You only added CONFIG_MMC_BCM2835_UPSTREAM symbol for bcm2708, missing bcm2709 and bcm2710, which will break buildbot for those subtargets.
Apart from that, what's the purpose of adding a disabled driver? Maybe you should create a branch in your staging repo in which this driver is enabled by default, in order to see if it works or not. El 01/04/2017 a las 15:30, Rafał Miłecki escribió: > From: Rafał Miłecki <ra...@milecki.pl> > > Signed-off-by: Rafał Miłecki <ra...@milecki.pl> > --- > target/linux/brcm2708/bcm2708/config-4.9 | 1 + > ...-Add-new-driver-for-the-sdhost-controller.patch | 1536 > ++++++++++++++++++++ > ...-Fix-possible-NULL-ptr-dereference-in-bcm.patch | 30 + > ...-rename-Kconfig-symbol-to-avoid-downstrea.patch | 40 + > 4 files changed, 1607 insertions(+) > create mode 100644 > target/linux/brcm2708/patches-4.9/080-0001-mmc-bcm2835-Add-new-driver-for-the-sdhost-controller.patch > create mode 100644 > target/linux/brcm2708/patches-4.9/080-0002-mmc-bcm2835-Fix-possible-NULL-ptr-dereference-in-bcm.patch > create mode 100644 > target/linux/brcm2708/patches-4.9/080-0100-mmc-bcm2835-rename-Kconfig-symbol-to-avoid-downstrea.patch > > diff --git a/target/linux/brcm2708/bcm2708/config-4.9 > b/target/linux/brcm2708/bcm2708/config-4.9 > index c1bed074c3..76dd1fde18 100644 > --- a/target/linux/brcm2708/bcm2708/config-4.9 > +++ b/target/linux/brcm2708/bcm2708/config-4.9 > @@ -251,6 +251,7 @@ CONFIG_MMC_BCM2835=y > CONFIG_MMC_BCM2835_DMA=y > CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2 > CONFIG_MMC_BCM2835_SDHOST=y > +# CONFIG_MMC_BCM2835_UPSTREAM is not set > CONFIG_MMC_BLOCK=y > CONFIG_MMC_BLOCK_MINORS=32 > CONFIG_MMC_SDHCI=y > diff --git > a/target/linux/brcm2708/patches-4.9/080-0001-mmc-bcm2835-Add-new-driver-for-the-sdhost-controller.patch > > b/target/linux/brcm2708/patches-4.9/080-0001-mmc-bcm2835-Add-new-driver-for-the-sdhost-controller.patch > new file mode 100644 > index 0000000000..2c0238cad9 > --- /dev/null > +++ > b/target/linux/brcm2708/patches-4.9/080-0001-mmc-bcm2835-Add-new-driver-for-the-sdhost-controller.patch > @@ -0,0 +1,1536 @@ > +From a7d3e315a02c3154c38d09e51fc9461ba2cac396 Mon Sep 17 00:00:00 2001 > +From: Eric Anholt <e...@anholt.net> > +Date: Wed, 8 Mar 2017 10:19:03 +0100 > +Subject: [PATCH] mmc: bcm2835: Add new driver for the sdhost controller. > + > +The 2835 has two SD controllers: The Arasan sdhci controller (supported > +by the iproc driver) and a custom sdhost controller. This patch adds a > +driver for the latter. > + > +The sdhci controller supports both sdcard and sdio. The sdhost > +controller supports the sdcard only, but has better performance. Also > +note that the rpi3 has sdio wifi, so driving the sdcard with the sdhost > +controller allows to use the sdhci controller for wifi support. > + > +The configuration is done by devicetree via pin muxing. Both SD > +controller are available on the same pins (2 pin groups = pin 22 to 27 + > +pin 48 to 53). So it's possible to use both SD controllers at the same > +time with different pin groups. > + > +The code was originally written by Phil Elwell in the downstream > +Rasbperry Pi tree. In preparation for the upstream merge it was > +cleaned up and the code base was moderized by Eric Anholt, Stefan > +Wahren and Gerd Hoffmann. > + > +Signed-off-by: Eric Anholt <e...@anholt.net> > +Signed-off-by: Stefan Wahren <stefan.wah...@i2se.com> > +Signed-off-by: Gerd Hoffmann <kra...@redhat.com> > +Signed-off-by: Ulf Hansson <ulf.hans...@linaro.org> > +--- > + drivers/mmc/host/Kconfig | 14 + > + drivers/mmc/host/Makefile | 1 + > + drivers/mmc/host/bcm2835.c | 1465 > ++++++++++++++++++++++++++++++++++++++++++++ > + 3 files changed, 1480 insertions(+) > + create mode 100644 drivers/mmc/host/bcm2835.c > + > +--- a/drivers/mmc/host/Kconfig > ++++ b/drivers/mmc/host/Kconfig > +@@ -769,6 +769,20 @@ config MMC_TOSHIBA_PCI > + depends on PCI > + help > + > ++config MMC_BCM2835 > ++ tristate "Broadcom BCM2835 SDHOST MMC Controller support" > ++ depends on ARCH_BCM2835 || COMPILE_TEST > ++ depends on HAS_DMA > ++ help > ++ This selects the BCM2835 SDHOST MMC controller. If you have > ++ a BCM2835 platform with SD or MMC devices, say Y or M here. > ++ > ++ Note that the BCM2835 has two SD controllers: The Arasan > ++ sdhci controller (supported by MMC_SDHCI_IPROC) and a custom > ++ sdhost controller (supported by this driver). > ++ > ++ If unsure, say N. > ++ > + config MMC_MTK > + tristate "MediaTek SD/MMC Card Interface support" > + depends on HAS_DMA > +--- a/drivers/mmc/host/Makefile > ++++ b/drivers/mmc/host/Makefile > +@@ -57,6 +57,7 @@ obj-$(CONFIG_MMC_MOXART) += moxart-mmc.o > + obj-$(CONFIG_MMC_SUNXI) += sunxi-mmc.o > + obj-$(CONFIG_MMC_USDHI6ROL0) += usdhi6rol0.o > + obj-$(CONFIG_MMC_TOSHIBA_PCI) += toshsd.o > ++obj-$(CONFIG_MMC_BCM2835) += bcm2835.o > + > + obj-$(CONFIG_MMC_REALTEK_PCI) += rtsx_pci_sdmmc.o > + obj-$(CONFIG_MMC_REALTEK_USB) += rtsx_usb_sdmmc.o > +--- /dev/null > ++++ b/drivers/mmc/host/bcm2835.c > +@@ -0,0 +1,1465 @@ > ++/* > ++ * bcm2835 sdhost driver. > ++ * > ++ * The 2835 has two SD controllers: The Arasan sdhci controller > ++ * (supported by the iproc driver) and a custom sdhost controller > ++ * (supported by this driver). > ++ * > ++ * The sdhci controller supports both sdcard and sdio. The sdhost > ++ * controller supports the sdcard only, but has better performance. > ++ * Also note that the rpi3 has sdio wifi, so driving the sdcard with > ++ * the sdhost controller allows to use the sdhci controller for wifi > ++ * support. > ++ * > ++ * The configuration is done by devicetree via pin muxing. Both > ++ * SD controller are available on the same pins (2 pin groups = pin 22 > ++ * to 27 + pin 48 to 53). So it's possible to use both SD controllers > ++ * at the same time with different pin groups. > ++ * > ++ * Author: Phil Elwell <p...@raspberrypi.org> > ++ * Copyright (C) 2015-2016 Raspberry Pi (Trading) Ltd. > ++ * > ++ * Based on > ++ * mmc-bcm2835.c by Gellert Weisz > ++ * which is, in turn, based on > ++ * sdhci-bcm2708.c by Broadcom > ++ * sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko > ++ * sdhci.c and sdhci-pci.c by Pierre Ossman > ++ * > ++ * This program is free software; you can redistribute it and/or modify it > ++ * under the terms and conditions of the GNU General Public License, > ++ * version 2, as published by the Free Software Foundation. > ++ * > ++ * This program is distributed in the hope it will be useful, but WITHOUT > ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or > ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for > ++ * more details. > ++ * > ++ * You should have received a copy of the GNU General Public License > ++ * along with this program. If not, see <http://www.gnu.org/licenses/>. > ++ */ > ++#include <linux/clk.h> > ++#include <linux/delay.h> > ++#include <linux/device.h> > ++#include <linux/dmaengine.h> > ++#include <linux/dma-mapping.h> > ++#include <linux/err.h> > ++#include <linux/highmem.h> > ++#include <linux/interrupt.h> > ++#include <linux/io.h> > ++#include <linux/iopoll.h> > ++#include <linux/module.h> > ++#include <linux/of_address.h> > ++#include <linux/of_irq.h> > ++#include <linux/platform_device.h> > ++#include <linux/scatterlist.h> > ++#include <linux/time.h> > ++#include <linux/workqueue.h> > ++ > ++#include <linux/mmc/host.h> > ++#include <linux/mmc/mmc.h> > ++#include <linux/mmc/sd.h> > ++ > ++#define SDCMD 0x00 /* Command to SD card - 16 R/W */ > ++#define SDARG 0x04 /* Argument to SD card - 32 R/W */ > ++#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */ > ++#define SDCDIV 0x0c /* Start value for clock divider - 11 R/W */ > ++#define SDRSP0 0x10 /* SD card response (31:0) - 32 R */ > ++#define SDRSP1 0x14 /* SD card response (63:32) - 32 R */ > ++#define SDRSP2 0x18 /* SD card response (95:64) - 32 R */ > ++#define SDRSP3 0x1c /* SD card response (127:96) - 32 R */ > ++#define SDHSTS 0x20 /* SD host status - 11 R/W */ > ++#define SDVDD 0x30 /* SD card power control - 1 R/W */ > ++#define SDEDM 0x34 /* Emergency Debug Mode - 13 R/W */ > ++#define SDHCFG 0x38 /* Host configuration - 2 R/W */ > ++#define SDHBCT 0x3c /* Host byte count (debug) - 32 R/W */ > ++#define SDDATA 0x40 /* Data to/from SD card - 32 R/W */ > ++#define SDHBLC 0x50 /* Host block count (SDIO/SDHC) - 9 R/W */ > ++ > ++#define SDCMD_NEW_FLAG 0x8000 > ++#define SDCMD_FAIL_FLAG 0x4000 > ++#define SDCMD_BUSYWAIT 0x800 > ++#define SDCMD_NO_RESPONSE 0x400 > ++#define SDCMD_LONG_RESPONSE 0x200 > ++#define SDCMD_WRITE_CMD 0x80 > ++#define SDCMD_READ_CMD 0x40 > ++#define SDCMD_CMD_MASK 0x3f > ++ > ++#define SDCDIV_MAX_CDIV 0x7ff > ++ > ++#define SDHSTS_BUSY_IRPT 0x400 > ++#define SDHSTS_BLOCK_IRPT 0x200 > ++#define SDHSTS_SDIO_IRPT 0x100 > ++#define SDHSTS_REW_TIME_OUT 0x80 > ++#define SDHSTS_CMD_TIME_OUT 0x40 > ++#define SDHSTS_CRC16_ERROR 0x20 > ++#define SDHSTS_CRC7_ERROR 0x10 > ++#define SDHSTS_FIFO_ERROR 0x08 > ++/* Reserved */ > ++/* Reserved */ > ++#define SDHSTS_DATA_FLAG 0x01 > ++ > ++#define SDHSTS_TRANSFER_ERROR_MASK (SDHSTS_CRC7_ERROR | \ > ++ SDHSTS_CRC16_ERROR | \ > ++ SDHSTS_REW_TIME_OUT | \ > ++ SDHSTS_FIFO_ERROR) > ++ > ++#define SDHSTS_ERROR_MASK (SDHSTS_CMD_TIME_OUT | \ > ++ SDHSTS_TRANSFER_ERROR_MASK) > ++ > ++#define SDHCFG_BUSY_IRPT_EN BIT(10) > ++#define SDHCFG_BLOCK_IRPT_EN BIT(8) > ++#define SDHCFG_SDIO_IRPT_EN BIT(5) > ++#define SDHCFG_DATA_IRPT_EN BIT(4) > ++#define SDHCFG_SLOW_CARD BIT(3) > ++#define SDHCFG_WIDE_EXT_BUS BIT(2) > ++#define SDHCFG_WIDE_INT_BUS BIT(1) > ++#define SDHCFG_REL_CMD_LINE BIT(0) > ++ > ++#define SDVDD_POWER_OFF 0 > ++#define SDVDD_POWER_ON 1 > ++ > ++#define SDEDM_FORCE_DATA_MODE BIT(19) > ++#define SDEDM_CLOCK_PULSE BIT(20) > ++#define SDEDM_BYPASS BIT(21) > ++ > ++#define SDEDM_WRITE_THRESHOLD_SHIFT 9 > ++#define SDEDM_READ_THRESHOLD_SHIFT 14 > ++#define SDEDM_THRESHOLD_MASK 0x1f > ++ > ++#define SDEDM_FSM_MASK 0xf > ++#define SDEDM_FSM_IDENTMODE 0x0 > ++#define SDEDM_FSM_DATAMODE 0x1 > ++#define SDEDM_FSM_READDATA 0x2 > ++#define SDEDM_FSM_WRITEDATA 0x3 > ++#define SDEDM_FSM_READWAIT 0x4 > ++#define SDEDM_FSM_READCRC 0x5 > ++#define SDEDM_FSM_WRITECRC 0x6 > ++#define SDEDM_FSM_WRITEWAIT1 0x7 > ++#define SDEDM_FSM_POWERDOWN 0x8 > ++#define SDEDM_FSM_POWERUP 0x9 > ++#define SDEDM_FSM_WRITESTART1 0xa > ++#define SDEDM_FSM_WRITESTART2 0xb > ++#define SDEDM_FSM_GENPULSES 0xc > ++#define SDEDM_FSM_WRITEWAIT2 0xd > ++#define SDEDM_FSM_STARTPOWDOWN 0xf > ++ > ++#define SDDATA_FIFO_WORDS 16 > ++ > ++#define FIFO_READ_THRESHOLD 4 > ++#define FIFO_WRITE_THRESHOLD 4 > ++#define SDDATA_FIFO_PIO_BURST 8 > ++ > ++#define PIO_THRESHOLD 1 /* Maximum block count for PIO (0 = always > DMA) */ > ++ > ++struct bcm2835_host { > ++ spinlock_t lock; > ++ struct mutex mutex; > ++ > ++ void __iomem *ioaddr; > ++ u32 phys_addr; > ++ > ++ struct mmc_host *mmc; > ++ struct platform_device *pdev; > ++ > ++ int clock; /* Current clock speed */ > ++ unsigned int max_clk; /* Max possible freq */ > ++ struct work_struct dma_work; > ++ struct delayed_work timeout_work; /* Timer for timeouts */ > ++ struct sg_mapping_iter sg_miter; /* SG state for PIO */ > ++ unsigned int blocks; /* remaining PIO blocks */ > ++ int irq; /* Device IRQ */ > ++ > ++ u32 ns_per_fifo_word; > ++ > ++ /* cached registers */ > ++ u32 hcfg; > ++ u32 cdiv; > ++ > ++ struct mmc_request *mrq; /* Current request */ > ++ struct mmc_command *cmd; /* Current command */ > ++ struct mmc_data *data; /* Current data request */ > ++ bool data_complete:1;/* Data finished before cmd */ > ++ bool use_busy:1; /* Wait for busy interrupt */ > ++ bool use_sbc:1; /* Send CMD23 */ > ++ > ++ /* for threaded irq handler */ > ++ bool irq_block; > ++ bool irq_busy; > ++ bool irq_data; > ++ > ++ /* DMA part */ > ++ struct dma_chan *dma_chan_rxtx; > ++ struct dma_chan *dma_chan; > ++ struct dma_slave_config dma_cfg_rx; > ++ struct dma_slave_config dma_cfg_tx; > ++ struct dma_async_tx_descriptor *dma_desc; > ++ u32 dma_dir; > ++ u32 drain_words; > ++ struct page *drain_page; > ++ u32 drain_offset; > ++ bool use_dma; > ++}; > ++ > ++static void bcm2835_dumpcmd(struct bcm2835_host *host, struct mmc_command > *cmd, > ++ const char *label) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ > ++ if (!cmd) > ++ return; > ++ > ++ dev_dbg(dev, "%c%s op %d arg 0x%x flags 0x%x - resp %08x %08x %08x > %08x, err %d\n", > ++ (cmd == host->cmd) ? '>' : ' ', > ++ label, cmd->opcode, cmd->arg, cmd->flags, > ++ cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3], > ++ cmd->error); > ++} > ++ > ++static void bcm2835_dumpregs(struct bcm2835_host *host) > ++{ > ++ struct mmc_request *mrq = host->mrq; > ++ struct device *dev = &host->pdev->dev; > ++ > ++ if (mrq) { > ++ bcm2835_dumpcmd(host, mrq->sbc, "sbc"); > ++ bcm2835_dumpcmd(host, mrq->cmd, "cmd"); > ++ if (mrq->data) { > ++ dev_dbg(dev, "data blocks %x blksz %x - err %d\n", > ++ mrq->data->blocks, > ++ mrq->data->blksz, > ++ mrq->data->error); > ++ } > ++ bcm2835_dumpcmd(host, mrq->stop, "stop"); > ++ } > ++ > ++ dev_dbg(dev, "=========== REGISTER DUMP ===========\n"); > ++ dev_dbg(dev, "SDCMD 0x%08x\n", readl(host->ioaddr + SDCMD)); > ++ dev_dbg(dev, "SDARG 0x%08x\n", readl(host->ioaddr + SDARG)); > ++ dev_dbg(dev, "SDTOUT 0x%08x\n", readl(host->ioaddr + SDTOUT)); > ++ dev_dbg(dev, "SDCDIV 0x%08x\n", readl(host->ioaddr + SDCDIV)); > ++ dev_dbg(dev, "SDRSP0 0x%08x\n", readl(host->ioaddr + SDRSP0)); > ++ dev_dbg(dev, "SDRSP1 0x%08x\n", readl(host->ioaddr + SDRSP1)); > ++ dev_dbg(dev, "SDRSP2 0x%08x\n", readl(host->ioaddr + SDRSP2)); > ++ dev_dbg(dev, "SDRSP3 0x%08x\n", readl(host->ioaddr + SDRSP3)); > ++ dev_dbg(dev, "SDHSTS 0x%08x\n", readl(host->ioaddr + SDHSTS)); > ++ dev_dbg(dev, "SDVDD 0x%08x\n", readl(host->ioaddr + SDVDD)); > ++ dev_dbg(dev, "SDEDM 0x%08x\n", readl(host->ioaddr + SDEDM)); > ++ dev_dbg(dev, "SDHCFG 0x%08x\n", readl(host->ioaddr + SDHCFG)); > ++ dev_dbg(dev, "SDHBCT 0x%08x\n", readl(host->ioaddr + SDHBCT)); > ++ dev_dbg(dev, "SDHBLC 0x%08x\n", readl(host->ioaddr + SDHBLC)); > ++ dev_dbg(dev, "===========================================\n"); > ++} > ++ > ++static void bcm2835_reset_internal(struct bcm2835_host *host) > ++{ > ++ u32 temp; > ++ > ++ writel(SDVDD_POWER_OFF, host->ioaddr + SDVDD); > ++ writel(0, host->ioaddr + SDCMD); > ++ writel(0, host->ioaddr + SDARG); > ++ writel(0xf00000, host->ioaddr + SDTOUT); > ++ writel(0, host->ioaddr + SDCDIV); > ++ writel(0x7f8, host->ioaddr + SDHSTS); /* Write 1s to clear */ > ++ writel(0, host->ioaddr + SDHCFG); > ++ writel(0, host->ioaddr + SDHBCT); > ++ writel(0, host->ioaddr + SDHBLC); > ++ > ++ /* Limit fifo usage due to silicon bug */ > ++ temp = readl(host->ioaddr + SDEDM); > ++ temp &= ~((SDEDM_THRESHOLD_MASK << SDEDM_READ_THRESHOLD_SHIFT) | > ++ (SDEDM_THRESHOLD_MASK << SDEDM_WRITE_THRESHOLD_SHIFT)); > ++ temp |= (FIFO_READ_THRESHOLD << SDEDM_READ_THRESHOLD_SHIFT) | > ++ (FIFO_WRITE_THRESHOLD << SDEDM_WRITE_THRESHOLD_SHIFT); > ++ writel(temp, host->ioaddr + SDEDM); > ++ msleep(20); > ++ writel(SDVDD_POWER_ON, host->ioaddr + SDVDD); > ++ msleep(20); > ++ host->clock = 0; > ++ writel(host->hcfg, host->ioaddr + SDHCFG); > ++ writel(host->cdiv, host->ioaddr + SDCDIV); > ++} > ++ > ++static void bcm2835_reset(struct mmc_host *mmc) > ++{ > ++ struct bcm2835_host *host = mmc_priv(mmc); > ++ > ++ if (host->dma_chan) > ++ dmaengine_terminate_sync(host->dma_chan); > ++ bcm2835_reset_internal(host); > ++} > ++ > ++static void bcm2835_finish_command(struct bcm2835_host *host); > ++ > ++static void bcm2835_wait_transfer_complete(struct bcm2835_host *host) > ++{ > ++ int timediff; > ++ u32 alternate_idle; > ++ > ++ alternate_idle = (host->mrq->data->flags & MMC_DATA_READ) ? > ++ SDEDM_FSM_READWAIT : SDEDM_FSM_WRITESTART1; > ++ > ++ timediff = 0; > ++ > ++ while (1) { > ++ u32 edm, fsm; > ++ > ++ edm = readl(host->ioaddr + SDEDM); > ++ fsm = edm & SDEDM_FSM_MASK; > ++ > ++ if ((fsm == SDEDM_FSM_IDENTMODE) || > ++ (fsm == SDEDM_FSM_DATAMODE)) > ++ break; > ++ if (fsm == alternate_idle) { > ++ writel(edm | SDEDM_FORCE_DATA_MODE, > ++ host->ioaddr + SDEDM); > ++ break; > ++ } > ++ > ++ timediff++; > ++ if (timediff == 100000) { > ++ dev_err(&host->pdev->dev, > ++ "wait_transfer_complete - still waiting after > %d retries\n", > ++ timediff); > ++ bcm2835_dumpregs(host); > ++ host->mrq->data->error = -ETIMEDOUT; > ++ return; > ++ } > ++ cpu_relax(); > ++ } > ++} > ++ > ++static void bcm2835_dma_complete(void *param) > ++{ > ++ struct bcm2835_host *host = param; > ++ > ++ schedule_work(&host->dma_work); > ++} > ++ > ++static void bcm2835_transfer_block_pio(struct bcm2835_host *host, bool > is_read) > ++{ > ++ unsigned long flags; > ++ size_t blksize; > ++ unsigned long wait_max; > ++ > ++ blksize = host->data->blksz; > ++ > ++ wait_max = jiffies + msecs_to_jiffies(500); > ++ > ++ local_irq_save(flags); > ++ > ++ while (blksize) { > ++ int copy_words; > ++ u32 hsts = 0; > ++ size_t len; > ++ u32 *buf; > ++ > ++ if (!sg_miter_next(&host->sg_miter)) { > ++ host->data->error = -EINVAL; > ++ break; > ++ } > ++ > ++ len = min(host->sg_miter.length, blksize); > ++ if (len % 4) { > ++ host->data->error = -EINVAL; > ++ break; > ++ } > ++ > ++ blksize -= len; > ++ host->sg_miter.consumed = len; > ++ > ++ buf = (u32 *)host->sg_miter.addr; > ++ > ++ copy_words = len / 4; > ++ > ++ while (copy_words) { > ++ int burst_words, words; > ++ u32 edm; > ++ > ++ burst_words = min(SDDATA_FIFO_PIO_BURST, copy_words); > ++ edm = readl(host->ioaddr + SDEDM); > ++ if (is_read) > ++ words = ((edm >> 4) & 0x1f); > ++ else > ++ words = SDDATA_FIFO_WORDS - ((edm >> 4) & 0x1f); > ++ > ++ if (words < burst_words) { > ++ int fsm_state = (edm & SDEDM_FSM_MASK); > ++ struct device *dev = &host->pdev->dev; > ++ > ++ if ((is_read && > ++ (fsm_state != SDEDM_FSM_READDATA && > ++ fsm_state != SDEDM_FSM_READWAIT && > ++ fsm_state != SDEDM_FSM_READCRC)) || > ++ (!is_read && > ++ (fsm_state != SDEDM_FSM_WRITEDATA && > ++ fsm_state != SDEDM_FSM_WRITESTART1 && > ++ fsm_state != SDEDM_FSM_WRITESTART2))) { > ++ hsts = readl(host->ioaddr + SDHSTS); > ++ dev_err(dev, "fsm %x, hsts %08x\n", > ++ fsm_state, hsts); > ++ if (hsts & SDHSTS_ERROR_MASK) > ++ break; > ++ } > ++ > ++ if (time_after(jiffies, wait_max)) { > ++ dev_err(dev, "PIO %s timeout - EDM > %08x\n", > ++ is_read ? "read" : "write", > ++ edm); > ++ hsts = SDHSTS_REW_TIME_OUT; > ++ break; > ++ } > ++ ndelay((burst_words - words) * > ++ host->ns_per_fifo_word); > ++ continue; > ++ } else if (words > copy_words) { > ++ words = copy_words; > ++ } > ++ > ++ copy_words -= words; > ++ > ++ while (words) { > ++ if (is_read) > ++ *(buf++) = readl(host->ioaddr + SDDATA); > ++ else > ++ writel(*(buf++), host->ioaddr + SDDATA); > ++ words--; > ++ } > ++ } > ++ > ++ if (hsts & SDHSTS_ERROR_MASK) > ++ break; > ++ } > ++ > ++ sg_miter_stop(&host->sg_miter); > ++ > ++ local_irq_restore(flags); > ++} > ++ > ++static void bcm2835_transfer_pio(struct bcm2835_host *host) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ u32 sdhsts; > ++ bool is_read; > ++ > ++ is_read = (host->data->flags & MMC_DATA_READ) != 0; > ++ bcm2835_transfer_block_pio(host, is_read); > ++ > ++ sdhsts = readl(host->ioaddr + SDHSTS); > ++ if (sdhsts & (SDHSTS_CRC16_ERROR | > ++ SDHSTS_CRC7_ERROR | > ++ SDHSTS_FIFO_ERROR)) { > ++ dev_err(dev, "%s transfer error - HSTS %08x\n", > ++ is_read ? "read" : "write", sdhsts); > ++ host->data->error = -EILSEQ; > ++ } else if ((sdhsts & (SDHSTS_CMD_TIME_OUT | > ++ SDHSTS_REW_TIME_OUT))) { > ++ dev_err(dev, "%s timeout error - HSTS %08x\n", > ++ is_read ? "read" : "write", sdhsts); > ++ host->data->error = -ETIMEDOUT; > ++ } > ++} > ++ > ++static > ++void bcm2835_prepare_dma(struct bcm2835_host *host, struct mmc_data *data) > ++{ > ++ int len, dir_data, dir_slave; > ++ struct dma_async_tx_descriptor *desc = NULL; > ++ struct dma_chan *dma_chan; > ++ > ++ dma_chan = host->dma_chan_rxtx; > ++ if (data->flags & MMC_DATA_READ) { > ++ dir_data = DMA_FROM_DEVICE; > ++ dir_slave = DMA_DEV_TO_MEM; > ++ } else { > ++ dir_data = DMA_TO_DEVICE; > ++ dir_slave = DMA_MEM_TO_DEV; > ++ } > ++ > ++ /* The block doesn't manage the FIFO DREQs properly for > ++ * multi-block transfers, so don't attempt to DMA the final > ++ * few words. Unfortunately this requires the final sg entry > ++ * to be trimmed. N.B. This code demands that the overspill > ++ * is contained in a single sg entry. > ++ */ > ++ > ++ host->drain_words = 0; > ++ if ((data->blocks > 1) && (dir_data == DMA_FROM_DEVICE)) { > ++ struct scatterlist *sg; > ++ u32 len; > ++ int i; > ++ > ++ len = min((u32)(FIFO_READ_THRESHOLD - 1) * 4, > ++ (u32)data->blocks * data->blksz); > ++ > ++ for_each_sg(data->sg, sg, data->sg_len, i) { > ++ if (sg_is_last(sg)) { > ++ WARN_ON(sg->length < len); > ++ sg->length -= len; > ++ host->drain_page = sg_page(sg); > ++ host->drain_offset = sg->offset + sg->length; > ++ } > ++ } > ++ host->drain_words = len / 4; > ++ } > ++ > ++ /* The parameters have already been validated, so this will not fail */ > ++ (void)dmaengine_slave_config(dma_chan, > ++ (dir_data == DMA_FROM_DEVICE) ? > ++ &host->dma_cfg_rx : > ++ &host->dma_cfg_tx); > ++ > ++ len = dma_map_sg(dma_chan->device->dev, data->sg, data->sg_len, > ++ dir_data); > ++ > ++ if (len > 0) { > ++ desc = dmaengine_prep_slave_sg(dma_chan, data->sg, > ++ len, dir_slave, > ++ DMA_PREP_INTERRUPT | > ++ DMA_CTRL_ACK); > ++ } > ++ > ++ if (desc) { > ++ desc->callback = bcm2835_dma_complete; > ++ desc->callback_param = host; > ++ host->dma_desc = desc; > ++ host->dma_chan = dma_chan; > ++ host->dma_dir = dir_data; > ++ } > ++} > ++ > ++static void bcm2835_start_dma(struct bcm2835_host *host) > ++{ > ++ dmaengine_submit(host->dma_desc); > ++ dma_async_issue_pending(host->dma_chan); > ++} > ++ > ++static void bcm2835_set_transfer_irqs(struct bcm2835_host *host) > ++{ > ++ u32 all_irqs = SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN | > ++ SDHCFG_BUSY_IRPT_EN; > ++ > ++ if (host->dma_desc) { > ++ host->hcfg = (host->hcfg & ~all_irqs) | > ++ SDHCFG_BUSY_IRPT_EN; > ++ } else { > ++ host->hcfg = (host->hcfg & ~all_irqs) | > ++ SDHCFG_DATA_IRPT_EN | > ++ SDHCFG_BUSY_IRPT_EN; > ++ } > ++ > ++ writel(host->hcfg, host->ioaddr + SDHCFG); > ++} > ++ > ++static > ++void bcm2835_prepare_data(struct bcm2835_host *host, struct mmc_command > *cmd) > ++{ > ++ struct mmc_data *data = cmd->data; > ++ > ++ WARN_ON(host->data); > ++ > ++ host->data = data; > ++ if (!data) > ++ return; > ++ > ++ host->data_complete = false; > ++ host->data->bytes_xfered = 0; > ++ > ++ if (!host->dma_desc) { > ++ /* Use PIO */ > ++ int flags = SG_MITER_ATOMIC; > ++ > ++ if (data->flags & MMC_DATA_READ) > ++ flags |= SG_MITER_TO_SG; > ++ else > ++ flags |= SG_MITER_FROM_SG; > ++ sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags); > ++ host->blocks = data->blocks; > ++ } > ++ > ++ bcm2835_set_transfer_irqs(host); > ++ > ++ writel(data->blksz, host->ioaddr + SDHBCT); > ++ writel(data->blocks, host->ioaddr + SDHBLC); > ++} > ++ > ++static u32 bcm2835_read_wait_sdcmd(struct bcm2835_host *host, u32 max_ms) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ u32 value; > ++ int ret; > ++ > ++ ret = readl_poll_timeout(host->ioaddr + SDCMD, value, > ++ !(value & SDCMD_NEW_FLAG), 1, 10); > ++ if (ret == -ETIMEDOUT) > ++ /* if it takes a while make poll interval bigger */ > ++ ret = readl_poll_timeout(host->ioaddr + SDCMD, value, > ++ !(value & SDCMD_NEW_FLAG), > ++ 10, max_ms * 1000); > ++ if (ret == -ETIMEDOUT) > ++ dev_err(dev, "%s: timeout (%d ms)\n", __func__, max_ms); > ++ > ++ return value; > ++} > ++ > ++static void bcm2835_finish_request(struct bcm2835_host *host) > ++{ > ++ struct dma_chan *terminate_chan = NULL; > ++ struct mmc_request *mrq; > ++ > ++ cancel_delayed_work(&host->timeout_work); > ++ > ++ mrq = host->mrq; > ++ > ++ host->mrq = NULL; > ++ host->cmd = NULL; > ++ host->data = NULL; > ++ > ++ host->dma_desc = NULL; > ++ terminate_chan = host->dma_chan; > ++ host->dma_chan = NULL; > ++ > ++ if (terminate_chan) { > ++ int err = dmaengine_terminate_all(terminate_chan); > ++ > ++ if (err) > ++ dev_err(&host->pdev->dev, > ++ "failed to terminate DMA (%d)\n", err); > ++ } > ++ > ++ mmc_request_done(host->mmc, mrq); > ++} > ++ > ++static > ++bool bcm2835_send_command(struct bcm2835_host *host, struct mmc_command > *cmd) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ u32 sdcmd, sdhsts; > ++ unsigned long timeout; > ++ > ++ WARN_ON(host->cmd); > ++ > ++ sdcmd = bcm2835_read_wait_sdcmd(host, 100); > ++ if (sdcmd & SDCMD_NEW_FLAG) { > ++ dev_err(dev, "previous command never completed.\n"); > ++ bcm2835_dumpregs(host); > ++ cmd->error = -EILSEQ; > ++ bcm2835_finish_request(host); > ++ return false; > ++ } > ++ > ++ if (!cmd->data && cmd->busy_timeout > 9000) > ++ timeout = DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ; > ++ else > ++ timeout = 10 * HZ; > ++ schedule_delayed_work(&host->timeout_work, timeout); > ++ > ++ host->cmd = cmd; > ++ > ++ /* Clear any error flags */ > ++ sdhsts = readl(host->ioaddr + SDHSTS); > ++ if (sdhsts & SDHSTS_ERROR_MASK) > ++ writel(sdhsts, host->ioaddr + SDHSTS); > ++ > ++ if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) { > ++ dev_err(dev, "unsupported response type!\n"); > ++ cmd->error = -EINVAL; > ++ bcm2835_finish_request(host); > ++ return false; > ++ } > ++ > ++ bcm2835_prepare_data(host, cmd); > ++ > ++ writel(cmd->arg, host->ioaddr + SDARG); > ++ > ++ sdcmd = cmd->opcode & SDCMD_CMD_MASK; > ++ > ++ host->use_busy = false; > ++ if (!(cmd->flags & MMC_RSP_PRESENT)) { > ++ sdcmd |= SDCMD_NO_RESPONSE; > ++ } else { > ++ if (cmd->flags & MMC_RSP_136) > ++ sdcmd |= SDCMD_LONG_RESPONSE; > ++ if (cmd->flags & MMC_RSP_BUSY) { > ++ sdcmd |= SDCMD_BUSYWAIT; > ++ host->use_busy = true; > ++ } > ++ } > ++ > ++ if (cmd->data) { > ++ if (cmd->data->flags & MMC_DATA_WRITE) > ++ sdcmd |= SDCMD_WRITE_CMD; > ++ if (cmd->data->flags & MMC_DATA_READ) > ++ sdcmd |= SDCMD_READ_CMD; > ++ } > ++ > ++ writel(sdcmd | SDCMD_NEW_FLAG, host->ioaddr + SDCMD); > ++ > ++ return true; > ++} > ++ > ++static void bcm2835_transfer_complete(struct bcm2835_host *host) > ++{ > ++ struct mmc_data *data; > ++ > ++ WARN_ON(!host->data_complete); > ++ > ++ data = host->data; > ++ host->data = NULL; > ++ > ++ /* Need to send CMD12 if - > ++ * a) open-ended multiblock transfer (no CMD23) > ++ * b) error in multiblock transfer > ++ */ > ++ if (host->mrq->stop && (data->error || !host->use_sbc)) { > ++ if (bcm2835_send_command(host, host->mrq->stop)) { > ++ /* No busy, so poll for completion */ > ++ if (!host->use_busy) > ++ bcm2835_finish_command(host); > ++ } > ++ } else { > ++ bcm2835_wait_transfer_complete(host); > ++ bcm2835_finish_request(host); > ++ } > ++} > ++ > ++static void bcm2835_finish_data(struct bcm2835_host *host) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ struct mmc_data *data; > ++ > ++ data = host->data; > ++ > ++ host->hcfg &= ~(SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN); > ++ writel(host->hcfg, host->ioaddr + SDHCFG); > ++ > ++ data->bytes_xfered = data->error ? 0 : (data->blksz * data->blocks); > ++ > ++ host->data_complete = true; > ++ > ++ if (host->cmd) { > ++ /* Data managed to finish before the > ++ * command completed. Make sure we do > ++ * things in the proper order. > ++ */ > ++ dev_dbg(dev, "Finished early - HSTS %08x\n", > ++ readl(host->ioaddr + SDHSTS)); > ++ } else { > ++ bcm2835_transfer_complete(host); > ++ } > ++} > ++ > ++static void bcm2835_finish_command(struct bcm2835_host *host) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ struct mmc_command *cmd = host->cmd; > ++ u32 sdcmd; > ++ > ++ sdcmd = bcm2835_read_wait_sdcmd(host, 100); > ++ > ++ /* Check for errors */ > ++ if (sdcmd & SDCMD_NEW_FLAG) { > ++ dev_err(dev, "command never completed.\n"); > ++ bcm2835_dumpregs(host); > ++ host->cmd->error = -EIO; > ++ bcm2835_finish_request(host); > ++ return; > ++ } else if (sdcmd & SDCMD_FAIL_FLAG) { > ++ u32 sdhsts = readl(host->ioaddr + SDHSTS); > ++ > ++ /* Clear the errors */ > ++ writel(SDHSTS_ERROR_MASK, host->ioaddr + SDHSTS); > ++ > ++ if (!(sdhsts & SDHSTS_CRC7_ERROR) || > ++ (host->cmd->opcode != MMC_SEND_OP_COND)) { > ++ if (sdhsts & SDHSTS_CMD_TIME_OUT) { > ++ host->cmd->error = -ETIMEDOUT; > ++ } else { > ++ dev_err(dev, "unexpected command %d error\n", > ++ host->cmd->opcode); > ++ bcm2835_dumpregs(host); > ++ host->cmd->error = -EILSEQ; > ++ } > ++ bcm2835_finish_request(host); > ++ return; > ++ } > ++ } > ++ > ++ if (cmd->flags & MMC_RSP_PRESENT) { > ++ if (cmd->flags & MMC_RSP_136) { > ++ int i; > ++ > ++ for (i = 0; i < 4; i++) { > ++ cmd->resp[3 - i] = > ++ readl(host->ioaddr + SDRSP0 + i * 4); > ++ } > ++ } else { > ++ cmd->resp[0] = readl(host->ioaddr + SDRSP0); > ++ } > ++ } > ++ > ++ if (cmd == host->mrq->sbc) { > ++ /* Finished CMD23, now send actual command. */ > ++ host->cmd = NULL; > ++ if (bcm2835_send_command(host, host->mrq->cmd)) { > ++ if (host->data && host->dma_desc) > ++ /* DMA transfer starts now, PIO starts > ++ * after irq > ++ */ > ++ bcm2835_start_dma(host); > ++ > ++ if (!host->use_busy) > ++ bcm2835_finish_command(host); > ++ } > ++ } else if (cmd == host->mrq->stop) { > ++ /* Finished CMD12 */ > ++ bcm2835_finish_request(host); > ++ } else { > ++ /* Processed actual command. */ > ++ host->cmd = NULL; > ++ if (!host->data) > ++ bcm2835_finish_request(host); > ++ else if (host->data_complete) > ++ bcm2835_transfer_complete(host); > ++ } > ++} > ++ > ++static void bcm2835_timeout(struct work_struct *work) > ++{ > ++ struct delayed_work *d = to_delayed_work(work); > ++ struct bcm2835_host *host = > ++ container_of(d, struct bcm2835_host, timeout_work); > ++ struct device *dev = &host->pdev->dev; > ++ > ++ mutex_lock(&host->mutex); > ++ > ++ if (host->mrq) { > ++ dev_err(dev, "timeout waiting for hardware interrupt.\n"); > ++ bcm2835_dumpregs(host); > ++ > ++ if (host->data) { > ++ host->data->error = -ETIMEDOUT; > ++ bcm2835_finish_data(host); > ++ } else { > ++ if (host->cmd) > ++ host->cmd->error = -ETIMEDOUT; > ++ else > ++ host->mrq->cmd->error = -ETIMEDOUT; > ++ > ++ bcm2835_finish_request(host); > ++ } > ++ } > ++ > ++ mutex_unlock(&host->mutex); > ++} > ++ > ++static bool bcm2835_check_cmd_error(struct bcm2835_host *host, u32 intmask) > ++{ > ++ struct device *dev = &host->pdev->dev; > ++ > ++ if (!(intmask & SDHSTS_ERROR_MASK)) > ++ return false; > ++ > ++ if (!host->cmd) > ++ return true; > ++ > ++ dev_err(dev, "sdhost_busy_irq: intmask %08x\n", intmask); > ++ if (intmask & SDHSTS_CRC7_ERROR) { > ++ host->cmd->error = -EILSEQ; > ++ } else if (intmask & (SDHSTS_CRC16_ERROR | > ++ SDHSTS_FIFO_ERROR)) { > ++ if (host->mrq->data) > ++ host->mrq->data->error = -EILSEQ; > ++ else > ++ host->cmd->error = -EILSEQ; > ++ } else if (intmask & SDHSTS_REW_TIME_OUT) { > ++ if (host->mrq->data) > ++ host->mrq->data->error = -ETIMEDOUT; > ++ else > ++ host->cmd->error = -ETIMEDOUT; > ++ } else if (intmask & SDHSTS_CMD_TIME_OUT) { > ++ host->cmd->error = -ETIMEDOUT; > ++ } > ++ bcm2835_dumpregs(host); > ++ return true; > ++} > ++ > ++static void bcm2835_check_data_error(struct bcm2835_host *host, u32 intmask) > ++{ > ++ if (!host->data) > ++ return; > ++ if (intmask & (SDHSTS_CRC16_ERROR | SDHSTS_FIFO_ERROR)) > ++ host->data->error = -EILSEQ; > ++ if (intmask & SDHSTS_REW_TIME_OUT) > ++ host->data->error = -ETIMEDOUT; > ++} > ++ > ++static void bcm2835_busy_irq(struct bcm2835_host *host) > ++{ > ++ if (WARN_ON(!host->cmd)) { > ++ bcm2835_dumpregs(host); > ++ return; > ++ } > ++ > ++ if (WARN_ON(!host->use_busy)) { > ++ bcm2835_dumpregs(host); > ++ return; > ++ } > ++ host->use_busy = false; > ++ > ++ bcm2835_finish_command(host); > ++} > ++ > ++static void bcm2835_data_irq(struct bcm2835_host *host, u32 intmask) > ++{ > ++ /* There are no dedicated data/space available interrupt > ++ * status bits, so it is necessary to use the single shared > ++ * data/space available FIFO status bits. It is therefore not > ++ * an error to get here when there is no data transfer in > ++ * progress. > ++ */ > ++ if (!host->data) > ++ return; > ++ > ++ bcm2835_check_data_error(host, intmask); > ++ if (host->data->error) > ++ goto finished; > ++ > ++ if (host->data->flags & MMC_DATA_WRITE) { > ++ /* Use the block interrupt for writes after the first block */ > ++ host->hcfg &= ~(SDHCFG_DATA_IRPT_EN); > ++ host->hcfg |= SDHCFG_BLOCK_IRPT_EN; > ++ writel(host->hcfg, host->ioaddr + SDHCFG); > ++ bcm2835_transfer_pio(host); > ++ } else { > ++ bcm2835_transfer_pio(host); > ++ host->blocks--; > ++ if ((host->blocks == 0) || host->data->error) > ++ goto finished; > ++ } > ++ return; > ++ > ++finished: > ++ host->hcfg &= ~(SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN); > ++ writel(host->hcfg, host->ioaddr + SDHCFG); > ++} > ++ > ++static void bcm2835_data_threaded_irq(struct bcm2835_host *host) > ++{ > ++ if (!host->data) > ++ return; > ++ if ((host->blocks == 0) || host->data->error) > ++ bcm2835_finish_data(host); > ++} > ++ > ++static void bcm2835_block_irq(struct bcm2835_host *host) > ++{ > ++ if (WARN_ON(!host->data)) { > ++ bcm2835_dumpregs(host); > ++ return; > ++ } > ++ > ++ if (!host->dma_desc) { > ++ WARN_ON(!host->blocks); > ++ if (host->data->error || (--host->blocks == 0)) > ++ bcm2835_finish_data(host); > ++ else > ++ bcm2835_transfer_pio(host); > ++ } else if (host->data->flags & MMC_DATA_WRITE) { > ++ bcm2835_finish_data(host); > ++ } > ++} > ++ > ++static irqreturn_t bcm2835_irq(int irq, void *dev_id) > ++{ > ++ irqreturn_t result = IRQ_NONE; > ++ struct bcm2835_host *host = dev_id; > ++ u32 intmask; > ++ > ++ spin_lock(&host->lock); > ++ > ++ intmask = readl(host->ioaddr + SDHSTS); > ++ > ++ writel(SDHSTS_BUSY_IRPT | > ++ SDHSTS_BLOCK_IRPT | > ++ SDHSTS_SDIO_IRPT | > ++ SDHSTS_DATA_FLAG, > ++ host->ioaddr + SDHSTS); > ++ > ++ if (intmask & SDHSTS_BLOCK_IRPT) { > ++ bcm2835_check_data_error(host, intmask); > ++ host->irq_block = true; > ++ result = IRQ_WAKE_THREAD; > ++ } > ++ > ++ if (intmask & SDHSTS_BUSY_IRPT) { > ++ if (!bcm2835_check_cmd_error(host, intmask)) { > ++ host->irq_busy = true; > ++ result = IRQ_WAKE_THREAD; > ++ } else { > ++ result = IRQ_HANDLED; > ++ } > ++ } > ++ > ++ /* There is no true data interrupt status bit, so it is > ++ * necessary to qualify the data flag with the interrupt > ++ * enable bit. > ++ */ > ++ if ((intmask & SDHSTS_DATA_FLAG) && > ++ (host->hcfg & SDHCFG_DATA_IRPT_EN)) { > ++ bcm2835_data_irq(host, intmask); > ++ host->irq_data = true; > ++ result = IRQ_WAKE_THREAD; > ++ } > ++ > ++ spin_unlock(&host->lock); > ++ > ++ return result; > ++} > ++ > ++static irqreturn_t bcm2835_threaded_irq(int irq, void *dev_id) > ++{ > ++ struct bcm2835_host *host = dev_id; > ++ unsigned long flags; > ++ bool block, busy, data; > ++ > ++ spin_lock_irqsave(&host->lock, flags); > ++ > ++ block = host->irq_block; > ++ busy = host->irq_busy; > ++ data = host->irq_data; > ++ host->irq_block = false; > ++ host->irq_busy = false; > ++ host->irq_data = false; > ++ > ++ spin_unlock_irqrestore(&host->lock, flags); > ++ > ++ mutex_lock(&host->mutex); > ++ > ++ if (block) > ++ bcm2835_block_irq(host); > ++ if (busy) > ++ bcm2835_busy_irq(host); > ++ if (data) > ++ bcm2835_data_threaded_irq(host); > ++ > ++ mutex_unlock(&host->mutex); > ++ > ++ return IRQ_HANDLED; > ++} > ++ > ++static void bcm2835_dma_complete_work(struct work_struct *work) > ++{ > ++ struct bcm2835_host *host = > ++ container_of(work, struct bcm2835_host, dma_work); > ++ struct mmc_data *data = host->data; > ++ > ++ mutex_lock(&host->mutex); > ++ > ++ if (host->dma_chan) { > ++ dma_unmap_sg(host->dma_chan->device->dev, > ++ data->sg, data->sg_len, > ++ host->dma_dir); > ++ > ++ host->dma_chan = NULL; > ++ } > ++ > ++ if (host->drain_words) { > ++ unsigned long flags; > ++ void *page; > ++ u32 *buf; > ++ > ++ if (host->drain_offset & PAGE_MASK) { > ++ host->drain_page += host->drain_offset >> PAGE_SHIFT; > ++ host->drain_offset &= ~PAGE_MASK; > ++ } > ++ local_irq_save(flags); > ++ page = kmap_atomic(host->drain_page); > ++ buf = page + host->drain_offset; > ++ > ++ while (host->drain_words) { > ++ u32 edm = readl(host->ioaddr + SDEDM); > ++ > ++ if ((edm >> 4) & 0x1f) > ++ *(buf++) = readl(host->ioaddr + SDDATA); > ++ host->drain_words--; > ++ } > ++ > ++ kunmap_atomic(page); > ++ local_irq_restore(flags); > ++ } > ++ > ++ bcm2835_finish_data(host); > ++ > ++ mutex_unlock(&host->mutex); > ++} > ++ > ++static void bcm2835_set_clock(struct bcm2835_host *host, unsigned int clock) > ++{ > ++ int div; > ++ > ++ /* The SDCDIV register has 11 bits, and holds (div - 2). But > ++ * in data mode the max is 50MHz wihout a minimum, and only > ++ * the bottom 3 bits are used. Since the switch over is > ++ * automatic (unless we have marked the card as slow...), > ++ * chosen values have to make sense in both modes. Ident mode > ++ * must be 100-400KHz, so can range check the requested > ++ * clock. CMD15 must be used to return to data mode, so this > ++ * can be monitored. > ++ * > ++ * clock 250MHz -> 0->125MHz, 1->83.3MHz, 2->62.5MHz, 3->50.0MHz > ++ * 4->41.7MHz, 5->35.7MHz, 6->31.3MHz, 7->27.8MHz > ++ * > ++ * 623->400KHz/27.8MHz > ++ * reset value (507)->491159/50MHz > ++ * > ++ * BUT, the 3-bit clock divisor in data mode is too small if > ++ * the core clock is higher than 250MHz, so instead use the > ++ * SLOW_CARD configuration bit to force the use of the ident > ++ * clock divisor at all times. > ++ */ > ++ > ++ if (clock < 100000) { > ++ /* Can't stop the clock, but make it as slow as possible > ++ * to show willing > ++ */ > ++ host->cdiv = SDCDIV_MAX_CDIV; > ++ writel(host->cdiv, host->ioaddr + SDCDIV); > ++ return; > ++ } > ++ > ++ div = host->max_clk / clock; > ++ if (div < 2) > ++ div = 2; > ++ if ((host->max_clk / div) > clock) > ++ div++; > ++ div -= 2; > ++ > ++ if (div > SDCDIV_MAX_CDIV) > ++ div = SDCDIV_MAX_CDIV; > ++ > ++ clock = host->max_clk / (div + 2); > ++ host->mmc->actual_clock = clock; > ++ > ++ /* Calibrate some delays */ > ++ > ++ host->ns_per_fifo_word = (1000000000 / clock) * > ++ ((host->mmc->caps & MMC_CAP_4_BIT_DATA) ? 8 : 32); > ++ > ++ host->cdiv = div; > ++ writel(host->cdiv, host->ioaddr + SDCDIV); > ++ > ++ /* Set the timeout to 500ms */ > ++ writel(host->mmc->actual_clock / 2, host->ioaddr + SDTOUT); > ++} > ++ > ++static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) > ++{ > ++ struct bcm2835_host *host = mmc_priv(mmc); > ++ struct device *dev = &host->pdev->dev; > ++ u32 edm, fsm; > ++ > ++ /* Reset the error statuses in case this is a retry */ > ++ if (mrq->sbc) > ++ mrq->sbc->error = 0; > ++ if (mrq->cmd) > ++ mrq->cmd->error = 0; > ++ if (mrq->data) > ++ mrq->data->error = 0; > ++ if (mrq->stop) > ++ mrq->stop->error = 0; > ++ > ++ if (mrq->data && !is_power_of_2(mrq->data->blksz)) { > ++ dev_err(dev, "unsupported block size (%d bytes)\n", > ++ mrq->data->blksz); > ++ mrq->cmd->error = -EINVAL; > ++ mmc_request_done(mmc, mrq); > ++ return; > ++ } > ++ > ++ if (host->use_dma && mrq->data && (mrq->data->blocks > PIO_THRESHOLD)) > ++ bcm2835_prepare_dma(host, mrq->data); > ++ > ++ mutex_lock(&host->mutex); > ++ > ++ WARN_ON(host->mrq); > ++ host->mrq = mrq; > ++ > ++ edm = readl(host->ioaddr + SDEDM); > ++ fsm = edm & SDEDM_FSM_MASK; > ++ > ++ if ((fsm != SDEDM_FSM_IDENTMODE) && > ++ (fsm != SDEDM_FSM_DATAMODE)) { > ++ dev_err(dev, "previous command (%d) not complete (EDM %08x)\n", > ++ readl(host->ioaddr + SDCMD) & SDCMD_CMD_MASK, > ++ edm); > ++ bcm2835_dumpregs(host); > ++ mrq->cmd->error = -EILSEQ; > ++ bcm2835_finish_request(host); > ++ mutex_unlock(&host->mutex); > ++ return; > ++ } > ++ > ++ host->use_sbc = !!mrq->sbc && (host->mrq->data->flags & MMC_DATA_READ); > ++ if (host->use_sbc) { > ++ if (bcm2835_send_command(host, mrq->sbc)) { > ++ if (!host->use_busy) > ++ bcm2835_finish_command(host); > ++ } > ++ } else if (bcm2835_send_command(host, mrq->cmd)) { > ++ if (host->data && host->dma_desc) { > ++ /* DMA transfer starts now, PIO starts after irq */ > ++ bcm2835_start_dma(host); > ++ } > ++ > ++ if (!host->use_busy) > ++ bcm2835_finish_command(host); > ++ } > ++ > ++ mutex_unlock(&host->mutex); > ++} > ++ > ++static void bcm2835_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) > ++{ > ++ struct bcm2835_host *host = mmc_priv(mmc); > ++ > ++ mutex_lock(&host->mutex); > ++ > ++ if (!ios->clock || ios->clock != host->clock) { > ++ bcm2835_set_clock(host, ios->clock); > ++ host->clock = ios->clock; > ++ } > ++ > ++ /* set bus width */ > ++ host->hcfg &= ~SDHCFG_WIDE_EXT_BUS; > ++ if (ios->bus_width == MMC_BUS_WIDTH_4) > ++ host->hcfg |= SDHCFG_WIDE_EXT_BUS; > ++ > ++ host->hcfg |= SDHCFG_WIDE_INT_BUS; > ++ > ++ /* Disable clever clock switching, to cope with fast core clocks */ > ++ host->hcfg |= SDHCFG_SLOW_CARD; > ++ > ++ writel(host->hcfg, host->ioaddr + SDHCFG); > ++ > ++ mutex_unlock(&host->mutex); > ++} > ++ > ++static struct mmc_host_ops bcm2835_ops = { > ++ .request = bcm2835_request, > ++ .set_ios = bcm2835_set_ios, > ++ .hw_reset = bcm2835_reset, > ++}; > ++ > ++static int bcm2835_add_host(struct bcm2835_host *host) > ++{ > ++ struct mmc_host *mmc = host->mmc; > ++ struct device *dev = &host->pdev->dev; > ++ char pio_limit_string[20]; > ++ int ret; > ++ > ++ mmc->f_max = host->max_clk; > ++ mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV; > ++ > ++ mmc->max_busy_timeout = ~0 / (mmc->f_max / 1000); > ++ > ++ dev_dbg(dev, "f_max %d, f_min %d, max_busy_timeout %d\n", > ++ mmc->f_max, mmc->f_min, mmc->max_busy_timeout); > ++ > ++ /* host controller capabilities */ > ++ mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED | > ++ MMC_CAP_NEEDS_POLL | MMC_CAP_HW_RESET | MMC_CAP_ERASE | > ++ MMC_CAP_CMD23; > ++ > ++ spin_lock_init(&host->lock); > ++ mutex_init(&host->mutex); > ++ > ++ if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) { > ++ dev_warn(dev, "unable to initialise DMA channel. Falling back > to PIO\n"); > ++ host->use_dma = false; > ++ } else { > ++ host->use_dma = true; > ++ > ++ host->dma_cfg_tx.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; > ++ host->dma_cfg_tx.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; > ++ host->dma_cfg_tx.slave_id = 13; /* DREQ channel */ > ++ host->dma_cfg_tx.direction = DMA_MEM_TO_DEV; > ++ host->dma_cfg_tx.src_addr = 0; > ++ host->dma_cfg_tx.dst_addr = host->phys_addr + SDDATA; > ++ > ++ host->dma_cfg_rx.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; > ++ host->dma_cfg_rx.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; > ++ host->dma_cfg_rx.slave_id = 13; /* DREQ channel */ > ++ host->dma_cfg_rx.direction = DMA_DEV_TO_MEM; > ++ host->dma_cfg_rx.src_addr = host->phys_addr + SDDATA; > ++ host->dma_cfg_rx.dst_addr = 0; > ++ > ++ if (dmaengine_slave_config(host->dma_chan_rxtx, > ++ &host->dma_cfg_tx) != 0 || > ++ dmaengine_slave_config(host->dma_chan_rxtx, > ++ &host->dma_cfg_rx) != 0) > ++ host->use_dma = false; > ++ } > ++ > ++ mmc->max_segs = 128; > ++ mmc->max_req_size = 524288; > ++ mmc->max_seg_size = mmc->max_req_size; > ++ mmc->max_blk_size = 1024; > ++ mmc->max_blk_count = 65535; > ++ > ++ /* report supported voltage ranges */ > ++ mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; > ++ > ++ INIT_WORK(&host->dma_work, bcm2835_dma_complete_work); > ++ INIT_DELAYED_WORK(&host->timeout_work, bcm2835_timeout); > ++ > ++ /* Set interrupt enables */ > ++ host->hcfg = SDHCFG_BUSY_IRPT_EN; > ++ > ++ bcm2835_reset_internal(host); > ++ > ++ ret = request_threaded_irq(host->irq, bcm2835_irq, > ++ bcm2835_threaded_irq, > ++ 0, mmc_hostname(mmc), host); > ++ if (ret) { > ++ dev_err(dev, "failed to request IRQ %d: %d\n", host->irq, ret); > ++ return ret; > ++ } > ++ > ++ ret = mmc_add_host(mmc); > ++ if (ret) { > ++ free_irq(host->irq, host); > ++ return ret; > ++ } > ++ > ++ pio_limit_string[0] = '\0'; > ++ if (host->use_dma && (PIO_THRESHOLD > 0)) > ++ sprintf(pio_limit_string, " (>%d)", PIO_THRESHOLD); > ++ dev_info(dev, "loaded - DMA %s%s\n", > ++ host->use_dma ? "enabled" : "disabled", pio_limit_string); > ++ > ++ return 0; > ++} > ++ > ++static int bcm2835_probe(struct platform_device *pdev) > ++{ > ++ struct device *dev = &pdev->dev; > ++ struct clk *clk; > ++ struct resource *iomem; > ++ struct bcm2835_host *host; > ++ struct mmc_host *mmc; > ++ const __be32 *regaddr_p; > ++ int ret; > ++ > ++ dev_dbg(dev, "%s\n", __func__); > ++ mmc = mmc_alloc_host(sizeof(*host), dev); > ++ if (!mmc) > ++ return -ENOMEM; > ++ > ++ mmc->ops = &bcm2835_ops; > ++ host = mmc_priv(mmc); > ++ host->mmc = mmc; > ++ host->pdev = pdev; > ++ spin_lock_init(&host->lock); > ++ > ++ iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0); > ++ host->ioaddr = devm_ioremap_resource(dev, iomem); > ++ if (IS_ERR(host->ioaddr)) { > ++ ret = PTR_ERR(host->ioaddr); > ++ goto err; > ++ } > ++ > ++ /* Parse OF address directly to get the physical address for > ++ * DMA to our registers. > ++ */ > ++ regaddr_p = of_get_address(pdev->dev.of_node, 0, NULL, NULL); > ++ if (!regaddr_p) { > ++ dev_err(dev, "Can't get phys address\n"); > ++ ret = -EINVAL; > ++ goto err; > ++ } > ++ > ++ host->phys_addr = be32_to_cpup(regaddr_p); > ++ > ++ host->dma_chan = NULL; > ++ host->dma_desc = NULL; > ++ > ++ host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx"); > ++ > ++ clk = devm_clk_get(dev, NULL); > ++ if (IS_ERR(clk)) { > ++ ret = PTR_ERR(clk); > ++ if (ret != -EPROBE_DEFER) > ++ dev_err(dev, "could not get clk: %d\n", ret); > ++ goto err; > ++ } > ++ > ++ host->max_clk = clk_get_rate(clk); > ++ > ++ host->irq = platform_get_irq(pdev, 0); > ++ if (host->irq <= 0) { > ++ dev_err(dev, "get IRQ failed\n"); > ++ ret = -EINVAL; > ++ goto err; > ++ } > ++ > ++ ret = mmc_of_parse(mmc); > ++ if (ret) > ++ goto err; > ++ > ++ ret = bcm2835_add_host(host); > ++ if (ret) > ++ goto err; > ++ > ++ platform_set_drvdata(pdev, host); > ++ > ++ dev_dbg(dev, "%s -> OK\n", __func__); > ++ > ++ return 0; > ++ > ++err: > ++ dev_dbg(dev, "%s -> err %d\n", __func__, ret); > ++ mmc_free_host(mmc); > ++ > ++ return ret; > ++} > ++ > ++static int bcm2835_remove(struct platform_device *pdev) > ++{ > ++ struct bcm2835_host *host = platform_get_drvdata(pdev); > ++ > ++ mmc_remove_host(host->mmc); > ++ > ++ writel(SDVDD_POWER_OFF, host->ioaddr + SDVDD); > ++ > ++ free_irq(host->irq, host); > ++ > ++ cancel_work_sync(&host->dma_work); > ++ cancel_delayed_work_sync(&host->timeout_work); > ++ > ++ mmc_free_host(host->mmc); > ++ platform_set_drvdata(pdev, NULL); > ++ > ++ return 0; > ++} > ++ > ++static const struct of_device_id bcm2835_match[] = { > ++ { .compatible = "brcm,bcm2835-sdhost" }, > ++ { } > ++}; > ++MODULE_DEVICE_TABLE(of, bcm2835_match); > ++ > ++static struct platform_driver bcm2835_driver = { > ++ .probe = bcm2835_probe, > ++ .remove = bcm2835_remove, > ++ .driver = { > ++ .name = "sdhost-bcm2835", > ++ .of_match_table = bcm2835_match, > ++ }, > ++}; > ++module_platform_driver(bcm2835_driver); > ++ > ++MODULE_ALIAS("platform:sdhost-bcm2835"); > ++MODULE_DESCRIPTION("BCM2835 SDHost driver"); > ++MODULE_LICENSE("GPL v2"); > ++MODULE_AUTHOR("Phil Elwell"); > diff --git > a/target/linux/brcm2708/patches-4.9/080-0002-mmc-bcm2835-Fix-possible-NULL-ptr-dereference-in-bcm.patch > > b/target/linux/brcm2708/patches-4.9/080-0002-mmc-bcm2835-Fix-possible-NULL-ptr-dereference-in-bcm.patch > new file mode 100644 > index 0000000000..f41bc9d379 > --- /dev/null > +++ > b/target/linux/brcm2708/patches-4.9/080-0002-mmc-bcm2835-Fix-possible-NULL-ptr-dereference-in-bcm.patch > @@ -0,0 +1,30 @@ > +From f6974cc20bb846169319b5dbe86fb2d79a002aa0 Mon Sep 17 00:00:00 2001 > +From: Stefan Wahren <stefan.wah...@i2se.com> > +Date: Sat, 25 Mar 2017 13:17:00 +0000 > +Subject: [PATCH] mmc: bcm2835: Fix possible NULL ptr dereference in > + bcm2835_request > + > +This fixes a NULL pointer dereference in case of a MMC request with a > +set block count command and no data. > + > +Reported-by: Dan Carpenter <dan.carpen...@oracle.com> > +Signed-off-by: Stefan Wahren <stefan.wah...@i2se.com> > +Tested-by: Peter Robinson <pbrobin...@gmail.com> > +Reviewed-by: Jaehoon Chung <jh80.ch...@samsung.com> > +Signed-off-by: Ulf Hansson <ulf.hans...@linaro.org> > +--- > + drivers/mmc/host/bcm2835.c | 3 ++- > + 1 file changed, 2 insertions(+), 1 deletion(-) > + > +--- a/drivers/mmc/host/bcm2835.c > ++++ b/drivers/mmc/host/bcm2835.c > +@@ -1200,7 +1200,8 @@ static void bcm2835_request(struct mmc_h > + return; > + } > + > +- host->use_sbc = !!mrq->sbc && (host->mrq->data->flags & MMC_DATA_READ); > ++ host->use_sbc = !!mrq->sbc && host->mrq->data && > ++ (host->mrq->data->flags & MMC_DATA_READ); > + if (host->use_sbc) { > + if (bcm2835_send_command(host, mrq->sbc)) { > + if (!host->use_busy) > diff --git > a/target/linux/brcm2708/patches-4.9/080-0100-mmc-bcm2835-rename-Kconfig-symbol-to-avoid-downstrea.patch > > b/target/linux/brcm2708/patches-4.9/080-0100-mmc-bcm2835-rename-Kconfig-symbol-to-avoid-downstrea.patch > new file mode 100644 > index 0000000000..d3178446ef > --- /dev/null > +++ > b/target/linux/brcm2708/patches-4.9/080-0100-mmc-bcm2835-rename-Kconfig-symbol-to-avoid-downstrea.patch > @@ -0,0 +1,40 @@ > +From add1f1fc554efd32c08515ec1addcd2f23cb6b22 Mon Sep 17 00:00:00 2001 > +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <ra...@milecki.pl> > +Date: Sat, 1 Apr 2017 14:36:31 +0200 > +Subject: [PATCH] mmc: bcm2835: rename Kconfig symbol to avoid downstream > + conflict > +MIME-Version: 1.0 > +Content-Type: text/plain; charset=UTF-8 > +Content-Transfer-Encoding: 8bit > + > +Downstream Linux adds "alternative MMC driver" with MMC_BCM2835 symbol. > +Until it's resolved rename backported symbol. > + > +Signed-off-by: Rafał Miłecki <ra...@milecki.pl> > +--- > + drivers/mmc/host/Kconfig | 2 +- > + drivers/mmc/host/Makefile | 2 +- > + 2 files changed, 2 insertions(+), 2 deletions(-) > + > +--- a/drivers/mmc/host/Kconfig > ++++ b/drivers/mmc/host/Kconfig > +@@ -769,7 +769,7 @@ config MMC_TOSHIBA_PCI > + depends on PCI > + help > + > +-config MMC_BCM2835 > ++config MMC_BCM2835_UPSTREAM > + tristate "Broadcom BCM2835 SDHOST MMC Controller support" > + depends on ARCH_BCM2835 || COMPILE_TEST > + depends on HAS_DMA > +--- a/drivers/mmc/host/Makefile > ++++ b/drivers/mmc/host/Makefile > +@@ -57,7 +57,7 @@ obj-$(CONFIG_MMC_MOXART) += moxart-mmc.o > + obj-$(CONFIG_MMC_SUNXI) += sunxi-mmc.o > + obj-$(CONFIG_MMC_USDHI6ROL0) += usdhi6rol0.o > + obj-$(CONFIG_MMC_TOSHIBA_PCI) += toshsd.o > +-obj-$(CONFIG_MMC_BCM2835) += bcm2835.o > ++obj-$(CONFIG_MMC_BCM2835_UPSTREAM) += bcm2835.o > + > + obj-$(CONFIG_MMC_REALTEK_PCI) += rtsx_pci_sdmmc.o > + obj-$(CONFIG_MMC_REALTEK_USB) += rtsx_usb_sdmmc.o > _______________________________________________ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
