?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge tag 'v3.3.7' into 3.3/master
[zen-stable.git] / drivers / net / wireless / brcm80211 / brcmfmac / dhd_sdio.c
blobf7eeee1dcdb66a8b3a09c5534bb8f15a15f09e91
1 /*
2 * Copyright (c) 2010 Broadcom Corporation
3 *
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/kthread.h>
20 #include <linux/printk.h>
21 #include <linux/pci_ids.h>
22 #include <linux/netdevice.h>
23 #include <linux/interrupt.h>
24 #include <linux/sched.h>
25 #include <linux/mmc/sdio.h>
26 #include <linux/mmc/sdio_func.h>
27 #include <linux/mmc/card.h>
28 #include <linux/semaphore.h>
29 #include <linux/firmware.h>
30 #include <linux/module.h>
31 #include <linux/bcma/bcma.h>
32 #include <asm/unaligned.h>
33 #include <defs.h>
34 #include <brcmu_wifi.h>
35 #include <brcmu_utils.h>
36 #include <brcm_hw_ids.h>
37 #include <soc.h>
38 #include "sdio_host.h"
39 #include "sdio_chip.h"
40
41 #define DCMD_RESP_TIMEOUT 2000 /* In milli second */
42
43 #ifdef BCMDBG
44
45 #define BRCMF_TRAP_INFO_SIZE 80
46
47 #define CBUF_LEN (128)
48
49 struct rte_log_le {
50 __le32 buf; /* Can't be pointer on (64-bit) hosts */
51 __le32 buf_size;
52 __le32 idx;
53 char *_buf_compat; /* Redundant pointer for backward compat. */
54 };
55
56 struct rte_console {
57 /* Virtual UART
58 * When there is no UART (e.g. Quickturn),
59 * the host should write a complete
60 * input line directly into cbuf and then write
61 * the length into vcons_in.
62 * This may also be used when there is a real UART
63 * (at risk of conflicting with
64 * the real UART). vcons_out is currently unused.
65 */
66 uint vcons_in;
67 uint vcons_out;
68
69 /* Output (logging) buffer
70 * Console output is written to a ring buffer log_buf at index log_idx.
71 * The host may read the output when it sees log_idx advance.
72 * Output will be lost if the output wraps around faster than the host
73 * polls.
74 */
75 struct rte_log_le log_le;
76
77 /* Console input line buffer
78 * Characters are read one at a time into cbuf
79 * until <CR> is received, then
80 * the buffer is processed as a command line.
81 * Also used for virtual UART.
82 */
83 uint cbuf_idx;
84 char cbuf[CBUF_LEN];
85 };
86
87 #endif /* BCMDBG */
88 #include <chipcommon.h>
89
90 #include "dhd_bus.h"
91 #include "dhd_dbg.h"
92
93 #define TXQLEN 2048 /* bulk tx queue length */
94 #define TXHI (TXQLEN - 256) /* turn on flow control above TXHI */
95 #define TXLOW (TXHI - 256) /* turn off flow control below TXLOW */
96 #define PRIOMASK 7
97
98 #define TXRETRIES 2 /* # of retries for tx frames */
99
100 #define BRCMF_RXBOUND 50 /* Default for max rx frames in
101 one scheduling */
102
103 #define BRCMF_TXBOUND 20 /* Default for max tx frames in
104 one scheduling */
105
106 #define BRCMF_TXMINMAX 1 /* Max tx frames if rx still pending */
107
108 #define MEMBLOCK 2048 /* Block size used for downloading
109 of dongle image */
110 #define MAX_DATA_BUF (32 * 1024) /* Must be large enough to hold
111 biggest possible glom */
112
113 #define BRCMF_FIRSTREAD (1 << 6)
114
115
116 /* SBSDIO_DEVICE_CTL */
117
118 /* 1: device will assert busy signal when receiving CMD53 */
119 #define SBSDIO_DEVCTL_SETBUSY 0x01
120 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
121 #define SBSDIO_DEVCTL_SPI_INTR_SYNC 0x02
122 /* 1: mask all interrupts to host except the chipActive (rev 8) */
123 #define SBSDIO_DEVCTL_CA_INT_ONLY 0x04
124 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
125 * sdio bus power cycle to clear (rev 9) */
126 #define SBSDIO_DEVCTL_PADS_ISO 0x08
127 /* Force SD->SB reset mapping (rev 11) */
128 #define SBSDIO_DEVCTL_SB_RST_CTL 0x30
129 /* Determined by CoreControl bit */
130 #define SBSDIO_DEVCTL_RST_CORECTL 0x00
131 /* Force backplane reset */
132 #define SBSDIO_DEVCTL_RST_BPRESET 0x10
133 /* Force no backplane reset */
134 #define SBSDIO_DEVCTL_RST_NOBPRESET 0x20
135
136 /* direct(mapped) cis space */
137
138 /* MAPPED common CIS address */
139 #define SBSDIO_CIS_BASE_COMMON 0x1000
140 /* maximum bytes in one CIS */
141 #define SBSDIO_CIS_SIZE_LIMIT 0x200
142 /* cis offset addr is < 17 bits */
143 #define SBSDIO_CIS_OFT_ADDR_MASK 0x1FFFF
144
145 /* manfid tuple length, include tuple, link bytes */
146 #define SBSDIO_CIS_MANFID_TUPLE_LEN 6
147
148 /* intstatus */
149 #define I_SMB_SW0 (1 << 0) /* To SB Mail S/W interrupt 0 */
150 #define I_SMB_SW1 (1 << 1) /* To SB Mail S/W interrupt 1 */
151 #define I_SMB_SW2 (1 << 2) /* To SB Mail S/W interrupt 2 */
152 #define I_SMB_SW3 (1 << 3) /* To SB Mail S/W interrupt 3 */
153 #define I_SMB_SW_MASK 0x0000000f /* To SB Mail S/W interrupts mask */
154 #define I_SMB_SW_SHIFT 0 /* To SB Mail S/W interrupts shift */
155 #define I_HMB_SW0 (1 << 4) /* To Host Mail S/W interrupt 0 */
156 #define I_HMB_SW1 (1 << 5) /* To Host Mail S/W interrupt 1 */
157 #define I_HMB_SW2 (1 << 6) /* To Host Mail S/W interrupt 2 */
158 #define I_HMB_SW3 (1 << 7) /* To Host Mail S/W interrupt 3 */
159 #define I_HMB_SW_MASK 0x000000f0 /* To Host Mail S/W interrupts mask */
160 #define I_HMB_SW_SHIFT 4 /* To Host Mail S/W interrupts shift */
161 #define I_WR_OOSYNC (1 << 8) /* Write Frame Out Of Sync */
162 #define I_RD_OOSYNC (1 << 9) /* Read Frame Out Of Sync */
163 #define I_PC (1 << 10) /* descriptor error */
164 #define I_PD (1 << 11) /* data error */
165 #define I_DE (1 << 12) /* Descriptor protocol Error */
166 #define I_RU (1 << 13) /* Receive descriptor Underflow */
167 #define I_RO (1 << 14) /* Receive fifo Overflow */
168 #define I_XU (1 << 15) /* Transmit fifo Underflow */
169 #define I_RI (1 << 16) /* Receive Interrupt */
170 #define I_BUSPWR (1 << 17) /* SDIO Bus Power Change (rev 9) */
171 #define I_XMTDATA_AVAIL (1 << 23) /* bits in fifo */
172 #define I_XI (1 << 24) /* Transmit Interrupt */
173 #define I_RF_TERM (1 << 25) /* Read Frame Terminate */
174 #define I_WF_TERM (1 << 26) /* Write Frame Terminate */
175 #define I_PCMCIA_XU (1 << 27) /* PCMCIA Transmit FIFO Underflow */
176 #define I_SBINT (1 << 28) /* sbintstatus Interrupt */
177 #define I_CHIPACTIVE (1 << 29) /* chip from doze to active state */
178 #define I_SRESET (1 << 30) /* CCCR RES interrupt */
179 #define I_IOE2 (1U << 31) /* CCCR IOE2 Bit Changed */
180 #define I_ERRORS (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
181 #define I_DMA (I_RI | I_XI | I_ERRORS)
182
183 /* corecontrol */
184 #define CC_CISRDY (1 << 0) /* CIS Ready */
185 #define CC_BPRESEN (1 << 1) /* CCCR RES signal */
186 #define CC_F2RDY (1 << 2) /* set CCCR IOR2 bit */
187 #define CC_CLRPADSISO (1 << 3) /* clear SDIO pads isolation */
188 #define CC_XMTDATAAVAIL_MODE (1 << 4)
189 #define CC_XMTDATAAVAIL_CTRL (1 << 5)
190
191 /* SDA_FRAMECTRL */
192 #define SFC_RF_TERM (1 << 0) /* Read Frame Terminate */
193 #define SFC_WF_TERM (1 << 1) /* Write Frame Terminate */
194 #define SFC_CRC4WOOS (1 << 2) /* CRC error for write out of sync */
195 #define SFC_ABORTALL (1 << 3) /* Abort all in-progress frames */
196
197 /* HW frame tag */
198 #define SDPCM_FRAMETAG_LEN 4 /* 2 bytes len, 2 bytes check val */
199
200 /* Total length of frame header for dongle protocol */
201 #define SDPCM_HDRLEN (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
202 #define SDPCM_RESERVE (SDPCM_HDRLEN + BRCMF_SDALIGN)
203
204 /*
205 * Software allocation of To SB Mailbox resources
206 */
207
208 /* tosbmailbox bits corresponding to intstatus bits */
209 #define SMB_NAK (1 << 0) /* Frame NAK */
210 #define SMB_INT_ACK (1 << 1) /* Host Interrupt ACK */
211 #define SMB_USE_OOB (1 << 2) /* Use OOB Wakeup */
212 #define SMB_DEV_INT (1 << 3) /* Miscellaneous Interrupt */
213
214 /* tosbmailboxdata */
215 #define SMB_DATA_VERSION_SHIFT 16 /* host protocol version */
216
217 /*
218 * Software allocation of To Host Mailbox resources
219 */
220
221 /* intstatus bits */
222 #define I_HMB_FC_STATE I_HMB_SW0 /* Flow Control State */
223 #define I_HMB_FC_CHANGE I_HMB_SW1 /* Flow Control State Changed */
224 #define I_HMB_FRAME_IND I_HMB_SW2 /* Frame Indication */
225 #define I_HMB_HOST_INT I_HMB_SW3 /* Miscellaneous Interrupt */
226
227 /* tohostmailboxdata */
228 #define HMB_DATA_NAKHANDLED 1 /* retransmit NAK'd frame */
229 #define HMB_DATA_DEVREADY 2 /* talk to host after enable */
230 #define HMB_DATA_FC 4 /* per prio flowcontrol update flag */
231 #define HMB_DATA_FWREADY 8 /* fw ready for protocol activity */
232
233 #define HMB_DATA_FCDATA_MASK 0xff000000
234 #define HMB_DATA_FCDATA_SHIFT 24
235
236 #define HMB_DATA_VERSION_MASK 0x00ff0000
237 #define HMB_DATA_VERSION_SHIFT 16
238
239 /*
240 * Software-defined protocol header
241 */
242
243 /* Current protocol version */
244 #define SDPCM_PROT_VERSION 4
245
246 /* SW frame header */
247 #define SDPCM_PACKET_SEQUENCE(p) (((u8 *)p)[0] & 0xff)
248
249 #define SDPCM_CHANNEL_MASK 0x00000f00
250 #define SDPCM_CHANNEL_SHIFT 8
251 #define SDPCM_PACKET_CHANNEL(p) (((u8 *)p)[1] & 0x0f)
252
253 #define SDPCM_NEXTLEN_OFFSET 2
254
255 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
256 #define SDPCM_DOFFSET_OFFSET 3 /* Data Offset */
257 #define SDPCM_DOFFSET_VALUE(p) (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
258 #define SDPCM_DOFFSET_MASK 0xff000000
259 #define SDPCM_DOFFSET_SHIFT 24
260 #define SDPCM_FCMASK_OFFSET 4 /* Flow control */
261 #define SDPCM_FCMASK_VALUE(p) (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
262 #define SDPCM_WINDOW_OFFSET 5 /* Credit based fc */
263 #define SDPCM_WINDOW_VALUE(p) (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
264
265 #define SDPCM_SWHEADER_LEN 8 /* SW header is 64 bits */
266
267 /* logical channel numbers */
268 #define SDPCM_CONTROL_CHANNEL 0 /* Control channel Id */
269 #define SDPCM_EVENT_CHANNEL 1 /* Asyc Event Indication Channel Id */
270 #define SDPCM_DATA_CHANNEL 2 /* Data Xmit/Recv Channel Id */
271 #define SDPCM_GLOM_CHANNEL 3 /* For coalesced packets */
272 #define SDPCM_TEST_CHANNEL 15 /* Reserved for test/debug packets */
273
274 #define SDPCM_SEQUENCE_WRAP 256 /* wrap-around val for 8bit frame seq */
275
276 #define SDPCM_GLOMDESC(p) (((u8 *)p)[1] & 0x80)
277
278 /*
279 * Shared structure between dongle and the host.
280 * The structure contains pointers to trap or assert information.
281 */
282 #define SDPCM_SHARED_VERSION 0x0002
283 #define SDPCM_SHARED_VERSION_MASK 0x00FF
284 #define SDPCM_SHARED_ASSERT_BUILT 0x0100
285 #define SDPCM_SHARED_ASSERT 0x0200
286 #define SDPCM_SHARED_TRAP 0x0400
287
288 /* Space for header read, limit for data packets */
289 #define MAX_HDR_READ (1 << 6)
290 #define MAX_RX_DATASZ 2048
291
292 /* Maximum milliseconds to wait for F2 to come up */
293 #define BRCMF_WAIT_F2RDY 3000
294
295 /* Bump up limit on waiting for HT to account for first startup;
296 * if the image is doing a CRC calculation before programming the PMU
297 * for HT availability, it could take a couple hundred ms more, so
298 * max out at a 1 second (1000000us).
299 */
300 #undef PMU_MAX_TRANSITION_DLY
301 #define PMU_MAX_TRANSITION_DLY 1000000
302
303 /* Value for ChipClockCSR during initial setup */
304 #define BRCMF_INIT_CLKCTL1 (SBSDIO_FORCE_HW_CLKREQ_OFF | \
305 SBSDIO_ALP_AVAIL_REQ)
306
307 /* Flags for SDH calls */
308 #define F2SYNC (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
309
310 #define BRCMFMAC_FW_NAME "brcm/brcmfmac.bin"
311 #define BRCMFMAC_NV_NAME "brcm/brcmfmac.txt"
312 MODULE_FIRMWARE(BRCMFMAC_FW_NAME);
313 MODULE_FIRMWARE(BRCMFMAC_NV_NAME);
314
315 #define BRCMF_IDLE_IMMEDIATE (-1) /* Enter idle immediately */
316 #define BRCMF_IDLE_ACTIVE 0 /* Do not request any SD clock change
317 * when idle
318 */
319 #define BRCMF_IDLE_INTERVAL 1
320
321 /*
322 * Conversion of 802.1D priority to precedence level
323 */
324 static uint prio2prec(u32 prio)
325 {
326 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
327 (prio^2) : prio;
328 }
329
330 /* core registers */
331 struct sdpcmd_regs {
332 u32 corecontrol; /* 0x00, rev8 */
333 u32 corestatus; /* rev8 */
334 u32 PAD[1];
335 u32 biststatus; /* rev8 */
336
337 /* PCMCIA access */
338 u16 pcmciamesportaladdr; /* 0x010, rev8 */
339 u16 PAD[1];
340 u16 pcmciamesportalmask; /* rev8 */
341 u16 PAD[1];
342 u16 pcmciawrframebc; /* rev8 */
343 u16 PAD[1];
344 u16 pcmciaunderflowtimer; /* rev8 */
345 u16 PAD[1];
346
347 /* interrupt */
348 u32 intstatus; /* 0x020, rev8 */
349 u32 hostintmask; /* rev8 */
350 u32 intmask; /* rev8 */
351 u32 sbintstatus; /* rev8 */
352 u32 sbintmask; /* rev8 */
353 u32 funcintmask; /* rev4 */
354 u32 PAD[2];
355 u32 tosbmailbox; /* 0x040, rev8 */
356 u32 tohostmailbox; /* rev8 */
357 u32 tosbmailboxdata; /* rev8 */
358 u32 tohostmailboxdata; /* rev8 */
359
360 /* synchronized access to registers in SDIO clock domain */
361 u32 sdioaccess; /* 0x050, rev8 */
362 u32 PAD[3];
363
364 /* PCMCIA frame control */
365 u8 pcmciaframectrl; /* 0x060, rev8 */
366 u8 PAD[3];
367 u8 pcmciawatermark; /* rev8 */
368 u8 PAD[155];
369
370 /* interrupt batching control */
371 u32 intrcvlazy; /* 0x100, rev8 */
372 u32 PAD[3];
373
374 /* counters */
375 u32 cmd52rd; /* 0x110, rev8 */
376 u32 cmd52wr; /* rev8 */
377 u32 cmd53rd; /* rev8 */
378 u32 cmd53wr; /* rev8 */
379 u32 abort; /* rev8 */
380 u32 datacrcerror; /* rev8 */
381 u32 rdoutofsync; /* rev8 */
382 u32 wroutofsync; /* rev8 */
383 u32 writebusy; /* rev8 */
384 u32 readwait; /* rev8 */
385 u32 readterm; /* rev8 */
386 u32 writeterm; /* rev8 */
387 u32 PAD[40];
388 u32 clockctlstatus; /* rev8 */
389 u32 PAD[7];
390
391 u32 PAD[128]; /* DMA engines */
392
393 /* SDIO/PCMCIA CIS region */
394 char cis[512]; /* 0x400-0x5ff, rev6 */
395
396 /* PCMCIA function control registers */
397 char pcmciafcr[256]; /* 0x600-6ff, rev6 */
398 u16 PAD[55];
399
400 /* PCMCIA backplane access */
401 u16 backplanecsr; /* 0x76E, rev6 */
402 u16 backplaneaddr0; /* rev6 */
403 u16 backplaneaddr1; /* rev6 */
404 u16 backplaneaddr2; /* rev6 */
405 u16 backplaneaddr3; /* rev6 */
406 u16 backplanedata0; /* rev6 */
407 u16 backplanedata1; /* rev6 */
408 u16 backplanedata2; /* rev6 */
409 u16 backplanedata3; /* rev6 */
410 u16 PAD[31];
411
412 /* sprom "size" & "blank" info */
413 u16 spromstatus; /* 0x7BE, rev2 */
414 u32 PAD[464];
415
416 u16 PAD[0x80];
417 };
418
419 #ifdef BCMDBG
420 /* Device console log buffer state */
421 struct brcmf_console {
422 uint count; /* Poll interval msec counter */
423 uint log_addr; /* Log struct address (fixed) */
424 struct rte_log_le log_le; /* Log struct (host copy) */
425 uint bufsize; /* Size of log buffer */
426 u8 *buf; /* Log buffer (host copy) */
427 uint last; /* Last buffer read index */
428 };
429 #endif /* BCMDBG */
430
431 struct sdpcm_shared {
432 u32 flags;
433 u32 trap_addr;
434 u32 assert_exp_addr;
435 u32 assert_file_addr;
436 u32 assert_line;
437 u32 console_addr; /* Address of struct rte_console */
438 u32 msgtrace_addr;
439 u8 tag[32];
440 };
441
442 struct sdpcm_shared_le {
443 __le32 flags;
444 __le32 trap_addr;
445 __le32 assert_exp_addr;
446 __le32 assert_file_addr;
447 __le32 assert_line;
448 __le32 console_addr; /* Address of struct rte_console */
449 __le32 msgtrace_addr;
450 u8 tag[32];
451 };
452
453
454 /* misc chip info needed by some of the routines */
455 /* Private data for SDIO bus interaction */
456 struct brcmf_sdio {
457 struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
458 struct chip_info *ci; /* Chip info struct */
459 char *vars; /* Variables (from CIS and/or other) */
460 uint varsz; /* Size of variables buffer */
461
462 u32 ramsize; /* Size of RAM in SOCRAM (bytes) */
463
464 u32 hostintmask; /* Copy of Host Interrupt Mask */
465 u32 intstatus; /* Intstatus bits (events) pending */
466 bool dpc_sched; /* Indicates DPC schedule (intrpt rcvd) */
467 bool fcstate; /* State of dongle flow-control */
468
469 uint blocksize; /* Block size of SDIO transfers */
470 uint roundup; /* Max roundup limit */
471
472 struct pktq txq; /* Queue length used for flow-control */
473 u8 flowcontrol; /* per prio flow control bitmask */
474 u8 tx_seq; /* Transmit sequence number (next) */
475 u8 tx_max; /* Maximum transmit sequence allowed */
476
477 u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
478 u8 *rxhdr; /* Header of current rx frame (in hdrbuf) */
479 u16 nextlen; /* Next Read Len from last header */
480 u8 rx_seq; /* Receive sequence number (expected) */
481 bool rxskip; /* Skip receive (awaiting NAK ACK) */
482
483 uint rxbound; /* Rx frames to read before resched */
484 uint txbound; /* Tx frames to send before resched */
485 uint txminmax;
486
487 struct sk_buff *glomd; /* Packet containing glomming descriptor */
488 struct sk_buff_head glom; /* Packet list for glommed superframe */
489 uint glomerr; /* Glom packet read errors */
490
491 u8 *rxbuf; /* Buffer for receiving control packets */
492 uint rxblen; /* Allocated length of rxbuf */
493 u8 *rxctl; /* Aligned pointer into rxbuf */
494 u8 *databuf; /* Buffer for receiving big glom packet */
495 u8 *dataptr; /* Aligned pointer into databuf */
496 uint rxlen; /* Length of valid data in buffer */
497
498 u8 sdpcm_ver; /* Bus protocol reported by dongle */
499
500 bool intr; /* Use interrupts */
501 bool poll; /* Use polling */
502 bool ipend; /* Device interrupt is pending */
503 uint intrcount; /* Count of device interrupt callbacks */
504 uint lastintrs; /* Count as of last watchdog timer */
505 uint spurious; /* Count of spurious interrupts */
506 uint pollrate; /* Ticks between device polls */
507 uint polltick; /* Tick counter */
508 uint pollcnt; /* Count of active polls */
509
510 #ifdef BCMDBG
511 uint console_interval;
512 struct brcmf_console console; /* Console output polling support */
513 uint console_addr; /* Console address from shared struct */
514 #endif /* BCMDBG */
515
516 uint regfails; /* Count of R_REG failures */
517
518 uint clkstate; /* State of sd and backplane clock(s) */
519 bool activity; /* Activity flag for clock down */
520 s32 idletime; /* Control for activity timeout */
521 s32 idlecount; /* Activity timeout counter */
522 s32 idleclock; /* How to set bus driver when idle */
523 s32 sd_rxchain;
524 bool use_rxchain; /* If brcmf should use PKT chains */
525 bool sleeping; /* Is SDIO bus sleeping? */
526 bool rxflow_mode; /* Rx flow control mode */
527 bool rxflow; /* Is rx flow control on */
528 bool alp_only; /* Don't use HT clock (ALP only) */
529 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
530 bool usebufpool;
531
532 /* Some additional counters */
533 uint tx_sderrs; /* Count of tx attempts with sd errors */
534 uint fcqueued; /* Tx packets that got queued */
535 uint rxrtx; /* Count of rtx requests (NAK to dongle) */
536 uint rx_toolong; /* Receive frames too long to receive */
537 uint rxc_errors; /* SDIO errors when reading control frames */
538 uint rx_hdrfail; /* SDIO errors on header reads */
539 uint rx_badhdr; /* Bad received headers (roosync?) */
540 uint rx_badseq; /* Mismatched rx sequence number */
541 uint fc_rcvd; /* Number of flow-control events received */
542 uint fc_xoff; /* Number which turned on flow-control */
543 uint fc_xon; /* Number which turned off flow-control */
544 uint rxglomfail; /* Failed deglom attempts */
545 uint rxglomframes; /* Number of glom frames (superframes) */
546 uint rxglompkts; /* Number of packets from glom frames */
547 uint f2rxhdrs; /* Number of header reads */
548 uint f2rxdata; /* Number of frame data reads */
549 uint f2txdata; /* Number of f2 frame writes */
550 uint f1regdata; /* Number of f1 register accesses */
551 uint tickcnt; /* Number of watchdog been schedule */
552 unsigned long tx_ctlerrs; /* Err of sending ctrl frames */
553 unsigned long tx_ctlpkts; /* Ctrl frames sent to dongle */
554 unsigned long rx_ctlerrs; /* Err of processing rx ctrl frames */
555 unsigned long rx_ctlpkts; /* Ctrl frames processed from dongle */
556 unsigned long rx_readahead_cnt; /* Number of packets where header
557 * read-ahead was used. */
558
559 u8 *ctrl_frame_buf;
560 u32 ctrl_frame_len;
561 bool ctrl_frame_stat;
562
563 spinlock_t txqlock;
564 wait_queue_head_t ctrl_wait;
565 wait_queue_head_t dcmd_resp_wait;
566
567 struct timer_list timer;
568 struct completion watchdog_wait;
569 struct task_struct *watchdog_tsk;
570 bool wd_timer_valid;
571 uint save_ms;
572
573 struct task_struct *dpc_tsk;
574 struct completion dpc_wait;
575
576 struct semaphore sdsem;
577
578 const struct firmware *firmware;
579 u32 fw_ptr;
580
581 bool txoff; /* Transmit flow-controlled */
582 };
583
584 /* clkstate */
585 #define CLK_NONE 0
586 #define CLK_SDONLY 1
587 #define CLK_PENDING 2 /* Not used yet */
588 #define CLK_AVAIL 3
589
590 #ifdef BCMDBG
591 static int qcount[NUMPRIO];
592 static int tx_packets[NUMPRIO];
593 #endif /* BCMDBG */
594
595 #define SDIO_DRIVE_STRENGTH 6 /* in milliamps */
596
597 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
598
599 /* Retry count for register access failures */
600 static const uint retry_limit = 2;
601
602 /* Limit on rounding up frames */
603 static const uint max_roundup = 512;
604
605 #define ALIGNMENT 4
606
607 static void pkt_align(struct sk_buff *p, int len, int align)
608 {
609 uint datalign;
610 datalign = (unsigned long)(p->data);
611 datalign = roundup(datalign, (align)) - datalign;
612 if (datalign)
613 skb_pull(p, datalign);
614 __skb_trim(p, len);
615 }
616
617 /* To check if there's window offered */
618 static bool data_ok(struct brcmf_sdio *bus)
619 {
620 return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
621 ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
622 }
623
624 /*
625 * Reads a register in the SDIO hardware block. This block occupies a series of
626 * adresses on the 32 bit backplane bus.
627 */
628 static void
629 r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
630 {
631 u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
632 *retryvar = 0;
633 do {
634 *regvar = brcmf_sdcard_reg_read(bus->sdiodev,
635 bus->ci->c_inf[idx].base + reg_offset,
636 sizeof(u32));
637 } while (brcmf_sdcard_regfail(bus->sdiodev) &&
638 (++(*retryvar) <= retry_limit));
639 if (*retryvar) {
640 bus->regfails += (*retryvar-1);
641 if (*retryvar > retry_limit) {
642 brcmf_dbg(ERROR, "FAILED READ %Xh\n", reg_offset);
643 *regvar = 0;
644 }
645 }
646 }
647
648 static void
649 w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset, u32 *retryvar)
650 {
651 u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
652 *retryvar = 0;
653 do {
654 brcmf_sdcard_reg_write(bus->sdiodev,
655 bus->ci->c_inf[idx].base + reg_offset,
656 sizeof(u32), regval);
657 } while (brcmf_sdcard_regfail(bus->sdiodev) &&
658 (++(*retryvar) <= retry_limit));
659 if (*retryvar) {
660 bus->regfails += (*retryvar-1);
661 if (*retryvar > retry_limit)
662 brcmf_dbg(ERROR, "FAILED REGISTER WRITE %Xh\n",
663 reg_offset);
664 }
665 }
666
667 #define PKT_AVAILABLE() (intstatus & I_HMB_FRAME_IND)
668
669 #define HOSTINTMASK (I_HMB_SW_MASK | I_CHIPACTIVE)
670
671 /* Packet free applicable unconditionally for sdio and sdspi.
672 * Conditional if bufpool was present for gspi bus.
673 */
674 static void brcmf_sdbrcm_pktfree2(struct brcmf_sdio *bus, struct sk_buff *pkt)
675 {
676 if (bus->usebufpool)
677 brcmu_pkt_buf_free_skb(pkt);
678 }
679
680 /* Turn backplane clock on or off */
681 static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
682 {
683 int err;
684 u8 clkctl, clkreq, devctl;
685 unsigned long timeout;
686
687 brcmf_dbg(TRACE, "Enter\n");
688
689 clkctl = 0;
690
691 if (on) {
692 /* Request HT Avail */
693 clkreq =
694 bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
695
696 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
697 SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
698 if (err) {
699 brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
700 return -EBADE;
701 }
702
703 /* Check current status */
704 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
705 SBSDIO_FUNC1_CHIPCLKCSR, &err);
706 if (err) {
707 brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
708 return -EBADE;
709 }
710
711 /* Go to pending and await interrupt if appropriate */
712 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
713 /* Allow only clock-available interrupt */
714 devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
715 SDIO_FUNC_1,
716 SBSDIO_DEVICE_CTL, &err);
717 if (err) {
718 brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
719 err);
720 return -EBADE;
721 }
722
723 devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
724 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
725 SBSDIO_DEVICE_CTL, devctl, &err);
726 brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
727 bus->clkstate = CLK_PENDING;
728
729 return 0;
730 } else if (bus->clkstate == CLK_PENDING) {
731 /* Cancel CA-only interrupt filter */
732 devctl =
733 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
734 SBSDIO_DEVICE_CTL, &err);
735 devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
736 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
737 SBSDIO_DEVICE_CTL, devctl, &err);
738 }
739
740 /* Otherwise, wait here (polling) for HT Avail */
741 timeout = jiffies +
742 msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
743 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
744 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev,
745 SDIO_FUNC_1,
746 SBSDIO_FUNC1_CHIPCLKCSR,
747 &err);
748 if (time_after(jiffies, timeout))
749 break;
750 else
751 usleep_range(5000, 10000);
752 }
753 if (err) {
754 brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
755 return -EBADE;
756 }
757 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
758 brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
759 PMU_MAX_TRANSITION_DLY, clkctl);
760 return -EBADE;
761 }
762
763 /* Mark clock available */
764 bus->clkstate = CLK_AVAIL;
765 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
766
767 #if defined(BCMDBG)
768 if (bus->alp_only != true) {
769 if (SBSDIO_ALPONLY(clkctl))
770 brcmf_dbg(ERROR, "HT Clock should be on\n");
771 }
772 #endif /* defined (BCMDBG) */
773
774 bus->activity = true;
775 } else {
776 clkreq = 0;
777
778 if (bus->clkstate == CLK_PENDING) {
779 /* Cancel CA-only interrupt filter */
780 devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
781 SDIO_FUNC_1,
782 SBSDIO_DEVICE_CTL, &err);
783 devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
784 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
785 SBSDIO_DEVICE_CTL, devctl, &err);
786 }
787
788 bus->clkstate = CLK_SDONLY;
789 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
790 SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
791 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
792 if (err) {
793 brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
794 err);
795 return -EBADE;
796 }
797 }
798 return 0;
799 }
800
801 /* Change idle/active SD state */
802 static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
803 {
804 brcmf_dbg(TRACE, "Enter\n");
805
806 if (on)
807 bus->clkstate = CLK_SDONLY;
808 else
809 bus->clkstate = CLK_NONE;
810
811 return 0;
812 }
813
814 /* Transition SD and backplane clock readiness */
815 static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
816 {
817 #ifdef BCMDBG
818 uint oldstate = bus->clkstate;
819 #endif /* BCMDBG */
820
821 brcmf_dbg(TRACE, "Enter\n");
822
823 /* Early exit if we're already there */
824 if (bus->clkstate == target) {
825 if (target == CLK_AVAIL) {
826 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
827 bus->activity = true;
828 }
829 return 0;
830 }
831
832 switch (target) {
833 case CLK_AVAIL:
834 /* Make sure SD clock is available */
835 if (bus->clkstate == CLK_NONE)
836 brcmf_sdbrcm_sdclk(bus, true);
837 /* Now request HT Avail on the backplane */
838 brcmf_sdbrcm_htclk(bus, true, pendok);
839 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
840 bus->activity = true;
841 break;
842
843 case CLK_SDONLY:
844 /* Remove HT request, or bring up SD clock */
845 if (bus->clkstate == CLK_NONE)
846 brcmf_sdbrcm_sdclk(bus, true);
847 else if (bus->clkstate == CLK_AVAIL)
848 brcmf_sdbrcm_htclk(bus, false, false);
849 else
850 brcmf_dbg(ERROR, "request for %d -> %d\n",
851 bus->clkstate, target);
852 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
853 break;
854
855 case CLK_NONE:
856 /* Make sure to remove HT request */
857 if (bus->clkstate == CLK_AVAIL)
858 brcmf_sdbrcm_htclk(bus, false, false);
859 /* Now remove the SD clock */
860 brcmf_sdbrcm_sdclk(bus, false);
861 brcmf_sdbrcm_wd_timer(bus, 0);
862 break;
863 }
864 #ifdef BCMDBG
865 brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
866 #endif /* BCMDBG */
867
868 return 0;
869 }
870
871 static int brcmf_sdbrcm_bussleep(struct brcmf_sdio *bus, bool sleep)
872 {
873 uint retries = 0;
874
875 brcmf_dbg(INFO, "request %s (currently %s)\n",
876 sleep ? "SLEEP" : "WAKE",
877 bus->sleeping ? "SLEEP" : "WAKE");
878
879 /* Done if we're already in the requested state */
880 if (sleep == bus->sleeping)
881 return 0;
882
883 /* Going to sleep: set the alarm and turn off the lights... */
884 if (sleep) {
885 /* Don't sleep if something is pending */
886 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
887 return -EBUSY;
888
889 /* Make sure the controller has the bus up */
890 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
891
892 /* Tell device to start using OOB wakeup */
893 w_sdreg32(bus, SMB_USE_OOB,
894 offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
895 if (retries > retry_limit)
896 brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
897
898 /* Turn off our contribution to the HT clock request */
899 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
900
901 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
902 SBSDIO_FUNC1_CHIPCLKCSR,
903 SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
904
905 /* Isolate the bus */
906 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
907 SBSDIO_DEVICE_CTL,
908 SBSDIO_DEVCTL_PADS_ISO, NULL);
909
910 /* Change state */
911 bus->sleeping = true;
912
913 } else {
914 /* Waking up: bus power up is ok, set local state */
915
916 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
917 SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
918
919 /* Make sure the controller has the bus up */
920 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
921
922 /* Send misc interrupt to indicate OOB not needed */
923 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
924 &retries);
925 if (retries <= retry_limit)
926 w_sdreg32(bus, SMB_DEV_INT,
927 offsetof(struct sdpcmd_regs, tosbmailbox),
928 &retries);
929
930 if (retries > retry_limit)
931 brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
932
933 /* Make sure we have SD bus access */
934 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
935
936 /* Change state */
937 bus->sleeping = false;
938 }
939
940 return 0;
941 }
942
943 static void bus_wake(struct brcmf_sdio *bus)
944 {
945 if (bus->sleeping)
946 brcmf_sdbrcm_bussleep(bus, false);
947 }
948
949 static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
950 {
951 u32 intstatus = 0;
952 u32 hmb_data;
953 u8 fcbits;
954 uint retries = 0;
955
956 brcmf_dbg(TRACE, "Enter\n");
957
958 /* Read mailbox data and ack that we did so */
959 r_sdreg32(bus, &hmb_data,
960 offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
961
962 if (retries <= retry_limit)
963 w_sdreg32(bus, SMB_INT_ACK,
964 offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
965 bus->f1regdata += 2;
966
967 /* Dongle recomposed rx frames, accept them again */
968 if (hmb_data & HMB_DATA_NAKHANDLED) {
969 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
970 bus->rx_seq);
971 if (!bus->rxskip)
972 brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
973
974 bus->rxskip = false;
975 intstatus |= I_HMB_FRAME_IND;
976 }
977
978 /*
979 * DEVREADY does not occur with gSPI.
980 */
981 if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
982 bus->sdpcm_ver =
983 (hmb_data & HMB_DATA_VERSION_MASK) >>
984 HMB_DATA_VERSION_SHIFT;
985 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
986 brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
987 "expecting %d\n",
988 bus->sdpcm_ver, SDPCM_PROT_VERSION);
989 else
990 brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
991 bus->sdpcm_ver);
992 }
993
994 /*
995 * Flow Control has been moved into the RX headers and this out of band
996 * method isn't used any more.
997 * remaining backward compatible with older dongles.
998 */
999 if (hmb_data & HMB_DATA_FC) {
1000 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
1001 HMB_DATA_FCDATA_SHIFT;
1002
1003 if (fcbits & ~bus->flowcontrol)
1004 bus->fc_xoff++;
1005
1006 if (bus->flowcontrol & ~fcbits)
1007 bus->fc_xon++;
1008
1009 bus->fc_rcvd++;
1010 bus->flowcontrol = fcbits;
1011 }
1012
1013 /* Shouldn't be any others */
1014 if (hmb_data & ~(HMB_DATA_DEVREADY |
1015 HMB_DATA_NAKHANDLED |
1016 HMB_DATA_FC |
1017 HMB_DATA_FWREADY |
1018 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1019 brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
1020 hmb_data);
1021
1022 return intstatus;
1023 }
1024
1025 static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
1026 {
1027 uint retries = 0;
1028 u16 lastrbc;
1029 u8 hi, lo;
1030 int err;
1031
1032 brcmf_dbg(ERROR, "%sterminate frame%s\n",
1033 abort ? "abort command, " : "",
1034 rtx ? ", send NAK" : "");
1035
1036 if (abort)
1037 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1038
1039 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1040 SBSDIO_FUNC1_FRAMECTRL,
1041 SFC_RF_TERM, &err);
1042 bus->f1regdata++;
1043
1044 /* Wait until the packet has been flushed (device/FIFO stable) */
1045 for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1046 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1047 SBSDIO_FUNC1_RFRAMEBCHI, NULL);
1048 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1049 SBSDIO_FUNC1_RFRAMEBCLO, NULL);
1050 bus->f1regdata += 2;
1051
1052 if ((hi == 0) && (lo == 0))
1053 break;
1054
1055 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1056 brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
1057 lastrbc, (hi << 8) + lo);
1058 }
1059 lastrbc = (hi << 8) + lo;
1060 }
1061
1062 if (!retries)
1063 brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
1064 else
1065 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
1066
1067 if (rtx) {
1068 bus->rxrtx++;
1069 w_sdreg32(bus, SMB_NAK,
1070 offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1071
1072 bus->f1regdata++;
1073 if (retries <= retry_limit)
1074 bus->rxskip = true;
1075 }
1076
1077 /* Clear partial in any case */
1078 bus->nextlen = 0;
1079
1080 /* If we can't reach the device, signal failure */
1081 if (err || brcmf_sdcard_regfail(bus->sdiodev))
1082 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
1083 }
1084
1085 /* copy a buffer into a pkt buffer chain */
1086 static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_sdio *bus, uint len)
1087 {
1088 uint n, ret = 0;
1089 struct sk_buff *p;
1090 u8 *buf;
1091
1092 buf = bus->dataptr;
1093
1094 /* copy the data */
1095 skb_queue_walk(&bus->glom, p) {
1096 n = min_t(uint, p->len, len);
1097 memcpy(p->data, buf, n);
1098 buf += n;
1099 len -= n;
1100 ret += n;
1101 if (!len)
1102 break;
1103 }
1104
1105 return ret;
1106 }
1107
1108 /* return total length of buffer chain */
1109 static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
1110 {
1111 struct sk_buff *p;
1112 uint total;
1113
1114 total = 0;
1115 skb_queue_walk(&bus->glom, p)
1116 total += p->len;
1117 return total;
1118 }
1119
1120 static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
1121 {
1122 struct sk_buff *cur, *next;
1123
1124 skb_queue_walk_safe(&bus->glom, cur, next) {
1125 skb_unlink(cur, &bus->glom);
1126 brcmu_pkt_buf_free_skb(cur);
1127 }
1128 }
1129
1130 static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1131 {
1132 u16 dlen, totlen;
1133 u8 *dptr, num = 0;
1134
1135 u16 sublen, check;
1136 struct sk_buff *pfirst, *pnext;
1137
1138 int errcode;
1139 u8 chan, seq, doff, sfdoff;
1140 u8 txmax;
1141
1142 int ifidx = 0;
1143 bool usechain = bus->use_rxchain;
1144
1145 /* If packets, issue read(s) and send up packet chain */
1146 /* Return sequence numbers consumed? */
1147
1148 brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
1149 bus->glomd, skb_peek(&bus->glom));
1150
1151 /* If there's a descriptor, generate the packet chain */
1152 if (bus->glomd) {
1153 pfirst = pnext = NULL;
1154 dlen = (u16) (bus->glomd->len);
1155 dptr = bus->glomd->data;
1156 if (!dlen || (dlen & 1)) {
1157 brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
1158 dlen);
1159 dlen = 0;
1160 }
1161
1162 for (totlen = num = 0; dlen; num++) {
1163 /* Get (and move past) next length */
1164 sublen = get_unaligned_le16(dptr);
1165 dlen -= sizeof(u16);
1166 dptr += sizeof(u16);
1167 if ((sublen < SDPCM_HDRLEN) ||
1168 ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1169 brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
1170 num, sublen);
1171 pnext = NULL;
1172 break;
1173 }
1174 if (sublen % BRCMF_SDALIGN) {
1175 brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
1176 sublen, BRCMF_SDALIGN);
1177 usechain = false;
1178 }
1179 totlen += sublen;
1180
1181 /* For last frame, adjust read len so total
1182 is a block multiple */
1183 if (!dlen) {
1184 sublen +=
1185 (roundup(totlen, bus->blocksize) - totlen);
1186 totlen = roundup(totlen, bus->blocksize);
1187 }
1188
1189 /* Allocate/chain packet for next subframe */
1190 pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1191 if (pnext == NULL) {
1192 brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
1193 num, sublen);
1194 break;
1195 }
1196 skb_queue_tail(&bus->glom, pnext);
1197
1198 /* Adhere to start alignment requirements */
1199 pkt_align(pnext, sublen, BRCMF_SDALIGN);
1200 }
1201
1202 /* If all allocations succeeded, save packet chain
1203 in bus structure */
1204 if (pnext) {
1205 brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1206 totlen, num);
1207 if (BRCMF_GLOM_ON() && bus->nextlen &&
1208 totlen != bus->nextlen) {
1209 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1210 bus->nextlen, totlen, rxseq);
1211 }
1212 pfirst = pnext = NULL;
1213 } else {
1214 brcmf_sdbrcm_free_glom(bus);
1215 num = 0;
1216 }
1217
1218 /* Done with descriptor packet */
1219 brcmu_pkt_buf_free_skb(bus->glomd);
1220 bus->glomd = NULL;
1221 bus->nextlen = 0;
1222 }
1223
1224 /* Ok -- either we just generated a packet chain,
1225 or had one from before */
1226 if (!skb_queue_empty(&bus->glom)) {
1227 if (BRCMF_GLOM_ON()) {
1228 brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1229 skb_queue_walk(&bus->glom, pnext) {
1230 brcmf_dbg(GLOM, " %p: %p len 0x%04x (%d)\n",
1231 pnext, (u8 *) (pnext->data),
1232 pnext->len, pnext->len);
1233 }
1234 }
1235
1236 pfirst = skb_peek(&bus->glom);
1237 dlen = (u16) brcmf_sdbrcm_glom_len(bus);
1238
1239 /* Do an SDIO read for the superframe. Configurable iovar to
1240 * read directly into the chained packet, or allocate a large
1241 * packet and and copy into the chain.
1242 */
1243 if (usechain) {
1244 errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
1245 bus->sdiodev->sbwad,
1246 SDIO_FUNC_2, F2SYNC, &bus->glom);
1247 } else if (bus->dataptr) {
1248 errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1249 bus->sdiodev->sbwad,
1250 SDIO_FUNC_2, F2SYNC,
1251 bus->dataptr, dlen);
1252 sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
1253 if (sublen != dlen) {
1254 brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
1255 dlen, sublen);
1256 errcode = -1;
1257 }
1258 pnext = NULL;
1259 } else {
1260 brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1261 dlen);
1262 errcode = -1;
1263 }
1264 bus->f2rxdata++;
1265
1266 /* On failure, kill the superframe, allow a couple retries */
1267 if (errcode < 0) {
1268 brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
1269 dlen, errcode);
1270 bus->sdiodev->bus_if->dstats.rx_errors++;
1271
1272 if (bus->glomerr++ < 3) {
1273 brcmf_sdbrcm_rxfail(bus, true, true);
1274 } else {
1275 bus->glomerr = 0;
1276 brcmf_sdbrcm_rxfail(bus, true, false);
1277 bus->rxglomfail++;
1278 brcmf_sdbrcm_free_glom(bus);
1279 }
1280 return 0;
1281 }
1282 #ifdef BCMDBG
1283 if (BRCMF_GLOM_ON()) {
1284 printk(KERN_DEBUG "SUPERFRAME:\n");
1285 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1286 pfirst->data, min_t(int, pfirst->len, 48));
1287 }
1288 #endif
1289
1290 /* Validate the superframe header */
1291 dptr = (u8 *) (pfirst->data);
1292 sublen = get_unaligned_le16(dptr);
1293 check = get_unaligned_le16(dptr + sizeof(u16));
1294
1295 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1296 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1297 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1298 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1299 brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
1300 bus->nextlen, seq);
1301 bus->nextlen = 0;
1302 }
1303 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1304 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1305
1306 errcode = 0;
1307 if ((u16)~(sublen ^ check)) {
1308 brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
1309 sublen, check);
1310 errcode = -1;
1311 } else if (roundup(sublen, bus->blocksize) != dlen) {
1312 brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
1313 sublen, roundup(sublen, bus->blocksize),
1314 dlen);
1315 errcode = -1;
1316 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
1317 SDPCM_GLOM_CHANNEL) {
1318 brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
1319 SDPCM_PACKET_CHANNEL(
1320 &dptr[SDPCM_FRAMETAG_LEN]));
1321 errcode = -1;
1322 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
1323 brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
1324 errcode = -1;
1325 } else if ((doff < SDPCM_HDRLEN) ||
1326 (doff > (pfirst->len - SDPCM_HDRLEN))) {
1327 brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
1328 doff, sublen, pfirst->len, SDPCM_HDRLEN);
1329 errcode = -1;
1330 }
1331
1332 /* Check sequence number of superframe SW header */
1333 if (rxseq != seq) {
1334 brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
1335 seq, rxseq);
1336 bus->rx_badseq++;
1337 rxseq = seq;
1338 }
1339
1340 /* Check window for sanity */
1341 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1342 brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1343 txmax, bus->tx_seq);
1344 txmax = bus->tx_seq + 2;
1345 }
1346 bus->tx_max = txmax;
1347
1348 /* Remove superframe header, remember offset */
1349 skb_pull(pfirst, doff);
1350 sfdoff = doff;
1351 num = 0;
1352
1353 /* Validate all the subframe headers */
1354 skb_queue_walk(&bus->glom, pnext) {
1355 /* leave when invalid subframe is found */
1356 if (errcode)
1357 break;
1358
1359 dptr = (u8 *) (pnext->data);
1360 dlen = (u16) (pnext->len);
1361 sublen = get_unaligned_le16(dptr);
1362 check = get_unaligned_le16(dptr + sizeof(u16));
1363 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1364 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1365 #ifdef BCMDBG
1366 if (BRCMF_GLOM_ON()) {
1367 printk(KERN_DEBUG "subframe:\n");
1368 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1369 dptr, 32);
1370 }
1371 #endif
1372
1373 if ((u16)~(sublen ^ check)) {
1374 brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
1375 num, sublen, check);
1376 errcode = -1;
1377 } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
1378 brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
1379 num, sublen, dlen);
1380 errcode = -1;
1381 } else if ((chan != SDPCM_DATA_CHANNEL) &&
1382 (chan != SDPCM_EVENT_CHANNEL)) {
1383 brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
1384 num, chan);
1385 errcode = -1;
1386 } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
1387 brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
1388 num, doff, sublen, SDPCM_HDRLEN);
1389 errcode = -1;
1390 }
1391 /* increase the subframe count */
1392 num++;
1393 }
1394
1395 if (errcode) {
1396 /* Terminate frame on error, request
1397 a couple retries */
1398 if (bus->glomerr++ < 3) {
1399 /* Restore superframe header space */
1400 skb_push(pfirst, sfdoff);
1401 brcmf_sdbrcm_rxfail(bus, true, true);
1402 } else {
1403 bus->glomerr = 0;
1404 brcmf_sdbrcm_rxfail(bus, true, false);
1405 bus->rxglomfail++;
1406 brcmf_sdbrcm_free_glom(bus);
1407 }
1408 bus->nextlen = 0;
1409 return 0;
1410 }
1411
1412 /* Basic SD framing looks ok - process each packet (header) */
1413
1414 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1415 dptr = (u8 *) (pfirst->data);
1416 sublen = get_unaligned_le16(dptr);
1417 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1418 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1419 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1420
1421 brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
1422 num, pfirst, pfirst->data,
1423 pfirst->len, sublen, chan, seq);
1424
1425 /* precondition: chan == SDPCM_DATA_CHANNEL ||
1426 chan == SDPCM_EVENT_CHANNEL */
1427
1428 if (rxseq != seq) {
1429 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
1430 seq, rxseq);
1431 bus->rx_badseq++;
1432 rxseq = seq;
1433 }
1434 rxseq++;
1435
1436 #ifdef BCMDBG
1437 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1438 printk(KERN_DEBUG "Rx Subframe Data:\n");
1439 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1440 dptr, dlen);
1441 }
1442 #endif
1443
1444 __skb_trim(pfirst, sublen);
1445 skb_pull(pfirst, doff);
1446
1447 if (pfirst->len == 0) {
1448 skb_unlink(pfirst, &bus->glom);
1449 brcmu_pkt_buf_free_skb(pfirst);
1450 continue;
1451 } else if (brcmf_proto_hdrpull(bus->sdiodev->dev,
1452 &ifidx, pfirst) != 0) {
1453 brcmf_dbg(ERROR, "rx protocol error\n");
1454 bus->sdiodev->bus_if->dstats.rx_errors++;
1455 skb_unlink(pfirst, &bus->glom);
1456 brcmu_pkt_buf_free_skb(pfirst);
1457 continue;
1458 }
1459
1460 #ifdef BCMDBG
1461 if (BRCMF_GLOM_ON()) {
1462 brcmf_dbg(GLOM, "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1463 bus->glom.qlen, pfirst, pfirst->data,
1464 pfirst->len, pfirst->next,
1465 pfirst->prev);
1466 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1467 pfirst->data,
1468 min_t(int, pfirst->len, 32));
1469 }
1470 #endif /* BCMDBG */
1471 }
1472 /* sent any remaining packets up */
1473 if (bus->glom.qlen) {
1474 up(&bus->sdsem);
1475 brcmf_rx_frame(bus->sdiodev->dev, ifidx, &bus->glom);
1476 down(&bus->sdsem);
1477 }
1478
1479 bus->rxglomframes++;
1480 bus->rxglompkts += bus->glom.qlen;
1481 }
1482 return num;
1483 }
1484
1485 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1486 bool *pending)
1487 {
1488 DECLARE_WAITQUEUE(wait, current);
1489 int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1490
1491 /* Wait until control frame is available */
1492 add_wait_queue(&bus->dcmd_resp_wait, &wait);
1493 set_current_state(TASK_INTERRUPTIBLE);
1494
1495 while (!(*condition) && (!signal_pending(current) && timeout))
1496 timeout = schedule_timeout(timeout);
1497
1498 if (signal_pending(current))
1499 *pending = true;
1500
1501 set_current_state(TASK_RUNNING);
1502 remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1503
1504 return timeout;
1505 }
1506
1507 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
1508 {
1509 if (waitqueue_active(&bus->dcmd_resp_wait))
1510 wake_up_interruptible(&bus->dcmd_resp_wait);
1511
1512 return 0;
1513 }
1514 static void
1515 brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1516 {
1517 uint rdlen, pad;
1518
1519 int sdret;
1520
1521 brcmf_dbg(TRACE, "Enter\n");
1522
1523 /* Set rxctl for frame (w/optional alignment) */
1524 bus->rxctl = bus->rxbuf;
1525 bus->rxctl += BRCMF_FIRSTREAD;
1526 pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
1527 if (pad)
1528 bus->rxctl += (BRCMF_SDALIGN - pad);
1529 bus->rxctl -= BRCMF_FIRSTREAD;
1530
1531 /* Copy the already-read portion over */
1532 memcpy(bus->rxctl, hdr, BRCMF_FIRSTREAD);
1533 if (len <= BRCMF_FIRSTREAD)
1534 goto gotpkt;
1535
1536 /* Raise rdlen to next SDIO block to avoid tail command */
1537 rdlen = len - BRCMF_FIRSTREAD;
1538 if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1539 pad = bus->blocksize - (rdlen % bus->blocksize);
1540 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1541 ((len + pad) < bus->sdiodev->bus_if->maxctl))
1542 rdlen += pad;
1543 } else if (rdlen % BRCMF_SDALIGN) {
1544 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1545 }
1546
1547 /* Satisfy length-alignment requirements */
1548 if (rdlen & (ALIGNMENT - 1))
1549 rdlen = roundup(rdlen, ALIGNMENT);
1550
1551 /* Drop if the read is too big or it exceeds our maximum */
1552 if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
1553 brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
1554 rdlen, bus->sdiodev->bus_if->maxctl);
1555 bus->sdiodev->bus_if->dstats.rx_errors++;
1556 brcmf_sdbrcm_rxfail(bus, false, false);
1557 goto done;
1558 }
1559
1560 if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
1561 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1562 len, len - doff, bus->sdiodev->bus_if->maxctl);
1563 bus->sdiodev->bus_if->dstats.rx_errors++;
1564 bus->rx_toolong++;
1565 brcmf_sdbrcm_rxfail(bus, false, false);
1566 goto done;
1567 }
1568
1569 /* Read remainder of frame body into the rxctl buffer */
1570 sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1571 bus->sdiodev->sbwad,
1572 SDIO_FUNC_2,
1573 F2SYNC, (bus->rxctl + BRCMF_FIRSTREAD), rdlen);
1574 bus->f2rxdata++;
1575
1576 /* Control frame failures need retransmission */
1577 if (sdret < 0) {
1578 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
1579 rdlen, sdret);
1580 bus->rxc_errors++;
1581 brcmf_sdbrcm_rxfail(bus, true, true);
1582 goto done;
1583 }
1584
1585 gotpkt:
1586
1587 #ifdef BCMDBG
1588 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1589 printk(KERN_DEBUG "RxCtrl:\n");
1590 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
1591 }
1592 #endif
1593
1594 /* Point to valid data and indicate its length */
1595 bus->rxctl += doff;
1596 bus->rxlen = len - doff;
1597
1598 done:
1599 /* Awake any waiters */
1600 brcmf_sdbrcm_dcmd_resp_wake(bus);
1601 }
1602
1603 /* Pad read to blocksize for efficiency */
1604 static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1605 {
1606 if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1607 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1608 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1609 *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1610 *rdlen += *pad;
1611 } else if (*rdlen % BRCMF_SDALIGN) {
1612 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1613 }
1614 }
1615
1616 static void
1617 brcmf_alloc_pkt_and_read(struct brcmf_sdio *bus, u16 rdlen,
1618 struct sk_buff **pkt, u8 **rxbuf)
1619 {
1620 int sdret; /* Return code from calls */
1621
1622 *pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
1623 if (*pkt == NULL)
1624 return;
1625
1626 pkt_align(*pkt, rdlen, BRCMF_SDALIGN);
1627 *rxbuf = (u8 *) ((*pkt)->data);
1628 /* Read the entire frame */
1629 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1630 SDIO_FUNC_2, F2SYNC, *pkt);
1631 bus->f2rxdata++;
1632
1633 if (sdret < 0) {
1634 brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
1635 rdlen, sdret);
1636 brcmu_pkt_buf_free_skb(*pkt);
1637 bus->sdiodev->bus_if->dstats.rx_errors++;
1638 /* Force retry w/normal header read.
1639 * Don't attempt NAK for
1640 * gSPI
1641 */
1642 brcmf_sdbrcm_rxfail(bus, true, true);
1643 *pkt = NULL;
1644 }
1645 }
1646
1647 /* Checks the header */
1648 static int
1649 brcmf_check_rxbuf(struct brcmf_sdio *bus, struct sk_buff *pkt, u8 *rxbuf,
1650 u8 rxseq, u16 nextlen, u16 *len)
1651 {
1652 u16 check;
1653 bool len_consistent; /* Result of comparing readahead len and
1654 len from hw-hdr */
1655
1656 memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
1657
1658 /* Extract hardware header fields */
1659 *len = get_unaligned_le16(bus->rxhdr);
1660 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1661
1662 /* All zeros means readahead info was bad */
1663 if (!(*len | check)) {
1664 brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
1665 goto fail;
1666 }
1667
1668 /* Validate check bytes */
1669 if ((u16)~(*len ^ check)) {
1670 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
1671 nextlen, *len, check);
1672 bus->rx_badhdr++;
1673 brcmf_sdbrcm_rxfail(bus, false, false);
1674 goto fail;
1675 }
1676
1677 /* Validate frame length */
1678 if (*len < SDPCM_HDRLEN) {
1679 brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
1680 *len);
1681 goto fail;
1682 }
1683
1684 /* Check for consistency with readahead info */
1685 len_consistent = (nextlen != (roundup(*len, 16) >> 4));
1686 if (len_consistent) {
1687 /* Mismatch, force retry w/normal
1688 header (may be >4K) */
1689 brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
1690 nextlen, *len, roundup(*len, 16),
1691 rxseq);
1692 brcmf_sdbrcm_rxfail(bus, true, true);
1693 goto fail;
1694 }
1695
1696 return 0;
1697
1698 fail:
1699 brcmf_sdbrcm_pktfree2(bus, pkt);
1700 return -EINVAL;
1701 }
1702
1703 /* Return true if there may be more frames to read */
1704 static uint
1705 brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
1706 {
1707 u16 len, check; /* Extracted hardware header fields */
1708 u8 chan, seq, doff; /* Extracted software header fields */
1709 u8 fcbits; /* Extracted fcbits from software header */
1710
1711 struct sk_buff *pkt; /* Packet for event or data frames */
1712 u16 pad; /* Number of pad bytes to read */
1713 u16 rdlen; /* Total number of bytes to read */
1714 u8 rxseq; /* Next sequence number to expect */
1715 uint rxleft = 0; /* Remaining number of frames allowed */
1716 int sdret; /* Return code from calls */
1717 u8 txmax; /* Maximum tx sequence offered */
1718 u8 *rxbuf;
1719 int ifidx = 0;
1720 uint rxcount = 0; /* Total frames read */
1721
1722 brcmf_dbg(TRACE, "Enter\n");
1723
1724 /* Not finished unless we encounter no more frames indication */
1725 *finished = false;
1726
1727 for (rxseq = bus->rx_seq, rxleft = maxframes;
1728 !bus->rxskip && rxleft &&
1729 bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
1730 rxseq++, rxleft--) {
1731
1732 /* Handle glomming separately */
1733 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1734 u8 cnt;
1735 brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1736 bus->glomd, skb_peek(&bus->glom));
1737 cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
1738 brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1739 rxseq += cnt - 1;
1740 rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1741 continue;
1742 }
1743
1744 /* Try doing single read if we can */
1745 if (bus->nextlen) {
1746 u16 nextlen = bus->nextlen;
1747 bus->nextlen = 0;
1748
1749 rdlen = len = nextlen << 4;
1750 brcmf_pad(bus, &pad, &rdlen);
1751
1752 /*
1753 * After the frame is received we have to
1754 * distinguish whether it is data
1755 * or non-data frame.
1756 */
1757 brcmf_alloc_pkt_and_read(bus, rdlen, &pkt, &rxbuf);
1758 if (pkt == NULL) {
1759 /* Give up on data, request rtx of events */
1760 brcmf_dbg(ERROR, "(nextlen): brcmf_alloc_pkt_and_read failed: len %d rdlen %d expected rxseq %d\n",
1761 len, rdlen, rxseq);
1762 continue;
1763 }
1764
1765 if (brcmf_check_rxbuf(bus, pkt, rxbuf, rxseq, nextlen,
1766 &len) < 0)
1767 continue;
1768
1769 /* Extract software header fields */
1770 chan = SDPCM_PACKET_CHANNEL(
1771 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1772 seq = SDPCM_PACKET_SEQUENCE(
1773 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1774 doff = SDPCM_DOFFSET_VALUE(
1775 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1776 txmax = SDPCM_WINDOW_VALUE(
1777 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1778
1779 bus->nextlen =
1780 bus->rxhdr[SDPCM_FRAMETAG_LEN +
1781 SDPCM_NEXTLEN_OFFSET];
1782 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1783 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1784 bus->nextlen, seq);
1785 bus->nextlen = 0;
1786 }
1787
1788 bus->rx_readahead_cnt++;
1789
1790 /* Handle Flow Control */
1791 fcbits = SDPCM_FCMASK_VALUE(
1792 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1793
1794 if (bus->flowcontrol != fcbits) {
1795 if (~bus->flowcontrol & fcbits)
1796 bus->fc_xoff++;
1797
1798 if (bus->flowcontrol & ~fcbits)
1799 bus->fc_xon++;
1800
1801 bus->fc_rcvd++;
1802 bus->flowcontrol = fcbits;
1803 }
1804
1805 /* Check and update sequence number */
1806 if (rxseq != seq) {
1807 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
1808 seq, rxseq);
1809 bus->rx_badseq++;
1810 rxseq = seq;
1811 }
1812
1813 /* Check window for sanity */
1814 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1815 brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
1816 txmax, bus->tx_seq);
1817 txmax = bus->tx_seq + 2;
1818 }
1819 bus->tx_max = txmax;
1820
1821 #ifdef BCMDBG
1822 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1823 printk(KERN_DEBUG "Rx Data:\n");
1824 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1825 rxbuf, len);
1826 } else if (BRCMF_HDRS_ON()) {
1827 printk(KERN_DEBUG "RxHdr:\n");
1828 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1829 bus->rxhdr, SDPCM_HDRLEN);
1830 }
1831 #endif
1832
1833 if (chan == SDPCM_CONTROL_CHANNEL) {
1834 brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
1835 seq);
1836 /* Force retry w/normal header read */
1837 bus->nextlen = 0;
1838 brcmf_sdbrcm_rxfail(bus, false, true);
1839 brcmf_sdbrcm_pktfree2(bus, pkt);
1840 continue;
1841 }
1842
1843 /* Validate data offset */
1844 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1845 brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
1846 doff, len, SDPCM_HDRLEN);
1847 brcmf_sdbrcm_rxfail(bus, false, false);
1848 brcmf_sdbrcm_pktfree2(bus, pkt);
1849 continue;
1850 }
1851
1852 /* All done with this one -- now deliver the packet */
1853 goto deliver;
1854 }
1855
1856 /* Read frame header (hardware and software) */
1857 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
1858 SDIO_FUNC_2, F2SYNC, bus->rxhdr,
1859 BRCMF_FIRSTREAD);
1860 bus->f2rxhdrs++;
1861
1862 if (sdret < 0) {
1863 brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
1864 bus->rx_hdrfail++;
1865 brcmf_sdbrcm_rxfail(bus, true, true);
1866 continue;
1867 }
1868 #ifdef BCMDBG
1869 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
1870 printk(KERN_DEBUG "RxHdr:\n");
1871 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1872 bus->rxhdr, SDPCM_HDRLEN);
1873 }
1874 #endif
1875
1876 /* Extract hardware header fields */
1877 len = get_unaligned_le16(bus->rxhdr);
1878 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1879
1880 /* All zeros means no more frames */
1881 if (!(len | check)) {
1882 *finished = true;
1883 break;
1884 }
1885
1886 /* Validate check bytes */
1887 if ((u16) ~(len ^ check)) {
1888 brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
1889 len, check);
1890 bus->rx_badhdr++;
1891 brcmf_sdbrcm_rxfail(bus, false, false);
1892 continue;
1893 }
1894
1895 /* Validate frame length */
1896 if (len < SDPCM_HDRLEN) {
1897 brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
1898 continue;
1899 }
1900
1901 /* Extract software header fields */
1902 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1903 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1904 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1905 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1906
1907 /* Validate data offset */
1908 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1909 brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
1910 doff, len, SDPCM_HDRLEN, seq);
1911 bus->rx_badhdr++;
1912 brcmf_sdbrcm_rxfail(bus, false, false);
1913 continue;
1914 }
1915
1916 /* Save the readahead length if there is one */
1917 bus->nextlen =
1918 bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1919 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1920 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1921 bus->nextlen, seq);
1922 bus->nextlen = 0;
1923 }
1924
1925 /* Handle Flow Control */
1926 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1927
1928 if (bus->flowcontrol != fcbits) {
1929 if (~bus->flowcontrol & fcbits)
1930 bus->fc_xoff++;
1931
1932 if (bus->flowcontrol & ~fcbits)
1933 bus->fc_xon++;
1934
1935 bus->fc_rcvd++;
1936 bus->flowcontrol = fcbits;
1937 }
1938
1939 /* Check and update sequence number */
1940 if (rxseq != seq) {
1941 brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
1942 bus->rx_badseq++;
1943 rxseq = seq;
1944 }
1945
1946 /* Check window for sanity */
1947 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1948 brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1949 txmax, bus->tx_seq);
1950 txmax = bus->tx_seq + 2;
1951 }
1952 bus->tx_max = txmax;
1953
1954 /* Call a separate function for control frames */
1955 if (chan == SDPCM_CONTROL_CHANNEL) {
1956 brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
1957 continue;
1958 }
1959
1960 /* precondition: chan is either SDPCM_DATA_CHANNEL,
1961 SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
1962 SDPCM_GLOM_CHANNEL */
1963
1964 /* Length to read */
1965 rdlen = (len > BRCMF_FIRSTREAD) ? (len - BRCMF_FIRSTREAD) : 0;
1966
1967 /* May pad read to blocksize for efficiency */
1968 if (bus->roundup && bus->blocksize &&
1969 (rdlen > bus->blocksize)) {
1970 pad = bus->blocksize - (rdlen % bus->blocksize);
1971 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1972 ((rdlen + pad + BRCMF_FIRSTREAD) < MAX_RX_DATASZ))
1973 rdlen += pad;
1974 } else if (rdlen % BRCMF_SDALIGN) {
1975 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1976 }
1977
1978 /* Satisfy length-alignment requirements */
1979 if (rdlen & (ALIGNMENT - 1))
1980 rdlen = roundup(rdlen, ALIGNMENT);
1981
1982 if ((rdlen + BRCMF_FIRSTREAD) > MAX_RX_DATASZ) {
1983 /* Too long -- skip this frame */
1984 brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
1985 len, rdlen);
1986 bus->sdiodev->bus_if->dstats.rx_errors++;
1987 bus->rx_toolong++;
1988 brcmf_sdbrcm_rxfail(bus, false, false);
1989 continue;
1990 }
1991
1992 pkt = brcmu_pkt_buf_get_skb(rdlen +
1993 BRCMF_FIRSTREAD + BRCMF_SDALIGN);
1994 if (!pkt) {
1995 /* Give up on data, request rtx of events */
1996 brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
1997 rdlen, chan);
1998 bus->sdiodev->bus_if->dstats.rx_dropped++;
1999 brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
2000 continue;
2001 }
2002
2003 /* Leave room for what we already read, and align remainder */
2004 skb_pull(pkt, BRCMF_FIRSTREAD);
2005 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
2006
2007 /* Read the remaining frame data */
2008 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
2009 SDIO_FUNC_2, F2SYNC, pkt);
2010 bus->f2rxdata++;
2011
2012 if (sdret < 0) {
2013 brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
2014 ((chan == SDPCM_EVENT_CHANNEL) ? "event"
2015 : ((chan == SDPCM_DATA_CHANNEL) ? "data"
2016 : "test")), sdret);
2017 brcmu_pkt_buf_free_skb(pkt);
2018 bus->sdiodev->bus_if->dstats.rx_errors++;
2019 brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
2020 continue;
2021 }
2022
2023 /* Copy the already-read portion */
2024 skb_push(pkt, BRCMF_FIRSTREAD);
2025 memcpy(pkt->data, bus->rxhdr, BRCMF_FIRSTREAD);
2026
2027 #ifdef BCMDBG
2028 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2029 printk(KERN_DEBUG "Rx Data:\n");
2030 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2031 pkt->data, len);
2032 }
2033 #endif
2034
2035 deliver:
2036 /* Save superframe descriptor and allocate packet frame */
2037 if (chan == SDPCM_GLOM_CHANNEL) {
2038 if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
2039 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
2040 len);
2041 #ifdef BCMDBG
2042 if (BRCMF_GLOM_ON()) {
2043 printk(KERN_DEBUG "Glom Data:\n");
2044 print_hex_dump_bytes("",
2045 DUMP_PREFIX_OFFSET,
2046 pkt->data, len);
2047 }
2048 #endif
2049 __skb_trim(pkt, len);
2050 skb_pull(pkt, SDPCM_HDRLEN);
2051 bus->glomd = pkt;
2052 } else {
2053 brcmf_dbg(ERROR, "%s: glom superframe w/o "
2054 "descriptor!\n", __func__);
2055 brcmf_sdbrcm_rxfail(bus, false, false);
2056 }
2057 continue;
2058 }
2059
2060 /* Fill in packet len and prio, deliver upward */
2061 __skb_trim(pkt, len);
2062 skb_pull(pkt, doff);
2063
2064 if (pkt->len == 0) {
2065 brcmu_pkt_buf_free_skb(pkt);
2066 continue;
2067 } else if (brcmf_proto_hdrpull(bus->sdiodev->dev, &ifidx,
2068 pkt) != 0) {
2069 brcmf_dbg(ERROR, "rx protocol error\n");
2070 brcmu_pkt_buf_free_skb(pkt);
2071 bus->sdiodev->bus_if->dstats.rx_errors++;
2072 continue;
2073 }
2074
2075 /* Unlock during rx call */
2076 up(&bus->sdsem);
2077 brcmf_rx_packet(bus->sdiodev->dev, ifidx, pkt);
2078 down(&bus->sdsem);
2079 }
2080 rxcount = maxframes - rxleft;
2081 #ifdef BCMDBG
2082 /* Message if we hit the limit */
2083 if (!rxleft)
2084 brcmf_dbg(DATA, "hit rx limit of %d frames\n",
2085 maxframes);
2086 else
2087 #endif /* BCMDBG */
2088 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2089 /* Back off rxseq if awaiting rtx, update rx_seq */
2090 if (bus->rxskip)
2091 rxseq--;
2092 bus->rx_seq = rxseq;
2093
2094 return rxcount;
2095 }
2096
2097 static void
2098 brcmf_sdbrcm_wait_for_event(struct brcmf_sdio *bus, bool *lockvar)
2099 {
2100 up(&bus->sdsem);
2101 wait_event_interruptible_timeout(bus->ctrl_wait,
2102 (*lockvar == false), HZ * 2);
2103 down(&bus->sdsem);
2104 return;
2105 }
2106
2107 static void
2108 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
2109 {
2110 if (waitqueue_active(&bus->ctrl_wait))
2111 wake_up_interruptible(&bus->ctrl_wait);
2112 return;
2113 }
2114
2115 /* Writes a HW/SW header into the packet and sends it. */
2116 /* Assumes: (a) header space already there, (b) caller holds lock */
2117 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
2118 uint chan, bool free_pkt)
2119 {
2120 int ret;
2121 u8 *frame;
2122 u16 len, pad = 0;
2123 u32 swheader;
2124 struct sk_buff *new;
2125 int i;
2126
2127 brcmf_dbg(TRACE, "Enter\n");
2128
2129 frame = (u8 *) (pkt->data);
2130
2131 /* Add alignment padding, allocate new packet if needed */
2132 pad = ((unsigned long)frame % BRCMF_SDALIGN);
2133 if (pad) {
2134 if (skb_headroom(pkt) < pad) {
2135 brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
2136 skb_headroom(pkt), pad);
2137 bus->sdiodev->bus_if->tx_realloc++;
2138 new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
2139 if (!new) {
2140 brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
2141 pkt->len + BRCMF_SDALIGN);
2142 ret = -ENOMEM;
2143 goto done;
2144 }
2145
2146 pkt_align(new, pkt->len, BRCMF_SDALIGN);
2147 memcpy(new->data, pkt->data, pkt->len);
2148 if (free_pkt)
2149 brcmu_pkt_buf_free_skb(pkt);
2150 /* free the pkt if canned one is not used */
2151 free_pkt = true;
2152 pkt = new;
2153 frame = (u8 *) (pkt->data);
2154 /* precondition: (frame % BRCMF_SDALIGN) == 0) */
2155 pad = 0;
2156 } else {
2157 skb_push(pkt, pad);
2158 frame = (u8 *) (pkt->data);
2159 /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
2160 memset(frame, 0, pad + SDPCM_HDRLEN);
2161 }
2162 }
2163 /* precondition: pad < BRCMF_SDALIGN */
2164
2165 /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2166 len = (u16) (pkt->len);
2167 *(__le16 *) frame = cpu_to_le16(len);
2168 *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
2169
2170 /* Software tag: channel, sequence number, data offset */
2171 swheader =
2172 ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
2173 (((pad +
2174 SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
2175
2176 put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2177 put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2178
2179 #ifdef BCMDBG
2180 tx_packets[pkt->priority]++;
2181 if (BRCMF_BYTES_ON() &&
2182 (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
2183 (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
2184 printk(KERN_DEBUG "Tx Frame:\n");
2185 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
2186 } else if (BRCMF_HDRS_ON()) {
2187 printk(KERN_DEBUG "TxHdr:\n");
2188 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2189 frame, min_t(u16, len, 16));
2190 }
2191 #endif
2192
2193 /* Raise len to next SDIO block to eliminate tail command */
2194 if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2195 u16 pad = bus->blocksize - (len % bus->blocksize);
2196 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2197 len += pad;
2198 } else if (len % BRCMF_SDALIGN) {
2199 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2200 }
2201
2202 /* Some controllers have trouble with odd bytes -- round to even */
2203 if (len & (ALIGNMENT - 1))
2204 len = roundup(len, ALIGNMENT);
2205
2206 ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
2207 SDIO_FUNC_2, F2SYNC, pkt);
2208 bus->f2txdata++;
2209
2210 if (ret < 0) {
2211 /* On failure, abort the command and terminate the frame */
2212 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2213 ret);
2214 bus->tx_sderrs++;
2215
2216 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2217 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2218 SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2219 NULL);
2220 bus->f1regdata++;
2221
2222 for (i = 0; i < 3; i++) {
2223 u8 hi, lo;
2224 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2225 SDIO_FUNC_1,
2226 SBSDIO_FUNC1_WFRAMEBCHI,
2227 NULL);
2228 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2229 SDIO_FUNC_1,
2230 SBSDIO_FUNC1_WFRAMEBCLO,
2231 NULL);
2232 bus->f1regdata += 2;
2233 if ((hi == 0) && (lo == 0))
2234 break;
2235 }
2236
2237 }
2238 if (ret == 0)
2239 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2240
2241 done:
2242 /* restore pkt buffer pointer before calling tx complete routine */
2243 skb_pull(pkt, SDPCM_HDRLEN + pad);
2244 up(&bus->sdsem);
2245 brcmf_txcomplete(bus->sdiodev->dev, pkt, ret != 0);
2246 down(&bus->sdsem);
2247
2248 if (free_pkt)
2249 brcmu_pkt_buf_free_skb(pkt);
2250
2251 return ret;
2252 }
2253
2254 static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
2255 {
2256 struct sk_buff *pkt;
2257 u32 intstatus = 0;
2258 uint retries = 0;
2259 int ret = 0, prec_out;
2260 uint cnt = 0;
2261 uint datalen;
2262 u8 tx_prec_map;
2263
2264 brcmf_dbg(TRACE, "Enter\n");
2265
2266 tx_prec_map = ~bus->flowcontrol;
2267
2268 /* Send frames until the limit or some other event */
2269 for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
2270 spin_lock_bh(&bus->txqlock);
2271 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
2272 if (pkt == NULL) {
2273 spin_unlock_bh(&bus->txqlock);
2274 break;
2275 }
2276 spin_unlock_bh(&bus->txqlock);
2277 datalen = pkt->len - SDPCM_HDRLEN;
2278
2279 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
2280 if (ret)
2281 bus->sdiodev->bus_if->dstats.tx_errors++;
2282 else
2283 bus->sdiodev->bus_if->dstats.tx_bytes += datalen;
2284
2285 /* In poll mode, need to check for other events */
2286 if (!bus->intr && cnt) {
2287 /* Check device status, signal pending interrupt */
2288 r_sdreg32(bus, &intstatus,
2289 offsetof(struct sdpcmd_regs, intstatus),
2290 &retries);
2291 bus->f2txdata++;
2292 if (brcmf_sdcard_regfail(bus->sdiodev))
2293 break;
2294 if (intstatus & bus->hostintmask)
2295 bus->ipend = true;
2296 }
2297 }
2298
2299 /* Deflow-control stack if needed */
2300 if (bus->sdiodev->bus_if->drvr_up &&
2301 (bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
2302 bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
2303 bus->txoff = OFF;
2304 brcmf_txflowcontrol(bus->sdiodev->dev, 0, OFF);
2305 }
2306
2307 return cnt;
2308 }
2309
2310 static void brcmf_sdbrcm_bus_stop(struct device *dev)
2311 {
2312 u32 local_hostintmask;
2313 u8 saveclk;
2314 uint retries;
2315 int err;
2316 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2317 struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
2318 struct brcmf_sdio *bus = sdiodev->bus;
2319
2320 brcmf_dbg(TRACE, "Enter\n");
2321
2322 if (bus->watchdog_tsk) {
2323 send_sig(SIGTERM, bus->watchdog_tsk, 1);
2324 kthread_stop(bus->watchdog_tsk);
2325 bus->watchdog_tsk = NULL;
2326 }
2327
2328 if (bus->dpc_tsk && bus->dpc_tsk != current) {
2329 send_sig(SIGTERM, bus->dpc_tsk, 1);
2330 kthread_stop(bus->dpc_tsk);
2331 bus->dpc_tsk = NULL;
2332 }
2333
2334 down(&bus->sdsem);
2335
2336 bus_wake(bus);
2337
2338 /* Enable clock for device interrupts */
2339 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2340
2341 /* Disable and clear interrupts at the chip level also */
2342 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
2343 local_hostintmask = bus->hostintmask;
2344 bus->hostintmask = 0;
2345
2346 /* Change our idea of bus state */
2347 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2348
2349 /* Force clocks on backplane to be sure F2 interrupt propagates */
2350 saveclk = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2351 SBSDIO_FUNC1_CHIPCLKCSR, &err);
2352 if (!err) {
2353 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2354 SBSDIO_FUNC1_CHIPCLKCSR,
2355 (saveclk | SBSDIO_FORCE_HT), &err);
2356 }
2357 if (err)
2358 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
2359
2360 /* Turn off the bus (F2), free any pending packets */
2361 brcmf_dbg(INTR, "disable SDIO interrupts\n");
2362 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
2363 SDIO_FUNC_ENABLE_1, NULL);
2364
2365 /* Clear any pending interrupts now that F2 is disabled */
2366 w_sdreg32(bus, local_hostintmask,
2367 offsetof(struct sdpcmd_regs, intstatus), &retries);
2368
2369 /* Turn off the backplane clock (only) */
2370 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
2371
2372 /* Clear the data packet queues */
2373 brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2374
2375 /* Clear any held glomming stuff */
2376 if (bus->glomd)
2377 brcmu_pkt_buf_free_skb(bus->glomd);
2378 brcmf_sdbrcm_free_glom(bus);
2379
2380 /* Clear rx control and wake any waiters */
2381 bus->rxlen = 0;
2382 brcmf_sdbrcm_dcmd_resp_wake(bus);
2383
2384 /* Reset some F2 state stuff */
2385 bus->rxskip = false;
2386 bus->tx_seq = bus->rx_seq = 0;
2387
2388 up(&bus->sdsem);
2389 }
2390
2391 static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
2392 {
2393 u32 intstatus, newstatus = 0;
2394 uint retries = 0;
2395 uint rxlimit = bus->rxbound; /* Rx frames to read before resched */
2396 uint txlimit = bus->txbound; /* Tx frames to send before resched */
2397 uint framecnt = 0; /* Temporary counter of tx/rx frames */
2398 bool rxdone = true; /* Flag for no more read data */
2399 bool resched = false; /* Flag indicating resched wanted */
2400
2401 brcmf_dbg(TRACE, "Enter\n");
2402
2403 /* Start with leftover status bits */
2404 intstatus = bus->intstatus;
2405
2406 down(&bus->sdsem);
2407
2408 /* If waiting for HTAVAIL, check status */
2409 if (bus->clkstate == CLK_PENDING) {
2410 int err;
2411 u8 clkctl, devctl = 0;
2412
2413 #ifdef BCMDBG
2414 /* Check for inconsistent device control */
2415 devctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2416 SBSDIO_DEVICE_CTL, &err);
2417 if (err) {
2418 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
2419 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2420 }
2421 #endif /* BCMDBG */
2422
2423 /* Read CSR, if clock on switch to AVAIL, else ignore */
2424 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2425 SBSDIO_FUNC1_CHIPCLKCSR, &err);
2426 if (err) {
2427 brcmf_dbg(ERROR, "error reading CSR: %d\n",
2428 err);
2429 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2430 }
2431
2432 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2433 devctl, clkctl);
2434
2435 if (SBSDIO_HTAV(clkctl)) {
2436 devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
2437 SDIO_FUNC_1,
2438 SBSDIO_DEVICE_CTL, &err);
2439 if (err) {
2440 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
2441 err);
2442 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2443 }
2444 devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2445 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2446 SBSDIO_DEVICE_CTL, devctl, &err);
2447 if (err) {
2448 brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
2449 err);
2450 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2451 }
2452 bus->clkstate = CLK_AVAIL;
2453 } else {
2454 goto clkwait;
2455 }
2456 }
2457
2458 bus_wake(bus);
2459
2460 /* Make sure backplane clock is on */
2461 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2462 if (bus->clkstate == CLK_PENDING)
2463 goto clkwait;
2464
2465 /* Pending interrupt indicates new device status */
2466 if (bus->ipend) {
2467 bus->ipend = false;
2468 r_sdreg32(bus, &newstatus,
2469 offsetof(struct sdpcmd_regs, intstatus), &retries);
2470 bus->f1regdata++;
2471 if (brcmf_sdcard_regfail(bus->sdiodev))
2472 newstatus = 0;
2473 newstatus &= bus->hostintmask;
2474 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
2475 if (newstatus) {
2476 w_sdreg32(bus, newstatus,
2477 offsetof(struct sdpcmd_regs, intstatus),
2478 &retries);
2479 bus->f1regdata++;
2480 }
2481 }
2482
2483 /* Merge new bits with previous */
2484 intstatus |= newstatus;
2485 bus->intstatus = 0;
2486
2487 /* Handle flow-control change: read new state in case our ack
2488 * crossed another change interrupt. If change still set, assume
2489 * FC ON for safety, let next loop through do the debounce.
2490 */
2491 if (intstatus & I_HMB_FC_CHANGE) {
2492 intstatus &= ~I_HMB_FC_CHANGE;
2493 w_sdreg32(bus, I_HMB_FC_CHANGE,
2494 offsetof(struct sdpcmd_regs, intstatus), &retries);
2495
2496 r_sdreg32(bus, &newstatus,
2497 offsetof(struct sdpcmd_regs, intstatus), &retries);
2498 bus->f1regdata += 2;
2499 bus->fcstate =
2500 !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
2501 intstatus |= (newstatus & bus->hostintmask);
2502 }
2503
2504 /* Handle host mailbox indication */
2505 if (intstatus & I_HMB_HOST_INT) {
2506 intstatus &= ~I_HMB_HOST_INT;
2507 intstatus |= brcmf_sdbrcm_hostmail(bus);
2508 }
2509
2510 /* Generally don't ask for these, can get CRC errors... */
2511 if (intstatus & I_WR_OOSYNC) {
2512 brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
2513 intstatus &= ~I_WR_OOSYNC;
2514 }
2515
2516 if (intstatus & I_RD_OOSYNC) {
2517 brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
2518 intstatus &= ~I_RD_OOSYNC;
2519 }
2520
2521 if (intstatus & I_SBINT) {
2522 brcmf_dbg(ERROR, "Dongle reports SBINT\n");
2523 intstatus &= ~I_SBINT;
2524 }
2525
2526 /* Would be active due to wake-wlan in gSPI */
2527 if (intstatus & I_CHIPACTIVE) {
2528 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2529 intstatus &= ~I_CHIPACTIVE;
2530 }
2531
2532 /* Ignore frame indications if rxskip is set */
2533 if (bus->rxskip)
2534 intstatus &= ~I_HMB_FRAME_IND;
2535
2536 /* On frame indication, read available frames */
2537 if (PKT_AVAILABLE()) {
2538 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
2539 if (rxdone || bus->rxskip)
2540 intstatus &= ~I_HMB_FRAME_IND;
2541 rxlimit -= min(framecnt, rxlimit);
2542 }
2543
2544 /* Keep still-pending events for next scheduling */
2545 bus->intstatus = intstatus;
2546
2547 clkwait:
2548 if (data_ok(bus) && bus->ctrl_frame_stat &&
2549 (bus->clkstate == CLK_AVAIL)) {
2550 int ret, i;
2551
2552 ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2553 SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
2554 (u32) bus->ctrl_frame_len);
2555
2556 if (ret < 0) {
2557 /* On failure, abort the command and
2558 terminate the frame */
2559 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2560 ret);
2561 bus->tx_sderrs++;
2562
2563 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2564
2565 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2566 SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2567 NULL);
2568 bus->f1regdata++;
2569
2570 for (i = 0; i < 3; i++) {
2571 u8 hi, lo;
2572 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2573 SDIO_FUNC_1,
2574 SBSDIO_FUNC1_WFRAMEBCHI,
2575 NULL);
2576 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2577 SDIO_FUNC_1,
2578 SBSDIO_FUNC1_WFRAMEBCLO,
2579 NULL);
2580 bus->f1regdata += 2;
2581 if ((hi == 0) && (lo == 0))
2582 break;
2583 }
2584
2585 }
2586 if (ret == 0)
2587 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2588
2589 brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
2590 bus->ctrl_frame_stat = false;
2591 brcmf_sdbrcm_wait_event_wakeup(bus);
2592 }
2593 /* Send queued frames (limit 1 if rx may still be pending) */
2594 else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
2595 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2596 && data_ok(bus)) {
2597 framecnt = rxdone ? txlimit : min(txlimit, bus->txminmax);
2598 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2599 txlimit -= framecnt;
2600 }
2601
2602 /* Resched if events or tx frames are pending,
2603 else await next interrupt */
2604 /* On failed register access, all bets are off:
2605 no resched or interrupts */
2606 if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) ||
2607 brcmf_sdcard_regfail(bus->sdiodev)) {
2608 brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation %d\n",
2609 brcmf_sdcard_regfail(bus->sdiodev));
2610 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2611 bus->intstatus = 0;
2612 } else if (bus->clkstate == CLK_PENDING) {
2613 brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
2614 resched = true;
2615 } else if (bus->intstatus || bus->ipend ||
2616 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
2617 && data_ok(bus)) || PKT_AVAILABLE()) {
2618 resched = true;
2619 }
2620
2621 bus->dpc_sched = resched;
2622
2623 /* If we're done for now, turn off clock request. */
2624 if ((bus->clkstate != CLK_PENDING)
2625 && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2626 bus->activity = false;
2627 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2628 }
2629
2630 up(&bus->sdsem);
2631
2632 return resched;
2633 }
2634
2635 static int brcmf_sdbrcm_dpc_thread(void *data)
2636 {
2637 struct brcmf_sdio *bus = (struct brcmf_sdio *) data;
2638
2639 allow_signal(SIGTERM);
2640 /* Run until signal received */
2641 while (1) {
2642 if (kthread_should_stop())
2643 break;
2644 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
2645 /* Call bus dpc unless it indicated down
2646 (then clean stop) */
2647 if (bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN) {
2648 if (brcmf_sdbrcm_dpc(bus))
2649 complete(&bus->dpc_wait);
2650 } else {
2651 /* after stopping the bus, exit thread */
2652 brcmf_sdbrcm_bus_stop(bus->sdiodev->dev);
2653 bus->dpc_tsk = NULL;
2654 break;
2655 }
2656 } else
2657 break;
2658 }
2659 return 0;
2660 }
2661
2662 static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
2663 {
2664 int ret = -EBADE;
2665 uint datalen, prec;
2666 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2667 struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
2668 struct brcmf_sdio *bus = sdiodev->bus;
2669
2670 brcmf_dbg(TRACE, "Enter\n");
2671
2672 datalen = pkt->len;
2673
2674 /* Add space for the header */
2675 skb_push(pkt, SDPCM_HDRLEN);
2676 /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2677
2678 prec = prio2prec((pkt->priority & PRIOMASK));
2679
2680 /* Check for existing queue, current flow-control,
2681 pending event, or pending clock */
2682 brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2683 bus->fcqueued++;
2684
2685 /* Priority based enq */
2686 spin_lock_bh(&bus->txqlock);
2687 if (brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec) ==
2688 false) {
2689 skb_pull(pkt, SDPCM_HDRLEN);
2690 brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
2691 brcmu_pkt_buf_free_skb(pkt);
2692 brcmf_dbg(ERROR, "out of bus->txq !!!\n");
2693 ret = -ENOSR;
2694 } else {
2695 ret = 0;
2696 }
2697 spin_unlock_bh(&bus->txqlock);
2698
2699 if (pktq_len(&bus->txq) >= TXHI) {
2700 bus->txoff = ON;
2701 brcmf_txflowcontrol(bus->sdiodev->dev, 0, ON);
2702 }
2703
2704 #ifdef BCMDBG
2705 if (pktq_plen(&bus->txq, prec) > qcount[prec])
2706 qcount[prec] = pktq_plen(&bus->txq, prec);
2707 #endif
2708 /* Schedule DPC if needed to send queued packet(s) */
2709 if (!bus->dpc_sched) {
2710 bus->dpc_sched = true;
2711 if (bus->dpc_tsk)
2712 complete(&bus->dpc_wait);
2713 }
2714
2715 return ret;
2716 }
2717
2718 static int
2719 brcmf_sdbrcm_membytes(struct brcmf_sdio *bus, bool write, u32 address, u8 *data,
2720 uint size)
2721 {
2722 int bcmerror = 0;
2723 u32 sdaddr;
2724 uint dsize;
2725
2726 /* Determine initial transfer parameters */
2727 sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2728 if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2729 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2730 else
2731 dsize = size;
2732
2733 /* Set the backplane window to include the start address */
2734 bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2735 if (bcmerror) {
2736 brcmf_dbg(ERROR, "window change failed\n");
2737 goto xfer_done;
2738 }
2739
2740 /* Do the transfer(s) */
2741 while (size) {
2742 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2743 write ? "write" : "read", dsize,
2744 sdaddr, address & SBSDIO_SBWINDOW_MASK);
2745 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2746 sdaddr, data, dsize);
2747 if (bcmerror) {
2748 brcmf_dbg(ERROR, "membytes transfer failed\n");
2749 break;
2750 }
2751
2752 /* Adjust for next transfer (if any) */
2753 size -= dsize;
2754 if (size) {
2755 data += dsize;
2756 address += dsize;
2757 bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2758 address);
2759 if (bcmerror) {
2760 brcmf_dbg(ERROR, "window change failed\n");
2761 break;
2762 }
2763 sdaddr = 0;
2764 dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2765 }
2766 }
2767
2768 xfer_done:
2769 /* Return the window to backplane enumeration space for core access */
2770 if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2771 brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
2772 bus->sdiodev->sbwad);
2773
2774 return bcmerror;
2775 }
2776
2777 #ifdef BCMDBG
2778 #define CONSOLE_LINE_MAX 192
2779
2780 static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
2781 {
2782 struct brcmf_console *c = &bus->console;
2783 u8 line[CONSOLE_LINE_MAX], ch;
2784 u32 n, idx, addr;
2785 int rv;
2786
2787 /* Don't do anything until FWREADY updates console address */
2788 if (bus->console_addr == 0)
2789 return 0;
2790
2791 /* Read console log struct */
2792 addr = bus->console_addr + offsetof(struct rte_console, log_le);
2793 rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
2794 sizeof(c->log_le));
2795 if (rv < 0)
2796 return rv;
2797
2798 /* Allocate console buffer (one time only) */
2799 if (c->buf == NULL) {
2800 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2801 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2802 if (c->buf == NULL)
2803 return -ENOMEM;
2804 }
2805
2806 idx = le32_to_cpu(c->log_le.idx);
2807
2808 /* Protect against corrupt value */
2809 if (idx > c->bufsize)
2810 return -EBADE;
2811
2812 /* Skip reading the console buffer if the index pointer
2813 has not moved */
2814 if (idx == c->last)
2815 return 0;
2816
2817 /* Read the console buffer */
2818 addr = le32_to_cpu(c->log_le.buf);
2819 rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2820 if (rv < 0)
2821 return rv;
2822
2823 while (c->last != idx) {
2824 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2825 if (c->last == idx) {
2826 /* This would output a partial line.
2827 * Instead, back up
2828 * the buffer pointer and output this
2829 * line next time around.
2830 */
2831 if (c->last >= n)
2832 c->last -= n;
2833 else
2834 c->last = c->bufsize - n;
2835 goto break2;
2836 }
2837 ch = c->buf[c->last];
2838 c->last = (c->last + 1) % c->bufsize;
2839 if (ch == '\n')
2840 break;
2841 line[n] = ch;
2842 }
2843
2844 if (n > 0) {
2845 if (line[n - 1] == '\r')
2846 n--;
2847 line[n] = 0;
2848 printk(KERN_DEBUG "CONSOLE: %s\n", line);
2849 }
2850 }
2851 break2:
2852
2853 return 0;
2854 }
2855 #endif /* BCMDBG */
2856
2857 static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
2858 {
2859 int i;
2860 int ret;
2861
2862 bus->ctrl_frame_stat = false;
2863 ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2864 SDIO_FUNC_2, F2SYNC, frame, len);
2865
2866 if (ret < 0) {
2867 /* On failure, abort the command and terminate the frame */
2868 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2869 ret);
2870 bus->tx_sderrs++;
2871
2872 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2873
2874 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2875 SBSDIO_FUNC1_FRAMECTRL,
2876 SFC_WF_TERM, NULL);
2877 bus->f1regdata++;
2878
2879 for (i = 0; i < 3; i++) {
2880 u8 hi, lo;
2881 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2882 SBSDIO_FUNC1_WFRAMEBCHI,
2883 NULL);
2884 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2885 SBSDIO_FUNC1_WFRAMEBCLO,
2886 NULL);
2887 bus->f1regdata += 2;
2888 if (hi == 0 && lo == 0)
2889 break;
2890 }
2891 return ret;
2892 }
2893
2894 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2895
2896 return ret;
2897 }
2898
2899 static int
2900 brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2901 {
2902 u8 *frame;
2903 u16 len;
2904 u32 swheader;
2905 uint retries = 0;
2906 u8 doff = 0;
2907 int ret = -1;
2908 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2909 struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
2910 struct brcmf_sdio *bus = sdiodev->bus;
2911
2912 brcmf_dbg(TRACE, "Enter\n");
2913
2914 /* Back the pointer to make a room for bus header */
2915 frame = msg - SDPCM_HDRLEN;
2916 len = (msglen += SDPCM_HDRLEN);
2917
2918 /* Add alignment padding (optional for ctl frames) */
2919 doff = ((unsigned long)frame % BRCMF_SDALIGN);
2920 if (doff) {
2921 frame -= doff;
2922 len += doff;
2923 msglen += doff;
2924 memset(frame, 0, doff + SDPCM_HDRLEN);
2925 }
2926 /* precondition: doff < BRCMF_SDALIGN */
2927 doff += SDPCM_HDRLEN;
2928
2929 /* Round send length to next SDIO block */
2930 if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2931 u16 pad = bus->blocksize - (len % bus->blocksize);
2932 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2933 len += pad;
2934 } else if (len % BRCMF_SDALIGN) {
2935 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2936 }
2937
2938 /* Satisfy length-alignment requirements */
2939 if (len & (ALIGNMENT - 1))
2940 len = roundup(len, ALIGNMENT);
2941
2942 /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2943
2944 /* Need to lock here to protect txseq and SDIO tx calls */
2945 down(&bus->sdsem);
2946
2947 bus_wake(bus);
2948
2949 /* Make sure backplane clock is on */
2950 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2951
2952 /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2953 *(__le16 *) frame = cpu_to_le16((u16) msglen);
2954 *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
2955
2956 /* Software tag: channel, sequence number, data offset */
2957 swheader =
2958 ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
2959 SDPCM_CHANNEL_MASK)
2960 | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
2961 SDPCM_DOFFSET_MASK);
2962 put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2963 put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2964
2965 if (!data_ok(bus)) {
2966 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2967 bus->tx_max, bus->tx_seq);
2968 bus->ctrl_frame_stat = true;
2969 /* Send from dpc */
2970 bus->ctrl_frame_buf = frame;
2971 bus->ctrl_frame_len = len;
2972
2973 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
2974
2975 if (bus->ctrl_frame_stat == false) {
2976 brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
2977 ret = 0;
2978 } else {
2979 brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
2980 ret = -1;
2981 }
2982 }
2983
2984 if (ret == -1) {
2985 #ifdef BCMDBG
2986 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
2987 printk(KERN_DEBUG "Tx Frame:\n");
2988 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2989 frame, len);
2990 } else if (BRCMF_HDRS_ON()) {
2991 printk(KERN_DEBUG "TxHdr:\n");
2992 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2993 frame, min_t(u16, len, 16));
2994 }
2995 #endif
2996
2997 do {
2998 ret = brcmf_tx_frame(bus, frame, len);
2999 } while (ret < 0 && retries++ < TXRETRIES);
3000 }
3001
3002 if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
3003 bus->activity = false;
3004 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
3005 }
3006
3007 up(&bus->sdsem);
3008
3009 if (ret)
3010 bus->tx_ctlerrs++;
3011 else
3012 bus->tx_ctlpkts++;
3013
3014 return ret ? -EIO : 0;
3015 }
3016
3017 static int
3018 brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
3019 {
3020 int timeleft;
3021 uint rxlen = 0;
3022 bool pending;
3023 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3024 struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
3025 struct brcmf_sdio *bus = sdiodev->bus;
3026
3027 brcmf_dbg(TRACE, "Enter\n");
3028
3029 /* Wait until control frame is available */
3030 timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
3031
3032 down(&bus->sdsem);
3033 rxlen = bus->rxlen;
3034 memcpy(msg, bus->rxctl, min(msglen, rxlen));
3035 bus->rxlen = 0;
3036 up(&bus->sdsem);
3037
3038 if (rxlen) {
3039 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
3040 rxlen, msglen);
3041 } else if (timeleft == 0) {
3042 brcmf_dbg(ERROR, "resumed on timeout\n");
3043 } else if (pending == true) {
3044 brcmf_dbg(CTL, "cancelled\n");
3045 return -ERESTARTSYS;
3046 } else {
3047 brcmf_dbg(CTL, "resumed for unknown reason?\n");
3048 }
3049
3050 if (rxlen)
3051 bus->rx_ctlpkts++;
3052 else
3053 bus->rx_ctlerrs++;
3054
3055 return rxlen ? (int)rxlen : -ETIMEDOUT;
3056 }
3057
3058 static int brcmf_sdbrcm_downloadvars(struct brcmf_sdio *bus, void *arg, int len)
3059 {
3060 int bcmerror = 0;
3061
3062 brcmf_dbg(TRACE, "Enter\n");
3063
3064 /* Basic sanity checks */
3065 if (bus->sdiodev->bus_if->drvr_up) {
3066 bcmerror = -EISCONN;
3067 goto err;
3068 }
3069 if (!len) {
3070 bcmerror = -EOVERFLOW;
3071 goto err;
3072 }
3073
3074 /* Free the old ones and replace with passed variables */
3075 kfree(bus->vars);
3076
3077 bus->vars = kmalloc(len, GFP_ATOMIC);
3078 bus->varsz = bus->vars ? len : 0;
3079 if (bus->vars == NULL) {
3080 bcmerror = -ENOMEM;
3081 goto err;
3082 }
3083
3084 /* Copy the passed variables, which should include the
3085 terminating double-null */
3086 memcpy(bus->vars, arg, bus->varsz);
3087 err:
3088 return bcmerror;
3089 }
3090
3091 static int brcmf_sdbrcm_write_vars(struct brcmf_sdio *bus)
3092 {
3093 int bcmerror = 0;
3094 u32 varsize;
3095 u32 varaddr;
3096 u8 *vbuffer;
3097 u32 varsizew;
3098 __le32 varsizew_le;
3099 #ifdef BCMDBG
3100 char *nvram_ularray;
3101 #endif /* BCMDBG */
3102
3103 /* Even if there are no vars are to be written, we still
3104 need to set the ramsize. */
3105 varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
3106 varaddr = (bus->ramsize - 4) - varsize;
3107
3108 if (bus->vars) {
3109 vbuffer = kzalloc(varsize, GFP_ATOMIC);
3110 if (!vbuffer)
3111 return -ENOMEM;
3112
3113 memcpy(vbuffer, bus->vars, bus->varsz);
3114
3115 /* Write the vars list */
3116 bcmerror =
3117 brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
3118 #ifdef BCMDBG
3119 /* Verify NVRAM bytes */
3120 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
3121 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
3122 if (!nvram_ularray) {
3123 kfree(vbuffer);
3124 return -ENOMEM;
3125 }
3126
3127 /* Upload image to verify downloaded contents. */
3128 memset(nvram_ularray, 0xaa, varsize);
3129
3130 /* Read the vars list to temp buffer for comparison */
3131 bcmerror =
3132 brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
3133 varsize);
3134 if (bcmerror) {
3135 brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
3136 bcmerror, varsize, varaddr);
3137 }
3138 /* Compare the org NVRAM with the one read from RAM */
3139 if (memcmp(vbuffer, nvram_ularray, varsize))
3140 brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
3141 else
3142 brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
3143
3144 kfree(nvram_ularray);
3145 #endif /* BCMDBG */
3146
3147 kfree(vbuffer);
3148 }
3149
3150 /* adjust to the user specified RAM */
3151 brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
3152 brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3153 varaddr, varsize);
3154 varsize = ((bus->ramsize - 4) - varaddr);
3155
3156 /*
3157 * Determine the length token:
3158 * Varsize, converted to words, in lower 16-bits, checksum
3159 * in upper 16-bits.
3160 */
3161 if (bcmerror) {
3162 varsizew = 0;
3163 varsizew_le = cpu_to_le32(0);
3164 } else {
3165 varsizew = varsize / 4;
3166 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3167 varsizew_le = cpu_to_le32(varsizew);
3168 }
3169
3170 brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3171 varsize, varsizew);
3172
3173 /* Write the length token to the last word */
3174 bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
3175 (u8 *)&varsizew_le, 4);
3176
3177 return bcmerror;
3178 }
3179
3180 static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
3181 {
3182 uint retries;
3183 int bcmerror = 0;
3184 struct chip_info *ci = bus->ci;
3185
3186 /* To enter download state, disable ARM and reset SOCRAM.
3187 * To exit download state, simply reset ARM (default is RAM boot).
3188 */
3189 if (enter) {
3190 bus->alp_only = true;
3191
3192 ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3193
3194 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
3195
3196 /* Clear the top bit of memory */
3197 if (bus->ramsize) {
3198 u32 zeros = 0;
3199 brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3200 (u8 *)&zeros, 4);
3201 }
3202 } else {
3203 if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
3204 brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
3205 bcmerror = -EBADE;
3206 goto fail;
3207 }
3208
3209 bcmerror = brcmf_sdbrcm_write_vars(bus);
3210 if (bcmerror) {
3211 brcmf_dbg(ERROR, "no vars written to RAM\n");
3212 bcmerror = 0;
3213 }
3214
3215 w_sdreg32(bus, 0xFFFFFFFF,
3216 offsetof(struct sdpcmd_regs, intstatus), &retries);
3217
3218 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3219
3220 /* Allow HT Clock now that the ARM is running. */
3221 bus->alp_only = false;
3222
3223 bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
3224 }
3225 fail:
3226 return bcmerror;
3227 }
3228
3229 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
3230 {
3231 if (bus->firmware->size < bus->fw_ptr + len)
3232 len = bus->firmware->size - bus->fw_ptr;
3233
3234 memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3235 bus->fw_ptr += len;
3236 return len;
3237 }
3238
3239 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
3240 {
3241 int offset = 0;
3242 uint len;
3243 u8 *memblock = NULL, *memptr;
3244 int ret;
3245
3246 brcmf_dbg(INFO, "Enter\n");
3247
3248 ret = request_firmware(&bus->firmware, BRCMFMAC_FW_NAME,
3249 &bus->sdiodev->func[2]->dev);
3250 if (ret) {
3251 brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
3252 return ret;
3253 }
3254 bus->fw_ptr = 0;
3255
3256 memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3257 if (memblock == NULL) {
3258 ret = -ENOMEM;
3259 goto err;
3260 }
3261 if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3262 memptr += (BRCMF_SDALIGN -
3263 ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3264
3265 /* Download image */
3266 while ((len =
3267 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3268 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3269 if (ret) {
3270 brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
3271 ret, MEMBLOCK, offset);
3272 goto err;
3273 }
3274
3275 offset += MEMBLOCK;
3276 }
3277
3278 err:
3279 kfree(memblock);
3280
3281 release_firmware(bus->firmware);
3282 bus->fw_ptr = 0;
3283
3284 return ret;
3285 }
3286
3287 /*
3288 * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3289 * and ending in a NUL.
3290 * Removes carriage returns, empty lines, comment lines, and converts
3291 * newlines to NULs.
3292 * Shortens buffer as needed and pads with NULs. End of buffer is marked
3293 * by two NULs.
3294 */
3295
3296 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
3297 {
3298 char *dp;
3299 bool findNewline;
3300 int column;
3301 uint buf_len, n;
3302
3303 dp = varbuf;
3304
3305 findNewline = false;
3306 column = 0;
3307
3308 for (n = 0; n < len; n++) {
3309 if (varbuf[n] == 0)
3310 break;
3311 if (varbuf[n] == '\r')
3312 continue;
3313 if (findNewline && varbuf[n] != '\n')
3314 continue;
3315 findNewline = false;
3316 if (varbuf[n] == '#') {
3317 findNewline = true;
3318 continue;
3319 }
3320 if (varbuf[n] == '\n') {
3321 if (column == 0)
3322 continue;
3323 *dp++ = 0;
3324 column = 0;
3325 continue;
3326 }
3327 *dp++ = varbuf[n];
3328 column++;
3329 }
3330 buf_len = dp - varbuf;
3331
3332 while (dp < varbuf + n)
3333 *dp++ = 0;
3334
3335 return buf_len;
3336 }
3337
3338 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
3339 {
3340 uint len;
3341 char *memblock = NULL;
3342 char *bufp;
3343 int ret;
3344
3345 ret = request_firmware(&bus->firmware, BRCMFMAC_NV_NAME,
3346 &bus->sdiodev->func[2]->dev);
3347 if (ret) {
3348 brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
3349 return ret;
3350 }
3351 bus->fw_ptr = 0;
3352
3353 memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
3354 if (memblock == NULL) {
3355 ret = -ENOMEM;
3356 goto err;
3357 }
3358
3359 len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
3360
3361 if (len > 0 && len < MEMBLOCK) {
3362 bufp = (char *)memblock;
3363 bufp[len] = 0;
3364 len = brcmf_process_nvram_vars(bufp, len);
3365 bufp += len;
3366 *bufp++ = 0;
3367 if (len)
3368 ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
3369 if (ret)
3370 brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
3371 } else {
3372 brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
3373 ret = -EIO;
3374 }
3375
3376 err:
3377 kfree(memblock);
3378
3379 release_firmware(bus->firmware);
3380 bus->fw_ptr = 0;
3381
3382 return ret;
3383 }
3384
3385 static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3386 {
3387 int bcmerror = -1;
3388
3389 /* Keep arm in reset */
3390 if (brcmf_sdbrcm_download_state(bus, true)) {
3391 brcmf_dbg(ERROR, "error placing ARM core in reset\n");
3392 goto err;
3393 }
3394
3395 /* External image takes precedence if specified */
3396 if (brcmf_sdbrcm_download_code_file(bus)) {
3397 brcmf_dbg(ERROR, "dongle image file download failed\n");
3398 goto err;
3399 }
3400
3401 /* External nvram takes precedence if specified */
3402 if (brcmf_sdbrcm_download_nvram(bus))
3403 brcmf_dbg(ERROR, "dongle nvram file download failed\n");
3404
3405 /* Take arm out of reset */
3406 if (brcmf_sdbrcm_download_state(bus, false)) {
3407 brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
3408 goto err;
3409 }
3410
3411 bcmerror = 0;
3412
3413 err:
3414 return bcmerror;
3415 }
3416
3417 static bool
3418 brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3419 {
3420 bool ret;
3421
3422 /* Download the firmware */
3423 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3424
3425 ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3426
3427 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3428
3429 return ret;
3430 }
3431
3432 static int brcmf_sdbrcm_bus_init(struct device *dev)
3433 {
3434 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3435 struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv;
3436 struct brcmf_sdio *bus = sdiodev->bus;
3437 unsigned long timeout;
3438 uint retries = 0;
3439 u8 ready, enable;
3440 int err, ret = 0;
3441 u8 saveclk;
3442
3443 brcmf_dbg(TRACE, "Enter\n");
3444
3445 /* try to download image and nvram to the dongle */
3446 if (bus_if->state == BRCMF_BUS_DOWN) {
3447 if (!(brcmf_sdbrcm_download_firmware(bus)))
3448 return -1;
3449 }
3450
3451 if (!bus->sdiodev->bus_if->drvr)
3452 return 0;
3453
3454 /* Start the watchdog timer */
3455 bus->tickcnt = 0;
3456 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3457
3458 down(&bus->sdsem);
3459
3460 /* Make sure backplane clock is on, needed to generate F2 interrupt */
3461 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3462 if (bus->clkstate != CLK_AVAIL)
3463 goto exit;
3464
3465 /* Force clocks on backplane to be sure F2 interrupt propagates */
3466 saveclk =
3467 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3468 SBSDIO_FUNC1_CHIPCLKCSR, &err);
3469 if (!err) {
3470 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3471 SBSDIO_FUNC1_CHIPCLKCSR,
3472 (saveclk | SBSDIO_FORCE_HT), &err);
3473 }
3474 if (err) {
3475 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3476 goto exit;
3477 }
3478
3479 /* Enable function 2 (frame transfers) */
3480 w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3481 offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
3482 enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3483
3484 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3485 enable, NULL);
3486
3487 timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3488 ready = 0;
3489 while (enable != ready) {
3490 ready = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_0,
3491 SDIO_CCCR_IORx, NULL);
3492 if (time_after(jiffies, timeout))
3493 break;
3494 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3495 /* prevent busy waiting if it takes too long */
3496 msleep_interruptible(20);
3497 }
3498
3499 brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3500
3501 /* If F2 successfully enabled, set core and enable interrupts */
3502 if (ready == enable) {
3503 /* Set up the interrupt mask and enable interrupts */
3504 bus->hostintmask = HOSTINTMASK;
3505 w_sdreg32(bus, bus->hostintmask,
3506 offsetof(struct sdpcmd_regs, hostintmask), &retries);
3507
3508 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3509 SBSDIO_WATERMARK, 8, &err);
3510
3511 /* Set bus state according to enable result */
3512 bus_if->state = BRCMF_BUS_DATA;
3513 }
3514
3515 else {
3516 /* Disable F2 again */
3517 enable = SDIO_FUNC_ENABLE_1;
3518 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0,
3519 SDIO_CCCR_IOEx, enable, NULL);
3520 }
3521
3522 /* Restore previous clock setting */
3523 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3524 SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3525
3526 /* If we didn't come up, turn off backplane clock */
3527 if (bus_if->state != BRCMF_BUS_DATA)
3528 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3529
3530 exit:
3531 up(&bus->sdsem);
3532
3533 return ret;
3534 }
3535
3536 void brcmf_sdbrcm_isr(void *arg)
3537 {
3538 struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
3539
3540 brcmf_dbg(TRACE, "Enter\n");
3541
3542 if (!bus) {
3543 brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
3544 return;
3545 }
3546
3547 if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
3548 brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
3549 return;
3550 }
3551 /* Count the interrupt call */
3552 bus->intrcount++;
3553 bus->ipend = true;
3554
3555 /* Shouldn't get this interrupt if we're sleeping? */
3556 if (bus->sleeping) {
3557 brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
3558 return;
3559 }
3560
3561 /* Disable additional interrupts (is this needed now)? */
3562 if (!bus->intr)
3563 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
3564
3565 bus->dpc_sched = true;
3566 if (bus->dpc_tsk)
3567 complete(&bus->dpc_wait);
3568 }
3569
3570 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
3571 {
3572 #ifdef BCMDBG
3573 struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
3574 #endif /* BCMDBG */
3575
3576 brcmf_dbg(TIMER, "Enter\n");
3577
3578 /* Ignore the timer if simulating bus down */
3579 if (bus->sleeping)
3580 return false;
3581
3582 down(&bus->sdsem);
3583
3584 /* Poll period: check device if appropriate. */
3585 if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3586 u32 intstatus = 0;
3587
3588 /* Reset poll tick */
3589 bus->polltick = 0;
3590
3591 /* Check device if no interrupts */
3592 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
3593
3594 if (!bus->dpc_sched) {
3595 u8 devpend;
3596 devpend = brcmf_sdcard_cfg_read(bus->sdiodev,
3597 SDIO_FUNC_0, SDIO_CCCR_INTx,
3598 NULL);
3599 intstatus =
3600 devpend & (INTR_STATUS_FUNC1 |
3601 INTR_STATUS_FUNC2);
3602 }
3603
3604 /* If there is something, make like the ISR and
3605 schedule the DPC */
3606 if (intstatus) {
3607 bus->pollcnt++;
3608 bus->ipend = true;
3609
3610 bus->dpc_sched = true;
3611 if (bus->dpc_tsk)
3612 complete(&bus->dpc_wait);
3613 }
3614 }
3615
3616 /* Update interrupt tracking */
3617 bus->lastintrs = bus->intrcount;
3618 }
3619 #ifdef BCMDBG
3620 /* Poll for console output periodically */
3621 if (bus_if->state == BRCMF_BUS_DATA &&
3622 bus->console_interval != 0) {
3623 bus->console.count += BRCMF_WD_POLL_MS;
3624 if (bus->console.count >= bus->console_interval) {
3625 bus->console.count -= bus->console_interval;
3626 /* Make sure backplane clock is on */
3627 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3628 if (brcmf_sdbrcm_readconsole(bus) < 0)
3629 /* stop on error */
3630 bus->console_interval = 0;
3631 }
3632 }
3633 #endif /* BCMDBG */
3634
3635 /* On idle timeout clear activity flag and/or turn off clock */
3636 if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3637 if (++bus->idlecount >= bus->idletime) {
3638 bus->idlecount = 0;
3639 if (bus->activity) {
3640 bus->activity = false;
3641 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3642 } else {
3643 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3644 }
3645 }
3646 }
3647
3648 up(&bus->sdsem);
3649
3650 return bus->ipend;
3651 }
3652
3653 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3654 {
3655 if (chipid == BCM4329_CHIP_ID)
3656 return true;
3657 if (chipid == BCM4330_CHIP_ID)
3658 return true;
3659 return false;
3660 }
3661
3662 static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
3663 {
3664 brcmf_dbg(TRACE, "Enter\n");
3665
3666 kfree(bus->rxbuf);
3667 bus->rxctl = bus->rxbuf = NULL;
3668 bus->rxlen = 0;
3669
3670 kfree(bus->databuf);
3671 bus->databuf = NULL;
3672 }
3673
3674 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
3675 {
3676 brcmf_dbg(TRACE, "Enter\n");
3677
3678 if (bus->sdiodev->bus_if->maxctl) {
3679 bus->rxblen =
3680 roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
3681 ALIGNMENT) + BRCMF_SDALIGN;
3682 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3683 if (!(bus->rxbuf))
3684 goto fail;
3685 }
3686
3687 /* Allocate buffer to receive glomed packet */
3688 bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
3689 if (!(bus->databuf)) {
3690 /* release rxbuf which was already located as above */
3691 if (!bus->rxblen)
3692 kfree(bus->rxbuf);
3693 goto fail;
3694 }
3695
3696 /* Align the buffer */
3697 if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
3698 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
3699 ((unsigned long)bus->databuf % BRCMF_SDALIGN));
3700 else
3701 bus->dataptr = bus->databuf;
3702
3703 return true;
3704
3705 fail:
3706 return false;
3707 }
3708
3709 static bool
3710 brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
3711 {
3712 u8 clkctl = 0;
3713 int err = 0;
3714 int reg_addr;
3715 u32 reg_val;
3716 u8 idx;
3717
3718 bus->alp_only = true;
3719
3720 /* Return the window to backplane enumeration space for core access */
3721 if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, SI_ENUM_BASE))
3722 brcmf_dbg(ERROR, "FAILED to return to SI_ENUM_BASE\n");
3723
3724 #ifdef BCMDBG
3725 printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
3726 brcmf_sdcard_reg_read(bus->sdiodev, SI_ENUM_BASE, 4));
3727
3728 #endif /* BCMDBG */
3729
3730 /*
3731 * Force PLL off until brcmf_sdio_chip_attach()
3732 * programs PLL control regs
3733 */
3734
3735 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3736 SBSDIO_FUNC1_CHIPCLKCSR,
3737 BRCMF_INIT_CLKCTL1, &err);
3738 if (!err)
3739 clkctl =
3740 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3741 SBSDIO_FUNC1_CHIPCLKCSR, &err);
3742
3743 if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3744 brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3745 err, BRCMF_INIT_CLKCTL1, clkctl);
3746 goto fail;
3747 }
3748
3749 if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3750 brcmf_dbg(ERROR, "brcmf_sdio_chip_attach failed!\n");
3751 goto fail;
3752 }
3753
3754 if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
3755 brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
3756 goto fail;
3757 }
3758
3759 brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
3760 SDIO_DRIVE_STRENGTH);
3761
3762 /* Get info on the SOCRAM cores... */
3763 bus->ramsize = bus->ci->ramsize;
3764 if (!(bus->ramsize)) {
3765 brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
3766 goto fail;
3767 }
3768
3769 /* Set core control so an SDIO reset does a backplane reset */
3770 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3771 reg_addr = bus->ci->c_inf[idx].base +
3772 offsetof(struct sdpcmd_regs, corecontrol);
3773 reg_val = brcmf_sdcard_reg_read(bus->sdiodev, reg_addr, sizeof(u32));
3774 brcmf_sdcard_reg_write(bus->sdiodev, reg_addr, sizeof(u32),
3775 reg_val | CC_BPRESEN);
3776
3777 brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3778
3779 /* Locate an appropriately-aligned portion of hdrbuf */
3780 bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3781 BRCMF_SDALIGN);
3782
3783 /* Set the poll and/or interrupt flags */
3784 bus->intr = true;
3785 bus->poll = false;
3786 if (bus->poll)
3787 bus->pollrate = 1;
3788
3789 return true;
3790
3791 fail:
3792 return false;
3793 }
3794
3795 static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
3796 {
3797 brcmf_dbg(TRACE, "Enter\n");
3798
3799 /* Disable F2 to clear any intermediate frame state on the dongle */
3800 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3801 SDIO_FUNC_ENABLE_1, NULL);
3802
3803 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3804 bus->sleeping = false;
3805 bus->rxflow = false;
3806
3807 /* Done with backplane-dependent accesses, can drop clock... */
3808 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3809 SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3810
3811 /* ...and initialize clock/power states */
3812 bus->clkstate = CLK_SDONLY;
3813 bus->idletime = BRCMF_IDLE_INTERVAL;
3814 bus->idleclock = BRCMF_IDLE_ACTIVE;
3815
3816 /* Query the F2 block size, set roundup accordingly */
3817 bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3818 bus->roundup = min(max_roundup, bus->blocksize);
3819
3820 /* bus module does not support packet chaining */
3821 bus->use_rxchain = false;
3822 bus->sd_rxchain = false;
3823
3824 return true;
3825 }
3826
3827 static int
3828 brcmf_sdbrcm_watchdog_thread(void *data)
3829 {
3830 struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3831
3832 allow_signal(SIGTERM);
3833 /* Run until signal received */
3834 while (1) {
3835 if (kthread_should_stop())
3836 break;
3837 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3838 brcmf_sdbrcm_bus_watchdog(bus);
3839 /* Count the tick for reference */
3840 bus->tickcnt++;
3841 } else
3842 break;
3843 }
3844 return 0;
3845 }
3846
3847 static void
3848 brcmf_sdbrcm_watchdog(unsigned long data)
3849 {
3850 struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3851
3852 if (bus->watchdog_tsk) {
3853 complete(&bus->watchdog_wait);
3854 /* Reschedule the watchdog */
3855 if (bus->wd_timer_valid)
3856 mod_timer(&bus->timer,
3857 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3858 }
3859 }
3860
3861 static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
3862 {
3863 brcmf_dbg(TRACE, "Enter\n");
3864
3865 if (bus->ci) {
3866 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3867 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3868 brcmf_sdio_chip_detach(&bus->ci);
3869 if (bus->vars && bus->varsz)
3870 kfree(bus->vars);
3871 bus->vars = NULL;
3872 }
3873
3874 brcmf_dbg(TRACE, "Disconnected\n");
3875 }
3876
3877 /* Detach and free everything */
3878 static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
3879 {
3880 brcmf_dbg(TRACE, "Enter\n");
3881
3882 if (bus) {
3883 /* De-register interrupt handler */
3884 brcmf_sdcard_intr_dereg(bus->sdiodev);
3885
3886 if (bus->sdiodev->bus_if->drvr) {
3887 brcmf_detach(bus->sdiodev->dev);
3888 brcmf_sdbrcm_release_dongle(bus);
3889 }
3890
3891 brcmf_sdbrcm_release_malloc(bus);
3892
3893 kfree(bus);
3894 }
3895
3896 brcmf_dbg(TRACE, "Disconnected\n");
3897 }
3898
3899 void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
3900 {
3901 int ret;
3902 struct brcmf_sdio *bus;
3903
3904 brcmf_dbg(TRACE, "Enter\n");
3905
3906 /* We make an assumption about address window mappings:
3907 * regsva == SI_ENUM_BASE*/
3908
3909 /* Allocate private bus interface state */
3910 bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
3911 if (!bus)
3912 goto fail;
3913
3914 bus->sdiodev = sdiodev;
3915 sdiodev->bus = bus;
3916 skb_queue_head_init(&bus->glom);
3917 bus->txbound = BRCMF_TXBOUND;
3918 bus->rxbound = BRCMF_RXBOUND;
3919 bus->txminmax = BRCMF_TXMINMAX;
3920 bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
3921 bus->usebufpool = false; /* Use bufpool if allocated,
3922 else use locally malloced rxbuf */
3923
3924 /* attempt to attach to the dongle */
3925 if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3926 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
3927 goto fail;
3928 }
3929
3930 spin_lock_init(&bus->txqlock);
3931 init_waitqueue_head(&bus->ctrl_wait);
3932 init_waitqueue_head(&bus->dcmd_resp_wait);
3933
3934 /* Set up the watchdog timer */
3935 init_timer(&bus->timer);
3936 bus->timer.data = (unsigned long)bus;
3937 bus->timer.function = brcmf_sdbrcm_watchdog;
3938
3939 /* Initialize thread based operation and lock */
3940 sema_init(&bus->sdsem, 1);
3941
3942 /* Initialize watchdog thread */
3943 init_completion(&bus->watchdog_wait);
3944 bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3945 bus, "brcmf_watchdog");
3946 if (IS_ERR(bus->watchdog_tsk)) {
3947 printk(KERN_WARNING
3948 "brcmf_watchdog thread failed to start\n");
3949 bus->watchdog_tsk = NULL;
3950 }
3951 /* Initialize DPC thread */
3952 init_completion(&bus->dpc_wait);
3953 bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
3954 bus, "brcmf_dpc");
3955 if (IS_ERR(bus->dpc_tsk)) {
3956 printk(KERN_WARNING
3957 "brcmf_dpc thread failed to start\n");
3958 bus->dpc_tsk = NULL;
3959 }
3960
3961 /* Assign bus interface call back */
3962 bus->sdiodev->bus_if->brcmf_bus_stop = brcmf_sdbrcm_bus_stop;
3963 bus->sdiodev->bus_if->brcmf_bus_init = brcmf_sdbrcm_bus_init;
3964 bus->sdiodev->bus_if->brcmf_bus_txdata = brcmf_sdbrcm_bus_txdata;
3965 bus->sdiodev->bus_if->brcmf_bus_txctl = brcmf_sdbrcm_bus_txctl;
3966 bus->sdiodev->bus_if->brcmf_bus_rxctl = brcmf_sdbrcm_bus_rxctl;
3967 /* Attach to the brcmf/OS/network interface */
3968 ret = brcmf_attach(SDPCM_RESERVE, bus->sdiodev->dev);
3969 if (ret != 0) {
3970 brcmf_dbg(ERROR, "brcmf_attach failed\n");
3971 goto fail;
3972 }
3973
3974 /* Allocate buffers */
3975 if (!(brcmf_sdbrcm_probe_malloc(bus))) {
3976 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
3977 goto fail;
3978 }
3979
3980 if (!(brcmf_sdbrcm_probe_init(bus))) {
3981 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
3982 goto fail;
3983 }
3984
3985 /* Register interrupt callback, but mask it (not operational yet). */
3986 brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
3987 ret = brcmf_sdcard_intr_reg(bus->sdiodev);
3988 if (ret != 0) {
3989 brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
3990 goto fail;
3991 }
3992 brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
3993
3994 brcmf_dbg(INFO, "completed!!\n");
3995
3996 /* if firmware path present try to download and bring up bus */
3997 ret = brcmf_bus_start(bus->sdiodev->dev);
3998 if (ret != 0) {
3999 if (ret == -ENOLINK) {
4000 brcmf_dbg(ERROR, "dongle is not responding\n");
4001 goto fail;
4002 }
4003 }
4004
4005 /* add interface and open for business */
4006 if (brcmf_add_if(bus->sdiodev->dev, 0, "wlan%d", NULL)) {
4007 brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
4008 goto fail;
4009 }
4010
4011 return bus;
4012
4013 fail:
4014 brcmf_sdbrcm_release(bus);
4015 return NULL;
4016 }
4017
4018 void brcmf_sdbrcm_disconnect(void *ptr)
4019 {
4020 struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
4021
4022 brcmf_dbg(TRACE, "Enter\n");
4023
4024 if (bus)
4025 brcmf_sdbrcm_release(bus);
4026
4027 brcmf_dbg(TRACE, "Disconnected\n");
4028 }
4029
4030 void
4031 brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
4032 {
4033 /* Totally stop the timer */
4034 if (!wdtick && bus->wd_timer_valid == true) {
4035 del_timer_sync(&bus->timer);
4036 bus->wd_timer_valid = false;
4037 bus->save_ms = wdtick;
4038 return;
4039 }
4040
4041 /* don't start the wd until fw is loaded */
4042 if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
4043 return;
4044
4045 if (wdtick) {
4046 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4047 if (bus->wd_timer_valid == true)
4048 /* Stop timer and restart at new value */
4049 del_timer_sync(&bus->timer);
4050
4051 /* Create timer again when watchdog period is
4052 dynamically changed or in the first instance
4053 */
4054 bus->timer.expires =
4055 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4056 add_timer(&bus->timer);
4057
4058 } else {
4059 /* Re arm the timer, at last watchdog period */
4060 mod_timer(&bus->timer,
4061 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4062 }
4063
4064 bus->wd_timer_valid = true;
4065 bus->save_ms = wdtick;
4066 }
4067 }