Enter\n");
3253
3254         val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL,
3255                                &err);
3256         if (err) {
3257                 brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
3258                 return;
3259         }
3260
3261         val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
3262         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL,
3263                          val, &err);
3264         if (err) {
3265                 brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
3266                 return;
3267         }
3268
3269         /* Add CMD14 Support */
3270         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
3271                          (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
3272                           SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
3273                          &err);
3274         if (err) {
3275                 brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
3276                 return;
3277         }
3278
3279         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3280                          SBSDIO_FORCE_HT, &err);
3281         if (err) {
3282                 brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
3283                 return;
3284         }
3285
3286         /* set flag */
3287         bus->sr_enabled = true;
3288         brcmf_dbg(INFO, "SR enabled\n");
3289 }
3290
3291 /* enable KSO bit */
3292 static int brcmf_sdbrcm_kso_init(struct brcmf_sdio *bus)
3293 {
3294         u8 val;
3295         int err = 0;
3296
3297         brcmf_dbg(TRACE, "Enter\n");
3298
3299         /* KSO bit added in SDIO core rev 12 */
3300         if (bus->ci->c_inf[1].rev < 12)
3301                 return 0;
3302
3303         val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
3304                                &err);
3305         if (err) {
3306                 brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
3307                 return err;
3308         }
3309
3310         if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
3311                 val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
3312                         SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
3313                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
3314                                  val, &err);
3315                 if (err) {
3316                         brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
3317                         return err;
3318                 }
3319         }
3320
3321         return 0;
3322 }
3323
3324
3325 static bool
3326 brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3327 {
3328         bool ret;
3329
3330         sdio_claim_host(bus->sdiodev->func[1]);
3331
3332         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3333
3334         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3335
3336         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3337
3338         sdio_release_host(bus->sdiodev->func[1]);
3339
3340         return ret;
3341 }
3342
3343 static int brcmf_sdbrcm_bus_init(struct device *dev)
3344 {
3345         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3346         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3347         struct brcmf_sdio *bus = sdiodev->bus;
3348         unsigned long timeout;
3349         u8 ready, enable;
3350         int err, ret = 0;
3351         u8 saveclk;
3352
3353         brcmf_dbg(TRACE, "Enter\n");
3354
3355         /* try to download image and nvram to the dongle */
3356         if (bus_if->state == BRCMF_BUS_DOWN) {
3357                 if (!(brcmf_sdbrcm_download_firmware(bus)))
3358                         return -1;
3359         }
3360
3361         if (!bus->sdiodev->bus_if->drvr)
3362                 return 0;
3363
3364         /* Start the watchdog timer */
3365         bus->sdcnt.tickcnt = 0;
3366         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3367
3368         sdio_claim_host(bus->sdiodev->func[1]);
3369
3370         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3371         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3372         if (bus->clkstate != CLK_AVAIL)
3373                 goto exit;
3374
3375         /* Force clocks on backplane to be sure F2 interrupt propagates */
3376         saveclk = brcmf_sdio_regrb(bus->sdiodev,
3377                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
3378         if (!err) {
3379                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3380                                  (saveclk | SBSDIO_FORCE_HT), &err);
3381         }
3382         if (err) {
3383                 brcmf_err("Failed to force clock for F2: err %d\n", err);
3384                 goto exit;
3385         }
3386
3387         /* Enable function 2 (frame transfers) */
3388         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3389                   offsetof(struct sdpcmd_regs, tosbmailboxdata));
3390         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3391
3392         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
3393
3394         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3395         ready = 0;
3396         while (enable != ready) {
3397                 ready = brcmf_sdio_regrb(bus->sdiodev,
3398                                          SDIO_CCCR_IORx, NULL);
3399                 if (time_after(jiffies, timeout))
3400                         break;
3401                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3402                         /* prevent busy waiting if it takes too long */
3403                         msleep_interruptible(20);
3404         }
3405
3406         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3407
3408         /* If F2 successfully enabled, set core and enable interrupts */
3409         if (ready == enable) {
3410                 /* Set up the interrupt mask and enable interrupts */
3411                 bus->hostintmask = HOSTINTMASK;
3412                 w_sdreg32(bus, bus->hostintmask,
3413                           offsetof(struct sdpcmd_regs, hostintmask));
3414
3415                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
3416         } else {
3417                 /* Disable F2 again */
3418                 enable = SDIO_FUNC_ENABLE_1;
3419                 brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
3420                 ret = -ENODEV;
3421         }
3422
3423         if (brcmf_sdbrcm_sr_capable(bus)) {
3424                 brcmf_sdbrcm_sr_init(bus);
3425         } else {
3426                 /* Restore previous clock setting */
3427                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3428                                  saveclk, &err);
3429         }
3430
3431         if (ret == 0) {
3432                 ret = brcmf_sdio_intr_register(bus->sdiodev);
3433                 if (ret != 0)
3434                         brcmf_err("intr register failed:%d\n", ret);
3435         }
3436
3437         /* If we didn't come up, turn off backplane clock */
3438         if (bus_if->state != BRCMF_BUS_DATA)
3439                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3440
3441 exit:
3442         sdio_release_host(bus->sdiodev->func[1]);
3443
3444         return ret;
3445 }
3446
3447 void brcmf_sdbrcm_isr(void *arg)
3448 {
3449         struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
3450
3451         brcmf_dbg(TRACE, "Enter\n");
3452
3453         if (!bus) {
3454                 brcmf_err("bus is null pointer, exiting\n");
3455                 return;
3456         }
3457
3458         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
3459                 brcmf_err("bus is down. we have nothing to do\n");
3460                 return;
3461         }
3462         /* Count the interrupt call */
3463         bus->sdcnt.intrcount++;
3464         if (in_interrupt())
3465                 atomic_set(&bus->ipend, 1);
3466         else
3467                 if (brcmf_sdio_intr_rstatus(bus)) {
3468                         brcmf_err("failed backplane access\n");
3469                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3470                 }
3471
3472         /* Disable additional interrupts (is this needed now)? */
3473         if (!bus->intr)
3474                 brcmf_err("isr w/o interrupt configured!\n");
3475
3476         atomic_inc(&bus->dpc_tskcnt);
3477         queue_work(bus->brcmf_wq, &bus->datawork);
3478 }
3479
3480 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
3481 {
3482 #ifdef DEBUG
3483         struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
3484 #endif  /* DEBUG */
3485
3486         brcmf_dbg(TIMER, "Enter\n");
3487
3488         /* Poll period: check device if appropriate. */
3489         if (!bus->sr_enabled &&
3490             bus->poll && (++bus->polltick >= bus->pollrate)) {
3491                 u32 intstatus = 0;
3492
3493                 /* Reset poll tick */
3494                 bus->polltick = 0;
3495
3496                 /* Check device if no interrupts */
3497                 if (!bus->intr ||
3498                     (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
3499
3500                         if (atomic_read(&bus->dpc_tskcnt) == 0) {
3501                                 u8 devpend;
3502
3503                                 sdio_claim_host(bus->sdiodev->func[1]);
3504                                 devpend = brcmf_sdio_regrb(bus->sdiodev,
3505                                                            SDIO_CCCR_INTx,
3506                                                            NULL);
3507                                 sdio_release_host(bus->sdiodev->func[1]);
3508                                 intstatus =
3509                                     devpend & (INTR_STATUS_FUNC1 |
3510                                                INTR_STATUS_FUNC2);
3511                         }
3512
3513                         /* If there is something, make like the ISR and
3514                                  schedule the DPC */
3515                         if (intstatus) {
3516                                 bus->sdcnt.pollcnt++;
3517                                 atomic_set(&bus->ipend, 1);
3518
3519                                 atomic_inc(&bus->dpc_tskcnt);
3520                                 queue_work(bus->brcmf_wq, &bus->datawork);
3521                         }
3522                 }
3523
3524                 /* Update interrupt tracking */
3525                 bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
3526         }
3527 #ifdef DEBUG
3528         /* Poll for console output periodically */
3529         if (bus_if && bus_if->state == BRCMF_BUS_DATA &&
3530             bus->console_interval != 0) {
3531                 bus->console.count += BRCMF_WD_POLL_MS;
3532                 if (bus->console.count >= bus->console_interval) {
3533                         bus->console.count -= bus->console_interval;
3534                         sdio_claim_host(bus->sdiodev->func[1]);
3535                         /* Make sure backplane clock is on */
3536                         brcmf_sdbrcm_bus_sleep(bus, false, false);
3537                         if (brcmf_sdbrcm_readconsole(bus) < 0)
3538                                 /* stop on error */
3539                                 bus->console_interval = 0;
3540                         sdio_release_host(bus->sdiodev->func[1]);
3541                 }
3542         }
3543 #endif                          /* DEBUG */
3544
3545         /* On idle timeout clear activity flag and/or turn off clock */
3546         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3547                 if (++bus->idlecount >= bus->idletime) {
3548                         bus->idlecount = 0;
3549                         if (bus->activity) {
3550                                 bus->activity = false;
3551                                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3552                         } else {
3553                                 brcmf_dbg(SDIO, "idle\n");
3554                                 sdio_claim_host(bus->sdiodev->func[1]);
3555                                 brcmf_sdbrcm_bus_sleep(bus, true, false);
3556                                 sdio_release_host(bus->sdiodev->func[1]);
3557                         }
3558                 }
3559         }
3560
3561         return (atomic_read(&bus->ipend) > 0);
3562 }
3563
3564 static void brcmf_sdio_dataworker(struct work_struct *work)
3565 {
3566         struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
3567                                               datawork);
3568
3569         while (atomic_read(&bus->dpc_tskcnt)) {
3570                 brcmf_sdbrcm_dpc(bus);
3571                 atomic_dec(&bus->dpc_tskcnt);
3572         }
3573 }
3574
3575 static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
3576 {
3577         brcmf_dbg(TRACE, "Enter\n");
3578
3579         kfree(bus->rxbuf);
3580         bus->rxctl = bus->rxbuf = NULL;
3581         bus->rxlen = 0;
3582 }
3583
3584 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
3585 {
3586         brcmf_dbg(TRACE, "Enter\n");
3587
3588         if (bus->sdiodev->bus_if->maxctl) {
3589                 bus->rxblen =
3590                     roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
3591                             ALIGNMENT) + BRCMF_SDALIGN;
3592                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3593                 if (!(bus->rxbuf))
3594                         return false;
3595         }
3596
3597         return true;
3598 }
3599
3600 static bool
3601 brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
3602 {
3603         u8 clkctl = 0;
3604         int err = 0;
3605         int reg_addr;
3606         u32 reg_val;
3607         u32 drivestrength;
3608
3609         bus->alp_only = true;
3610
3611         sdio_claim_host(bus->sdiodev->func[1]);
3612
3613         pr_debug("F1 signature read @0x18000000=0x%4x\n",
3614                  brcmf_sdio_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
3615
3616         /*
3617          * Force PLL off until brcmf_sdio_chip_attach()
3618          * programs PLL control regs
3619          */
3620
3621         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3622                          BRCMF_INIT_CLKCTL1, &err);
3623         if (!err)
3624                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
3625                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
3626
3627         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3628                 brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3629                           err, BRCMF_INIT_CLKCTL1, clkctl);
3630                 goto fail;
3631         }
3632
3633         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3634                 brcmf_err("brcmf_sdio_chip_attach failed!\n");
3635                 goto fail;
3636         }
3637
3638         if (brcmf_sdbrcm_kso_init(bus)) {
3639                 brcmf_err("error enabling KSO\n");
3640                 goto fail;
3641         }
3642
3643         if ((bus->sdiodev->pdata) && (bus->sdiodev->pdata->drive_strength))
3644                 drivestrength = bus->sdiodev->pdata->drive_strength;
3645         else
3646                 drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
3647         brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
3648
3649         /* Get info on the SOCRAM cores... */
3650         bus->ramsize = bus->ci->ramsize;
3651         if (!(bus->ramsize)) {
3652                 brcmf_err("failed to find SOCRAM memory!\n");
3653                 goto fail;
3654         }
3655
3656         /* Set card control so an SDIO card reset does a WLAN backplane reset */
3657         reg_val = brcmf_sdio_regrb(bus->sdiodev,
3658                                    SDIO_CCCR_BRCM_CARDCTRL, &err);
3659         if (err)
3660                 goto fail;
3661
3662         reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
3663
3664         brcmf_sdio_regwb(bus->sdiodev,
3665                          SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
3666         if (err)
3667                 goto fail;
3668
3669         /* set PMUControl so a backplane reset does PMU state reload */
3670         reg_addr = CORE_CC_REG(bus->ci->c_inf[0].base,
3671                                pmucontrol);
3672         reg_val = brcmf_sdio_regrl(bus->sdiodev,
3673                                    reg_addr,
3674                                    &err);
3675         if (err)
3676                 goto fail;
3677
3678         reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
3679
3680         brcmf_sdio_regwl(bus->sdiodev,
3681                          reg_addr,
3682                          reg_val,
3683                          &err);
3684         if (err)
3685                 goto fail;
3686
3687
3688         sdio_release_host(bus->sdiodev->func[1]);
3689
3690         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3691
3692         /* Locate an appropriately-aligned portion of hdrbuf */
3693         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3694                                     BRCMF_SDALIGN);
3695
3696         /* Set the poll and/or interrupt flags */
3697         bus->intr = true;
3698         bus->poll = false;
3699         if (bus->poll)
3700                 bus->pollrate = 1;
3701
3702         return true;
3703
3704 fail:
3705         sdio_release_host(bus->sdiodev->func[1]);
3706         return false;
3707 }
3708
3709 static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
3710 {
3711         brcmf_dbg(TRACE, "Enter\n");
3712
3713         sdio_claim_host(bus->sdiodev->func[1]);
3714
3715         /* Disable F2 to clear any intermediate frame state on the dongle */
3716         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx,
3717                          SDIO_FUNC_ENABLE_1, NULL);
3718
3719         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3720         bus->rxflow = false;
3721
3722         /* Done with backplane-dependent accesses, can drop clock... */
3723         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3724
3725         sdio_release_host(bus->sdiodev->func[1]);
3726
3727         /* ...and initialize clock/power states */
3728         bus->clkstate = CLK_SDONLY;
3729         bus->idletime = BRCMF_IDLE_INTERVAL;
3730         bus->idleclock = BRCMF_IDLE_ACTIVE;
3731
3732         /* Query the F2 block size, set roundup accordingly */
3733         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3734         bus->roundup = min(max_roundup, bus->blocksize);
3735
3736         /* SR state */
3737         bus->sleeping = false;
3738         bus->sr_enabled = false;
3739
3740         return true;
3741 }
3742
3743 static int
3744 brcmf_sdbrcm_watchdog_thread(void *data)
3745 {
3746         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3747
3748         allow_signal(SIGTERM);
3749         /* Run until signal received */
3750         while (1) {
3751                 if (kthread_should_stop())
3752                         break;
3753                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3754                         brcmf_sdbrcm_bus_watchdog(bus);
3755                         /* Count the tick for reference */
3756                         bus->sdcnt.tickcnt++;
3757                 } else
3758                         break;
3759         }
3760         return 0;
3761 }
3762
3763 static void
3764 brcmf_sdbrcm_watchdog(unsigned long data)
3765 {
3766         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3767
3768         if (bus->watchdog_tsk) {
3769                 complete(&bus->watchdog_wait);
3770                 /* Reschedule the watchdog */
3771                 if (bus->wd_timer_valid)
3772                         mod_timer(&bus->timer,
3773                                   jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3774         }
3775 }
3776
3777 static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
3778 {
3779         brcmf_dbg(TRACE, "Enter\n");
3780
3781         if (bus->ci) {
3782                 sdio_claim_host(bus->sdiodev->func[1]);
3783                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3784                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3785                 sdio_release_host(bus->sdiodev->func[1]);
3786                 brcmf_sdio_chip_detach(&bus->ci);
3787                 if (bus->vars && bus->varsz)
3788                         kfree(bus->vars);
3789                 bus->vars = NULL;
3790         }
3791
3792         brcmf_dbg(TRACE, "Disconnected\n");
3793 }
3794
3795 /* Detach and free everything */
3796 static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
3797 {
3798         brcmf_dbg(TRACE, "Enter\n");
3799
3800         if (bus) {
3801                 /* De-register interrupt handler */
3802                 brcmf_sdio_intr_unregister(bus->sdiodev);
3803
3804                 cancel_work_sync(&bus->datawork);
3805                 if (bus->brcmf_wq)
3806                         destroy_workqueue(bus->brcmf_wq);
3807
3808                 if (bus->sdiodev->bus_if->drvr) {
3809                         brcmf_detach(bus->sdiodev->dev);
3810                         brcmf_sdbrcm_release_dongle(bus);
3811                 }
3812
3813                 brcmf_sdbrcm_release_malloc(bus);
3814
3815                 kfree(bus);
3816         }
3817
3818         brcmf_dbg(TRACE, "Disconnected\n");
3819 }
3820
3821 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
3822         .stop = brcmf_sdbrcm_bus_stop,
3823         .init = brcmf_sdbrcm_bus_init,
3824         .txdata = brcmf_sdbrcm_bus_txdata,
3825         .txctl = brcmf_sdbrcm_bus_txctl,
3826         .rxctl = brcmf_sdbrcm_bus_rxctl,
3827         .gettxq = brcmf_sdbrcm_bus_gettxq,
3828 };
3829
3830 void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
3831 {
3832         int ret;
3833         struct brcmf_sdio *bus;
3834         struct brcmf_bus_dcmd *dlst;
3835         u32 dngl_txglom;
3836         u32 txglomalign = 0;
3837         u8 idx;
3838
3839         brcmf_dbg(TRACE, "Enter\n");
3840
3841         /* We make an assumption about address window mappings:
3842          * regsva == SI_ENUM_BASE*/
3843
3844         /* Allocate private bus interface state */
3845         bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
3846         if (!bus)
3847                 goto fail;
3848
3849         bus->sdiodev = sdiodev;
3850         sdiodev->bus = bus;
3851         skb_queue_head_init(&bus->glom);
3852         bus->txbound = BRCMF_TXBOUND;
3853         bus->rxbound = BRCMF_RXBOUND;
3854         bus->txminmax = BRCMF_TXMINMAX;
3855         bus->tx_seq = SDPCM_SEQ_WRAP - 1;
3856
3857         INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
3858         bus->brcmf_wq = create_singlethread_workqueue("brcmf_wq");
3859         if (bus->brcmf_wq == NULL) {
3860                 brcmf_err("insufficient memory to create txworkqueue\n");
3861                 goto fail;
3862         }
3863
3864         /* attempt to attach to the dongle */
3865         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3866                 brcmf_err("brcmf_sdbrcm_probe_attach failed\n");
3867                 goto fail;
3868         }
3869
3870         spin_lock_init(&bus->rxctl_lock);
3871         spin_lock_init(&bus->txqlock);
3872         init_waitqueue_head(&bus->ctrl_wait);
3873         init_waitqueue_head(&bus->dcmd_resp_wait);
3874
3875         /* Set up the watchdog timer */
3876         init_timer(&bus->timer);
3877         bus->timer.data = (unsigned long)bus;
3878         bus->timer.function = brcmf_sdbrcm_watchdog;
3879
3880         /* Initialize watchdog thread */
3881         init_completion(&bus->watchdog_wait);
3882         bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3883                                         bus, "brcmf_watchdog");
3884         if (IS_ERR(bus->watchdog_tsk)) {
3885                 pr_warn("brcmf_watchdog thread failed to start\n");
3886                 bus->watchdog_tsk = NULL;
3887         }
3888         /* Initialize DPC thread */
3889         atomic_set(&bus->dpc_tskcnt, 0);
3890
3891         /* Assign bus interface call back */
3892         bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
3893         bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
3894         bus->sdiodev->bus_if->chip = bus->ci->chip;
3895         bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
3896
3897         /* default sdio bus header length for tx packet */
3898         bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
3899
3900         /* Attach to the common layer, reserve hdr space */
3901         ret = brcmf_attach(bus->tx_hdrlen, bus->sdiodev->dev);
3902         if (ret != 0) {
3903                 brcmf_err("brcmf_attach failed\n");
3904                 goto fail;
3905         }
3906
3907         /* Allocate buffers */
3908         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
3909                 brcmf_err("brcmf_sdbrcm_probe_malloc failed\n");
3910                 goto fail;
3911         }
3912
3913         if (!(brcmf_sdbrcm_probe_init(bus))) {
3914                 brcmf_err("brcmf_sdbrcm_probe_init failed\n");
3915                 goto fail;
3916         }
3917
3918         brcmf_sdio_debugfs_create(bus);
3919         brcmf_dbg(INFO, "completed!!\n");
3920
3921         /* sdio bus core specific dcmd */
3922         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3923         dlst = kzalloc(sizeof(struct brcmf_bus_dcmd), GFP_KERNEL);
3924         if (dlst) {
3925                 if (bus->ci->c_inf[idx].rev < 12) {
3926                         /* for sdio core rev < 12, disable txgloming */
3927                         dngl_txglom = 0;
3928                         dlst->name = "bus:txglom";
3929                         dlst->param = (char *)&dngl_txglom;
3930                         dlst->param_len = sizeof(u32);
3931                 } else {
3932                         /* otherwise, set txglomalign */
3933                         if (sdiodev->pdata)
3934                                 txglomalign = sdiodev->pdata->sd_sgentry_align;
3935                         /* SDIO ADMA requires at least 32 bit alignment */
3936                         if (txglomalign < 4)
3937                                 txglomalign = 4;
3938                         dlst->name = "bus:txglomalign";
3939                         dlst->param = (char *)&txglomalign;
3940                         dlst->param_len = sizeof(u32);
3941                 }
3942                 list_add(&dlst->list, &bus->sdiodev->bus_if->dcmd_list);
3943         }
3944
3945         /* if firmware path present try to download and bring up bus */
3946         ret = brcmf_bus_start(bus->sdiodev->dev);
3947         if (ret != 0) {
3948                 brcmf_err("dongle is not responding\n");
3949                 goto fail;
3950         }
3951
3952         return bus;
3953
3954 fail:
3955         brcmf_sdbrcm_release(bus);
3956         return NULL;
3957 }
3958
3959 void brcmf_sdbrcm_disconnect(void *ptr)
3960 {
3961         struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
3962
3963         brcmf_dbg(TRACE, "Enter\n");
3964
3965         if (bus)
3966                 brcmf_sdbrcm_release(bus);
3967
3968         brcmf_dbg(TRACE, "Disconnected\n");
3969 }
3970
3971 void
3972 brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
3973 {
3974         /* Totally stop the timer */
3975         if (!wdtick && bus->wd_timer_valid) {
3976                 del_timer_sync(&bus->timer);
3977                 bus->wd_timer_valid = false;
3978                 bus->save_ms = wdtick;
3979                 return;
3980         }
3981
3982         /* don't start the wd until fw is loaded */
3983         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
3984                 return;
3985
3986         if (wdtick) {
3987                 if (bus->save_ms != BRCMF_WD_POLL_MS) {
3988                         if (bus->wd_timer_valid)
3989                                 /* Stop timer and restart at new value */
3990                                 del_timer_sync(&bus->timer);
3991
3992                         /* Create timer again when watchdog period is
3993                            dynamically changed or in the first instance
3994                          */
3995                         bus->timer.expires =
3996                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
3997                         add_timer(&bus->timer);
3998
3999                 } else {
4000                         /* Re arm the timer, at last watchdog period */
4001                         mod_timer(&bus->timer,
4002                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4003                 }
4004
4005                 bus->wd_timer_valid = true;
4006                 bus->save_ms = wdtick;
4007         }
4008 }