Merge tag 'wireless-drivers-next-for-davem-2015-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
Major changes:

ath9k:

* add Active Interference Cancellation, a method implemented in the HW
  to counter WLAN RX > sensitivity degradation when BT is transmitting
  at the same time. This feature is supported by cards like WB222
  based on AR9462.

iwlwifi:

* Location Aware Regulatory was added by Arik
* 8000 device family work
* update to the BT Coex firmware API

brmcfmac:

* add new BCM43455 and BCM43457 SDIO device support
* add new BCM43430 SDIO device support

wil6210:

* take care of AP bridging
* fix NAPI behavior
* found approach to achieve 4*n+2 alignment of Rx frames

rt2x00:

* add new rt2800usb device DWA 130

rtlwifi:

* add USB ID for D-Link DWA-131
* add USB ID ASUS N10 WiFi dongle

mwifiex:

* throughput enhancements
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 381 insertions, 185 deletions

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index c438ccdb6ed8..9b508bd3b839 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -29,6 +29,7 @@
 #include <linux/mmc/host.h>
 #include <linux/platform_device.h>
 #include <linux/platform_data/brcmfmac-sdio.h>
+#include <linux/pm_runtime.h>
 #include <linux/suspend.h>
 #include <linux/errno.h>
 #include <linux/module.h>
@@ -1006,6 +1007,7 @@ static int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev)
         sg_free_table(&sdiodev->sgtable);
         sdiodev->sbwad = 0;
 
+        pm_runtime_allow(sdiodev->func[1]->card->host->parent);
         return 0;
 }
 
@@ -1074,7 +1076,7 @@ static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
                 ret = -ENODEV;
                 goto out;
         }
-
+        pm_runtime_forbid(host->parent);
 out:
         if (ret)
                 brcmf_sdiod_remove(sdiodev);
@@ -1096,6 +1098,8 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
         BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
         BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
         BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4345),
         BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
         { /* end: all zeroes */ }
 };
@@ -1194,7 +1198,7 @@ static void brcmf_ops_sdio_remove(struct sdio_func *func)
         brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
         brcmf_dbg(SDIO, "Function: %d\n", func->num);
 
-        if (func->num != 1 && func->num != 2)
+        if (func->num != 1)
                 return;
 
         bus_if = dev_get_drvdata(&func->dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index 04d2ca0d87d6..ab2fac8b2760 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -100,9 +100,6 @@
 #define BCM4329_CORE_SOCRAM_BASE        0x18003000
 /* ARM Cortex M3 core, ID 0x82a */
 #define BCM4329_CORE_ARM_BASE           0x18002000
-#define BCM4329_RAMSIZE                 0x48000
-/* bcm43143 */
-#define BCM43143_RAMSIZE                0x70000
 
 #define CORE_SB(base, field) \
                 (base + SBCONFIGOFF + offsetof(struct sbconfig, field))
@@ -150,6 +147,78 @@ struct sbconfig {
         u32 sbidhigh;   /* identification */
 };
 
+/* bankidx and bankinfo reg defines corerev >= 8 */
+#define SOCRAM_BANKINFO_RETNTRAM_MASK   0x00010000
+#define SOCRAM_BANKINFO_SZMASK          0x0000007f
+#define SOCRAM_BANKIDX_ROM_MASK         0x00000100
+
+#define SOCRAM_BANKIDX_MEMTYPE_SHIFT    8
+/* socram bankinfo memtype */
+#define SOCRAM_MEMTYPE_RAM              0
+#define SOCRAM_MEMTYPE_R0M              1
+#define SOCRAM_MEMTYPE_DEVRAM           2
+
+#define SOCRAM_BANKINFO_SZBASE          8192
+#define SRCI_LSS_MASK           0x00f00000
+#define SRCI_LSS_SHIFT          20
+#define SRCI_SRNB_MASK          0xf0
+#define SRCI_SRNB_SHIFT         4
+#define SRCI_SRBSZ_MASK         0xf
+#define SRCI_SRBSZ_SHIFT        0
+#define SR_BSZ_BASE             14
+
+struct sbsocramregs {
+        u32 coreinfo;
+        u32 bwalloc;
+        u32 extracoreinfo;
+        u32 biststat;
+        u32 bankidx;
+        u32 standbyctrl;
+
+        u32 errlogstatus;       /* rev 6 */
+        u32 errlogaddr; /* rev 6 */
+        /* used for patching rev 3 & 5 */
+        u32 cambankidx;
+        u32 cambankstandbyctrl;
+        u32 cambankpatchctrl;
+        u32 cambankpatchtblbaseaddr;
+        u32 cambankcmdreg;
+        u32 cambankdatareg;
+        u32 cambankmaskreg;
+        u32 PAD[1];
+        u32 bankinfo;   /* corev 8 */
+        u32 bankpda;
+        u32 PAD[14];
+        u32 extmemconfig;
+        u32 extmemparitycsr;
+        u32 extmemparityerrdata;
+        u32 extmemparityerrcnt;
+        u32 extmemwrctrlandsize;
+        u32 PAD[84];
+        u32 workaround;
+        u32 pwrctl;             /* corerev >= 2 */
+        u32 PAD[133];
+        u32 sr_control;     /* corerev >= 15 */
+        u32 sr_status;      /* corerev >= 15 */
+        u32 sr_address;     /* corerev >= 15 */
+        u32 sr_data;        /* corerev >= 15 */
+};
+
+#define SOCRAMREGOFFS(_f)       offsetof(struct sbsocramregs, _f)
+
+#define ARMCR4_CAP              (0x04)
+#define ARMCR4_BANKIDX          (0x40)
+#define ARMCR4_BANKINFO         (0x44)
+#define ARMCR4_BANKPDA          (0x4C)
+
+#define ARMCR4_TCBBNB_MASK      0xf0
+#define ARMCR4_TCBBNB_SHIFT     4
+#define ARMCR4_TCBANB_MASK      0xf
+#define ARMCR4_TCBANB_SHIFT     0
+
+#define ARMCR4_BSZ_MASK         0x3f
+#define ARMCR4_BSZ_MULT         8192
+
 struct brcmf_core_priv {
         struct brcmf_core pub;
         u32 wrapbase;
@@ -419,13 +488,13 @@ static struct brcmf_core *brcmf_chip_add_core(struct brcmf_chip_priv *ci,
         return &core->pub;
 }
 
-#ifdef DEBUG
 /* safety check for chipinfo */
 static int brcmf_chip_cores_check(struct brcmf_chip_priv *ci)
 {
         struct brcmf_core_priv *core;
         bool need_socram = false;
         bool has_socram = false;
+        bool cpu_found = false;
         int idx = 1;
 
         list_for_each_entry(core, &ci->cores, list) {
@@ -435,22 +504,24 @@ static int brcmf_chip_cores_check(struct brcmf_chip_priv *ci)
 
                 switch (core->pub.id) {
                 case BCMA_CORE_ARM_CM3:
+                        cpu_found = true;
                         need_socram = true;
                         break;
                 case BCMA_CORE_INTERNAL_MEM:
                         has_socram = true;
                         break;
                 case BCMA_CORE_ARM_CR4:
-                        if (ci->pub.rambase == 0) {
-                                brcmf_err("RAM base not provided with ARM CR4 core\n");
-                                return -ENOMEM;
-                        }
+                        cpu_found = true;
                         break;
                 default:
                         break;
                 }
         }
 
+        if (!cpu_found) {
+                brcmf_err("CPU core not detected\n");
+                return -ENXIO;
+        }
         /* check RAM core presence for ARM CM3 core */
         if (need_socram && !has_socram) {
                 brcmf_err("RAM core not provided with ARM CM3 core\n");
@@ -458,56 +529,164 @@ static int brcmf_chip_cores_check(struct brcmf_chip_priv *ci)
         }
         return 0;
 }
-#else   /* DEBUG */
-static inline int brcmf_chip_cores_check(struct brcmf_chip_priv *ci)
+
+static u32 brcmf_chip_core_read32(struct brcmf_core_priv *core, u16 reg)
 {
-        return 0;
+        return core->chip->ops->read32(core->chip->ctx, core->pub.base + reg);
 }
-#endif
 
-static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
+static void brcmf_chip_core_write32(struct brcmf_core_priv *core,
+                                    u16 reg, u32 val)
 {
-        switch (ci->pub.chip) {
-        case BRCM_CC_4329_CHIP_ID:
-                ci->pub.ramsize = BCM4329_RAMSIZE;
-                break;
-        case BRCM_CC_43143_CHIP_ID:
-                ci->pub.ramsize = BCM43143_RAMSIZE;
-                break;
-        case BRCM_CC_43241_CHIP_ID:
-                ci->pub.ramsize = 0x90000;
-                break;
-        case BRCM_CC_4330_CHIP_ID:
-                ci->pub.ramsize = 0x48000;
-                break;
+        core->chip->ops->write32(core->chip->ctx, core->pub.base + reg, val);
+}
+
+static bool brcmf_chip_socram_banksize(struct brcmf_core_priv *core, u8 idx,
+                                       u32 *banksize)
+{
+        u32 bankinfo;
+        u32 bankidx = (SOCRAM_MEMTYPE_RAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+
+        bankidx |= idx;
+        brcmf_chip_core_write32(core, SOCRAMREGOFFS(bankidx), bankidx);
+        bankinfo = brcmf_chip_core_read32(core, SOCRAMREGOFFS(bankinfo));
+        *banksize = (bankinfo & SOCRAM_BANKINFO_SZMASK) + 1;
+        *banksize *= SOCRAM_BANKINFO_SZBASE;
+        return !!(bankinfo & SOCRAM_BANKINFO_RETNTRAM_MASK);
+}
+
+static void brcmf_chip_socram_ramsize(struct brcmf_core_priv *sr, u32 *ramsize,
+                                      u32 *srsize)
+{
+        u32 coreinfo;
+        uint nb, banksize, lss;
+        bool retent;
+        int i;
+
+        *ramsize = 0;
+        *srsize = 0;
+
+        if (WARN_ON(sr->pub.rev < 4))
+                return;
+
+        if (!brcmf_chip_iscoreup(&sr->pub))
+                brcmf_chip_resetcore(&sr->pub, 0, 0, 0);
+
+        /* Get info for determining size */
+        coreinfo = brcmf_chip_core_read32(sr, SOCRAMREGOFFS(coreinfo));
+        nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+
+        if ((sr->pub.rev <= 7) || (sr->pub.rev == 12)) {
+                banksize = (coreinfo & SRCI_SRBSZ_MASK);
+                lss = (coreinfo & SRCI_LSS_MASK) >> SRCI_LSS_SHIFT;
+                if (lss != 0)
+                        nb--;
+                *ramsize = nb * (1 << (banksize + SR_BSZ_BASE));
+                if (lss != 0)
+                        *ramsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+        } else {
+                nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+                for (i = 0; i < nb; i++) {
+                        retent = brcmf_chip_socram_banksize(sr, i, &banksize);
+                        *ramsize += banksize;
+                        if (retent)
+                                *srsize += banksize;
+                }
+        }
+
+        /* hardcoded save&restore memory sizes */
+        switch (sr->chip->pub.chip) {
         case BRCM_CC_4334_CHIP_ID:
-        case BRCM_CC_43340_CHIP_ID:
-                ci->pub.ramsize = 0x80000;
+                if (sr->chip->pub.chiprev < 2)
+                        *srsize = (32 * 1024);
                 break;
-        case BRCM_CC_4335_CHIP_ID:
-                ci->pub.ramsize = 0xc0000;
-                ci->pub.rambase = 0x180000;
+        case BRCM_CC_43430_CHIP_ID:
+                /* assume sr for now as we can not check
+                 * firmware sr capability at this point.
+                 */
+                *srsize = (64 * 1024);
                 break;
-        case BRCM_CC_43362_CHIP_ID:
-                ci->pub.ramsize = 0x3c000;
+        default:
                 break;
+        }
+}
+
+/** Return the TCM-RAM size of the ARMCR4 core. */
+static u32 brcmf_chip_tcm_ramsize(struct brcmf_core_priv *cr4)
+{
+        u32 corecap;
+        u32 memsize = 0;
+        u32 nab;
+        u32 nbb;
+        u32 totb;
+        u32 bxinfo;
+        u32 idx;
+
+        corecap = brcmf_chip_core_read32(cr4, ARMCR4_CAP);
+
+        nab = (corecap & ARMCR4_TCBANB_MASK) >> ARMCR4_TCBANB_SHIFT;
+        nbb = (corecap & ARMCR4_TCBBNB_MASK) >> ARMCR4_TCBBNB_SHIFT;
+        totb = nab + nbb;
+
+        for (idx = 0; idx < totb; idx++) {
+                brcmf_chip_core_write32(cr4, ARMCR4_BANKIDX, idx);
+                bxinfo = brcmf_chip_core_read32(cr4, ARMCR4_BANKINFO);
+                memsize += ((bxinfo & ARMCR4_BSZ_MASK) + 1) * ARMCR4_BSZ_MULT;
+        }
+
+        return memsize;
+}
+
+static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
+{
+        switch (ci->pub.chip) {
+        case BRCM_CC_4345_CHIP_ID:
+                return 0x198000;
+        case BRCM_CC_4335_CHIP_ID:
         case BRCM_CC_4339_CHIP_ID:
         case BRCM_CC_4354_CHIP_ID:
         case BRCM_CC_4356_CHIP_ID:
         case BRCM_CC_43567_CHIP_ID:
         case BRCM_CC_43569_CHIP_ID:
         case BRCM_CC_43570_CHIP_ID:
-                ci->pub.ramsize = 0xc0000;
-                ci->pub.rambase = 0x180000;
-                break;
         case BRCM_CC_43602_CHIP_ID:
-                ci->pub.ramsize = 0xf0000;
-                ci->pub.rambase = 0x180000;
-                break;
+                return 0x180000;
         default:
                 brcmf_err("unknown chip: %s\n", ci->pub.name);
                 break;
         }
+        return 0;
+}
+
+static int brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
+{
+        struct brcmf_core_priv *mem_core;
+        struct brcmf_core *mem;
+
+        mem = brcmf_chip_get_core(&ci->pub, BCMA_CORE_ARM_CR4);
+        if (mem) {
+                mem_core = container_of(mem, struct brcmf_core_priv, pub);
+                ci->pub.ramsize = brcmf_chip_tcm_ramsize(mem_core);
+                ci->pub.rambase = brcmf_chip_tcm_rambase(ci);
+                if (!ci->pub.rambase) {
+                        brcmf_err("RAM base not provided with ARM CR4 core\n");
+                        return -EINVAL;
+                }
+        } else {
+                mem = brcmf_chip_get_core(&ci->pub, BCMA_CORE_INTERNAL_MEM);
+                mem_core = container_of(mem, struct brcmf_core_priv, pub);
+                brcmf_chip_socram_ramsize(mem_core, &ci->pub.ramsize,
+                                          &ci->pub.srsize);
+        }
+        brcmf_dbg(INFO, "RAM: base=0x%x size=%d (0x%x) sr=%d (0x%x)\n",
+                  ci->pub.rambase, ci->pub.ramsize, ci->pub.ramsize,
+                  ci->pub.srsize, ci->pub.srsize);
+
+        if (!ci->pub.ramsize) {
+                brcmf_err("RAM size is undetermined\n");
+                return -ENOMEM;
+        }
+        return 0;
 }
 
 static u32 brcmf_chip_dmp_get_desc(struct brcmf_chip_priv *ci, u32 *eromaddr,
@@ -660,6 +839,7 @@ static int brcmf_chip_recognition(struct brcmf_chip_priv *ci)
         struct brcmf_core *core;
         u32 regdata;
         u32 socitype;
+        int ret;
 
         /* Get CC core rev
          * Chipid is assume to be at offset 0 from SI_ENUM_BASE
@@ -712,9 +892,13 @@ static int brcmf_chip_recognition(struct brcmf_chip_priv *ci)
                 return -ENODEV;
         }
 
-        brcmf_chip_get_raminfo(ci);
+        ret = brcmf_chip_cores_check(ci);
+        if (ret)
+                return ret;
 
-        return brcmf_chip_cores_check(ci);
+        /* assure chip is passive for core access */
+        brcmf_chip_set_passive(&ci->pub);
+        return brcmf_chip_get_raminfo(ci);
 }
 
 static void brcmf_chip_disable_arm(struct brcmf_chip_priv *chip, u16 id)
@@ -778,12 +962,6 @@ static int brcmf_chip_setup(struct brcmf_chip_priv *chip)
         if (chip->ops->setup)
                 ret = chip->ops->setup(chip->ctx, pub);
 
-        /*
-         * Make sure any on-chip ARM is off (in case strapping is wrong),
-         * or downloaded code was already running.
-         */
-        brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CM3);
-        brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CR4);
         return ret;
 }
 
@@ -799,7 +977,7 @@ struct brcmf_chip *brcmf_chip_attach(void *ctx,
                 err = -EINVAL;
         if (WARN_ON(!ops->prepare))
                 err = -EINVAL;
-        if (WARN_ON(!ops->exit_dl))
+        if (WARN_ON(!ops->activate))
                 err = -EINVAL;
         if (err < 0)
                 return ERR_PTR(-EINVAL);
@@ -897,9 +1075,10 @@ void brcmf_chip_resetcore(struct brcmf_core *pub, u32 prereset, u32 reset,
 }
 
 static void
-brcmf_chip_cm3_enterdl(struct brcmf_chip_priv *chip)
+brcmf_chip_cm3_set_passive(struct brcmf_chip_priv *chip)
 {
         struct brcmf_core *core;
+        struct brcmf_core_priv *sr;
 
         brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CM3);
         core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_80211);
@@ -909,9 +1088,16 @@ brcmf_chip_cm3_enterdl(struct brcmf_chip_priv *chip)
                              D11_BCMA_IOCTL_PHYCLOCKEN);
         core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_INTERNAL_MEM);
         brcmf_chip_resetcore(core, 0, 0, 0);
+
+        /* disable bank #3 remap for this device */
+        if (chip->pub.chip == BRCM_CC_43430_CHIP_ID) {
+                sr = container_of(core, struct brcmf_core_priv, pub);
+                brcmf_chip_core_write32(sr, SOCRAMREGOFFS(bankidx), 3);
+                brcmf_chip_core_write32(sr, SOCRAMREGOFFS(bankpda), 0);
+        }
 }
 
-static bool brcmf_chip_cm3_exitdl(struct brcmf_chip_priv *chip)
+static bool brcmf_chip_cm3_set_active(struct brcmf_chip_priv *chip)
 {
         struct brcmf_core *core;
 
@@ -921,7 +1107,7 @@ static bool brcmf_chip_cm3_exitdl(struct brcmf_chip_priv *chip)
                 return false;
         }
 
-        chip->ops->exit_dl(chip->ctx, &chip->pub, 0);
+        chip->ops->activate(chip->ctx, &chip->pub, 0);
 
         core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_ARM_CM3);
         brcmf_chip_resetcore(core, 0, 0, 0);
@@ -930,7 +1116,7 @@ static bool brcmf_chip_cm3_exitdl(struct brcmf_chip_priv *chip)
 }
 
 static inline void
-brcmf_chip_cr4_enterdl(struct brcmf_chip_priv *chip)
+brcmf_chip_cr4_set_passive(struct brcmf_chip_priv *chip)
 {
         struct brcmf_core *core;
 
@@ -943,11 +1129,11 @@ brcmf_chip_cr4_enterdl(struct brcmf_chip_priv *chip)
                              D11_BCMA_IOCTL_PHYCLOCKEN);
 }
 
-static bool brcmf_chip_cr4_exitdl(struct brcmf_chip_priv *chip, u32 rstvec)
+static bool brcmf_chip_cr4_set_active(struct brcmf_chip_priv *chip, u32 rstvec)
 {
         struct brcmf_core *core;
 
-        chip->ops->exit_dl(chip->ctx, &chip->pub, rstvec);
+        chip->ops->activate(chip->ctx, &chip->pub, rstvec);
 
         /* restore ARM */
         core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_ARM_CR4);
@@ -956,7 +1142,7 @@ static bool brcmf_chip_cr4_exitdl(struct brcmf_chip_priv *chip, u32 rstvec)
         return true;
 }
 
-void brcmf_chip_enter_download(struct brcmf_chip *pub)
+void brcmf_chip_set_passive(struct brcmf_chip *pub)
 {
         struct brcmf_chip_priv *chip;
         struct brcmf_core *arm;
@@ -966,14 +1152,14 @@ void brcmf_chip_enter_download(struct brcmf_chip *pub)
         chip = container_of(pub, struct brcmf_chip_priv, pub);
         arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CR4);
         if (arm) {
-                brcmf_chip_cr4_enterdl(chip);
+                brcmf_chip_cr4_set_passive(chip);
                 return;
         }
 
-        brcmf_chip_cm3_enterdl(chip);
+        brcmf_chip_cm3_set_passive(chip);
 }
 
-bool brcmf_chip_exit_download(struct brcmf_chip *pub, u32 rstvec)
+bool brcmf_chip_set_active(struct brcmf_chip *pub, u32 rstvec)
 {
         struct brcmf_chip_priv *chip;
         struct brcmf_core *arm;
@@ -983,9 +1169,9 @@ bool brcmf_chip_exit_download(struct brcmf_chip *pub, u32 rstvec)
         chip = container_of(pub, struct brcmf_chip_priv, pub);
         arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CR4);
         if (arm)
-                return brcmf_chip_cr4_exitdl(chip, rstvec);
+                return brcmf_chip_cr4_set_active(chip, rstvec);
 
-        return brcmf_chip_cm3_exitdl(chip);
+        return brcmf_chip_cm3_set_active(chip);
 }
 
 bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
@@ -1016,6 +1202,10 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
                 addr = CORE_CC_REG(base, chipcontrol_data);
                 reg = chip->ops->read32(chip->ctx, addr);
                 return (reg & pmu_cc3_mask) != 0;
+        case BRCM_CC_43430_CHIP_ID:
+                addr = CORE_CC_REG(base, sr_control1);
+                reg = chip->ops->read32(chip->ctx, addr);
+                return reg != 0;
         default:
                 addr = CORE_CC_REG(base, pmucapabilities_ext);
                 reg = chip->ops->read32(chip->ctx, addr);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.h b/drivers/net/wireless/brcm80211/brcmfmac/chip.h
index c32908da90c8..60dcb38fc77a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.h
@@ -30,7 +30,8 @@
  * @pmucaps: PMU capabilities.
  * @pmurev: PMU revision.
  * @rambase: RAM base address (only applicable for ARM CR4 chips).
- * @ramsize: amount of RAM on chip.
+ * @ramsize: amount of RAM on chip including retention.
+ * @srsize: amount of retention RAM on chip.
  * @name: string representation of the chip identifier.
  */
 struct brcmf_chip {
@@ -41,6 +42,7 @@ struct brcmf_chip {
         u32 pmurev;
         u32 rambase;
         u32 ramsize;
+        u32 srsize;
         char name[8];
 };
 
@@ -64,7 +66,7 @@ struct brcmf_core {
  * @write32: write 32-bit value over bus.
  * @prepare: prepare bus for core configuration.
  * @setup: bus-specific core setup.
- * @exit_dl: exit download state.
+ * @active: chip becomes active.
  *      The callback should use the provided @rstvec when non-zero.
  */
 struct brcmf_buscore_ops {
@@ -72,7 +74,7 @@ struct brcmf_buscore_ops {
         void (*write32)(void *ctx, u32 addr, u32 value);
         int (*prepare)(void *ctx);
         int (*setup)(void *ctx, struct brcmf_chip *chip);
-        void (*exit_dl)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
+        void (*activate)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
 };
 
 struct brcmf_chip *brcmf_chip_attach(void *ctx,
@@ -84,8 +86,8 @@ bool brcmf_chip_iscoreup(struct brcmf_core *core);
 void brcmf_chip_coredisable(struct brcmf_core *core, u32 prereset, u32 reset);
 void brcmf_chip_resetcore(struct brcmf_core *core, u32 prereset, u32 reset,
                           u32 postreset);
-void brcmf_chip_enter_download(struct brcmf_chip *ci);
-bool brcmf_chip_exit_download(struct brcmf_chip *ci, u32 rstvec);
+void brcmf_chip_set_passive(struct brcmf_chip *ci);
+bool brcmf_chip_set_active(struct brcmf_chip *ci, u32 rstvec);
 bool brcmf_chip_sr_capable(struct brcmf_chip *pub);
 
 #endif /* BRCMF_AXIDMP_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 6262612dec45..4ec9811f49c8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -481,10 +481,9 @@ static int brcmf_msgbuf_ioctl_resp_wait(struct brcmf_msgbuf *msgbuf)
 
 static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
 {
-        if (waitqueue_active(&msgbuf->ioctl_resp_wait)) {
-                msgbuf->ctl_completed = true;
+        msgbuf->ctl_completed = true;
+        if (waitqueue_active(&msgbuf->ioctl_resp_wait))
                 wake_up(&msgbuf->ioctl_resp_wait);
-        }
 }
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
index 77a51b8c1e12..3d513e407e3d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
@@ -17,11 +17,11 @@
 
 #ifdef CONFIG_BRCMFMAC_PROTO_MSGBUF
 
-#define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_MAX_ITEM       20
-#define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_MAX_ITEM        256
-#define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_MAX_ITEM     20
+#define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_MAX_ITEM       64
+#define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_MAX_ITEM        512
+#define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_MAX_ITEM     64
 #define BRCMF_D2H_MSGRING_TX_COMPLETE_MAX_ITEM          1024
-#define BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM          256
+#define BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM          512
 #define BRCMF_H2D_TXFLOWRING_MAX_ITEM                   512
 
 #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE       40
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 61c053a729be..1831ecd0813e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -47,8 +47,6 @@ enum brcmf_pcie_state {
 
 #define BRCMF_PCIE_43602_FW_NAME                "brcm/brcmfmac43602-pcie.bin"
 #define BRCMF_PCIE_43602_NVRAM_NAME             "brcm/brcmfmac43602-pcie.txt"
-#define BRCMF_PCIE_4354_FW_NAME                 "brcm/brcmfmac4354-pcie.bin"
-#define BRCMF_PCIE_4354_NVRAM_NAME              "brcm/brcmfmac4354-pcie.txt"
 #define BRCMF_PCIE_4356_FW_NAME                 "brcm/brcmfmac4356-pcie.bin"
 #define BRCMF_PCIE_4356_NVRAM_NAME              "brcm/brcmfmac4356-pcie.txt"
 #define BRCMF_PCIE_43570_FW_NAME                "brcm/brcmfmac43570-pcie.bin"
@@ -187,8 +185,8 @@ enum brcmf_pcie_state {
 
 MODULE_FIRMWARE(BRCMF_PCIE_43602_FW_NAME);
 MODULE_FIRMWARE(BRCMF_PCIE_43602_NVRAM_NAME);
-MODULE_FIRMWARE(BRCMF_PCIE_4354_FW_NAME);
-MODULE_FIRMWARE(BRCMF_PCIE_4354_NVRAM_NAME);
+MODULE_FIRMWARE(BRCMF_PCIE_4356_FW_NAME);
+MODULE_FIRMWARE(BRCMF_PCIE_4356_NVRAM_NAME);
 MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME);
 MODULE_FIRMWARE(BRCMF_PCIE_43570_NVRAM_NAME);
 
@@ -509,8 +507,6 @@ static void brcmf_pcie_attach(struct brcmf_pciedev_info *devinfo)
 
 static int brcmf_pcie_enter_download_state(struct brcmf_pciedev_info *devinfo)
 {
-        brcmf_chip_enter_download(devinfo->ci);
-
         if (devinfo->ci->chip == BRCM_CC_43602_CHIP_ID) {
                 brcmf_pcie_select_core(devinfo, BCMA_CORE_ARM_CR4);
                 brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_ARMCR4REG_BANKIDX,
@@ -536,7 +532,7 @@ static int brcmf_pcie_exit_download_state(struct brcmf_pciedev_info *devinfo,
                 brcmf_chip_resetcore(core, 0, 0, 0);
         }
 
-        return !brcmf_chip_exit_download(devinfo->ci, resetintr);
+        return !brcmf_chip_set_active(devinfo->ci, resetintr);
 }
 
 
@@ -653,10 +649,9 @@ static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo)
                         console->log_str[console->log_idx] = ch;
                         console->log_idx++;
                 }
-
                 if (ch == '\n') {
                         console->log_str[console->log_idx] = 0;
-                        brcmf_dbg(PCIE, "CONSOLE: %s\n", console->log_str);
+                        brcmf_dbg(PCIE, "CONSOLE: %s", console->log_str);
                         console->log_idx = 0;
                 }
         }
@@ -1328,10 +1323,6 @@ static int brcmf_pcie_get_fwnames(struct brcmf_pciedev_info *devinfo)
                 fw_name = BRCMF_PCIE_43602_FW_NAME;
                 nvram_name = BRCMF_PCIE_43602_NVRAM_NAME;
                 break;
-        case BRCM_CC_4354_CHIP_ID:
-                fw_name = BRCMF_PCIE_4354_FW_NAME;
-                nvram_name = BRCMF_PCIE_4354_NVRAM_NAME;
-                break;
         case BRCM_CC_4356_CHIP_ID:
                 fw_name = BRCMF_PCIE_4356_FW_NAME;
                 nvram_name = BRCMF_PCIE_4356_NVRAM_NAME;
@@ -1566,8 +1557,8 @@ static int brcmf_pcie_buscoreprep(void *ctx)
 }
 
 
-static void brcmf_pcie_buscore_exitdl(void *ctx, struct brcmf_chip *chip,
-                                      u32 rstvec)
+static void brcmf_pcie_buscore_activate(void *ctx, struct brcmf_chip *chip,
+                                        u32 rstvec)
 {
         struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)ctx;
 
@@ -1577,7 +1568,7 @@ static void brcmf_pcie_buscore_exitdl(void *ctx, struct brcmf_chip *chip,
 
 static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
         .prepare = brcmf_pcie_buscoreprep,
-        .exit_dl = brcmf_pcie_buscore_exitdl,
+        .activate = brcmf_pcie_buscore_activate,
         .read32 = brcmf_pcie_buscore_read32,
         .write32 = brcmf_pcie_buscore_write32,
 };
@@ -1856,7 +1847,6 @@ cleanup:
         PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
 
 static struct pci_device_id brcmf_pcie_devid_table[] = {
-        BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_DEVICE_ID),
         BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
         BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
         BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
index 257ee70feb5b..ab0c89833013 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
@@ -432,8 +432,6 @@ struct brcmf_sdio {
         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
         struct brcmf_chip *ci;  /* Chip info struct */
 
-        u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
-
         u32 hostintmask;        /* Copy of Host Interrupt Mask */
         atomic_t intstatus;     /* Intstatus bits (events) pending */
         atomic_t fcstate;       /* State of dongle flow-control */
@@ -485,10 +483,9 @@ struct brcmf_sdio {
 #endif                          /* DEBUG */
 
         uint clkstate;          /* State of sd and backplane clock(s) */
-        bool activity;          /* Activity flag for clock down */
         s32 idletime;           /* Control for activity timeout */
-        s32 idlecount;  /* Activity timeout counter */
-        s32 idleclock;  /* How to set bus driver when idle */
+        s32 idlecount;          /* Activity timeout counter */
+        s32 idleclock;          /* How to set bus driver when idle */
         bool rxflow_mode;       /* Rx flow control mode */
         bool rxflow;            /* Is rx flow control on */
         bool alp_only;          /* Don't use HT clock (ALP only) */
@@ -510,7 +507,8 @@ struct brcmf_sdio {
 
         struct workqueue_struct *brcmf_wq;
         struct work_struct datawork;
-        atomic_t dpc_tskcnt;
+        bool dpc_triggered;
+        bool dpc_running;
 
         bool txoff;             /* Transmit flow-controlled */
         struct brcmf_sdio_count sdcnt;
@@ -617,6 +615,10 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 #define BCM43362_NVRAM_NAME             "brcm/brcmfmac43362-sdio.txt"
 #define BCM4339_FIRMWARE_NAME           "brcm/brcmfmac4339-sdio.bin"
 #define BCM4339_NVRAM_NAME              "brcm/brcmfmac4339-sdio.txt"
+#define BCM43430_FIRMWARE_NAME          "brcm/brcmfmac43430-sdio.bin"
+#define BCM43430_NVRAM_NAME             "brcm/brcmfmac43430-sdio.txt"
+#define BCM43455_FIRMWARE_NAME          "brcm/brcmfmac43455-sdio.bin"
+#define BCM43455_NVRAM_NAME             "brcm/brcmfmac43455-sdio.txt"
 #define BCM4354_FIRMWARE_NAME           "brcm/brcmfmac4354-sdio.bin"
 #define BCM4354_NVRAM_NAME              "brcm/brcmfmac4354-sdio.txt"
 
@@ -640,6 +642,10 @@ MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43430_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43430_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43455_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43455_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4354_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4354_NVRAM_NAME);
 
@@ -669,6 +675,8 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
         { BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
         { BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
+        { BRCM_CC_43430_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43430) },
+        { BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, BRCMF_FIRMWARE_NVRAM(BCM43455) },
         { BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
 };
 
@@ -959,13 +967,8 @@ static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
         brcmf_dbg(SDIO, "Enter\n");
 
         /* Early exit if we're already there */
-        if (bus->clkstate == target) {
-                if (target == CLK_AVAIL) {
-                        brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-                        bus->activity = true;
-                }
+        if (bus->clkstate == target)
                 return 0;
-        }
 
         switch (target) {
         case CLK_AVAIL:
@@ -974,8 +977,6 @@ static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
                         brcmf_sdio_sdclk(bus, true);
                 /* Now request HT Avail on the backplane */
                 brcmf_sdio_htclk(bus, true, pendok);
-                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-                bus->activity = true;
                 break;
 
         case CLK_SDONLY:
@@ -987,7 +988,6 @@ static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
                 else
                         brcmf_err("request for %d -> %d\n",
                                   bus->clkstate, target);
-                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
                 break;
 
         case CLK_NONE:
@@ -996,7 +996,6 @@ static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
                         brcmf_sdio_htclk(bus, false, false);
                 /* Now remove the SD clock */
                 brcmf_sdio_sdclk(bus, false);
-                brcmf_sdio_wd_timer(bus, 0);
                 break;
         }
 #ifdef DEBUG
@@ -1024,17 +1023,6 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 
                 /* Going to sleep */
                 if (sleep) {
-                        /* Don't sleep if something is pending */
-                        if (atomic_read(&bus->intstatus) ||
-                            atomic_read(&bus->ipend) > 0 ||
-                            bus->ctrl_frame_stat ||
-                            (!atomic_read(&bus->fcstate) &&
-                            brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
-                            data_ok(bus))) {
-                                 err = -EBUSY;
-                                 goto done;
-                        }
-
                         clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
                                                    SBSDIO_FUNC1_CHIPCLKCSR,
                                                    &err);
@@ -1045,11 +1033,7 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
                                                   SBSDIO_ALP_AVAIL_REQ, &err);
                         }
                         err = brcmf_sdio_kso_control(bus, false);
-                        /* disable watchdog */
-                        if (!err)
-                                brcmf_sdio_wd_timer(bus, 0);
                 } else {
-                        bus->idlecount = 0;
                         err = brcmf_sdio_kso_control(bus, true);
                 }
                 if (err) {
@@ -1066,6 +1050,7 @@ end:
                         brcmf_sdio_clkctl(bus, CLK_NONE, pendok);
         } else {
                 brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
+                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
         }
         bus->sleeping = sleep;
         brcmf_dbg(SDIO, "new state %s\n",
@@ -1085,44 +1070,47 @@ static inline bool brcmf_sdio_valid_shared_address(u32 addr)
 static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
                                  struct sdpcm_shared *sh)
 {
-        u32 addr;
+        u32 addr = 0;
         int rv;
         u32 shaddr = 0;
         struct sdpcm_shared_le sh_le;
         __le32 addr_le;
 
-        shaddr = bus->ci->rambase + bus->ramsize - 4;
+        sdio_claim_host(bus->sdiodev->func[1]);
+        brcmf_sdio_bus_sleep(bus, false, false);
 
         /*
          * Read last word in socram to determine
          * address of sdpcm_shared structure
          */
-        sdio_claim_host(bus->sdiodev->func[1]);
-        brcmf_sdio_bus_sleep(bus, false, false);
-        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
-        sdio_release_host(bus->sdiodev->func[1]);
+        shaddr = bus->ci->rambase + bus->ci->ramsize - 4;
+        if (!bus->ci->rambase && brcmf_chip_sr_capable(bus->ci))
+                shaddr -= bus->ci->srsize;
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr,
+                               (u8 *)&addr_le, 4);
         if (rv < 0)
-                return rv;
-
-        addr = le32_to_cpu(addr_le);
-
-        brcmf_dbg(SDIO, "sdpcm_shared address 0x%08X\n", addr);
+                goto fail;
 
         /*
          * Check if addr is valid.
          * NVRAM length at the end of memory should have been overwritten.
          */
+        addr = le32_to_cpu(addr_le);
         if (!brcmf_sdio_valid_shared_address(addr)) {
-                        brcmf_err("invalid sdpcm_shared address 0x%08X\n",
-                                  addr);
-                        return -EINVAL;
+                brcmf_err("invalid sdpcm_shared address 0x%08X\n", addr);
+                rv = -EINVAL;
+                goto fail;
         }
 
+        brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
+
         /* Read hndrte_shared structure */
         rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
                                sizeof(struct sdpcm_shared_le));
         if (rv < 0)
-                return rv;
+                goto fail;
+
+        sdio_release_host(bus->sdiodev->func[1]);
 
         /* Endianness */
         sh->flags = le32_to_cpu(sh_le.flags);
@@ -1139,8 +1127,13 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
                           sh->flags & SDPCM_SHARED_VERSION_MASK);
                 return -EPROTO;
         }
-
         return 0;
+
+fail:
+        brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
+                  rv, addr);
+        sdio_release_host(bus->sdiodev->func[1]);
+        return rv;
 }
 
 static void brcmf_sdio_get_console_addr(struct brcmf_sdio *bus)
@@ -2721,11 +2714,14 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
         if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
             data_ok(bus)) {
                 sdio_claim_host(bus->sdiodev->func[1]);
-                err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
-                                              bus->ctrl_frame_len);
+                if (bus->ctrl_frame_stat) {
+                        err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+                                                      bus->ctrl_frame_len);
+                        bus->ctrl_frame_err = err;
+                        wmb();
+                        bus->ctrl_frame_stat = false;
+                }
                 sdio_release_host(bus->sdiodev->func[1]);
-                bus->ctrl_frame_err = err;
-                bus->ctrl_frame_stat = false;
                 brcmf_sdio_wait_event_wakeup(bus);
         }
         /* Send queued frames (limit 1 if rx may still be pending) */
@@ -2740,12 +2736,22 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
         if ((bus->sdiodev->state != BRCMF_SDIOD_DATA) || (err != 0)) {
                 brcmf_err("failed backplane access over SDIO, halting operation\n");
                 atomic_set(&bus->intstatus, 0);
+                if (bus->ctrl_frame_stat) {
+                        sdio_claim_host(bus->sdiodev->func[1]);
+                        if (bus->ctrl_frame_stat) {
+                                bus->ctrl_frame_err = -ENODEV;
+                                wmb();
+                                bus->ctrl_frame_stat = false;
+                                brcmf_sdio_wait_event_wakeup(bus);
+                        }
+                        sdio_release_host(bus->sdiodev->func[1]);
+                }
         } else if (atomic_read(&bus->intstatus) ||
                    atomic_read(&bus->ipend) > 0 ||
                    (!atomic_read(&bus->fcstate) &&
                     brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
                     data_ok(bus))) {
-                atomic_inc(&bus->dpc_tskcnt);
+                bus->dpc_triggered = true;
         }
 }
 
@@ -2941,20 +2947,27 @@ brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         /* Send from dpc */
         bus->ctrl_frame_buf = msg;
         bus->ctrl_frame_len = msglen;
+        wmb();
         bus->ctrl_frame_stat = true;
 
         brcmf_sdio_trigger_dpc(bus);
         wait_event_interruptible_timeout(bus->ctrl_wait, !bus->ctrl_frame_stat,
                                          msecs_to_jiffies(CTL_DONE_TIMEOUT));
-
-        if (!bus->ctrl_frame_stat) {
+        ret = 0;
+        if (bus->ctrl_frame_stat) {
+                sdio_claim_host(bus->sdiodev->func[1]);
+                if (bus->ctrl_frame_stat) {
+                        brcmf_dbg(SDIO, "ctrl_frame timeout\n");
+                        bus->ctrl_frame_stat = false;
+                        ret = -ETIMEDOUT;
+                }
+                sdio_release_host(bus->sdiodev->func[1]);
+        }
+        if (!ret) {
                 brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
                           bus->ctrl_frame_err);
+                rmb();
                 ret = bus->ctrl_frame_err;
-        } else {
-                brcmf_dbg(SDIO, "ctrl_frame timeout\n");
-                bus->ctrl_frame_stat = false;
-                ret = -ETIMEDOUT;
         }
 
         if (ret)
@@ -3358,9 +3371,6 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
         sdio_claim_host(bus->sdiodev->func[1]);
         brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
 
-        /* Keep arm in reset */
-        brcmf_chip_enter_download(bus->ci);
-
         rstvec = get_unaligned_le32(fw->data);
         brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
 
@@ -3380,7 +3390,7 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
         }
 
         /* Take arm out of reset */
-        if (!brcmf_chip_exit_download(bus->ci, rstvec)) {
+        if (!brcmf_chip_set_active(bus->ci, rstvec)) {
                 brcmf_err("error getting out of ARM core reset\n");
                 goto err;
         }
@@ -3525,8 +3535,8 @@ done:
 
 void brcmf_sdio_trigger_dpc(struct brcmf_sdio *bus)
 {
-        if (atomic_read(&bus->dpc_tskcnt) == 0) {
-                atomic_inc(&bus->dpc_tskcnt);
+        if (!bus->dpc_triggered) {
+                bus->dpc_triggered = true;
                 queue_work(bus->brcmf_wq, &bus->datawork);
         }
 }
@@ -3557,11 +3567,11 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
         if (!bus->intr)
                 brcmf_err("isr w/o interrupt configured!\n");
 
-        atomic_inc(&bus->dpc_tskcnt);
+        bus->dpc_triggered = true;
         queue_work(bus->brcmf_wq, &bus->datawork);
 }
 
-static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
+static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
 {
         brcmf_dbg(TIMER, "Enter\n");
 
@@ -3577,7 +3587,7 @@ static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
                 if (!bus->intr ||
                     (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
 
-                        if (atomic_read(&bus->dpc_tskcnt) == 0) {
+                        if (!bus->dpc_triggered) {
                                 u8 devpend;
 
                                 sdio_claim_host(bus->sdiodev->func[1]);
@@ -3595,7 +3605,7 @@ static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
                                 bus->sdcnt.pollcnt++;
                                 atomic_set(&bus->ipend, 1);
 
-                                atomic_inc(&bus->dpc_tskcnt);
+                                bus->dpc_triggered = true;
                                 queue_work(bus->brcmf_wq, &bus->datawork);
                         }
                 }
@@ -3622,22 +3632,25 @@ static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
 #endif                          /* DEBUG */
 
         /* On idle timeout clear activity flag and/or turn off clock */
-        if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
-                if (++bus->idlecount >= bus->idletime) {
-                        bus->idlecount = 0;
-                        if (bus->activity) {
-                                bus->activity = false;
-                                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-                        } else {
+        if (!bus->dpc_triggered) {
+                rmb();
+                if ((!bus->dpc_running) && (bus->idletime > 0) &&
+                    (bus->clkstate == CLK_AVAIL)) {
+                        bus->idlecount++;
+                        if (bus->idlecount > bus->idletime) {
                                 brcmf_dbg(SDIO, "idle\n");
                                 sdio_claim_host(bus->sdiodev->func[1]);
+                                brcmf_sdio_wd_timer(bus, 0);
+                                bus->idlecount = 0;
                                 brcmf_sdio_bus_sleep(bus, true, false);
                                 sdio_release_host(bus->sdiodev->func[1]);
                         }
+                } else {
+                        bus->idlecount = 0;
                 }
+        } else {
+                bus->idlecount = 0;
         }
-
-        return (atomic_read(&bus->ipend) > 0);
 }
 
 static void brcmf_sdio_dataworker(struct work_struct *work)
@@ -3645,10 +3658,14 @@ static void brcmf_sdio_dataworker(struct work_struct *work)
         struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
                                               datawork);
 
-        while (atomic_read(&bus->dpc_tskcnt)) {
-                atomic_set(&bus->dpc_tskcnt, 0);
+        bus->dpc_running = true;
+        wmb();
+        while (ACCESS_ONCE(bus->dpc_triggered)) {
+                bus->dpc_triggered = false;
                 brcmf_sdio_dpc(bus);
+                bus->idlecount = 0;
         }
+        bus->dpc_running = false;
         if (brcmf_sdiod_freezing(bus->sdiodev)) {
                 brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DOWN);
                 brcmf_sdiod_try_freeze(bus->sdiodev);
@@ -3771,8 +3788,8 @@ static int brcmf_sdio_buscoreprep(void *ctx)
         return 0;
 }
 
-static void brcmf_sdio_buscore_exitdl(void *ctx, struct brcmf_chip *chip,
-                                      u32 rstvec)
+static void brcmf_sdio_buscore_activate(void *ctx, struct brcmf_chip *chip,
+                                        u32 rstvec)
 {
         struct brcmf_sdio_dev *sdiodev = ctx;
         struct brcmf_core *core;
@@ -3815,7 +3832,7 @@ static void brcmf_sdio_buscore_write32(void *ctx, u32 addr, u32 val)
 
 static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
         .prepare = brcmf_sdio_buscoreprep,
-        .exit_dl = brcmf_sdio_buscore_exitdl,
+        .activate = brcmf_sdio_buscore_activate,
         .read32 = brcmf_sdio_buscore_read32,
         .write32 = brcmf_sdio_buscore_write32,
 };
@@ -3869,13 +3886,6 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
                 drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
         brcmf_sdio_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
 
-        /* Get info on the SOCRAM cores... */
-        bus->ramsize = bus->ci->ramsize;
-        if (!(bus->ramsize)) {
-                brcmf_err("failed to find SOCRAM memory!\n");
-                goto fail;
-        }
-
         /* Set card control so an SDIO card reset does a WLAN backplane reset */
         reg_val = brcmf_sdiod_regrb(bus->sdiodev,
                                     SDIO_CCCR_BRCM_CARDCTRL, &err);
@@ -4148,7 +4158,8 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
                 bus->watchdog_tsk = NULL;
         }
         /* Initialize DPC thread */
-        atomic_set(&bus->dpc_tskcnt, 0);
+        bus->dpc_triggered = false;
+        bus->dpc_running = false;
 
         /* Assign bus interface call back */
         bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
@@ -4243,14 +4254,14 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                 if (bus->ci) {
                         if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
                                 sdio_claim_host(bus->sdiodev->func[1]);
+                                brcmf_sdio_wd_timer(bus, 0);
                                 brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
                                 /* Leave the device in state where it is
-                                 * 'quiet'. This is done by putting it in
-                                 * download_state which essentially resets
-                                 * all necessary cores.
+                                 * 'passive'. This is done by resetting all
+                                 * necessary cores.
                                  */
                                 msleep(20);
-                                brcmf_chip_enter_download(bus->ci);
+                                brcmf_chip_set_passive(bus->ci);
                                 brcmf_sdio_clkctl(bus, CLK_NONE, false);
                                 sdio_release_host(bus->sdiodev->func[1]);
                         }