?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
brcm80211: fmac: change firmware/nvram name to be more generic
[linux-2.6.git] / drivers / net / wireless / brcm80211 / brcmfmac / dhd_sdio.c
blob1f3e3198ebf136736cf650d27f25138d1484f85f
1 /*
2 * Copyright (c) 2010 Broadcom Corporation
3 *
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/kthread.h>
20 #include <linux/printk.h>
21 #include <linux/pci_ids.h>
22 #include <linux/netdevice.h>
23 #include <linux/interrupt.h>
24 #include <linux/sched.h>
25 #include <linux/mmc/sdio.h>
26 #include <linux/mmc/sdio_func.h>
27 #include <linux/mmc/card.h>
28 #include <linux/semaphore.h>
29 #include <linux/firmware.h>
30 #include <linux/module.h>
31 #include <linux/bcma/bcma.h>
32 #include <asm/unaligned.h>
33 #include <defs.h>
34 #include <brcmu_wifi.h>
35 #include <brcmu_utils.h>
36 #include <brcm_hw_ids.h>
37 #include <soc.h>
38 #include "sdio_host.h"
39 #include "sdio_chip.h"
40
41 #define DCMD_RESP_TIMEOUT 2000 /* In milli second */
42
43 #ifdef BCMDBG
44
45 #define BRCMF_TRAP_INFO_SIZE 80
46
47 #define CBUF_LEN (128)
48
49 struct rte_log_le {
50 __le32 buf; /* Can't be pointer on (64-bit) hosts */
51 __le32 buf_size;
52 __le32 idx;
53 char *_buf_compat; /* Redundant pointer for backward compat. */
54 };
55
56 struct rte_console {
57 /* Virtual UART
58 * When there is no UART (e.g. Quickturn),
59 * the host should write a complete
60 * input line directly into cbuf and then write
61 * the length into vcons_in.
62 * This may also be used when there is a real UART
63 * (at risk of conflicting with
64 * the real UART). vcons_out is currently unused.
65 */
66 uint vcons_in;
67 uint vcons_out;
68
69 /* Output (logging) buffer
70 * Console output is written to a ring buffer log_buf at index log_idx.
71 * The host may read the output when it sees log_idx advance.
72 * Output will be lost if the output wraps around faster than the host
73 * polls.
74 */
75 struct rte_log_le log_le;
76
77 /* Console input line buffer
78 * Characters are read one at a time into cbuf
79 * until <CR> is received, then
80 * the buffer is processed as a command line.
81 * Also used for virtual UART.
82 */
83 uint cbuf_idx;
84 char cbuf[CBUF_LEN];
85 };
86
87 #endif /* BCMDBG */
88 #include <chipcommon.h>
89
90 #include "dhd.h"
91 #include "dhd_bus.h"
92 #include "dhd_proto.h"
93 #include "dhd_dbg.h"
94
95 #define TXQLEN 2048 /* bulk tx queue length */
96 #define TXHI (TXQLEN - 256) /* turn on flow control above TXHI */
97 #define TXLOW (TXHI - 256) /* turn off flow control below TXLOW */
98 #define PRIOMASK 7
99
100 #define TXRETRIES 2 /* # of retries for tx frames */
101
102 #define BRCMF_RXBOUND 50 /* Default for max rx frames in
103 one scheduling */
104
105 #define BRCMF_TXBOUND 20 /* Default for max tx frames in
106 one scheduling */
107
108 #define BRCMF_TXMINMAX 1 /* Max tx frames if rx still pending */
109
110 #define MEMBLOCK 2048 /* Block size used for downloading
111 of dongle image */
112 #define MAX_DATA_BUF (32 * 1024) /* Must be large enough to hold
113 biggest possible glom */
114
115 #define BRCMF_FIRSTREAD (1 << 6)
116
117
118 /* SBSDIO_DEVICE_CTL */
119
120 /* 1: device will assert busy signal when receiving CMD53 */
121 #define SBSDIO_DEVCTL_SETBUSY 0x01
122 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
123 #define SBSDIO_DEVCTL_SPI_INTR_SYNC 0x02
124 /* 1: mask all interrupts to host except the chipActive (rev 8) */
125 #define SBSDIO_DEVCTL_CA_INT_ONLY 0x04
126 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
127 * sdio bus power cycle to clear (rev 9) */
128 #define SBSDIO_DEVCTL_PADS_ISO 0x08
129 /* Force SD->SB reset mapping (rev 11) */
130 #define SBSDIO_DEVCTL_SB_RST_CTL 0x30
131 /* Determined by CoreControl bit */
132 #define SBSDIO_DEVCTL_RST_CORECTL 0x00
133 /* Force backplane reset */
134 #define SBSDIO_DEVCTL_RST_BPRESET 0x10
135 /* Force no backplane reset */
136 #define SBSDIO_DEVCTL_RST_NOBPRESET 0x20
137
138 /* direct(mapped) cis space */
139
140 /* MAPPED common CIS address */
141 #define SBSDIO_CIS_BASE_COMMON 0x1000
142 /* maximum bytes in one CIS */
143 #define SBSDIO_CIS_SIZE_LIMIT 0x200
144 /* cis offset addr is < 17 bits */
145 #define SBSDIO_CIS_OFT_ADDR_MASK 0x1FFFF
146
147 /* manfid tuple length, include tuple, link bytes */
148 #define SBSDIO_CIS_MANFID_TUPLE_LEN 6
149
150 /* intstatus */
151 #define I_SMB_SW0 (1 << 0) /* To SB Mail S/W interrupt 0 */
152 #define I_SMB_SW1 (1 << 1) /* To SB Mail S/W interrupt 1 */
153 #define I_SMB_SW2 (1 << 2) /* To SB Mail S/W interrupt 2 */
154 #define I_SMB_SW3 (1 << 3) /* To SB Mail S/W interrupt 3 */
155 #define I_SMB_SW_MASK 0x0000000f /* To SB Mail S/W interrupts mask */
156 #define I_SMB_SW_SHIFT 0 /* To SB Mail S/W interrupts shift */
157 #define I_HMB_SW0 (1 << 4) /* To Host Mail S/W interrupt 0 */
158 #define I_HMB_SW1 (1 << 5) /* To Host Mail S/W interrupt 1 */
159 #define I_HMB_SW2 (1 << 6) /* To Host Mail S/W interrupt 2 */
160 #define I_HMB_SW3 (1 << 7) /* To Host Mail S/W interrupt 3 */
161 #define I_HMB_SW_MASK 0x000000f0 /* To Host Mail S/W interrupts mask */
162 #define I_HMB_SW_SHIFT 4 /* To Host Mail S/W interrupts shift */
163 #define I_WR_OOSYNC (1 << 8) /* Write Frame Out Of Sync */
164 #define I_RD_OOSYNC (1 << 9) /* Read Frame Out Of Sync */
165 #define I_PC (1 << 10) /* descriptor error */
166 #define I_PD (1 << 11) /* data error */
167 #define I_DE (1 << 12) /* Descriptor protocol Error */
168 #define I_RU (1 << 13) /* Receive descriptor Underflow */
169 #define I_RO (1 << 14) /* Receive fifo Overflow */
170 #define I_XU (1 << 15) /* Transmit fifo Underflow */
171 #define I_RI (1 << 16) /* Receive Interrupt */
172 #define I_BUSPWR (1 << 17) /* SDIO Bus Power Change (rev 9) */
173 #define I_XMTDATA_AVAIL (1 << 23) /* bits in fifo */
174 #define I_XI (1 << 24) /* Transmit Interrupt */
175 #define I_RF_TERM (1 << 25) /* Read Frame Terminate */
176 #define I_WF_TERM (1 << 26) /* Write Frame Terminate */
177 #define I_PCMCIA_XU (1 << 27) /* PCMCIA Transmit FIFO Underflow */
178 #define I_SBINT (1 << 28) /* sbintstatus Interrupt */
179 #define I_CHIPACTIVE (1 << 29) /* chip from doze to active state */
180 #define I_SRESET (1 << 30) /* CCCR RES interrupt */
181 #define I_IOE2 (1U << 31) /* CCCR IOE2 Bit Changed */
182 #define I_ERRORS (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
183 #define I_DMA (I_RI | I_XI | I_ERRORS)
184
185 /* corecontrol */
186 #define CC_CISRDY (1 << 0) /* CIS Ready */
187 #define CC_BPRESEN (1 << 1) /* CCCR RES signal */
188 #define CC_F2RDY (1 << 2) /* set CCCR IOR2 bit */
189 #define CC_CLRPADSISO (1 << 3) /* clear SDIO pads isolation */
190 #define CC_XMTDATAAVAIL_MODE (1 << 4)
191 #define CC_XMTDATAAVAIL_CTRL (1 << 5)
192
193 /* SDA_FRAMECTRL */
194 #define SFC_RF_TERM (1 << 0) /* Read Frame Terminate */
195 #define SFC_WF_TERM (1 << 1) /* Write Frame Terminate */
196 #define SFC_CRC4WOOS (1 << 2) /* CRC error for write out of sync */
197 #define SFC_ABORTALL (1 << 3) /* Abort all in-progress frames */
198
199 /* HW frame tag */
200 #define SDPCM_FRAMETAG_LEN 4 /* 2 bytes len, 2 bytes check val */
201
202 /* Total length of frame header for dongle protocol */
203 #define SDPCM_HDRLEN (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
204 #define SDPCM_RESERVE (SDPCM_HDRLEN + BRCMF_SDALIGN)
205
206 /*
207 * Software allocation of To SB Mailbox resources
208 */
209
210 /* tosbmailbox bits corresponding to intstatus bits */
211 #define SMB_NAK (1 << 0) /* Frame NAK */
212 #define SMB_INT_ACK (1 << 1) /* Host Interrupt ACK */
213 #define SMB_USE_OOB (1 << 2) /* Use OOB Wakeup */
214 #define SMB_DEV_INT (1 << 3) /* Miscellaneous Interrupt */
215
216 /* tosbmailboxdata */
217 #define SMB_DATA_VERSION_SHIFT 16 /* host protocol version */
218
219 /*
220 * Software allocation of To Host Mailbox resources
221 */
222
223 /* intstatus bits */
224 #define I_HMB_FC_STATE I_HMB_SW0 /* Flow Control State */
225 #define I_HMB_FC_CHANGE I_HMB_SW1 /* Flow Control State Changed */
226 #define I_HMB_FRAME_IND I_HMB_SW2 /* Frame Indication */
227 #define I_HMB_HOST_INT I_HMB_SW3 /* Miscellaneous Interrupt */
228
229 /* tohostmailboxdata */
230 #define HMB_DATA_NAKHANDLED 1 /* retransmit NAK'd frame */
231 #define HMB_DATA_DEVREADY 2 /* talk to host after enable */
232 #define HMB_DATA_FC 4 /* per prio flowcontrol update flag */
233 #define HMB_DATA_FWREADY 8 /* fw ready for protocol activity */
234
235 #define HMB_DATA_FCDATA_MASK 0xff000000
236 #define HMB_DATA_FCDATA_SHIFT 24
237
238 #define HMB_DATA_VERSION_MASK 0x00ff0000
239 #define HMB_DATA_VERSION_SHIFT 16
240
241 /*
242 * Software-defined protocol header
243 */
244
245 /* Current protocol version */
246 #define SDPCM_PROT_VERSION 4
247
248 /* SW frame header */
249 #define SDPCM_PACKET_SEQUENCE(p) (((u8 *)p)[0] & 0xff)
250
251 #define SDPCM_CHANNEL_MASK 0x00000f00
252 #define SDPCM_CHANNEL_SHIFT 8
253 #define SDPCM_PACKET_CHANNEL(p) (((u8 *)p)[1] & 0x0f)
254
255 #define SDPCM_NEXTLEN_OFFSET 2
256
257 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
258 #define SDPCM_DOFFSET_OFFSET 3 /* Data Offset */
259 #define SDPCM_DOFFSET_VALUE(p) (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
260 #define SDPCM_DOFFSET_MASK 0xff000000
261 #define SDPCM_DOFFSET_SHIFT 24
262 #define SDPCM_FCMASK_OFFSET 4 /* Flow control */
263 #define SDPCM_FCMASK_VALUE(p) (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
264 #define SDPCM_WINDOW_OFFSET 5 /* Credit based fc */
265 #define SDPCM_WINDOW_VALUE(p) (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
266
267 #define SDPCM_SWHEADER_LEN 8 /* SW header is 64 bits */
268
269 /* logical channel numbers */
270 #define SDPCM_CONTROL_CHANNEL 0 /* Control channel Id */
271 #define SDPCM_EVENT_CHANNEL 1 /* Asyc Event Indication Channel Id */
272 #define SDPCM_DATA_CHANNEL 2 /* Data Xmit/Recv Channel Id */
273 #define SDPCM_GLOM_CHANNEL 3 /* For coalesced packets */
274 #define SDPCM_TEST_CHANNEL 15 /* Reserved for test/debug packets */
275
276 #define SDPCM_SEQUENCE_WRAP 256 /* wrap-around val for 8bit frame seq */
277
278 #define SDPCM_GLOMDESC(p) (((u8 *)p)[1] & 0x80)
279
280 /*
281 * Shared structure between dongle and the host.
282 * The structure contains pointers to trap or assert information.
283 */
284 #define SDPCM_SHARED_VERSION 0x0002
285 #define SDPCM_SHARED_VERSION_MASK 0x00FF
286 #define SDPCM_SHARED_ASSERT_BUILT 0x0100
287 #define SDPCM_SHARED_ASSERT 0x0200
288 #define SDPCM_SHARED_TRAP 0x0400
289
290 /* Space for header read, limit for data packets */
291 #define MAX_HDR_READ (1 << 6)
292 #define MAX_RX_DATASZ 2048
293
294 /* Maximum milliseconds to wait for F2 to come up */
295 #define BRCMF_WAIT_F2RDY 3000
296
297 /* Bump up limit on waiting for HT to account for first startup;
298 * if the image is doing a CRC calculation before programming the PMU
299 * for HT availability, it could take a couple hundred ms more, so
300 * max out at a 1 second (1000000us).
301 */
302 #undef PMU_MAX_TRANSITION_DLY
303 #define PMU_MAX_TRANSITION_DLY 1000000
304
305 /* Value for ChipClockCSR during initial setup */
306 #define BRCMF_INIT_CLKCTL1 (SBSDIO_FORCE_HW_CLKREQ_OFF | \
307 SBSDIO_ALP_AVAIL_REQ)
308
309 /* Flags for SDH calls */
310 #define F2SYNC (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
311
312 #define BRCMFMAC_FW_NAME "brcm/brcmfmac.bin"
313 #define BRCMFMAC_NV_NAME "brcm/brcmfmac.txt"
314 MODULE_FIRMWARE(BRCMFMAC_FW_NAME);
315 MODULE_FIRMWARE(BRCMFMAC_NV_NAME);
316
317 /*
318 * Conversion of 802.1D priority to precedence level
319 */
320 static uint prio2prec(u32 prio)
321 {
322 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
323 (prio^2) : prio;
324 }
325
326 /* core registers */
327 struct sdpcmd_regs {
328 u32 corecontrol; /* 0x00, rev8 */
329 u32 corestatus; /* rev8 */
330 u32 PAD[1];
331 u32 biststatus; /* rev8 */
332
333 /* PCMCIA access */
334 u16 pcmciamesportaladdr; /* 0x010, rev8 */
335 u16 PAD[1];
336 u16 pcmciamesportalmask; /* rev8 */
337 u16 PAD[1];
338 u16 pcmciawrframebc; /* rev8 */
339 u16 PAD[1];
340 u16 pcmciaunderflowtimer; /* rev8 */
341 u16 PAD[1];
342
343 /* interrupt */
344 u32 intstatus; /* 0x020, rev8 */
345 u32 hostintmask; /* rev8 */
346 u32 intmask; /* rev8 */
347 u32 sbintstatus; /* rev8 */
348 u32 sbintmask; /* rev8 */
349 u32 funcintmask; /* rev4 */
350 u32 PAD[2];
351 u32 tosbmailbox; /* 0x040, rev8 */
352 u32 tohostmailbox; /* rev8 */
353 u32 tosbmailboxdata; /* rev8 */
354 u32 tohostmailboxdata; /* rev8 */
355
356 /* synchronized access to registers in SDIO clock domain */
357 u32 sdioaccess; /* 0x050, rev8 */
358 u32 PAD[3];
359
360 /* PCMCIA frame control */
361 u8 pcmciaframectrl; /* 0x060, rev8 */
362 u8 PAD[3];
363 u8 pcmciawatermark; /* rev8 */
364 u8 PAD[155];
365
366 /* interrupt batching control */
367 u32 intrcvlazy; /* 0x100, rev8 */
368 u32 PAD[3];
369
370 /* counters */
371 u32 cmd52rd; /* 0x110, rev8 */
372 u32 cmd52wr; /* rev8 */
373 u32 cmd53rd; /* rev8 */
374 u32 cmd53wr; /* rev8 */
375 u32 abort; /* rev8 */
376 u32 datacrcerror; /* rev8 */
377 u32 rdoutofsync; /* rev8 */
378 u32 wroutofsync; /* rev8 */
379 u32 writebusy; /* rev8 */
380 u32 readwait; /* rev8 */
381 u32 readterm; /* rev8 */
382 u32 writeterm; /* rev8 */
383 u32 PAD[40];
384 u32 clockctlstatus; /* rev8 */
385 u32 PAD[7];
386
387 u32 PAD[128]; /* DMA engines */
388
389 /* SDIO/PCMCIA CIS region */
390 char cis[512]; /* 0x400-0x5ff, rev6 */
391
392 /* PCMCIA function control registers */
393 char pcmciafcr[256]; /* 0x600-6ff, rev6 */
394 u16 PAD[55];
395
396 /* PCMCIA backplane access */
397 u16 backplanecsr; /* 0x76E, rev6 */
398 u16 backplaneaddr0; /* rev6 */
399 u16 backplaneaddr1; /* rev6 */
400 u16 backplaneaddr2; /* rev6 */
401 u16 backplaneaddr3; /* rev6 */
402 u16 backplanedata0; /* rev6 */
403 u16 backplanedata1; /* rev6 */
404 u16 backplanedata2; /* rev6 */
405 u16 backplanedata3; /* rev6 */
406 u16 PAD[31];
407
408 /* sprom "size" & "blank" info */
409 u16 spromstatus; /* 0x7BE, rev2 */
410 u32 PAD[464];
411
412 u16 PAD[0x80];
413 };
414
415 #ifdef BCMDBG
416 /* Device console log buffer state */
417 struct brcmf_console {
418 uint count; /* Poll interval msec counter */
419 uint log_addr; /* Log struct address (fixed) */
420 struct rte_log_le log_le; /* Log struct (host copy) */
421 uint bufsize; /* Size of log buffer */
422 u8 *buf; /* Log buffer (host copy) */
423 uint last; /* Last buffer read index */
424 };
425 #endif /* BCMDBG */
426
427 struct sdpcm_shared {
428 u32 flags;
429 u32 trap_addr;
430 u32 assert_exp_addr;
431 u32 assert_file_addr;
432 u32 assert_line;
433 u32 console_addr; /* Address of struct rte_console */
434 u32 msgtrace_addr;
435 u8 tag[32];
436 };
437
438 struct sdpcm_shared_le {
439 __le32 flags;
440 __le32 trap_addr;
441 __le32 assert_exp_addr;
442 __le32 assert_file_addr;
443 __le32 assert_line;
444 __le32 console_addr; /* Address of struct rte_console */
445 __le32 msgtrace_addr;
446 u8 tag[32];
447 };
448
449
450 /* misc chip info needed by some of the routines */
451 /* Private data for SDIO bus interaction */
452 struct brcmf_bus {
453 struct brcmf_pub *drvr;
454
455 struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
456 struct chip_info *ci; /* Chip info struct */
457 char *vars; /* Variables (from CIS and/or other) */
458 uint varsz; /* Size of variables buffer */
459
460 u32 ramsize; /* Size of RAM in SOCRAM (bytes) */
461
462 u32 hostintmask; /* Copy of Host Interrupt Mask */
463 u32 intstatus; /* Intstatus bits (events) pending */
464 bool dpc_sched; /* Indicates DPC schedule (intrpt rcvd) */
465 bool fcstate; /* State of dongle flow-control */
466
467 uint blocksize; /* Block size of SDIO transfers */
468 uint roundup; /* Max roundup limit */
469
470 struct pktq txq; /* Queue length used for flow-control */
471 u8 flowcontrol; /* per prio flow control bitmask */
472 u8 tx_seq; /* Transmit sequence number (next) */
473 u8 tx_max; /* Maximum transmit sequence allowed */
474
475 u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
476 u8 *rxhdr; /* Header of current rx frame (in hdrbuf) */
477 u16 nextlen; /* Next Read Len from last header */
478 u8 rx_seq; /* Receive sequence number (expected) */
479 bool rxskip; /* Skip receive (awaiting NAK ACK) */
480
481 uint rxbound; /* Rx frames to read before resched */
482 uint txbound; /* Tx frames to send before resched */
483 uint txminmax;
484
485 struct sk_buff *glomd; /* Packet containing glomming descriptor */
486 struct sk_buff_head glom; /* Packet list for glommed superframe */
487 uint glomerr; /* Glom packet read errors */
488
489 u8 *rxbuf; /* Buffer for receiving control packets */
490 uint rxblen; /* Allocated length of rxbuf */
491 u8 *rxctl; /* Aligned pointer into rxbuf */
492 u8 *databuf; /* Buffer for receiving big glom packet */
493 u8 *dataptr; /* Aligned pointer into databuf */
494 uint rxlen; /* Length of valid data in buffer */
495
496 u8 sdpcm_ver; /* Bus protocol reported by dongle */
497
498 bool intr; /* Use interrupts */
499 bool poll; /* Use polling */
500 bool ipend; /* Device interrupt is pending */
501 uint intrcount; /* Count of device interrupt callbacks */
502 uint lastintrs; /* Count as of last watchdog timer */
503 uint spurious; /* Count of spurious interrupts */
504 uint pollrate; /* Ticks between device polls */
505 uint polltick; /* Tick counter */
506 uint pollcnt; /* Count of active polls */
507
508 #ifdef BCMDBG
509 uint console_interval;
510 struct brcmf_console console; /* Console output polling support */
511 uint console_addr; /* Console address from shared struct */
512 #endif /* BCMDBG */
513
514 uint regfails; /* Count of R_REG failures */
515
516 uint clkstate; /* State of sd and backplane clock(s) */
517 bool activity; /* Activity flag for clock down */
518 s32 idletime; /* Control for activity timeout */
519 s32 idlecount; /* Activity timeout counter */
520 s32 idleclock; /* How to set bus driver when idle */
521 s32 sd_rxchain;
522 bool use_rxchain; /* If brcmf should use PKT chains */
523 bool sleeping; /* Is SDIO bus sleeping? */
524 bool rxflow_mode; /* Rx flow control mode */
525 bool rxflow; /* Is rx flow control on */
526 bool alp_only; /* Don't use HT clock (ALP only) */
527 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
528 bool usebufpool;
529
530 /* Some additional counters */
531 uint tx_sderrs; /* Count of tx attempts with sd errors */
532 uint fcqueued; /* Tx packets that got queued */
533 uint rxrtx; /* Count of rtx requests (NAK to dongle) */
534 uint rx_toolong; /* Receive frames too long to receive */
535 uint rxc_errors; /* SDIO errors when reading control frames */
536 uint rx_hdrfail; /* SDIO errors on header reads */
537 uint rx_badhdr; /* Bad received headers (roosync?) */
538 uint rx_badseq; /* Mismatched rx sequence number */
539 uint fc_rcvd; /* Number of flow-control events received */
540 uint fc_xoff; /* Number which turned on flow-control */
541 uint fc_xon; /* Number which turned off flow-control */
542 uint rxglomfail; /* Failed deglom attempts */
543 uint rxglomframes; /* Number of glom frames (superframes) */
544 uint rxglompkts; /* Number of packets from glom frames */
545 uint f2rxhdrs; /* Number of header reads */
546 uint f2rxdata; /* Number of frame data reads */
547 uint f2txdata; /* Number of f2 frame writes */
548 uint f1regdata; /* Number of f1 register accesses */
549
550 u8 *ctrl_frame_buf;
551 u32 ctrl_frame_len;
552 bool ctrl_frame_stat;
553
554 spinlock_t txqlock;
555 wait_queue_head_t ctrl_wait;
556 wait_queue_head_t dcmd_resp_wait;
557
558 struct timer_list timer;
559 struct completion watchdog_wait;
560 struct task_struct *watchdog_tsk;
561 bool wd_timer_valid;
562 uint save_ms;
563
564 struct task_struct *dpc_tsk;
565 struct completion dpc_wait;
566
567 struct semaphore sdsem;
568
569 const struct firmware *firmware;
570 u32 fw_ptr;
571 };
572
573 /* clkstate */
574 #define CLK_NONE 0
575 #define CLK_SDONLY 1
576 #define CLK_PENDING 2 /* Not used yet */
577 #define CLK_AVAIL 3
578
579 #ifdef BCMDBG
580 static int qcount[NUMPRIO];
581 static int tx_packets[NUMPRIO];
582 #endif /* BCMDBG */
583
584 #define SDIO_DRIVE_STRENGTH 6 /* in milliamps */
585
586 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
587
588 /* Retry count for register access failures */
589 static const uint retry_limit = 2;
590
591 /* Limit on rounding up frames */
592 static const uint max_roundup = 512;
593
594 #define ALIGNMENT 4
595
596 static void pkt_align(struct sk_buff *p, int len, int align)
597 {
598 uint datalign;
599 datalign = (unsigned long)(p->data);
600 datalign = roundup(datalign, (align)) - datalign;
601 if (datalign)
602 skb_pull(p, datalign);
603 __skb_trim(p, len);
604 }
605
606 /* To check if there's window offered */
607 static bool data_ok(struct brcmf_bus *bus)
608 {
609 return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
610 ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
611 }
612
613 /*
614 * Reads a register in the SDIO hardware block. This block occupies a series of
615 * adresses on the 32 bit backplane bus.
616 */
617 static void
618 r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
619 {
620 u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
621 *retryvar = 0;
622 do {
623 *regvar = brcmf_sdcard_reg_read(bus->sdiodev,
624 bus->ci->c_inf[idx].base + reg_offset,
625 sizeof(u32));
626 } while (brcmf_sdcard_regfail(bus->sdiodev) &&
627 (++(*retryvar) <= retry_limit));
628 if (*retryvar) {
629 bus->regfails += (*retryvar-1);
630 if (*retryvar > retry_limit) {
631 brcmf_dbg(ERROR, "FAILED READ %Xh\n", reg_offset);
632 *regvar = 0;
633 }
634 }
635 }
636
637 static void
638 w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
639 {
640 u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
641 *retryvar = 0;
642 do {
643 brcmf_sdcard_reg_write(bus->sdiodev,
644 bus->ci->c_inf[idx].base + reg_offset,
645 sizeof(u32), regval);
646 } while (brcmf_sdcard_regfail(bus->sdiodev) &&
647 (++(*retryvar) <= retry_limit));
648 if (*retryvar) {
649 bus->regfails += (*retryvar-1);
650 if (*retryvar > retry_limit)
651 brcmf_dbg(ERROR, "FAILED REGISTER WRITE %Xh\n",
652 reg_offset);
653 }
654 }
655
656 #define PKT_AVAILABLE() (intstatus & I_HMB_FRAME_IND)
657
658 #define HOSTINTMASK (I_HMB_SW_MASK | I_CHIPACTIVE)
659
660 /* Packet free applicable unconditionally for sdio and sdspi.
661 * Conditional if bufpool was present for gspi bus.
662 */
663 static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
664 {
665 if (bus->usebufpool)
666 brcmu_pkt_buf_free_skb(pkt);
667 }
668
669 /* Turn backplane clock on or off */
670 static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
671 {
672 int err;
673 u8 clkctl, clkreq, devctl;
674 unsigned long timeout;
675
676 brcmf_dbg(TRACE, "Enter\n");
677
678 clkctl = 0;
679
680 if (on) {
681 /* Request HT Avail */
682 clkreq =
683 bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
684
685 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
686 SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
687 if (err) {
688 brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
689 return -EBADE;
690 }
691
692 /* Check current status */
693 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
694 SBSDIO_FUNC1_CHIPCLKCSR, &err);
695 if (err) {
696 brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
697 return -EBADE;
698 }
699
700 /* Go to pending and await interrupt if appropriate */
701 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
702 /* Allow only clock-available interrupt */
703 devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
704 SDIO_FUNC_1,
705 SBSDIO_DEVICE_CTL, &err);
706 if (err) {
707 brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
708 err);
709 return -EBADE;
710 }
711
712 devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
713 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
714 SBSDIO_DEVICE_CTL, devctl, &err);
715 brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
716 bus->clkstate = CLK_PENDING;
717
718 return 0;
719 } else if (bus->clkstate == CLK_PENDING) {
720 /* Cancel CA-only interrupt filter */
721 devctl =
722 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
723 SBSDIO_DEVICE_CTL, &err);
724 devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
725 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
726 SBSDIO_DEVICE_CTL, devctl, &err);
727 }
728
729 /* Otherwise, wait here (polling) for HT Avail */
730 timeout = jiffies +
731 msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
732 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
733 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev,
734 SDIO_FUNC_1,
735 SBSDIO_FUNC1_CHIPCLKCSR,
736 &err);
737 if (time_after(jiffies, timeout))
738 break;
739 else
740 usleep_range(5000, 10000);
741 }
742 if (err) {
743 brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
744 return -EBADE;
745 }
746 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
747 brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
748 PMU_MAX_TRANSITION_DLY, clkctl);
749 return -EBADE;
750 }
751
752 /* Mark clock available */
753 bus->clkstate = CLK_AVAIL;
754 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
755
756 #if defined(BCMDBG)
757 if (bus->alp_only != true) {
758 if (SBSDIO_ALPONLY(clkctl))
759 brcmf_dbg(ERROR, "HT Clock should be on\n");
760 }
761 #endif /* defined (BCMDBG) */
762
763 bus->activity = true;
764 } else {
765 clkreq = 0;
766
767 if (bus->clkstate == CLK_PENDING) {
768 /* Cancel CA-only interrupt filter */
769 devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
770 SDIO_FUNC_1,
771 SBSDIO_DEVICE_CTL, &err);
772 devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
773 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
774 SBSDIO_DEVICE_CTL, devctl, &err);
775 }
776
777 bus->clkstate = CLK_SDONLY;
778 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
779 SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
780 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
781 if (err) {
782 brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
783 err);
784 return -EBADE;
785 }
786 }
787 return 0;
788 }
789
790 /* Change idle/active SD state */
791 static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
792 {
793 brcmf_dbg(TRACE, "Enter\n");
794
795 if (on)
796 bus->clkstate = CLK_SDONLY;
797 else
798 bus->clkstate = CLK_NONE;
799
800 return 0;
801 }
802
803 /* Transition SD and backplane clock readiness */
804 static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
805 {
806 #ifdef BCMDBG
807 uint oldstate = bus->clkstate;
808 #endif /* BCMDBG */
809
810 brcmf_dbg(TRACE, "Enter\n");
811
812 /* Early exit if we're already there */
813 if (bus->clkstate == target) {
814 if (target == CLK_AVAIL) {
815 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
816 bus->activity = true;
817 }
818 return 0;
819 }
820
821 switch (target) {
822 case CLK_AVAIL:
823 /* Make sure SD clock is available */
824 if (bus->clkstate == CLK_NONE)
825 brcmf_sdbrcm_sdclk(bus, true);
826 /* Now request HT Avail on the backplane */
827 brcmf_sdbrcm_htclk(bus, true, pendok);
828 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
829 bus->activity = true;
830 break;
831
832 case CLK_SDONLY:
833 /* Remove HT request, or bring up SD clock */
834 if (bus->clkstate == CLK_NONE)
835 brcmf_sdbrcm_sdclk(bus, true);
836 else if (bus->clkstate == CLK_AVAIL)
837 brcmf_sdbrcm_htclk(bus, false, false);
838 else
839 brcmf_dbg(ERROR, "request for %d -> %d\n",
840 bus->clkstate, target);
841 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
842 break;
843
844 case CLK_NONE:
845 /* Make sure to remove HT request */
846 if (bus->clkstate == CLK_AVAIL)
847 brcmf_sdbrcm_htclk(bus, false, false);
848 /* Now remove the SD clock */
849 brcmf_sdbrcm_sdclk(bus, false);
850 brcmf_sdbrcm_wd_timer(bus, 0);
851 break;
852 }
853 #ifdef BCMDBG
854 brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
855 #endif /* BCMDBG */
856
857 return 0;
858 }
859
860 static int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
861 {
862 uint retries = 0;
863
864 brcmf_dbg(INFO, "request %s (currently %s)\n",
865 sleep ? "SLEEP" : "WAKE",
866 bus->sleeping ? "SLEEP" : "WAKE");
867
868 /* Done if we're already in the requested state */
869 if (sleep == bus->sleeping)
870 return 0;
871
872 /* Going to sleep: set the alarm and turn off the lights... */
873 if (sleep) {
874 /* Don't sleep if something is pending */
875 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
876 return -EBUSY;
877
878 /* Make sure the controller has the bus up */
879 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
880
881 /* Tell device to start using OOB wakeup */
882 w_sdreg32(bus, SMB_USE_OOB,
883 offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
884 if (retries > retry_limit)
885 brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
886
887 /* Turn off our contribution to the HT clock request */
888 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
889
890 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
891 SBSDIO_FUNC1_CHIPCLKCSR,
892 SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
893
894 /* Isolate the bus */
895 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
896 SBSDIO_DEVICE_CTL,
897 SBSDIO_DEVCTL_PADS_ISO, NULL);
898
899 /* Change state */
900 bus->sleeping = true;
901
902 } else {
903 /* Waking up: bus power up is ok, set local state */
904
905 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
906 SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
907
908 /* Make sure the controller has the bus up */
909 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
910
911 /* Send misc interrupt to indicate OOB not needed */
912 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
913 &retries);
914 if (retries <= retry_limit)
915 w_sdreg32(bus, SMB_DEV_INT,
916 offsetof(struct sdpcmd_regs, tosbmailbox),
917 &retries);
918
919 if (retries > retry_limit)
920 brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
921
922 /* Make sure we have SD bus access */
923 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
924
925 /* Change state */
926 bus->sleeping = false;
927 }
928
929 return 0;
930 }
931
932 static void bus_wake(struct brcmf_bus *bus)
933 {
934 if (bus->sleeping)
935 brcmf_sdbrcm_bussleep(bus, false);
936 }
937
938 static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
939 {
940 u32 intstatus = 0;
941 u32 hmb_data;
942 u8 fcbits;
943 uint retries = 0;
944
945 brcmf_dbg(TRACE, "Enter\n");
946
947 /* Read mailbox data and ack that we did so */
948 r_sdreg32(bus, &hmb_data,
949 offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
950
951 if (retries <= retry_limit)
952 w_sdreg32(bus, SMB_INT_ACK,
953 offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
954 bus->f1regdata += 2;
955
956 /* Dongle recomposed rx frames, accept them again */
957 if (hmb_data & HMB_DATA_NAKHANDLED) {
958 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
959 bus->rx_seq);
960 if (!bus->rxskip)
961 brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
962
963 bus->rxskip = false;
964 intstatus |= I_HMB_FRAME_IND;
965 }
966
967 /*
968 * DEVREADY does not occur with gSPI.
969 */
970 if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
971 bus->sdpcm_ver =
972 (hmb_data & HMB_DATA_VERSION_MASK) >>
973 HMB_DATA_VERSION_SHIFT;
974 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
975 brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
976 "expecting %d\n",
977 bus->sdpcm_ver, SDPCM_PROT_VERSION);
978 else
979 brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
980 bus->sdpcm_ver);
981 }
982
983 /*
984 * Flow Control has been moved into the RX headers and this out of band
985 * method isn't used any more.
986 * remaining backward compatible with older dongles.
987 */
988 if (hmb_data & HMB_DATA_FC) {
989 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
990 HMB_DATA_FCDATA_SHIFT;
991
992 if (fcbits & ~bus->flowcontrol)
993 bus->fc_xoff++;
994
995 if (bus->flowcontrol & ~fcbits)
996 bus->fc_xon++;
997
998 bus->fc_rcvd++;
999 bus->flowcontrol = fcbits;
1000 }
1001
1002 /* Shouldn't be any others */
1003 if (hmb_data & ~(HMB_DATA_DEVREADY |
1004 HMB_DATA_NAKHANDLED |
1005 HMB_DATA_FC |
1006 HMB_DATA_FWREADY |
1007 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
1008 brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
1009 hmb_data);
1010
1011 return intstatus;
1012 }
1013
1014 static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
1015 {
1016 uint retries = 0;
1017 u16 lastrbc;
1018 u8 hi, lo;
1019 int err;
1020
1021 brcmf_dbg(ERROR, "%sterminate frame%s\n",
1022 abort ? "abort command, " : "",
1023 rtx ? ", send NAK" : "");
1024
1025 if (abort)
1026 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1027
1028 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
1029 SBSDIO_FUNC1_FRAMECTRL,
1030 SFC_RF_TERM, &err);
1031 bus->f1regdata++;
1032
1033 /* Wait until the packet has been flushed (device/FIFO stable) */
1034 for (lastrbc = retries = 0xffff; retries > 0; retries--) {
1035 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1036 SBSDIO_FUNC1_RFRAMEBCHI, NULL);
1037 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
1038 SBSDIO_FUNC1_RFRAMEBCLO, NULL);
1039 bus->f1regdata += 2;
1040
1041 if ((hi == 0) && (lo == 0))
1042 break;
1043
1044 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
1045 brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
1046 lastrbc, (hi << 8) + lo);
1047 }
1048 lastrbc = (hi << 8) + lo;
1049 }
1050
1051 if (!retries)
1052 brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
1053 else
1054 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
1055
1056 if (rtx) {
1057 bus->rxrtx++;
1058 w_sdreg32(bus, SMB_NAK,
1059 offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
1060
1061 bus->f1regdata++;
1062 if (retries <= retry_limit)
1063 bus->rxskip = true;
1064 }
1065
1066 /* Clear partial in any case */
1067 bus->nextlen = 0;
1068
1069 /* If we can't reach the device, signal failure */
1070 if (err || brcmf_sdcard_regfail(bus->sdiodev))
1071 bus->drvr->busstate = BRCMF_BUS_DOWN;
1072 }
1073
1074 /* copy a buffer into a pkt buffer chain */
1075 static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_bus *bus, uint len)
1076 {
1077 uint n, ret = 0;
1078 struct sk_buff *p;
1079 u8 *buf;
1080
1081 buf = bus->dataptr;
1082
1083 /* copy the data */
1084 skb_queue_walk(&bus->glom, p) {
1085 n = min_t(uint, p->len, len);
1086 memcpy(p->data, buf, n);
1087 buf += n;
1088 len -= n;
1089 ret += n;
1090 if (!len)
1091 break;
1092 }
1093
1094 return ret;
1095 }
1096
1097 /* return total length of buffer chain */
1098 static uint brcmf_sdbrcm_glom_len(struct brcmf_bus *bus)
1099 {
1100 struct sk_buff *p;
1101 uint total;
1102
1103 total = 0;
1104 skb_queue_walk(&bus->glom, p)
1105 total += p->len;
1106 return total;
1107 }
1108
1109 static void brcmf_sdbrcm_free_glom(struct brcmf_bus *bus)
1110 {
1111 struct sk_buff *cur, *next;
1112
1113 skb_queue_walk_safe(&bus->glom, cur, next) {
1114 skb_unlink(cur, &bus->glom);
1115 brcmu_pkt_buf_free_skb(cur);
1116 }
1117 }
1118
1119 static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
1120 {
1121 u16 dlen, totlen;
1122 u8 *dptr, num = 0;
1123
1124 u16 sublen, check;
1125 struct sk_buff *pfirst, *pnext;
1126
1127 int errcode;
1128 u8 chan, seq, doff, sfdoff;
1129 u8 txmax;
1130
1131 int ifidx = 0;
1132 bool usechain = bus->use_rxchain;
1133
1134 /* If packets, issue read(s) and send up packet chain */
1135 /* Return sequence numbers consumed? */
1136
1137 brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
1138 bus->glomd, skb_peek(&bus->glom));
1139
1140 /* If there's a descriptor, generate the packet chain */
1141 if (bus->glomd) {
1142 pfirst = pnext = NULL;
1143 dlen = (u16) (bus->glomd->len);
1144 dptr = bus->glomd->data;
1145 if (!dlen || (dlen & 1)) {
1146 brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
1147 dlen);
1148 dlen = 0;
1149 }
1150
1151 for (totlen = num = 0; dlen; num++) {
1152 /* Get (and move past) next length */
1153 sublen = get_unaligned_le16(dptr);
1154 dlen -= sizeof(u16);
1155 dptr += sizeof(u16);
1156 if ((sublen < SDPCM_HDRLEN) ||
1157 ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1158 brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
1159 num, sublen);
1160 pnext = NULL;
1161 break;
1162 }
1163 if (sublen % BRCMF_SDALIGN) {
1164 brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
1165 sublen, BRCMF_SDALIGN);
1166 usechain = false;
1167 }
1168 totlen += sublen;
1169
1170 /* For last frame, adjust read len so total
1171 is a block multiple */
1172 if (!dlen) {
1173 sublen +=
1174 (roundup(totlen, bus->blocksize) - totlen);
1175 totlen = roundup(totlen, bus->blocksize);
1176 }
1177
1178 /* Allocate/chain packet for next subframe */
1179 pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1180 if (pnext == NULL) {
1181 brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
1182 num, sublen);
1183 break;
1184 }
1185 skb_queue_tail(&bus->glom, pnext);
1186
1187 /* Adhere to start alignment requirements */
1188 pkt_align(pnext, sublen, BRCMF_SDALIGN);
1189 }
1190
1191 /* If all allocations succeeded, save packet chain
1192 in bus structure */
1193 if (pnext) {
1194 brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1195 totlen, num);
1196 if (BRCMF_GLOM_ON() && bus->nextlen &&
1197 totlen != bus->nextlen) {
1198 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1199 bus->nextlen, totlen, rxseq);
1200 }
1201 pfirst = pnext = NULL;
1202 } else {
1203 brcmf_sdbrcm_free_glom(bus);
1204 num = 0;
1205 }
1206
1207 /* Done with descriptor packet */
1208 brcmu_pkt_buf_free_skb(bus->glomd);
1209 bus->glomd = NULL;
1210 bus->nextlen = 0;
1211 }
1212
1213 /* Ok -- either we just generated a packet chain,
1214 or had one from before */
1215 if (!skb_queue_empty(&bus->glom)) {
1216 if (BRCMF_GLOM_ON()) {
1217 brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1218 skb_queue_walk(&bus->glom, pnext) {
1219 brcmf_dbg(GLOM, " %p: %p len 0x%04x (%d)\n",
1220 pnext, (u8 *) (pnext->data),
1221 pnext->len, pnext->len);
1222 }
1223 }
1224
1225 pfirst = skb_peek(&bus->glom);
1226 dlen = (u16) brcmf_sdbrcm_glom_len(bus);
1227
1228 /* Do an SDIO read for the superframe. Configurable iovar to
1229 * read directly into the chained packet, or allocate a large
1230 * packet and and copy into the chain.
1231 */
1232 if (usechain) {
1233 errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
1234 bus->sdiodev->sbwad,
1235 SDIO_FUNC_2, F2SYNC, &bus->glom);
1236 } else if (bus->dataptr) {
1237 errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1238 bus->sdiodev->sbwad,
1239 SDIO_FUNC_2, F2SYNC,
1240 bus->dataptr, dlen);
1241 sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
1242 if (sublen != dlen) {
1243 brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
1244 dlen, sublen);
1245 errcode = -1;
1246 }
1247 pnext = NULL;
1248 } else {
1249 brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1250 dlen);
1251 errcode = -1;
1252 }
1253 bus->f2rxdata++;
1254
1255 /* On failure, kill the superframe, allow a couple retries */
1256 if (errcode < 0) {
1257 brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
1258 dlen, errcode);
1259 bus->drvr->rx_errors++;
1260
1261 if (bus->glomerr++ < 3) {
1262 brcmf_sdbrcm_rxfail(bus, true, true);
1263 } else {
1264 bus->glomerr = 0;
1265 brcmf_sdbrcm_rxfail(bus, true, false);
1266 bus->rxglomfail++;
1267 brcmf_sdbrcm_free_glom(bus);
1268 }
1269 return 0;
1270 }
1271 #ifdef BCMDBG
1272 if (BRCMF_GLOM_ON()) {
1273 printk(KERN_DEBUG "SUPERFRAME:\n");
1274 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1275 pfirst->data, min_t(int, pfirst->len, 48));
1276 }
1277 #endif
1278
1279 /* Validate the superframe header */
1280 dptr = (u8 *) (pfirst->data);
1281 sublen = get_unaligned_le16(dptr);
1282 check = get_unaligned_le16(dptr + sizeof(u16));
1283
1284 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1285 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1286 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1287 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1288 brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
1289 bus->nextlen, seq);
1290 bus->nextlen = 0;
1291 }
1292 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1293 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1294
1295 errcode = 0;
1296 if ((u16)~(sublen ^ check)) {
1297 brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
1298 sublen, check);
1299 errcode = -1;
1300 } else if (roundup(sublen, bus->blocksize) != dlen) {
1301 brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
1302 sublen, roundup(sublen, bus->blocksize),
1303 dlen);
1304 errcode = -1;
1305 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
1306 SDPCM_GLOM_CHANNEL) {
1307 brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
1308 SDPCM_PACKET_CHANNEL(
1309 &dptr[SDPCM_FRAMETAG_LEN]));
1310 errcode = -1;
1311 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
1312 brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
1313 errcode = -1;
1314 } else if ((doff < SDPCM_HDRLEN) ||
1315 (doff > (pfirst->len - SDPCM_HDRLEN))) {
1316 brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
1317 doff, sublen, pfirst->len, SDPCM_HDRLEN);
1318 errcode = -1;
1319 }
1320
1321 /* Check sequence number of superframe SW header */
1322 if (rxseq != seq) {
1323 brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
1324 seq, rxseq);
1325 bus->rx_badseq++;
1326 rxseq = seq;
1327 }
1328
1329 /* Check window for sanity */
1330 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1331 brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1332 txmax, bus->tx_seq);
1333 txmax = bus->tx_seq + 2;
1334 }
1335 bus->tx_max = txmax;
1336
1337 /* Remove superframe header, remember offset */
1338 skb_pull(pfirst, doff);
1339 sfdoff = doff;
1340 num = 0;
1341
1342 /* Validate all the subframe headers */
1343 skb_queue_walk(&bus->glom, pnext) {
1344 /* leave when invalid subframe is found */
1345 if (errcode)
1346 break;
1347
1348 dptr = (u8 *) (pnext->data);
1349 dlen = (u16) (pnext->len);
1350 sublen = get_unaligned_le16(dptr);
1351 check = get_unaligned_le16(dptr + sizeof(u16));
1352 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1353 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1354 #ifdef BCMDBG
1355 if (BRCMF_GLOM_ON()) {
1356 printk(KERN_DEBUG "subframe:\n");
1357 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1358 dptr, 32);
1359 }
1360 #endif
1361
1362 if ((u16)~(sublen ^ check)) {
1363 brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
1364 num, sublen, check);
1365 errcode = -1;
1366 } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
1367 brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
1368 num, sublen, dlen);
1369 errcode = -1;
1370 } else if ((chan != SDPCM_DATA_CHANNEL) &&
1371 (chan != SDPCM_EVENT_CHANNEL)) {
1372 brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
1373 num, chan);
1374 errcode = -1;
1375 } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
1376 brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
1377 num, doff, sublen, SDPCM_HDRLEN);
1378 errcode = -1;
1379 }
1380 /* increase the subframe count */
1381 num++;
1382 }
1383
1384 if (errcode) {
1385 /* Terminate frame on error, request
1386 a couple retries */
1387 if (bus->glomerr++ < 3) {
1388 /* Restore superframe header space */
1389 skb_push(pfirst, sfdoff);
1390 brcmf_sdbrcm_rxfail(bus, true, true);
1391 } else {
1392 bus->glomerr = 0;
1393 brcmf_sdbrcm_rxfail(bus, true, false);
1394 bus->rxglomfail++;
1395 brcmf_sdbrcm_free_glom(bus);
1396 }
1397 bus->nextlen = 0;
1398 return 0;
1399 }
1400
1401 /* Basic SD framing looks ok - process each packet (header) */
1402
1403 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1404 dptr = (u8 *) (pfirst->data);
1405 sublen = get_unaligned_le16(dptr);
1406 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
1407 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
1408 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1409
1410 brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
1411 num, pfirst, pfirst->data,
1412 pfirst->len, sublen, chan, seq);
1413
1414 /* precondition: chan == SDPCM_DATA_CHANNEL ||
1415 chan == SDPCM_EVENT_CHANNEL */
1416
1417 if (rxseq != seq) {
1418 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
1419 seq, rxseq);
1420 bus->rx_badseq++;
1421 rxseq = seq;
1422 }
1423 rxseq++;
1424
1425 #ifdef BCMDBG
1426 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1427 printk(KERN_DEBUG "Rx Subframe Data:\n");
1428 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1429 dptr, dlen);
1430 }
1431 #endif
1432
1433 __skb_trim(pfirst, sublen);
1434 skb_pull(pfirst, doff);
1435
1436 if (pfirst->len == 0) {
1437 skb_unlink(pfirst, &bus->glom);
1438 brcmu_pkt_buf_free_skb(pfirst);
1439 continue;
1440 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx,
1441 pfirst) != 0) {
1442 brcmf_dbg(ERROR, "rx protocol error\n");
1443 bus->drvr->rx_errors++;
1444 skb_unlink(pfirst, &bus->glom);
1445 brcmu_pkt_buf_free_skb(pfirst);
1446 continue;
1447 }
1448
1449 #ifdef BCMDBG
1450 if (BRCMF_GLOM_ON()) {
1451 brcmf_dbg(GLOM, "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1452 bus->glom.qlen, pfirst, pfirst->data,
1453 pfirst->len, pfirst->next,
1454 pfirst->prev);
1455 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1456 pfirst->data,
1457 min_t(int, pfirst->len, 32));
1458 }
1459 #endif /* BCMDBG */
1460 }
1461 /* sent any remaining packets up */
1462 if (bus->glom.qlen) {
1463 up(&bus->sdsem);
1464 brcmf_rx_frame(bus->drvr, ifidx, &bus->glom);
1465 down(&bus->sdsem);
1466 }
1467
1468 bus->rxglomframes++;
1469 bus->rxglompkts += bus->glom.qlen;
1470 }
1471 return num;
1472 }
1473
1474 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_bus *bus, uint *condition,
1475 bool *pending)
1476 {
1477 DECLARE_WAITQUEUE(wait, current);
1478 int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1479
1480 /* Wait until control frame is available */
1481 add_wait_queue(&bus->dcmd_resp_wait, &wait);
1482 set_current_state(TASK_INTERRUPTIBLE);
1483
1484 while (!(*condition) && (!signal_pending(current) && timeout))
1485 timeout = schedule_timeout(timeout);
1486
1487 if (signal_pending(current))
1488 *pending = true;
1489
1490 set_current_state(TASK_RUNNING);
1491 remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1492
1493 return timeout;
1494 }
1495
1496 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_bus *bus)
1497 {
1498 if (waitqueue_active(&bus->dcmd_resp_wait))
1499 wake_up_interruptible(&bus->dcmd_resp_wait);
1500
1501 return 0;
1502 }
1503 static void
1504 brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
1505 {
1506 uint rdlen, pad;
1507
1508 int sdret;
1509
1510 brcmf_dbg(TRACE, "Enter\n");
1511
1512 /* Set rxctl for frame (w/optional alignment) */
1513 bus->rxctl = bus->rxbuf;
1514 bus->rxctl += BRCMF_FIRSTREAD;
1515 pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
1516 if (pad)
1517 bus->rxctl += (BRCMF_SDALIGN - pad);
1518 bus->rxctl -= BRCMF_FIRSTREAD;
1519
1520 /* Copy the already-read portion over */
1521 memcpy(bus->rxctl, hdr, BRCMF_FIRSTREAD);
1522 if (len <= BRCMF_FIRSTREAD)
1523 goto gotpkt;
1524
1525 /* Raise rdlen to next SDIO block to avoid tail command */
1526 rdlen = len - BRCMF_FIRSTREAD;
1527 if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1528 pad = bus->blocksize - (rdlen % bus->blocksize);
1529 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1530 ((len + pad) < bus->drvr->maxctl))
1531 rdlen += pad;
1532 } else if (rdlen % BRCMF_SDALIGN) {
1533 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1534 }
1535
1536 /* Satisfy length-alignment requirements */
1537 if (rdlen & (ALIGNMENT - 1))
1538 rdlen = roundup(rdlen, ALIGNMENT);
1539
1540 /* Drop if the read is too big or it exceeds our maximum */
1541 if ((rdlen + BRCMF_FIRSTREAD) > bus->drvr->maxctl) {
1542 brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
1543 rdlen, bus->drvr->maxctl);
1544 bus->drvr->rx_errors++;
1545 brcmf_sdbrcm_rxfail(bus, false, false);
1546 goto done;
1547 }
1548
1549 if ((len - doff) > bus->drvr->maxctl) {
1550 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1551 len, len - doff, bus->drvr->maxctl);
1552 bus->drvr->rx_errors++;
1553 bus->rx_toolong++;
1554 brcmf_sdbrcm_rxfail(bus, false, false);
1555 goto done;
1556 }
1557
1558 /* Read remainder of frame body into the rxctl buffer */
1559 sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1560 bus->sdiodev->sbwad,
1561 SDIO_FUNC_2,
1562 F2SYNC, (bus->rxctl + BRCMF_FIRSTREAD), rdlen);
1563 bus->f2rxdata++;
1564
1565 /* Control frame failures need retransmission */
1566 if (sdret < 0) {
1567 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
1568 rdlen, sdret);
1569 bus->rxc_errors++;
1570 brcmf_sdbrcm_rxfail(bus, true, true);
1571 goto done;
1572 }
1573
1574 gotpkt:
1575
1576 #ifdef BCMDBG
1577 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
1578 printk(KERN_DEBUG "RxCtrl:\n");
1579 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
1580 }
1581 #endif
1582
1583 /* Point to valid data and indicate its length */
1584 bus->rxctl += doff;
1585 bus->rxlen = len - doff;
1586
1587 done:
1588 /* Awake any waiters */
1589 brcmf_sdbrcm_dcmd_resp_wake(bus);
1590 }
1591
1592 /* Pad read to blocksize for efficiency */
1593 static void brcmf_pad(struct brcmf_bus *bus, u16 *pad, u16 *rdlen)
1594 {
1595 if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1596 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1597 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1598 *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1599 *rdlen += *pad;
1600 } else if (*rdlen % BRCMF_SDALIGN) {
1601 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1602 }
1603 }
1604
1605 static void
1606 brcmf_alloc_pkt_and_read(struct brcmf_bus *bus, u16 rdlen,
1607 struct sk_buff **pkt, u8 **rxbuf)
1608 {
1609 int sdret; /* Return code from calls */
1610
1611 *pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
1612 if (*pkt == NULL)
1613 return;
1614
1615 pkt_align(*pkt, rdlen, BRCMF_SDALIGN);
1616 *rxbuf = (u8 *) ((*pkt)->data);
1617 /* Read the entire frame */
1618 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1619 SDIO_FUNC_2, F2SYNC, *pkt);
1620 bus->f2rxdata++;
1621
1622 if (sdret < 0) {
1623 brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
1624 rdlen, sdret);
1625 brcmu_pkt_buf_free_skb(*pkt);
1626 bus->drvr->rx_errors++;
1627 /* Force retry w/normal header read.
1628 * Don't attempt NAK for
1629 * gSPI
1630 */
1631 brcmf_sdbrcm_rxfail(bus, true, true);
1632 *pkt = NULL;
1633 }
1634 }
1635
1636 /* Checks the header */
1637 static int
1638 brcmf_check_rxbuf(struct brcmf_bus *bus, struct sk_buff *pkt, u8 *rxbuf,
1639 u8 rxseq, u16 nextlen, u16 *len)
1640 {
1641 u16 check;
1642 bool len_consistent; /* Result of comparing readahead len and
1643 len from hw-hdr */
1644
1645 memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
1646
1647 /* Extract hardware header fields */
1648 *len = get_unaligned_le16(bus->rxhdr);
1649 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1650
1651 /* All zeros means readahead info was bad */
1652 if (!(*len | check)) {
1653 brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
1654 goto fail;
1655 }
1656
1657 /* Validate check bytes */
1658 if ((u16)~(*len ^ check)) {
1659 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
1660 nextlen, *len, check);
1661 bus->rx_badhdr++;
1662 brcmf_sdbrcm_rxfail(bus, false, false);
1663 goto fail;
1664 }
1665
1666 /* Validate frame length */
1667 if (*len < SDPCM_HDRLEN) {
1668 brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
1669 *len);
1670 goto fail;
1671 }
1672
1673 /* Check for consistency with readahead info */
1674 len_consistent = (nextlen != (roundup(*len, 16) >> 4));
1675 if (len_consistent) {
1676 /* Mismatch, force retry w/normal
1677 header (may be >4K) */
1678 brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
1679 nextlen, *len, roundup(*len, 16),
1680 rxseq);
1681 brcmf_sdbrcm_rxfail(bus, true, true);
1682 goto fail;
1683 }
1684
1685 return 0;
1686
1687 fail:
1688 brcmf_sdbrcm_pktfree2(bus, pkt);
1689 return -EINVAL;
1690 }
1691
1692 /* Return true if there may be more frames to read */
1693 static uint
1694 brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
1695 {
1696 u16 len, check; /* Extracted hardware header fields */
1697 u8 chan, seq, doff; /* Extracted software header fields */
1698 u8 fcbits; /* Extracted fcbits from software header */
1699
1700 struct sk_buff *pkt; /* Packet for event or data frames */
1701 u16 pad; /* Number of pad bytes to read */
1702 u16 rdlen; /* Total number of bytes to read */
1703 u8 rxseq; /* Next sequence number to expect */
1704 uint rxleft = 0; /* Remaining number of frames allowed */
1705 int sdret; /* Return code from calls */
1706 u8 txmax; /* Maximum tx sequence offered */
1707 u8 *rxbuf;
1708 int ifidx = 0;
1709 uint rxcount = 0; /* Total frames read */
1710
1711 brcmf_dbg(TRACE, "Enter\n");
1712
1713 /* Not finished unless we encounter no more frames indication */
1714 *finished = false;
1715
1716 for (rxseq = bus->rx_seq, rxleft = maxframes;
1717 !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
1718 rxseq++, rxleft--) {
1719
1720 /* Handle glomming separately */
1721 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1722 u8 cnt;
1723 brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1724 bus->glomd, skb_peek(&bus->glom));
1725 cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
1726 brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1727 rxseq += cnt - 1;
1728 rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1729 continue;
1730 }
1731
1732 /* Try doing single read if we can */
1733 if (bus->nextlen) {
1734 u16 nextlen = bus->nextlen;
1735 bus->nextlen = 0;
1736
1737 rdlen = len = nextlen << 4;
1738 brcmf_pad(bus, &pad, &rdlen);
1739
1740 /*
1741 * After the frame is received we have to
1742 * distinguish whether it is data
1743 * or non-data frame.
1744 */
1745 brcmf_alloc_pkt_and_read(bus, rdlen, &pkt, &rxbuf);
1746 if (pkt == NULL) {
1747 /* Give up on data, request rtx of events */
1748 brcmf_dbg(ERROR, "(nextlen): brcmf_alloc_pkt_and_read failed: len %d rdlen %d expected rxseq %d\n",
1749 len, rdlen, rxseq);
1750 continue;
1751 }
1752
1753 if (brcmf_check_rxbuf(bus, pkt, rxbuf, rxseq, nextlen,
1754 &len) < 0)
1755 continue;
1756
1757 /* Extract software header fields */
1758 chan = SDPCM_PACKET_CHANNEL(
1759 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1760 seq = SDPCM_PACKET_SEQUENCE(
1761 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1762 doff = SDPCM_DOFFSET_VALUE(
1763 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1764 txmax = SDPCM_WINDOW_VALUE(
1765 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1766
1767 bus->nextlen =
1768 bus->rxhdr[SDPCM_FRAMETAG_LEN +
1769 SDPCM_NEXTLEN_OFFSET];
1770 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1771 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1772 bus->nextlen, seq);
1773 bus->nextlen = 0;
1774 }
1775
1776 bus->drvr->rx_readahead_cnt++;
1777
1778 /* Handle Flow Control */
1779 fcbits = SDPCM_FCMASK_VALUE(
1780 &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1781
1782 if (bus->flowcontrol != fcbits) {
1783 if (~bus->flowcontrol & fcbits)
1784 bus->fc_xoff++;
1785
1786 if (bus->flowcontrol & ~fcbits)
1787 bus->fc_xon++;
1788
1789 bus->fc_rcvd++;
1790 bus->flowcontrol = fcbits;
1791 }
1792
1793 /* Check and update sequence number */
1794 if (rxseq != seq) {
1795 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
1796 seq, rxseq);
1797 bus->rx_badseq++;
1798 rxseq = seq;
1799 }
1800
1801 /* Check window for sanity */
1802 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1803 brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
1804 txmax, bus->tx_seq);
1805 txmax = bus->tx_seq + 2;
1806 }
1807 bus->tx_max = txmax;
1808
1809 #ifdef BCMDBG
1810 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
1811 printk(KERN_DEBUG "Rx Data:\n");
1812 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1813 rxbuf, len);
1814 } else if (BRCMF_HDRS_ON()) {
1815 printk(KERN_DEBUG "RxHdr:\n");
1816 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1817 bus->rxhdr, SDPCM_HDRLEN);
1818 }
1819 #endif
1820
1821 if (chan == SDPCM_CONTROL_CHANNEL) {
1822 brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
1823 seq);
1824 /* Force retry w/normal header read */
1825 bus->nextlen = 0;
1826 brcmf_sdbrcm_rxfail(bus, false, true);
1827 brcmf_sdbrcm_pktfree2(bus, pkt);
1828 continue;
1829 }
1830
1831 /* Validate data offset */
1832 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1833 brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
1834 doff, len, SDPCM_HDRLEN);
1835 brcmf_sdbrcm_rxfail(bus, false, false);
1836 brcmf_sdbrcm_pktfree2(bus, pkt);
1837 continue;
1838 }
1839
1840 /* All done with this one -- now deliver the packet */
1841 goto deliver;
1842 }
1843
1844 /* Read frame header (hardware and software) */
1845 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
1846 SDIO_FUNC_2, F2SYNC, bus->rxhdr,
1847 BRCMF_FIRSTREAD);
1848 bus->f2rxhdrs++;
1849
1850 if (sdret < 0) {
1851 brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
1852 bus->rx_hdrfail++;
1853 brcmf_sdbrcm_rxfail(bus, true, true);
1854 continue;
1855 }
1856 #ifdef BCMDBG
1857 if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
1858 printk(KERN_DEBUG "RxHdr:\n");
1859 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1860 bus->rxhdr, SDPCM_HDRLEN);
1861 }
1862 #endif
1863
1864 /* Extract hardware header fields */
1865 len = get_unaligned_le16(bus->rxhdr);
1866 check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
1867
1868 /* All zeros means no more frames */
1869 if (!(len | check)) {
1870 *finished = true;
1871 break;
1872 }
1873
1874 /* Validate check bytes */
1875 if ((u16) ~(len ^ check)) {
1876 brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
1877 len, check);
1878 bus->rx_badhdr++;
1879 brcmf_sdbrcm_rxfail(bus, false, false);
1880 continue;
1881 }
1882
1883 /* Validate frame length */
1884 if (len < SDPCM_HDRLEN) {
1885 brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
1886 continue;
1887 }
1888
1889 /* Extract software header fields */
1890 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1891 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1892 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1893 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1894
1895 /* Validate data offset */
1896 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
1897 brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
1898 doff, len, SDPCM_HDRLEN, seq);
1899 bus->rx_badhdr++;
1900 brcmf_sdbrcm_rxfail(bus, false, false);
1901 continue;
1902 }
1903
1904 /* Save the readahead length if there is one */
1905 bus->nextlen =
1906 bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1907 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
1908 brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
1909 bus->nextlen, seq);
1910 bus->nextlen = 0;
1911 }
1912
1913 /* Handle Flow Control */
1914 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
1915
1916 if (bus->flowcontrol != fcbits) {
1917 if (~bus->flowcontrol & fcbits)
1918 bus->fc_xoff++;
1919
1920 if (bus->flowcontrol & ~fcbits)
1921 bus->fc_xon++;
1922
1923 bus->fc_rcvd++;
1924 bus->flowcontrol = fcbits;
1925 }
1926
1927 /* Check and update sequence number */
1928 if (rxseq != seq) {
1929 brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
1930 bus->rx_badseq++;
1931 rxseq = seq;
1932 }
1933
1934 /* Check window for sanity */
1935 if ((u8) (txmax - bus->tx_seq) > 0x40) {
1936 brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
1937 txmax, bus->tx_seq);
1938 txmax = bus->tx_seq + 2;
1939 }
1940 bus->tx_max = txmax;
1941
1942 /* Call a separate function for control frames */
1943 if (chan == SDPCM_CONTROL_CHANNEL) {
1944 brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
1945 continue;
1946 }
1947
1948 /* precondition: chan is either SDPCM_DATA_CHANNEL,
1949 SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
1950 SDPCM_GLOM_CHANNEL */
1951
1952 /* Length to read */
1953 rdlen = (len > BRCMF_FIRSTREAD) ? (len - BRCMF_FIRSTREAD) : 0;
1954
1955 /* May pad read to blocksize for efficiency */
1956 if (bus->roundup && bus->blocksize &&
1957 (rdlen > bus->blocksize)) {
1958 pad = bus->blocksize - (rdlen % bus->blocksize);
1959 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1960 ((rdlen + pad + BRCMF_FIRSTREAD) < MAX_RX_DATASZ))
1961 rdlen += pad;
1962 } else if (rdlen % BRCMF_SDALIGN) {
1963 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1964 }
1965
1966 /* Satisfy length-alignment requirements */
1967 if (rdlen & (ALIGNMENT - 1))
1968 rdlen = roundup(rdlen, ALIGNMENT);
1969
1970 if ((rdlen + BRCMF_FIRSTREAD) > MAX_RX_DATASZ) {
1971 /* Too long -- skip this frame */
1972 brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
1973 len, rdlen);
1974 bus->drvr->rx_errors++;
1975 bus->rx_toolong++;
1976 brcmf_sdbrcm_rxfail(bus, false, false);
1977 continue;
1978 }
1979
1980 pkt = brcmu_pkt_buf_get_skb(rdlen +
1981 BRCMF_FIRSTREAD + BRCMF_SDALIGN);
1982 if (!pkt) {
1983 /* Give up on data, request rtx of events */
1984 brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
1985 rdlen, chan);
1986 bus->drvr->rx_dropped++;
1987 brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
1988 continue;
1989 }
1990
1991 /* Leave room for what we already read, and align remainder */
1992 skb_pull(pkt, BRCMF_FIRSTREAD);
1993 pkt_align(pkt, rdlen, BRCMF_SDALIGN);
1994
1995 /* Read the remaining frame data */
1996 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1997 SDIO_FUNC_2, F2SYNC, pkt);
1998 bus->f2rxdata++;
1999
2000 if (sdret < 0) {
2001 brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
2002 ((chan == SDPCM_EVENT_CHANNEL) ? "event"
2003 : ((chan == SDPCM_DATA_CHANNEL) ? "data"
2004 : "test")), sdret);
2005 brcmu_pkt_buf_free_skb(pkt);
2006 bus->drvr->rx_errors++;
2007 brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
2008 continue;
2009 }
2010
2011 /* Copy the already-read portion */
2012 skb_push(pkt, BRCMF_FIRSTREAD);
2013 memcpy(pkt->data, bus->rxhdr, BRCMF_FIRSTREAD);
2014
2015 #ifdef BCMDBG
2016 if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
2017 printk(KERN_DEBUG "Rx Data:\n");
2018 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2019 pkt->data, len);
2020 }
2021 #endif
2022
2023 deliver:
2024 /* Save superframe descriptor and allocate packet frame */
2025 if (chan == SDPCM_GLOM_CHANNEL) {
2026 if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
2027 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
2028 len);
2029 #ifdef BCMDBG
2030 if (BRCMF_GLOM_ON()) {
2031 printk(KERN_DEBUG "Glom Data:\n");
2032 print_hex_dump_bytes("",
2033 DUMP_PREFIX_OFFSET,
2034 pkt->data, len);
2035 }
2036 #endif
2037 __skb_trim(pkt, len);
2038 skb_pull(pkt, SDPCM_HDRLEN);
2039 bus->glomd = pkt;
2040 } else {
2041 brcmf_dbg(ERROR, "%s: glom superframe w/o "
2042 "descriptor!\n", __func__);
2043 brcmf_sdbrcm_rxfail(bus, false, false);
2044 }
2045 continue;
2046 }
2047
2048 /* Fill in packet len and prio, deliver upward */
2049 __skb_trim(pkt, len);
2050 skb_pull(pkt, doff);
2051
2052 if (pkt->len == 0) {
2053 brcmu_pkt_buf_free_skb(pkt);
2054 continue;
2055 } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
2056 brcmf_dbg(ERROR, "rx protocol error\n");
2057 brcmu_pkt_buf_free_skb(pkt);
2058 bus->drvr->rx_errors++;
2059 continue;
2060 }
2061
2062 /* Unlock during rx call */
2063 up(&bus->sdsem);
2064 brcmf_rx_packet(bus->drvr, ifidx, pkt);
2065 down(&bus->sdsem);
2066 }
2067 rxcount = maxframes - rxleft;
2068 #ifdef BCMDBG
2069 /* Message if we hit the limit */
2070 if (!rxleft)
2071 brcmf_dbg(DATA, "hit rx limit of %d frames\n",
2072 maxframes);
2073 else
2074 #endif /* BCMDBG */
2075 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
2076 /* Back off rxseq if awaiting rtx, update rx_seq */
2077 if (bus->rxskip)
2078 rxseq--;
2079 bus->rx_seq = rxseq;
2080
2081 return rxcount;
2082 }
2083
2084 static void
2085 brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
2086 {
2087 up(&bus->sdsem);
2088 wait_event_interruptible_timeout(bus->ctrl_wait,
2089 (*lockvar == false), HZ * 2);
2090 down(&bus->sdsem);
2091 return;
2092 }
2093
2094 static void
2095 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
2096 {
2097 if (waitqueue_active(&bus->ctrl_wait))
2098 wake_up_interruptible(&bus->ctrl_wait);
2099 return;
2100 }
2101
2102 /* Writes a HW/SW header into the packet and sends it. */
2103 /* Assumes: (a) header space already there, (b) caller holds lock */
2104 static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt,
2105 uint chan, bool free_pkt)
2106 {
2107 int ret;
2108 u8 *frame;
2109 u16 len, pad = 0;
2110 u32 swheader;
2111 struct sk_buff *new;
2112 int i;
2113
2114 brcmf_dbg(TRACE, "Enter\n");
2115
2116 frame = (u8 *) (pkt->data);
2117
2118 /* Add alignment padding, allocate new packet if needed */
2119 pad = ((unsigned long)frame % BRCMF_SDALIGN);
2120 if (pad) {
2121 if (skb_headroom(pkt) < pad) {
2122 brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
2123 skb_headroom(pkt), pad);
2124 bus->drvr->tx_realloc++;
2125 new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
2126 if (!new) {
2127 brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
2128 pkt->len + BRCMF_SDALIGN);
2129 ret = -ENOMEM;
2130 goto done;
2131 }
2132
2133 pkt_align(new, pkt->len, BRCMF_SDALIGN);
2134 memcpy(new->data, pkt->data, pkt->len);
2135 if (free_pkt)
2136 brcmu_pkt_buf_free_skb(pkt);
2137 /* free the pkt if canned one is not used */
2138 free_pkt = true;
2139 pkt = new;
2140 frame = (u8 *) (pkt->data);
2141 /* precondition: (frame % BRCMF_SDALIGN) == 0) */
2142 pad = 0;
2143 } else {
2144 skb_push(pkt, pad);
2145 frame = (u8 *) (pkt->data);
2146 /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
2147 memset(frame, 0, pad + SDPCM_HDRLEN);
2148 }
2149 }
2150 /* precondition: pad < BRCMF_SDALIGN */
2151
2152 /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2153 len = (u16) (pkt->len);
2154 *(__le16 *) frame = cpu_to_le16(len);
2155 *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
2156
2157 /* Software tag: channel, sequence number, data offset */
2158 swheader =
2159 ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
2160 (((pad +
2161 SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
2162
2163 put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2164 put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2165
2166 #ifdef BCMDBG
2167 tx_packets[pkt->priority]++;
2168 if (BRCMF_BYTES_ON() &&
2169 (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
2170 (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
2171 printk(KERN_DEBUG "Tx Frame:\n");
2172 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
2173 } else if (BRCMF_HDRS_ON()) {
2174 printk(KERN_DEBUG "TxHdr:\n");
2175 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2176 frame, min_t(u16, len, 16));
2177 }
2178 #endif
2179
2180 /* Raise len to next SDIO block to eliminate tail command */
2181 if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2182 u16 pad = bus->blocksize - (len % bus->blocksize);
2183 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2184 len += pad;
2185 } else if (len % BRCMF_SDALIGN) {
2186 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2187 }
2188
2189 /* Some controllers have trouble with odd bytes -- round to even */
2190 if (len & (ALIGNMENT - 1))
2191 len = roundup(len, ALIGNMENT);
2192
2193 ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
2194 SDIO_FUNC_2, F2SYNC, pkt);
2195 bus->f2txdata++;
2196
2197 if (ret < 0) {
2198 /* On failure, abort the command and terminate the frame */
2199 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2200 ret);
2201 bus->tx_sderrs++;
2202
2203 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2204 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2205 SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2206 NULL);
2207 bus->f1regdata++;
2208
2209 for (i = 0; i < 3; i++) {
2210 u8 hi, lo;
2211 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2212 SDIO_FUNC_1,
2213 SBSDIO_FUNC1_WFRAMEBCHI,
2214 NULL);
2215 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2216 SDIO_FUNC_1,
2217 SBSDIO_FUNC1_WFRAMEBCLO,
2218 NULL);
2219 bus->f1regdata += 2;
2220 if ((hi == 0) && (lo == 0))
2221 break;
2222 }
2223
2224 }
2225 if (ret == 0)
2226 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2227
2228 done:
2229 /* restore pkt buffer pointer before calling tx complete routine */
2230 skb_pull(pkt, SDPCM_HDRLEN + pad);
2231 up(&bus->sdsem);
2232 brcmf_txcomplete(bus->drvr, pkt, ret != 0);
2233 down(&bus->sdsem);
2234
2235 if (free_pkt)
2236 brcmu_pkt_buf_free_skb(pkt);
2237
2238 return ret;
2239 }
2240
2241 static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
2242 {
2243 struct sk_buff *pkt;
2244 u32 intstatus = 0;
2245 uint retries = 0;
2246 int ret = 0, prec_out;
2247 uint cnt = 0;
2248 uint datalen;
2249 u8 tx_prec_map;
2250
2251 struct brcmf_pub *drvr = bus->drvr;
2252
2253 brcmf_dbg(TRACE, "Enter\n");
2254
2255 tx_prec_map = ~bus->flowcontrol;
2256
2257 /* Send frames until the limit or some other event */
2258 for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
2259 spin_lock_bh(&bus->txqlock);
2260 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
2261 if (pkt == NULL) {
2262 spin_unlock_bh(&bus->txqlock);
2263 break;
2264 }
2265 spin_unlock_bh(&bus->txqlock);
2266 datalen = pkt->len - SDPCM_HDRLEN;
2267
2268 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
2269 if (ret)
2270 bus->drvr->tx_errors++;
2271 else
2272 bus->drvr->dstats.tx_bytes += datalen;
2273
2274 /* In poll mode, need to check for other events */
2275 if (!bus->intr && cnt) {
2276 /* Check device status, signal pending interrupt */
2277 r_sdreg32(bus, &intstatus,
2278 offsetof(struct sdpcmd_regs, intstatus),
2279 &retries);
2280 bus->f2txdata++;
2281 if (brcmf_sdcard_regfail(bus->sdiodev))
2282 break;
2283 if (intstatus & bus->hostintmask)
2284 bus->ipend = true;
2285 }
2286 }
2287
2288 /* Deflow-control stack if needed */
2289 if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
2290 drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
2291 brcmf_txflowcontrol(drvr, 0, OFF);
2292
2293 return cnt;
2294 }
2295
2296 static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
2297 {
2298 u32 intstatus, newstatus = 0;
2299 uint retries = 0;
2300 uint rxlimit = bus->rxbound; /* Rx frames to read before resched */
2301 uint txlimit = bus->txbound; /* Tx frames to send before resched */
2302 uint framecnt = 0; /* Temporary counter of tx/rx frames */
2303 bool rxdone = true; /* Flag for no more read data */
2304 bool resched = false; /* Flag indicating resched wanted */
2305
2306 brcmf_dbg(TRACE, "Enter\n");
2307
2308 /* Start with leftover status bits */
2309 intstatus = bus->intstatus;
2310
2311 down(&bus->sdsem);
2312
2313 /* If waiting for HTAVAIL, check status */
2314 if (bus->clkstate == CLK_PENDING) {
2315 int err;
2316 u8 clkctl, devctl = 0;
2317
2318 #ifdef BCMDBG
2319 /* Check for inconsistent device control */
2320 devctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2321 SBSDIO_DEVICE_CTL, &err);
2322 if (err) {
2323 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
2324 bus->drvr->busstate = BRCMF_BUS_DOWN;
2325 }
2326 #endif /* BCMDBG */
2327
2328 /* Read CSR, if clock on switch to AVAIL, else ignore */
2329 clkctl = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2330 SBSDIO_FUNC1_CHIPCLKCSR, &err);
2331 if (err) {
2332 brcmf_dbg(ERROR, "error reading CSR: %d\n",
2333 err);
2334 bus->drvr->busstate = BRCMF_BUS_DOWN;
2335 }
2336
2337 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2338 devctl, clkctl);
2339
2340 if (SBSDIO_HTAV(clkctl)) {
2341 devctl = brcmf_sdcard_cfg_read(bus->sdiodev,
2342 SDIO_FUNC_1,
2343 SBSDIO_DEVICE_CTL, &err);
2344 if (err) {
2345 brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
2346 err);
2347 bus->drvr->busstate = BRCMF_BUS_DOWN;
2348 }
2349 devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2350 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2351 SBSDIO_DEVICE_CTL, devctl, &err);
2352 if (err) {
2353 brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
2354 err);
2355 bus->drvr->busstate = BRCMF_BUS_DOWN;
2356 }
2357 bus->clkstate = CLK_AVAIL;
2358 } else {
2359 goto clkwait;
2360 }
2361 }
2362
2363 bus_wake(bus);
2364
2365 /* Make sure backplane clock is on */
2366 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2367 if (bus->clkstate == CLK_PENDING)
2368 goto clkwait;
2369
2370 /* Pending interrupt indicates new device status */
2371 if (bus->ipend) {
2372 bus->ipend = false;
2373 r_sdreg32(bus, &newstatus,
2374 offsetof(struct sdpcmd_regs, intstatus), &retries);
2375 bus->f1regdata++;
2376 if (brcmf_sdcard_regfail(bus->sdiodev))
2377 newstatus = 0;
2378 newstatus &= bus->hostintmask;
2379 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
2380 if (newstatus) {
2381 w_sdreg32(bus, newstatus,
2382 offsetof(struct sdpcmd_regs, intstatus),
2383 &retries);
2384 bus->f1regdata++;
2385 }
2386 }
2387
2388 /* Merge new bits with previous */
2389 intstatus |= newstatus;
2390 bus->intstatus = 0;
2391
2392 /* Handle flow-control change: read new state in case our ack
2393 * crossed another change interrupt. If change still set, assume
2394 * FC ON for safety, let next loop through do the debounce.
2395 */
2396 if (intstatus & I_HMB_FC_CHANGE) {
2397 intstatus &= ~I_HMB_FC_CHANGE;
2398 w_sdreg32(bus, I_HMB_FC_CHANGE,
2399 offsetof(struct sdpcmd_regs, intstatus), &retries);
2400
2401 r_sdreg32(bus, &newstatus,
2402 offsetof(struct sdpcmd_regs, intstatus), &retries);
2403 bus->f1regdata += 2;
2404 bus->fcstate =
2405 !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
2406 intstatus |= (newstatus & bus->hostintmask);
2407 }
2408
2409 /* Handle host mailbox indication */
2410 if (intstatus & I_HMB_HOST_INT) {
2411 intstatus &= ~I_HMB_HOST_INT;
2412 intstatus |= brcmf_sdbrcm_hostmail(bus);
2413 }
2414
2415 /* Generally don't ask for these, can get CRC errors... */
2416 if (intstatus & I_WR_OOSYNC) {
2417 brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
2418 intstatus &= ~I_WR_OOSYNC;
2419 }
2420
2421 if (intstatus & I_RD_OOSYNC) {
2422 brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
2423 intstatus &= ~I_RD_OOSYNC;
2424 }
2425
2426 if (intstatus & I_SBINT) {
2427 brcmf_dbg(ERROR, "Dongle reports SBINT\n");
2428 intstatus &= ~I_SBINT;
2429 }
2430
2431 /* Would be active due to wake-wlan in gSPI */
2432 if (intstatus & I_CHIPACTIVE) {
2433 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2434 intstatus &= ~I_CHIPACTIVE;
2435 }
2436
2437 /* Ignore frame indications if rxskip is set */
2438 if (bus->rxskip)
2439 intstatus &= ~I_HMB_FRAME_IND;
2440
2441 /* On frame indication, read available frames */
2442 if (PKT_AVAILABLE()) {
2443 framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
2444 if (rxdone || bus->rxskip)
2445 intstatus &= ~I_HMB_FRAME_IND;
2446 rxlimit -= min(framecnt, rxlimit);
2447 }
2448
2449 /* Keep still-pending events for next scheduling */
2450 bus->intstatus = intstatus;
2451
2452 clkwait:
2453 if (data_ok(bus) && bus->ctrl_frame_stat &&
2454 (bus->clkstate == CLK_AVAIL)) {
2455 int ret, i;
2456
2457 ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2458 SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
2459 (u32) bus->ctrl_frame_len);
2460
2461 if (ret < 0) {
2462 /* On failure, abort the command and
2463 terminate the frame */
2464 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2465 ret);
2466 bus->tx_sderrs++;
2467
2468 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2469
2470 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2471 SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
2472 NULL);
2473 bus->f1regdata++;
2474
2475 for (i = 0; i < 3; i++) {
2476 u8 hi, lo;
2477 hi = brcmf_sdcard_cfg_read(bus->sdiodev,
2478 SDIO_FUNC_1,
2479 SBSDIO_FUNC1_WFRAMEBCHI,
2480 NULL);
2481 lo = brcmf_sdcard_cfg_read(bus->sdiodev,
2482 SDIO_FUNC_1,
2483 SBSDIO_FUNC1_WFRAMEBCLO,
2484 NULL);
2485 bus->f1regdata += 2;
2486 if ((hi == 0) && (lo == 0))
2487 break;
2488 }
2489
2490 }
2491 if (ret == 0)
2492 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2493
2494 brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
2495 bus->ctrl_frame_stat = false;
2496 brcmf_sdbrcm_wait_event_wakeup(bus);
2497 }
2498 /* Send queued frames (limit 1 if rx may still be pending) */
2499 else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
2500 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2501 && data_ok(bus)) {
2502 framecnt = rxdone ? txlimit : min(txlimit, bus->txminmax);
2503 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2504 txlimit -= framecnt;
2505 }
2506
2507 /* Resched if events or tx frames are pending,
2508 else await next interrupt */
2509 /* On failed register access, all bets are off:
2510 no resched or interrupts */
2511 if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
2512 brcmf_sdcard_regfail(bus->sdiodev)) {
2513 brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation %d\n",
2514 brcmf_sdcard_regfail(bus->sdiodev));
2515 bus->drvr->busstate = BRCMF_BUS_DOWN;
2516 bus->intstatus = 0;
2517 } else if (bus->clkstate == CLK_PENDING) {
2518 brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
2519 resched = true;
2520 } else if (bus->intstatus || bus->ipend ||
2521 (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
2522 && data_ok(bus)) || PKT_AVAILABLE()) {
2523 resched = true;
2524 }
2525
2526 bus->dpc_sched = resched;
2527
2528 /* If we're done for now, turn off clock request. */
2529 if ((bus->clkstate != CLK_PENDING)
2530 && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2531 bus->activity = false;
2532 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2533 }
2534
2535 up(&bus->sdsem);
2536
2537 return resched;
2538 }
2539
2540 static int brcmf_sdbrcm_dpc_thread(void *data)
2541 {
2542 struct brcmf_bus *bus = (struct brcmf_bus *) data;
2543
2544 allow_signal(SIGTERM);
2545 /* Run until signal received */
2546 while (1) {
2547 if (kthread_should_stop())
2548 break;
2549 if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
2550 /* Call bus dpc unless it indicated down
2551 (then clean stop) */
2552 if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
2553 if (brcmf_sdbrcm_dpc(bus))
2554 complete(&bus->dpc_wait);
2555 } else {
2556 /* after stopping the bus, exit thread */
2557 brcmf_sdbrcm_bus_stop(bus);
2558 bus->dpc_tsk = NULL;
2559 break;
2560 }
2561 } else
2562 break;
2563 }
2564 return 0;
2565 }
2566
2567 int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
2568 {
2569 int ret = -EBADE;
2570 uint datalen, prec;
2571
2572 brcmf_dbg(TRACE, "Enter\n");
2573
2574 datalen = pkt->len;
2575
2576 /* Add space for the header */
2577 skb_push(pkt, SDPCM_HDRLEN);
2578 /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2579
2580 prec = prio2prec((pkt->priority & PRIOMASK));
2581
2582 /* Check for existing queue, current flow-control,
2583 pending event, or pending clock */
2584 brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2585 bus->fcqueued++;
2586
2587 /* Priority based enq */
2588 spin_lock_bh(&bus->txqlock);
2589 if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) == false) {
2590 skb_pull(pkt, SDPCM_HDRLEN);
2591 brcmf_txcomplete(bus->drvr, pkt, false);
2592 brcmu_pkt_buf_free_skb(pkt);
2593 brcmf_dbg(ERROR, "out of bus->txq !!!\n");
2594 ret = -ENOSR;
2595 } else {
2596 ret = 0;
2597 }
2598 spin_unlock_bh(&bus->txqlock);
2599
2600 if (pktq_len(&bus->txq) >= TXHI)
2601 brcmf_txflowcontrol(bus->drvr, 0, ON);
2602
2603 #ifdef BCMDBG
2604 if (pktq_plen(&bus->txq, prec) > qcount[prec])
2605 qcount[prec] = pktq_plen(&bus->txq, prec);
2606 #endif
2607 /* Schedule DPC if needed to send queued packet(s) */
2608 if (!bus->dpc_sched) {
2609 bus->dpc_sched = true;
2610 if (bus->dpc_tsk)
2611 complete(&bus->dpc_wait);
2612 }
2613
2614 return ret;
2615 }
2616
2617 static int
2618 brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
2619 uint size)
2620 {
2621 int bcmerror = 0;
2622 u32 sdaddr;
2623 uint dsize;
2624
2625 /* Determine initial transfer parameters */
2626 sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2627 if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2628 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2629 else
2630 dsize = size;
2631
2632 /* Set the backplane window to include the start address */
2633 bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2634 if (bcmerror) {
2635 brcmf_dbg(ERROR, "window change failed\n");
2636 goto xfer_done;
2637 }
2638
2639 /* Do the transfer(s) */
2640 while (size) {
2641 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2642 write ? "write" : "read", dsize,
2643 sdaddr, address & SBSDIO_SBWINDOW_MASK);
2644 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2645 sdaddr, data, dsize);
2646 if (bcmerror) {
2647 brcmf_dbg(ERROR, "membytes transfer failed\n");
2648 break;
2649 }
2650
2651 /* Adjust for next transfer (if any) */
2652 size -= dsize;
2653 if (size) {
2654 data += dsize;
2655 address += dsize;
2656 bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2657 address);
2658 if (bcmerror) {
2659 brcmf_dbg(ERROR, "window change failed\n");
2660 break;
2661 }
2662 sdaddr = 0;
2663 dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2664 }
2665 }
2666
2667 xfer_done:
2668 /* Return the window to backplane enumeration space for core access */
2669 if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2670 brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
2671 bus->sdiodev->sbwad);
2672
2673 return bcmerror;
2674 }
2675
2676 #ifdef BCMDBG
2677 #define CONSOLE_LINE_MAX 192
2678
2679 static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
2680 {
2681 struct brcmf_console *c = &bus->console;
2682 u8 line[CONSOLE_LINE_MAX], ch;
2683 u32 n, idx, addr;
2684 int rv;
2685
2686 /* Don't do anything until FWREADY updates console address */
2687 if (bus->console_addr == 0)
2688 return 0;
2689
2690 /* Read console log struct */
2691 addr = bus->console_addr + offsetof(struct rte_console, log_le);
2692 rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
2693 sizeof(c->log_le));
2694 if (rv < 0)
2695 return rv;
2696
2697 /* Allocate console buffer (one time only) */
2698 if (c->buf == NULL) {
2699 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2700 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2701 if (c->buf == NULL)
2702 return -ENOMEM;
2703 }
2704
2705 idx = le32_to_cpu(c->log_le.idx);
2706
2707 /* Protect against corrupt value */
2708 if (idx > c->bufsize)
2709 return -EBADE;
2710
2711 /* Skip reading the console buffer if the index pointer
2712 has not moved */
2713 if (idx == c->last)
2714 return 0;
2715
2716 /* Read the console buffer */
2717 addr = le32_to_cpu(c->log_le.buf);
2718 rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2719 if (rv < 0)
2720 return rv;
2721
2722 while (c->last != idx) {
2723 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2724 if (c->last == idx) {
2725 /* This would output a partial line.
2726 * Instead, back up
2727 * the buffer pointer and output this
2728 * line next time around.
2729 */
2730 if (c->last >= n)
2731 c->last -= n;
2732 else
2733 c->last = c->bufsize - n;
2734 goto break2;
2735 }
2736 ch = c->buf[c->last];
2737 c->last = (c->last + 1) % c->bufsize;
2738 if (ch == '\n')
2739 break;
2740 line[n] = ch;
2741 }
2742
2743 if (n > 0) {
2744 if (line[n - 1] == '\r')
2745 n--;
2746 line[n] = 0;
2747 printk(KERN_DEBUG "CONSOLE: %s\n", line);
2748 }
2749 }
2750 break2:
2751
2752 return 0;
2753 }
2754 #endif /* BCMDBG */
2755
2756 static int brcmf_tx_frame(struct brcmf_bus *bus, u8 *frame, u16 len)
2757 {
2758 int i;
2759 int ret;
2760
2761 bus->ctrl_frame_stat = false;
2762 ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2763 SDIO_FUNC_2, F2SYNC, frame, len);
2764
2765 if (ret < 0) {
2766 /* On failure, abort the command and terminate the frame */
2767 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2768 ret);
2769 bus->tx_sderrs++;
2770
2771 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2772
2773 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
2774 SBSDIO_FUNC1_FRAMECTRL,
2775 SFC_WF_TERM, NULL);
2776 bus->f1regdata++;
2777
2778 for (i = 0; i < 3; i++) {
2779 u8 hi, lo;
2780 hi = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2781 SBSDIO_FUNC1_WFRAMEBCHI,
2782 NULL);
2783 lo = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
2784 SBSDIO_FUNC1_WFRAMEBCLO,
2785 NULL);
2786 bus->f1regdata += 2;
2787 if (hi == 0 && lo == 0)
2788 break;
2789 }
2790 return ret;
2791 }
2792
2793 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2794
2795 return ret;
2796 }
2797
2798 int
2799 brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
2800 {
2801 u8 *frame;
2802 u16 len;
2803 u32 swheader;
2804 uint retries = 0;
2805 u8 doff = 0;
2806 int ret = -1;
2807
2808 brcmf_dbg(TRACE, "Enter\n");
2809
2810 /* Back the pointer to make a room for bus header */
2811 frame = msg - SDPCM_HDRLEN;
2812 len = (msglen += SDPCM_HDRLEN);
2813
2814 /* Add alignment padding (optional for ctl frames) */
2815 doff = ((unsigned long)frame % BRCMF_SDALIGN);
2816 if (doff) {
2817 frame -= doff;
2818 len += doff;
2819 msglen += doff;
2820 memset(frame, 0, doff + SDPCM_HDRLEN);
2821 }
2822 /* precondition: doff < BRCMF_SDALIGN */
2823 doff += SDPCM_HDRLEN;
2824
2825 /* Round send length to next SDIO block */
2826 if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2827 u16 pad = bus->blocksize - (len % bus->blocksize);
2828 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2829 len += pad;
2830 } else if (len % BRCMF_SDALIGN) {
2831 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2832 }
2833
2834 /* Satisfy length-alignment requirements */
2835 if (len & (ALIGNMENT - 1))
2836 len = roundup(len, ALIGNMENT);
2837
2838 /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2839
2840 /* Need to lock here to protect txseq and SDIO tx calls */
2841 down(&bus->sdsem);
2842
2843 bus_wake(bus);
2844
2845 /* Make sure backplane clock is on */
2846 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2847
2848 /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2849 *(__le16 *) frame = cpu_to_le16((u16) msglen);
2850 *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
2851
2852 /* Software tag: channel, sequence number, data offset */
2853 swheader =
2854 ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
2855 SDPCM_CHANNEL_MASK)
2856 | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
2857 SDPCM_DOFFSET_MASK);
2858 put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2859 put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2860
2861 if (!data_ok(bus)) {
2862 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2863 bus->tx_max, bus->tx_seq);
2864 bus->ctrl_frame_stat = true;
2865 /* Send from dpc */
2866 bus->ctrl_frame_buf = frame;
2867 bus->ctrl_frame_len = len;
2868
2869 brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
2870
2871 if (bus->ctrl_frame_stat == false) {
2872 brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
2873 ret = 0;
2874 } else {
2875 brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
2876 ret = -1;
2877 }
2878 }
2879
2880 if (ret == -1) {
2881 #ifdef BCMDBG
2882 if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
2883 printk(KERN_DEBUG "Tx Frame:\n");
2884 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2885 frame, len);
2886 } else if (BRCMF_HDRS_ON()) {
2887 printk(KERN_DEBUG "TxHdr:\n");
2888 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
2889 frame, min_t(u16, len, 16));
2890 }
2891 #endif
2892
2893 do {
2894 ret = brcmf_tx_frame(bus, frame, len);
2895 } while (ret < 0 && retries++ < TXRETRIES);
2896 }
2897
2898 if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2899 bus->activity = false;
2900 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2901 }
2902
2903 up(&bus->sdsem);
2904
2905 if (ret)
2906 bus->drvr->tx_ctlerrs++;
2907 else
2908 bus->drvr->tx_ctlpkts++;
2909
2910 return ret ? -EIO : 0;
2911 }
2912
2913 int
2914 brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
2915 {
2916 int timeleft;
2917 uint rxlen = 0;
2918 bool pending;
2919
2920 brcmf_dbg(TRACE, "Enter\n");
2921
2922 /* Wait until control frame is available */
2923 timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
2924
2925 down(&bus->sdsem);
2926 rxlen = bus->rxlen;
2927 memcpy(msg, bus->rxctl, min(msglen, rxlen));
2928 bus->rxlen = 0;
2929 up(&bus->sdsem);
2930
2931 if (rxlen) {
2932 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
2933 rxlen, msglen);
2934 } else if (timeleft == 0) {
2935 brcmf_dbg(ERROR, "resumed on timeout\n");
2936 } else if (pending == true) {
2937 brcmf_dbg(CTL, "cancelled\n");
2938 return -ERESTARTSYS;
2939 } else {
2940 brcmf_dbg(CTL, "resumed for unknown reason?\n");
2941 }
2942
2943 if (rxlen)
2944 bus->drvr->rx_ctlpkts++;
2945 else
2946 bus->drvr->rx_ctlerrs++;
2947
2948 return rxlen ? (int)rxlen : -ETIMEDOUT;
2949 }
2950
2951 static int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
2952 {
2953 int bcmerror = 0;
2954
2955 brcmf_dbg(TRACE, "Enter\n");
2956
2957 /* Basic sanity checks */
2958 if (bus->drvr->up) {
2959 bcmerror = -EISCONN;
2960 goto err;
2961 }
2962 if (!len) {
2963 bcmerror = -EOVERFLOW;
2964 goto err;
2965 }
2966
2967 /* Free the old ones and replace with passed variables */
2968 kfree(bus->vars);
2969
2970 bus->vars = kmalloc(len, GFP_ATOMIC);
2971 bus->varsz = bus->vars ? len : 0;
2972 if (bus->vars == NULL) {
2973 bcmerror = -ENOMEM;
2974 goto err;
2975 }
2976
2977 /* Copy the passed variables, which should include the
2978 terminating double-null */
2979 memcpy(bus->vars, arg, bus->varsz);
2980 err:
2981 return bcmerror;
2982 }
2983
2984 static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
2985 {
2986 int bcmerror = 0;
2987 u32 varsize;
2988 u32 varaddr;
2989 u8 *vbuffer;
2990 u32 varsizew;
2991 __le32 varsizew_le;
2992 #ifdef BCMDBG
2993 char *nvram_ularray;
2994 #endif /* BCMDBG */
2995
2996 /* Even if there are no vars are to be written, we still
2997 need to set the ramsize. */
2998 varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
2999 varaddr = (bus->ramsize - 4) - varsize;
3000
3001 if (bus->vars) {
3002 vbuffer = kzalloc(varsize, GFP_ATOMIC);
3003 if (!vbuffer)
3004 return -ENOMEM;
3005
3006 memcpy(vbuffer, bus->vars, bus->varsz);
3007
3008 /* Write the vars list */
3009 bcmerror =
3010 brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
3011 #ifdef BCMDBG
3012 /* Verify NVRAM bytes */
3013 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
3014 nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
3015 if (!nvram_ularray)
3016 return -ENOMEM;
3017
3018 /* Upload image to verify downloaded contents. */
3019 memset(nvram_ularray, 0xaa, varsize);
3020
3021 /* Read the vars list to temp buffer for comparison */
3022 bcmerror =
3023 brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
3024 varsize);
3025 if (bcmerror) {
3026 brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
3027 bcmerror, varsize, varaddr);
3028 }
3029 /* Compare the org NVRAM with the one read from RAM */
3030 if (memcmp(vbuffer, nvram_ularray, varsize))
3031 brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
3032 else
3033 brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
3034
3035 kfree(nvram_ularray);
3036 #endif /* BCMDBG */
3037
3038 kfree(vbuffer);
3039 }
3040
3041 /* adjust to the user specified RAM */
3042 brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
3043 brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3044 varaddr, varsize);
3045 varsize = ((bus->ramsize - 4) - varaddr);
3046
3047 /*
3048 * Determine the length token:
3049 * Varsize, converted to words, in lower 16-bits, checksum
3050 * in upper 16-bits.
3051 */
3052 if (bcmerror) {
3053 varsizew = 0;
3054 varsizew_le = cpu_to_le32(0);
3055 } else {
3056 varsizew = varsize / 4;
3057 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3058 varsizew_le = cpu_to_le32(varsizew);
3059 }
3060
3061 brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3062 varsize, varsizew);
3063
3064 /* Write the length token to the last word */
3065 bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
3066 (u8 *)&varsizew_le, 4);
3067
3068 return bcmerror;
3069 }
3070
3071 static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
3072 {
3073 uint retries;
3074 int bcmerror = 0;
3075 struct chip_info *ci = bus->ci;
3076
3077 /* To enter download state, disable ARM and reset SOCRAM.
3078 * To exit download state, simply reset ARM (default is RAM boot).
3079 */
3080 if (enter) {
3081 bus->alp_only = true;
3082
3083 ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3084
3085 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
3086
3087 /* Clear the top bit of memory */
3088 if (bus->ramsize) {
3089 u32 zeros = 0;
3090 brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3091 (u8 *)&zeros, 4);
3092 }
3093 } else {
3094 if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
3095 brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
3096 bcmerror = -EBADE;
3097 goto fail;
3098 }
3099
3100 bcmerror = brcmf_sdbrcm_write_vars(bus);
3101 if (bcmerror) {
3102 brcmf_dbg(ERROR, "no vars written to RAM\n");
3103 bcmerror = 0;
3104 }
3105
3106 w_sdreg32(bus, 0xFFFFFFFF,
3107 offsetof(struct sdpcmd_regs, intstatus), &retries);
3108
3109 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3110
3111 /* Allow HT Clock now that the ARM is running. */
3112 bus->alp_only = false;
3113
3114 bus->drvr->busstate = BRCMF_BUS_LOAD;
3115 }
3116 fail:
3117 return bcmerror;
3118 }
3119
3120 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
3121 {
3122 if (bus->firmware->size < bus->fw_ptr + len)
3123 len = bus->firmware->size - bus->fw_ptr;
3124
3125 memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3126 bus->fw_ptr += len;
3127 return len;
3128 }
3129
3130 static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
3131 {
3132 int offset = 0;
3133 uint len;
3134 u8 *memblock = NULL, *memptr;
3135 int ret;
3136
3137 brcmf_dbg(INFO, "Enter\n");
3138
3139 ret = request_firmware(&bus->firmware, BRCMFMAC_FW_NAME,
3140 &bus->sdiodev->func[2]->dev);
3141 if (ret) {
3142 brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
3143 return ret;
3144 }
3145 bus->fw_ptr = 0;
3146
3147 memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3148 if (memblock == NULL) {
3149 ret = -ENOMEM;
3150 goto err;
3151 }
3152 if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3153 memptr += (BRCMF_SDALIGN -
3154 ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3155
3156 /* Download image */
3157 while ((len =
3158 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3159 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3160 if (ret) {
3161 brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
3162 ret, MEMBLOCK, offset);
3163 goto err;
3164 }
3165
3166 offset += MEMBLOCK;
3167 }
3168
3169 err:
3170 kfree(memblock);
3171
3172 release_firmware(bus->firmware);
3173 bus->fw_ptr = 0;
3174
3175 return ret;
3176 }
3177
3178 /*
3179 * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3180 * and ending in a NUL.
3181 * Removes carriage returns, empty lines, comment lines, and converts
3182 * newlines to NULs.
3183 * Shortens buffer as needed and pads with NULs. End of buffer is marked
3184 * by two NULs.
3185 */
3186
3187 static uint brcmf_process_nvram_vars(char *varbuf, uint len)
3188 {
3189 char *dp;
3190 bool findNewline;
3191 int column;
3192 uint buf_len, n;
3193
3194 dp = varbuf;
3195
3196 findNewline = false;
3197 column = 0;
3198
3199 for (n = 0; n < len; n++) {
3200 if (varbuf[n] == 0)
3201 break;
3202 if (varbuf[n] == '\r')
3203 continue;
3204 if (findNewline && varbuf[n] != '\n')
3205 continue;
3206 findNewline = false;
3207 if (varbuf[n] == '#') {
3208 findNewline = true;
3209 continue;
3210 }
3211 if (varbuf[n] == '\n') {
3212 if (column == 0)
3213 continue;
3214 *dp++ = 0;
3215 column = 0;
3216 continue;
3217 }
3218 *dp++ = varbuf[n];
3219 column++;
3220 }
3221 buf_len = dp - varbuf;
3222
3223 while (dp < varbuf + n)
3224 *dp++ = 0;
3225
3226 return buf_len;
3227 }
3228
3229 static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
3230 {
3231 uint len;
3232 char *memblock = NULL;
3233 char *bufp;
3234 int ret;
3235
3236 ret = request_firmware(&bus->firmware, BRCMFMAC_NV_NAME,
3237 &bus->sdiodev->func[2]->dev);
3238 if (ret) {
3239 brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
3240 return ret;
3241 }
3242 bus->fw_ptr = 0;
3243
3244 memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
3245 if (memblock == NULL) {
3246 ret = -ENOMEM;
3247 goto err;
3248 }
3249
3250 len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
3251
3252 if (len > 0 && len < MEMBLOCK) {
3253 bufp = (char *)memblock;
3254 bufp[len] = 0;
3255 len = brcmf_process_nvram_vars(bufp, len);
3256 bufp += len;
3257 *bufp++ = 0;
3258 if (len)
3259 ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
3260 if (ret)
3261 brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
3262 } else {
3263 brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
3264 ret = -EIO;
3265 }
3266
3267 err:
3268 kfree(memblock);
3269
3270 release_firmware(bus->firmware);
3271 bus->fw_ptr = 0;
3272
3273 return ret;
3274 }
3275
3276 static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
3277 {
3278 int bcmerror = -1;
3279
3280 /* Keep arm in reset */
3281 if (brcmf_sdbrcm_download_state(bus, true)) {
3282 brcmf_dbg(ERROR, "error placing ARM core in reset\n");
3283 goto err;
3284 }
3285
3286 /* External image takes precedence if specified */
3287 if (brcmf_sdbrcm_download_code_file(bus)) {
3288 brcmf_dbg(ERROR, "dongle image file download failed\n");
3289 goto err;
3290 }
3291
3292 /* External nvram takes precedence if specified */
3293 if (brcmf_sdbrcm_download_nvram(bus))
3294 brcmf_dbg(ERROR, "dongle nvram file download failed\n");
3295
3296 /* Take arm out of reset */
3297 if (brcmf_sdbrcm_download_state(bus, false)) {
3298 brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
3299 goto err;
3300 }
3301
3302 bcmerror = 0;
3303
3304 err:
3305 return bcmerror;
3306 }
3307
3308 static bool
3309 brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
3310 {
3311 bool ret;
3312
3313 /* Download the firmware */
3314 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3315
3316 ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3317
3318 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3319
3320 return ret;
3321 }
3322
3323 void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus)
3324 {
3325 u32 local_hostintmask;
3326 u8 saveclk;
3327 uint retries;
3328 int err;
3329
3330 brcmf_dbg(TRACE, "Enter\n");
3331
3332 if (bus->watchdog_tsk) {
3333 send_sig(SIGTERM, bus->watchdog_tsk, 1);
3334 kthread_stop(bus->watchdog_tsk);
3335 bus->watchdog_tsk = NULL;
3336 }
3337
3338 if (bus->dpc_tsk && bus->dpc_tsk != current) {
3339 send_sig(SIGTERM, bus->dpc_tsk, 1);
3340 kthread_stop(bus->dpc_tsk);
3341 bus->dpc_tsk = NULL;
3342 }
3343
3344 down(&bus->sdsem);
3345
3346 bus_wake(bus);
3347
3348 /* Enable clock for device interrupts */
3349 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3350
3351 /* Disable and clear interrupts at the chip level also */
3352 w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
3353 local_hostintmask = bus->hostintmask;
3354 bus->hostintmask = 0;
3355
3356 /* Change our idea of bus state */
3357 bus->drvr->busstate = BRCMF_BUS_DOWN;
3358
3359 /* Force clocks on backplane to be sure F2 interrupt propagates */
3360 saveclk = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3361 SBSDIO_FUNC1_CHIPCLKCSR, &err);
3362 if (!err) {
3363 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3364 SBSDIO_FUNC1_CHIPCLKCSR,
3365 (saveclk | SBSDIO_FORCE_HT), &err);
3366 }
3367 if (err)
3368 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3369
3370 /* Turn off the bus (F2), free any pending packets */
3371 brcmf_dbg(INTR, "disable SDIO interrupts\n");
3372 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3373 SDIO_FUNC_ENABLE_1, NULL);
3374
3375 /* Clear any pending interrupts now that F2 is disabled */
3376 w_sdreg32(bus, local_hostintmask,
3377 offsetof(struct sdpcmd_regs, intstatus), &retries);
3378
3379 /* Turn off the backplane clock (only) */
3380 brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3381
3382 /* Clear the data packet queues */
3383 brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
3384
3385 /* Clear any held glomming stuff */
3386 if (bus->glomd)
3387 brcmu_pkt_buf_free_skb(bus->glomd);
3388 brcmf_sdbrcm_free_glom(bus);
3389
3390 /* Clear rx control and wake any waiters */
3391 bus->rxlen = 0;
3392 brcmf_sdbrcm_dcmd_resp_wake(bus);
3393
3394 /* Reset some F2 state stuff */
3395 bus->rxskip = false;
3396 bus->tx_seq = bus->rx_seq = 0;
3397
3398 up(&bus->sdsem);
3399 }
3400
3401 int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr)
3402 {
3403 struct brcmf_bus *bus = drvr->bus;
3404 unsigned long timeout;
3405 uint retries = 0;
3406 u8 ready, enable;
3407 int err, ret = 0;
3408 u8 saveclk;
3409
3410 brcmf_dbg(TRACE, "Enter\n");
3411
3412 /* try to download image and nvram to the dongle */
3413 if (drvr->busstate == BRCMF_BUS_DOWN) {
3414 if (!(brcmf_sdbrcm_download_firmware(bus)))
3415 return -1;
3416 }
3417
3418 if (!bus->drvr)
3419 return 0;
3420
3421 /* Start the watchdog timer */
3422 bus->drvr->tickcnt = 0;
3423 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3424
3425 down(&bus->sdsem);
3426
3427 /* Make sure backplane clock is on, needed to generate F2 interrupt */
3428 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3429 if (bus->clkstate != CLK_AVAIL)
3430 goto exit;
3431
3432 /* Force clocks on backplane to be sure F2 interrupt propagates */
3433 saveclk =
3434 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3435 SBSDIO_FUNC1_CHIPCLKCSR, &err);
3436 if (!err) {
3437 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3438 SBSDIO_FUNC1_CHIPCLKCSR,
3439 (saveclk | SBSDIO_FORCE_HT), &err);
3440 }
3441 if (err) {
3442 brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
3443 goto exit;
3444 }
3445
3446 /* Enable function 2 (frame transfers) */
3447 w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3448 offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
3449 enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3450
3451 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3452 enable, NULL);
3453
3454 timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3455 ready = 0;
3456 while (enable != ready) {
3457 ready = brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_0,
3458 SDIO_CCCR_IORx, NULL);
3459 if (time_after(jiffies, timeout))
3460 break;
3461 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3462 /* prevent busy waiting if it takes too long */
3463 msleep_interruptible(20);
3464 }
3465
3466 brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3467
3468 /* If F2 successfully enabled, set core and enable interrupts */
3469 if (ready == enable) {
3470 /* Set up the interrupt mask and enable interrupts */
3471 bus->hostintmask = HOSTINTMASK;
3472 w_sdreg32(bus, bus->hostintmask,
3473 offsetof(struct sdpcmd_regs, hostintmask), &retries);
3474
3475 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3476 SBSDIO_WATERMARK, 8, &err);
3477
3478 /* Set bus state according to enable result */
3479 drvr->busstate = BRCMF_BUS_DATA;
3480 }
3481
3482 else {
3483 /* Disable F2 again */
3484 enable = SDIO_FUNC_ENABLE_1;
3485 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0,
3486 SDIO_CCCR_IOEx, enable, NULL);
3487 }
3488
3489 /* Restore previous clock setting */
3490 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3491 SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3492
3493 /* If we didn't come up, turn off backplane clock */
3494 if (drvr->busstate != BRCMF_BUS_DATA)
3495 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3496
3497 exit:
3498 up(&bus->sdsem);
3499
3500 return ret;
3501 }
3502
3503 void brcmf_sdbrcm_isr(void *arg)
3504 {
3505 struct brcmf_bus *bus = (struct brcmf_bus *) arg;
3506
3507 brcmf_dbg(TRACE, "Enter\n");
3508
3509 if (!bus) {
3510 brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
3511 return;
3512 }
3513
3514 if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
3515 brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
3516 return;
3517 }
3518 /* Count the interrupt call */
3519 bus->intrcount++;
3520 bus->ipend = true;
3521
3522 /* Shouldn't get this interrupt if we're sleeping? */
3523 if (bus->sleeping) {
3524 brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
3525 return;
3526 }
3527
3528 /* Disable additional interrupts (is this needed now)? */
3529 if (!bus->intr)
3530 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
3531
3532 bus->dpc_sched = true;
3533 if (bus->dpc_tsk)
3534 complete(&bus->dpc_wait);
3535 }
3536
3537 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
3538 {
3539 struct brcmf_bus *bus;
3540
3541 brcmf_dbg(TIMER, "Enter\n");
3542
3543 bus = drvr->bus;
3544
3545 /* Ignore the timer if simulating bus down */
3546 if (bus->sleeping)
3547 return false;
3548
3549 down(&bus->sdsem);
3550
3551 /* Poll period: check device if appropriate. */
3552 if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3553 u32 intstatus = 0;
3554
3555 /* Reset poll tick */
3556 bus->polltick = 0;
3557
3558 /* Check device if no interrupts */
3559 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
3560
3561 if (!bus->dpc_sched) {
3562 u8 devpend;
3563 devpend = brcmf_sdcard_cfg_read(bus->sdiodev,
3564 SDIO_FUNC_0, SDIO_CCCR_INTx,
3565 NULL);
3566 intstatus =
3567 devpend & (INTR_STATUS_FUNC1 |
3568 INTR_STATUS_FUNC2);
3569 }
3570
3571 /* If there is something, make like the ISR and
3572 schedule the DPC */
3573 if (intstatus) {
3574 bus->pollcnt++;
3575 bus->ipend = true;
3576
3577 bus->dpc_sched = true;
3578 if (bus->dpc_tsk)
3579 complete(&bus->dpc_wait);
3580 }
3581 }
3582
3583 /* Update interrupt tracking */
3584 bus->lastintrs = bus->intrcount;
3585 }
3586 #ifdef BCMDBG
3587 /* Poll for console output periodically */
3588 if (drvr->busstate == BRCMF_BUS_DATA && bus->console_interval != 0) {
3589 bus->console.count += BRCMF_WD_POLL_MS;
3590 if (bus->console.count >= bus->console_interval) {
3591 bus->console.count -= bus->console_interval;
3592 /* Make sure backplane clock is on */
3593 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3594 if (brcmf_sdbrcm_readconsole(bus) < 0)
3595 /* stop on error */
3596 bus->console_interval = 0;
3597 }
3598 }
3599 #endif /* BCMDBG */
3600
3601 /* On idle timeout clear activity flag and/or turn off clock */
3602 if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3603 if (++bus->idlecount >= bus->idletime) {
3604 bus->idlecount = 0;
3605 if (bus->activity) {
3606 bus->activity = false;
3607 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3608 } else {
3609 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3610 }
3611 }
3612 }
3613
3614 up(&bus->sdsem);
3615
3616 return bus->ipend;
3617 }
3618
3619 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3620 {
3621 if (chipid == BCM4329_CHIP_ID)
3622 return true;
3623 return false;
3624 }
3625
3626 static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
3627 {
3628 brcmf_dbg(TRACE, "Enter\n");
3629
3630 kfree(bus->rxbuf);
3631 bus->rxctl = bus->rxbuf = NULL;
3632 bus->rxlen = 0;
3633
3634 kfree(bus->databuf);
3635 bus->databuf = NULL;
3636 }
3637
3638 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus)
3639 {
3640 brcmf_dbg(TRACE, "Enter\n");
3641
3642 if (bus->drvr->maxctl) {
3643 bus->rxblen =
3644 roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
3645 ALIGNMENT) + BRCMF_SDALIGN;
3646 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3647 if (!(bus->rxbuf))
3648 goto fail;
3649 }
3650
3651 /* Allocate buffer to receive glomed packet */
3652 bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
3653 if (!(bus->databuf)) {
3654 /* release rxbuf which was already located as above */
3655 if (!bus->rxblen)
3656 kfree(bus->rxbuf);
3657 goto fail;
3658 }
3659
3660 /* Align the buffer */
3661 if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
3662 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
3663 ((unsigned long)bus->databuf % BRCMF_SDALIGN));
3664 else
3665 bus->dataptr = bus->databuf;
3666
3667 return true;
3668
3669 fail:
3670 return false;
3671 }
3672
3673 static bool
3674 brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, u32 regsva)
3675 {
3676 u8 clkctl = 0;
3677 int err = 0;
3678 int reg_addr;
3679 u32 reg_val;
3680 u8 idx;
3681
3682 bus->alp_only = true;
3683
3684 /* Return the window to backplane enumeration space for core access */
3685 if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, SI_ENUM_BASE))
3686 brcmf_dbg(ERROR, "FAILED to return to SI_ENUM_BASE\n");
3687
3688 #ifdef BCMDBG
3689 printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
3690 brcmf_sdcard_reg_read(bus->sdiodev, SI_ENUM_BASE, 4));
3691
3692 #endif /* BCMDBG */
3693
3694 /*
3695 * Force PLL off until brcmf_sdio_chip_attach()
3696 * programs PLL control regs
3697 */
3698
3699 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3700 SBSDIO_FUNC1_CHIPCLKCSR,
3701 BRCMF_INIT_CLKCTL1, &err);
3702 if (!err)
3703 clkctl =
3704 brcmf_sdcard_cfg_read(bus->sdiodev, SDIO_FUNC_1,
3705 SBSDIO_FUNC1_CHIPCLKCSR, &err);
3706
3707 if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3708 brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3709 err, BRCMF_INIT_CLKCTL1, clkctl);
3710 goto fail;
3711 }
3712
3713 if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3714 brcmf_dbg(ERROR, "brcmf_sdio_chip_attach failed!\n");
3715 goto fail;
3716 }
3717
3718 if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
3719 brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
3720 goto fail;
3721 }
3722
3723 brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
3724 SDIO_DRIVE_STRENGTH);
3725
3726 /* Get info on the SOCRAM cores... */
3727 bus->ramsize = bus->ci->ramsize;
3728 if (!(bus->ramsize)) {
3729 brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
3730 goto fail;
3731 }
3732
3733 /* Set core control so an SDIO reset does a backplane reset */
3734 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3735 reg_addr = bus->ci->c_inf[idx].base +
3736 offsetof(struct sdpcmd_regs, corecontrol);
3737 reg_val = brcmf_sdcard_reg_read(bus->sdiodev, reg_addr, sizeof(u32));
3738 brcmf_sdcard_reg_write(bus->sdiodev, reg_addr, sizeof(u32),
3739 reg_val | CC_BPRESEN);
3740
3741 brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3742
3743 /* Locate an appropriately-aligned portion of hdrbuf */
3744 bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3745 BRCMF_SDALIGN);
3746
3747 /* Set the poll and/or interrupt flags */
3748 bus->intr = true;
3749 bus->poll = false;
3750 if (bus->poll)
3751 bus->pollrate = 1;
3752
3753 return true;
3754
3755 fail:
3756 return false;
3757 }
3758
3759 static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus)
3760 {
3761 brcmf_dbg(TRACE, "Enter\n");
3762
3763 /* Disable F2 to clear any intermediate frame state on the dongle */
3764 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_0, SDIO_CCCR_IOEx,
3765 SDIO_FUNC_ENABLE_1, NULL);
3766
3767 bus->drvr->busstate = BRCMF_BUS_DOWN;
3768 bus->sleeping = false;
3769 bus->rxflow = false;
3770
3771 /* Done with backplane-dependent accesses, can drop clock... */
3772 brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
3773 SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3774
3775 /* ...and initialize clock/power states */
3776 bus->clkstate = CLK_SDONLY;
3777 bus->idletime = BRCMF_IDLE_INTERVAL;
3778 bus->idleclock = BRCMF_IDLE_ACTIVE;
3779
3780 /* Query the F2 block size, set roundup accordingly */
3781 bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3782 bus->roundup = min(max_roundup, bus->blocksize);
3783
3784 /* bus module does not support packet chaining */
3785 bus->use_rxchain = false;
3786 bus->sd_rxchain = false;
3787
3788 return true;
3789 }
3790
3791 static int
3792 brcmf_sdbrcm_watchdog_thread(void *data)
3793 {
3794 struct brcmf_bus *bus = (struct brcmf_bus *)data;
3795
3796 allow_signal(SIGTERM);
3797 /* Run until signal received */
3798 while (1) {
3799 if (kthread_should_stop())
3800 break;
3801 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3802 brcmf_sdbrcm_bus_watchdog(bus->drvr);
3803 /* Count the tick for reference */
3804 bus->drvr->tickcnt++;
3805 } else
3806 break;
3807 }
3808 return 0;
3809 }
3810
3811 static void
3812 brcmf_sdbrcm_watchdog(unsigned long data)
3813 {
3814 struct brcmf_bus *bus = (struct brcmf_bus *)data;
3815
3816 if (bus->watchdog_tsk) {
3817 complete(&bus->watchdog_wait);
3818 /* Reschedule the watchdog */
3819 if (bus->wd_timer_valid)
3820 mod_timer(&bus->timer,
3821 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3822 }
3823 }
3824
3825 static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
3826 {
3827 brcmf_dbg(TRACE, "Enter\n");
3828
3829 if (bus->ci) {
3830 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3831 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3832 brcmf_sdio_chip_detach(&bus->ci);
3833 if (bus->vars && bus->varsz)
3834 kfree(bus->vars);
3835 bus->vars = NULL;
3836 }
3837
3838 brcmf_dbg(TRACE, "Disconnected\n");
3839 }
3840
3841 /* Detach and free everything */
3842 static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
3843 {
3844 brcmf_dbg(TRACE, "Enter\n");
3845
3846 if (bus) {
3847 /* De-register interrupt handler */
3848 brcmf_sdcard_intr_dereg(bus->sdiodev);
3849
3850 if (bus->drvr) {
3851 brcmf_detach(bus->drvr);
3852 brcmf_sdbrcm_release_dongle(bus);
3853 bus->drvr = NULL;
3854 }
3855
3856 brcmf_sdbrcm_release_malloc(bus);
3857
3858 kfree(bus);
3859 }
3860
3861 brcmf_dbg(TRACE, "Disconnected\n");
3862 }
3863
3864 void *brcmf_sdbrcm_probe(u16 bus_no, u16 slot, u16 func, uint bustype,
3865 u32 regsva, struct brcmf_sdio_dev *sdiodev)
3866 {
3867 int ret;
3868 struct brcmf_bus *bus;
3869
3870 /* Init global variables at run-time, not as part of the declaration.
3871 * This is required to support init/de-init of the driver.
3872 * Initialization
3873 * of globals as part of the declaration results in non-deterministic
3874 * behavior since the value of the globals may be different on the
3875 * first time that the driver is initialized vs subsequent
3876 * initializations.
3877 */
3878 brcmf_c_init();
3879
3880 brcmf_dbg(TRACE, "Enter\n");
3881
3882 /* We make an assumption about address window mappings:
3883 * regsva == SI_ENUM_BASE*/
3884
3885 /* Allocate private bus interface state */
3886 bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
3887 if (!bus)
3888 goto fail;
3889
3890 bus->sdiodev = sdiodev;
3891 sdiodev->bus = bus;
3892 skb_queue_head_init(&bus->glom);
3893 bus->txbound = BRCMF_TXBOUND;
3894 bus->rxbound = BRCMF_RXBOUND;
3895 bus->txminmax = BRCMF_TXMINMAX;
3896 bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
3897 bus->usebufpool = false; /* Use bufpool if allocated,
3898 else use locally malloced rxbuf */
3899
3900 /* attempt to attach to the dongle */
3901 if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3902 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
3903 goto fail;
3904 }
3905
3906 spin_lock_init(&bus->txqlock);
3907 init_waitqueue_head(&bus->ctrl_wait);
3908 init_waitqueue_head(&bus->dcmd_resp_wait);
3909
3910 /* Set up the watchdog timer */
3911 init_timer(&bus->timer);
3912 bus->timer.data = (unsigned long)bus;
3913 bus->timer.function = brcmf_sdbrcm_watchdog;
3914
3915 /* Initialize thread based operation and lock */
3916 sema_init(&bus->sdsem, 1);
3917
3918 /* Initialize watchdog thread */
3919 init_completion(&bus->watchdog_wait);
3920 bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3921 bus, "brcmf_watchdog");
3922 if (IS_ERR(bus->watchdog_tsk)) {
3923 printk(KERN_WARNING
3924 "brcmf_watchdog thread failed to start\n");
3925 bus->watchdog_tsk = NULL;
3926 }
3927 /* Initialize DPC thread */
3928 init_completion(&bus->dpc_wait);
3929 bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
3930 bus, "brcmf_dpc");
3931 if (IS_ERR(bus->dpc_tsk)) {
3932 printk(KERN_WARNING
3933 "brcmf_dpc thread failed to start\n");
3934 bus->dpc_tsk = NULL;
3935 }
3936
3937 /* Attach to the brcmf/OS/network interface */
3938 bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
3939 if (!bus->drvr) {
3940 brcmf_dbg(ERROR, "brcmf_attach failed\n");
3941 goto fail;
3942 }
3943
3944 /* Allocate buffers */
3945 if (!(brcmf_sdbrcm_probe_malloc(bus))) {
3946 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
3947 goto fail;
3948 }
3949
3950 if (!(brcmf_sdbrcm_probe_init(bus))) {
3951 brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
3952 goto fail;
3953 }
3954
3955 /* Register interrupt callback, but mask it (not operational yet). */
3956 brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
3957 ret = brcmf_sdcard_intr_reg(bus->sdiodev);
3958 if (ret != 0) {
3959 brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
3960 goto fail;
3961 }
3962 brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
3963
3964 brcmf_dbg(INFO, "completed!!\n");
3965
3966 /* if firmware path present try to download and bring up bus */
3967 ret = brcmf_bus_start(bus->drvr);
3968 if (ret != 0) {
3969 if (ret == -ENOLINK) {
3970 brcmf_dbg(ERROR, "dongle is not responding\n");
3971 goto fail;
3972 }
3973 }
3974
3975 /* add interface and open for business */
3976 if (brcmf_add_if((struct brcmf_info *)bus->drvr, 0, "wlan%d", NULL)) {
3977 brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
3978 goto fail;
3979 }
3980
3981 return bus;
3982
3983 fail:
3984 brcmf_sdbrcm_release(bus);
3985 return NULL;
3986 }
3987
3988 void brcmf_sdbrcm_disconnect(void *ptr)
3989 {
3990 struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
3991
3992 brcmf_dbg(TRACE, "Enter\n");
3993
3994 if (bus)
3995 brcmf_sdbrcm_release(bus);
3996
3997 brcmf_dbg(TRACE, "Disconnected\n");
3998 }
3999
4000 struct device *brcmf_bus_get_device(struct brcmf_bus *bus)
4001 {
4002 return &bus->sdiodev->func[2]->dev;
4003 }
4004
4005 void
4006 brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
4007 {
4008 /* Totally stop the timer */
4009 if (!wdtick && bus->wd_timer_valid == true) {
4010 del_timer_sync(&bus->timer);
4011 bus->wd_timer_valid = false;
4012 bus->save_ms = wdtick;
4013 return;
4014 }
4015
4016 /* don't start the wd until fw is loaded */
4017 if (bus->drvr->busstate == BRCMF_BUS_DOWN)
4018 return;
4019
4020 if (wdtick) {
4021 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4022 if (bus->wd_timer_valid == true)
4023 /* Stop timer and restart at new value */
4024 del_timer_sync(&bus->timer);
4025
4026 /* Create timer again when watchdog period is
4027 dynamically changed or in the first instance
4028 */
4029 bus->timer.expires =
4030 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4031 add_timer(&bus->timer);
4032
4033 } else {
4034 /* Re arm the timer, at last watchdog period */
4035 mod_timer(&bus->timer,
4036 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4037 }
4038
4039 bus->wd_timer_valid = true;
4040 bus->save_ms = wdtick;
4041 }
4042 }
Linus' kernel tree