linux/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
<<
>>
Prefs
   1// SPDX-License-Identifier: ISC
   2/*
   3 * Copyright (c) 2010 Broadcom Corporation
   4 */
   5
   6#include <linux/types.h>
   7#include <linux/atomic.h>
   8#include <linux/kernel.h>
   9#include <linux/kthread.h>
  10#include <linux/printk.h>
  11#include <linux/pci_ids.h>
  12#include <linux/netdevice.h>
  13#include <linux/interrupt.h>
  14#include <linux/sched/signal.h>
  15#include <linux/mmc/sdio.h>
  16#include <linux/mmc/sdio_ids.h>
  17#include <linux/mmc/sdio_func.h>
  18#include <linux/mmc/card.h>
  19#include <linux/mmc/core.h>
  20#include <linux/semaphore.h>
  21#include <linux/firmware.h>
  22#include <linux/module.h>
  23#include <linux/bcma/bcma.h>
  24#include <linux/debugfs.h>
  25#include <linux/vmalloc.h>
  26#include <asm/unaligned.h>
  27#include <defs.h>
  28#include <brcmu_wifi.h>
  29#include <brcmu_utils.h>
  30#include <brcm_hw_ids.h>
  31#include <soc.h>
  32#include "sdio.h"
  33#include "chip.h"
  34#include "firmware.h"
  35#include "core.h"
  36#include "common.h"
  37#include "bcdc.h"
  38
  39#define DCMD_RESP_TIMEOUT       msecs_to_jiffies(2500)
  40#define CTL_DONE_TIMEOUT        msecs_to_jiffies(2500)
  41
  42/* watermark expressed in number of words */
  43#define DEFAULT_F2_WATERMARK    0x8
  44#define CY_4373_F2_WATERMARK    0x40
  45#define CY_4373_F1_MESBUSYCTRL  (CY_4373_F2_WATERMARK | SBSDIO_MESBUSYCTRL_ENAB)
  46#define CY_43012_F2_WATERMARK    0x60
  47#define CY_43012_MES_WATERMARK  0x50
  48#define CY_43012_MESBUSYCTRL    (CY_43012_MES_WATERMARK | \
  49                                 SBSDIO_MESBUSYCTRL_ENAB)
  50#define CY_4339_F2_WATERMARK    48
  51#define CY_4339_MES_WATERMARK   80
  52#define CY_4339_MESBUSYCTRL     (CY_4339_MES_WATERMARK | \
  53                                 SBSDIO_MESBUSYCTRL_ENAB)
  54#define CY_43455_F2_WATERMARK   0x60
  55#define CY_43455_MES_WATERMARK  0x50
  56#define CY_43455_MESBUSYCTRL    (CY_43455_MES_WATERMARK | \
  57                                 SBSDIO_MESBUSYCTRL_ENAB)
  58#define CY_435X_F2_WATERMARK    0x40
  59#define CY_435X_F1_MESBUSYCTRL  (CY_435X_F2_WATERMARK | \
  60                                 SBSDIO_MESBUSYCTRL_ENAB)
  61
  62#ifdef DEBUG
  63
  64#define BRCMF_TRAP_INFO_SIZE    80
  65
  66#define CBUF_LEN        (128)
  67
  68/* Device console log buffer state */
  69#define CONSOLE_BUFFER_MAX      2024
  70
  71struct rte_log_le {
  72        __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  73        __le32 buf_size;
  74        __le32 idx;
  75        char *_buf_compat;      /* Redundant pointer for backward compat. */
  76};
  77
  78struct rte_console {
  79        /* Virtual UART
  80         * When there is no UART (e.g. Quickturn),
  81         * the host should write a complete
  82         * input line directly into cbuf and then write
  83         * the length into vcons_in.
  84         * This may also be used when there is a real UART
  85         * (at risk of conflicting with
  86         * the real UART).  vcons_out is currently unused.
  87         */
  88        uint vcons_in;
  89        uint vcons_out;
  90
  91        /* Output (logging) buffer
  92         * Console output is written to a ring buffer log_buf at index log_idx.
  93         * The host may read the output when it sees log_idx advance.
  94         * Output will be lost if the output wraps around faster than the host
  95         * polls.
  96         */
  97        struct rte_log_le log_le;
  98
  99        /* Console input line buffer
 100         * Characters are read one at a time into cbuf
 101         * until <CR> is received, then
 102         * the buffer is processed as a command line.
 103         * Also used for virtual UART.
 104         */
 105        uint cbuf_idx;
 106        char cbuf[CBUF_LEN];
 107};
 108
 109#endif                          /* DEBUG */
 110#include <chipcommon.h>
 111
 112#include "bus.h"
 113#include "debug.h"
 114#include "tracepoint.h"
 115
 116#define TXQLEN          2048    /* bulk tx queue length */
 117#define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 118#define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 119#define PRIOMASK        7
 120
 121#define TXRETRIES       2       /* # of retries for tx frames */
 122
 123#define BRCMF_RXBOUND   50      /* Default for max rx frames in
 124                                 one scheduling */
 125
 126#define BRCMF_TXBOUND   20      /* Default for max tx frames in
 127                                 one scheduling */
 128
 129#define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 130
 131#define MEMBLOCK        2048    /* Block size used for downloading
 132                                 of dongle image */
 133#define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 134                                 biggest possible glom */
 135
 136#define BRCMF_FIRSTREAD (1 << 6)
 137
 138#define BRCMF_CONSOLE   10      /* watchdog interval to poll console */
 139
 140/* SBSDIO_DEVICE_CTL */
 141
 142/* 1: device will assert busy signal when receiving CMD53 */
 143#define SBSDIO_DEVCTL_SETBUSY           0x01
 144/* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 145#define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 146/* 1: mask all interrupts to host except the chipActive (rev 8) */
 147#define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 148/* 1: isolate internal sdio signals, put external pads in tri-state; requires
 149 * sdio bus power cycle to clear (rev 9) */
 150#define SBSDIO_DEVCTL_PADS_ISO          0x08
 151/* 1: enable F2 Watermark */
 152#define SBSDIO_DEVCTL_F2WM_ENAB         0x10
 153/* Force SD->SB reset mapping (rev 11) */
 154#define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 155/*   Determined by CoreControl bit */
 156#define SBSDIO_DEVCTL_RST_CORECTL       0x00
 157/*   Force backplane reset */
 158#define SBSDIO_DEVCTL_RST_BPRESET       0x10
 159/*   Force no backplane reset */
 160#define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 161
 162/* direct(mapped) cis space */
 163
 164/* MAPPED common CIS address */
 165#define SBSDIO_CIS_BASE_COMMON          0x1000
 166/* maximum bytes in one CIS */
 167#define SBSDIO_CIS_SIZE_LIMIT           0x200
 168/* cis offset addr is < 17 bits */
 169#define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 170
 171/* manfid tuple length, include tuple, link bytes */
 172#define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 173
 174#define SD_REG(field) \
 175                (offsetof(struct sdpcmd_regs, field))
 176
 177/* SDIO function 1 register CHIPCLKCSR */
 178/* Force ALP request to backplane */
 179#define SBSDIO_FORCE_ALP                0x01
 180/* Force HT request to backplane */
 181#define SBSDIO_FORCE_HT                 0x02
 182/* Force ILP request to backplane */
 183#define SBSDIO_FORCE_ILP                0x04
 184/* Make ALP ready (power up xtal) */
 185#define SBSDIO_ALP_AVAIL_REQ            0x08
 186/* Make HT ready (power up PLL) */
 187#define SBSDIO_HT_AVAIL_REQ             0x10
 188/* Squelch clock requests from HW */
 189#define SBSDIO_FORCE_HW_CLKREQ_OFF      0x20
 190/* Status: ALP is ready */
 191#define SBSDIO_ALP_AVAIL                0x40
 192/* Status: HT is ready */
 193#define SBSDIO_HT_AVAIL                 0x80
 194#define SBSDIO_CSR_MASK                 0x1F
 195#define SBSDIO_AVBITS           (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
 196#define SBSDIO_ALPAV(regval)    ((regval) & SBSDIO_AVBITS)
 197#define SBSDIO_HTAV(regval)     (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
 198#define SBSDIO_ALPONLY(regval)  (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
 199#define SBSDIO_CLKAV(regval, alponly) \
 200        (SBSDIO_ALPAV(regval) && (alponly ? 1 : SBSDIO_HTAV(regval)))
 201
 202/* intstatus */
 203#define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 204#define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 205#define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 206#define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 207#define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 208#define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 209#define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 210#define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 211#define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 212#define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 213#define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 214#define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 215#define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 216#define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 217#define I_PC            (1 << 10)       /* descriptor error */
 218#define I_PD            (1 << 11)       /* data error */
 219#define I_DE            (1 << 12)       /* Descriptor protocol Error */
 220#define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 221#define I_RO            (1 << 14)       /* Receive fifo Overflow */
 222#define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 223#define I_RI            (1 << 16)       /* Receive Interrupt */
 224#define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 225#define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 226#define I_XI            (1 << 24)       /* Transmit Interrupt */
 227#define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 228#define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 229#define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 230#define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 231#define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 232#define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 233#define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 234#define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 235#define I_DMA           (I_RI | I_XI | I_ERRORS)
 236
 237/* corecontrol */
 238#define CC_CISRDY               (1 << 0)        /* CIS Ready */
 239#define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 240#define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 241#define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 242#define CC_XMTDATAAVAIL_MODE    (1 << 4)
 243#define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 244
 245/* SDA_FRAMECTRL */
 246#define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 247#define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 248#define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 249#define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 250
 251/*
 252 * Software allocation of To SB Mailbox resources
 253 */
 254
 255/* tosbmailbox bits corresponding to intstatus bits */
 256#define SMB_NAK         (1 << 0)        /* Frame NAK */
 257#define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 258#define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 259#define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 260
 261/* tosbmailboxdata */
 262#define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 263
 264/*
 265 * Software allocation of To Host Mailbox resources
 266 */
 267
 268/* intstatus bits */
 269#define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 270#define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 271#define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 272#define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 273
 274/* tohostmailboxdata */
 275#define HMB_DATA_NAKHANDLED     0x0001  /* retransmit NAK'd frame */
 276#define HMB_DATA_DEVREADY       0x0002  /* talk to host after enable */
 277#define HMB_DATA_FC             0x0004  /* per prio flowcontrol update flag */
 278#define HMB_DATA_FWREADY        0x0008  /* fw ready for protocol activity */
 279#define HMB_DATA_FWHALT         0x0010  /* firmware halted */
 280
 281#define HMB_DATA_FCDATA_MASK    0xff000000
 282#define HMB_DATA_FCDATA_SHIFT   24
 283
 284#define HMB_DATA_VERSION_MASK   0x00ff0000
 285#define HMB_DATA_VERSION_SHIFT  16
 286
 287/*
 288 * Software-defined protocol header
 289 */
 290
 291/* Current protocol version */
 292#define SDPCM_PROT_VERSION      4
 293
 294/*
 295 * Shared structure between dongle and the host.
 296 * The structure contains pointers to trap or assert information.
 297 */
 298#define SDPCM_SHARED_VERSION       0x0003
 299#define SDPCM_SHARED_VERSION_MASK  0x00FF
 300#define SDPCM_SHARED_ASSERT_BUILT  0x0100
 301#define SDPCM_SHARED_ASSERT        0x0200
 302#define SDPCM_SHARED_TRAP          0x0400
 303
 304/* Space for header read, limit for data packets */
 305#define MAX_HDR_READ    (1 << 6)
 306#define MAX_RX_DATASZ   2048
 307
 308/* Bump up limit on waiting for HT to account for first startup;
 309 * if the image is doing a CRC calculation before programming the PMU
 310 * for HT availability, it could take a couple hundred ms more, so
 311 * max out at a 1 second (1000000us).
 312 */
 313#undef PMU_MAX_TRANSITION_DLY
 314#define PMU_MAX_TRANSITION_DLY 1000000
 315
 316/* Value for ChipClockCSR during initial setup */
 317#define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 318                                        SBSDIO_ALP_AVAIL_REQ)
 319
 320/* Flags for SDH calls */
 321#define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 322
 323#define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
 324                                         * when idle
 325                                         */
 326#define BRCMF_IDLE_INTERVAL     1
 327
 328#define KSO_WAIT_US 50
 329#define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
 330#define BRCMF_SDIO_MAX_ACCESS_ERRORS    5
 331
 332#ifdef DEBUG
 333/* Device console log buffer state */
 334struct brcmf_console {
 335        uint count;             /* Poll interval msec counter */
 336        uint log_addr;          /* Log struct address (fixed) */
 337        struct rte_log_le log_le;       /* Log struct (host copy) */
 338        uint bufsize;           /* Size of log buffer */
 339        u8 *buf;                /* Log buffer (host copy) */
 340        uint last;              /* Last buffer read index */
 341};
 342
 343struct brcmf_trap_info {
 344        __le32          type;
 345        __le32          epc;
 346        __le32          cpsr;
 347        __le32          spsr;
 348        __le32          r0;     /* a1 */
 349        __le32          r1;     /* a2 */
 350        __le32          r2;     /* a3 */
 351        __le32          r3;     /* a4 */
 352        __le32          r4;     /* v1 */
 353        __le32          r5;     /* v2 */
 354        __le32          r6;     /* v3 */
 355        __le32          r7;     /* v4 */
 356        __le32          r8;     /* v5 */
 357        __le32          r9;     /* sb/v6 */
 358        __le32          r10;    /* sl/v7 */
 359        __le32          r11;    /* fp/v8 */
 360        __le32          r12;    /* ip */
 361        __le32          r13;    /* sp */
 362        __le32          r14;    /* lr */
 363        __le32          pc;     /* r15 */
 364};
 365#endif                          /* DEBUG */
 366
 367struct sdpcm_shared {
 368        u32 flags;
 369        u32 trap_addr;
 370        u32 assert_exp_addr;
 371        u32 assert_file_addr;
 372        u32 assert_line;
 373        u32 console_addr;       /* Address of struct rte_console */
 374        u32 msgtrace_addr;
 375        u8 tag[32];
 376        u32 brpt_addr;
 377};
 378
 379struct sdpcm_shared_le {
 380        __le32 flags;
 381        __le32 trap_addr;
 382        __le32 assert_exp_addr;
 383        __le32 assert_file_addr;
 384        __le32 assert_line;
 385        __le32 console_addr;    /* Address of struct rte_console */
 386        __le32 msgtrace_addr;
 387        u8 tag[32];
 388        __le32 brpt_addr;
 389};
 390
 391/* dongle SDIO bus specific header info */
 392struct brcmf_sdio_hdrinfo {
 393        u8 seq_num;
 394        u8 channel;
 395        u16 len;
 396        u16 len_left;
 397        u16 len_nxtfrm;
 398        u8 dat_offset;
 399        bool lastfrm;
 400        u16 tail_pad;
 401};
 402
 403/*
 404 * hold counter variables
 405 */
 406struct brcmf_sdio_count {
 407        uint intrcount;         /* Count of device interrupt callbacks */
 408        uint lastintrs;         /* Count as of last watchdog timer */
 409        uint pollcnt;           /* Count of active polls */
 410        uint regfails;          /* Count of R_REG failures */
 411        uint tx_sderrs;         /* Count of tx attempts with sd errors */
 412        uint fcqueued;          /* Tx packets that got queued */
 413        uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
 414        uint rx_toolong;        /* Receive frames too long to receive */
 415        uint rxc_errors;        /* SDIO errors when reading control frames */
 416        uint rx_hdrfail;        /* SDIO errors on header reads */
 417        uint rx_badhdr;         /* Bad received headers (roosync?) */
 418        uint rx_badseq;         /* Mismatched rx sequence number */
 419        uint fc_rcvd;           /* Number of flow-control events received */
 420        uint fc_xoff;           /* Number which turned on flow-control */
 421        uint fc_xon;            /* Number which turned off flow-control */
 422        uint rxglomfail;        /* Failed deglom attempts */
 423        uint rxglomframes;      /* Number of glom frames (superframes) */
 424        uint rxglompkts;        /* Number of packets from glom frames */
 425        uint f2rxhdrs;          /* Number of header reads */
 426        uint f2rxdata;          /* Number of frame data reads */
 427        uint f2txdata;          /* Number of f2 frame writes */
 428        uint f1regdata;         /* Number of f1 register accesses */
 429        uint tickcnt;           /* Number of watchdog been schedule */
 430        ulong tx_ctlerrs;       /* Err of sending ctrl frames */
 431        ulong tx_ctlpkts;       /* Ctrl frames sent to dongle */
 432        ulong rx_ctlerrs;       /* Err of processing rx ctrl frames */
 433        ulong rx_ctlpkts;       /* Ctrl frames processed from dongle */
 434        ulong rx_readahead_cnt; /* packets where header read-ahead was used */
 435};
 436
 437/* misc chip info needed by some of the routines */
 438/* Private data for SDIO bus interaction */
 439struct brcmf_sdio {
 440        struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 441        struct brcmf_chip *ci;  /* Chip info struct */
 442        struct brcmf_core *sdio_core; /* sdio core info struct */
 443
 444        u32 hostintmask;        /* Copy of Host Interrupt Mask */
 445        atomic_t intstatus;     /* Intstatus bits (events) pending */
 446        atomic_t fcstate;       /* State of dongle flow-control */
 447
 448        uint blocksize;         /* Block size of SDIO transfers */
 449        uint roundup;           /* Max roundup limit */
 450
 451        struct pktq txq;        /* Queue length used for flow-control */
 452        u8 flowcontrol; /* per prio flow control bitmask */
 453        u8 tx_seq;              /* Transmit sequence number (next) */
 454        u8 tx_max;              /* Maximum transmit sequence allowed */
 455
 456        u8 *hdrbuf;             /* buffer for handling rx frame */
 457        u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 458        u8 rx_seq;              /* Receive sequence number (expected) */
 459        struct brcmf_sdio_hdrinfo cur_read;
 460                                /* info of current read frame */
 461        bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 462        bool rxpending;         /* Data frame pending in dongle */
 463
 464        uint rxbound;           /* Rx frames to read before resched */
 465        uint txbound;           /* Tx frames to send before resched */
 466        uint txminmax;
 467
 468        struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 469        struct sk_buff_head glom; /* Packet list for glommed superframe */
 470
 471        u8 *rxbuf;              /* Buffer for receiving control packets */
 472        uint rxblen;            /* Allocated length of rxbuf */
 473        u8 *rxctl;              /* Aligned pointer into rxbuf */
 474        u8 *rxctl_orig;         /* pointer for freeing rxctl */
 475        uint rxlen;             /* Length of valid data in buffer */
 476        spinlock_t rxctl_lock;  /* protection lock for ctrl frame resources */
 477
 478        u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 479
 480        bool intr;              /* Use interrupts */
 481        bool poll;              /* Use polling */
 482        atomic_t ipend;         /* Device interrupt is pending */
 483        uint spurious;          /* Count of spurious interrupts */
 484        uint pollrate;          /* Ticks between device polls */
 485        uint polltick;          /* Tick counter */
 486
 487#ifdef DEBUG
 488        uint console_interval;
 489        struct brcmf_console console;   /* Console output polling support */
 490        uint console_addr;      /* Console address from shared struct */
 491#endif                          /* DEBUG */
 492
 493        uint clkstate;          /* State of sd and backplane clock(s) */
 494        s32 idletime;           /* Control for activity timeout */
 495        s32 idlecount;          /* Activity timeout counter */
 496        s32 idleclock;          /* How to set bus driver when idle */
 497        bool rxflow_mode;       /* Rx flow control mode */
 498        bool rxflow;            /* Is rx flow control on */
 499        bool alp_only;          /* Don't use HT clock (ALP only) */
 500
 501        u8 *ctrl_frame_buf;
 502        u16 ctrl_frame_len;
 503        bool ctrl_frame_stat;
 504        int ctrl_frame_err;
 505
 506        spinlock_t txq_lock;            /* protect bus->txq */
 507        wait_queue_head_t ctrl_wait;
 508        wait_queue_head_t dcmd_resp_wait;
 509
 510        struct timer_list timer;
 511        struct completion watchdog_wait;
 512        struct task_struct *watchdog_tsk;
 513        bool wd_active;
 514
 515        struct workqueue_struct *brcmf_wq;
 516        struct work_struct datawork;
 517        bool dpc_triggered;
 518        bool dpc_running;
 519
 520        bool txoff;             /* Transmit flow-controlled */
 521        struct brcmf_sdio_count sdcnt;
 522        bool sr_enabled; /* SaveRestore enabled */
 523        bool sleeping;
 524
 525        u8 tx_hdrlen;           /* sdio bus header length for tx packet */
 526        bool txglom;            /* host tx glomming enable flag */
 527        u16 head_align;         /* buffer pointer alignment */
 528        u16 sgentry_align;      /* scatter-gather buffer alignment */
 529};
 530
 531/* clkstate */
 532#define CLK_NONE        0
 533#define CLK_SDONLY      1
 534#define CLK_PENDING     2
 535#define CLK_AVAIL       3
 536
 537#ifdef DEBUG
 538static int qcount[NUMPRIO];
 539#endif                          /* DEBUG */
 540
 541#define DEFAULT_SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 542
 543#define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 544
 545/* Limit on rounding up frames */
 546static const uint max_roundup = 512;
 547
 548#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
 549#define ALIGNMENT  8
 550#else
 551#define ALIGNMENT  4
 552#endif
 553
 554enum brcmf_sdio_frmtype {
 555        BRCMF_SDIO_FT_NORMAL,
 556        BRCMF_SDIO_FT_SUPER,
 557        BRCMF_SDIO_FT_SUB,
 558};
 559
 560#define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
 561
 562/* SDIO Pad drive strength to select value mappings */
 563struct sdiod_drive_str {
 564        u8 strength;    /* Pad Drive Strength in mA */
 565        u8 sel;         /* Chip-specific select value */
 566};
 567
 568/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8V) */
 569static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
 570        {32, 0x6},
 571        {26, 0x7},
 572        {22, 0x4},
 573        {16, 0x5},
 574        {12, 0x2},
 575        {8, 0x3},
 576        {4, 0x0},
 577        {0, 0x1}
 578};
 579
 580/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
 581static const struct sdiod_drive_str sdiod_drive_strength_tab5_1v8[] = {
 582        {6, 0x7},
 583        {5, 0x6},
 584        {4, 0x5},
 585        {3, 0x4},
 586        {2, 0x2},
 587        {1, 0x1},
 588        {0, 0x0}
 589};
 590
 591/* SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
 592static const struct sdiod_drive_str sdiod_drvstr_tab6_1v8[] = {
 593        {3, 0x3},
 594        {2, 0x2},
 595        {1, 0x1},
 596        {0, 0x0} };
 597
 598/* SDIO Drive Strength to sel value table for 43143 PMU Rev 17 (3.3V) */
 599static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 600        {16, 0x7},
 601        {12, 0x5},
 602        {8,  0x3},
 603        {4,  0x1}
 604};
 605
 606BRCMF_FW_DEF(43143, "brcmfmac43143-sdio");
 607BRCMF_FW_DEF(43241B0, "brcmfmac43241b0-sdio");
 608BRCMF_FW_DEF(43241B4, "brcmfmac43241b4-sdio");
 609BRCMF_FW_DEF(43241B5, "brcmfmac43241b5-sdio");
 610BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
 611BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
 612BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
 613BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
 614BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
 615BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
 616BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
 617BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-sdio");
 618/* Note the names are not postfixed with a1 for backward compatibility */
 619BRCMF_FW_CLM_DEF(43430A1, "brcmfmac43430-sdio");
 620BRCMF_FW_DEF(43430B0, "brcmfmac43430b0-sdio");
 621BRCMF_FW_CLM_DEF(43455, "brcmfmac43455-sdio");
 622BRCMF_FW_DEF(43456, "brcmfmac43456-sdio");
 623BRCMF_FW_CLM_DEF(4354, "brcmfmac4354-sdio");
 624BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-sdio");
 625BRCMF_FW_DEF(4359, "brcmfmac4359-sdio");
 626BRCMF_FW_CLM_DEF(4373, "brcmfmac4373-sdio");
 627BRCMF_FW_CLM_DEF(43012, "brcmfmac43012-sdio");
 628BRCMF_FW_CLM_DEF(43752, "brcmfmac43752-sdio");
 629
 630/* firmware config files */
 631MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-sdio.*.txt");
 632MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-pcie.*.txt");
 633
 634/* per-board firmware binaries */
 635MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-sdio.*.bin");
 636
 637static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
 638        BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
 639        BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
 640        BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
 641        BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
 642        BRCMF_FW_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
 643        BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
 644        BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
 645        BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
 646        BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
 647        BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
 648        BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
 649        BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
 650        BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
 651        BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000002, 43430A1),
 652        BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFC, 43430B0),
 653        BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0x00000200, 43456),
 654        BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFDC0, 43455),
 655        BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
 656        BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
 657        BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
 658        BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373),
 659        BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012),
 660        BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752)
 661};
 662
 663#define TXCTL_CREDITS   2
 664
 665static void pkt_align(struct sk_buff *p, int len, int align)
 666{
 667        uint datalign;
 668        datalign = (unsigned long)(p->data);
 669        datalign = roundup(datalign, (align)) - datalign;
 670        if (datalign)
 671                skb_pull(p, datalign);
 672        __skb_trim(p, len);
 673}
 674
 675/* To check if there's window offered */
 676static bool data_ok(struct brcmf_sdio *bus)
 677{
 678        u8 tx_rsv = 0;
 679
 680        /* Reserve TXCTL_CREDITS credits for txctl when it is ready to send */
 681        if (bus->ctrl_frame_stat)
 682                tx_rsv = TXCTL_CREDITS;
 683
 684        return (bus->tx_max - bus->tx_seq - tx_rsv) != 0 &&
 685               ((bus->tx_max - bus->tx_seq - tx_rsv) & 0x80) == 0;
 686
 687}
 688
 689/* To check if there's window offered */
 690static bool txctl_ok(struct brcmf_sdio *bus)
 691{
 692        return (bus->tx_max - bus->tx_seq) != 0 &&
 693               ((bus->tx_max - bus->tx_seq) & 0x80) == 0;
 694}
 695
 696static int
 697brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
 698{
 699        u8 wr_val = 0, rd_val, cmp_val, bmask;
 700        int err = 0;
 701        int err_cnt = 0;
 702        int try_cnt = 0;
 703
 704        brcmf_dbg(TRACE, "Enter: on=%d\n", on);
 705
 706        sdio_retune_crc_disable(bus->sdiodev->func1);
 707
 708        /* Cannot re-tune if device is asleep; defer till we're awake */
 709        if (on)
 710                sdio_retune_hold_now(bus->sdiodev->func1);
 711
 712        wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
 713        /* 1st KSO write goes to AOS wake up core if device is asleep  */
 714        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
 715
 716        /* In case of 43012 chip, the chip could go down immediately after
 717         * KSO bit is cleared. So the further reads of KSO register could
 718         * fail. Thereby just bailing out immediately after clearing KSO
 719         * bit, to avoid polling of KSO bit.
 720         */
 721        if (!on && bus->ci->chip == CY_CC_43012_CHIP_ID)
 722                return err;
 723
 724        if (on) {
 725                /* device WAKEUP through KSO:
 726                 * write bit 0 & read back until
 727                 * both bits 0 (kso bit) & 1 (dev on status) are set
 728                 */
 729                cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |
 730                          SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
 731                bmask = cmp_val;
 732                usleep_range(2000, 3000);
 733        } else {
 734                /* Put device to sleep, turn off KSO */
 735                cmp_val = 0;
 736                /* only check for bit0, bit1(dev on status) may not
 737                 * get cleared right away
 738                 */
 739                bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
 740        }
 741
 742        do {
 743                /* reliable KSO bit set/clr:
 744                 * the sdiod sleep write access is synced to PMU 32khz clk
 745                 * just one write attempt may fail,
 746                 * read it back until it matches written value
 747                 */
 748                rd_val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
 749                                           &err);
 750                if (!err) {
 751                        if ((rd_val & bmask) == cmp_val)
 752                                break;
 753                        err_cnt = 0;
 754                }
 755                /* bail out upon subsequent access errors */
 756                if (err && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS))
 757                        break;
 758
 759                udelay(KSO_WAIT_US);
 760                brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val,
 761                                   &err);
 762
 763        } while (try_cnt++ < MAX_KSO_ATTEMPTS);
 764
 765        if (try_cnt > 2)
 766                brcmf_dbg(SDIO, "try_cnt=%d rd_val=0x%x err=%d\n", try_cnt,
 767                          rd_val, err);
 768
 769        if (try_cnt > MAX_KSO_ATTEMPTS)
 770                brcmf_err("max tries: rd_val=0x%x err=%d\n", rd_val, err);
 771
 772        if (on)
 773                sdio_retune_release(bus->sdiodev->func1);
 774
 775        sdio_retune_crc_enable(bus->sdiodev->func1);
 776
 777        return err;
 778}
 779
 780#define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 781
 782/* Turn backplane clock on or off */
 783static int brcmf_sdio_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 784{
 785        int err;
 786        u8 clkctl, clkreq, devctl;
 787        unsigned long timeout;
 788
 789        brcmf_dbg(SDIO, "Enter\n");
 790
 791        clkctl = 0;
 792
 793        if (bus->sr_enabled) {
 794                bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
 795                return 0;
 796        }
 797
 798        if (on) {
 799                /* Request HT Avail */
 800                clkreq =
 801                    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 802
 803                brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 804                                   clkreq, &err);
 805                if (err) {
 806                        brcmf_err("HT Avail request error: %d\n", err);
 807                        return -EBADE;
 808                }
 809
 810                /* Check current status */
 811                clkctl = brcmf_sdiod_readb(bus->sdiodev,
 812                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
 813                if (err) {
 814                        brcmf_err("HT Avail read error: %d\n", err);
 815                        return -EBADE;
 816                }
 817
 818                /* Go to pending and await interrupt if appropriate */
 819                if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 820                        /* Allow only clock-available interrupt */
 821                        devctl = brcmf_sdiod_readb(bus->sdiodev,
 822                                                   SBSDIO_DEVICE_CTL, &err);
 823                        if (err) {
 824                                brcmf_err("Devctl error setting CA: %d\n", err);
 825                                return -EBADE;
 826                        }
 827
 828                        devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 829                        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 830                                           devctl, &err);
 831                        brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
 832                        bus->clkstate = CLK_PENDING;
 833
 834                        return 0;
 835                } else if (bus->clkstate == CLK_PENDING) {
 836                        /* Cancel CA-only interrupt filter */
 837                        devctl = brcmf_sdiod_readb(bus->sdiodev,
 838                                                   SBSDIO_DEVICE_CTL, &err);
 839                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 840                        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 841                                           devctl, &err);
 842                }
 843
 844                /* Otherwise, wait here (polling) for HT Avail */
 845                timeout = jiffies +
 846                          msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 847                while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 848                        clkctl = brcmf_sdiod_readb(bus->sdiodev,
 849                                                   SBSDIO_FUNC1_CHIPCLKCSR,
 850                                                   &err);
 851                        if (time_after(jiffies, timeout))
 852                                break;
 853                        else
 854                                usleep_range(5000, 10000);
 855                }
 856                if (err) {
 857                        brcmf_err("HT Avail request error: %d\n", err);
 858                        return -EBADE;
 859                }
 860                if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 861                        brcmf_err("HT Avail timeout (%d): clkctl 0x%02x\n",
 862                                  PMU_MAX_TRANSITION_DLY, clkctl);
 863                        return -EBADE;
 864                }
 865
 866                /* Mark clock available */
 867                bus->clkstate = CLK_AVAIL;
 868                brcmf_dbg(SDIO, "CLKCTL: turned ON\n");
 869
 870#if defined(DEBUG)
 871                if (!bus->alp_only) {
 872                        if (SBSDIO_ALPONLY(clkctl))
 873                                brcmf_err("HT Clock should be on\n");
 874                }
 875#endif                          /* defined (DEBUG) */
 876
 877        } else {
 878                clkreq = 0;
 879
 880                if (bus->clkstate == CLK_PENDING) {
 881                        /* Cancel CA-only interrupt filter */
 882                        devctl = brcmf_sdiod_readb(bus->sdiodev,
 883                                                   SBSDIO_DEVICE_CTL, &err);
 884                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 885                        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 886                                           devctl, &err);
 887                }
 888
 889                bus->clkstate = CLK_SDONLY;
 890                brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 891                                   clkreq, &err);
 892                brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
 893                if (err) {
 894                        brcmf_err("Failed access turning clock off: %d\n",
 895                                  err);
 896                        return -EBADE;
 897                }
 898        }
 899        return 0;
 900}
 901
 902/* Change idle/active SD state */
 903static int brcmf_sdio_sdclk(struct brcmf_sdio *bus, bool on)
 904{
 905        brcmf_dbg(SDIO, "Enter\n");
 906
 907        if (on)
 908                bus->clkstate = CLK_SDONLY;
 909        else
 910                bus->clkstate = CLK_NONE;
 911
 912        return 0;
 913}
 914
 915/* Transition SD and backplane clock readiness */
 916static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 917{
 918#ifdef DEBUG
 919        uint oldstate = bus->clkstate;
 920#endif                          /* DEBUG */
 921
 922        brcmf_dbg(SDIO, "Enter\n");
 923
 924        /* Early exit if we're already there */
 925        if (bus->clkstate == target)
 926                return 0;
 927
 928        switch (target) {
 929        case CLK_AVAIL:
 930                /* Make sure SD clock is available */
 931                if (bus->clkstate == CLK_NONE)
 932                        brcmf_sdio_sdclk(bus, true);
 933                /* Now request HT Avail on the backplane */
 934                brcmf_sdio_htclk(bus, true, pendok);
 935                break;
 936
 937        case CLK_SDONLY:
 938                /* Remove HT request, or bring up SD clock */
 939                if (bus->clkstate == CLK_NONE)
 940                        brcmf_sdio_sdclk(bus, true);
 941                else if (bus->clkstate == CLK_AVAIL)
 942                        brcmf_sdio_htclk(bus, false, false);
 943                else
 944                        brcmf_err("request for %d -> %d\n",
 945                                  bus->clkstate, target);
 946                break;
 947
 948        case CLK_NONE:
 949                /* Make sure to remove HT request */
 950                if (bus->clkstate == CLK_AVAIL)
 951                        brcmf_sdio_htclk(bus, false, false);
 952                /* Now remove the SD clock */
 953                brcmf_sdio_sdclk(bus, false);
 954                break;
 955        }
 956#ifdef DEBUG
 957        brcmf_dbg(SDIO, "%d -> %d\n", oldstate, bus->clkstate);
 958#endif                          /* DEBUG */
 959
 960        return 0;
 961}
 962
 963static int
 964brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 965{
 966        int err = 0;
 967        u8 clkcsr;
 968
 969        brcmf_dbg(SDIO, "Enter: request %s currently %s\n",
 970                  (sleep ? "SLEEP" : "WAKE"),
 971                  (bus->sleeping ? "SLEEP" : "WAKE"));
 972
 973        /* If SR is enabled control bus state with KSO */
 974        if (bus->sr_enabled) {
 975                /* Done if we're already in the requested state */
 976                if (sleep == bus->sleeping)
 977                        goto end;
 978
 979                /* Going to sleep */
 980                if (sleep) {
 981                        clkcsr = brcmf_sdiod_readb(bus->sdiodev,
 982                                                   SBSDIO_FUNC1_CHIPCLKCSR,
 983                                                   &err);
 984                        if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
 985                                brcmf_dbg(SDIO, "no clock, set ALP\n");
 986                                brcmf_sdiod_writeb(bus->sdiodev,
 987                                                   SBSDIO_FUNC1_CHIPCLKCSR,
 988                                                   SBSDIO_ALP_AVAIL_REQ, &err);
 989                        }
 990                        err = brcmf_sdio_kso_control(bus, false);
 991                } else {
 992                        err = brcmf_sdio_kso_control(bus, true);
 993                }
 994                if (err) {
 995                        brcmf_err("error while changing bus sleep state %d\n",
 996                                  err);
 997                        goto done;
 998                }
 999        }
1000
1001end:
1002        /* control clocks */
1003        if (sleep) {
1004                if (!bus->sr_enabled)
1005                        brcmf_sdio_clkctl(bus, CLK_NONE, pendok);
1006        } else {
1007                brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
1008                brcmf_sdio_wd_timer(bus, true);
1009        }
1010        bus->sleeping = sleep;
1011        brcmf_dbg(SDIO, "new state %s\n",
1012                  (sleep ? "SLEEP" : "WAKE"));
1013done:
1014        brcmf_dbg(SDIO, "Exit: err=%d\n", err);
1015        return err;
1016
1017}
1018
1019#ifdef DEBUG
1020static inline bool brcmf_sdio_valid_shared_address(u32 addr)
1021{
1022        return !(addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff));
1023}
1024
1025static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
1026                                 struct sdpcm_shared *sh)
1027{
1028        u32 addr = 0;
1029        int rv;
1030        u32 shaddr = 0;
1031        struct sdpcm_shared_le sh_le;
1032        __le32 addr_le;
1033
1034        sdio_claim_host(bus->sdiodev->func1);
1035        brcmf_sdio_bus_sleep(bus, false, false);
1036
1037        /*
1038         * Read last word in socram to determine
1039         * address of sdpcm_shared structure
1040         */
1041        shaddr = bus->ci->rambase + bus->ci->ramsize - 4;
1042        if (!bus->ci->rambase && brcmf_chip_sr_capable(bus->ci))
1043                shaddr -= bus->ci->srsize;
1044        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr,
1045                               (u8 *)&addr_le, 4);
1046        if (rv < 0)
1047                goto fail;
1048
1049        /*
1050         * Check if addr is valid.
1051         * NVRAM length at the end of memory should have been overwritten.
1052         */
1053        addr = le32_to_cpu(addr_le);
1054        if (!brcmf_sdio_valid_shared_address(addr)) {
1055                brcmf_err("invalid sdpcm_shared address 0x%08X\n", addr);
1056                rv = -EINVAL;
1057                goto fail;
1058        }
1059
1060        brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
1061
1062        /* Read hndrte_shared structure */
1063        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
1064                               sizeof(struct sdpcm_shared_le));
1065        if (rv < 0)
1066                goto fail;
1067
1068        sdio_release_host(bus->sdiodev->func1);
1069
1070        /* Endianness */
1071        sh->flags = le32_to_cpu(sh_le.flags);
1072        sh->trap_addr = le32_to_cpu(sh_le.trap_addr);
1073        sh->assert_exp_addr = le32_to_cpu(sh_le.assert_exp_addr);
1074        sh->assert_file_addr = le32_to_cpu(sh_le.assert_file_addr);
1075        sh->assert_line = le32_to_cpu(sh_le.assert_line);
1076        sh->console_addr = le32_to_cpu(sh_le.console_addr);
1077        sh->msgtrace_addr = le32_to_cpu(sh_le.msgtrace_addr);
1078
1079        if ((sh->flags & SDPCM_SHARED_VERSION_MASK) > SDPCM_SHARED_VERSION) {
1080                brcmf_err("sdpcm shared version unsupported: dhd %d dongle %d\n",
1081                          SDPCM_SHARED_VERSION,
1082                          sh->flags & SDPCM_SHARED_VERSION_MASK);
1083                return -EPROTO;
1084        }
1085        return 0;
1086
1087fail:
1088        brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
1089                  rv, addr);
1090        sdio_release_host(bus->sdiodev->func1);
1091        return rv;
1092}
1093
1094static void brcmf_sdio_get_console_addr(struct brcmf_sdio *bus)
1095{
1096        struct sdpcm_shared sh;
1097
1098        if (brcmf_sdio_readshared(bus, &sh) == 0)
1099                bus->console_addr = sh.console_addr;
1100}
1101#else
1102static void brcmf_sdio_get_console_addr(struct brcmf_sdio *bus)
1103{
1104}
1105#endif /* DEBUG */
1106
1107static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
1108{
1109        struct brcmf_sdio_dev *sdiod = bus->sdiodev;
1110        struct brcmf_core *core = bus->sdio_core;
1111        u32 intstatus = 0;
1112        u32 hmb_data;
1113        u8 fcbits;
1114        int ret;
1115
1116        brcmf_dbg(SDIO, "Enter\n");
1117
1118        /* Read mailbox data and ack that we did so */
1119        hmb_data = brcmf_sdiod_readl(sdiod,
1120                                     core->base + SD_REG(tohostmailboxdata),
1121                                     &ret);
1122
1123        if (!ret)
1124                brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
1125                                   SMB_INT_ACK, &ret);
1126
1127        bus->sdcnt.f1regdata += 2;
1128
1129        /* dongle indicates the firmware has halted/crashed */
1130        if (hmb_data & HMB_DATA_FWHALT) {
1131                brcmf_dbg(SDIO, "mailbox indicates firmware halted\n");
1132                brcmf_fw_crashed(&sdiod->func1->dev);
1133        }
1134
1135        /* Dongle recomposed rx frames, accept them again */
1136        if (hmb_data & HMB_DATA_NAKHANDLED) {
1137                brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
1138                          bus->rx_seq);
1139                if (!bus->rxskip)
1140                        brcmf_err("unexpected NAKHANDLED!\n");
1141
1142                bus->rxskip = false;
1143                intstatus |= I_HMB_FRAME_IND;
1144        }
1145
1146        /*
1147         * DEVREADY does not occur with gSPI.
1148         */
1149        if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
1150                bus->sdpcm_ver =
1151                    (hmb_data & HMB_DATA_VERSION_MASK) >>
1152                    HMB_DATA_VERSION_SHIFT;
1153                if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
1154                        brcmf_err("Version mismatch, dongle reports %d, "
1155                                  "expecting %d\n",
1156                                  bus->sdpcm_ver, SDPCM_PROT_VERSION);
1157                else
1158                        brcmf_dbg(SDIO, "Dongle ready, protocol version %d\n",
1159                                  bus->sdpcm_ver);
1160
1161                /*
1162                 * Retrieve console state address now that firmware should have
1163                 * updated it.
1164                 */
1165                brcmf_sdio_get_console_addr(bus);
1166        }
1167
1168        /*
1169         * Flow Control has been moved into the RX headers and this out of band
1170         * method isn't used any more.
1171         * remaining backward compatible with older dongles.
1172         */
1173        if (hmb_data & HMB_DATA_FC) {
1174                fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
1175                                                        HMB_DATA_FCDATA_SHIFT;
1176
1177                if (fcbits & ~bus->flowcontrol)
1178                        bus->sdcnt.fc_xoff++;
1179
1180                if (bus->flowcontrol & ~fcbits)
1181                        bus->sdcnt.fc_xon++;
1182
1183                bus->sdcnt.fc_rcvd++;
1184                bus->flowcontrol = fcbits;
1185        }
1186
1187        /* Shouldn't be any others */
1188        if (hmb_data & ~(HMB_DATA_DEVREADY |
1189                         HMB_DATA_NAKHANDLED |
1190                         HMB_DATA_FC |
1191                         HMB_DATA_FWREADY |
1192                         HMB_DATA_FWHALT |
1193                         HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1194                brcmf_err("Unknown mailbox data content: 0x%02x\n",
1195                          hmb_data);
1196
1197        return intstatus;
1198}
1199
1200static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
1201{
1202        struct brcmf_sdio_dev *sdiod = bus->sdiodev;
1203        struct brcmf_core *core = bus->sdio_core;
1204        uint retries = 0;
1205        u16 lastrbc;
1206        u8 hi, lo;
1207        int err;
1208
1209        brcmf_err("%sterminate frame%s\n",
1210                  abort ? "abort command, " : "",
1211                  rtx ? ", send NAK" : "");
1212
1213        if (abort)
1214                brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func2);
1215
1216        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
1217                           &err);
1218        bus->sdcnt.f1regdata++;
1219
1220        /* Wait until the packet has been flushed (device/FIFO stable) */
1221        for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1222                hi = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCHI,
1223                                       &err);
1224                lo = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCLO,
1225                                       &err);
1226                bus->sdcnt.f1regdata += 2;
1227
1228                if ((hi == 0) && (lo == 0))
1229                        break;
1230
1231                if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1232                        brcmf_err("count growing: last 0x%04x now 0x%04x\n",
1233                                  lastrbc, (hi << 8) + lo);
1234                }
1235                lastrbc = (hi << 8) + lo;
1236        }
1237
1238        if (!retries)
1239                brcmf_err("count never zeroed: last 0x%04x\n", lastrbc);
1240        else
1241                brcmf_dbg(SDIO, "flush took %d iterations\n", 0xffff - retries);
1242
1243        if (rtx) {
1244                bus->sdcnt.rxrtx++;
1245                brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
1246                                   SMB_NAK, &err);
1247
1248                bus->sdcnt.f1regdata++;
1249                if (err == 0)
1250                        bus->rxskip = true;
1251        }
1252
1253        /* Clear partial in any case */
1254        bus->cur_read.len = 0;
1255}
1256
1257static void brcmf_sdio_txfail(struct brcmf_sdio *bus)
1258{
1259        struct brcmf_sdio_dev *sdiodev = bus->sdiodev;
1260        u8 i, hi, lo;
1261
1262        /* On failure, abort the command and terminate the frame */
1263        brcmf_err("sdio error, abort command and terminate frame\n");
1264        bus->sdcnt.tx_sderrs++;
1265
1266        brcmf_sdiod_abort(sdiodev, sdiodev->func2);
1267        brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
1268        bus->sdcnt.f1regdata++;
1269
1270        for (i = 0; i < 3; i++) {
1271                hi = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1272                lo = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1273                bus->sdcnt.f1regdata += 2;
1274                if ((hi == 0) && (lo == 0))
1275                        break;
1276        }
1277}
1278
1279/* return total length of buffer chain */
1280static uint brcmf_sdio_glom_len(struct brcmf_sdio *bus)
1281{
1282        struct sk_buff *p;
1283        uint total;
1284
1285        total = 0;
1286        skb_queue_walk(&bus->glom, p)
1287                total += p->len;
1288        return total;
1289}
1290
1291static void brcmf_sdio_free_glom(struct brcmf_sdio *bus)
1292{
1293        struct sk_buff *cur, *next;
1294
1295        skb_queue_walk_safe(&bus->glom, cur, next) {
1296                skb_unlink(cur, &bus->glom);
1297                brcmu_pkt_buf_free_skb(cur);
1298        }
1299}
1300
1301/*
1302 * brcmfmac sdio bus specific header
1303 * This is the lowest layer header wrapped on the packets transmitted between
1304 * host and WiFi dongle which contains information needed for SDIO core and
1305 * firmware
1306 *
1307 * It consists of 3 parts: hardware header, hardware extension header and
1308 * software header
1309 * hardware header (frame tag) - 4 bytes
1310 * Byte 0~1: Frame length
1311 * Byte 2~3: Checksum, bit-wise inverse of frame length
1312 * hardware extension header - 8 bytes
1313 * Tx glom mode only, N/A for Rx or normal Tx
1314 * Byte 0~1: Packet length excluding hw frame tag
1315 * Byte 2: Reserved
1316 * Byte 3: Frame flags, bit 0: last frame indication
1317 * Byte 4~5: Reserved
1318 * Byte 6~7: Tail padding length
1319 * software header - 8 bytes
1320 * Byte 0: Rx/Tx sequence number
1321 * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
1322 * Byte 2: Length of next data frame, reserved for Tx
1323 * Byte 3: Data offset
1324 * Byte 4: Flow control bits, reserved for Tx
1325 * Byte 5: Maximum Sequence number allowed by firmware for Tx, N/A for Tx packet
1326 * Byte 6~7: Reserved
1327 */
1328#define SDPCM_HWHDR_LEN                 4
1329#define SDPCM_HWEXT_LEN                 8
1330#define SDPCM_SWHDR_LEN                 8
1331#define SDPCM_HDRLEN                    (SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN)
1332/* software header */
1333#define SDPCM_SEQ_MASK                  0x000000ff
1334#define SDPCM_SEQ_WRAP                  256
1335#define SDPCM_CHANNEL_MASK              0x00000f00
1336#define SDPCM_CHANNEL_SHIFT             8
1337#define SDPCM_CONTROL_CHANNEL           0       /* Control */
1338#define SDPCM_EVENT_CHANNEL             1       /* Asyc Event Indication */
1339#define SDPCM_DATA_CHANNEL              2       /* Data Xmit/Recv */
1340#define SDPCM_GLOM_CHANNEL              3       /* Coalesced packets */
1341#define SDPCM_TEST_CHANNEL              15      /* Test/debug packets */
1342#define SDPCM_GLOMDESC(p)               (((u8 *)p)[1] & 0x80)
1343#define SDPCM_NEXTLEN_MASK              0x00ff0000
1344#define SDPCM_NEXTLEN_SHIFT             16
1345#define SDPCM_DOFFSET_MASK              0xff000000
1346#define SDPCM_DOFFSET_SHIFT             24
1347#define SDPCM_FCMASK_MASK               0x000000ff
1348#define SDPCM_WINDOW_MASK               0x0000ff00
1349#define SDPCM_WINDOW_SHIFT              8
1350
1351static inline u8 brcmf_sdio_getdatoffset(u8 *swheader)
1352{
1353        u32 hdrvalue;
1354        hdrvalue = le32_to_cpu(*(__le32 *)swheader);
1355        return (u8)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT);
1356}
1357
1358static inline bool brcmf_sdio_fromevntchan(u8 *swheader)
1359{
1360        u32 hdrvalue;
1361        u8 ret;
1362
1363        hdrvalue = le32_to_cpu(*(__le32 *)swheader);
1364        ret = (u8)((hdrvalue & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT);
1365
1366        return (ret == SDPCM_EVENT_CHANNEL);
1367}
1368
1369static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
1370                              struct brcmf_sdio_hdrinfo *rd,
1371                              enum brcmf_sdio_frmtype type)
1372{
1373        u16 len, checksum;
1374        u8 rx_seq, fc, tx_seq_max;
1375        u32 swheader;
1376
1377        trace_brcmf_sdpcm_hdr(SDPCM_RX, header);
1378
1379        /* hw header */
1380        len = get_unaligned_le16(header);
1381        checksum = get_unaligned_le16(header + sizeof(u16));
1382        /* All zero means no more to read */
1383        if (!(len | checksum)) {
1384                bus->rxpending = false;
1385                return -ENODATA;
1386        }
1387        if ((u16)(~(len ^ checksum))) {
1388                brcmf_err("HW header checksum error\n");
1389                bus->sdcnt.rx_badhdr++;
1390                brcmf_sdio_rxfail(bus, false, false);
1391                return -EIO;
1392        }
1393        if (len < SDPCM_HDRLEN) {
1394                brcmf_err("HW header length error\n");
1395                return -EPROTO;
1396        }
1397        if (type == BRCMF_SDIO_FT_SUPER &&
1398            (roundup(len, bus->blocksize) != rd->len)) {
1399                brcmf_err("HW superframe header length error\n");
1400                return -EPROTO;
1401        }
1402        if (type == BRCMF_SDIO_FT_SUB && len > rd->len) {
1403                brcmf_err("HW subframe header length error\n");
1404                return -EPROTO;
1405        }
1406        rd->len = len;
1407
1408        /* software header */
1409        header += SDPCM_HWHDR_LEN;
1410        swheader = le32_to_cpu(*(__le32 *)header);
1411        if (type == BRCMF_SDIO_FT_SUPER && SDPCM_GLOMDESC(header)) {
1412                brcmf_err("Glom descriptor found in superframe head\n");
1413                rd->len = 0;
1414                return -EINVAL;
1415        }
1416        rx_seq = (u8)(swheader & SDPCM_SEQ_MASK);
1417        rd->channel = (swheader & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT;
1418        if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
1419            type != BRCMF_SDIO_FT_SUPER) {
1420                brcmf_err("HW header length too long\n");
1421                bus->sdcnt.rx_toolong++;
1422                brcmf_sdio_rxfail(bus, false, false);
1423                rd->len = 0;
1424                return -EPROTO;
1425        }
1426        if (type == BRCMF_SDIO_FT_SUPER && rd->channel != SDPCM_GLOM_CHANNEL) {
1427                brcmf_err("Wrong channel for superframe\n");
1428                rd->len = 0;
1429                return -EINVAL;
1430        }
1431        if (type == BRCMF_SDIO_FT_SUB && rd->channel != SDPCM_DATA_CHANNEL &&
1432            rd->channel != SDPCM_EVENT_CHANNEL) {
1433                brcmf_err("Wrong channel for subframe\n");
1434                rd->len = 0;
1435                return -EINVAL;
1436        }
1437        rd->dat_offset = brcmf_sdio_getdatoffset(header);
1438        if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
1439                brcmf_err("seq %d: bad data offset\n", rx_seq);
1440                bus->sdcnt.rx_badhdr++;
1441                brcmf_sdio_rxfail(bus, false, false);
1442                rd->len = 0;
1443                return -ENXIO;
1444        }
1445        if (rd->seq_num != rx_seq) {
1446                brcmf_dbg(SDIO, "seq %d, expected %d\n", rx_seq, rd->seq_num);
1447                bus->sdcnt.rx_badseq++;
1448                rd->seq_num = rx_seq;
1449        }
1450        /* no need to check the reset for subframe */
1451        if (type == BRCMF_SDIO_FT_SUB)
1452                return 0;
1453        rd->len_nxtfrm = (swheader & SDPCM_NEXTLEN_MASK) >> SDPCM_NEXTLEN_SHIFT;
1454        if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
1455                /* only warm for NON glom packet */
1456                if (rd->channel != SDPCM_GLOM_CHANNEL)
1457                        brcmf_err("seq %d: next length error\n", rx_seq);
1458                rd->len_nxtfrm = 0;
1459        }
1460        swheader = le32_to_cpu(*(__le32 *)(header + 4));
1461        fc = swheader & SDPCM_FCMASK_MASK;
1462        if (bus->flowcontrol != fc) {
1463                if (~bus->flowcontrol & fc)
1464                        bus->sdcnt.fc_xoff++;
1465                if (bus->flowcontrol & ~fc)
1466                        bus->sdcnt.fc_xon++;
1467                bus->sdcnt.fc_rcvd++;
1468                bus->flowcontrol = fc;
1469        }
1470        tx_seq_max = (swheader & SDPCM_WINDOW_MASK) >> SDPCM_WINDOW_SHIFT;
1471        if ((u8)(tx_seq_max - bus->tx_seq) > 0x40) {
1472                brcmf_err("seq %d: max tx seq number error\n", rx_seq);
1473                tx_seq_max = bus->tx_seq + 2;
1474        }
1475        bus->tx_max = tx_seq_max;
1476
1477        return 0;
1478}
1479
1480static inline void brcmf_sdio_update_hwhdr(u8 *header, u16 frm_length)
1481{
1482        *(__le16 *)header = cpu_to_le16(frm_length);
1483        *(((__le16 *)header) + 1) = cpu_to_le16(~frm_length);
1484}
1485
1486static void brcmf_sdio_hdpack(struct brcmf_sdio *bus, u8 *header,
1487                              struct brcmf_sdio_hdrinfo *hd_info)
1488{
1489        u32 hdrval;
1490        u8 hdr_offset;
1491
1492        brcmf_sdio_update_hwhdr(header, hd_info->len);
1493        hdr_offset = SDPCM_HWHDR_LEN;
1494
1495        if (bus->txglom) {
1496                hdrval = (hd_info->len - hdr_offset) | (hd_info->lastfrm << 24);
1497                *((__le32 *)(header + hdr_offset)) = cpu_to_le32(hdrval);
1498                hdrval = (u16)hd_info->tail_pad << 16;
1499                *(((__le32 *)(header + hdr_offset)) + 1) = cpu_to_le32(hdrval);
1500                hdr_offset += SDPCM_HWEXT_LEN;
1501        }
1502
1503        hdrval = hd_info->seq_num;
1504        hdrval |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) &
1505                  SDPCM_CHANNEL_MASK;
1506        hdrval |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) &
1507                  SDPCM_DOFFSET_MASK;
1508        *((__le32 *)(header + hdr_offset)) = cpu_to_le32(hdrval);
1509        *(((__le32 *)(header + hdr_offset)) + 1) = 0;
1510        trace_brcmf_sdpcm_hdr(SDPCM_TX + !!(bus->txglom), header);
1511}
1512
1513static u8 brcmf_sdio_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1514{
1515        u16 dlen, totlen;
1516        u8 *dptr, num = 0;
1517        u16 sublen;
1518        struct sk_buff *pfirst, *pnext;
1519
1520        int errcode;
1521        u8 doff;
1522
1523        struct brcmf_sdio_hdrinfo rd_new;
1524
1525        /* If packets, issue read(s) and send up packet chain */
1526        /* Return sequence numbers consumed? */
1527
1528        brcmf_dbg(SDIO, "start: glomd %p glom %p\n",
1529                  bus->glomd, skb_peek(&bus->glom));
1530
1531        /* If there's a descriptor, generate the packet chain */
1532        if (bus->glomd) {
1533                pfirst = pnext = NULL;
1534                dlen = (u16) (bus->glomd->len);
1535                dptr = bus->glomd->data;
1536                if (!dlen || (dlen & 1)) {
1537                        brcmf_err("bad glomd len(%d), ignore descriptor\n",
1538                                  dlen);
1539                        dlen = 0;
1540                }
1541
1542                for (totlen = num = 0; dlen; num++) {
1543                        /* Get (and move past) next length */
1544                        sublen = get_unaligned_le16(dptr);
1545                        dlen -= sizeof(u16);
1546                        dptr += sizeof(u16);
1547                        if ((sublen < SDPCM_HDRLEN) ||
1548                            ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1549                                brcmf_err("descriptor len %d bad: %d\n",
1550                                          num, sublen);
1551                                pnext = NULL;
1552                                break;
1553                        }
1554                        if (sublen % bus->sgentry_align) {
1555                                brcmf_err("sublen %d not multiple of %d\n",
1556                                          sublen, bus->sgentry_align);
1557                        }
1558                        totlen += sublen;
1559
1560                        /* For last frame, adjust read len so total
1561                                 is a block multiple */
1562                        if (!dlen) {
1563                                sublen +=
1564                                    (roundup(totlen, bus->blocksize) - totlen);
1565                                totlen = roundup(totlen, bus->blocksize);
1566                        }
1567
1568                        /* Allocate/chain packet for next subframe */
1569                        pnext = brcmu_pkt_buf_get_skb(sublen + bus->sgentry_align);
1570                        if (pnext == NULL) {
1571                                brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
1572                                          num, sublen);
1573                                break;
1574                        }
1575                        skb_queue_tail(&bus->glom, pnext);
1576
1577                        /* Adhere to start alignment requirements */
1578                        pkt_align(pnext, sublen, bus->sgentry_align);
1579                }
1580
1581                /* If all allocations succeeded, save packet chain
1582                         in bus structure */
1583                if (pnext) {
1584                        brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1585                                  totlen, num);
1586                        if (BRCMF_GLOM_ON() && bus->cur_read.len &&
1587                            totlen != bus->cur_read.len) {
1588                                brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1589                                          bus->cur_read.len, totlen, rxseq);
1590                        }
1591                        pfirst = pnext = NULL;
1592                } else {
1593                        brcmf_sdio_free_glom(bus);
1594                        num = 0;
1595                }
1596
1597                /* Done with descriptor packet */
1598                brcmu_pkt_buf_free_skb(bus->glomd);
1599                bus->glomd = NULL;
1600                bus->cur_read.len = 0;
1601        }
1602
1603        /* Ok -- either we just generated a packet chain,
1604                 or had one from before */
1605        if (!skb_queue_empty(&bus->glom)) {
1606                if (BRCMF_GLOM_ON()) {
1607                        brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1608                        skb_queue_walk(&bus->glom, pnext) {
1609                                brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1610                                          pnext, (u8 *) (pnext->data),
1611                                          pnext->len, pnext->len);
1612                        }
1613                }
1614
1615                pfirst = skb_peek(&bus->glom);
1616                dlen = (u16) brcmf_sdio_glom_len(bus);
1617
1618                /* Do an SDIO read for the superframe.  Configurable iovar to
1619                 * read directly into the chained packet, or allocate a large
1620                 * packet and and copy into the chain.
1621                 */
1622                sdio_claim_host(bus->sdiodev->func1);
1623                errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
1624                                                 &bus->glom, dlen);
1625                sdio_release_host(bus->sdiodev->func1);
1626                bus->sdcnt.f2rxdata++;
1627
1628                /* On failure, kill the superframe */
1629                if (errcode < 0) {
1630                        brcmf_err("glom read of %d bytes failed: %d\n",
1631                                  dlen, errcode);
1632
1633                        sdio_claim_host(bus->sdiodev->func1);
1634                        brcmf_sdio_rxfail(bus, true, false);
1635                        bus->sdcnt.rxglomfail++;
1636                        brcmf_sdio_free_glom(bus);
1637                        sdio_release_host(bus->sdiodev->func1);
1638                        return 0;
1639                }
1640
1641                brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1642                                   pfirst->data, min_t(int, pfirst->len, 48),
1643                                   "SUPERFRAME:\n");
1644
1645                rd_new.seq_num = rxseq;
1646                rd_new.len = dlen;
1647                sdio_claim_host(bus->sdiodev->func1);
1648                errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
1649                                             BRCMF_SDIO_FT_SUPER);
1650                sdio_release_host(bus->sdiodev->func1);
1651                bus->cur_read.len = rd_new.len_nxtfrm << 4;
1652
1653                /* Remove superframe header, remember offset */
1654                skb_pull(pfirst, rd_new.dat_offset);
1655                num = 0;
1656
1657                /* Validate all the subframe headers */
1658                skb_queue_walk(&bus->glom, pnext) {
1659                        /* leave when invalid subframe is found */
1660                        if (errcode)
1661                                break;
1662
1663                        rd_new.len = pnext->len;
1664                        rd_new.seq_num = rxseq++;
1665                        sdio_claim_host(bus->sdiodev->func1);
1666                        errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
1667                                                     BRCMF_SDIO_FT_SUB);
1668                        sdio_release_host(bus->sdiodev->func1);
1669                        brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1670                                           pnext->data, 32, "subframe:\n");
1671
1672                        num++;
1673                }
1674
1675                if (errcode) {
1676                        /* Terminate frame on error */
1677                        sdio_claim_host(bus->sdiodev->func1);
1678                        brcmf_sdio_rxfail(bus, true, false);
1679                        bus->sdcnt.rxglomfail++;
1680                        brcmf_sdio_free_glom(bus);
1681                        sdio_release_host(bus->sdiodev->func1);
1682                        bus->cur_read.len = 0;
1683                        return 0;
1684                }
1685
1686                /* Basic SD framing looks ok - process each packet (header) */
1687
1688                skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1689                        dptr = (u8 *) (pfirst->data);
1690                        sublen = get_unaligned_le16(dptr);
1691                        doff = brcmf_sdio_getdatoffset(&dptr[SDPCM_HWHDR_LEN]);
1692
1693                        brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1694                                           dptr, pfirst->len,
1695                                           "Rx Subframe Data:\n");
1696
1697                        __skb_trim(pfirst, sublen);
1698                        skb_pull(pfirst, doff);
1699
1700                        if (pfirst->len == 0) {
1701                                skb_unlink(pfirst, &bus->glom);
1702                                brcmu_pkt_buf_free_skb(pfirst);
1703                                continue;
1704                        }
1705
1706                        brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1707                                           pfirst->data,
1708                                           min_t(int, pfirst->len, 32),
1709                                           "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1710                                           bus->glom.qlen, pfirst, pfirst->data,
1711                                           pfirst->len, pfirst->next,
1712                                           pfirst->prev);
1713                        skb_unlink(pfirst, &bus->glom);
1714                        if (brcmf_sdio_fromevntchan(&dptr[SDPCM_HWHDR_LEN]))
1715                                brcmf_rx_event(bus->sdiodev->dev, pfirst);
1716                        else
1717                                brcmf_rx_frame(bus->sdiodev->dev, pfirst,
1718                                               false, false);
1719                        bus->sdcnt.rxglompkts++;
1720                }
1721
1722                bus->sdcnt.rxglomframes++;
1723        }
1724        return num;
1725}
1726
1727static int brcmf_sdio_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1728                                     bool *pending)
1729{
1730        DECLARE_WAITQUEUE(wait, current);
1731        int timeout = DCMD_RESP_TIMEOUT;
1732
1733        /* Wait until control frame is available */
1734        add_wait_queue(&bus->dcmd_resp_wait, &wait);
1735        set_current_state(TASK_INTERRUPTIBLE);
1736
1737        while (!(*condition) && (!signal_pending(current) && timeout))
1738                timeout = schedule_timeout(timeout);
1739
1740        if (signal_pending(current))
1741                *pending = true;
1742
1743        set_current_state(TASK_RUNNING);
1744        remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1745
1746        return timeout;
1747}
1748
1749static int brcmf_sdio_dcmd_resp_wake(struct brcmf_sdio *bus)
1750{
1751        wake_up_interruptible(&bus->dcmd_resp_wait);
1752
1753        return 0;
1754}
1755static void
1756brcmf_sdio_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1757{
1758        uint rdlen, pad;
1759        u8 *buf = NULL, *rbuf;
1760        int sdret;
1761
1762        brcmf_dbg(SDIO, "Enter\n");
1763        if (bus->rxblen)
1764                buf = vzalloc(bus->rxblen);
1765        if (!buf)
1766                goto done;
1767
1768        rbuf = bus->rxbuf;
1769        pad = ((unsigned long)rbuf % bus->head_align);
1770        if (pad)
1771                rbuf += (bus->head_align - pad);
1772
1773        /* Copy the already-read portion over */
1774        memcpy(buf, hdr, BRCMF_FIRSTREAD);
1775        if (len <= BRCMF_FIRSTREAD)
1776                goto gotpkt;
1777
1778        /* Raise rdlen to next SDIO block to avoid tail command */
1779        rdlen = len - BRCMF_FIRSTREAD;
1780        if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1781                pad = bus->blocksize - (rdlen % bus->blocksize);
1782                if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1783                    ((len + pad) < bus->sdiodev->bus_if->maxctl))
1784                        rdlen += pad;
1785        } else if (rdlen % bus->head_align) {
1786                rdlen += bus->head_align - (rdlen % bus->head_align);
1787        }
1788
1789        /* Drop if the read is too big or it exceeds our maximum */
1790        if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
1791                brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
1792                          rdlen, bus->sdiodev->bus_if->maxctl);
1793                brcmf_sdio_rxfail(bus, false, false);
1794                goto done;
1795        }
1796
1797        if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
1798                brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1799                          len, len - doff, bus->sdiodev->bus_if->maxctl);
1800                bus->sdcnt.rx_toolong++;
1801                brcmf_sdio_rxfail(bus, false, false);
1802                goto done;
1803        }
1804
1805        /* Read remain of frame body */
1806        sdret = brcmf_sdiod_recv_buf(bus->sdiodev, rbuf, rdlen);
1807        bus->sdcnt.f2rxdata++;
1808
1809        /* Control frame failures need retransmission */
1810        if (sdret < 0) {
1811                brcmf_err("read %d control bytes failed: %d\n",
1812                          rdlen, sdret);
1813                bus->sdcnt.rxc_errors++;
1814                brcmf_sdio_rxfail(bus, true, true);
1815                goto done;
1816        } else
1817                memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
1818
1819gotpkt:
1820
1821        brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
1822                           buf, len, "RxCtrl:\n");
1823
1824        /* Point to valid data and indicate its length */
1825        spin_lock_bh(&bus->rxctl_lock);
1826        if (bus->rxctl) {
1827                brcmf_err("last control frame is being processed.\n");
1828                spin_unlock_bh(&bus->rxctl_lock);
1829                vfree(buf);
1830                goto done;
1831        }
1832        bus->rxctl = buf + doff;
1833        bus->rxctl_orig = buf;
1834        bus->rxlen = len - doff;
1835        spin_unlock_bh(&bus->rxctl_lock);
1836
1837done:
1838        /* Awake any waiters */
1839        brcmf_sdio_dcmd_resp_wake(bus);
1840}
1841
1842/* Pad read to blocksize for efficiency */
1843static void brcmf_sdio_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1844{
1845        if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1846                *pad = bus->blocksize - (*rdlen % bus->blocksize);
1847                if (*pad <= bus->roundup && *pad < bus->blocksize &&
1848                    *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1849                        *rdlen += *pad;
1850        } else if (*rdlen % bus->head_align) {
1851                *rdlen += bus->head_align - (*rdlen % bus->head_align);
1852        }
1853}
1854
1855static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
1856{
1857        struct sk_buff *pkt;            /* Packet for event or data frames */
1858        u16 pad;                /* Number of pad bytes to read */
1859        uint rxleft = 0;        /* Remaining number of frames allowed */
1860        int ret;                /* Return code from calls */
1861        uint rxcount = 0;       /* Total frames read */
1862        struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
1863        u8 head_read = 0;
1864
1865        brcmf_dbg(SDIO, "Enter\n");
1866
1867        /* Not finished unless we encounter no more frames indication */
1868        bus->rxpending = true;
1869
1870        for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
1871             !bus->rxskip && rxleft && bus->sdiodev->state == BRCMF_SDIOD_DATA;
1872             rd->seq_num++, rxleft--) {
1873
1874                /* Handle glomming separately */
1875                if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1876                        u8 cnt;
1877                        brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1878                                  bus->glomd, skb_peek(&bus->glom));
1879                        cnt = brcmf_sdio_rxglom(bus, rd->seq_num);
1880                        brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1881                        rd->seq_num += cnt - 1;
1882                        rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1883                        continue;
1884                }
1885
1886                rd->len_left = rd->len;
1887                /* read header first for unknow frame length */
1888                sdio_claim_host(bus->sdiodev->func1);
1889                if (!rd->len) {
1890                        ret = brcmf_sdiod_recv_buf(bus->sdiodev,
1891                                                   bus->rxhdr, BRCMF_FIRSTREAD);
1892                        bus->sdcnt.f2rxhdrs++;
1893                        if (ret < 0) {
1894                                brcmf_err("RXHEADER FAILED: %d\n",
1895                                          ret);
1896                                bus->sdcnt.rx_hdrfail++;
1897                                brcmf_sdio_rxfail(bus, true, true);
1898                                sdio_release_host(bus->sdiodev->func1);
1899                                continue;
1900                        }
1901
1902                        brcmf_dbg_hex_dump(BRCMF_BYTES_ON() || BRCMF_HDRS_ON(),
1903                                           bus->rxhdr, SDPCM_HDRLEN,
1904                                           "RxHdr:\n");
1905
1906                        if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
1907                                               BRCMF_SDIO_FT_NORMAL)) {
1908                                sdio_release_host(bus->sdiodev->func1);
1909                                if (!bus->rxpending)
1910                                        break;
1911                                else
1912                                        continue;
1913                        }
1914
1915                        if (rd->channel == SDPCM_CONTROL_CHANNEL) {
1916                                brcmf_sdio_read_control(bus, bus->rxhdr,
1917                                                        rd->len,
1918                                                        rd->dat_offset);
1919                                /* prepare the descriptor for the next read */
1920                                rd->len = rd->len_nxtfrm << 4;
1921                                rd->len_nxtfrm = 0;
1922                                /* treat all packet as event if we don't know */
1923                                rd->channel = SDPCM_EVENT_CHANNEL;
1924                                sdio_release_host(bus->sdiodev->func1);
1925                                continue;
1926                        }
1927                        rd->len_left = rd->len > BRCMF_FIRSTREAD ?
1928                                       rd->len - BRCMF_FIRSTREAD : 0;
1929                        head_read = BRCMF_FIRSTREAD;
1930                }
1931
1932                brcmf_sdio_pad(bus, &pad, &rd->len_left);
1933
1934                pkt = brcmu_pkt_buf_get_skb(rd->len_left + head_read +
1935                                            bus->head_align);
1936                if (!pkt) {
1937                        /* Give up on data, request rtx of events */
1938                        brcmf_err("brcmu_pkt_buf_get_skb failed\n");
1939                        brcmf_sdio_rxfail(bus, false,
1940                                            RETRYCHAN(rd->channel));
1941                        sdio_release_host(bus->sdiodev->func1);
1942                        continue;
1943                }
1944                skb_pull(pkt, head_read);
1945                pkt_align(pkt, rd->len_left, bus->head_align);
1946
1947                ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
1948                bus->sdcnt.f2rxdata++;
1949                sdio_release_host(bus->sdiodev->func1);
1950
1951                if (ret < 0) {
1952                        brcmf_err("read %d bytes from channel %d failed: %d\n",
1953                                  rd->len, rd->channel, ret);
1954                        brcmu_pkt_buf_free_skb(pkt);
1955                        sdio_claim_host(bus->sdiodev->func1);
1956                        brcmf_sdio_rxfail(bus, true,
1957                                            RETRYCHAN(rd->channel));
1958                        sdio_release_host(bus->sdiodev->func1);
1959                        continue;
1960                }
1961
1962                if (head_read) {
1963                        skb_push(pkt, head_read);
1964                        memcpy(pkt->data, bus->rxhdr, head_read);
1965                        head_read = 0;
1966                } else {
1967                        memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
1968                        rd_new.seq_num = rd->seq_num;
1969                        sdio_claim_host(bus->sdiodev->func1);
1970                        if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
1971                                               BRCMF_SDIO_FT_NORMAL)) {
1972                                rd->len = 0;
1973                                brcmf_sdio_rxfail(bus, true, true);
1974                                sdio_release_host(bus->sdiodev->func1);
1975                                brcmu_pkt_buf_free_skb(pkt);
1976                                continue;
1977                        }
1978                        bus->sdcnt.rx_readahead_cnt++;
1979                        if (rd->len != roundup(rd_new.len, 16)) {
1980                                brcmf_err("frame length mismatch:read %d, should be %d\n",
1981                                          rd->len,
1982                                          roundup(rd_new.len, 16) >> 4);
1983                                rd->len = 0;
1984                                brcmf_sdio_rxfail(bus, true, true);
1985                                sdio_release_host(bus->sdiodev->func1);
1986                                brcmu_pkt_buf_free_skb(pkt);
1987                                continue;
1988                        }
1989                        sdio_release_host(bus->sdiodev->func1);
1990                        rd->len_nxtfrm = rd_new.len_nxtfrm;
1991                        rd->channel = rd_new.channel;
1992                        rd->dat_offset = rd_new.dat_offset;
1993
1994                        brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1995                                             BRCMF_DATA_ON()) &&
1996                                           BRCMF_HDRS_ON(),
1997                                           bus->rxhdr, SDPCM_HDRLEN,
1998                                           "RxHdr:\n");
1999
2000                        if (rd_new.channel == SDPCM_CONTROL_CHANNEL) {
2001                                brcmf_err("readahead on control packet %d?\n",
2002                                          rd_new.seq_num);
2003                                /* Force retry w/normal header read */
2004                                rd->len = 0;
2005                                sdio_claim_host(bus->sdiodev->func1);
2006                                brcmf_sdio_rxfail(bus, false, true);
2007                                sdio_release_host(bus->sdiodev->func1);
2008                                brcmu_pkt_buf_free_skb(pkt);
2009                                continue;
2010                        }
2011                }
2012
2013                brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
2014                                   pkt->data, rd->len, "Rx Data:\n");
2015
2016                /* Save superframe descriptor and allocate packet frame */
2017                if (rd->channel == SDPCM_GLOM_CHANNEL) {
2018                        if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_HWHDR_LEN])) {
2019                                brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
2020                                          rd->len);
2021                                brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
2022                                                   pkt->data, rd->len,
2023                                                   "Glom Data:\n");
2024                                __skb_trim(pkt, rd->len);
2025                                skb_pull(pkt, SDPCM_HDRLEN);
2026                                bus->glomd = pkt;
2027                        } else {
2028                                brcmf_err("%s: glom superframe w/o "
2029                                          "descriptor!\n", __func__);
2030                                sdio_claim_host(bus->sdiodev->func1);
2031                                brcmf_sdio_rxfail(bus, false, false);
2032                                sdio_release_host(bus->sdiodev->func1);
2033                        }
2034                        /* prepare the descriptor for the next read */
2035                        rd->len = rd->len_nxtfrm << 4;
2036                        rd->len_nxtfrm = 0;
2037                        /* treat all packet as event if we don't know */
2038                        rd->channel = SDPCM_EVENT_CHANNEL;
2039                        continue;
2040                }
2041
2042                /* Fill in packet len and prio, deliver upward */
2043                __skb_trim(pkt, rd->len);
2044                skb_pull(pkt, rd->dat_offset);
2045
2046                if (pkt->len == 0)
2047                        brcmu_pkt_buf_free_skb(pkt);
2048                else if (rd->channel == SDPCM_EVENT_CHANNEL)
2049                        brcmf_rx_event(bus->sdiodev->dev, pkt);
2050                else
2051                        brcmf_rx_frame(bus->sdiodev->dev, pkt,
2052                                       false, false);
2053
2054                /* prepare the descriptor for the next read */
2055                rd->len = rd->len_nxtfrm << 4;
2056                rd->len_nxtfrm = 0;
2057                /* treat all packet as event if we don't know */
2058                rd->channel = SDPCM_EVENT_CHANNEL;
2059        }
2060
2061        rxcount = maxframes - rxleft;
2062        /* Message if we hit the limit */
2063        if (!rxleft)
2064                brcmf_dbg(DATA, "hit rx limit of %d frames\n", maxframes);
2065        else
2066                brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2067        /* Back off rxseq if awaiting rtx, update rx_seq */
2068        if (bus->rxskip)
2069                rd->seq_num--;
2070        bus->rx_seq = rd->seq_num;
2071
2072        return rxcount;
2073}
2074
2075static void
2076brcmf_sdio_wait_event_wakeup(struct brcmf_sdio *bus)
2077{
2078        wake_up_interruptible(&bus->ctrl_wait);
2079        return;
2080}
2081
2082static int brcmf_sdio_txpkt_hdalign(struct brcmf_sdio *bus, struct sk_buff *pkt)
2083{
2084        struct brcmf_bus_stats *stats;
2085        u16 head_pad;
2086        u8 *dat_buf;
2087
2088        dat_buf = (u8 *)(pkt->data);
2089
2090        /* Check head padding */
2091        head_pad = ((unsigned long)dat_buf % bus->head_align);
2092        if (head_pad) {
2093                if (skb_headroom(pkt) < head_pad) {
2094                        stats = &bus->sdiodev->bus_if->stats;
2095                        atomic_inc(&stats->pktcowed);
2096                        if (skb_cow_head(pkt, head_pad)) {
2097                                atomic_inc(&stats->pktcow_failed);
2098                                return -ENOMEM;
2099                        }
2100                        head_pad = 0;
2101                }
2102                skb_push(pkt, head_pad);
2103                dat_buf = (u8 *)(pkt->data);
2104        }
2105        memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
2106        return head_pad;
2107}
2108
2109/*
2110 * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
2111 * bus layer usage.
2112 */
2113/* flag marking a dummy skb added for DMA alignment requirement */
2114#define ALIGN_SKB_FLAG          0x8000
2115/* bit mask of data length chopped from the previous packet */
2116#define ALIGN_SKB_CHOP_LEN_MASK 0x7fff
2117
2118static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
2119                                    struct sk_buff_head *pktq,
2120                                    struct sk_buff *pkt, u16 total_len)
2121{
2122        struct brcmf_sdio_dev *sdiodev;
2123        struct sk_buff *pkt_pad;
2124        u16 tail_pad, tail_chop, chain_pad;
2125        unsigned int blksize;
2126        bool lastfrm;
2127        int ntail, ret;
2128
2129        sdiodev = bus->sdiodev;
2130        blksize = sdiodev->func2->cur_blksize;
2131        /* sg entry alignment should be a divisor of block size */
2132        WARN_ON(blksize % bus->sgentry_align);
2133
2134        /* Check tail padding */
2135        lastfrm = skb_queue_is_last(pktq, pkt);
2136        tail_pad = 0;
2137        tail_chop = pkt->len % bus->sgentry_align;
2138        if (tail_chop)
2139                tail_pad = bus->sgentry_align - tail_chop;
2140        chain_pad = (total_len + tail_pad) % blksize;
2141        if (lastfrm && chain_pad)
2142                tail_pad += blksize - chain_pad;
2143        if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
2144                pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop +
2145                                                bus->head_align);
2146                if (pkt_pad == NULL)
2147                        return -ENOMEM;
2148                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
2149                if (unlikely(ret < 0)) {
2150                        kfree_skb(pkt_pad);
2151                        return ret;
2152                }
2153                memcpy(pkt_pad->data,
2154                       pkt->data + pkt->len - tail_chop,
2155                       tail_chop);
2156                *(u16 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;
2157                skb_trim(pkt, pkt->len - tail_chop);
2158                skb_trim(pkt_pad, tail_pad + tail_chop);
2159                __skb_queue_after(pktq, pkt, pkt_pad);
2160        } else {
2161                ntail = pkt->data_len + tail_pad -
2162                        (pkt->end - pkt->tail);
2163                if (skb_cloned(pkt) || ntail > 0)
2164                        if (pskb_expand_head(pkt, 0, ntail, GFP_ATOMIC))
2165                                return -ENOMEM;
2166                if (skb_linearize(pkt))
2167                        return -ENOMEM;
2168                __skb_put(pkt, tail_pad);
2169        }
2170
2171        return tail_pad;
2172}
2173
2174/**
2175 * brcmf_sdio_txpkt_prep - packet preparation for transmit
2176 * @bus: brcmf_sdio structure pointer
2177 * @pktq: packet list pointer
2178 * @chan: virtual channel to transmit the packet
2179 *
2180 * Processes to be applied to the packet
2181 *      - Align data buffer pointer
2182 *      - Align data buffer length
2183 *      - Prepare header
2184 * Return: negative value if there is error
2185 */
2186static int
2187brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
2188                      uint chan)
2189{
2190        u16 head_pad, total_len;
2191        struct sk_buff *pkt_next;
2192        u8 txseq;
2193        int ret;
2194        struct brcmf_sdio_hdrinfo hd_info = {0};
2195
2196        txseq = bus->tx_seq;
2197        total_len = 0;
2198        skb_queue_walk(pktq, pkt_next) {
2199                /* alignment packet inserted in previous
2200                 * loop cycle can be skipped as it is
2201                 * already properly aligned and does not
2202                 * need an sdpcm header.
2203                 */
2204                if (*(u16 *)(pkt_next->cb) & ALIGN_SKB_FLAG)
2205                        continue;
2206
2207                /* align packet data pointer */
2208                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_next);
2209                if (ret < 0)
2210                        return ret;
2211                head_pad = (u16)ret;
2212                if (head_pad)
2213                        memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);
2214
2215                total_len += pkt_next->len;
2216
2217                hd_info.len = pkt_next->len;
2218                hd_info.lastfrm = skb_queue_is_last(pktq, pkt_next);
2219                if (bus->txglom && pktq->qlen > 1) {
2220                        ret = brcmf_sdio_txpkt_prep_sg(bus, pktq,
2221                                                       pkt_next, total_len);
2222                        if (ret < 0)
2223                                return ret;
2224                        hd_info.tail_pad = (u16)ret;
2225                        total_len += (u16)ret;
2226                }
2227
2228                hd_info.channel = chan;
2229                hd_info.dat_offset = head_pad + bus->tx_hdrlen;
2230                hd_info.seq_num = txseq++;
2231
2232                /* Now fill the header */
2233                brcmf_sdio_hdpack(bus, pkt_next->data, &hd_info);
2234
2235                if (BRCMF_BYTES_ON() &&
2236                    ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
2237                     (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)))
2238                        brcmf_dbg_hex_dump(true, pkt_next->data, hd_info.len,
2239                                           "Tx Frame:\n");
2240                else if (BRCMF_HDRS_ON())
2241                        brcmf_dbg_hex_dump(true, pkt_next->data,
2242                                           head_pad + bus->tx_hdrlen,
2243                                           "Tx Header:\n");
2244        }
2245        /* Hardware length tag of the first packet should be total
2246         * length of the chain (including padding)
2247         */
2248        if (bus->txglom)
2249                brcmf_sdio_update_hwhdr(__skb_peek(pktq)->data, total_len);
2250        return 0;
2251}
2252
2253/**
2254 * brcmf_sdio_txpkt_postp - packet post processing for transmit
2255 * @bus: brcmf_sdio structure pointer
2256 * @pktq: packet list pointer
2257 *
2258 * Processes to be applied to the packet
2259 *      - Remove head padding
2260 *      - Remove tail padding
2261 */
2262static void
2263brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
2264{
2265        u8 *hdr;
2266        u32 dat_offset;
2267        u16 tail_pad;
2268        u16 dummy_flags, chop_len;
2269        struct sk_buff *pkt_next, *tmp, *pkt_prev;
2270
2271        skb_queue_walk_safe(pktq, pkt_next, tmp) {
2272                dummy_flags = *(u16 *)(pkt_next->cb);
2273                if (dummy_flags & ALIGN_SKB_FLAG) {
2274                        chop_len = dummy_flags & ALIGN_SKB_CHOP_LEN_MASK;
2275                        if (chop_len) {
2276                                pkt_prev = pkt_next->prev;
2277                                skb_put(pkt_prev, chop_len);
2278                        }
2279                        __skb_unlink(pkt_next, pktq);
2280                        brcmu_pkt_buf_free_skb(pkt_next);
2281                } else {
2282                        hdr = pkt_next->data + bus->tx_hdrlen - SDPCM_SWHDR_LEN;
2283                        dat_offset = le32_to_cpu(*(__le32 *)hdr);
2284                        dat_offset = (dat_offset & SDPCM_DOFFSET_MASK) >>
2285                                     SDPCM_DOFFSET_SHIFT;
2286                        skb_pull(pkt_next, dat_offset);
2287                        if (bus->txglom) {
2288                                tail_pad = le16_to_cpu(*(__le16 *)(hdr - 2));
2289                                skb_trim(pkt_next, pkt_next->len - tail_pad);
2290                        }
2291                }
2292        }
2293}
2294
2295/* Writes a HW/SW header into the packet and sends it. */
2296/* Assumes: (a) header space already there, (b) caller holds lock */
2297static int brcmf_sdio_txpkt(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
2298                            uint chan)
2299{
2300        int ret;
2301        struct sk_buff *pkt_next, *tmp;
2302
2303        brcmf_dbg(TRACE, "Enter\n");
2304
2305        ret = brcmf_sdio_txpkt_prep(bus, pktq, chan);
2306        if (ret)
2307                goto done;
2308
2309        sdio_claim_host(bus->sdiodev->func1);
2310        ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
2311        bus->sdcnt.f2txdata++;
2312
2313        if (ret < 0)
2314                brcmf_sdio_txfail(bus);
2315
2316        sdio_release_host(bus->sdiodev->func1);
2317
2318done:
2319        brcmf_sdio_txpkt_postp(bus, pktq);
2320        if (ret == 0)
2321                bus->tx_seq = (bus->tx_seq + pktq->qlen) % SDPCM_SEQ_WRAP;
2322        skb_queue_walk_safe(pktq, pkt_next, tmp) {
2323                __skb_unlink(pkt_next, pktq);
2324                brcmf_proto_bcdc_txcomplete(bus->sdiodev->dev, pkt_next,
2325                                            ret == 0);
2326        }
2327        return ret;
2328}
2329
2330static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
2331{
2332        struct sk_buff *pkt;
2333        struct sk_buff_head pktq;
2334        u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
2335        u32 intstatus = 0;
2336        int ret = 0, prec_out, i;
2337        uint cnt = 0;
2338        u8 tx_prec_map, pkt_num;
2339
2340        brcmf_dbg(TRACE, "Enter\n");
2341
2342        tx_prec_map = ~bus->flowcontrol;
2343
2344        /* Send frames until the limit or some other event */
2345        for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
2346                pkt_num = 1;
2347                if (bus->txglom)
2348                        pkt_num = min_t(u8, bus->tx_max - bus->tx_seq,
2349                                        bus->sdiodev->txglomsz);
2350                pkt_num = min_t(u32, pkt_num,
2351                                brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol));
2352                __skb_queue_head_init(&pktq);
2353                spin_lock_bh(&bus->txq_lock);
2354                for (i = 0; i < pkt_num; i++) {
2355                        pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map,
2356                                              &prec_out);
2357                        if (pkt == NULL)
2358                                break;
2359                        __skb_queue_tail(&pktq, pkt);
2360                }
2361                spin_unlock_bh(&bus->txq_lock);
2362                if (i == 0)
2363                        break;
2364
2365                ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
2366
2367                cnt += i;
2368
2369                /* In poll mode, need to check for other events */
2370                if (!bus->intr) {
2371                        /* Check device status, signal pending interrupt */
2372                        sdio_claim_host(bus->sdiodev->func1);
2373                        intstatus = brcmf_sdiod_readl(bus->sdiodev,
2374                                                      intstat_addr, &ret);
2375                        sdio_release_host(bus->sdiodev->func1);
2376
2377                        bus->sdcnt.f2txdata++;
2378                        if (ret != 0)
2379                                break;
2380                        if (intstatus & bus->hostintmask)
2381                                atomic_set(&bus->ipend, 1);
2382                }
2383        }
2384
2385        /* Deflow-control stack if needed */
2386        if ((bus->sdiodev->state == BRCMF_SDIOD_DATA) &&
2387            bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
2388                bus->txoff = false;
2389                brcmf_proto_bcdc_txflowblock(bus->sdiodev->dev, false);
2390        }
2391
2392        return cnt;
2393}
2394
2395static int brcmf_sdio_tx_ctrlframe(struct brcmf_sdio *bus, u8 *frame, u16 len)
2396{
2397        u8 doff;
2398        u16 pad;
2399        uint retries = 0;
2400        struct brcmf_sdio_hdrinfo hd_info = {0};
2401        int ret;
2402
2403        brcmf_dbg(SDIO, "Enter\n");
2404
2405        /* Back the pointer to make room for bus header */
2406        frame -= bus->tx_hdrlen;
2407        len += bus->tx_hdrlen;
2408
2409        /* Add alignment padding (optional for ctl frames) */
2410        doff = ((unsigned long)frame % bus->head_align);
2411        if (doff) {
2412                frame -= doff;
2413                len += doff;
2414                memset(frame + bus->tx_hdrlen, 0, doff);
2415        }
2416
2417        /* Round send length to next SDIO block */
2418        pad = 0;
2419        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2420                pad = bus->blocksize - (len % bus->blocksize);
2421                if ((pad > bus->roundup) || (pad >= bus->blocksize))
2422                        pad = 0;
2423        } else if (len % bus->head_align) {
2424                pad = bus->head_align - (len % bus->head_align);
2425        }
2426        len += pad;
2427
2428        hd_info.len = len - pad;
2429        hd_info.channel = SDPCM_CONTROL_CHANNEL;
2430        hd_info.dat_offset = doff + bus->tx_hdrlen;
2431        hd_info.seq_num = bus->tx_seq;
2432        hd_info.lastfrm = true;
2433        hd_info.tail_pad = pad;
2434        brcmf_sdio_hdpack(bus, frame, &hd_info);
2435
2436        if (bus->txglom)
2437                brcmf_sdio_update_hwhdr(frame, len);
2438
2439        brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
2440                           frame, len, "Tx Frame:\n");
2441        brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
2442                           BRCMF_HDRS_ON(),
2443                           frame, min_t(u16, len, 16), "TxHdr:\n");
2444
2445        do {
2446                ret = brcmf_sdiod_send_buf(bus->sdiodev, frame, len);
2447
2448                if (ret < 0)
2449                        brcmf_sdio_txfail(bus);
2450                else
2451                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
2452        } while (ret < 0 && retries++ < TXRETRIES);
2453
2454        return ret;
2455}
2456
2457static bool brcmf_chip_is_ulp(struct brcmf_chip *ci)
2458{
2459        if (ci->chip == CY_CC_43012_CHIP_ID)
2460                return true;
2461        else
2462                return false;
2463}
2464
2465static void brcmf_sdio_bus_stop(struct device *dev)
2466{
2467        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2468        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2469        struct brcmf_sdio *bus = sdiodev->bus;
2470        struct brcmf_core *core = bus->sdio_core;
2471        u32 local_hostintmask;
2472        u8 saveclk, bpreq;
2473        int err;
2474
2475        brcmf_dbg(TRACE, "Enter\n");
2476
2477        if (bus->watchdog_tsk) {
2478                send_sig(SIGTERM, bus->watchdog_tsk, 1);
2479                kthread_stop(bus->watchdog_tsk);
2480                bus->watchdog_tsk = NULL;
2481        }
2482
2483        if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
2484                sdio_claim_host(sdiodev->func1);
2485
2486                /* Enable clock for device interrupts */
2487                brcmf_sdio_bus_sleep(bus, false, false);
2488
2489                /* Disable and clear interrupts at the chip level also */
2490                brcmf_sdiod_writel(sdiodev, core->base + SD_REG(hostintmask),
2491                                   0, NULL);
2492
2493                local_hostintmask = bus->hostintmask;
2494                bus->hostintmask = 0;
2495
2496                /* Force backplane clocks to assure F2 interrupt propagates */
2497                saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
2498                                            &err);
2499                if (!err) {
2500                        bpreq = saveclk;
2501                        bpreq |= brcmf_chip_is_ulp(bus->ci) ?
2502                                SBSDIO_HT_AVAIL_REQ : SBSDIO_FORCE_HT;
2503                        brcmf_sdiod_writeb(sdiodev,
2504                                           SBSDIO_FUNC1_CHIPCLKCSR,
2505                                           bpreq, &err);
2506                }
2507                if (err)
2508                        brcmf_err("Failed to force clock for F2: err %d\n",
2509                                  err);
2510
2511                /* Turn off the bus (F2), free any pending packets */
2512                brcmf_dbg(INTR, "disable SDIO interrupts\n");
2513                sdio_disable_func(sdiodev->func2);
2514
2515                /* Clear any pending interrupts now that F2 is disabled */
2516                brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
2517                                   local_hostintmask, NULL);
2518
2519                sdio_release_host(sdiodev->func1);
2520        }
2521        /* Clear the data packet queues */
2522        brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2523
2524        /* Clear any held glomming stuff */
2525        brcmu_pkt_buf_free_skb(bus->glomd);
2526        brcmf_sdio_free_glom(bus);
2527
2528        /* Clear rx control and wake any waiters */
2529        spin_lock_bh(&bus->rxctl_lock);
2530        bus->rxlen = 0;
2531        spin_unlock_bh(&bus->rxctl_lock);
2532        brcmf_sdio_dcmd_resp_wake(bus);
2533
2534        /* Reset some F2 state stuff */
2535        bus->rxskip = false;
2536        bus->tx_seq = bus->rx_seq = 0;
2537}
2538
2539static inline void brcmf_sdio_clrintr(struct brcmf_sdio *bus)
2540{
2541        struct brcmf_sdio_dev *sdiodev;
2542        unsigned long flags;
2543
2544        sdiodev = bus->sdiodev;
2545        if (sdiodev->oob_irq_requested) {
2546                spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
2547                if (!sdiodev->irq_en && !atomic_read(&bus->ipend)) {
2548                        enable_irq(sdiodev->settings->bus.sdio.oob_irq_nr);
2549                        sdiodev->irq_en = true;
2550                }
2551                spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
2552        }
2553}
2554
2555static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
2556{
2557        struct brcmf_core *core = bus->sdio_core;
2558        u32 addr;
2559        unsigned long val;
2560        int ret;
2561
2562        addr = core->base + SD_REG(intstatus);
2563
2564        val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
2565        bus->sdcnt.f1regdata++;
2566        if (ret != 0)
2567                return ret;
2568
2569        val &= bus->hostintmask;
2570        atomic_set(&bus->fcstate, !!(val & I_HMB_FC_STATE));
2571
2572        /* Clear interrupts */
2573        if (val) {
2574                brcmf_sdiod_writel(bus->sdiodev, addr, val, &ret);
2575                bus->sdcnt.f1regdata++;
2576                atomic_or(val, &bus->intstatus);
2577        }
2578
2579        return ret;
2580}
2581
2582static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
2583{
2584        struct brcmf_sdio_dev *sdiod = bus->sdiodev;
2585        u32 newstatus = 0;
2586        u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
2587        unsigned long intstatus;
2588        uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2589        uint framecnt;                  /* Temporary counter of tx/rx frames */
2590        int err = 0;
2591
2592        brcmf_dbg(SDIO, "Enter\n");
2593
2594        sdio_claim_host(bus->sdiodev->func1);
2595
2596        /* If waiting for HTAVAIL, check status */
2597        if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
2598                u8 clkctl, devctl = 0;
2599
2600#ifdef DEBUG
2601                /* Check for inconsistent device control */
2602                devctl = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_DEVICE_CTL,
2603                                           &err);
2604#endif                          /* DEBUG */
2605
2606                /* Read CSR, if clock on switch to AVAIL, else ignore */
2607                clkctl = brcmf_sdiod_readb(bus->sdiodev,
2608                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
2609
2610                brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2611                          devctl, clkctl);
2612
2613                if (SBSDIO_HTAV(clkctl)) {
2614                        devctl = brcmf_sdiod_readb(bus->sdiodev,
2615                                                   SBSDIO_DEVICE_CTL, &err);
2616                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2617                        brcmf_sdiod_writeb(bus->sdiodev,
2618                                           SBSDIO_DEVICE_CTL, devctl, &err);
2619                        bus->clkstate = CLK_AVAIL;
2620                }
2621        }
2622
2623        /* Make sure backplane clock is on */
2624        brcmf_sdio_bus_sleep(bus, false, true);
2625
2626        /* Pending interrupt indicates new device status */
2627        if (atomic_read(&bus->ipend) > 0) {
2628                atomic_set(&bus->ipend, 0);
2629                err = brcmf_sdio_intr_rstatus(bus);
2630        }
2631
2632        /* Start with leftover status bits */
2633        intstatus = atomic_xchg(&bus->intstatus, 0);
2634
2635        /* Handle flow-control change: read new state in case our ack
2636         * crossed another change interrupt.  If change still set, assume
2637         * FC ON for safety, let next loop through do the debounce.
2638         */
2639        if (intstatus & I_HMB_FC_CHANGE) {
2640                intstatus &= ~I_HMB_FC_CHANGE;
2641                brcmf_sdiod_writel(sdiod, intstat_addr, I_HMB_FC_CHANGE, &err);
2642
2643                newstatus = brcmf_sdiod_readl(sdiod, intstat_addr, &err);
2644
2645                bus->sdcnt.f1regdata += 2;
2646                atomic_set(&bus->fcstate,
2647                           !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
2648                intstatus |= (newstatus & bus->hostintmask);
2649        }
2650
2651        /* Handle host mailbox indication */
2652        if (intstatus & I_HMB_HOST_INT) {
2653                intstatus &= ~I_HMB_HOST_INT;
2654                intstatus |= brcmf_sdio_hostmail(bus);
2655        }
2656
2657        sdio_release_host(bus->sdiodev->func1);
2658
2659        /* Generally don't ask for these, can get CRC errors... */
2660        if (intstatus & I_WR_OOSYNC) {
2661                brcmf_err("Dongle reports WR_OOSYNC\n");
2662                intstatus &= ~I_WR_OOSYNC;
2663        }
2664
2665        if (intstatus & I_RD_OOSYNC) {
2666                brcmf_err("Dongle reports RD_OOSYNC\n");
2667                intstatus &= ~I_RD_OOSYNC;
2668        }
2669
2670        if (intstatus & I_SBINT) {
2671                brcmf_err("Dongle reports SBINT\n");
2672                intstatus &= ~I_SBINT;
2673        }
2674
2675        /* Would be active due to wake-wlan in gSPI */
2676        if (intstatus & I_CHIPACTIVE) {
2677                brcmf_dbg(SDIO, "Dongle reports CHIPACTIVE\n");
2678                intstatus &= ~I_CHIPACTIVE;
2679        }
2680
2681        /* Ignore frame indications if rxskip is set */
2682        if (bus->rxskip)
2683                intstatus &= ~I_HMB_FRAME_IND;
2684
2685        /* On frame indication, read available frames */
2686        if ((intstatus & I_HMB_FRAME_IND) && (bus->clkstate == CLK_AVAIL)) {
2687                brcmf_sdio_readframes(bus, bus->rxbound);
2688                if (!bus->rxpending)
2689                        intstatus &= ~I_HMB_FRAME_IND;
2690        }
2691
2692        /* Keep still-pending events for next scheduling */
2693        if (intstatus)
2694                atomic_or(intstatus, &bus->intstatus);
2695
2696        brcmf_sdio_clrintr(bus);
2697
2698        if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
2699            txctl_ok(bus)) {
2700                sdio_claim_host(bus->sdiodev->func1);
2701                if (bus->ctrl_frame_stat) {
2702                        err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
2703                                                      bus->ctrl_frame_len);
2704                        bus->ctrl_frame_err = err;
2705                        wmb();
2706                        bus->ctrl_frame_stat = false;
2707                        if (err)
2708                                brcmf_err("sdio ctrlframe tx failed err=%d\n",
2709                                          err);
2710                }
2711                sdio_release_host(bus->sdiodev->func1);
2712                brcmf_sdio_wait_event_wakeup(bus);
2713        }
2714        /* Send queued frames (limit 1 if rx may still be pending) */
2715        if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
2716            brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit &&
2717            data_ok(bus)) {
2718                framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
2719                                            txlimit;
2720                brcmf_sdio_sendfromq(bus, framecnt);
2721        }
2722
2723        if ((bus->sdiodev->state != BRCMF_SDIOD_DATA) || (err != 0)) {
2724                brcmf_err("failed backplane access over SDIO, halting operation\n");
2725                atomic_set(&bus->intstatus, 0);
2726                if (bus->ctrl_frame_stat) {
2727                        sdio_claim_host(bus->sdiodev->func1);
2728                        if (bus->ctrl_frame_stat) {
2729                                bus->ctrl_frame_err = -ENODEV;
2730                                wmb();
2731                                bus->ctrl_frame_stat = false;
2732                                brcmf_sdio_wait_event_wakeup(bus);
2733                        }
2734                        sdio_release_host(bus->sdiodev->func1);
2735                }
2736        } else if (atomic_read(&bus->intstatus) ||
2737                   atomic_read(&bus->ipend) > 0 ||
2738                   (!atomic_read(&bus->fcstate) &&
2739                    brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
2740                    data_ok(bus))) {
2741                bus->dpc_triggered = true;
2742        }
2743}
2744
2745static struct pktq *brcmf_sdio_bus_gettxq(struct device *dev)
2746{
2747        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2748        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2749        struct brcmf_sdio *bus = sdiodev->bus;
2750
2751        return &bus->txq;
2752}
2753
2754static bool brcmf_sdio_prec_enq(struct pktq *q, struct sk_buff *pkt, int prec)
2755{
2756        struct sk_buff *p;
2757        int eprec = -1;         /* precedence to evict from */
2758
2759        /* Fast case, precedence queue is not full and we are also not
2760         * exceeding total queue length
2761         */
2762        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
2763                brcmu_pktq_penq(q, prec, pkt);
2764                return true;
2765        }
2766
2767        /* Determine precedence from which to evict packet, if any */
2768        if (pktq_pfull(q, prec)) {
2769                eprec = prec;
2770        } else if (pktq_full(q)) {
2771                p = brcmu_pktq_peek_tail(q, &eprec);
2772                if (eprec > prec)
2773                        return false;
2774        }
2775
2776        /* Evict if needed */
2777        if (eprec >= 0) {
2778                /* Detect queueing to unconfigured precedence */
2779                if (eprec == prec)
2780                        return false;   /* refuse newer (incoming) packet */
2781                /* Evict packet according to discard policy */
2782                p = brcmu_pktq_pdeq_tail(q, eprec);
2783                if (p == NULL)
2784                        brcmf_err("brcmu_pktq_pdeq_tail() failed\n");
2785                brcmu_pkt_buf_free_skb(p);
2786        }
2787
2788        /* Enqueue */
2789        p = brcmu_pktq_penq(q, prec, pkt);
2790        if (p == NULL)
2791                brcmf_err("brcmu_pktq_penq() failed\n");
2792
2793        return p != NULL;
2794}
2795
2796static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
2797{
2798        int ret = -EBADE;
2799        uint prec;
2800        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2801        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2802        struct brcmf_sdio *bus = sdiodev->bus;
2803
2804        brcmf_dbg(TRACE, "Enter: pkt: data %p len %d\n", pkt->data, pkt->len);
2805        if (sdiodev->state != BRCMF_SDIOD_DATA)
2806                return -EIO;
2807
2808        /* Add space for the header */
2809        skb_push(pkt, bus->tx_hdrlen);
2810        /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2811
2812        /* In WLAN, priority is always set by the AP using WMM parameters
2813         * and this need not always follow the standard 802.1d priority.
2814         * Based on AP WMM config, map from 802.1d priority to corresponding
2815         * precedence level.
2816         */
2817        prec = brcmf_map_prio_to_prec(bus_if->drvr->config,
2818                                      (pkt->priority & PRIOMASK));
2819
2820        /* Check for existing queue, current flow-control,
2821                         pending event, or pending clock */
2822        brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2823        bus->sdcnt.fcqueued++;
2824
2825        /* Priority based enq */
2826        spin_lock_bh(&bus->txq_lock);
2827        /* reset bus_flags in packet cb */
2828        *(u16 *)(pkt->cb) = 0;
2829        if (!brcmf_sdio_prec_enq(&bus->txq, pkt, prec)) {
2830                skb_pull(pkt, bus->tx_hdrlen);
2831                brcmf_err("out of bus->txq !!!\n");
2832                ret = -ENOSR;
2833        } else {
2834                ret = 0;
2835        }
2836
2837        if (pktq_len(&bus->txq) >= TXHI) {
2838                bus->txoff = true;
2839                brcmf_proto_bcdc_txflowblock(dev, true);
2840        }
2841        spin_unlock_bh(&bus->txq_lock);
2842
2843#ifdef DEBUG
2844        if (pktq_plen(&bus->txq, prec) > qcount[prec])
2845                qcount[prec] = pktq_plen(&bus->txq, prec);
2846#endif
2847
2848        brcmf_sdio_trigger_dpc(bus);
2849        return ret;
2850}
2851
2852#ifdef DEBUG
2853#define CONSOLE_LINE_MAX        192
2854
2855static int brcmf_sdio_readconsole(struct brcmf_sdio *bus)
2856{
2857        struct brcmf_console *c = &bus->console;
2858        u8 line[CONSOLE_LINE_MAX], ch;
2859        u32 n, idx, addr;
2860        int rv;
2861
2862        /* Don't do anything until FWREADY updates console address */
2863        if (bus->console_addr == 0)
2864                return 0;
2865
2866        /* Read console log struct */
2867        addr = bus->console_addr + offsetof(struct rte_console, log_le);
2868        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&c->log_le,
2869                               sizeof(c->log_le));
2870        if (rv < 0)
2871                return rv;
2872
2873        /* Allocate console buffer (one time only) */
2874        if (c->buf == NULL) {
2875                c->bufsize = le32_to_cpu(c->log_le.buf_size);
2876                c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2877                if (c->buf == NULL)
2878                        return -ENOMEM;
2879        }
2880
2881        idx = le32_to_cpu(c->log_le.idx);
2882
2883        /* Protect against corrupt value */
2884        if (idx > c->bufsize)
2885                return -EBADE;
2886
2887        /* Skip reading the console buffer if the index pointer
2888         has not moved */
2889        if (idx == c->last)
2890                return 0;
2891
2892        /* Read the console buffer */
2893        addr = le32_to_cpu(c->log_le.buf);
2894        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
2895        if (rv < 0)
2896                return rv;
2897
2898        while (c->last != idx) {
2899                for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2900                        if (c->last == idx) {
2901                                /* This would output a partial line.
2902                                 * Instead, back up
2903                                 * the buffer pointer and output this
2904                                 * line next time around.
2905                                 */
2906                                if (c->last >= n)
2907                                        c->last -= n;
2908                                else
2909                                        c->last = c->bufsize - n;
2910                                goto break2;
2911                        }
2912                        ch = c->buf[c->last];
2913                        c->last = (c->last + 1) % c->bufsize;
2914                        if (ch == '\n')
2915                                break;
2916                        line[n] = ch;
2917                }
2918
2919                if (n > 0) {
2920                        if (line[n - 1] == '\r')
2921                                n--;
2922                        line[n] = 0;
2923                        pr_debug("CONSOLE: %s\n", line);
2924                }
2925        }
2926break2:
2927
2928        return 0;
2929}
2930#endif                          /* DEBUG */
2931
2932static int
2933brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2934{
2935        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2936        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2937        struct brcmf_sdio *bus = sdiodev->bus;
2938        int ret;
2939
2940        brcmf_dbg(TRACE, "Enter\n");
2941        if (sdiodev->state != BRCMF_SDIOD_DATA)
2942                return -EIO;
2943
2944        /* Send from dpc */
2945        bus->ctrl_frame_buf = msg;
2946        bus->ctrl_frame_len = msglen;
2947        wmb();
2948        bus->ctrl_frame_stat = true;
2949
2950        brcmf_sdio_trigger_dpc(bus);
2951        wait_event_interruptible_timeout(bus->ctrl_wait, !bus->ctrl_frame_stat,
2952                                         CTL_DONE_TIMEOUT);
2953        ret = 0;
2954        if (bus->ctrl_frame_stat) {
2955                sdio_claim_host(bus->sdiodev->func1);
2956                if (bus->ctrl_frame_stat) {
2957                        brcmf_dbg(SDIO, "ctrl_frame timeout\n");
2958                        bus->ctrl_frame_stat = false;
2959                        ret = -ETIMEDOUT;
2960                }
2961                sdio_release_host(bus->sdiodev->func1);
2962        }
2963        if (!ret) {
2964                brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
2965                          bus->ctrl_frame_err);
2966                rmb();
2967                ret = bus->ctrl_frame_err;
2968        }
2969
2970        if (ret)
2971                bus->sdcnt.tx_ctlerrs++;
2972        else
2973                bus->sdcnt.tx_ctlpkts++;
2974
2975        return ret;
2976}
2977
2978#ifdef DEBUG
2979static int brcmf_sdio_dump_console(struct seq_file *seq, struct brcmf_sdio *bus,
2980                                   struct sdpcm_shared *sh)
2981{
2982        u32 addr, console_ptr, console_size, console_index;
2983        char *conbuf = NULL;
2984        __le32 sh_val;
2985        int rv;
2986
2987        /* obtain console information from device memory */
2988        addr = sh->console_addr + offsetof(struct rte_console, log_le);
2989        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
2990                               (u8 *)&sh_val, sizeof(u32));
2991        if (rv < 0)
2992                return rv;
2993        console_ptr = le32_to_cpu(sh_val);
2994
2995        addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
2996        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
2997                               (u8 *)&sh_val, sizeof(u32));
2998        if (rv < 0)
2999                return rv;
3000        console_size = le32_to_cpu(sh_val);
3001
3002        addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
3003        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
3004                               (u8 *)&sh_val, sizeof(u32));
3005        if (rv < 0)
3006                return rv;
3007        console_index = le32_to_cpu(sh_val);
3008
3009        /* allocate buffer for console data */
3010        if (console_size <= CONSOLE_BUFFER_MAX)
3011                conbuf = vzalloc(console_size+1);
3012
3013        if (!conbuf)
3014                return -ENOMEM;
3015
3016        /* obtain the console data from device */
3017        conbuf[console_size] = '\0';
3018        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, console_ptr, (u8 *)conbuf,
3019                               console_size);
3020        if (rv < 0)
3021                goto done;
3022
3023        rv = seq_write(seq, conbuf + console_index,
3024                       console_size - console_index);
3025        if (rv < 0)
3026                goto done;
3027
3028        if (console_index > 0)
3029                rv = seq_write(seq, conbuf, console_index - 1);
3030
3031done:
3032        vfree(conbuf);
3033        return rv;
3034}
3035
3036static int brcmf_sdio_trap_info(struct seq_file *seq, struct brcmf_sdio *bus,
3037                                struct sdpcm_shared *sh)
3038{
3039        int error;
3040        struct brcmf_trap_info tr;
3041
3042        if ((sh->flags & SDPCM_SHARED_TRAP) == 0) {
3043                brcmf_dbg(INFO, "no trap in firmware\n");
3044                return 0;
3045        }
3046
3047        error = brcmf_sdiod_ramrw(bus->sdiodev, false, sh->trap_addr, (u8 *)&tr,
3048                                  sizeof(struct brcmf_trap_info));
3049        if (error < 0)
3050                return error;
3051
3052        if (seq)
3053                seq_printf(seq,
3054                           "dongle trap info: type 0x%x @ epc 0x%08x\n"
3055                           "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
3056                           "  lr   0x%08x pc   0x%08x offset 0x%x\n"
3057                           "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
3058                           "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
3059                           le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
3060                           le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
3061                           le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
3062                           le32_to_cpu(tr.pc), sh->trap_addr,
3063                           le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
3064                           le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
3065                           le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
3066                           le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
3067        else
3068                pr_debug("dongle trap info: type 0x%x @ epc 0x%08x\n"
3069                         "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
3070                         "  lr   0x%08x pc   0x%08x offset 0x%x\n"
3071                         "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
3072                         "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
3073                         le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
3074                         le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
3075                         le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
3076                         le32_to_cpu(tr.pc), sh->trap_addr,
3077                         le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
3078                         le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
3079                         le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
3080                         le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
3081        return 0;
3082}
3083
3084static int brcmf_sdio_assert_info(struct seq_file *seq, struct brcmf_sdio *bus,
3085                                  struct sdpcm_shared *sh)
3086{
3087        int error = 0;
3088        char file[80] = "?";
3089        char expr[80] = "<???>";
3090
3091        if ((sh->flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
3092                brcmf_dbg(INFO, "firmware not built with -assert\n");
3093                return 0;
3094        } else if ((sh->flags & SDPCM_SHARED_ASSERT) == 0) {
3095                brcmf_dbg(INFO, "no assert in dongle\n");
3096                return 0;
3097        }
3098
3099        sdio_claim_host(bus->sdiodev->func1);
3100        if (sh->assert_file_addr != 0) {
3101                error = brcmf_sdiod_ramrw(bus->sdiodev, false,
3102                                          sh->assert_file_addr, (u8 *)file, 80);
3103                if (error < 0)
3104                        return error;
3105        }
3106        if (sh->assert_exp_addr != 0) {
3107                error = brcmf_sdiod_ramrw(bus->sdiodev, false,
3108                                          sh->assert_exp_addr, (u8 *)expr, 80);
3109                if (error < 0)
3110                        return error;
3111        }
3112        sdio_release_host(bus->sdiodev->func1);
3113
3114        seq_printf(seq, "dongle assert: %s:%d: assert(%s)\n",
3115                   file, sh->assert_line, expr);
3116        return 0;
3117}
3118
3119static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
3120{
3121        int error;
3122        struct sdpcm_shared sh;
3123
3124        error = brcmf_sdio_readshared(bus, &sh);
3125
3126        if (error < 0)
3127                return error;
3128
3129        if ((sh.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
3130                brcmf_dbg(INFO, "firmware not built with -assert\n");
3131        else if (sh.flags & SDPCM_SHARED_ASSERT)
3132                brcmf_err("assertion in dongle\n");
3133
3134        if (sh.flags & SDPCM_SHARED_TRAP) {
3135                brcmf_err("firmware trap in dongle\n");
3136                brcmf_sdio_trap_info(NULL, bus, &sh);
3137        }
3138
3139        return 0;
3140}
3141
3142static int brcmf_sdio_died_dump(struct seq_file *seq, struct brcmf_sdio *bus)
3143{
3144        int error = 0;
3145        struct sdpcm_shared sh;
3146
3147        error = brcmf_sdio_readshared(bus, &sh);
3148        if (error < 0)
3149                goto done;
3150
3151        error = brcmf_sdio_assert_info(seq, bus, &sh);
3152        if (error < 0)
3153                goto done;
3154
3155        error = brcmf_sdio_trap_info(seq, bus, &sh);
3156        if (error < 0)
3157                goto done;
3158
3159        error = brcmf_sdio_dump_console(seq, bus, &sh);
3160
3161done:
3162        return error;
3163}
3164
3165static int brcmf_sdio_forensic_read(struct seq_file *seq, void *data)
3166{
3167        struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
3168        struct brcmf_sdio *bus = bus_if->bus_priv.sdio->bus;
3169
3170        return brcmf_sdio_died_dump(seq, bus);
3171}
3172
3173static int brcmf_debugfs_sdio_count_read(struct seq_file *seq, void *data)
3174{
3175        struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
3176        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3177        struct brcmf_sdio_count *sdcnt = &sdiodev->bus->sdcnt;
3178
3179        seq_printf(seq,
3180                   "intrcount:    %u\nlastintrs:    %u\n"
3181                   "pollcnt:      %u\nregfails:     %u\n"
3182                   "tx_sderrs:    %u\nfcqueued:     %u\n"
3183                   "rxrtx:        %u\nrx_toolong:   %u\n"
3184                   "rxc_errors:   %u\nrx_hdrfail:   %u\n"
3185                   "rx_badhdr:    %u\nrx_badseq:    %u\n"
3186                   "fc_rcvd:      %u\nfc_xoff:      %u\n"
3187                   "fc_xon:       %u\nrxglomfail:   %u\n"
3188                   "rxglomframes: %u\nrxglompkts:   %u\n"
3189                   "f2rxhdrs:     %u\nf2rxdata:     %u\n"
3190                   "f2txdata:     %u\nf1regdata:    %u\n"
3191                   "tickcnt:      %u\ntx_ctlerrs:   %lu\n"
3192                   "tx_ctlpkts:   %lu\nrx_ctlerrs:   %lu\n"
3193                   "rx_ctlpkts:   %lu\nrx_readahead: %lu\n",
3194                   sdcnt->intrcount, sdcnt->lastintrs,
3195                   sdcnt->pollcnt, sdcnt->regfails,
3196                   sdcnt->tx_sderrs, sdcnt->fcqueued,
3197                   sdcnt->rxrtx, sdcnt->rx_toolong,
3198                   sdcnt->rxc_errors, sdcnt->rx_hdrfail,
3199                   sdcnt->rx_badhdr, sdcnt->rx_badseq,
3200                   sdcnt->fc_rcvd, sdcnt->fc_xoff,
3201                   sdcnt->fc_xon, sdcnt->rxglomfail,
3202                   sdcnt->rxglomframes, sdcnt->rxglompkts,
3203                   sdcnt->f2rxhdrs, sdcnt->f2rxdata,
3204                   sdcnt->f2txdata, sdcnt->f1regdata,
3205                   sdcnt->tickcnt, sdcnt->tx_ctlerrs,
3206                   sdcnt->tx_ctlpkts, sdcnt->rx_ctlerrs,
3207                   sdcnt->rx_ctlpkts, sdcnt->rx_readahead_cnt);
3208
3209        return 0;
3210}
3211
3212static void brcmf_sdio_debugfs_create(struct device *dev)
3213{
3214        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3215        struct brcmf_pub *drvr = bus_if->drvr;
3216        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3217        struct brcmf_sdio *bus = sdiodev->bus;
3218        struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
3219
3220        if (IS_ERR_OR_NULL(dentry))
3221                return;
3222
3223        bus->console_interval = BRCMF_CONSOLE;
3224
3225        brcmf_debugfs_add_entry(drvr, "forensics", brcmf_sdio_forensic_read);
3226        brcmf_debugfs_add_entry(drvr, "counters",
3227                                brcmf_debugfs_sdio_count_read);
3228        debugfs_create_u32("console_interval", 0644, dentry,
3229                           &bus->console_interval);
3230}
3231#else
3232static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
3233{
3234        return 0;
3235}
3236
3237static void brcmf_sdio_debugfs_create(struct device *dev)
3238{
3239}
3240#endif /* DEBUG */
3241
3242static int
3243brcmf_sdio_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
3244{
3245        int timeleft;
3246        uint rxlen = 0;
3247        bool pending;
3248        u8 *buf;
3249        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3250        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3251        struct brcmf_sdio *bus = sdiodev->bus;
3252
3253        brcmf_dbg(TRACE, "Enter\n");
3254        if (sdiodev->state != BRCMF_SDIOD_DATA)
3255                return -EIO;
3256
3257        /* Wait until control frame is available */
3258        timeleft = brcmf_sdio_dcmd_resp_wait(bus, &bus->rxlen, &pending);
3259
3260        spin_lock_bh(&bus->rxctl_lock);
3261        rxlen = bus->rxlen;
3262        memcpy(msg, bus->rxctl, min(msglen, rxlen));
3263        bus->rxctl = NULL;
3264        buf = bus->rxctl_orig;
3265        bus->rxctl_orig = NULL;
3266        bus->rxlen = 0;
3267        spin_unlock_bh(&bus->rxctl_lock);
3268        vfree(buf);
3269
3270        if (rxlen) {
3271                brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
3272                          rxlen, msglen);
3273        } else if (timeleft == 0) {
3274                brcmf_err("resumed on timeout\n");
3275                brcmf_sdio_checkdied(bus);
3276        } else if (pending) {
3277                brcmf_dbg(CTL, "cancelled\n");
3278                return -ERESTARTSYS;
3279        } else {
3280                brcmf_dbg(CTL, "resumed for unknown reason?\n");
3281                brcmf_sdio_checkdied(bus);
3282        }
3283
3284        if (rxlen)
3285                bus->sdcnt.rx_ctlpkts++;
3286        else
3287                bus->sdcnt.rx_ctlerrs++;
3288
3289        return rxlen ? (int)rxlen : -ETIMEDOUT;
3290}
3291
3292#ifdef DEBUG
3293static bool
3294brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
3295                        u8 *ram_data, uint ram_sz)
3296{
3297        char *ram_cmp;
3298        int err;
3299        bool ret = true;
3300        int address;
3301        int offset;
3302        int len;
3303
3304        /* read back and verify */
3305        brcmf_dbg(INFO, "Compare RAM dl & ul at 0x%08x; size=%d\n", ram_addr,
3306                  ram_sz);
3307        ram_cmp = kmalloc(MEMBLOCK, GFP_KERNEL);
3308        /* do not proceed while no memory but  */
3309        if (!ram_cmp)
3310                return true;
3311
3312        address = ram_addr;
3313        offset = 0;
3314        while (offset < ram_sz) {
3315                len = ((offset + MEMBLOCK) < ram_sz) ? MEMBLOCK :
3316                      ram_sz - offset;
3317                err = brcmf_sdiod_ramrw(sdiodev, false, address, ram_cmp, len);
3318                if (err) {
3319                        brcmf_err("error %d on reading %d membytes at 0x%08x\n",
3320                                  err, len, address);
3321                        ret = false;
3322                        break;
3323                } else if (memcmp(ram_cmp, &ram_data[offset], len)) {
3324                        brcmf_err("Downloaded RAM image is corrupted, block offset is %d, len is %d\n",
3325                                  offset, len);
3326                        ret = false;
3327                        break;
3328                }
3329                offset += len;
3330                address += len;
3331        }
3332
3333        kfree(ram_cmp);
3334
3335        return ret;
3336}
3337#else   /* DEBUG */
3338static bool
3339brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
3340                        u8 *ram_data, uint ram_sz)
3341{
3342        return true;
3343}
3344#endif  /* DEBUG */
3345
3346static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus,
3347                                         const struct firmware *fw)
3348{
3349        int err;
3350
3351        brcmf_dbg(TRACE, "Enter\n");
3352
3353        err = brcmf_sdiod_ramrw(bus->sdiodev, true, bus->ci->rambase,
3354                                (u8 *)fw->data, fw->size);
3355        if (err)
3356                brcmf_err("error %d on writing %d membytes at 0x%08x\n",
3357                          err, (int)fw->size, bus->ci->rambase);
3358        else if (!brcmf_sdio_verifymemory(bus->sdiodev, bus->ci->rambase,
3359                                          (u8 *)fw->data, fw->size))
3360                err = -EIO;
3361
3362        return err;
3363}
3364
3365static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus,
3366                                     void *vars, u32 varsz)
3367{
3368        int address;
3369        int err;
3370
3371        brcmf_dbg(TRACE, "Enter\n");
3372
3373        address = bus->ci->ramsize - varsz + bus->ci->rambase;
3374        err = brcmf_sdiod_ramrw(bus->sdiodev, true, address, vars, varsz);
3375        if (err)
3376                brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
3377                          err, varsz, address);
3378        else if (!brcmf_sdio_verifymemory(bus->sdiodev, address, vars, varsz))
3379                err = -EIO;
3380
3381        return err;
3382}
3383
3384static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
3385                                        const struct firmware *fw,
3386                                        void *nvram, u32 nvlen)
3387{
3388        int bcmerror;
3389        u32 rstvec;
3390
3391        sdio_claim_host(bus->sdiodev->func1);
3392        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
3393
3394        rstvec = get_unaligned_le32(fw->data);
3395        brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
3396
3397        bcmerror = brcmf_sdio_download_code_file(bus, fw);
3398        release_firmware(fw);
3399        if (bcmerror) {
3400                brcmf_err("dongle image file download failed\n");
3401                brcmf_fw_nvram_free(nvram);
3402                goto err;
3403        }
3404
3405        bcmerror = brcmf_sdio_download_nvram(bus, nvram, nvlen);
3406        brcmf_fw_nvram_free(nvram);
3407        if (bcmerror) {
3408                brcmf_err("dongle nvram file download failed\n");
3409                goto err;
3410        }
3411
3412        /* Take arm out of reset */
3413        if (!brcmf_chip_set_active(bus->ci, rstvec)) {
3414                brcmf_err("error getting out of ARM core reset\n");
3415                goto err;
3416        }
3417
3418err:
3419        brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
3420        sdio_release_host(bus->sdiodev->func1);
3421        return bcmerror;
3422}
3423
3424static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
3425{
3426        if (bus->ci->chip == CY_CC_43012_CHIP_ID ||
3427            bus->ci->chip == CY_CC_43752_CHIP_ID)
3428                return true;
3429        else
3430                return false;
3431}
3432
3433static void brcmf_sdio_sr_init(struct brcmf_sdio *bus)
3434{
3435        int err = 0;
3436        u8 val;
3437        u8 wakeupctrl;
3438        u8 cardcap;
3439        u8 chipclkcsr;
3440
3441        brcmf_dbg(TRACE, "Enter\n");
3442
3443        if (brcmf_chip_is_ulp(bus->ci)) {
3444                wakeupctrl = SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT;
3445                chipclkcsr = SBSDIO_HT_AVAIL_REQ;
3446        } else {
3447                wakeupctrl = SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
3448                chipclkcsr = SBSDIO_FORCE_HT;
3449        }
3450
3451        if (brcmf_sdio_aos_no_decode(bus)) {
3452                cardcap = SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC;
3453        } else {
3454                cardcap = (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
3455                           SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT);
3456        }
3457
3458        val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
3459        if (err) {
3460                brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
3461                return;
3462        }
3463        val |= 1 << wakeupctrl;
3464        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
3465        if (err) {
3466                brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
3467                return;
3468        }
3469
3470        /* Add CMD14 Support */
3471        brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
3472                             cardcap,
3473                             &err);
3474        if (err) {
3475                brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
3476                return;
3477        }
3478
3479        brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3480                           chipclkcsr, &err);
3481        if (err) {
3482                brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
3483                return;
3484        }
3485
3486        /* set flag */
3487        bus->sr_enabled = true;
3488        brcmf_dbg(INFO, "SR enabled\n");
3489}
3490
3491/* enable KSO bit */
3492static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
3493{
3494        struct brcmf_core *core = bus->sdio_core;
3495        u8 val;
3496        int err = 0;
3497
3498        brcmf_dbg(TRACE, "Enter\n");
3499
3500        /* KSO bit added in SDIO core rev 12 */
3501        if (core->rev < 12)
3502                return 0;
3503
3504        val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
3505        if (err) {
3506                brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
3507                return err;
3508        }
3509
3510        if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
3511                val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
3512                        SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
3513                brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
3514                                   val, &err);
3515                if (err) {
3516                        brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
3517                        return err;
3518                }
3519        }
3520
3521        return 0;
3522}
3523
3524
3525static int brcmf_sdio_bus_preinit(struct device *dev)
3526{
3527        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3528        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3529        struct brcmf_sdio *bus = sdiodev->bus;
3530        struct brcmf_core *core = bus->sdio_core;
3531        u32 value;
3532        __le32 iovar;
3533        int err;
3534
3535        /* maxctl provided by common layer */
3536        if (WARN_ON(!bus_if->maxctl))
3537                return -EINVAL;
3538
3539        /* Allocate control receive buffer */
3540        bus_if->maxctl += bus->roundup;
3541        value = roundup((bus_if->maxctl + SDPCM_HDRLEN), ALIGNMENT);
3542        value += bus->head_align;
3543        bus->rxbuf = kmalloc(value, GFP_ATOMIC);
3544        if (bus->rxbuf)
3545                bus->rxblen = value;
3546
3547        /* the commands below use the terms tx and rx from
3548         * a device perspective, ie. bus:txglom affects the
3549         * bus transfers from device to host.
3550         */
3551        if (core->rev < 12) {
3552                /* for sdio core rev < 12, disable txgloming */
3553                iovar = 0;
3554                err = brcmf_iovar_data_set(dev, "bus:txglom", &iovar,
3555                                           sizeof(iovar));
3556        } else {
3557                /* otherwise, set txglomalign */
3558                value = sdiodev->settings->bus.sdio.sd_sgentry_align;
3559                /* SDIO ADMA requires at least 32 bit alignment */
3560                iovar = cpu_to_le32(max_t(u32, value, ALIGNMENT));
3561                err = brcmf_iovar_data_set(dev, "bus:txglomalign", &iovar,
3562                                           sizeof(iovar));
3563        }
3564
3565        if (err < 0)
3566                goto done;
3567
3568        bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
3569        if (sdiodev->sg_support) {
3570                bus->txglom = false;
3571                iovar = cpu_to_le32(1);
3572                err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
3573                                           &iovar, sizeof(iovar));
3574                if (err < 0) {
3575                        /* bus:rxglom is allowed to fail */
3576                        err = 0;
3577                } else {
3578                        bus->txglom = true;
3579                        bus->tx_hdrlen += SDPCM_HWEXT_LEN;
3580                }
3581        }
3582        brcmf_bus_add_txhdrlen(bus->sdiodev->dev, bus->tx_hdrlen);
3583
3584done:
3585        return err;
3586}
3587
3588static size_t brcmf_sdio_bus_get_ramsize(struct device *dev)
3589{
3590        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3591        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3592        struct brcmf_sdio *bus = sdiodev->bus;
3593
3594        return bus->ci->ramsize - bus->ci->srsize;
3595}
3596
3597static int brcmf_sdio_bus_get_memdump(struct device *dev, void *data,
3598                                      size_t mem_size)
3599{
3600        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3601        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3602        struct brcmf_sdio *bus = sdiodev->bus;
3603        int err;
3604        int address;
3605        int offset;
3606        int len;
3607
3608        brcmf_dbg(INFO, "dump at 0x%08x: size=%zu\n", bus->ci->rambase,
3609                  mem_size);
3610
3611        address = bus->ci->rambase;
3612        offset = err = 0;
3613        sdio_claim_host(sdiodev->func1);
3614        while (offset < mem_size) {
3615                len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
3616                      mem_size - offset;
3617                err = brcmf_sdiod_ramrw(sdiodev, false, address, data, len);
3618                if (err) {
3619                        brcmf_err("error %d on reading %d membytes at 0x%08x\n",
3620                                  err, len, address);
3621                        goto done;
3622                }
3623                data += len;
3624                offset += len;
3625                address += len;
3626        }
3627
3628done:
3629        sdio_release_host(sdiodev->func1);
3630        return err;
3631}
3632
3633void brcmf_sdio_trigger_dpc(struct brcmf_sdio *bus)
3634{
3635        if (!bus->dpc_triggered) {
3636                bus->dpc_triggered = true;
3637                queue_work(bus->brcmf_wq, &bus->datawork);
3638        }
3639}
3640
3641void brcmf_sdio_isr(struct brcmf_sdio *bus, bool in_isr)
3642{
3643        brcmf_dbg(TRACE, "Enter\n");
3644
3645        if (!bus) {
3646                brcmf_err("bus is null pointer, exiting\n");
3647                return;
3648        }
3649
3650        /* Count the interrupt call */
3651        bus->sdcnt.intrcount++;
3652        if (in_isr)
3653                atomic_set(&bus->ipend, 1);
3654        else
3655                if (brcmf_sdio_intr_rstatus(bus)) {
3656                        brcmf_err("failed backplane access\n");
3657                }
3658
3659        /* Disable additional interrupts (is this needed now)? */
3660        if (!bus->intr)
3661                brcmf_err("isr w/o interrupt configured!\n");
3662
3663        bus->dpc_triggered = true;
3664        queue_work(bus->brcmf_wq, &bus->datawork);
3665}
3666
3667static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
3668{
3669        brcmf_dbg(TIMER, "Enter\n");
3670
3671        /* Poll period: check device if appropriate. */
3672        if (!bus->sr_enabled &&
3673            bus->poll && (++bus->polltick >= bus->pollrate)) {
3674                u32 intstatus = 0;
3675
3676                /* Reset poll tick */
3677                bus->polltick = 0;
3678
3679                /* Check device if no interrupts */
3680                if (!bus->intr ||
3681                    (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
3682
3683                        if (!bus->dpc_triggered) {
3684                                u8 devpend;
3685
3686                                sdio_claim_host(bus->sdiodev->func1);
3687                                devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
3688                                                  SDIO_CCCR_INTx, NULL);
3689                                sdio_release_host(bus->sdiodev->func1);
3690                                intstatus = devpend & (INTR_STATUS_FUNC1 |
3691                                                       INTR_STATUS_FUNC2);
3692                        }
3693
3694                        /* If there is something, make like the ISR and
3695                                 schedule the DPC */
3696                        if (intstatus) {
3697                                bus->sdcnt.pollcnt++;
3698                                atomic_set(&bus->ipend, 1);
3699
3700                                bus->dpc_triggered = true;
3701                                queue_work(bus->brcmf_wq, &bus->datawork);
3702                        }
3703                }
3704
3705                /* Update interrupt tracking */
3706                bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
3707        }
3708#ifdef DEBUG
3709        /* Poll for console output periodically */
3710        if (bus->sdiodev->state == BRCMF_SDIOD_DATA && BRCMF_FWCON_ON() &&
3711            bus->console_interval != 0) {
3712                bus->console.count += jiffies_to_msecs(BRCMF_WD_POLL);
3713                if (bus->console.count >= bus->console_interval) {
3714                        bus->console.count -= bus->console_interval;
3715                        sdio_claim_host(bus->sdiodev->func1);
3716                        /* Make sure backplane clock is on */
3717                        brcmf_sdio_bus_sleep(bus, false, false);
3718                        if (brcmf_sdio_readconsole(bus) < 0)
3719                                /* stop on error */
3720                                bus->console_interval = 0;
3721                        sdio_release_host(bus->sdiodev->func1);
3722                }
3723        }
3724#endif                          /* DEBUG */
3725
3726        /* On idle timeout clear activity flag and/or turn off clock */
3727        if (!bus->dpc_triggered) {
3728                rmb();
3729                if ((!bus->dpc_running) && (bus->idletime > 0) &&
3730                    (bus->clkstate == CLK_AVAIL)) {
3731                        bus->idlecount++;
3732                        if (bus->idlecount > bus->idletime) {
3733                                brcmf_dbg(SDIO, "idle\n");
3734                                sdio_claim_host(bus->sdiodev->func1);
3735#ifdef DEBUG
3736                                if (!BRCMF_FWCON_ON() ||
3737                                    bus->console_interval == 0)
3738#endif
3739                                        brcmf_sdio_wd_timer(bus, false);
3740                                bus->idlecount = 0;
3741                                brcmf_sdio_bus_sleep(bus, true, false);
3742                                sdio_release_host(bus->sdiodev->func1);
3743                        }
3744                } else {
3745                        bus->idlecount = 0;
3746                }
3747        } else {
3748                bus->idlecount = 0;
3749        }
3750}
3751
3752static void brcmf_sdio_dataworker(struct work_struct *work)
3753{
3754        struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
3755                                              datawork);
3756
3757        bus->dpc_running = true;
3758        wmb();
3759        while (READ_ONCE(bus->dpc_triggered)) {
3760                bus->dpc_triggered = false;
3761                brcmf_sdio_dpc(bus);
3762                bus->idlecount = 0;
3763        }
3764        bus->dpc_running = false;
3765        if (brcmf_sdiod_freezing(bus->sdiodev)) {
3766                brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DOWN);
3767                brcmf_sdiod_try_freeze(bus->sdiodev);
3768                brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
3769        }
3770}
3771
3772static void
3773brcmf_sdio_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
3774                             struct brcmf_chip *ci, u32 drivestrength)
3775{
3776        const struct sdiod_drive_str *str_tab = NULL;
3777        u32 str_mask;
3778        u32 str_shift;
3779        u32 i;
3780        u32 drivestrength_sel = 0;
3781        u32 cc_data_temp;
3782        u32 addr;
3783
3784        if (!(ci->cc_caps & CC_CAP_PMU))
3785                return;
3786
3787        switch (SDIOD_DRVSTR_KEY(ci->chip, ci->pmurev)) {
3788        case SDIOD_DRVSTR_KEY(BRCM_CC_4330_CHIP_ID, 12):
3789                str_tab = sdiod_drvstr_tab1_1v8;
3790                str_mask = 0x00003800;
3791                str_shift = 11;
3792                break;
3793        case SDIOD_DRVSTR_KEY(BRCM_CC_4334_CHIP_ID, 17):
3794                str_tab = sdiod_drvstr_tab6_1v8;
3795                str_mask = 0x00001800;
3796                str_shift = 11;
3797                break;
3798        case SDIOD_DRVSTR_KEY(BRCM_CC_43143_CHIP_ID, 17):
3799                /* note: 43143 does not support tristate */
3800                i = ARRAY_SIZE(sdiod_drvstr_tab2_3v3) - 1;
3801                if (drivestrength >= sdiod_drvstr_tab2_3v3[i].strength) {
3802                        str_tab = sdiod_drvstr_tab2_3v3;
3803                        str_mask = 0x00000007;
3804                        str_shift = 0;
3805                } else
3806                        brcmf_err("Invalid SDIO Drive strength for chip %s, strength=%d\n",
3807                                  ci->name, drivestrength);
3808                break;
3809        case SDIOD_DRVSTR_KEY(BRCM_CC_43362_CHIP_ID, 13):
3810                str_tab = sdiod_drive_strength_tab5_1v8;
3811                str_mask = 0x00003800;
3812                str_shift = 11;
3813                break;
3814        default:
3815                brcmf_dbg(INFO, "No SDIO driver strength init needed for chip %s rev %d pmurev %d\n",
3816                          ci->name, ci->chiprev, ci->pmurev);
3817                break;
3818        }
3819
3820        if (str_tab != NULL) {
3821                struct brcmf_core *pmu = brcmf_chip_get_pmu(ci);
3822
3823                for (i = 0; str_tab[i].strength != 0; i++) {
3824                        if (drivestrength >= str_tab[i].strength) {
3825                                drivestrength_sel = str_tab[i].sel;
3826                                break;
3827                        }
3828                }
3829                addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
3830                brcmf_sdiod_writel(sdiodev, addr, 1, NULL);
3831                cc_data_temp = brcmf_sdiod_readl(sdiodev, addr, NULL);
3832                cc_data_temp &= ~str_mask;
3833                drivestrength_sel <<= str_shift;
3834                cc_data_temp |= drivestrength_sel;
3835                brcmf_sdiod_writel(sdiodev, addr, cc_data_temp, NULL);
3836
3837                brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
3838                          str_tab[i].strength, drivestrength, cc_data_temp);
3839        }
3840}
3841
3842static int brcmf_sdio_buscoreprep(void *ctx)
3843{
3844        struct brcmf_sdio_dev *sdiodev = ctx;
3845        int err = 0;
3846        u8 clkval, clkset;
3847
3848        /* Try forcing SDIO core to do ALPAvail request only */
3849        clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
3850        brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
3851        if (err) {
3852                brcmf_err("error writing for HT off\n");
3853                return err;
3854        }
3855
3856        /* If register supported, wait for ALPAvail and then force ALP */
3857        /* This may take up to 15 milliseconds */
3858        clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
3859
3860        if ((clkval & ~SBSDIO_AVBITS) != clkset) {
3861                brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
3862                          clkset, clkval);
3863                return -EACCES;
3864        }
3865
3866        SPINWAIT(((clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3867                                              NULL)),
3868                 !SBSDIO_ALPAV(clkval)),
3869                 PMU_MAX_TRANSITION_DLY);
3870
3871        if (!SBSDIO_ALPAV(clkval)) {
3872                brcmf_err("timeout on ALPAV wait, clkval 0x%02x\n",
3873                          clkval);
3874                return -EBUSY;
3875        }
3876
3877        clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
3878        brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
3879        udelay(65);
3880
3881        /* Also, disable the extra SDIO pull-ups */
3882        brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
3883
3884        return 0;
3885}
3886
3887static void brcmf_sdio_buscore_activate(void *ctx, struct brcmf_chip *chip,
3888                                        u32 rstvec)
3889{
3890        struct brcmf_sdio_dev *sdiodev = ctx;
3891        struct brcmf_core *core = sdiodev->bus->sdio_core;
3892        u32 reg_addr;
3893
3894        /* clear all interrupts */
3895        reg_addr = core->base + SD_REG(intstatus);
3896        brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
3897
3898        if (rstvec)
3899                /* Write reset vector to address 0 */
3900                brcmf_sdiod_ramrw(sdiodev, true, 0, (void *)&rstvec,
3901                                  sizeof(rstvec));
3902}
3903
3904static u32 brcmf_sdio_buscore_read32(void *ctx, u32 addr)
3905{
3906        struct brcmf_sdio_dev *sdiodev = ctx;
3907        u32 val, rev;
3908
3909        val = brcmf_sdiod_readl(sdiodev, addr, NULL);
3910
3911        /*
3912         * this is a bit of special handling if reading the chipcommon chipid
3913         * register. The 4339 is a next-gen of the 4335. It uses the same
3914         * SDIO device id as 4335 and the chipid register returns 4335 as well.
3915         * It can be identified as 4339 by looking at the chip revision. It
3916         * is corrected here so the chip.c module has the right info.
3917         */
3918        if (addr == CORE_CC_REG(SI_ENUM_BASE_DEFAULT, chipid) &&
3919            (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
3920             sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
3921                rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
3922                if (rev >= 2) {
3923                        val &= ~CID_ID_MASK;
3924                        val |= BRCM_CC_4339_CHIP_ID;
3925                }
3926        }
3927
3928        return val;
3929}
3930
3931static void brcmf_sdio_buscore_write32(void *ctx, u32 addr, u32 val)
3932{
3933        struct brcmf_sdio_dev *sdiodev = ctx;
3934
3935        brcmf_sdiod_writel(sdiodev, addr, val, NULL);
3936}
3937
3938static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
3939        .prepare = brcmf_sdio_buscoreprep,
3940        .activate = brcmf_sdio_buscore_activate,
3941        .read32 = brcmf_sdio_buscore_read32,
3942        .write32 = brcmf_sdio_buscore_write32,
3943};
3944
3945static bool
3946brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
3947{
3948        struct brcmf_sdio_dev *sdiodev;
3949        u8 clkctl = 0;
3950        int err = 0;
3951        int reg_addr;
3952        u32 reg_val;
3953        u32 drivestrength;
3954        u32 enum_base;
3955
3956        sdiodev = bus->sdiodev;
3957        sdio_claim_host(sdiodev->func1);
3958
3959        enum_base = brcmf_chip_enum_base(sdiodev->func1->device);
3960
3961        pr_debug("F1 signature read @0x%08x=0x%4x\n", enum_base,
3962                 brcmf_sdiod_readl(sdiodev, enum_base, NULL));
3963
3964        /*
3965         * Force PLL off until brcmf_chip_attach()
3966         * programs PLL control regs
3967         */
3968
3969        brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, BRCMF_INIT_CLKCTL1,
3970                           &err);
3971        if (!err)
3972                clkctl = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3973                                           &err);
3974
3975        if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3976                brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3977                          err, BRCMF_INIT_CLKCTL1, clkctl);
3978                goto fail;
3979        }
3980
3981        bus->ci = brcmf_chip_attach(sdiodev, sdiodev->func1->device,
3982                                    &brcmf_sdio_buscore_ops);
3983        if (IS_ERR(bus->ci)) {
3984                brcmf_err("brcmf_chip_attach failed!\n");
3985                bus->ci = NULL;
3986                goto fail;
3987        }
3988
3989        /* Pick up the SDIO core info struct from chip.c */
3990        bus->sdio_core   = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
3991        if (!bus->sdio_core)
3992                goto fail;
3993
3994        /* Pick up the CHIPCOMMON core info struct, for bulk IO in bcmsdh.c */
3995        sdiodev->cc_core = brcmf_chip_get_core(bus->ci, BCMA_CORE_CHIPCOMMON);
3996        if (!sdiodev->cc_core)
3997                goto fail;
3998
3999        sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
4000                                                   BRCMF_BUSTYPE_SDIO,
4001                                                   bus->ci->chip,
4002                                                   bus->ci->chiprev);
4003        if (!sdiodev->settings) {
4004                brcmf_err("Failed to get device parameters\n");
4005                goto fail;
4006        }
4007        /* platform specific configuration:
4008         *   alignments must be at least 4 bytes for ADMA
4009         */
4010        bus->head_align = ALIGNMENT;
4011        bus->sgentry_align = ALIGNMENT;
4012        if (sdiodev->settings->bus.sdio.sd_head_align > ALIGNMENT)
4013                bus->head_align = sdiodev->settings->bus.sdio.sd_head_align;
4014        if (sdiodev->settings->bus.sdio.sd_sgentry_align > ALIGNMENT)
4015                bus->sgentry_align =
4016                                sdiodev->settings->bus.sdio.sd_sgentry_align;
4017
4018        /* allocate scatter-gather table. sg support
4019         * will be disabled upon allocation failure.
4020         */
4021        brcmf_sdiod_sgtable_alloc(sdiodev);
4022
4023#ifdef CONFIG_PM_SLEEP
4024        /* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
4025         * is true or when platform data OOB irq is true).
4026         */
4027        if ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_KEEP_POWER) &&
4028            ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_WAKE_SDIO_IRQ) ||
4029             (sdiodev->settings->bus.sdio.oob_irq_supported)))
4030                sdiodev->bus_if->wowl_supported = true;
4031#endif
4032
4033        if (brcmf_sdio_kso_init(bus)) {
4034                brcmf_err("error enabling KSO\n");
4035                goto fail;
4036        }
4037
4038        if (sdiodev->settings->bus.sdio.drive_strength)
4039                drivestrength = sdiodev->settings->bus.sdio.drive_strength;
4040        else
4041                drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
4042        brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
4043
4044        /* Set card control so an SDIO card reset does a WLAN backplane reset */
4045        reg_val = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
4046        if (err)
4047                goto fail;
4048
4049        reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
4050
4051        brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
4052        if (err)
4053                goto fail;
4054
4055        /* set PMUControl so a backplane reset does PMU state reload */
4056        reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
4057        reg_val = brcmf_sdiod_readl(sdiodev, reg_addr, &err);
4058        if (err)
4059                goto fail;
4060
4061        reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
4062
4063        brcmf_sdiod_writel(sdiodev, reg_addr, reg_val, &err);
4064        if (err)
4065                goto fail;
4066
4067        sdio_release_host(sdiodev->func1);
4068
4069        brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
4070
4071        /* allocate header buffer */
4072        bus->hdrbuf = kzalloc(MAX_HDR_READ + bus->head_align, GFP_KERNEL);
4073        if (!bus->hdrbuf)
4074                return false;
4075        /* Locate an appropriately-aligned portion of hdrbuf */
4076        bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
4077                                    bus->head_align);
4078
4079        /* Set the poll and/or interrupt flags */
4080        bus->intr = true;
4081        bus->poll = false;
4082        if (bus->poll)
4083                bus->pollrate = 1;
4084
4085        return true;
4086
4087fail:
4088        sdio_release_host(sdiodev->func1);
4089        return false;
4090}
4091
4092static int
4093brcmf_sdio_watchdog_thread(void *data)
4094{
4095        struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
4096        int wait;
4097
4098        allow_signal(SIGTERM);
4099        /* Run until signal received */
4100        brcmf_sdiod_freezer_count(bus->sdiodev);
4101        while (1) {
4102                if (kthread_should_stop())
4103                        break;
4104                brcmf_sdiod_freezer_uncount(bus->sdiodev);
4105                wait = wait_for_completion_interruptible(&bus->watchdog_wait);
4106                brcmf_sdiod_freezer_count(bus->sdiodev);
4107                brcmf_sdiod_try_freeze(bus->sdiodev);
4108                if (!wait) {
4109                        brcmf_sdio_bus_watchdog(bus);
4110                        /* Count the tick for reference */
4111                        bus->sdcnt.tickcnt++;
4112                        reinit_completion(&bus->watchdog_wait);
4113                } else
4114                        break;
4115        }
4116        return 0;
4117}
4118
4119static void
4120brcmf_sdio_watchdog(struct timer_list *t)
4121{
4122        struct brcmf_sdio *bus = from_timer(bus, t, timer);
4123
4124        if (bus->watchdog_tsk) {
4125                complete(&bus->watchdog_wait);
4126                /* Reschedule the watchdog */
4127                if (bus->wd_active)
4128                        mod_timer(&bus->timer,
4129                                  jiffies + BRCMF_WD_POLL);
4130        }
4131}
4132
4133static
4134int brcmf_sdio_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
4135{
4136        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
4137        struct brcmf_fw_request *fwreq;
4138        struct brcmf_fw_name fwnames[] = {
4139                { ext, fw_name },
4140        };
4141
4142        fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
4143                                       brcmf_sdio_fwnames,
4144                                       ARRAY_SIZE(brcmf_sdio_fwnames),
4145                                       fwnames, ARRAY_SIZE(fwnames));
4146        if (!fwreq)
4147                return -ENOMEM;
4148
4149        kfree(fwreq);
4150        return 0;
4151}
4152
4153static int brcmf_sdio_bus_reset(struct device *dev)
4154{
4155        int ret = 0;
4156        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
4157        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
4158
4159        brcmf_dbg(SDIO, "Enter\n");
4160
4161        /* start by unregistering irqs */
4162        brcmf_sdiod_intr_unregister(sdiodev);
4163
4164        brcmf_sdiod_remove(sdiodev);
4165
4166        /* reset the adapter */
4167        sdio_claim_host(sdiodev->func1);
4168        mmc_hw_reset(sdiodev->func1->card->host);
4169        sdio_release_host(sdiodev->func1);
4170
4171        brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_DOWN);
4172
4173        ret = brcmf_sdiod_probe(sdiodev);
4174        if (ret) {
4175                brcmf_err("Failed to probe after sdio device reset: ret %d\n",
4176                          ret);
4177        }
4178
4179        return ret;
4180}
4181
4182static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
4183        .stop = brcmf_sdio_bus_stop,
4184        .preinit = brcmf_sdio_bus_preinit,
4185        .txdata = brcmf_sdio_bus_txdata,
4186        .txctl = brcmf_sdio_bus_txctl,
4187        .rxctl = brcmf_sdio_bus_rxctl,
4188        .gettxq = brcmf_sdio_bus_gettxq,
4189        .wowl_config = brcmf_sdio_wowl_config,
4190        .get_ramsize = brcmf_sdio_bus_get_ramsize,
4191        .get_memdump = brcmf_sdio_bus_get_memdump,
4192        .get_fwname = brcmf_sdio_get_fwname,
4193        .debugfs_create = brcmf_sdio_debugfs_create,
4194        .reset = brcmf_sdio_bus_reset
4195};
4196
4197#define BRCMF_SDIO_FW_CODE      0
4198#define BRCMF_SDIO_FW_NVRAM     1
4199
4200static void brcmf_sdio_firmware_callback(struct device *dev, int err,
4201                                         struct brcmf_fw_request *fwreq)
4202{
4203        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
4204        struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
4205        struct brcmf_sdio *bus = sdiod->bus;
4206        struct brcmf_core *core = bus->sdio_core;
4207        const struct firmware *code;
4208        void *nvram;
4209        u32 nvram_len;
4210        u8 saveclk, bpreq;
4211        u8 devctl;
4212
4213        brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
4214
4215        if (err)
4216                goto fail;
4217
4218        code = fwreq->items[BRCMF_SDIO_FW_CODE].binary;
4219        nvram = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.data;
4220        nvram_len = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.len;
4221        kfree(fwreq);
4222
4223        /* try to download image and nvram to the dongle */
4224        bus->alp_only = true;
4225        err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
4226        if (err)
4227                goto fail;
4228        bus->alp_only = false;
4229
4230        /* Start the watchdog timer */
4231        bus->sdcnt.tickcnt = 0;
4232        brcmf_sdio_wd_timer(bus, true);
4233
4234        sdio_claim_host(sdiod->func1);
4235
4236        /* Make sure backplane clock is on, needed to generate F2 interrupt */
4237        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
4238        if (bus->clkstate != CLK_AVAIL)
4239                goto release;
4240
4241        /* Force clocks on backplane to be sure F2 interrupt propagates */
4242        saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
4243        if (!err) {
4244                bpreq = saveclk;
4245                bpreq |= brcmf_chip_is_ulp(bus->ci) ?
4246                        SBSDIO_HT_AVAIL_REQ : SBSDIO_FORCE_HT;
4247                brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
4248                                   bpreq, &err);
4249        }
4250        if (err) {
4251                brcmf_err("Failed to force clock for F2: err %d\n", err);
4252                goto release;
4253        }
4254
4255        /* Enable function 2 (frame transfers) */
4256        brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
4257                           SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
4258
4259        err = sdio_enable_func(sdiod->func2);
4260
4261        brcmf_dbg(INFO, "enable F2: err=%d\n", err);
4262
4263        /* If F2 successfully enabled, set core and enable interrupts */
4264        if (!err) {
4265                /* Set up the interrupt mask and enable interrupts */
4266                bus->hostintmask = HOSTINTMASK;
4267                brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
4268                                   bus->hostintmask, NULL);
4269
4270                switch (sdiod->func1->device) {
4271                case SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373:
4272                case SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752:
4273                        brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
4274                                  CY_4373_F2_WATERMARK);
4275                        brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
4276                                           CY_4373_F2_WATERMARK, &err);
4277                        devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
4278                                                   &err);
4279                        devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
4280                        brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
4281                                           &err);
4282                        brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
4283                                           CY_4373_F1_MESBUSYCTRL, &err);
4284                        break;
4285                case SDIO_DEVICE_ID_BROADCOM_CYPRESS_43012:
4286                        brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
4287                                  CY_43012_F2_WATERMARK);
4288                        brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
4289                                           CY_43012_F2_WATERMARK, &err);
4290                        devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
4291                                                   &err);
4292                        devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
4293                        brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
4294                                           &err);
4295                        brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
4296                                           CY_43012_MESBUSYCTRL, &err);
4297                        break;
4298                case SDIO_DEVICE_ID_BROADCOM_4329:
4299                case SDIO_DEVICE_ID_BROADCOM_4339:
4300                        brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
4301                                  CY_4339_F2_WATERMARK);
4302                        brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
4303                                           CY_4339_F2_WATERMARK, &err);
4304                        devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
4305                                                   &err);
4306                        devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
4307                        brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
4308                                           &err);
4309                        brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
4310                                           CY_4339_MESBUSYCTRL, &err);
4311                        break;
4312                case SDIO_DEVICE_ID_BROADCOM_43455:
4313                        brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
4314                                  CY_43455_F2_WATERMARK);
4315                        brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
4316                                           CY_43455_F2_WATERMARK, &err);
4317                        devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
4318                                                   &err);
4319                        devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
4320                        brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
4321                                           &err);
4322                        brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
4323                                           CY_43455_MESBUSYCTRL, &err);
4324                        break;
4325                case SDIO_DEVICE_ID_BROADCOM_4359:
4326                case SDIO_DEVICE_ID_BROADCOM_4354:
4327                case SDIO_DEVICE_ID_BROADCOM_4356:
4328                        brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
4329                                  CY_435X_F2_WATERMARK);
4330                        brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
4331                                           CY_435X_F2_WATERMARK, &err);
4332                        devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
4333                                                   &err);
4334                        devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
4335                        brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
4336                                           &err);
4337                        brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
4338                                           CY_435X_F1_MESBUSYCTRL, &err);
4339                        break;
4340                default:
4341                        brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
4342                                           DEFAULT_F2_WATERMARK, &err);
4343                        break;
4344                }
4345        } else {
4346                /* Disable F2 again */
4347                sdio_disable_func(sdiod->func2);
4348                goto checkdied;
4349        }
4350
4351        if (brcmf_chip_sr_capable(bus->ci)) {
4352                brcmf_sdio_sr_init(bus);
4353        } else {
4354                /* Restore previous clock setting */
4355                brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
4356                                   saveclk, &err);
4357        }
4358
4359        if (err == 0) {
4360                /* Assign bus interface call back */
4361                sdiod->bus_if->dev = sdiod->dev;
4362                sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
4363                sdiod->bus_if->chip = bus->ci->chip;
4364                sdiod->bus_if->chiprev = bus->ci->chiprev;
4365
4366                /* Allow full data communication using DPC from now on. */
4367                brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
4368
4369                err = brcmf_sdiod_intr_register(sdiod);
4370                if (err != 0)
4371                        brcmf_err("intr register failed:%d\n", err);
4372        }
4373
4374        /* If we didn't come up, turn off backplane clock */
4375        if (err != 0) {
4376                brcmf_sdio_clkctl(bus, CLK_NONE, false);
4377                goto checkdied;
4378        }
4379
4380        sdio_release_host(sdiod->func1);
4381
4382        err = brcmf_alloc(sdiod->dev, sdiod->settings);
4383        if (err) {
4384                brcmf_err("brcmf_alloc failed\n");
4385                goto claim;
4386        }
4387
4388        /* Attach to the common layer, reserve hdr space */
4389        err = brcmf_attach(sdiod->dev);
4390        if (err != 0) {
4391                brcmf_err("brcmf_attach failed\n");
4392                goto free;
4393        }
4394
4395        /* ready */
4396        return;
4397
4398free:
4399        brcmf_free(sdiod->dev);
4400claim:
4401        sdio_claim_host(sdiod->func1);
4402checkdied:
4403        brcmf_sdio_checkdied(bus);
4404release:
4405        sdio_release_host(sdiod->func1);
4406fail:
4407        brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
4408        device_release_driver(&sdiod->func2->dev);
4409        device_release_driver(dev);
4410}
4411
4412static struct brcmf_fw_request *
4413brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
4414{
4415        struct brcmf_fw_request *fwreq;
4416        struct brcmf_fw_name fwnames[] = {
4417                { ".bin", bus->sdiodev->fw_name },
4418                { ".txt", bus->sdiodev->nvram_name },
4419        };
4420
4421        fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
4422                                       brcmf_sdio_fwnames,
4423                                       ARRAY_SIZE(brcmf_sdio_fwnames),
4424                                       fwnames, ARRAY_SIZE(fwnames));
4425        if (!fwreq)
4426                return NULL;
4427
4428        fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
4429        fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
4430        fwreq->board_type = bus->sdiodev->settings->board_type;
4431
4432        return fwreq;
4433}
4434
4435struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
4436{
4437        int ret;
4438        struct brcmf_sdio *bus;
4439        struct workqueue_struct *wq;
4440        struct brcmf_fw_request *fwreq;
4441
4442        brcmf_dbg(TRACE, "Enter\n");
4443
4444        /* Allocate private bus interface state */
4445        bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
4446        if (!bus)
4447                goto fail;
4448
4449        bus->sdiodev = sdiodev;
4450        sdiodev->bus = bus;
4451        skb_queue_head_init(&bus->glom);
4452        bus->txbound = BRCMF_TXBOUND;
4453        bus->rxbound = BRCMF_RXBOUND;
4454        bus->txminmax = BRCMF_TXMINMAX;
4455        bus->tx_seq = SDPCM_SEQ_WRAP - 1;
4456
4457        /* single-threaded workqueue */
4458        wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM | WQ_HIGHPRI,
4459                                     dev_name(&sdiodev->func1->dev));
4460        if (!wq) {
4461                brcmf_err("insufficient memory to create txworkqueue\n");
4462                goto fail;
4463        }
4464        brcmf_sdiod_freezer_count(sdiodev);
4465        INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
4466        bus->brcmf_wq = wq;
4467
4468        /* attempt to attach to the dongle */
4469        if (!(brcmf_sdio_probe_attach(bus))) {
4470                brcmf_err("brcmf_sdio_probe_attach failed\n");
4471                goto fail;
4472        }
4473
4474        spin_lock_init(&bus->rxctl_lock);
4475        spin_lock_init(&bus->txq_lock);
4476        init_waitqueue_head(&bus->ctrl_wait);
4477        init_waitqueue_head(&bus->dcmd_resp_wait);
4478
4479        /* Set up the watchdog timer */
4480        timer_setup(&bus->timer, brcmf_sdio_watchdog, 0);
4481        /* Initialize watchdog thread */
4482        init_completion(&bus->watchdog_wait);
4483        bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
4484                                        bus, "brcmf_wdog/%s",
4485                                        dev_name(&sdiodev->func1->dev));
4486        if (IS_ERR(bus->watchdog_tsk)) {
4487                pr_warn("brcmf_watchdog thread failed to start\n");
4488                bus->watchdog_tsk =