Google Git
Sign in
fuchsia / fuchsia / 7965656349ec8e3e6aa26c7314b774d9ac27d380 / . / src / connectivity / wlan / drivers / third_party / broadcom / brcmfmac / sdio / sdio.cc
blob: ff1284676a1374200dd23c0dd1df92be192a2f5b [file] [log] [blame]
/*
* Copyright (c) 2010 Broadcom Corporation
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "sdio.h"
#include <lib/ddk/device.h>
#include <lib/ddk/metadata.h>
#include <lib/ddk/trace/event.h>
#include <lib/sync/completion.h>
#include <lib/zircon-internal/align.h>
#include <lib/zircon-internal/thread_annotations.h>
#include <zircon/errors.h>
#include <zircon/status.h>
#include <algorithm>
#include <atomic>
#include <limits>
#include <wifi/wifi-config.h>
#ifndef _ALL_SOURCE
#define _ALL_SOURCE
#endif
#include <threads.h>
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/bcdc.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/brcm_hw_ids.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/brcmu_utils.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/brcmu_wifi.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/chip.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/chipset/firmware.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/common.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/core.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/debug.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/defs.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/device.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/inspect/device_inspect.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/linuxisms.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/netbuf.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/soc.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/timer.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/workqueue.h"
#define DCMD_RESP_TIMEOUT_MSEC (2500)
#if !defined(NDEBUG)
#define BRCMF_TRAP_INFO_SIZE 80
#define CBUF_LEN (128)
/* Device console log buffer state */
#define CONSOLE_BUFFER_MAX 2024
struct rte_console {
/* Virtual UART
* When there is no UART (e.g. Quickturn),
* the host should write a complete
* input line directly into cbuf and then write
* the length into vcons_in.
* This may also be used when there is a real UART
* (at risk of conflicting with
* the real UART). vcons_out is currently unused.
*/
uint vcons_in;
uint vcons_out;
/* Output (logging) buffer
* Console output is written to a ring buffer log_buf at index log_idx.
* The host may read the output when it sees log_idx advance.
* Output will be lost if the output wraps around faster than the host
* polls.
*/
struct rte_log_le log_le;
/* Console input line buffer
* Characters are read one at a time into cbuf
* until <CR> is received, then
* the buffer is processed as a command line.
* Also used for virtual UART.
*/
uint cbuf_idx;
char cbuf[CBUF_LEN];
};
#endif /* !defined(NDEBUG) */
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/bus.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/chipcommon.h"
#include "src/connectivity/wlan/drivers/third_party/broadcom/brcmfmac/debug.h"
#define TXQLEN 2048 /* bulk tx queue length */
#define TXHI (TXQLEN - 256) /* turn on flow control above TXHI */
#define TXLOW (TXHI - 256) /* turn off flow control below TXLOW */
#define PRIOMASK 7
#define TXRETRIES 2 /* # of retries for tx frames */
/* Default for max rx frames in
one scheduling */
#define BRCMF_RXBOUND 50
/* Default for max tx frames in
one scheduling */
#define BRCMF_TXBOUND 20
#define BRCMF_TXMINMAX 1 /* Max tx frames if rx still pending */
/* Block size used for downloading
of dongle image */
#define MEMBLOCK 2048
/* Must be large enough to hold
biggest possible glom */
#define MAX_DATA_BUF (32 * 1024)
#define BRCMF_FIRSTREAD (1 << 6)
#define BRCMF_CONSOLE_INTERVAL 100 /* watchdog interval to poll console */
/* SBSDIO_DEVICE_CTL */
// clang-format off
/* 1: device will assert busy signal when receiving CMD53 */
#define SBSDIO_DEVCTL_SETBUSY 0x01
/* 1: assertion of sdio interrupt is synchronous to the sdio clock */
#define SBSDIO_DEVCTL_SPI_INTR_SYNC 0x02
/* 1: mask all interrupts to host except the chipActive (rev 8) */
#define SBSDIO_DEVCTL_CA_INT_ONLY 0x04
/* 1: isolate internal sdio signals, put external pads in tri-state; requires
* sdio bus power cycle to clear (rev 9) */
#define SBSDIO_DEVCTL_PADS_ISO 0x08
/* Force SD->SB reset mapping (rev 11) */
#define SBSDIO_DEVCTL_SB_RST_CTL 0x30
/* Determined by CoreControl bit */
#define SBSDIO_DEVCTL_RST_CORECTL 0x00
/* Force backplane reset */
#define SBSDIO_DEVCTL_RST_BPRESET 0x10
/* Force no backplane reset */
#define SBSDIO_DEVCTL_RST_NOBPRESET 0x20
/* direct(mapped) cis space */
/* MAPPED common CIS address */
#define SBSDIO_CIS_BASE_COMMON 0x1000
/* maximum bytes in one CIS */
#define SBSDIO_CIS_SIZE_LIMIT 0x200
/* cis offset addr is < 17 bits */
#define SBSDIO_CIS_OFT_ADDR_MASK 0x1FFFF
/* manfid tuple length, include tuple, link bytes */
#define SBSDIO_CIS_MANFID_TUPLE_LEN 6
#define SD_REG(field) (offsetof(struct sdpcmd_regs, field))
/* SDIO function 1 register CHIPCLKCSR */
/* Force ALP request to backplane */
#define SBSDIO_FORCE_ALP 0x01
/* Force HT request to backplane */
#define SBSDIO_FORCE_HT 0x02
/* Force ILP request to backplane */
#define SBSDIO_FORCE_ILP 0x04
/* Make ALP ready (power up xtal) */
#define SBSDIO_ALP_AVAIL_REQ 0x08
/* Make HT ready (power up PLL) */
#define SBSDIO_HT_AVAIL_REQ 0x10
/* Squelch clock requests from HW */
#define SBSDIO_FORCE_HW_CLKREQ_OFF 0x20
/* Status: ALP is ready */
#define SBSDIO_ALP_AVAIL 0x40
/* Status: HT is ready */
#define SBSDIO_HT_AVAIL 0x80
#define SBSDIO_CSR_MASK 0x1F
#define SBSDIO_AVBITS (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
#define SBSDIO_ALPAV(regval) ((regval)&SBSDIO_AVBITS)
#define SBSDIO_HTAV(regval) (((regval)&SBSDIO_AVBITS) == SBSDIO_AVBITS)
#define SBSDIO_ALPONLY(regval) (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
#define SBSDIO_CLKAV(regval, alponly) (SBSDIO_ALPAV(regval) && (alponly ? 1 : SBSDIO_HTAV(regval)))
/* intstatus */
#define I_SMB_SW0 (1 << 0) /* To SB Mail S/W interrupt 0 */
#define I_SMB_SW1 (1 << 1) /* To SB Mail S/W interrupt 1 */
#define I_SMB_SW2 (1 << 2) /* To SB Mail S/W interrupt 2 */
#define I_SMB_SW3 (1 << 3) /* To SB Mail S/W interrupt 3 */
#define I_SMB_SW_MASK 0x0000000f /* To SB Mail S/W interrupts mask */
#define I_SMB_SW_SHIFT 0 /* To SB Mail S/W interrupts shift */
#define I_HMB_SW0 (1 << 4) /* To Host Mail S/W interrupt 0 */
#define I_HMB_SW1 (1 << 5) /* To Host Mail S/W interrupt 1 */
#define I_HMB_SW2 (1 << 6) /* To Host Mail S/W interrupt 2 */
#define I_HMB_SW3 (1 << 7) /* To Host Mail S/W interrupt 3 */
#define I_HMB_SW_MASK 0x000000f0 /* To Host Mail S/W interrupts mask */
#define I_HMB_SW_SHIFT 4 /* To Host Mail S/W interrupts shift */
#define I_WR_OOSYNC (1 << 8) /* Write Frame Out Of Sync */
#define I_RD_OOSYNC (1 << 9) /* Read Frame Out Of Sync */
#define I_PC (1 << 10) /* descriptor error */
#define I_PD (1 << 11) /* data error */
#define I_DE (1 << 12) /* Descriptor protocol Error */
#define I_RU (1 << 13) /* Receive descriptor Underflow */
#define I_RO (1 << 14) /* Receive fifo Overflow */
#define I_XU (1 << 15) /* Transmit fifo Underflow */
#define I_RI (1 << 16) /* Receive Interrupt */
#define I_BUSPWR (1 << 17) /* SDIO Bus Power Change (rev 9) */
#define I_XMTDATA_AVAIL (1 << 23) /* bits in fifo */
#define I_XI (1 << 24) /* Transmit Interrupt */
#define I_RF_TERM (1 << 25) /* Read Frame Terminate */
#define I_WF_TERM (1 << 26) /* Write Frame Terminate */
#define I_PCMCIA_XU (1 << 27) /* PCMCIA Transmit FIFO Underflow */
#define I_SBINT (1 << 28) /* sbintstatus Interrupt */
#define I_CHIPACTIVE (1 << 29) /* chip from doze to active state */
#define I_SRESET (1 << 30) /* CCCR RES interrupt */
#define I_IOE2 (1U << 31) /* CCCR IOE2 Bit Changed */
#define I_ERRORS (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
#define I_DMA (I_RI | I_XI | I_ERRORS)
/* corecontrol */
#define CC_CISRDY (1 << 0) /* CIS Ready */
#define CC_BPRESEN (1 << 1) /* CCCR RES signal */
#define CC_F2RDY (1 << 2) /* set CCCR IOR2 bit */
#define CC_CLRPADSISO (1 << 3) /* clear SDIO pads isolation */
#define CC_XMTDATAAVAIL_MODE (1 << 4)
#define CC_XMTDATAAVAIL_CTRL (1 << 5)
/* SDA_FRAMECTRL */
#define SFC_RF_TERM (1 << 0) /* Read Frame Terminate */
#define SFC_WF_TERM (1 << 1) /* Write Frame Terminate */
#define SFC_CRC4WOOS (1 << 2) /* CRC error for write out of sync */
#define SFC_ABORTALL (1 << 3) /* Abort all in-progress frames */
/*
* Software allocation of To SB Mailbox resources
*/
/* tosbmailbox bits corresponding to intstatus bits */
#define SMB_NAK (1 << 0) /* Frame NAK */
#define SMB_INT_ACK (1 << 1) /* Host Interrupt ACK */
#define SMB_USE_OOB (1 << 2) /* Use OOB Wakeup */
#define SMB_DEV_INT (1 << 3) /* Miscellaneous Interrupt */
/* tosbmailboxdata */
#define SMB_DATA_VERSION_SHIFT 16 /* host protocol version */
/*
* Software allocation of To Host Mailbox resources
*/
/* intstatus bits */
#define I_HMB_FC_STATE I_HMB_SW0 /* Flow Control State */
#define I_HMB_FC_CHANGE I_HMB_SW1 /* Flow Control State Changed */
#define I_HMB_FRAME_IND I_HMB_SW2 /* Frame Indication */
#define I_HMB_HOST_INT I_HMB_SW3 /* Miscellaneous Interrupt */
/* tohostmailboxdata */
#define HMB_DATA_NAKHANDLED 0x0001 /* retransmit NAK'd frame */
#define HMB_DATA_DEVREADY 0x0002 /* talk to host after enable */
#define HMB_DATA_FC 0x0004 /* per prio flowcontrol update flag */
#define HMB_DATA_FWREADY 0x0008 /* fw ready for protocol activity */
#define HMB_DATA_FWHALT 0x0010 /* firmware halted */
#define HMB_DATA_FCDATA_MASK 0xff000000
#define HMB_DATA_FCDATA_SHIFT 24
#define HMB_DATA_VERSION_MASK 0x00ff0000
#define HMB_DATA_VERSION_SHIFT 16
/*
* Software-defined protocol header
*/
/* Current protocol version */
#define SDPCM_PROT_VERSION 4
/*
* Shared structure between dongle and the host.
* The structure contains pointers to trap or assert information.
*/
#define SDPCM_SHARED_VERSION 0x0003
#define SDPCM_SHARED_VERSION_MASK 0x00FF
#define SDPCM_SHARED_ASSERT_BUILT 0x0100
#define SDPCM_SHARED_ASSERT 0x0200
#define SDPCM_SHARED_TRAP 0x0400
/* Space for header read, limit for data packets */
#define MAX_HDR_READ (1 << 6)
#define MAX_RX_DATASZ 2048
// clang-format on
/* Bump up limit on waiting for HT to account for first startup;
* if the image is doing a CRC calculation before programming the PMU
* for HT availability, it could take a couple hundred ms more, so
* max out at a 1 second (1000000us).
*/
#undef PMU_MAX_TRANSITION_DLY_USEC
#define PMU_MAX_TRANSITION_DLY_USEC 1000000
/* Value for ChipClockCSR during initial setup */
#define BRCMF_INIT_CLKCTL1 (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
/* Flags for SDH calls */
#define F2SYNC (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
#define BRCMF_IDLE_ACTIVE 0 /* Do not request any SD clock change when idle */
#define BRCMF_IDLE_INTERVAL 1
#define KSO_WAIT_US 50
#define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY_USEC / KSO_WAIT_US)
#define BRCMF_SDIO_MAX_ACCESS_ERRORS 5
#define BC_CORE_POWER_CONTROL_RELOAD 0x2
#define BC_CORE_POWER_CONTROL_SHIFT 13
/*
* Conversion of 802.1D priority to precedence level
*/
static uint prio2prec(uint32_t prio) {
return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ? (prio ^ 2) : prio;
}
#if !defined(NDEBUG)
struct brcmf_trap_info {
uint32_t type;
uint32_t epc;
uint32_t cpsr;
uint32_t spsr;
uint32_t r0; /* a1 */
uint32_t r1; /* a2 */
uint32_t r2; /* a3 */
uint32_t r3; /* a4 */
uint32_t r4; /* v1 */
uint32_t r5; /* v2 */
uint32_t r6; /* v3 */
uint32_t r7; /* v4 */
uint32_t r8; /* v5 */
uint32_t r9; /* sb/v6 */
uint32_t r10; /* sl/v7 */
uint32_t r11; /* fp/v8 */
uint32_t r12; /* ip */
uint32_t r13; /* sp */
uint32_t r14; /* lr */
uint32_t pc; /* r15 */
};
#endif /* !defined(NDEBUG) */
struct sdpcm_shared {
uint32_t flags;
uint32_t trap_addr;
uint32_t assert_exp_addr;
uint32_t assert_file_addr;
uint32_t assert_line;
#if !defined(NDEBUG)
uint32_t console_addr; /* Address of struct rte_console */
#endif // !defined(NDEBUG)
uint32_t msgtrace_addr;
uint8_t tag[32];
uint32_t brpt_addr;
};
struct sdpcm_shared_le {
uint32_t flags;
uint32_t trap_addr;
uint32_t assert_exp_addr;
uint32_t assert_file_addr;
uint32_t assert_line;
#if !defined(NDEBUG)
uint32_t console_addr; /* Address of struct rte_console */
#endif // !defined(NDEBUG)
uint32_t msgtrace_addr;
uint8_t tag[32];
uint32_t brpt_addr;
};
/* clkstate */
#define CLK_NONE 0
#define CLK_SDONLY 1
#define CLK_PENDING 2
#define CLK_AVAIL 3
#if !defined(NDEBUG)
static int qcount[NUMPRIO];
#endif /* !defined(NDEBUG) */
#define DEFAULT_SDIO_DRIVE_STRENGTH 6 /* in milliamps */
#define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
/* Limit on rounding up frames */
static const uint16_t max_roundup = 512;
enum brcmf_sdio_frmtype {
BRCMF_SDIO_FT_NORMAL,
BRCMF_SDIO_FT_SUPER,
BRCMF_SDIO_FT_SUB,
};
#define SDIOD_DRVSTR_KEY(chip, pmu) ((((uint32_t)chip) << 16) | (pmu))
/* SDIO Pad drive strength to select value mappings */
struct sdiod_drive_str {
uint8_t strength; /* Pad Drive Strength in mA */
uint8_t sel; /* Chip-specific select value */
};
/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8V) */
static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
{32, 0x6}, {26, 0x7}, {22, 0x4}, {16, 0x5}, {12, 0x2}, {8, 0x3}, {4, 0x0}, {0, 0x1}};
/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
static const struct sdiod_drive_str sdiod_drive_strength_tab5_1v8[] = {
{6, 0x7}, {5, 0x6}, {4, 0x5}, {3, 0x4}, {2, 0x2}, {1, 0x1}, {0, 0x0}};
/* SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
static const struct sdiod_drive_str sdiod_drvstr_tab6_1v8[] = {
{3, 0x3}, {2, 0x2}, {1, 0x1}, {0, 0x0}};
/* SDIO Drive Strength to sel value table for 43143 PMU Rev 17 (3.3V) */
static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
{16, 0x7}, {12, 0x5}, {8, 0x3}, {4, 0x1}};
void pkt_align(struct brcmf_netbuf* p, int len, int align) {
const auto datalign_unsized = reinterpret_cast<uint64_t>(p->data);
ZX_DEBUG_ASSERT(roundup(datalign_unsized, align) - datalign_unsized <=
std::numeric_limits<uint32_t>::max());
const auto datalign = static_cast<uint32_t>(roundup(datalign_unsized, align) - datalign_unsized);
if (datalign) {
brcmf_netbuf_shrink_head(p, datalign);
}
brcmf_netbuf_set_length_to(p, ZX_ROUNDUP(len, SDIOD_SIZE_ALIGNMENT));
}
/* To check if there's window offered */
static bool data_ok(struct brcmf_sdio* bus) {
return (uint8_t)(bus->tx_max - bus->tx_seq) != 0 &&
((uint8_t)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
}
/*
* Read bus->ctrl_frame_stat, and if it's value is true, acquire the lock for bus->sdiodev->func1,
* call fn(), set bus->ctrl_frame_stat to false, and release the lock.
*/
void brcmf_sdio_if_ctrl_frame_stat_set(struct brcmf_sdio* bus, std::function<void()> fn) {
if (bus->ctrl_frame_stat.load()) {
sdio_claim_host(bus->sdiodev->func1);
if (bus->ctrl_frame_stat.load()) {
fn();
bus->ctrl_frame_stat.store(false);
}
sdio_release_host(bus->sdiodev->func1);
}
}
/*
* Read bus->ctrl_frame_stat, and if it's value is false, acquire the lock for bus->sdiodev->func1,
* call fn(), and release the lock.
*/
void brcmf_sdio_if_ctrl_frame_stat_clear(struct brcmf_sdio* bus, std::function<void()> fn) {
if (!bus->ctrl_frame_stat.load()) {
sdio_claim_host(bus->sdiodev->func1);
if (!bus->ctrl_frame_stat.load()) {
fn();
}
sdio_release_host(bus->sdiodev->func1);
}
}
static zx_status_t brcmf_sdio_kso_control(struct brcmf_sdio* bus, bool on) {
uint8_t wr_val = 0;
uint8_t rd_val, cmp_val, bmask;
zx_status_t err = ZX_OK;
int err_cnt = 0;
int try_cnt = 0;
BRCMF_DBG(TRACE, "Enter: on=%d", on);
wr_val = static_cast<uint8_t>(static_cast<uint8_t>(on) << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
/* 1st KSO write goes to AOS wake up core if device is asleep */
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
if (on) {
/* device WAKEUP through KSO:
* write bit 0 & read back until
* both bits 0 (kso bit) & 1 (dev on status) are set
*/
cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK | SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
bmask = cmp_val;
zx_nanosleep(zx_deadline_after(ZX_USEC(2000)));
} else {
/* Put device to sleep, turn off KSO */
cmp_val = 0;
/* only check for bit0, bit1(dev on status) may not
* get cleared right away
*/
bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
}
do {
/* reliable KSO bit set/clr:
* the sdiod sleep write access is synced to PMU 32khz clk
* just one write attempt may fail,
* read it back until it matches written value
*/
rd_val = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
if (err == ZX_OK) {
if ((rd_val & bmask) == cmp_val) {
break;
}
err_cnt = 0;
}
/* bail out upon subsequent access errors */
if (err != ZX_OK && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS)) {
break;
}
zx_nanosleep(zx_deadline_after(ZX_USEC(KSO_WAIT_US)));
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
} while (try_cnt++ < MAX_KSO_ATTEMPTS);
if (try_cnt > 2) {
BRCMF_DBG(SDIO, "try_cnt=%d rd_val=0x%x err=%d", try_cnt, rd_val, err);
}
if (try_cnt > MAX_KSO_ATTEMPTS) {
BRCMF_ERR("max tries: rd_val=0x%x err=%d", rd_val, err);
}
return err;
}
#define HOSTINTMASK (I_HMB_SW_MASK | I_CHIPACTIVE)
/* Turn backplane clock on or off */
static zx_status_t brcmf_sdio_htclk(struct brcmf_sdio* bus, bool on, bool pendok) {
zx_status_t err;
uint8_t clkctl, clkreq, devctl;
zx_time_t timeout;
BRCMF_DBG(SDIO, "Enter");
clkctl = 0;
if (bus->sr_enabled) {
bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
return ZX_OK;
}
if (on) {
/* Request HT Avail */
clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
if (err != ZX_OK) {
BRCMF_ERR("HT Avail request error: %d", err);
return ZX_ERR_IO_REFUSED;
}
/* Check current status */
clkctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
if (err != ZX_OK) {
BRCMF_ERR("HT Avail read error: %d", err);
return ZX_ERR_IO_REFUSED;
}
/* Go to pending and await interrupt if appropriate */
if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
/* Allow only clock-available interrupt */
devctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_DEVICE_CTL, &err);
if (err != ZX_OK) {
BRCMF_ERR("Devctl error setting CA: %d", err);
return ZX_ERR_IO_REFUSED;
}
devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_DEVICE_CTL, devctl, &err);
BRCMF_DBG(SDIO, "CLKCTL: set PENDING");
bus->clkstate = CLK_PENDING;
return ZX_OK;
} else if (bus->clkstate == CLK_PENDING) {
/* Cancel CA-only interrupt filter */
devctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_DEVICE_CTL, &err);
devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_DEVICE_CTL, devctl, &err);
}
/* Otherwise, wait here (polling) for HT Avail */
timeout = zx_clock_get_monotonic() + ZX_USEC(PMU_MAX_TRANSITION_DLY_USEC);
while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
clkctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
if (zx_clock_get_monotonic() > timeout) {
break;
} else {
zx_nanosleep(zx_deadline_after(ZX_USEC(5000)));
}
}
if (err != ZX_OK) {
BRCMF_ERR("HT Avail request error: %d", err);
return ZX_ERR_IO_REFUSED;
}
if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
BRCMF_ERR("HT Avail timeout (%d): clkctl 0x%02x", PMU_MAX_TRANSITION_DLY_USEC, clkctl);
return ZX_ERR_SHOULD_WAIT;
}
/* Mark clock available */
bus->clkstate = CLK_AVAIL;
BRCMF_DBG(SDIO, "CLKCTL: turned ON");
#if !defined(NDEBUG)
if (!bus->alp_only) {
if (SBSDIO_ALPONLY(clkctl)) {
BRCMF_ERR("HT Clock should be on");
}
}
#endif /* !defined(NDEBUG) */
} else {
clkreq = 0;
if (bus->clkstate == CLK_PENDING) {
/* Cancel CA-only interrupt filter */
devctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_DEVICE_CTL, &err);
devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_DEVICE_CTL, devctl, &err);
}
bus->clkstate = CLK_SDONLY;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
BRCMF_DBG(SDIO, "CLKCTL: turned OFF");
if (err != ZX_OK) {
BRCMF_ERR("Failed access turning clock off: %d", err);
return ZX_ERR_IO_REFUSED;
}
}
return ZX_OK;
}
/* Change idle/active SD state */
static zx_status_t brcmf_sdio_sdclk(struct brcmf_sdio* bus, bool on) {
BRCMF_DBG(SDIO, "Enter");
if (on) {
bus->clkstate = CLK_SDONLY;
} else {
bus->clkstate = CLK_NONE;
}
return ZX_OK;
}
/* Transition SD and backplane clock readiness */
static zx_status_t brcmf_sdio_clkctl(struct brcmf_sdio* bus, uint target, bool pendok) {
uint oldstate = bus->clkstate;
BRCMF_DBG(SDIO, "Enter");
/* Early exit if we're already there */
if (bus->clkstate == target) {
return ZX_OK;
}
if (bus->ci->chip == BRCM_CC_4359_CHIP_ID && target == CLK_NONE) {
BRCMF_DBG(TEMP, "Returning because chip is 4359");
return ZX_OK;
}
switch (target) {
case CLK_AVAIL:
/* Make sure SD clock is available */
if (bus->clkstate == CLK_NONE) {
brcmf_sdio_sdclk(bus, true);
}
/* Now request HT Avail on the backplane */
brcmf_sdio_htclk(bus, true, pendok);
break;
case CLK_SDONLY:
/* Remove HT request, or bring up SD clock */
if (bus->clkstate == CLK_NONE) {
brcmf_sdio_sdclk(bus, true);
} else if (bus->clkstate == CLK_AVAIL) {
brcmf_sdio_htclk(bus, false, false);
} else {
BRCMF_ERR("request for %d -> %d", bus->clkstate, target);
}
break;
case CLK_NONE:
/* Make sure to remove HT request */
if (bus->clkstate == CLK_AVAIL) {
brcmf_sdio_htclk(bus, false, false);
}
/* Now remove the SD clock */
brcmf_sdio_sdclk(bus, false);
break;
}
BRCMF_DBG(SDIO, "%d -> %d", oldstate, bus->clkstate);
return ZX_OK;
}
static zx_status_t brcmf_sdio_bus_sleep(struct brcmf_sdio* bus, bool sleep, bool pendok) {
zx_status_t err = ZX_OK;
uint8_t clkcsr;
BRCMF_DBG(SDIO, "Enter: request %s currently %s", (sleep ? "SLEEP" : "WAKE"),
(bus->sleeping ? "SLEEP" : "WAKE"));
/* If SR is enabled control bus state with KSO */
if (bus->sr_enabled) {
/* Done if we're already in the requested state */
if (sleep == bus->sleeping) {
goto end;
}
/* Going to sleep */
if (sleep) {
clkcsr = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
BRCMF_DBG(SDIO, "no clock, set ALP");
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, SBSDIO_ALP_AVAIL_REQ, &err);
}
err = brcmf_sdio_kso_control(bus, false);
} else {
err = brcmf_sdio_kso_control(bus, true);
}
if (err != ZX_OK) {
BRCMF_ERR("error while changing bus sleep state %d", err);
goto done;
}
}
end:
/* control clocks */
if (sleep) {
if (!bus->sr_enabled) {
brcmf_sdio_clkctl(bus, CLK_NONE, pendok);
}
} else {
brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
brcmf_sdio_wd_timer(bus, true);
}
bus->sleeping = sleep;
BRCMF_DBG(SDIO, "new state %s", (sleep ? "SLEEP" : "WAKE"));
done:
BRCMF_DBG(SDIO, "Exit: err=%d", err);
return err;
}
static inline bool brcmf_sdio_valid_shared_address(uint32_t addr) {
return !(addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff));
}
static zx_status_t __brcmf_sdio_sharedrw(struct brcmf_sdio* bus, struct sdpcm_shared* sh,
bool write) {
uint32_t addr = 0;
zx_status_t rv;
uint32_t shaddr = 0;
if (write) {
if (sh == nullptr) {
BRCMF_ERR("Input sdpcm pointer doesn't exist");
return ZX_ERR_INVALID_ARGS;
}
if ((sh->flags & SDPCM_SHARED_VERSION_MASK) > SDPCM_SHARED_VERSION) {
BRCMF_ERR("sdpcm shared version unsupported: dhd %d dongle %d", SDPCM_SHARED_VERSION,
sh->flags & SDPCM_SHARED_VERSION_MASK);
return ZX_ERR_WRONG_TYPE;
}
}
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_bus_sleep(bus, false, false);
/*
* Read last word in socram to determine
* address of sdpcm_shared structure
*/
shaddr = bus->ci->rambase + bus->ci->ramsize - 4;
if (!bus->ci->rambase && brcmf_chip_sr_capable(bus->ci)) {
shaddr -= bus->ci->srsize;
}
rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr, (uint8_t*)&addr, 4);
if (rv != ZX_OK) {
goto fail;
}
/*
* Check if addr is valid.
* NVRAM length at the end of memory should have been overwritten.
*/
if (!brcmf_sdio_valid_shared_address(addr)) {
BRCMF_ERR("invalid sdpcm_shared address 0x%08X", addr);
rv = ZX_ERR_INVALID_ARGS;
goto fail;
}
BRCMF_DBG(INFO, "sdpcm_shared address 0x%08X", addr);
/* Read or write hndrte_shared structure */
rv = brcmf_sdiod_ramrw(bus->sdiodev, write, addr, (uint8_t*)sh, sizeof(struct sdpcm_shared_le));
if (rv != ZX_OK) {
goto fail;
}
sdio_release_host(bus->sdiodev->func1);
if (!write && (sh->flags & SDPCM_SHARED_VERSION_MASK) > SDPCM_SHARED_VERSION) {
BRCMF_ERR("sdpcm shared version unsupported: dhd %d dongle %d", SDPCM_SHARED_VERSION,
sh->flags & SDPCM_SHARED_VERSION_MASK);
return ZX_ERR_WRONG_TYPE;
}
return ZX_OK;
fail:
BRCMF_ERR("unable to %s sdpcm_shared info: rv=%d (addr=0x%x)", write ? "write" : "read", rv,
addr);
sdio_release_host(bus->sdiodev->func1);
return rv;
}
static zx_status_t brcmf_sdio_shared_read(struct brcmf_sdio* bus, struct sdpcm_shared* sh) {
return __brcmf_sdio_sharedrw(bus, sh, false);
}
static zx_status_t brcmf_sdio_shared_write(struct brcmf_sdio* bus, struct sdpcm_shared* sh) {
return __brcmf_sdio_sharedrw(bus, sh, true);
}
#if !defined(NDEBUG)
static void brcmf_sdio_get_console_addr(struct brcmf_sdio* bus) {
struct sdpcm_shared sh;
if (brcmf_sdio_shared_read(bus, &sh) == ZX_OK) {
bus->console_addr = sh.console_addr;
}
}
#else /* !defined(NDEBUG) */
static void brcmf_sdio_get_console_addr(struct brcmf_sdio* bus) {}
#endif /* !defined(NDEBUG) */
static uint32_t brcmf_sdio_hostmail(struct brcmf_sdio* bus) {
struct brcmf_sdio_dev* sdiod = bus->sdiodev;
struct brcmf_core* core = bus->sdio_core;
uint32_t intstatus = 0;
uint32_t hmb_data;
uint8_t fcbits;
zx_status_t ret;
BRCMF_DBG(SDIO, "Enter");
/* Read mailbox data and ack that we did so */
hmb_data = brcmf_sdiod_func1_rl(sdiod, core->base + SD_REG(tohostmailboxdata), &ret);
if (ret == ZX_OK) {
brcmf_sdiod_func1_wl(sdiod, core->base + SD_REG(tosbmailbox), SMB_INT_ACK, &ret);
}
bus->sdcnt.f1regdata += 2;
/* dongle indicates the firmware has halted/crashed */
if (hmb_data & HMB_DATA_FWHALT) {
BRCMF_ERR("mailbox indicates firmware halted");
}
/* Dongle recomposed rx frames, accept them again */
if (hmb_data & HMB_DATA_NAKHANDLED) {
BRCMF_DBG(SDIO, "Dongle reports NAK handled, expect rtx of %d", bus->rx_seq);
if (!bus->rxskip) {
BRCMF_ERR("unexpected NAKHANDLED!");
}
bus->rxskip = false;
intstatus |= I_HMB_FRAME_IND;
}
/*
* DEVREADY does not occur with gSPI.
*/
if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
if (bus->sdpcm_ver != SDPCM_PROT_VERSION) {
BRCMF_ERR(
"Version mismatch, dongle reports %d, "
"expecting %d",
bus->sdpcm_ver, SDPCM_PROT_VERSION);
} else {
BRCMF_DBG(SDIO, "Dongle ready, protocol version %d", bus->sdpcm_ver);
}
/*
* Retrieve console state address now that firmware should have
* updated it.
*/
brcmf_sdio_get_console_addr(bus);
}
/*
* Flow Control has been moved into the RX headers and this out of band
* method isn't used any more.
* remaining backward compatible with older dongles.
*/
if (hmb_data & HMB_DATA_FC) {
fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
if (fcbits & ~bus->flowcontrol) {
bus->sdcnt.fc_xoff++;
}
if (bus->flowcontrol & ~fcbits) {
bus->sdcnt.fc_xon++;
}
bus->sdcnt.fc_rcvd++;
bus->flowcontrol = fcbits;
}
/* Shouldn't be any others */
if (hmb_data & ~(HMB_DATA_DEVREADY | HMB_DATA_NAKHANDLED | HMB_DATA_FC | HMB_DATA_FWREADY |
HMB_DATA_FWHALT | HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK)) {
BRCMF_ERR("Unknown mailbox data content: 0x%02x", hmb_data);
}
return intstatus;
}
static void brcmf_sdio_rxfail(struct brcmf_sdio* bus, bool abort, bool rtx) {
struct brcmf_sdio_dev* sdiod = bus->sdiodev;
struct brcmf_core* core = bus->sdio_core;
uint retries = 0;
uint16_t lastrbc;
uint8_t hi, lo;
zx_status_t err;
BRCMF_ERR("%sterminate frame%s", abort ? "abort command, " : "", rtx ? ", send NAK" : "");
if (abort) {
brcmf_sdiod_abort(bus->sdiodev, SDIO_FN_2);
}
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
bus->sdcnt.f1regdata++;
/* Wait until the packet has been flushed (device/FIFO stable) */
for (lastrbc = retries = 0xffff; retries > 0; retries--) {
hi = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCHI, &err);
lo = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCLO, &err);
bus->sdcnt.f1regdata += 2;
if ((hi == 0) && (lo == 0)) {
break;
}
if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
BRCMF_ERR("count growing: last 0x%04x now 0x%04x", lastrbc, (hi << 8) + lo);
}
const auto lastrbc_unsized = (hi << 8) + lo;
ZX_DEBUG_ASSERT(lastrbc_unsized <= std::numeric_limits<uint16_t>::max());
lastrbc = static_cast<uint16_t>(lastrbc_unsized);
}
if (!retries) {
BRCMF_ERR("count never zeroed: last 0x%04x", lastrbc);
} else {
BRCMF_DBG_THROTTLE(SDIO, "flush took %d iterations", 0xffff - retries);
}
if (rtx) {
bus->sdcnt.rxrtx++;
brcmf_sdiod_func1_wl(sdiod, core->base + SD_REG(tosbmailbox), SMB_NAK, &err);
bus->sdcnt.f1regdata++;
if (err == ZX_OK) {
bus->rxskip = true;
}
}
/* Clear partial in any case */
bus->cur_read.len = 0;
}
static void brcmf_sdio_txfail(struct brcmf_sdio* bus) {
struct brcmf_sdio_dev* sdiodev = bus->sdiodev;
uint8_t i, hi, lo;
/* On failure, abort the command and terminate the frame */
BRCMF_ERR("sdio error, abort command and terminate frame");
bus->sdcnt.tx_sderrs++;
brcmf_sdiod_abort(sdiodev, SDIO_FN_2);
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
bus->sdcnt.f1regdata++;
for (i = 0; i < 3; i++) {
hi = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
lo = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
bus->sdcnt.f1regdata += 2;
if ((hi == 0) && (lo == 0)) {
break;
}
}
}
/* return total length of buffer chain */
static uint brcmf_sdio_glom_len(struct brcmf_sdio* bus) {
struct brcmf_netbuf* p;
uint total;
total = 0;
brcmf_netbuf_list_for_every(&bus->glom, p) total += p->len;
return total;
}
static void brcmf_sdio_free_glom(struct brcmf_sdio* bus) {
struct brcmf_netbuf* cur;
struct brcmf_netbuf* next;
brcmf_netbuf_list_for_every_safe(&bus->glom, cur, next) {
brcmf_netbuf_list_remove(&bus->glom, cur);
brcmu_pkt_buf_free_netbuf(cur);
}
}
/**
* brcmfmac sdio bus specific header
* This is the lowest layer header wrapped on the packets transmitted between
* host and WiFi dongle which contains information needed for SDIO core and
* firmware
*
* It consists of 3 parts: hardware header, hardware extension header and
* software header
* hardware header (frame tag) - 4 bytes
* Byte 0~1: Frame length
* Byte 2~3: Checksum, bit-wise inverse of frame length
* hardware extension header - 8 bytes
* Tx glom mode only, N/A for Rx or normal Tx
* Byte 0~1: Packet length excluding hw frame tag
* Byte 2: Reserved
* Byte 3: Frame flags, bit 0: last frame indication
* Byte 4~5: Reserved
* Byte 6~7: Tail padding length
* software header - 8 bytes
* Byte 0: Rx/Tx sequence number
* Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
* Byte 2: Length of next data frame, reserved for Tx
* Byte 3: Data offset
* Byte 4: Flow control bits, reserved for Tx
* Byte 5: Maximum Sequence number allowed by firmware for Tx, N/A for Tx packet
* Byte 6~7: Reserved
*/
#define SDPCM_HWHDR_LEN 4
#define SDPCM_HWEXT_LEN 8
#define SDPCM_SWHDR_LEN 8
#define SDPCM_HDRLEN (SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN)
/* software header */
#define SDPCM_SEQ_MASK 0x000000ff
#define SDPCM_SEQ_WRAP 256
#define SDPCM_CHANNEL_MASK 0x00000f00
#define SDPCM_CHANNEL_SHIFT 8
#define SDPCM_CONTROL_CHANNEL 0 /* Control */
#define SDPCM_EVENT_CHANNEL 1 /* Asyc Event Indication */
#define SDPCM_DATA_CHANNEL 2 /* Data Xmit/Recv */
#define SDPCM_GLOM_CHANNEL 3 /* Coalesced packets */
#define SDPCM_TEST_CHANNEL 15 /* Test/debug packets */
#define SDPCM_GLOMDESC(p) (((uint8_t*)p)[1] & 0x80)
#define SDPCM_NEXTLEN_MASK 0x00ff0000
#define SDPCM_NEXTLEN_SHIFT 16
#define SDPCM_DOFFSET_MASK 0xff000000
#define SDPCM_DOFFSET_SHIFT 24
#define SDPCM_FCMASK_MASK 0x000000ff
#define SDPCM_WINDOW_MASK 0x0000ff00
#define SDPCM_WINDOW_SHIFT 8
static inline uint8_t brcmf_sdio_getdatoffset(uint8_t* swheader) {
uint32_t hdrvalue;
hdrvalue = *(uint32_t*)swheader;
return (uint8_t)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT);
}
static inline bool brcmf_sdio_fromevntchan(uint8_t* swheader) {
uint32_t hdrvalue;
uint8_t ret;
hdrvalue = *(uint32_t*)swheader;
ret = (uint8_t)((hdrvalue & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT);
return (ret == SDPCM_EVENT_CHANNEL);
}
static zx_status_t brcmf_sdio_hdparse(struct brcmf_sdio* bus, uint8_t* header,
struct brcmf_sdio_hdrinfo* rd, enum brcmf_sdio_frmtype type) {
uint16_t len, checksum;
uint8_t rx_seq, fc, tx_seq_max;
uint32_t swheader;
// trace_brcmf_sdpcm_hdr(SDPCM_RX, header);
/* hw header */
len = *(uint16_t*)header;
checksum = *(uint16_t*)(header + sizeof(uint16_t));
/* All zero means no more to read */
if (!(len | checksum)) {
bus->rxpending = false;
return ZX_ERR_BUFFER_TOO_SMALL;
}
if ((uint16_t)(~(len ^ checksum))) {
BRCMF_ERR("HW header checksum error");
bus->sdcnt.rx_badhdr++;
brcmf_sdio_rxfail(bus, false, false);
return ZX_ERR_IO;
}
if (len < SDPCM_HDRLEN) {
BRCMF_ERR("HW header length error");
return ZX_ERR_IO_DATA_INTEGRITY;
}
if (type == BRCMF_SDIO_FT_SUPER && (roundup(len, bus->blocksize) != rd->len)) {
BRCMF_ERR("HW superframe header length error");
return ZX_ERR_IO_DATA_INTEGRITY;
}
if (type == BRCMF_SDIO_FT_SUB && len > rd->len) {
BRCMF_ERR("HW subframe header length error");
return ZX_ERR_IO_DATA_INTEGRITY;
}
rd->len = len;
/* software header */
header += SDPCM_HWHDR_LEN;
swheader = *(uint32_t*)header;
if (type == BRCMF_SDIO_FT_SUPER && SDPCM_GLOMDESC(header)) {
BRCMF_ERR("Glom descriptor found in superframe head");
rd->len = 0;
return ZX_ERR_INVALID_ARGS;
}
rx_seq = (uint8_t)(swheader & SDPCM_SEQ_MASK);
rd->channel = (swheader & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT;
if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL && type != BRCMF_SDIO_FT_SUPER) {
BRCMF_ERR("HW header length too long");
bus->sdcnt.rx_toolong++;
brcmf_sdio_rxfail(bus, false, false);
rd->len = 0;
return ZX_ERR_IO_DATA_INTEGRITY;
}
if (type == BRCMF_SDIO_FT_SUPER && rd->channel != SDPCM_GLOM_CHANNEL) {
BRCMF_ERR("Wrong channel for superframe");
rd->len = 0;
return ZX_ERR_INVALID_ARGS;
}
if (type == BRCMF_SDIO_FT_SUB && rd->channel != SDPCM_DATA_CHANNEL &&
rd->channel != SDPCM_EVENT_CHANNEL) {
BRCMF_ERR("Wrong channel for subframe");
rd->len = 0;
return ZX_ERR_INVALID_ARGS;
}
rd->dat_offset = brcmf_sdio_getdatoffset(header);
if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
BRCMF_ERR("seq %d: bad data offset", rx_seq);
bus->sdcnt.rx_badhdr++;
brcmf_sdio_rxfail(bus, false, false);
rd->len = 0;
return ZX_ERR_IO_DATA_INTEGRITY;
}
if (rd->seq_num != rx_seq) {
BRCMF_DBG(SDIO, "seq %d, expected %d", rx_seq, rd->seq_num);
bus->sdcnt.rx_badseq++;
rd->seq_num = rx_seq;
}
/* no need to check the reset for subframe */
if (type == BRCMF_SDIO_FT_SUB) {
return ZX_OK;
}
rd->len_nxtfrm = (swheader & SDPCM_NEXTLEN_MASK) >> SDPCM_NEXTLEN_SHIFT;
if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
/* only warm for NON glom packet */
if (rd->channel != SDPCM_GLOM_CHANNEL) {
BRCMF_ERR("seq %d: next length error", rx_seq);
}
rd->len_nxtfrm = 0;
}
swheader = *(uint32_t*)(header + 4);
fc = swheader & SDPCM_FCMASK_MASK;
if (bus->flowcontrol != fc) {
if (~bus->flowcontrol & fc) {
bus->sdcnt.fc_xoff++;
}
if (bus->flowcontrol & ~fc) {
bus->sdcnt.fc_xon++;
}
bus->sdcnt.fc_rcvd++;
bus->flowcontrol = fc;
}
tx_seq_max = (swheader & SDPCM_WINDOW_MASK) >> SDPCM_WINDOW_SHIFT;
if ((uint8_t)(tx_seq_max - bus->tx_seq) > 0x40) {
BRCMF_ERR("tx_seq_max is %d, bus->tx_seq is %d: max tx seq number error", tx_seq_max,
bus->tx_seq);
bus->sdiodev->drvr->device->GetInspect()->LogSdioMaxTxSeqErr();
tx_seq_max = bus->tx_seq + 2;
}
bus->tx_max = tx_seq_max;
return ZX_OK;
}
static inline void brcmf_sdio_update_hwhdr(uint8_t* header, uint16_t frm_length) {
*(uint16_t*)header = frm_length;
*(((uint16_t*)header) + 1) = ~frm_length;
}
static void brcmf_sdio_hdpack(struct brcmf_sdio* bus, uint8_t* header,
struct brcmf_sdio_hdrinfo* hd_info) {
uint32_t hdrval;
uint8_t hdr_offset;
brcmf_sdio_update_hwhdr(header, hd_info->len);
hdr_offset = SDPCM_HWHDR_LEN;
hdrval = hd_info->seq_num;
hdrval |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK;
hdrval |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK;
*((uint32_t*)(header + hdr_offset)) = hdrval;
*(((uint32_t*)(header + hdr_offset)) + 1) = 0;
}
static uint8_t brcmf_sdio_rxglom(struct brcmf_sdio* bus, uint8_t rxseq) {
uint16_t dlen, totlen;
uint8_t* dptr;
uint8_t num = 0;
uint16_t sublen;
struct brcmf_netbuf* pfirst;
struct brcmf_netbuf* pnext;
zx_status_t errcode;
uint8_t doff;
struct brcmf_sdio_hdrinfo rd_new;
TRACE_DURATION("brcmfmac:isr", "sdio_rxglom", "rxseq", TA_UINT32((uint32_t)rxseq));
/* If packets, issue read(s) and send up packet chain */
/* Return sequence numbers consumed? */
BRCMF_DBG(SDIO, "start: glomd %p glom %p", bus->glomd, brcmf_netbuf_list_peek_head(&bus->glom));
/* If there's a descriptor, generate the packet chain */
if (bus->glomd) {
pfirst = pnext = NULL;
dlen = (uint16_t)(bus->glomd->len);
dptr = bus->glomd->data;
if (!dlen || (dlen & 1)) {
BRCMF_ERR("bad glomd len(%d), ignore descriptor", dlen);
dlen = 0;
}
for (totlen = num = 0; dlen; num++) {
/* Get (and move past) next length */
sublen = *(uint16_t*)(dptr);
dlen -= sizeof(uint16_t);
dptr += sizeof(uint16_t);
if ((sublen < SDPCM_HDRLEN) || ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
BRCMF_ERR("descriptor len %d bad: %d", num, sublen);
pnext = NULL;
break;
}
if (sublen % bus->sgentry_align) {
BRCMF_ERR("sublen %d not multiple of %d", sublen, bus->sgentry_align);
}
totlen += sublen;
/* For last frame, adjust read len so total
is a block multiple */
if (!dlen) {
sublen += (roundup(totlen, bus->blocksize) - totlen);
totlen = roundup(totlen, bus->blocksize);
}
/* Allocate/chain packet for next subframe */
pnext = brcmu_pkt_buf_get_netbuf(sublen + bus->sgentry_align);
if (pnext == NULL) {
BRCMF_ERR("bcm_pkt_buf_get_netbuf failed, num %d len %d", num, sublen);
break;
}
brcmf_netbuf_list_add_tail(&bus->glom, pnext);
/* Adhere to start alignment requirements */
pkt_align(pnext, sublen, bus->sgentry_align);
}
/* If all allocations succeeded, save packet chain
in bus structure */
if (pnext) {
BRCMF_DBG(GLOM, "allocated %d-byte packet chain for %d subframes", totlen, num);
if (BRCMF_IS_ON(GLOM) && bus->cur_read.len && totlen != bus->cur_read.len) {
BRCMF_DBG(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d", bus->cur_read.len,
totlen, rxseq);
}
pfirst = pnext = NULL;
} else {
brcmf_sdio_free_glom(bus);
num = 0;
}
/* Done with descriptor packet */
brcmu_pkt_buf_free_netbuf(bus->glomd);
bus->glomd = NULL;
bus->cur_read.len = 0;
}
/* Ok -- either we just generated a packet chain,
or had one from before */
if (!brcmf_netbuf_list_is_empty(&bus->glom)) {
if (BRCMF_IS_ON(GLOM)) {
BRCMF_DBG(GLOM, "try superframe read, packet chain:");
brcmf_netbuf_list_for_every(&bus->glom, pnext) {
BRCMF_DBG(GLOM, " %p: %p len 0x%04x (%d)", pnext, (uint8_t*)(pnext->data), pnext->len,
pnext->len);
}
}
pfirst = brcmf_netbuf_list_peek_head(&bus->glom);
dlen = (uint16_t)brcmf_sdio_glom_len(bus);
/* Do an SDIO read for the superframe. Configurable iovar to
* read directly into the chained packet, or allocate a large
* packet and and copy into the chain.
*/
sdio_claim_host(bus->sdiodev->func1);
errcode = brcmf_sdiod_recv_chain(bus->sdiodev, &bus->glom, dlen);
sdio_release_host(bus->sdiodev->func1);
bus->sdcnt.f2rxdata++;
/* On failure, kill the superframe */
if (errcode != ZX_OK) {
BRCMF_ERR("glom read of %d bytes failed: %d", dlen, errcode);
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_rxfail(bus, true, false);
bus->sdcnt.rxglomfail++;
brcmf_sdio_free_glom(bus);
sdio_release_host(bus->sdiodev->func1);
return 0;
}
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(GLOM), pfirst->data, std::min<int>(pfirst->len, 48),
"SUPERFRAME:");
rd_new.seq_num = rxseq;
rd_new.len = dlen;
sdio_claim_host(bus->sdiodev->func1);
errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new, BRCMF_SDIO_FT_SUPER);
sdio_release_host(bus->sdiodev->func1);
if (errcode == ZX_OK) {
const auto cur_len = rd_new.len_nxtfrm << 4;
ZX_DEBUG_ASSERT(cur_len <= std::numeric_limits<uint16_t>::max());
bus->cur_read.len = static_cast<uint16_t>(cur_len);
/* Remove superframe header, remember offset */
brcmf_netbuf_shrink_head(pfirst, rd_new.dat_offset);
}
num = 0;
/* Validate all the subframe headers */
brcmf_netbuf_list_for_every(&bus->glom, pnext) {
/* leave when invalid subframe is found */
if (errcode != ZX_OK) {
break;
}
ZX_DEBUG_ASSERT(pnext->len <= std::numeric_limits<uint16_t>::max());
rd_new.len = static_cast<uint16_t>(pnext->len);
rd_new.seq_num = rxseq++;
sdio_claim_host(bus->sdiodev->func1);
errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new, BRCMF_SDIO_FT_SUB);
sdio_release_host(bus->sdiodev->func1);
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(GLOM), pnext->data, 32, "subframe:");
num++;
}
if (errcode != ZX_OK) {
/* Terminate frame on error */
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_rxfail(bus, true, false);
bus->sdcnt.rxglomfail++;
brcmf_sdio_free_glom(bus);
sdio_release_host(bus->sdiodev->func1);
bus->cur_read.len = 0;
return 0;
}
/* Basic SD framing looks ok - process each packet (header) */
brcmf_netbuf_list_for_every_safe(&bus->glom, pfirst, pnext) {
dptr = (uint8_t*)(pfirst->data);
sublen = *(uint16_t*)dptr;
doff = brcmf_sdio_getdatoffset(&dptr[SDPCM_HWHDR_LEN]);
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(BYTES) && BRCMF_IS_ON(DATA), dptr, pfirst->len,
"Rx Subframe Data:");
brcmf_netbuf_set_length_to(pfirst, sublen);
brcmf_netbuf_shrink_head(pfirst, doff);
if (pfirst->len == 0) {
brcmf_netbuf_list_remove(&bus->glom, pfirst);
brcmu_pkt_buf_free_netbuf(pfirst);
continue;
}
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(GLOM), pfirst->data, std::min<int>(pfirst->len, 32),
"subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p",
brcmf_netbuf_list_length(&bus->glom), pfirst, pfirst->data, pfirst->len,
brcmf_netbuf_list_next(&bus->glom, pfirst),
brcmf_netbuf_list_prev(&bus->glom, pfirst));
brcmf_netbuf_list_remove(&bus->glom, pfirst);
if (brcmf_sdio_fromevntchan(&dptr[SDPCM_HWHDR_LEN])) {
brcmf_rx_event(bus->sdiodev->drvr, pfirst);
} else {
brcmf_rx_frame(bus->sdiodev->drvr, pfirst, false);
}
bus->sdcnt.rxglompkts++;
}
bus->sdcnt.rxglomframes++;
}
return num;
}
static int brcmf_sdio_dcmd_resp_wait(struct brcmf_sdio* bus, bool* pending) {
/* Wait until control frame is available */
*pending = false; // TODO(cphoenix): Does signal_pending() have meaning in Garnet?
zx_status_t result;
result = sync_completion_wait(&bus->dcmd_resp_wait, ZX_MSEC(DCMD_RESP_TIMEOUT_MSEC));
sync_completion_reset(&bus->dcmd_resp_wait);
return result;
}
static zx_status_t brcmf_sdio_dcmd_resp_wake(struct brcmf_sdio* bus) {
sync_completion_signal(&bus->dcmd_resp_wait);
return ZX_OK;
}
static void brcmf_sdio_read_control(struct brcmf_sdio* bus, uint8_t* hdr, uint len, uint doff) {
uint rdlen, pad;
uint8_t* buf = NULL;
uint8_t* rbuf;
zx_status_t sdret;
BRCMF_DBG(TRACE, "Enter");
if (bus->rxblen) {
buf = static_cast<decltype(buf)>(calloc(1, bus->rxblen));
}
if (!buf) {
goto done;
}
rbuf = bus->rxbuf;
pad = ((unsigned long)rbuf % bus->head_align);
if (pad) {
rbuf += (bus->head_align - pad);
}
/* Copy the already-read portion over */
memcpy(buf, hdr, BRCMF_FIRSTREAD);
if (len <= BRCMF_FIRSTREAD) {
goto gotpkt;
}
/* Raise rdlen to next SDIO block to avoid tail command */
rdlen = len - BRCMF_FIRSTREAD;
if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
pad = bus->blocksize - (rdlen % bus->blocksize);
if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
((len + pad) < bus->sdiodev->bus_if->maxctl)) {
rdlen += pad;
}
} else if (rdlen % bus->head_align) {
rdlen += bus->head_align - (rdlen % bus->head_align);
}
/* Drop if the read is too big or it exceeds our maximum */
if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
BRCMF_ERR("%d-byte control read exceeds %d-byte buffer", rdlen, bus->sdiodev->bus_if->maxctl);
brcmf_sdio_rxfail(bus, false, false);
goto done;
}
if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
BRCMF_ERR("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit", len, len - doff,
bus->sdiodev->bus_if->maxctl);
bus->sdcnt.rx_toolong++;
brcmf_sdio_rxfail(bus, false, false);
goto done;
}
/* Read remain of frame body */
sdret = brcmf_sdiod_recv_buf(bus->sdiodev, rbuf, rdlen);
bus->sdcnt.f2rxdata++;
/* Control frame failures need retransmission */
if (sdret != ZX_OK) {
BRCMF_ERR("read %d control bytes failed: %d", rdlen, sdret);
bus->sdcnt.rxc_errors++;
brcmf_sdio_rxfail(bus, true, true);
goto done;
} else {
memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
}
gotpkt:
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(BYTES) && BRCMF_IS_ON(CTL), buf, len, "RxCtrl:");
/* Point to valid data and indicate its length */
// spin_lock_bh(&bus->rxctl_lock);
bus->sdiodev->drvr->irq_callback_lock.lock();
if (bus->rxctl) {
BRCMF_ERR("last control frame is being processed.");
// spin_unlock_bh(&bus->rxctl_lock);
bus->sdiodev->drvr->irq_callback_lock.unlock();
free(buf);
goto done;
}
bus->rxctl = buf + doff;
bus->rxctl_orig = buf;
bus->rxlen = len - doff;
// spin_unlock_bh(&bus->rxctl_lock);
bus->sdiodev->drvr->irq_callback_lock.unlock();
done:
/* Awake any waiters */
if (bus->rxlen) {
brcmf_sdio_dcmd_resp_wake(bus);
}
}
/* Pad read to blocksize for efficiency */
static void brcmf_sdio_pad(struct brcmf_sdio* bus, uint16_t* pad, uint16_t* rdlen) {
if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
*pad = bus->blocksize - (*rdlen % bus->blocksize);
if (*pad <= bus->roundup && *pad < bus->blocksize &&
*rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ) {
*rdlen += *pad;
}
} else if (*rdlen % bus->head_align) {
*rdlen += bus->head_align - (*rdlen % bus->head_align);
}
}
static uint brcmf_sdio_readframes(struct brcmf_sdio* bus, uint maxframes) {
struct brcmf_netbuf* pkt; /* Packet for event or data frames */
uint16_t pad; /* Number of pad bytes to read */
uint rxleft = 0; /* Remaining number of frames allowed */
zx_status_t ret; /* Return code from calls */
uint rxcount = 0; /* Total frames read */
struct brcmf_sdio_hdrinfo* rd = &bus->cur_read;
struct brcmf_sdio_hdrinfo rd_new;
uint8_t head_read = 0;
TRACE_DURATION("brcmfmac:isr", "readframes");
/* Not finished unless we encounter no more frames indication */
bus->rxpending = true;
for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
!bus->rxskip && rxleft && bus->sdiodev->state == BRCMF_SDIOD_DATA; rd->seq_num++, rxleft--) {
/* Handle glomming separately */
if (bus->glomd || !brcmf_netbuf_list_is_empty(&bus->glom)) {
uint8_t cnt;
BRCMF_DBG(GLOM, "calling rxglom: glomd %p, glom %p", bus->glomd,
brcmf_netbuf_list_peek_head(&bus->glom));
cnt = brcmf_sdio_rxglom(bus, rd->seq_num);
BRCMF_DBG(GLOM, "rxglom returned %d", cnt);
rd->seq_num += cnt - 1;
rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
continue;
}
rd->len_left = rd->len;
/* read header first for unknow frame length */
sdio_claim_host(bus->sdiodev->func1);
if (!rd->len) {
TRACE_DURATION("brcmfmac:isr", "read packet headers");
ret = brcmf_sdiod_recv_buf(bus->sdiodev, bus->rxhdr, BRCMF_FIRSTREAD);
bus->sdcnt.f2rxhdrs++;
if (ret != ZX_OK) {
BRCMF_ERR("RXHEADER FAILED: %d", ret);
bus->sdcnt.rx_hdrfail++;
brcmf_sdio_rxfail(bus, true, true);
sdio_release_host(bus->sdiodev->func1);
continue;
}
TRACE_INSTANT("brcmfmac:isr", "rxhdr", TRACE_SCOPE_THREAD, "frame length",
TA_UINT32((uint32_t) * (uint16_t*)&bus->rxhdr[0]), "checksum",
TA_UINT32((uint32_t) * (uint16_t*)&bus->rxhdr[2]), "seq num",
TA_UINT32((uint32_t)bus->rxhdr[SDPCM_HWHDR_LEN + 0]), "channel",
TA_UINT32((uint32_t)bus->rxhdr[SDPCM_HWHDR_LEN + 1] & 0xf), "data offset",
TA_UINT32((uint32_t)bus->rxhdr[SDPCM_HWHDR_LEN + 3]));
if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd, BRCMF_SDIO_FT_NORMAL) != ZX_OK) {
sdio_release_host(bus->sdiodev->func1);
if (!bus->rxpending) {
break;
} else {
continue;
}
}
if (rd->channel == SDPCM_CONTROL_CHANNEL) {
brcmf_sdio_read_control(bus, bus->rxhdr, rd->len, rd->dat_offset);
/* prepare the descriptor for the next read */
const auto next_len = rd->len_nxtfrm << 4;
ZX_DEBUG_ASSERT(next_len <= std::numeric_limits<uint16_t>::max());
rd->len = static_cast<uint16_t>(next_len);
rd->len_nxtfrm = 0;
/* treat all packet as event if we don't know */
rd->channel = SDPCM_EVENT_CHANNEL;
sdio_release_host(bus->sdiodev->func1);
continue;
}
rd->len_left = rd->len > BRCMF_FIRSTREAD ? rd->len - BRCMF_FIRSTREAD : 0;
head_read = BRCMF_FIRSTREAD;
}
brcmf_sdio_pad(bus, &pad, &rd->len_left);
pkt = brcmu_pkt_buf_get_netbuf(rd->len_left + head_read + bus->head_align);
if (!pkt) {
/* Give up on data, request rtx of events */
BRCMF_ERR("brcmu_pkt_buf_get_netbuf failed");
brcmf_sdio_rxfail(bus, false, RETRYCHAN(rd->channel));
sdio_release_host(bus->sdiodev->func1);
continue;
}
brcmf_netbuf_shrink_head(pkt, head_read);
pkt_align(pkt, rd->len_left, bus->head_align);
if (pkt->len > 0) {
ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
bus->sdcnt.f2rxdata++;
}
sdio_release_host(bus->sdiodev->func1);
if (ret != ZX_OK) {
BRCMF_ERR("read %d bytes from channel %d failed: %d", rd->len, rd->channel, ret);
brcmu_pkt_buf_free_netbuf(pkt);
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_rxfail(bus, true, RETRYCHAN(rd->channel));
sdio_release_host(bus->sdiodev->func1);
continue;
}
if (head_read) {
brcmf_netbuf_grow_head(pkt, head_read);
memcpy(pkt->data, bus->rxhdr, head_read);
head_read = 0;
} else {
memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
rd_new.seq_num = rd->seq_num;
sdio_claim_host(bus->sdiodev->func1);
if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new, BRCMF_SDIO_FT_NORMAL) != ZX_OK) {
rd->len = 0;
brcmu_pkt_buf_free_netbuf(pkt);
continue;
}
bus->sdcnt.rx_readahead_cnt++;
if (rd->len != roundup(rd_new.len, 16)) {
BRCMF_ERR("frame length mismatch:read %d, should be %d", rd->len,
roundup(rd_new.len, 16) >> 4);
rd->len = 0;
brcmf_sdio_rxfail(bus, true, true);
sdio_release_host(bus->sdiodev->func1);
brcmu_pkt_buf_free_netbuf(pkt);
continue;
}
sdio_release_host(bus->sdiodev->func1);
rd->len_nxtfrm = rd_new.len_nxtfrm;
rd->channel = rd_new.channel;
rd->dat_offset = rd_new.dat_offset;
BRCMF_DBG_HEX_DUMP(!(BRCMF_IS_ON(BYTES) && BRCMF_IS_ON(DATA)) && BRCMF_IS_ON(HDRS),
bus->rxhdr, SDPCM_HDRLEN, "RxHdr:");
if (rd_new.channel == SDPCM_CONTROL_CHANNEL) {
BRCMF_ERR("readahead on control packet %d?", rd_new.seq_num);
/* Force retry w/normal header read */
rd->len = 0;
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_rxfail(bus, false, true);
sdio_release_host(bus->sdiodev->func1);
brcmu_pkt_buf_free_netbuf(pkt);
continue;
}
}
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(BYTES) && BRCMF_IS_ON(DATA), pkt->data, rd->len, "Rx Data:");
/* Save superframe descriptor and allocate packet frame */
if (rd->channel == SDPCM_GLOM_CHANNEL) {
if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_HWHDR_LEN])) {
BRCMF_DBG(GLOM, "glom descriptor, %d bytes:", rd->len);
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(GLOM), pkt->data, rd->len, "Glom Data:");
brcmf_netbuf_set_length_to(pkt, rd->len);
brcmf_netbuf_shrink_head(pkt, SDPCM_HDRLEN);
bus->glomd = pkt;
} else {
BRCMF_ERR(
"%s: glom superframe w/o "
"descriptor!",
__func__);
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_rxfail(bus, false, false);
sdio_release_host(bus->sdiodev->func1);
}
/* prepare the descriptor for the next read */
const auto next_len = rd->len_nxtfrm << 4;
ZX_DEBUG_ASSERT(next_len <= std::numeric_limits<uint16_t>::max());
rd->len = static_cast<uint16_t>(next_len);
rd->len_nxtfrm = 0;
/* treat all packet as event if we don't know */
rd->channel = SDPCM_EVENT_CHANNEL;
continue;
}
/* Fill in packet len and prio, deliver upward */
brcmf_netbuf_set_length_to(pkt, rd->len);
brcmf_netbuf_shrink_head(pkt, rd->dat_offset);
if (pkt->len == 0) {
brcmu_pkt_buf_free_netbuf(pkt);
} else if (rd->channel == SDPCM_EVENT_CHANNEL) {
brcmf_rx_event(bus->sdiodev->drvr, pkt);
} else {
brcmf_rx_frame(bus->sdiodev->drvr, pkt, false);
}
/* prepare the descriptor for the next read */
const auto next_len = rd->len_nxtfrm << 4;
ZX_DEBUG_ASSERT(next_len <= std::numeric_limits<uint16_t>::max());
rd->len = static_cast<uint16_t>(next_len);
rd->len_nxtfrm = 0;
/* treat all packet as event if we don't know */
rd->channel = SDPCM_EVENT_CHANNEL;
}
rxcount = maxframes - rxleft;
/* Message if we hit the limit */
if (!rxleft) {
BRCMF_DBG_THROTTLE(DATA, "hit rx limit of %d frames", maxframes);
} else {
BRCMF_DBG(DATA, "processed %d frames", rxcount);
}
/* Back off rxseq if awaiting rtx, update rx_seq */
if (bus->rxskip) {
rd->seq_num--;
}
bus->rx_seq = rd->seq_num;
return rxcount;
}
void brcmf_sdio_wait_event_wakeup(struct brcmf_sdio* bus) {
sync_completion_signal(&bus->ctrl_wait);
return;
}
static zx_status_t brcmf_sdio_txpkt_hdalign(struct brcmf_sdio* bus, struct brcmf_netbuf* pkt,
uint16_t* head_pad_out) {
uint16_t head_pad;
uint8_t* dat_buf;
dat_buf = (uint8_t*)(pkt->data);
/* Check head padding */
head_pad = ((unsigned long)dat_buf % bus->head_align);
if (head_pad) {
if (brcmf_netbuf_head_space(pkt) < head_pad) {
if (brcmf_netbuf_grow_realloc(pkt, head_pad, 0)) {
return ZX_ERR_NO_MEMORY;
}
head_pad = 0;
}
brcmf_netbuf_grow_head(pkt, head_pad);
dat_buf = (uint8_t*)(pkt->data);
}
memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
if (head_pad_out) {
*head_pad_out = head_pad;
}
return ZX_OK;
}
/**
* brcmf_sdio_txpkt_prep - packet preparation for transmit
* @bus: brcmf_sdio structure pointer
* @pktq: packet list pointer
* @chan: virtual channel to transmit the packet
*
* Processes to be applied to the packet
* - Align data buffer pointer
* - Align data buffer length
* - Prepare header
* Return: negative value if there is error
*/
static zx_status_t brcmf_sdio_txpkt_prep(struct brcmf_sdio* bus, struct brcmf_netbuf_list* pktq,
uint8_t chan) {
uint16_t head_pad, total_len;
struct brcmf_netbuf* pkt_next;
uint8_t txseq;
zx_status_t ret;
struct brcmf_sdio_hdrinfo hd_info = {};
txseq = bus->tx_seq;
total_len = 0;
brcmf_netbuf_list_for_every(pktq, pkt_next) {
/* align packet data pointer */
ret = brcmf_sdio_txpkt_hdalign(bus, pkt_next, &head_pad);
if (ret != ZX_OK) {
return ret;
}
if (head_pad) {
memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);
}
total_len += pkt_next->len;
if (pkt_next->len > std::numeric_limits<uint16_t>::max()) {
BRCMF_ERR("brcmf_sdio_txpkt_prep failed: pkt_next len invalid (overflow)");
return ZX_ERR_INTERNAL;
}
hd_info.len = static_cast<uint16_t>(pkt_next->len);
hd_info.lastfrm = brcmf_netbuf_list_peek_tail(pktq) == pkt_next;
hd_info.channel = chan;
const auto dat_offset = head_pad + bus->tx_hdrlen;
if (dat_offset > std::numeric_limits<uint8_t>::max()) {
BRCMF_ERR("brcmf_sdio_txpkt_prep failed: dat_offset invalid (overflow)");
return ZX_ERR_INTERNAL;
}
hd_info.dat_offset = static_cast<uint8_t>(dat_offset);
hd_info.seq_num = txseq++;
/* Now fill the header */
brcmf_sdio_hdpack(bus, pkt_next->data, &hd_info);
if (BRCMF_IS_ON(BYTES) && ((BRCMF_IS_ON(CTL) && chan == SDPCM_CONTROL_CHANNEL) ||
(BRCMF_IS_ON(DATA) && chan != SDPCM_CONTROL_CHANNEL))) {
BRCMF_DBG_HEX_DUMP(true, pkt_next->data, hd_info.len, "Tx Frame:");
} else if (BRCMF_IS_ON(HDRS)) {
BRCMF_DBG_HEX_DUMP(true, pkt_next->data, head_pad + bus->tx_hdrlen, "Tx Header:");
}
}
return ZX_OK;
}
/**
* brcmf_sdio_txpkt_postp - packet post processing for transmit
* @bus: brcmf_sdio structure pointer
* @pktq: packet list pointer
*
* Processes to be applied to the packet
* - Remove head padding
* - Remove tail padding
*/
static void brcmf_sdio_txpkt_postp(struct brcmf_sdio* bus, struct brcmf_netbuf_list* pktq) {
uint8_t* hdr;
uint32_t dat_offset;
struct brcmf_netbuf* pkt_next;
struct brcmf_netbuf* tmp;
brcmf_netbuf_list_for_every_safe(pktq, pkt_next, tmp) {
hdr = pkt_next->data + bus->tx_hdrlen - SDPCM_SWHDR_LEN;
dat_offset = *(uint32_t*)hdr;
dat_offset = (dat_offset & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT;
brcmf_netbuf_shrink_head(pkt_next, dat_offset);
}
}
/* Writes a HW/SW header into the packet and sends it. */
/* Assumes: (a) header space already there, (b) caller holds lock */
static zx_status_t brcmf_sdio_txpkt(struct brcmf_sdio* bus, struct brcmf_netbuf_list* pktq,
uint8_t chan) {
zx_status_t ret;
struct brcmf_netbuf* pkt_next;
struct brcmf_netbuf* tmp;
TRACE_DURATION("brcmfmac:isr", "sdio_txpkt");
ret = brcmf_sdio_txpkt_prep(bus, pktq, chan);
if (ret != ZX_OK) {
goto done;
}
sdio_claim_host(bus->sdiodev->func1);
ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
bus->sdcnt.f2txdata++;
if (ret != ZX_OK) {
brcmf_sdio_txfail(bus);
}
sdio_release_host(bus->sdiodev->func1);
done:
brcmf_sdio_txpkt_postp(bus, pktq);
if (ret == ZX_OK) {
const auto tx_seq = (bus->tx_seq + brcmf_netbuf_list_length(pktq)) % SDPCM_SEQ_WRAP;
if (tx_seq > std::numeric_limits<uint8_t>::max()) {
BRCMF_ERR("brcmf_sdio_txpkt failed: tx_seq invalid (overflow)");
ret = ZX_ERR_INTERNAL;
} else {
bus->tx_seq = static_cast<uint8_t>(tx_seq);
}
}
brcmf_netbuf_list_for_every_safe(pktq, pkt_next, tmp) {
brcmf_netbuf_list_remove(pktq, pkt_next);
brcmf_proto_bcdc_txcomplete(bus->sdiodev->drvr, pkt_next, ret == ZX_OK);
}
return ret;
}
// TODO(fxbug.dev/42151): Remove once bug resolved
static uint32_t brcmf_sdio_txq_full_errors = 0;
static bool brcmf_sdio_txq_full_debug_log = false;
static uint brcmf_sdio_sendfromq(struct brcmf_sdio* bus, uint maxframes) {
struct brcmf_netbuf* pkt;
struct brcmf_netbuf_list pktq;
uint32_t intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
uint32_t intstatus = 0;
zx_status_t ret = ZX_OK;
int prec_out, i;
uint cnt = 0;
uint8_t tx_prec_map, pkt_num;
TRACE_DURATION("brcmfmac:isr", "sendfromq");
tx_prec_map = ~bus->flowcontrol;
// TODO(fxbug.dev/42151): Remove once bug resolved
if (unlikely(brcmf_sdio_txq_full_debug_log)) {
int available = brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol);
BRCMF_INFO("%s called, maxframes = %u, available in queue = %d", __func__, maxframes,
available);
}
/* Send frames until the limit or some other event */
for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
pkt_num = 1;
const auto pkt_num_min =
std::min<uint32_t>(pkt_num, brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol));
if (pkt_num_min > std::numeric_limits<uint8_t>::max()) {
BRCMF_ERR("brcmf_sdio_sendfromq error: pkt_num invalid (overflow)");
break;
}
pkt_num = static_cast<uint8_t>(pkt_num_min);
brcmf_netbuf_list_init(&pktq);
// spin_lock_bh(&bus->txq_lock);
bus->sdiodev->drvr->irq_callback_lock.lock();
for (i = 0; i < pkt_num; i++) {
pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
if (pkt == NULL) {
break;
}
brcmf_netbuf_list_add_tail(&pktq, pkt);
}
// spin_unlock_bh(&bus->txq_lock);
bus->sdiodev->drvr->irq_callback_lock.unlock();
if (i == 0) {
break;
}
ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
cnt += i;
/* In poll mode, need to check for other events */
if (!bus->intr) {
/* Check device status, signal pending interrupt */
sdio_claim_host(bus->sdiodev->func1);
intstatus = brcmf_sdiod_func1_rl(bus->sdiodev, intstat_addr, &ret);
sdio_release_host(bus->sdiodev->func1);
bus->sdcnt.f2txdata++;
if (ret != ZX_OK) {
break;
}
if (intstatus & bus->hostintmask) {
bus->ipend.store(1);
}
}
}
/* Deflow-control stack if needed */
if ((bus->sdiodev->state == BRCMF_SDIOD_DATA) && bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
bus->txoff = false;
}
// TODO(fxbug.dev/42151): Remove once bug resolved
if (unlikely(brcmf_sdio_txq_full_debug_log)) {
int available = brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol);
BRCMF_INFO("%s finished, maxframes = %u, transmitted = %u, available in queue = %d", __func__,
maxframes, cnt, available);
}
return cnt;
}
static zx_status_t brcmf_sdio_tx_ctrlframe(struct brcmf_sdio* bus, uint8_t* frame, uint16_t len) {
uint8_t doff;
uint16_t pad;
uint retries = 0;
struct brcmf_sdio_hdrinfo hd_info = {};
// TODO(cphoenix): ret, err, rv, error, status - more consistency is better.
zx_status_t ret;
TRACE_DURATION("brcmfmac:isr", "sdio_tx_ctrlframe");
/* Back the pointer to make room for bus header */
frame -= bus->tx_hdrlen;
len += bus->tx_hdrlen;
/* Add alignment padding (optional for ctl frames) */
const auto doff_unsized = reinterpret_cast<uint64_t>(frame) % bus->head_align;
if (doff_unsized > std::numeric_limits<uint8_t>::max()) {
BRCMF_ERR("brcmf_sdio_tx_ctrlframe failed: doff invalid (overflow)");
return ZX_ERR_INTERNAL;
}
doff = static_cast<uint8_t>(doff_unsized);
if (doff) {
frame -= doff;
len += doff;
memset(frame + bus->tx_hdrlen, 0, doff);
}
/* Round send length to next SDIO block */
pad = 0;
if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
pad = bus->blocksize - (len % bus->blocksize);
if ((pad > bus->roundup) || (pad >= bus->blocksize)) {
pad = 0;
}
} else if (len % bus->head_align) {
pad = bus->head_align - (len % bus->head_align);
}
len += pad;
hd_info.len = len - pad;
hd_info.channel = SDPCM_CONTROL_CHANNEL;
hd_info.dat_offset = doff + bus->tx_hdrlen;
hd_info.seq_num = bus->tx_seq;
hd_info.lastfrm = true;
hd_info.tail_pad = pad;
brcmf_sdio_hdpack(bus, frame, &hd_info);
BRCMF_DBG_HEX_DUMP(BRCMF_IS_ON(BYTES) && BRCMF_IS_ON(CTL), frame, len, "Tx Frame:");
BRCMF_DBG_HEX_DUMP(!(BRCMF_IS_ON(BYTES) && BRCMF_IS_ON(CTL)) && BRCMF_IS_ON(HDRS), frame,
std::min<uint16_t>(len, 16), "TxHdr:");
do {
ret = brcmf_sdiod_send_buf(bus->sdiodev, frame, len);
if (ret != ZX_OK) {
brcmf_sdio_txfail(bus);
} else {
bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
}
} while (ret != ZX_OK && retries++ < TXRETRIES);
return ret;
}
static void brcmf_sdio_bus_stop(brcmf_bus* bus_if) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
struct brcmf_core* core = bus->sdio_core;
uint32_t local_hostintmask;
uint8_t saveclk;
zx_status_t err;
int thread_result;
BRCMF_DBG(TRACE, "Enter");
if (bus->watchdog_tsk) {
bus->watchdog_should_stop.store(true);
sync_completion_signal(&bus->watchdog_wait);
BRCMF_DBG(TEMP, "Closing and joining SDIO watchdog task");
thread_result = thrd_join(bus->watchdog_tsk, NULL);
BRCMF_DBG(TEMP, "Result of thread join: %d", thread_result);
bus->watchdog_tsk = 0;
}
if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
sdio_claim_host(sdiodev->func1);
/* Enable clock for device interrupts */
brcmf_sdio_bus_sleep(bus, false, false);
/* Disable and clear interrupts at the chip level also */
brcmf_sdiod_func1_wl(sdiodev, core->base + SD_REG(hostintmask), 0, NULL);
local_hostintmask = bus->hostintmask;
bus->hostintmask = 0;
/* Force backplane clocks to assure F2 interrupt propagates */
saveclk = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
if (err == ZX_OK) {
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, (saveclk | SBSDIO_FORCE_HT), &err);
}
if (err != ZX_OK) {
BRCMF_ERR("Failed to force clock for F2: err %s", zx_status_get_string(err));
}
/* Turn off the bus (F2), free any pending packets */
BRCMF_DBG(INTR, "disable SDIO interrupts");
sdio_disable_fn(&sdiodev->sdio_proto_fn2);
/* Clear any pending interrupts now that F2 is disabled */
brcmf_sdiod_func1_wl(sdiodev, core->base + SD_REG(intstatus), local_hostintmask, NULL);
sdio_release_host(sdiodev->func1);
}
/* Clear the data packet queues */
brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
/* Clear any held glomming stuff */
brcmu_pkt_buf_free_netbuf(bus->glomd);
brcmf_sdio_free_glom(bus);
/* Clear rx control and wake any waiters */
// spin_lock_bh(&bus->rxctl_lock);
sdiodev->drvr->irq_callback_lock.lock();
bus->rxlen = 0;
// spin_unlock_bh(&bus->rxctl_lock);
sdiodev->drvr->irq_callback_lock.unlock();
// TODO(cphoenix): I think the original Linux code in brcmf_sdio_dcmd_resp_wait() would have
// gone right back to sleep, since rxlen is 0. In the current code, it will exit;
// brcmf_sdio_bus_rxctl() will return ZX_ERR_SHOULD_WAIT; the loop in brcmf_proto_bcdc_cmplt
// will terminate. Check once we're supporting SDIO: Is this what we want? Why was this an
// apparent NOP in Linux?
brcmf_sdio_dcmd_resp_wake(bus);
/* Reset some F2 state stuff */
bus->rxskip = false;
bus->tx_seq = bus->rx_seq = 0;
}
static zx_status_t brcmf_sdio_intr_rstatus(struct brcmf_sdio* bus) {
struct brcmf_core* core = bus->sdio_core;
uint32_t addr;
uint32_t val;
zx_status_t ret;
addr = core->base + SD_REG(intstatus);
val = brcmf_sdiod_func1_rl(bus->sdiodev, addr, &ret);
bus->sdcnt.f1regdata++;
if (ret != ZX_OK) {
return ret;
}
val &= bus->hostintmask;
bus->fcstate.store(!!(val & I_HMB_FC_STATE));
/* Clear interrupts */
if (val) {
brcmf_sdiod_func1_wl(bus->sdiodev, addr, val, &ret);
bus->sdcnt.f1regdata++;
bus->intstatus.fetch_or(val);
}
return ret;
}
static void brcmf_sdio_dpc(struct brcmf_sdio* bus) {
struct brcmf_sdio_dev* sdiod = bus->sdiodev;
uint32_t newstatus = 0;
uint32_t intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
uint32_t intstatus;
uint txlimit = bus->txbound; /* Tx frames to send before resched */
uint framecnt; /* Temporary counter of tx/rx frames */
zx_status_t err = ZX_OK;
TRACE_DURATION("brcmfmac:isr", "dpc");
sdio_claim_host(bus->sdiodev->func1);
/* If waiting for HTAVAIL, check status */
if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
uint8_t clkctl;
uint8_t devctl = 0;
#if !defined(NDEBUG)
/* Check for inconsistent device control */
devctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_DEVICE_CTL, &err);
#endif /* !defined(NDEBUG) */
/* Read CSR, if clock on switch to AVAIL, else ignore */
clkctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
BRCMF_DBG(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x", devctl, clkctl);
if (SBSDIO_HTAV(clkctl)) {
devctl = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_DEVICE_CTL, &err);
devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_DEVICE_CTL, devctl, &err);
bus->clkstate = CLK_AVAIL;
}
}
/* Make sure backplane clock is on */
brcmf_sdio_bus_sleep(bus, false, true);
/* Pending interrupt indicates new device status */
if (bus->ipend.load() > 0) {
bus->ipend.store(0);
err = brcmf_sdio_intr_rstatus(bus);
}
/* Start with leftover status bits */
intstatus = bus->intstatus.exchange(0);
/* Handle flow-control change: read new state in case our ack
* crossed another change interrupt. If change still set, assume
* FC ON for safety, let next loop through do the debounce.
*/
if (intstatus & I_HMB_FC_CHANGE) {
intstatus &= ~I_HMB_FC_CHANGE;
brcmf_sdiod_func1_wl(sdiod, intstat_addr, I_HMB_FC_CHANGE, &err);
newstatus = brcmf_sdiod_func1_rl(sdiod, intstat_addr, &err);
bus->sdcnt.f1regdata += 2;
bus->fcstate.store(!!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
intstatus |= (newstatus & bus->hostintmask);
}
/* Handle host mailbox indication */
if (intstatus & I_HMB_HOST_INT) {
intstatus &= ~I_HMB_HOST_INT;
intstatus |= brcmf_sdio_hostmail(bus);
}
sdio_release_host(bus->sdiodev->func1);
/* Generally don't ask for these, can get CRC errors... */
if (intstatus & I_WR_OOSYNC) {
BRCMF_ERR("Dongle reports WR_OOSYNC");
intstatus &= ~I_WR_OOSYNC;
}
if (intstatus & I_RD_OOSYNC) {
BRCMF_ERR("Dongle reports RD_OOSYNC");
intstatus &= ~I_RD_OOSYNC;
}
if (intstatus & I_SBINT) {
BRCMF_ERR("Dongle reports SBINT");
intstatus &= ~I_SBINT;
}
/* Would be active due to wake-wlan in gSPI */
if (intstatus & I_CHIPACTIVE) {
BRCMF_DBG(INFO, "Dongle reports CHIPACTIVE");
intstatus &= ~I_CHIPACTIVE;
}
/* Ignore frame indications if rxskip is set */
if (bus->rxskip) {
intstatus &= ~I_HMB_FRAME_IND;
}
/* On frame indication, read available frames */
if ((intstatus & I_HMB_FRAME_IND) && (bus->clkstate == CLK_AVAIL)) {
brcmf_sdio_readframes(bus, bus->rxbound);
if (!bus->rxpending) {
intstatus &= ~I_HMB_FRAME_IND;
}
}
/* Keep still-pending events for next scheduling */
if (intstatus) {
bus->intstatus.fetch_or(intstatus);
}
if ((bus->clkstate == CLK_AVAIL) && data_ok(bus)) {
brcmf_sdio_if_ctrl_frame_stat_set(bus, [&bus, &err]() {
err = brcmf_sdio_tx_ctrlframe(bus, bus->ctrl_frame_buf, bus->ctrl_frame_len);
bus->ctrl_frame_err = err;
std::atomic_thread_fence(std::memory_order_seq_cst);
brcmf_sdio_wait_event_wakeup(bus);
});
}
/* Send queued frames (limit 1 if rx may still be pending) */
if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate.load() &&
brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && data_ok(bus)) {
framecnt = bus->rxpending ? std::min(txlimit, bus->txminmax) : txlimit;
brcmf_sdio_sendfromq(bus, framecnt);
} else if (unlikely(brcmf_sdio_txq_full_debug_log)) {
// TODO(fxbug.dev/42151): Remove once bug resolved
int len = brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol);
if (len > 0) {
BRCMF_INFO(
"Not able to transmit queued frames right now, clkstate = %u, "
"fcstate = %d, queue len = %d, txlimit = %u, data_ok = %s",
bus->clkstate, bus->fcstate.load(), len, txlimit, data_ok(bus) ? "true" : "false");
if (!data_ok(bus)) {
BRCMF_INFO("The tx_window is not ready, tx_max: %d, tx_seq: %d", bus->tx_max, bus->tx_seq);
}
}
}
if ((bus->sdiodev->state != BRCMF_SDIOD_DATA) || (err != ZX_OK)) {
BRCMF_ERR("failed backplane access over SDIO, halting operation");
bus->intstatus.store(0);
brcmf_sdio_if_ctrl_frame_stat_set(bus, [&bus]() {
bus->ctrl_frame_err = ZX_ERR_IO_REFUSED;
std::atomic_thread_fence(std::memory_order_seq_cst);
brcmf_sdio_wait_event_wakeup(bus);
});
} else if (bus->intstatus.load() || bus->ipend.load() > 0 ||
(!bus->fcstate.load() && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
data_ok(bus))) {
bus->dpc_triggered.store(true);
}
}
static struct pktq* brcmf_sdio_bus_gettxq(brcmf_bus* bus_if) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
return &bus->txq;
}
static zx_status_t brcmf_sdio_bus_flush_txq(brcmf_bus* bus_if, int ifidx) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
struct brcmf_pub* drvr = sdiodev->drvr;
struct brcmf_netbuf* cur;
struct brcmf_netbuf* next;
std::lock_guard lock(drvr->irq_callback_lock);
for (size_t q = 0; q <= bus->txq.hi_prec; ++q) {
brcmf_netbuf_list_for_every_safe(&bus->txq.q[q].netbuf_list, cur, next) {
if (cur->len <= bus->tx_hdrlen) {
continue;
}
if (cur->len - bus->tx_hdrlen < BCDC_HEADER_LEN) {
continue;
}
auto hdr = reinterpret_cast<struct brcmf_proto_bcdc_header*>(cur->data + bus->tx_hdrlen);
uint8_t idx = BCDC_GET_IF_IDX(hdr);
if (ifidx != idx) {
continue;
}
brcmf_netbuf_shrink_head(cur, bus->tx_hdrlen);
brcmf_netbuf_list_remove(&bus->txq.q[q].netbuf_list, cur);
brcmf_proto_bcdc_txcomplete(drvr, cur, false);
}
}
return ZX_OK;
}
static bool brcmf_sdio_prec_enq(struct pktq* q, struct brcmf_netbuf* pkt, int prec) {
struct brcmf_netbuf* p;
int eprec = -1; /* precedence to evict from */
/* Fast case, precedence queue is not full and we are also not
* exceeding total queue length
*/
if (!pktq_pfull(q, prec) && !pktq_full(q)) {
brcmu_pktq_penq(q, prec, pkt);
return true;
}
/* Determine precedence from which to evict packet, if any */
if (pktq_pfull(q, prec)) {
eprec = prec;
} else if (pktq_full(q)) {
p = brcmu_pktq_peek_tail(q, &eprec);
if (eprec > prec) {
// TODO(fxbug.dev/42151): Remove once bug resolved
BRCMF_ERR("Eviction precedence (%d) greater than enqueue precedence (%d)", eprec, prec);
return false;
}
}
/* Evict if needed */
if (eprec >= 0) {
/* Detect queueing to unconfigured precedence */
if (eprec == prec) {
// TODO(fxbug.dev/42151): Remove once bug resolved
BRCMF_INFO_THROTTLE("Expected to evict from and queue to same queue %d", prec);
return false; /* refuse newer (incoming) packet */
}
/* Evict packet according to discard policy */
p = brcmu_pktq_pdeq_tail(q, eprec);
if (p == NULL) {
BRCMF_ERR("brcmu_pktq_pdeq_tail() failed");
}
brcmu_pkt_buf_free_netbuf(p);
}
/* Enqueue */
p = brcmu_pktq_penq(q, prec, pkt);
if (p == NULL) {
BRCMF_ERR("brcmu_pktq_penq() failed");
}
return p != NULL;
}
static zx_status_t brcmf_sdio_bus_txdata(brcmf_bus* bus_if, brcmf_netbuf* pkt) {
zx_status_t ret;
uint prec;
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
BRCMF_DBG(TRACE, "Enter: pkt: data %p len %d", pkt->data, pkt->len);
if (sdiodev->state != BRCMF_SDIOD_DATA) {
return ZX_ERR_IO;
}
/* Add space for the header */
brcmf_netbuf_grow_head(pkt, bus->tx_hdrlen);
/* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
prec = prio2prec((pkt->priority & PRIOMASK));
/* Check for existing queue, current flow-control,
pending event, or pending clock */
BRCMF_DBG(TRACE, "deferring pktq len %d", pktq_len(&bus->txq));
bus->sdcnt.fcqueued++;
/* Priority based enq */
// spin_lock_bh(&bus->txq_lock);
sdiodev->drvr->irq_callback_lock.lock();
if (!brcmf_sdio_prec_enq(&bus->txq, pkt, prec)) {
brcmf_netbuf_shrink_head(pkt, bus->tx_hdrlen);
BRCMF_INFO_THROTTLE("out of bus->txq !!!");
sdiodev->drvr->device->GetInspect()->LogTxQueueFull();
bus->sdcnt.tx_qfull++;
ret = ZX_ERR_NO_RESOURCES;
// TODO(fxbug.dev/42151): Remove once bug resolved
++brcmf_sdio_txq_full_errors;
if (brcmf_sdio_txq_full_errors >= 30 && !brcmf_sdio_txq_full_debug_log) {
// We've seen a large number of these errors in a row, start providing
// more debug information.
BRCMF_WARN("Excessive out of bus->txq errors, enabling debug logging");
brcmf_sdio_txq_full_debug_log = true;
}
} else {
ret = ZX_OK;
// TODO(fxbug.dev/42151): Remove once bug resolved
// Reset the counter here in case there was just a spurious queue issue.
// Also stop the debug logging so we don't spam the logs unnecessarily.
brcmf_sdio_txq_full_errors = 0;
brcmf_sdio_txq_full_debug_log = false;
}
if (pktq_len(&bus->txq) >= TXHI) {
bus->txoff = true;
}
// spin_unlock_bh(&bus->txq_lock);
sdiodev->drvr->irq_callback_lock.unlock();
#if !defined(NDEBUG)
if (pktq_plen(&bus->txq, prec) > qcount[prec]) {
qcount[prec] = pktq_plen(&bus->txq, prec);
}
#endif // !defined(NDEBUG)
brcmf_sdio_trigger_dpc(bus);
return ret;
}
#if !defined(NDEBUG)
#define CONSOLE_LINE_MAX 192
static zx_status_t brcmf_sdio_readconsole(struct brcmf_sdio* bus) {
struct brcmf_console* c = &bus->console;
uint8_t line[CONSOLE_LINE_MAX];
uint8_t ch;
uint32_t n, idx, addr;
zx_status_t rv;
/* Don't do anything until FWREADY updates console address */
if (bus->console_addr == 0) {
return ZX_OK;
}
/* Read console log struct */
addr = bus->console_addr + offsetof(struct rte_console, log_le);
rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (uint8_t*)&c->log_le, sizeof(c->log_le));
if (rv != ZX_OK) {
return rv;
}
/* Allocate console buffer (one time only) */
if (c->buf == NULL) {
c->bufsize = c->log_le.buf_size;
c->buf = static_cast<decltype(c->buf)>(malloc(c->bufsize));
if (c->buf == NULL) {
return ZX_ERR_NO_MEMORY;
}
}
idx = c->log_le.idx;
/* Protect against corrupt value */
if (idx > c->bufsize) {
return ZX_ERR_IO_DATA_INTEGRITY;
}
/* Skip reading the console buffer if the index pointer
has not moved */
if (idx == c->last) {
return ZX_OK;
}
/* Read the console buffer */
addr = c->log_le.buf;
rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
if (rv != ZX_OK) {
return rv;
}
while (c->last != idx) {
for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
if (c->last == idx) {
/* This would output a partial line.
* Instead, back up
* the buffer pointer and output this
* line next time around.
*/
if (c->last >= n) {
c->last -= n;
} else {
c->last = c->bufsize - n;
}
goto break2;
}
ch = c->buf[c->last];
c->last = (c->last + 1) % c->bufsize;
if (ch == '\n') {
break;
}
line[n] = ch;
}
if (n > 0) {
if (line[n - 1] == '\r') {
n--;
}
line[n] = 0;
BRCMF_DBG(FWCON, "CONSOLE: %s", line);
}
}
break2:
return ZX_OK;
}
#endif /* !defined(NDEBUG) */
zx_status_t brcmf_sdio_bus_txctl(brcmf_bus* bus_if, unsigned char* msg, uint msglen) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
zx_status_t wait_status;
BRCMF_DBG(TRACE, "Enter");
if (sdiodev->state != BRCMF_SDIOD_DATA) {
return ZX_ERR_IO;
}
/* Send from dpc */
sync_completion_reset(&bus->ctrl_wait);
bus->ctrl_frame_buf = msg;
if (msglen > std::numeric_limits<uint16_t>::max()) {
BRCMF_ERR("brcmf_sdio_bus_txctl failed: msglen invalid (overflow)");
return ZX_ERR_INTERNAL;
}
bus->ctrl_frame_len = static_cast<uint16_t>(msglen);
std::atomic_thread_fence(std::memory_order_seq_cst);
bus->ctrl_frame_stat.store(true);
brcmf_sdio_trigger_dpc(bus);
// Wait for a response from firmware
wait_status = sync_completion_wait(&bus->ctrl_wait, sdiodev->ctl_done_timeout);
if (wait_status == ZX_ERR_TIMED_OUT) {
BRCMF_ERR("timed out waiting for txctl sdio operation to complete: %s",
zx_status_get_string(wait_status));
brcmf_sdio_if_ctrl_frame_stat_clear(bus, []() {
BRCMF_ERR(
"Unexpected clearing of ctrl_frame_stat by brcmf_sdio_dpc thread even though sdio "
"operation timed out.");
});
bus->sdcnt.tx_ctlerrs++;
return wait_status;
}
zx_status_t status = ZX_OK;
brcmf_sdio_if_ctrl_frame_stat_set(bus, [&status]() { status = ZX_ERR_SHOULD_WAIT; });
if (status != ZX_OK) {
BRCMF_ERR("txctl ctrl_frame timeout: %s", zx_status_get_string(status));
bus->sdcnt.tx_ctlerrs++;
return status;
}
BRCMF_DBG(SDIO, "ctrl_frame complete, err=%d", bus->ctrl_frame_err);
std::atomic_thread_fence(std::memory_order_seq_cst);
bus->sdcnt.tx_ctlpkts++;
return bus->ctrl_frame_err;
}
static zx_status_t brcmf_sdio_checkdied(struct brcmf_sdio* bus) {
zx_status_t error;
struct sdpcm_shared sh;
error = brcmf_sdio_shared_read(bus, &sh);
if (error != ZX_OK) {
return error;
}
if ((sh.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
BRCMF_DBG(INFO, "firmware not built with -assert");
} else if (sh.flags & SDPCM_SHARED_ASSERT) {
BRCMF_ERR("assertion in dongle");
}
if (sh.flags & SDPCM_SHARED_TRAP) {
BRCMF_ERR("firmware trap in dongle");
sh.flags &= (~SDPCM_SHARED_TRAP);
// Clean up the share memory before triggering a recovery.
error = brcmf_sdio_shared_write(bus, &sh);
if (error != ZX_OK) {
BRCMF_ERR("Write shared failed -- error: %s", zx_status_get_string(error));
return error;
}
error = bus->sdiodev->drvr->recovery_trigger->firmware_crash_.Inc();
if (error != ZX_OK) {
BRCMF_ERR("Increase recovery trigger condition failed -- error: %s",
zx_status_get_string(error));
return error;
}
}
return ZX_OK;
}
static zx_status_t brcmf_sdio_bus_rxctl(brcmf_bus* bus_if, unsigned char* msg, uint msglen,
int* rxlen_out) {
bool timeout;
uint rxlen = 0;
bool pending;
uint8_t* buf;
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
BRCMF_DBG(TRACE, "Enter");
if (sdiodev->state != BRCMF_SDIOD_DATA) {
return ZX_ERR_IO;
}
/* Wait until control frame is available */
timeout = (brcmf_sdio_dcmd_resp_wait(bus, &pending) != ZX_OK);
// spin_lock_bh(&bus->rxctl_lock);
sdiodev->drvr->irq_callback_lock.lock();
rxlen = bus->rxlen;
memcpy(msg, bus->rxctl, std::min(msglen, rxlen));
bus->rxctl = NULL;
buf = bus->rxctl_orig;
bus->rxctl_orig = NULL;
bus->rxlen = 0;
// spin_unlock_bh(&bus->rxctl_lock);
sdiodev->drvr->irq_callback_lock.unlock();
free(buf);
if (rxlen) {
BRCMF_DBG(CTL, "resumed on rxctl frame, received %d, message length %d", rxlen, msglen);
} else if (timeout) {
BRCMF_ERR("resumed on timeout");
brcmf_sdio_checkdied(bus);
} else if (pending) {
BRCMF_DBG(CTL, "cancelled");
return ZX_ERR_UNAVAILABLE;
} else {
BRCMF_DBG(CTL, "resumed for unknown reason?");
brcmf_sdio_checkdied(bus);
}
if (rxlen) {
bus->sdcnt.rx_ctlpkts++;
} else {
bus->sdcnt.rx_ctlerrs++;
}
if (rxlen) {
*rxlen_out = rxlen;
return ZX_OK;
} else {
return ZX_ERR_SHOULD_WAIT;
}
}
static bool brcmf_sdio_verifymemory(struct brcmf_sdio_dev* sdiodev, uint32_t ram_addr,
const void* ram_data, size_t ram_sz) {
char* ram_cmp;
zx_status_t err;
bool ret = true;
int len;
/* read back and verify */
BRCMF_DBG(INFO, "Compare RAM dl & ul at 0x%08x; size=%zu", ram_addr, ram_sz);
ram_cmp = static_cast<decltype(ram_cmp)>(malloc(MEMBLOCK));
/* do not proceed while no memory but */
if (!ram_cmp) {
return true;
}
const char* expected_data = static_cast<const char*>(ram_data);
int address = ram_addr;
int offset = 0;
if (ram_sz > std::numeric_limits<int>::max()) {
BRCMF_ERR("brcmf_sdio_verifymemory failed: ram_sz invalid (overflow)");
return false;
}
const auto ram_sz_resized = static_cast<int>(ram_sz);
while (offset < ram_sz_resized) {
len = ((offset + MEMBLOCK) < ram_sz_resized) ? MEMBLOCK : ram_sz_resized - offset;
err = brcmf_sdiod_ramrw(sdiodev, false, address, (uint8_t*)ram_cmp, len);
if (err != ZX_OK) {
BRCMF_ERR("error %d on reading %d membytes at 0x%08x", err, len, address);
ret = false;
break;
} else if (memcmp(ram_cmp, expected_data + offset, len)) {
/* On failure, find the byte offset so we can print a detailed error */
for (int ndx = 0; ndx < len; ndx++) {
if (ram_cmp[ndx] != expected_data[offset + ndx]) {
BRCMF_ERR("Downloaded RAM image is corrupted at offset %d of %zu (saw:%#x expect:%#x)",
offset + ndx, ram_sz, ram_cmp[ndx], expected_data[offset + ndx]);
/*const int start = (ndx & 63) == 0 ? 0 : ((ndx & 63) - 1);*/
const int start = (ndx & ~63) == 0 ? 0 : ((ndx & ~63) - 64);
const int blocks = start == 0 ? 2 : 3;
zxlogf(ERROR, "Read:");
for (int i = start; len >= (64 * blocks) && i < (64 * blocks); i += 16) {
zxlogf(ERROR,
"%04x: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x "
"%02x %02x",
i, ram_cmp[i + 0], ram_cmp[i + 1], ram_cmp[i + 2], ram_cmp[i + 3],
ram_cmp[i + 4], ram_cmp[i + 5], ram_cmp[i + 6], ram_cmp[i + 7], ram_cmp[i + 8],
ram_cmp[i + 9], ram_cmp[i + 10], ram_cmp[i + 11], ram_cmp[i + 12],
ram_cmp[i + 13], ram_cmp[i + 14], ram_cmp[i + 15]);
}
const char* expected = expected_data + offset;
zxlogf(ERROR, "Expected:");
for (int i = start; len >= (64 * blocks) && i < (64 * blocks); i += 16) {
zxlogf(ERROR,
"%04x: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x "
"%02x %02x",
i, expected[i + 0], expected[i + 1], expected[i + 2], expected[i + 3],
expected[i + 4], expected[i + 5], expected[i + 6], expected[i + 7],
expected[i + 8], expected[i + 9], expected[i + 10], expected[i + 11],
expected[i + 12], expected[i + 13], expected[i + 14], expected[i + 15]);
}
break;
}
}
ret = false;
break;
}
offset += len;
address += len;
}
free(ram_cmp);
return ret;
}
static zx_status_t brcmf_sdio_download_code_file(struct brcmf_sdio* bus, const void* firmware,
size_t firmware_size) {
zx_status_t err;
BRCMF_DBG(TRACE, "Enter");
err = brcmf_sdiod_ramrw(bus->sdiodev, true, bus->ci->rambase, const_cast<void*>(firmware),
firmware_size);
if (err != ZX_OK)
BRCMF_ERR("error %d on writing %zu membytes at 0x%08x", err, firmware_size, bus->ci->rambase);
else if (!brcmf_sdio_verifymemory(bus->sdiodev, bus->ci->rambase, firmware, firmware_size)) {
err = ZX_ERR_IO;
}
return err;
}
static zx_status_t brcmf_sdio_download_nvram(struct brcmf_sdio* bus, const void* vars,
uint32_t varsz) {
int address;
zx_status_t err;
BRCMF_DBG(TRACE, "Enter");
address = bus->ci->ramsize - varsz + bus->ci->rambase;
err = brcmf_sdiod_ramrw(bus->sdiodev, true, address, const_cast<void*>(vars), varsz);
if (err != ZX_OK) {
BRCMF_ERR("error %d on writing %d nvram bytes at 0x%08x", err, varsz, address);
} else if (!brcmf_sdio_verifymemory(bus->sdiodev, address, vars, varsz)) {
err = ZX_ERR_IO;
}
return err;
}
static zx_status_t brcmf_sdio_download_firmware(struct brcmf_sdio* bus, const void* firmware,
size_t firmware_size, const void* nvram,
size_t nvram_size) {
zx_status_t bcmerror = ZX_OK;
uint32_t rstvec;
uint8_t attempt_times = 0;
if (nvram_size > std::numeric_limits<uint32_t>::max()) {
BRCMF_ERR("brcmf_sdio_download_firmware failed: nvram_size invalid (overflow)");
return ZX_ERR_INTERNAL;
}
const auto nvram_size_resized = static_cast<uint32_t>(nvram_size);
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
rstvec = *(const uint32_t*)firmware;
BRCMF_DBG(SDIO, "firmware rstvec: %x", rstvec);
// Download firmware with retries.
do {
attempt_times++;
bcmerror = brcmf_sdio_download_code_file(bus, firmware, firmware_size);
if (bcmerror == ZX_OK)
break;
BRCMF_ERR("firmware file download failed, %u retry attempts remaining.",
FILE_LOAD_MAX_ATTEMPTS - attempt_times);
} while (attempt_times < FILE_LOAD_MAX_ATTEMPTS);
BRCMF_DBG(SDIO, "attempted %u times.", attempt_times);
if (bcmerror != ZX_OK)
goto err;
attempt_times = 0;
// Download nvram with retries.
do {
attempt_times++;
bcmerror = brcmf_sdio_download_nvram(bus, nvram, nvram_size_resized);
if (bcmerror == ZX_OK)
break;
BRCMF_ERR("nvram file download failed, %u retry attempts remaining.",
FILE_LOAD_MAX_ATTEMPTS - attempt_times);
} while (attempt_times < FILE_LOAD_MAX_ATTEMPTS);
BRCMF_DBG(SDIO, "attempted %u times.", attempt_times);
if (bcmerror != ZX_OK)
goto err;
/* Take arm out of reset */
if (!brcmf_chip_set_active(bus->ci, rstvec)) {
BRCMF_ERR("error getting out of ARM core reset");
goto err;
}
err:
brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
sdio_release_host(bus->sdiodev->func1);
return bcmerror;
}
static void brcmf_sdio_sr_init(struct brcmf_sdio* bus) {
zx_status_t err = ZX_OK;
uint8_t val;
BRCMF_DBG(TRACE, "Enter");
val = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
if (err != ZX_OK) {
BRCMF_ERR("error reading SBSDIO_FUNC1_WAKEUPCTRL");
return;
}
val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
if (err != ZX_OK) {
BRCMF_ERR("error writing SBSDIO_FUNC1_WAKEUPCTRL");
return;
}
/* Add CMD14 Support */
brcmf_sdiod_vendor_control_wb(
bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
(SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT | SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT), &err);
if (err != ZX_OK) {
BRCMF_ERR("error writing SDIO_CCCR_BRCM_CARDCAP");
return;
}
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, SBSDIO_FORCE_HT, &err);
if (err != ZX_OK) {
BRCMF_ERR("error writing SBSDIO_FUNC1_CHIPCLKCSR");
return;
}
/* set flag */
bus->sr_enabled = true;
BRCMF_DBG(INFO, "SR enabled");
}
/* enable KSO bit */
static zx_status_t brcmf_sdio_kso_init(struct brcmf_sdio* bus) {
struct brcmf_core* core = bus->sdio_core;
uint8_t val;
zx_status_t err = ZX_OK;
BRCMF_DBG(TRACE, "Enter");
/* KSO bit added in SDIO core rev 12 */
if (core->rev < 12) {
return ZX_OK;
}
val = brcmf_sdiod_func1_rb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
if (err != ZX_OK) {
BRCMF_ERR("error reading SBSDIO_FUNC1_SLEEPCSR");
return err;
}
if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, val, &err);
if (err != ZX_OK) {
BRCMF_ERR("error writing SBSDIO_FUNC1_SLEEPCSR");
return err;
}
}
return ZX_OK;
}
static zx_status_t brcmf_sdio_bus_preinit(brcmf_bus* bus_if) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
struct brcmf_core* core = bus->sdio_core;
uint32_t value;
zx_status_t err;
/* the commands below use the terms tx and rx from
* a device perspective, ie. bus:txglom affects the
* bus transfers from device to host.
*/
if (core->rev < 12) {
/* for sdio core rev < 12, disable txgloming */
value = 0;
err = brcmf_iovar_data_set(sdiodev->drvr, "bus:txglom", &value, sizeof(uint32_t), nullptr);
} else {
/* otherwise, set txglomalign */
value = sdiodev->settings->bus.sdio->sd_sgentry_align;
/* SDIO ADMA requires at least 32 bit alignment */
value = std::max<uint32_t>(value, DMA_ALIGNMENT);
err = brcmf_iovar_data_set(sdiodev->drvr, "bus:txglomalign", &value, sizeof(uint32_t), nullptr);
}
// No support for txglomming, requires SDIO scatter/gather support (see fxbug.dev/29502)
if (err != ZX_OK) {
goto done;
}
bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
brcmf_bus_add_txhdrlen(sdiodev->drvr, bus->tx_hdrlen);
bus_if->always_use_fws_queue = false;
done:
return err;
}
void brcmf_sdio_trigger_dpc(struct brcmf_sdio* bus) {
if (!bus->dpc_triggered.load()) {
bus->dpc_triggered.store(true);
bus->brcmf_wq->Schedule(&bus->datawork);
}
}
void brcmf_sdio_isr(struct brcmf_sdio* bus) {
BRCMF_DBG(TRACE, "Enter");
if (!bus) {
BRCMF_ERR("bus is null pointer, exiting");
return;
}
/* Count the interrupt call */
bus->sdcnt.intrcount++;
if (brcmf_sdio_intr_rstatus(bus) != ZX_OK) {
BRCMF_ERR("failed backplane access");
}
/* Disable additional interrupts (is this needed now)? */
if (!bus->intr) {
BRCMF_ERR("isr w/o interrupt configured!");
}
bus->dpc_triggered.store(true);
bus->brcmf_wq->Schedule(&bus->datawork);
}
void brcmf_sdio_event_handler(struct brcmf_sdio* bus);
static void brcmf_sdio_bus_watchdog(struct brcmf_sdio* bus) {
BRCMF_DBG(TIMER, "Enter");
/* Poll period: check device if appropriate. */
if (!bus->sr_enabled && bus->poll && (++bus->polltick >= bus->pollrate)) {
bool intstatus = false;
/* Reset poll tick */
bus->polltick = 0;
/* Check device if no interrupts */
if (!bus->intr || (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
if (!bus->dpc_triggered.load()) {
bool func1_pend;
bool func2_pend;
sdio_claim_host(bus->sdiodev->func1);
sdio_intr_pending(&bus->sdiodev->sdio_proto_fn1, &func1_pend);
sdio_intr_pending(&bus->sdiodev->sdio_proto_fn2, &func2_pend);
sdio_release_host(bus->sdiodev->func1);
intstatus = func1_pend || func2_pend;
}
/* If there is something, make like the ISR and
schedule the DPC. */
if (intstatus) {
bus->sdcnt.pollcnt++;
bus->ipend.store(1);
bus->dpc_triggered.store(true);
bus->brcmf_wq->Schedule(&bus->datawork);
}
}
/* Update interrupt tracking */
bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
}
#if !defined(NDEBUG)
/* Poll for console output periodically */
// This was the original check. But for some reason sdiodev->state never gets set to
// BRCMF_SDIOD_DATA. Need to investiage TODO(fxbug.dev/36618)
// (bus->sdiodev->state == BRCMF_SDIOD_DATA && BRCMF_IS_ON(FWCON) && bus->console_interval != 0)
if (BRCMF_IS_ON(FWCON) && bus->console_interval != 0) {
bus->console.count += BRCMF_WD_POLL_MSEC;
if (bus->console.count >= bus->console_interval) {
bus->console.count -= bus->console_interval;
sdio_claim_host(bus->sdiodev->func1);
/* Make sure backplane clock is on */
brcmf_sdio_bus_sleep(bus, false, false);
if (brcmf_sdio_readconsole(bus) != ZX_OK) { /* stop on error */
bus->console_interval = 0;
}
sdio_release_host(bus->sdiodev->func1);
}
}
#endif /* !defined(NDEBUG) */
// TODO(cphoenix): Turn "idle" back on once things are working, and see if anything breaks.
#ifdef TEMP_DISABLE_DO_IDLE
/* On idle timeout clear activity flag and/or turn off clock */
if (!bus->dpc_triggered.load()) {
std::atomic_thread_fence(std::memory_order_seq_cst);
if ((!bus->dpc_running) && (bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
bus->idlecount++;
if (bus->idlecount > bus->idletime) {
BRCMF_DBG(SDIO, "idle");
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_wd_timer(bus, false);
bus->idlecount = 0;
brcmf_sdio_bus_sleep(bus, true, false);
sdio_release_host(bus->sdiodev->func1);
}
} else {
bus->idlecount = 0;
}
} else {
bus->idlecount = 0;
}
#endif // TEMP_DISABLE_DO_IDLE
}
void brcmf_sdio_event_handler(struct brcmf_sdio* bus) {
bus->dpc_running = true;
std::atomic_thread_fence(std::memory_order_seq_cst);
while (bus->dpc_triggered.load()) {
bus->dpc_triggered.store(false);
brcmf_sdio_dpc(bus);
bus->idlecount = 0;
}
bus->dpc_running = false;
}
static void brcmf_sdio_dataworker(WorkItem* work) {
struct brcmf_sdio* bus = containerof(work, struct brcmf_sdio, datawork);
// Lock here so that everything inside brcmf_sdio_event_handlers is protected.
// This is to ensure that the event handler is only called from either the
// workqueue or the interrupt thread. This is a little heavy-handed so there
// is probably room for improvement here. Running without this lock will
// eventually result in the driver failing though.
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_event_handler(bus);
sdio_release_host(bus->sdiodev->func1);
}
zx_status_t brcmf_sdio_load_files(brcmf_pub* drvr, bool reload) TA_NO_THREAD_SAFETY_ANALYSIS {
zx_status_t status = ZX_OK;
brcmf_bus* bus_if = drvr->bus_if;
std::string firmware_binary;
if ((status = wlan::brcmfmac::GetFirmwareBinary(
drvr->device, brcmf_bus_type::BRCMF_BUS_TYPE_SDIO,
static_cast<wlan::brcmfmac::CommonCoreId>(bus_if->chip), bus_if->chiprev,
&firmware_binary)) != ZX_OK) {
BRCMF_ERR("Load firmware binary failed, error: %s\n", zx_status_get_string(status));
if (reload)
drvr->fw_reloading.unlock();
return status;
}
const size_t padded_size_firmware = ZX_ROUNDUP(firmware_binary.size(), SDIOD_SIZE_ALIGNMENT);
firmware_binary.resize(padded_size_firmware, '\0');
std::string nvram_binary;
if ((status =
wlan::brcmfmac::GetNvramBinary(drvr->device, brcmf_bus_type::BRCMF_BUS_TYPE_SDIO,
static_cast<wlan::brcmfmac::CommonCoreId>(bus_if->chip),
bus_if->chiprev, &nvram_binary)) != ZX_OK) {
BRCMF_ERR("Load nvram binary failed, error: %s\n", zx_status_get_string(status));
if (reload)
drvr->fw_reloading.unlock();
return status;
}
const size_t padded_size_nvram = ZX_ROUNDUP(nvram_binary.size(), SDIOD_SIZE_ALIGNMENT);
nvram_binary.resize(padded_size_nvram, '\0');
if (firmware_binary.size() > std::numeric_limits<uint32_t>::max()) {
BRCMF_ERR("Firmware binary size too large");
if (reload)
drvr->fw_reloading.unlock();
return ZX_ERR_INTERNAL;
}
if ((status = brcmf_sdio_firmware_callback(drvr, firmware_binary.data(), firmware_binary.size(),
nvram_binary.data(), nvram_binary.size())) != ZX_OK) {
BRCMF_ERR("Load nvram binary failed, error: %s\n", zx_status_get_string(status));
if (reload)
drvr->fw_reloading.unlock();
return status;
}
std::string clm_binary;
if ((status =
wlan::brcmfmac::GetClmBinary(drvr->device, brcmf_bus_type::BRCMF_BUS_TYPE_SDIO,
static_cast<wlan::brcmfmac::CommonCoreId>(bus_if->chip),
bus_if->chiprev, &clm_binary)) != ZX_OK) {
BRCMF_ERR("Load CLM binary failed, error: %s\n", zx_status_get_string(status));
if (reload)
drvr->fw_reloading.unlock();
return status;
}
// Unlock firmware reload lock after reloading the firmware or in other failure branches above if
// it's a reload.
if (reload)
drvr->fw_reloading.unlock();
// The firmware IOVAR accesses to upload the CLM blob are always on ifidx 0, so we stub out an
// appropriate brcmf_if instance here.
brcmf_if ifp = {};
ifp.drvr = drvr;
ifp.ifidx = 0;
if ((status = brcmf_c_process_clm_blob(&ifp, clm_binary)) != ZX_OK) {
BRCMF_ERR("Process clm blob fail.\n");
return status;
}
return ZX_OK;
}
zx_status_t brcmf_sdio_recovery(struct brcmf_bus* bus) TA_NO_THREAD_SAFETY_ANALYSIS {
struct brcmf_sdio_dev* sdiod = bus->bus_priv.sdio;
struct brcmf_pub* drvr = sdiod->drvr;
zx_status_t error = ZX_OK;
// Lock the firmware reload mutex for this function so that no interrupt will be handled in
// the middle of it.
drvr->fw_reloading.lock();
// Close sdiod, so that no more data operation can proceed during during firmware reload.
brcmf_sdiod_change_state(sdiod, BRCMF_SDIOD_DOWN);
// Sdio clean-ups
brcmf_sdio_reset(sdiod->bus);
if ((error = brcmf_sdio_load_files(drvr, true)) != ZX_OK) {
BRCMF_ERR("Failed to reload images - error: %s", zx_status_get_string(error));
brcmf_proto_bcdc_detach(drvr);
return error;
}
if ((error = brcmf_bus_started(sdiod->drvr, true)) != ZX_OK) {
BRCMF_ERR("Initialization after bus started failed.\n");
brcmf_proto_bcdc_detach(drvr);
return error;
}
return ZX_OK;
}
void brcmf_sdio_log_stats(struct brcmf_bus* bus_if) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
zxlogf(INFO,
"SDIO bus stats: FC: %x FC_ChangeCnt: %u TxSeq: %u TxMax: %u TxCtlCnt: %lu TxCtlErr: %lu,"
" RxCtlCnt: %lu, RxCtlErr: %lu, Intrs: %u, HdrRead: %u, PktReads: %u, PktWrites: %u",
bus->flowcontrol, bus->sdcnt.fc_rcvd, bus->tx_seq, bus->tx_max, bus->sdcnt.tx_ctlpkts,
bus->sdcnt.tx_ctlerrs, bus->sdcnt.rx_ctlpkts, bus->sdcnt.rx_ctlerrs, bus->sdcnt.intrcount,
bus->sdcnt.f2rxhdrs, bus->sdcnt.f2rxdata, bus->sdcnt.f2txdata);
zxlogf(INFO,
"SDIO txq stats: EnqueueCnt: %u QFullCnt: %u QLen: %u PerPrecLen [0]: %u [1]: %u [2]: %u "
"[3]: %u",
pktq_enq_cnt(&bus->txq), bus->sdcnt.tx_qfull, pktq_len(&bus->txq), pktq_plen(&bus->txq, 0),
pktq_plen(&bus->txq, 1), pktq_plen(&bus->txq, 2), pktq_plen(&bus->txq, 3));
}
int brcmf_sdio_oob_irqhandler(void* cookie) {
struct brcmf_sdio_dev* sdiodev = static_cast<decltype(sdiodev)>(cookie);
struct brcmf_sdio* bus = sdiodev->bus;
zx_status_t status;
uint32_t intstatus;
while ((status = zx_interrupt_wait(sdiodev->irq_handle, NULL)) == ZX_OK) {
bus->sdcnt.intrcount++;
// Sleep the interrupt handling when reloading the firmware to reduce the chaos in driver caused
// by queued interrupts.
std::lock_guard<std::mutex> guard(sdiodev->drvr->fw_reloading);
BRCMF_DBG_THROTTLE(INTR, "OOB intr triggered");
sdio_claim_host(sdiodev->func1);
if (brcmf_sdio_intr_rstatus(sdiodev->bus)) {
BRCMF_ERR("failed backplane access");
}
intstatus = sdiodev->bus->intstatus.load();
sdiodev->bus->dpc_triggered.store(true);
brcmf_sdio_event_handler(sdiodev->bus);
sdio_release_host(sdiodev->func1);
if (intstatus == 0) {
BRCMF_DBG_THROTTLE(TEMP, "Zero intstatus; pausing 5 msec");
zx_nanosleep(zx_deadline_after(ZX_MSEC(5)));
}
BRCMF_DBG_THROTTLE(INTR, "Done with OOB intr");
}
BRCMF_ERR("ISR exiting with status %s", zx_status_get_string(status));
return (int)status;
}
static void brcmf_sdio_drivestrengthinit(struct brcmf_sdio_dev* sdiodev, struct brcmf_chip* ci,
uint32_t drivestrength) {
const struct sdiod_drive_str* str_tab = NULL;
uint32_t str_mask;
uint32_t str_shift;
uint32_t i;
uint32_t drivestrength_sel = 0;
uint32_t cc_data_temp;
uint32_t addr;
if (!(ci->cc_caps & CC_CAP_PMU)) {
return;
}
switch (SDIOD_DRVSTR_KEY(ci->chip, ci->pmurev)) {
case SDIOD_DRVSTR_KEY(BRCM_CC_4330_CHIP_ID, 12):
str_tab = sdiod_drvstr_tab1_1v8;
str_mask = 0x00003800;
str_shift = 11;
break;
case SDIOD_DRVSTR_KEY(BRCM_CC_4334_CHIP_ID, 17):
str_tab = sdiod_drvstr_tab6_1v8;
str_mask = 0x00001800;
str_shift = 11;
break;
case SDIOD_DRVSTR_KEY(BRCM_CC_43143_CHIP_ID, 17):
/* note: 43143 does not support tristate */
i = countof(sdiod_drvstr_tab2_3v3) - 1;
if (drivestrength >= sdiod_drvstr_tab2_3v3[i].strength) {
str_tab = sdiod_drvstr_tab2_3v3;
str_mask = 0x00000007;
str_shift = 0;
} else
BRCMF_ERR("Invalid SDIO Drive strength for chip %s, strength=%d", ci->name, drivestrength);
break;
case SDIOD_DRVSTR_KEY(BRCM_CC_43362_CHIP_ID, 13):
str_tab = sdiod_drive_strength_tab5_1v8;
str_mask = 0x00003800;
str_shift = 11;
break;
default:
BRCMF_DBG(INFO, "No SDIO driver strength init needed for chip %s rev %d pmurev %d", ci->name,
ci->chiprev, ci->pmurev);
break;
}
if (str_tab != NULL) {
struct brcmf_core* pmu = brcmf_chip_get_pmu(ci);
for (i = 0; str_tab[i].strength != 0; i++) {
if (drivestrength >= str_tab[i].strength) {
drivestrength_sel = str_tab[i].sel;
break;
}
}
addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
brcmf_sdiod_func1_wl(sdiodev, addr, 1, NULL);
cc_data_temp = brcmf_sdiod_func1_rl(sdiodev, addr, NULL);
cc_data_temp &= ~str_mask;
drivestrength_sel <<= str_shift;
cc_data_temp |= drivestrength_sel;
brcmf_sdiod_func1_wl(sdiodev, addr, cc_data_temp, NULL);
BRCMF_DBG(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x",
str_tab[i].strength, drivestrength, cc_data_temp);
}
}
static zx_status_t brcmf_sdio_buscoreprep(void* ctx) {
struct brcmf_sdio_dev* sdiodev = static_cast<decltype(sdiodev)>(ctx);
zx_status_t err = ZX_OK;
uint8_t clkval, clkset;
/* Try forcing SDIO core to do ALPAvail request only */
clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
if (err != ZX_OK) {
BRCMF_ERR("error writing for HT off");
return err;
}
/* If register supported, wait for ALPAvail and then force ALP */
/* This may take up to 15 milliseconds */
clkval = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
if ((clkval & ~SBSDIO_AVBITS) != clkset) {
BRCMF_ERR("ChipClkCSR access: wrote 0x%02x read 0x%02x", clkset, clkval);
return ZX_ERR_IO_REFUSED;
}
SPINWAIT(((clkval = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
!SBSDIO_ALPAV(clkval)),
PMU_MAX_TRANSITION_DLY_USEC);
if (!SBSDIO_ALPAV(clkval)) {
BRCMF_ERR("timeout on ALPAV wait, clkval 0x%02x", clkval);
return ZX_ERR_SHOULD_WAIT;
}
clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
zx_nanosleep(zx_deadline_after(ZX_USEC(65)));
/* Also, disable the extra SDIO pull-ups */
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
return ZX_OK;
}
static void brcmf_sdio_buscore_activate(void* ctx, struct brcmf_chip* chip, uint32_t rstvec) {
struct brcmf_sdio_dev* sdiodev = static_cast<decltype(sdiodev)>(ctx);
struct brcmf_core* core = sdiodev->bus->sdio_core;
uint32_t reg_addr;
/* clear all interrupts */
reg_addr = core->base + SD_REG(intstatus);
brcmf_sdiod_func1_wl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
if (rstvec) { /* Write reset vector to address 0 */
brcmf_sdiod_ramrw(sdiodev, true, 0, (void*)&rstvec, sizeof(rstvec));
}
}
static uint32_t brcmf_sdio_buscore_read32(void* ctx, uint32_t addr) {
struct brcmf_sdio_dev* sdiodev = static_cast<decltype(sdiodev)>(ctx);
uint32_t val, rev;
val = brcmf_sdiod_func1_rl(sdiodev, addr, NULL);
/*
* this is a bit of special handling if reading the chipcommon chipid
* register. The 4339 is a next-gen of the 4335. It uses the same
* SDIO device id as 4335 and the chipid register returns 4335 as well.
* It can be identified as 4339 by looking at the chip revision. It
* is corrected here so the chip.c module has the right info.
*/
if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
(sdiodev->product_id == SDIO_DEVICE_ID_BROADCOM_4339 ||
sdiodev->product_id == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
if (rev >= 2) {
val &= ~CID_ID_MASK;
val |= BRCM_CC_4339_CHIP_ID;
}
}
return val;
}
static void brcmf_sdio_buscore_write32(void* ctx, uint32_t addr, uint32_t val) {
struct brcmf_sdio_dev* sdiodev = static_cast<decltype(sdiodev)>(ctx);
brcmf_sdiod_func1_wl(sdiodev, addr, val, NULL);
}
static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
.read32 = brcmf_sdio_buscore_read32,
.write32 = brcmf_sdio_buscore_write32,
.prepare = brcmf_sdio_buscoreprep,
.activate = brcmf_sdio_buscore_activate,
};
// This will wait, then dump out all SDIO transactions to date.
#ifdef SDIO_PRINTER
thrd_t sdio_thread;
static int sdio_printer(void* foo) {
BRCMF_DBG(TEMP, "SDIO printer started");
zx_nanosleep(zx_deadline_after(ZX_SEC(10000000)));
psr();
return 0;
}
#endif // SDIO_PRINTER
static zx_status_t brcmf_sdio_probe_attach(struct brcmf_sdio* bus) {
struct brcmf_sdio_dev* sdiodev;
uint8_t clkctl = 0;
zx_status_t err = ZX_OK;
int reg_addr;
uint32_t reg_val;
uint32_t drivestrength;
brcmf_mp_device* settings = nullptr;
brcmf_sdio_pd* sdio_settings = nullptr;
sdiodev = bus->sdiodev;
sdio_claim_host(sdiodev->func1);
#ifdef SDIO_PRINTER
int status = thrd_create_with_name(&sdio_thread, &sdio_printer, nullptr, "sdio_printer");
if (status != thrd_success) {
BRCMF_ERR("Unable to create sdio_printer thread: %d" < status);
goto fail;
}
#endif // SDIO_PRINTER
BRCMF_DBG(INFO, "brcmfmac: F1 signature read @0x18000000=0x%4x",
brcmf_sdiod_func1_rl(sdiodev, SI_ENUM_BASE, NULL));
BRCMF_DBG(TEMP, "Survived signature read");
/*
* Force PLL off until brcmf_chip_attach()
* programs PLL control regs
*/
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, BRCMF_INIT_CLKCTL1, &err);
if (err == ZX_OK) {
clkctl = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
}
if (err != ZX_OK || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
BRCMF_ERR("ChipClkCSR access: err %s wrote 0x%02x read 0x%02x", zx_status_get_string(err),
BRCMF_INIT_CLKCTL1, clkctl);
goto fail;
}
err = brcmf_chip_attach(sdiodev, &brcmf_sdio_buscore_ops, &bus->ci);
if (err != ZX_OK) {
BRCMF_ERR("brcmf_chip_attach failed: %s", zx_status_get_string(err));
bus->ci = NULL;
goto fail;
}
/* Pick up the SDIO core info struct from chip.c */
bus->sdio_core = brcmf_chip_get_core(bus->ci, CHIPSET_SDIO_DEV_CORE);
if (!bus->sdio_core) {
BRCMF_ERR("call to brcmf_chip_get_core (SDIO_DEV_CORE) failed");
err = ZX_ERR_INTERNAL;
goto fail;
}
/* Pick up the CHIPCOMMON core info struct, for bulk IO in bcmsdh.c */
sdiodev->cc_core = brcmf_chip_get_core(bus->ci, CHIPSET_CHIPCOMMON_CORE);
if (!sdiodev->cc_core) {
BRCMF_ERR("call to brcmf_chip_get_core (CHIPCOMMON_CORE) failed");
err = ZX_ERR_INTERNAL;
goto fail;
}
settings = static_cast<decltype(settings)>(calloc(1, sizeof(*settings)));
if (!settings) {
BRCMF_ERR("failed to allocate device parameters");
err = ZX_ERR_NO_MEMORY;
goto fail;
}
brcmf_get_module_param(BRCMF_BUS_TYPE_SDIO, bus->ci->chip, bus->ci->chiprev, settings);
sdiodev->settings = settings;
sdio_settings = static_cast<decltype(sdio_settings)>(calloc(1, sizeof(*sdio_settings)));
if (!sdio_settings) {
BRCMF_ERR("failed to allocate SDIO parameters");
err = ZX_ERR_NO_MEMORY;
goto fail;
}
// TODO(cphoenix): Do we really want to use default? (If so, delete =0 lines because calloc)
sdio_settings->sd_sgentry_align = 0; // Use default
sdio_settings->sd_head_align = 0; // Use default
sdio_settings->drive_strength = 0; // Use default
sdio_settings->oob_irq_supported = true; // TODO(cphoenix): Always?
sdiodev->settings->bus.sdio = sdio_settings;
/* platform specific configuration:
* alignments must be at least 4 bytes for ADMA
*/
bus->head_align = DMA_ALIGNMENT;
bus->sgentry_align = DMA_ALIGNMENT;
if (sdiodev->settings->bus.sdio->sd_head_align > DMA_ALIGNMENT) {
if (sdiodev->settings->bus.sdio->sd_head_align > std::numeric_limits<uint16_t>::max()) {
BRCMF_ERR("brcmf_sdio_probe_attach error: sd_head_align invalid (overflow)");
err = ZX_ERR_INTERNAL;
goto fail;
}
bus->head_align = static_cast<uint16_t>(sdiodev->settings->bus.sdio->sd_head_align);
}
if (sdiodev->settings->bus.sdio->sd_sgentry_align > DMA_ALIGNMENT) {
if (sdiodev->settings->bus.sdio->sd_sgentry_align > std::numeric_limits<uint8_t>::max()) {
BRCMF_ERR("brcmf_sdio_probe_attach error: sgentry_align invalid (overflow)");
err = ZX_ERR_INTERNAL;
goto fail;
}
bus->sgentry_align = static_cast<uint16_t>(sdiodev->settings->bus.sdio->sd_sgentry_align);
}
err = brcmf_sdio_kso_init(bus);
if (err != ZX_OK) {
BRCMF_ERR("error enabling KSO: %s", zx_status_get_string(err));
goto fail;
}
if (sdiodev->settings->bus.sdio->drive_strength) {
drivestrength = sdiodev->settings->bus.sdio->drive_strength;
} else {
drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
}
brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
/* Set card control so an SDIO card reset does a WLAN backplane reset */
reg_val = brcmf_sdiod_vendor_control_rb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
if (err != ZX_OK) {
BRCMF_ERR("vendor_control_rb failed: %s", zx_status_get_string(err));
goto fail;
}
reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
if (reg_val > std::numeric_limits<uint8_t>::max()) {
BRCMF_ERR("vendor_control_wb cannot be called: reg_val invalid (overflow)");
err = ZX_ERR_INTERNAL;
goto fail;
}
brcmf_sdiod_vendor_control_wb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, static_cast<uint8_t>(reg_val),
&err);
if (err != ZX_OK) {
BRCMF_ERR("vendor_control_wb failed: %s", zx_status_get_string(err));
goto fail;
}
/* set PMUControl so a backplane reset does PMU state reload */
reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
reg_val = brcmf_sdiod_func1_rl(sdiodev, reg_addr, &err);
if (err != ZX_OK) {
BRCMF_ERR("func1_rl failed: %s", zx_status_get_string(err));
goto fail;
}
reg_val |= (BC_CORE_POWER_CONTROL_RELOAD << BC_CORE_POWER_CONTROL_SHIFT);
brcmf_sdiod_func1_wl(sdiodev, reg_addr, reg_val, &err);
if (err != ZX_OK) {
BRCMF_ERR("func1_wl failed: %s", zx_status_get_string(err));
goto fail;
}
sdio_release_host(sdiodev->func1);
brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
/* allocate header buffer */
bus->hdrbuf = static_cast<decltype(bus->hdrbuf)>(calloc(1, MAX_HDR_READ + bus->head_align));
if (!bus->hdrbuf) {
BRCMF_ERR("failed to allocate memory for SDIO hdrbuf");
// Don't go to 'fail' here because we've already released the host
return ZX_ERR_NO_MEMORY;
}
/* Locate an appropriately-aligned portion of hdrbuf */
bus->rxhdr = (uint8_t*)roundup((unsigned long)&bus->hdrbuf[0], bus->head_align);
/* Set the poll and/or interrupt flags */
bus->intr = true;
bus->poll = false;
if (bus->poll) {
bus->pollrate = 1;
}
BRCMF_DBG(TEMP, "Exit");
ZX_DEBUG_ASSERT(err == ZX_OK);
#if !defined(NDEBUG)
if (BRCMF_IS_ON(FWCON)) {
bus->console_interval = BRCMF_CONSOLE_INTERVAL;
}
#endif
return err;
fail:
sdio_release_host(sdiodev->func1);
BRCMF_DBG(TEMP, "* * FAIL");
return err;
}
static int brcmf_sdio_watchdog_thread(void* data) {
struct brcmf_sdio* bus = (struct brcmf_sdio*)data;
/* Run until signal received */
while (1) {
if (bus->watchdog_should_stop.load()) {
break;
}
// Wait for watchdog signal
sync_completion_wait(&bus->watchdog_wait, ZX_TIME_INFINITE);
if (bus->wd_active.load()) {
brcmf_sdio_bus_watchdog(bus);
}
/* Count the tick for reference */
bus->sdcnt.tickcnt++;
sync_completion_reset(&bus->watchdog_wait);
}
return 0;
}
static void brcmf_sdio_watchdog(struct brcmf_sdio* bus) {
bus->sdiodev->drvr->irq_callback_lock.lock();
if (bus->watchdog_tsk) {
// Signal watchdog
sync_completion_signal(&bus->watchdog_wait);
/* Reschedule the watchdog */
if (bus->wd_active.load()) {
bus->timer->Start(ZX_MSEC(BRCMF_WD_POLL_MSEC));
}
}
bus->sdiodev->drvr->irq_callback_lock.unlock();
}
static zx_status_t brcmf_get_wifi_metadata(brcmf_bus* bus_if, void* data, size_t exp_size,
size_t* actual) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
return sdiodev->drvr->device->DeviceGetMetadata(DEVICE_METADATA_WIFI_CONFIG, data, exp_size,
actual);
}
static zx_status_t brcmf_sdio_get_bootloader_macaddr(brcmf_bus* bus_if, uint8_t* mac_addr) {
struct brcmf_sdio_dev* sdiodev = bus_if->bus_priv.sdio;
static uint8_t bootloader_macaddr[ETH_ALEN];
static bool memoized = false;
zx_status_t status;
if (!memoized) {
status = brcmf_sdiod_get_bootloader_macaddr(sdiodev, bootloader_macaddr);
if (status != ZX_OK) {
return status;
}
memoized = true;
}
memcpy(mac_addr, bootloader_macaddr, sizeof(bootloader_macaddr));
return ZX_OK;
}
static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
.get_bus_type = []() { return BRCMF_BUS_TYPE_SDIO; },
.get_bootloader_macaddr = brcmf_sdio_get_bootloader_macaddr,
.get_wifi_metadata = brcmf_get_wifi_metadata,
.preinit = brcmf_sdio_bus_preinit,
.stop = brcmf_sdio_bus_stop,
.txdata = brcmf_sdio_bus_txdata,
.txctl = brcmf_sdio_bus_txctl,
.rxctl = brcmf_sdio_bus_rxctl,
.gettxq = brcmf_sdio_bus_gettxq,
.flush_txq = brcmf_sdio_bus_flush_txq,
.recovery = brcmf_sdio_recovery,
.log_stats = brcmf_sdio_log_stats,
};
zx_status_t brcmf_sdio_firmware_callback(brcmf_pub* drvr, const void* firmware,
size_t firmware_size, const void* nvram,
size_t nvram_size) {
zx_status_t err = ZX_OK;
struct brcmf_sdio_dev* sdiodev = drvr->bus_if->bus_priv.sdio;
struct brcmf_sdio* bus = sdiodev->bus;
struct brcmf_sdio_dev* sdiod = bus->sdiodev;
struct brcmf_core* core = bus->sdio_core;
struct sdpcm_shared sh = {};
uint8_t saveclk = 0;
BRCMF_DBG(TRACE, "Enter:");
if (err != ZX_OK) {
goto fail;
}
/* try to download image and nvram to the dongle */
bus->alp_only = true;
err = brcmf_sdio_download_firmware(bus, firmware, firmware_size, nvram, nvram_size);
if (err != ZX_OK) {
goto fail;
}
bus->alp_only = false;
/* Start the watchdog timer */
bus->sdcnt.tickcnt = 0;
// TODO(fxbug.dev/29365): This call apparently has no effect because the state isn't
// BRCMF_SDIOD_DATA. This was in the original driver. Once interrupts are working, figure out
// what's going on.
brcmf_sdio_wd_timer(bus, true);
// Magic 200 ms pause here, because 100ms worked in the hard-coded debug recipe.
// In addition, Broadcom said that a pause after booting may be necessary.
// The original Linux driver doesn't have it, but I don't recommend removing this
// without LOTS of stress testing.
zx_nanosleep(zx_deadline_after(ZX_MSEC(200)));
sdio_claim_host(sdiodev->func1);
/* Make sure backplane clock is on, needed to generate F2 interrupt */
bus->clkstate = CLK_NONE; // TODO(cphoenix): TEMP FOR DEBUG
brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
if (bus->clkstate != CLK_AVAIL) {
BRCMF_ERR("Bad clockstate %d, should be %d", bus->clkstate, CLK_AVAIL);
err = ZX_ERR_INTERNAL;
goto release;
}
/* Force clocks on backplane to be sure F2 interrupt propagates */
saveclk = brcmf_sdiod_func1_rb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
if (err == ZX_OK) {
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, (saveclk | SBSDIO_FORCE_HT), &err);
}
if (err != ZX_OK) {
BRCMF_ERR("Failed to force clock for F2: err %s", zx_status_get_string(err));
goto release;
}
/* Enable function 2 (frame transfers) */
brcmf_sdiod_func1_wl(sdiod, core->base + SD_REG(tosbmailboxdata),
SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
err = sdio_enable_fn(&sdiodev->sdio_proto_fn2);
BRCMF_DBG(INFO, "enable F2: err=%d", err);
/* If F2 successfully enabled, set core and enable interrupts */
if (err == ZX_OK) {
/* Set up the interrupt mask and enable interrupts */
bus->hostintmask = HOSTINTMASK;
brcmf_sdiod_func1_wl(sdiod, core->base + SD_REG(hostintmask), bus->hostintmask, NULL);
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_WATERMARK, 8, &err);
} else {
/* Disable F2 again */
sdio_disable_fn(&sdiodev->sdio_proto_fn2);
goto release;
}
if (brcmf_chip_sr_capable(bus->ci)) {
BRCMF_DBG(TEMP, "About to sr_init() (after 100 msec pause)");
PAUSE;
PAUSE;
brcmf_sdio_sr_init(bus);
PAUSE;
PAUSE;
BRCMF_DBG(TEMP, "Did sr_init() (100 msec ago)");
} else {
/* Restore previous clock setting */
brcmf_sdiod_func1_wb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
}
err = brcmf_sdio_shared_read(bus, &sh);
BRCMF_DBG(TEMP, "Read shared returned %d", err);
#if !defined(NDEBUG)
bus->console_addr = sh.console_addr;
BRCMF_DBG(TEMP, "console_addr 0x%x", bus->console_addr);
brcmf_sdio_readconsole(bus);
BRCMF_DBG(TEMP, "Should have seen readconsole output");
#endif // !defined(NDEBUG)
if (err == ZX_OK) {
/* Allow full data communication using DPC from now on. */
brcmf_sdiod_change_state(sdiod, BRCMF_SDIOD_DATA);
// TODO(fxbug.dev/29365): The next line was added to enable watchdog to take effect immediately,
// since it currently handles all interrupt conditions. This may or may not make the
// previous call to brcmf_sdio_wd_timer() unnecessary; that call apparently had no effect
// because the state wasn't BRCMF_SDIOD_DATA yet. Once interrupts are working, revisit
// and figure out this logic.
brcmf_sdio_wd_timer(bus, true);
// brcmf_sdiod_intr_register() creates the interrupt thread and enables the sdio interrupt
// through sdio proto, so it can be skipped while doing crash recovery.
if (bus->sdiodev->drvr->fw_reloading.try_lock()) {
err = brcmf_sdiod_intr_register(sdiodev);
if (err != ZX_OK) {
BRCMF_ERR("intr register failed:%d", err);
}
bus->sdiodev->drvr->fw_reloading.unlock();
}
}
/* If we didn't come up, turn off backplane clock */
if (err != ZX_OK) {
BRCMF_ERR("Err %d on register OOB IRQ", err);
brcmf_sdio_clkctl(bus, CLK_NONE, false);
}
sdio_release_host(sdiodev->func1);
zx_nanosleep(zx_deadline_after(ZX_MSEC(100)));
return ZX_OK;
release:
sdio_release_host(sdiodev->func1);
fail:
BRCMF_DBG(TRACE, "failed: err=%d", err);
BRCMF_ERR("Need to implement driver release logic (fxbug.dev/29508)");
// TODO(fxbug.dev/29508)
// device_release_driver(&sdiodev->func2->dev);
// device_release_driver(dev);
return err;
}
struct brcmf_sdio* brcmf_sdio_probe(struct brcmf_sdio_dev* sdiodev) {
zx_status_t ret;
int thread_result;
struct brcmf_sdio* bus;
WorkQueue* wq;
BRCMF_DBG(TRACE, "Enter");
/* Allocate private bus interface state */
bus = static_cast<decltype(bus)>(calloc(1, sizeof(struct brcmf_sdio)));
if (!bus) {
goto fail;
}
bus->sdiodev = sdiodev;
sdiodev->bus = bus;
brcmf_netbuf_list_init(&bus->glom);
bus->txbound = BRCMF_TXBOUND;
bus->rxbound = BRCMF_RXBOUND;
bus->txminmax = BRCMF_TXMINMAX;
bus->tx_seq = SDPCM_SEQ_WRAP - 1;
/* single-threaded workqueue */
char name[WorkQueue::kWorkqueueNameMaxlen];
static int queue_uniquify = 0;
snprintf(name, WorkQueue::kWorkqueueNameMaxlen, "brcmf_wq/%d", queue_uniquify++);
wq = new WorkQueue(name);
if (!wq) {
BRCMF_ERR("insufficient memory to create txworkqueue");
goto fail;
}
bus->datawork = WorkItem(brcmf_sdio_dataworker);
bus->brcmf_wq = wq;
/* attempt to attach to the dongle */
ret = brcmf_sdio_probe_attach(bus);
if (ret != ZX_OK) {
BRCMF_ERR("brcmf_sdio_probe_attach failed: %s", zx_status_get_string(ret));
goto fail;
}
// spin_lock_init(&bus->rxctl_lock);
// spin_lock_init(&bus->txq_lock);
bus->ctrl_wait = {};
bus->dcmd_resp_wait = {};
/* Initialize watchdog thread */
bus->watchdog_wait = {};
bus->watchdog_should_stop.store(false);
thread_result =
thrd_create_with_name(&bus->watchdog_tsk, &brcmf_sdio_watchdog_thread, bus, "brcmf-watchdog");
if (thread_result != thrd_success) {
BRCMF_ERR("brcmf_watchdog thread failed to start: error %d", thread_result);
bus->watchdog_tsk = 0;
}
/* Initialize DPC thread */
bus->dpc_triggered.store(false);
bus->dpc_running = false;
/* Assign bus interface call back */
bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
bus->sdiodev->bus_if->chip = bus->ci->chip;
bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
/* default sdio bus header length for tx packet */
bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
/* Attach to the common layer, reserve hdr space */
bus->sdiodev->drvr->bus_if = bus->sdiodev->bus_if;
bus->sdiodev->drvr->settings = bus->sdiodev->settings;
/* Set up the watchdog timer */
bus->timer = new Timer(bus->sdiodev->drvr->device->GetDispatcher(),
std::bind(brcmf_sdio_watchdog, bus), false);
ret = brcmf_attach(bus->sdiodev->drvr);
if (ret != ZX_OK) {
BRCMF_ERR("brcmf_attach failed");
goto fail;
}
/* Attach and link in the protocol */
ret = brcmf_proto_bcdc_attach(sdiodev->drvr);
if (ret != ZX_OK) {
BRCMF_ERR("brcmf_proto_bcdc_attach failed: %s", zx_status_get_string(ret));
goto fail;
}
/* Query the F2 block size, set roundup accordingly */
sdio_get_block_size(&sdiodev->sdio_proto_fn2, &bus->blocksize);
bus->roundup = std::min(max_roundup, bus->blocksize);
/* Allocate buffers */
if (bus->sdiodev->bus_if->maxctl) {
bus->sdiodev->bus_if->maxctl += bus->roundup;
bus->rxblen =
roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN), DMA_ALIGNMENT) + bus->head_align;
bus->rxbuf = static_cast<decltype(bus->rxbuf)>(malloc(bus->rxblen));
if (!(bus->rxbuf)) {
BRCMF_ERR("rxbuf allocation failed");
goto fail;
}
}
sdio_claim_host(bus->sdiodev->func1);
/* Disable F2 to clear any intermediate frame state on the dongle */
sdio_disable_fn(&bus->sdiodev->sdio_proto_fn2);
bus->rxflow = false;
/* Done with backplane-dependent accesses, can drop clock... */
brcmf_sdiod_func1_wb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
sdio_release_host(bus->sdiodev->func1);
/* ...and initialize clock/power states */
bus->clkstate = CLK_SDONLY;
bus->idletime = BRCMF_IDLE_INTERVAL;
bus->idleclock = BRCMF_IDLE_ACTIVE;
/* SR state */
bus->sr_enabled = false;
BRCMF_DBG(INFO, "completed!!");
if (ret != ZX_OK) {
goto fail;
}
return bus;
fail:
brcmf_sdio_remove(bus);
return NULL;
}
/* Detach and free everything */
void brcmf_sdio_remove(struct brcmf_sdio* bus) {
BRCMF_DBG(TRACE, "Enter");
if (bus) {
/* De-register interrupt handler */
brcmf_sdiod_intr_unregister(bus->sdiodev);
brcmf_proto_bcdc_detach(bus->sdiodev->drvr);
brcmf_detach(bus->sdiodev->drvr);
bus->datawork.Cancel();
if (bus->brcmf_wq) {
delete bus->brcmf_wq;
}
if (bus->ci) {
if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
sdio_claim_host(bus->sdiodev->func1);
brcmf_sdio_wd_timer(bus, false);
brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
/* Leave the device in state where it is
* 'passive'. This is done by resetting all
* necessary cores.
*/
msleep(20);
brcmf_chip_set_passive(bus->ci);
brcmf_sdio_clkctl(bus, CLK_NONE, false);
sdio_release_host(bus->sdiodev->func1);
}
brcmf_chip_detach(bus->ci);
}
if (bus->sdiodev->settings) {
if (bus->sdiodev->settings->bus.sdio) {
free(bus->sdiodev->settings->bus.sdio);
}
free(bus->sdiodev->settings);
}
delete bus->timer;
free(bus->rxbuf);
free(bus->hdrbuf);
free(bus);
}
BRCMF_DBG(TRACE, "Bus Disconnected");
}
/*Reset things When recovering from firmware crash*/
void brcmf_sdio_reset(struct brcmf_sdio* bus) {
BRCMF_DBG(TRACE, "Enter");
// Stop watch dog timer temporarily.
brcmf_sdio_wd_timer(bus, false);
// Flush the glom rx list.
brcmf_sdio_free_glom(bus);
// Clean up the data path.
bus->datawork.Cancel();
bus->brcmf_wq->Flush();
// Flush rx buffer.
memset(bus->rxbuf, 0, bus->rxblen);
// Flush tx queue.
brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
// Restart watchdog timer
brcmf_sdio_wd_timer(bus, true);
}
void brcmf_sdio_wd_timer(struct brcmf_sdio* bus, bool active) {
/* Totally stop the timer */
if (!active && bus->wd_active.load()) {
bus->timer->Stop();
bus->wd_active.store(false);
return;
}
/* don't start the wd until fw is loaded */
if (bus->sdiodev->state != BRCMF_SDIOD_DATA) {
return;
}
if (active) {
bus->wd_active.store(true);
bus->timer->Start(ZX_MSEC(BRCMF_WD_POLL_MSEC));
}
}
zx_status_t brcmf_sdio_sleep(struct brcmf_sdio* bus, bool sleep) {
zx_status_t ret;
sdio_claim_host(bus->sdiodev->func1);
ret = brcmf_sdio_bus_sleep(bus, sleep, false);
sdio_release_host(bus->sdiodev->func1);
return ret;
}