net: wireless: bcmdhd: Make responce waiting uninterruptible
[linux-2.6.git] / drivers / net / wireless / bcmdhd / dhd_sdio.c
1 /*
2  * DHD Bus Module for SDIO
3  *
4  * Copyright (C) 1999-2011, Broadcom Corporation
5  * 
6  *         Unless you and Broadcom execute a separate written software license
7  * agreement governing use of this software, this software is licensed to you
8  * under the terms of the GNU General Public License version 2 (the "GPL"),
9  * available at http://www.broadcom.com/licenses/GPLv2.php, with the
10  * following added to such license:
11  * 
12  *      As a special exception, the copyright holders of this software give you
13  * permission to link this software with independent modules, and to copy and
14  * distribute the resulting executable under terms of your choice, provided that
15  * you also meet, for each linked independent module, the terms and conditions of
16  * the license of that module.  An independent module is a module which is not
17  * derived from this software.  The special exception does not apply to any
18  * modifications of the software.
19  * 
20  *      Notwithstanding the above, under no circumstances may you combine this
21  * software in any way with any other Broadcom software provided under a license
22  * other than the GPL, without Broadcom's express prior written consent.
23  *
24  * $Id: dhd_sdio.c 326662 2012-04-10 06:38:08Z $
25  */
26
27 #include <typedefs.h>
28 #include <osl.h>
29 #include <bcmsdh.h>
30
31 #ifdef BCMEMBEDIMAGE
32 #include BCMEMBEDIMAGE
33 #endif /* BCMEMBEDIMAGE */
34
35 #include <bcmdefs.h>
36 #include <bcmutils.h>
37 #include <bcmendian.h>
38 #include <bcmdevs.h>
39
40 #include <siutils.h>
41 #include <hndpmu.h>
42 #include <hndsoc.h>
43 #include <bcmsdpcm.h>
44 #if defined(DHD_DEBUG)
45 #include <hndrte_armtrap.h>
46 #include <hndrte_cons.h>
47 #endif /* defined(DHD_DEBUG) */
48 #include <sbchipc.h>
49 #include <sbhnddma.h>
50
51 #include <sdio.h>
52 #include <sbsdio.h>
53 #include <sbsdpcmdev.h>
54 #include <bcmsdpcm.h>
55 #include <bcmsdbus.h>
56
57 #include <proto/ethernet.h>
58 #include <proto/802.1d.h>
59 #include <proto/802.11.h>
60
61 #include <dngl_stats.h>
62 #include <dhd.h>
63 #include <dhd_bus.h>
64 #include <dhd_proto.h>
65 #include <dhd_dbg.h>
66 #include <dhdioctl.h>
67 #include <sdiovar.h>
68
69 #ifndef DHDSDIO_MEM_DUMP_FNAME
70 #define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
71 #endif
72
73 #define QLEN            256     /* bulk rx and tx queue lengths */
74 #define FCHI            (QLEN - 10)
75 #define FCLOW           (FCHI / 2)
76 #define PRIOMASK        7
77
78 #define TXRETRIES       2       /* # of retries for tx frames */
79
80 #define DHD_RXBOUND     50      /* Default for max rx frames in one scheduling */
81
82 #define DHD_TXBOUND     20      /* Default for max tx frames in one scheduling */
83
84 #define DHD_TXMINMAX    1       /* Max tx frames if rx still pending */
85
86 #define MEMBLOCK        2048            /* Block size used for downloading of dongle image */
87 #define MAX_NVRAMBUF_SIZE       4096    /* max nvram buf size */
88 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold biggest possible glom */
89
90 #ifndef DHD_FIRSTREAD
91 #define DHD_FIRSTREAD   32
92 #endif
93 #if !ISPOWEROF2(DHD_FIRSTREAD)
94 #error DHD_FIRSTREAD is not a power of 2!
95 #endif
96
97 /* Total length of frame header for dongle protocol */
98 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
99 #ifdef SDTEST
100 #define SDPCM_RESERVE   (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
101 #else
102 #define SDPCM_RESERVE   (SDPCM_HDRLEN + DHD_SDALIGN)
103 #endif
104
105 /* Space for header read, limit for data packets */
106 #ifndef MAX_HDR_READ
107 #define MAX_HDR_READ    32
108 #endif
109 #if !ISPOWEROF2(MAX_HDR_READ)
110 #error MAX_HDR_READ is not a power of 2!
111 #endif
112
113 #define MAX_RX_DATASZ   2048
114
115 /* Maximum milliseconds to wait for F2 to come up */
116 #define DHD_WAIT_F2RDY  3000
117
118 /* Bump up limit on waiting for HT to account for first startup;
119  * if the image is doing a CRC calculation before programming the PMU
120  * for HT availability, it could take a couple hundred ms more, so
121  * max out at a 1 second (1000000us).
122  */
123 #if (PMU_MAX_TRANSITION_DLY <= 1000000)
124 #undef PMU_MAX_TRANSITION_DLY
125 #define PMU_MAX_TRANSITION_DLY 1000000
126 #endif
127
128 /* Value for ChipClockCSR during initial setup */
129 #define DHD_INIT_CLKCTL1        (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
130 #define DHD_INIT_CLKCTL2        (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
131
132 /* Flags for SDH calls */
133 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
134
135 /* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
136  * bufpool was present for gspi bus.
137  */
138 #define PKTFREE2()              if ((bus->bus != SPI_BUS) || bus->usebufpool) \
139                                         PKTFREE(bus->dhd->osh, pkt, FALSE);
140 DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
141 #if defined(OOB_INTR_ONLY)
142 extern void bcmsdh_set_irq(int flag);
143 #endif /* defined(OOB_INTR_ONLY) */
144 #ifdef PROP_TXSTATUS
145 extern void dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success);
146 #endif
147
148 #ifdef DHD_DEBUG
149 /* Device console log buffer state */
150 #define CONSOLE_LINE_MAX        192
151 #define CONSOLE_BUFFER_MAX      2024
152 typedef struct dhd_console {
153         uint            count;                  /* Poll interval msec counter */
154         uint            log_addr;               /* Log struct address (fixed) */
155         hndrte_log_t    log;                    /* Log struct (host copy) */
156         uint            bufsize;                /* Size of log buffer */
157         uint8           *buf;                   /* Log buffer (host copy) */
158         uint            last;                   /* Last buffer read index */
159 } dhd_console_t;
160 #endif /* DHD_DEBUG */
161
162 /* Private data for SDIO bus interaction */
163 typedef struct dhd_bus {
164         dhd_pub_t       *dhd;
165
166         bcmsdh_info_t   *sdh;                   /* Handle for BCMSDH calls */
167         si_t            *sih;                   /* Handle for SI calls */
168         char            *vars;                  /* Variables (from CIS and/or other) */
169         uint            varsz;                  /* Size of variables buffer */
170         uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
171
172         sdpcmd_regs_t   *regs;                  /* Registers for SDIO core */
173         uint            sdpcmrev;               /* SDIO core revision */
174         uint            armrev;                 /* CPU core revision */
175         uint            ramrev;                 /* SOCRAM core revision */
176         uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
177         uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
178
179         uint32          bus;                    /* gSPI or SDIO bus */
180         uint32          hostintmask;            /* Copy of Host Interrupt Mask */
181         uint32          intstatus;              /* Intstatus bits (events) pending */
182         bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
183         bool            fcstate;                /* State of dongle flow-control */
184
185         uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
186         char            *fw_path; /* module_param: path to firmware image */
187         char            *nv_path; /* module_param: path to nvram vars file */
188         const char      *nvram_params;          /* user specified nvram params. */
189
190         uint            blocksize;              /* Block size of SDIO transfers */
191         uint            roundup;                /* Max roundup limit */
192
193         struct pktq     txq;                    /* Queue length used for flow-control */
194         uint8           flowcontrol;            /* per prio flow control bitmask */
195         uint8           tx_seq;                 /* Transmit sequence number (next) */
196         uint8           tx_max;                 /* Maximum transmit sequence allowed */
197
198         uint8           hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
199         uint8           *rxhdr;                 /* Header of current rx frame (in hdrbuf) */
200         uint16          nextlen;                /* Next Read Len from last header */
201         uint8           rx_seq;                 /* Receive sequence number (expected) */
202         bool            rxskip;                 /* Skip receive (awaiting NAK ACK) */
203
204         void            *glomd;                 /* Packet containing glomming descriptor */
205         void            *glom;                  /* Packet chain for glommed superframe */
206         uint            glomerr;                /* Glom packet read errors */
207
208         uint8           *rxbuf;                 /* Buffer for receiving control packets */
209         uint            rxblen;                 /* Allocated length of rxbuf */
210         uint8           *rxctl;                 /* Aligned pointer into rxbuf */
211         uint8           *databuf;               /* Buffer for receiving big glom packet */
212         uint8           *dataptr;               /* Aligned pointer into databuf */
213         uint            rxlen;                  /* Length of valid data in buffer */
214
215         uint8           sdpcm_ver;              /* Bus protocol reported by dongle */
216
217         bool            intr;                   /* Use interrupts */
218         bool            poll;                   /* Use polling */
219         bool            ipend;                  /* Device interrupt is pending */
220         bool            intdis;                 /* Interrupts disabled by isr */
221         uint            intrcount;              /* Count of device interrupt callbacks */
222         uint            lastintrs;              /* Count as of last watchdog timer */
223         uint            spurious;               /* Count of spurious interrupts */
224         uint            pollrate;               /* Ticks between device polls */
225         uint            polltick;               /* Tick counter */
226         uint            pollcnt;                /* Count of active polls */
227
228 #ifdef DHD_DEBUG
229         dhd_console_t   console;                /* Console output polling support */
230         uint            console_addr;           /* Console address from shared struct */
231 #endif /* DHD_DEBUG */
232
233         uint            regfails;               /* Count of R_REG/W_REG failures */
234
235         uint            clkstate;               /* State of sd and backplane clock(s) */
236         bool            activity;               /* Activity flag for clock down */
237         int32           idletime;               /* Control for activity timeout */
238         int32           idlecount;              /* Activity timeout counter */
239         int32           idleclock;              /* How to set bus driver when idle */
240         int32           sd_divisor;             /* Speed control to bus driver */
241         int32           sd_mode;                /* Mode control to bus driver */
242         int32           sd_rxchain;             /* If bcmsdh api accepts PKT chains */
243         bool            use_rxchain;            /* If dhd should use PKT chains */
244         bool            sleeping;               /* Is SDIO bus sleeping? */
245         bool            rxflow_mode;    /* Rx flow control mode */
246         bool            rxflow;                 /* Is rx flow control on */
247         uint            prev_rxlim_hit;         /* Is prev rx limit exceeded (per dpc schedule) */
248         bool            alp_only;               /* Don't use HT clock (ALP only) */
249         /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
250         bool            usebufpool;
251
252 #ifdef SDTEST
253         /* external loopback */
254         bool            ext_loop;
255         uint8           loopid;
256
257         /* pktgen configuration */
258         uint            pktgen_freq;            /* Ticks between bursts */
259         uint            pktgen_count;           /* Packets to send each burst */
260         uint            pktgen_print;           /* Bursts between count displays */
261         uint            pktgen_total;           /* Stop after this many */
262         uint            pktgen_minlen;          /* Minimum packet data len */
263         uint            pktgen_maxlen;          /* Maximum packet data len */
264         uint            pktgen_mode;            /* Configured mode: tx, rx, or echo */
265         uint            pktgen_stop;            /* Number of tx failures causing stop */
266
267         /* active pktgen fields */
268         uint            pktgen_tick;            /* Tick counter for bursts */
269         uint            pktgen_ptick;           /* Burst counter for printing */
270         uint            pktgen_sent;            /* Number of test packets generated */
271         uint            pktgen_rcvd;            /* Number of test packets received */
272         uint            pktgen_fail;            /* Number of failed send attempts */
273         uint16          pktgen_len;             /* Length of next packet to send */
274 #define PKTGEN_RCV_IDLE     (0)
275 #define PKTGEN_RCV_ONGOING  (1)
276         uint16          pktgen_rcv_state;               /* receive state */
277         uint            pktgen_rcvd_rcvsession; /* test pkts rcvd per rcv session. */
278 #endif /* SDTEST */
279
280         /* Some additional counters */
281         uint            tx_sderrs;              /* Count of tx attempts with sd errors */
282         uint            fcqueued;               /* Tx packets that got queued */
283         uint            rxrtx;                  /* Count of rtx requests (NAK to dongle) */
284         uint            rx_toolong;             /* Receive frames too long to receive */
285         uint            rxc_errors;             /* SDIO errors when reading control frames */
286         uint            rx_hdrfail;             /* SDIO errors on header reads */
287         uint            rx_badhdr;              /* Bad received headers (roosync?) */
288         uint            rx_badseq;              /* Mismatched rx sequence number */
289         uint            fc_rcvd;                /* Number of flow-control events received */
290         uint            fc_xoff;                /* Number which turned on flow-control */
291         uint            fc_xon;                 /* Number which turned off flow-control */
292         uint            rxglomfail;             /* Failed deglom attempts */
293         uint            rxglomframes;           /* Number of glom frames (superframes) */
294         uint            rxglompkts;             /* Number of packets from glom frames */
295         uint            f2rxhdrs;               /* Number of header reads */
296         uint            f2rxdata;               /* Number of frame data reads */
297         uint            f2txdata;               /* Number of f2 frame writes */
298         uint            f1regdata;              /* Number of f1 register accesses */
299
300         uint8           *ctrl_frame_buf;
301         uint32          ctrl_frame_len;
302         bool            ctrl_frame_stat;
303         uint32          rxint_mode;     /* rx interrupt mode */
304 } dhd_bus_t;
305
306 /* clkstate */
307 #define CLK_NONE        0
308 #define CLK_SDONLY      1
309 #define CLK_PENDING     2       /* Not used yet */
310 #define CLK_AVAIL       3
311
312 #define DHD_NOPMU(dhd)  (FALSE)
313
314 #ifdef DHD_DEBUG
315 static int qcount[NUMPRIO];
316 static int tx_packets[NUMPRIO];
317 #endif /* DHD_DEBUG */
318
319 /* Deferred transmit */
320 const uint dhd_deferred_tx = 1;
321
322 extern uint dhd_watchdog_ms;
323 extern void dhd_os_wd_timer(void *bus, uint wdtick);
324
325 /* Tx/Rx bounds */
326 uint dhd_txbound;
327 uint dhd_rxbound;
328 uint dhd_txminmax = DHD_TXMINMAX;
329
330 /* override the RAM size if possible */
331 #define DONGLE_MIN_MEMSIZE (128 *1024)
332 int dhd_dongle_memsize;
333
334 static bool dhd_doflow;
335 static bool dhd_alignctl;
336
337 static bool sd1idle;
338
339 static bool retrydata;
340 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
341
342 static const uint watermark = 8;
343 static const uint firstread = DHD_FIRSTREAD;
344
345 #define HDATLEN (firstread - (SDPCM_HDRLEN))
346
347 /* Retry count for register access failures */
348 static const uint retry_limit = 2;
349
350 /* Force even SD lengths (some host controllers mess up on odd bytes) */
351 static bool forcealign;
352
353 /* Flag to indicate if we should download firmware on driver load */
354 uint dhd_download_fw_on_driverload = TRUE;
355
356 #define ALIGNMENT  4
357
358 #if defined(OOB_INTR_ONLY) && defined(HW_OOB)
359 extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
360 #endif
361
362 #if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
363 #error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
364 #endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
365 #define PKTALIGN(osh, p, len, align)                                    \
366         do {                                                            \
367                 uint datalign;                                          \
368                 datalign = (uintptr)PKTDATA((osh), (p));                \
369                 datalign = ROUNDUP(datalign, (align)) - datalign;       \
370                 ASSERT(datalign < (align));                             \
371                 ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));       \
372                 if (datalign)                                           \
373                         PKTPULL((osh), (p), datalign);                  \
374                 PKTSETLEN((osh), (p), (len));                           \
375         } while (0)
376
377 /* Limit on rounding up frames */
378 static const uint max_roundup = 512;
379
380 /* Try doing readahead */
381 static bool dhd_readahead;
382
383 /* To check if there's window offered */
384 #define DATAOK(bus) \
385         (((uint8)(bus->tx_max - bus->tx_seq) > 1) && \
386         (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
387
388 /* To check if there's window offered for ctrl frame */
389 #define TXCTLOK(bus) \
390         (((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
391         (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
392
393 /* Macros to get register read/write status */
394 /* NOTE: these assume a local dhdsdio_bus_t *bus! */
395 #define R_SDREG(regvar, regaddr, retryvar) \
396 do { \
397         retryvar = 0; \
398         do { \
399                 regvar = R_REG(bus->dhd->osh, regaddr); \
400         } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
401         if (retryvar) { \
402                 bus->regfails += (retryvar-1); \
403                 if (retryvar > retry_limit) { \
404                         DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
405                                    __FUNCTION__, __LINE__)); \
406                         regvar = 0; \
407                 } \
408         } \
409 } while (0)
410
411 #define W_SDREG(regval, regaddr, retryvar) \
412 do { \
413         retryvar = 0; \
414         do { \
415                 W_REG(bus->dhd->osh, regaddr, regval); \
416         } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
417         if (retryvar) { \
418                 bus->regfails += (retryvar-1); \
419                 if (retryvar > retry_limit) \
420                         DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
421                                    __FUNCTION__, __LINE__)); \
422         } \
423 } while (0)
424
425 #define BUS_WAKE(bus) \
426         do { \
427                 if ((bus)->sleeping) \
428                         dhdsdio_bussleep((bus), FALSE); \
429         } while (0);
430
431 /*
432  * pktavail interrupts from dongle to host can be managed in 3 different ways
433  * whenever there is a packet available in dongle to transmit to host.
434  *
435  * Mode 0:      Dongle writes the software host mailbox and host is interrupted.
436  * Mode 1:      (sdiod core rev >= 4)
437  *              Device sets a new bit in the intstatus whenever there is a packet
438  *              available in fifo.  Host can't clear this specific status bit until all the
439  *              packets are read from the FIFO.  No need to ack dongle intstatus.
440  * Mode 2:      (sdiod core rev >= 4)
441  *              Device sets a bit in the intstatus, and host acks this by writing
442  *              one to this bit.  Dongle won't generate anymore packet interrupts
443  *              until host reads all the packets from the dongle and reads a zero to
444  *              figure that there are no more packets.  No need to disable host ints.
445  *              Need to ack the intstatus.
446  */
447
448 #define SDIO_DEVICE_HMB_RXINT           0       /* default old way */
449 #define SDIO_DEVICE_RXDATAINT_MODE_0    1       /* from sdiod rev 4 */
450 #define SDIO_DEVICE_RXDATAINT_MODE_1    2       /* from sdiod rev 4 */
451
452
453 #define FRAME_AVAIL_MASK(bus)   \
454         ((bus->rxint_mode == SDIO_DEVICE_HMB_RXINT) ? I_HMB_FRAME_IND : I_XMTDATA_AVAIL)
455
456 #define DHD_BUS                 SDIO_BUS
457
458 #define PKT_AVAILABLE(bus, intstatus)   ((intstatus) & (FRAME_AVAIL_MASK(bus)))
459
460 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
461
462 #define GSPI_PR55150_BAILOUT
463
464
465 #ifdef SDTEST
466 static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
467 static void dhdsdio_sdtest_set(dhd_bus_t *bus, uint8 count);
468 #endif
469
470 #ifdef DHD_DEBUG
471 static int dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size);
472 static int dhd_serialconsole(dhd_bus_t *bus, bool get, bool enable, int *bcmerror);
473 #endif /* DHD_DEBUG */
474
475 static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
476
477 static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
478 static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
479 static void dhdsdio_disconnect(void *ptr);
480 static bool dhdsdio_chipmatch(uint16 chipid);
481 static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
482                                  void * regsva, uint16  devid);
483 static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
484 static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
485 static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation,
486         bool reset_flag);
487
488 static void dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size);
489 static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
490         uint8 *buf, uint nbytes,
491         void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
492 static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
493         uint8 *buf, uint nbytes,
494         void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
495
496 static bool dhdsdio_download_firmware(dhd_bus_t *bus, osl_t *osh, void *sdh);
497 static int _dhdsdio_download_firmware(dhd_bus_t *bus);
498
499 static int dhdsdio_download_code_file(dhd_bus_t *bus, char *image_path);
500 static int dhdsdio_download_nvram(dhd_bus_t *bus);
501 #ifdef BCMEMBEDIMAGE
502 static int dhdsdio_download_code_array(dhd_bus_t *bus);
503 #endif
504
505 #ifdef WLMEDIA_HTSF
506 #include <htsf.h>
507 extern uint32 dhd_get_htsf(void *dhd, int ifidx);
508 #endif /* WLMEDIA_HTSF */
509
510 static void
511 dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
512 {
513         int32 min_size =  DONGLE_MIN_MEMSIZE;
514         /* Restrict the memsize to user specified limit */
515         DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
516                 dhd_dongle_memsize, min_size));
517         if ((dhd_dongle_memsize > min_size) &&
518                 (dhd_dongle_memsize < (int32)bus->orig_ramsize))
519                 bus->ramsize = dhd_dongle_memsize;
520 }
521
522 static int
523 dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
524 {
525         int err = 0;
526         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
527                          (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
528         if (!err)
529                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
530                                  (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
531         if (!err)
532                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
533                                  (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
534         return err;
535 }
536
537
538 /* Turn backplane clock on or off */
539 static int
540 dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
541 {
542         int err;
543         uint8 clkctl, clkreq, devctl;
544         bcmsdh_info_t *sdh;
545
546         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
547
548 #if defined(OOB_INTR_ONLY)
549         pendok = FALSE;
550 #endif
551         clkctl = 0;
552         sdh = bus->sdh;
553
554
555         if (on) {
556                 /* Request HT Avail */
557                 clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
558
559
560
561
562                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
563                 if (err) {
564                         DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
565                         return BCME_ERROR;
566                 }
567
568                 if (pendok &&
569                     ((bus->sih->buscoretype == PCMCIA_CORE_ID) && (bus->sih->buscorerev == 9))) {
570                         uint32 dummy, retries;
571                         R_SDREG(dummy, &bus->regs->clockctlstatus, retries);
572                 }
573
574                 /* Check current status */
575                 clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
576                 if (err) {
577                         DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
578                         return BCME_ERROR;
579                 }
580
581                 /* Go to pending and await interrupt if appropriate */
582                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
583                         /* Allow only clock-available interrupt */
584                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
585                         if (err) {
586                                 DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
587                                            __FUNCTION__, err));
588                                 return BCME_ERROR;
589                         }
590
591                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
592                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
593                         DHD_INFO(("CLKCTL: set PENDING\n"));
594                         bus->clkstate = CLK_PENDING;
595                         return BCME_OK;
596                 } else if (bus->clkstate == CLK_PENDING) {
597                         /* Cancel CA-only interrupt filter */
598                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
599                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
600                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
601                 }
602
603                 /* Otherwise, wait here (polling) for HT Avail */
604                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
605                         SPINWAIT_SLEEP(sdioh_spinwait_sleep,
606                                 ((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
607                                                             SBSDIO_FUNC1_CHIPCLKCSR, &err)),
608                                   !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
609                 }
610                 if (err) {
611                         DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
612                         return BCME_ERROR;
613                 }
614                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
615                         DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
616                                    __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
617                         return BCME_ERROR;
618                 }
619
620
621                 /* Mark clock available */
622                 bus->clkstate = CLK_AVAIL;
623                 DHD_INFO(("CLKCTL: turned ON\n"));
624
625 #if defined(DHD_DEBUG)
626                 if (bus->alp_only == TRUE) {
627 #if !defined(BCMLXSDMMC)
628                         if (!SBSDIO_ALPONLY(clkctl)) {
629                                 DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
630                         }
631 #endif /* !defined(BCMLXSDMMC) */
632                 } else {
633                         if (SBSDIO_ALPONLY(clkctl)) {
634                                 DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
635                         }
636                 }
637 #endif /* defined (DHD_DEBUG) */
638
639                 bus->activity = TRUE;
640         } else {
641                 clkreq = 0;
642
643                 if (bus->clkstate == CLK_PENDING) {
644                         /* Cancel CA-only interrupt filter */
645                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
646                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
647                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
648                 }
649
650                 bus->clkstate = CLK_SDONLY;
651                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
652                 DHD_INFO(("CLKCTL: turned OFF\n"));
653                 if (err) {
654                         DHD_ERROR(("%s: Failed access turning clock off: %d\n",
655                                    __FUNCTION__, err));
656                         return BCME_ERROR;
657                 }
658         }
659         return BCME_OK;
660 }
661
662 /* Change idle/active SD state */
663 static int
664 dhdsdio_sdclk(dhd_bus_t *bus, bool on)
665 {
666         int err;
667         int32 iovalue;
668
669         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
670
671         if (on) {
672                 if (bus->idleclock == DHD_IDLE_STOP) {
673                         /* Turn on clock and restore mode */
674                         iovalue = 1;
675                         err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
676                                               &iovalue, sizeof(iovalue), TRUE);
677                         if (err) {
678                                 DHD_ERROR(("%s: error enabling sd_clock: %d\n",
679                                            __FUNCTION__, err));
680                                 return BCME_ERROR;
681                         }
682
683                         iovalue = bus->sd_mode;
684                         err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
685                                               &iovalue, sizeof(iovalue), TRUE);
686                         if (err) {
687                                 DHD_ERROR(("%s: error changing sd_mode: %d\n",
688                                            __FUNCTION__, err));
689                                 return BCME_ERROR;
690                         }
691                 } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
692                         /* Restore clock speed */
693                         iovalue = bus->sd_divisor;
694                         err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
695                                               &iovalue, sizeof(iovalue), TRUE);
696                         if (err) {
697                                 DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
698                                            __FUNCTION__, err));
699                                 return BCME_ERROR;
700                         }
701                 }
702                 bus->clkstate = CLK_SDONLY;
703         } else {
704                 /* Stop or slow the SD clock itself */
705                 if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
706                         DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
707                                    __FUNCTION__, bus->sd_divisor, bus->sd_mode));
708                         return BCME_ERROR;
709                 }
710                 if (bus->idleclock == DHD_IDLE_STOP) {
711                         if (sd1idle) {
712                                 /* Change to SD1 mode and turn off clock */
713                                 iovalue = 1;
714                                 err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
715                                                       &iovalue, sizeof(iovalue), TRUE);
716                                 if (err) {
717                                         DHD_ERROR(("%s: error changing sd_clock: %d\n",
718                                                    __FUNCTION__, err));
719                                         return BCME_ERROR;
720                                 }
721                         }
722
723                         iovalue = 0;
724                         err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
725                                               &iovalue, sizeof(iovalue), TRUE);
726                         if (err) {
727                                 DHD_ERROR(("%s: error disabling sd_clock: %d\n",
728                                            __FUNCTION__, err));
729                                 return BCME_ERROR;
730                         }
731                 } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
732                         /* Set divisor to idle value */
733                         iovalue = bus->idleclock;
734                         err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
735                                               &iovalue, sizeof(iovalue), TRUE);
736                         if (err) {
737                                 DHD_ERROR(("%s: error changing sd_divisor: %d\n",
738                                            __FUNCTION__, err));
739                                 return BCME_ERROR;
740                         }
741                 }
742                 bus->clkstate = CLK_NONE;
743         }
744
745         return BCME_OK;
746 }
747
748 /* Transition SD and backplane clock readiness */
749 static int
750 dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
751 {
752         int ret = BCME_OK;
753 #ifdef DHD_DEBUG
754         uint oldstate = bus->clkstate;
755 #endif /* DHD_DEBUG */
756
757         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
758
759         /* Early exit if we're already there */
760         if (bus->clkstate == target) {
761                 if (target == CLK_AVAIL) {
762                         dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
763                         bus->activity = TRUE;
764                 }
765                 return ret;
766         }
767
768         switch (target) {
769         case CLK_AVAIL:
770                 /* Make sure SD clock is available */
771                 if (bus->clkstate == CLK_NONE)
772                         dhdsdio_sdclk(bus, TRUE);
773                 /* Now request HT Avail on the backplane */
774                 ret = dhdsdio_htclk(bus, TRUE, pendok);
775                 if (ret == BCME_OK) {
776                         dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
777                         bus->activity = TRUE;
778                 }
779                 break;
780
781         case CLK_SDONLY:
782                 /* Remove HT request, or bring up SD clock */
783                 if (bus->clkstate == CLK_NONE)
784                         ret = dhdsdio_sdclk(bus, TRUE);
785                 else if (bus->clkstate == CLK_AVAIL)
786                         ret = dhdsdio_htclk(bus, FALSE, FALSE);
787                 else
788                         DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
789                                    bus->clkstate, target));
790                 if (ret == BCME_OK) {
791                         dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
792                 }
793                 break;
794
795         case CLK_NONE:
796                 /* Make sure to remove HT request */
797                 if (bus->clkstate == CLK_AVAIL)
798                         ret = dhdsdio_htclk(bus, FALSE, FALSE);
799                 /* Now remove the SD clock */
800                 ret = dhdsdio_sdclk(bus, FALSE);
801 #ifdef DHD_DEBUG
802                 if (dhd_console_ms == 0)
803 #endif /* DHD_DEBUG */
804                 if (bus->poll == 0)
805                         dhd_os_wd_timer(bus->dhd, 0);
806                 break;
807         }
808 #ifdef DHD_DEBUG
809         DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
810 #endif /* DHD_DEBUG */
811
812         return ret;
813 }
814
815 static int
816 dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
817 {
818         bcmsdh_info_t *sdh = bus->sdh;
819         sdpcmd_regs_t *regs = bus->regs;
820         uint retries = 0;
821
822         DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
823                   (sleep ? "SLEEP" : "WAKE"),
824                   (bus->sleeping ? "SLEEP" : "WAKE")));
825
826         /* Done if we're already in the requested state */
827         if (sleep == bus->sleeping)
828                 return BCME_OK;
829
830         /* Going to sleep: set the alarm and turn off the lights... */
831         if (sleep) {
832                 /* Don't sleep if something is pending */
833                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
834                         return BCME_BUSY;
835
836
837                 /* Disable SDIO interrupts (no longer interested) */
838                 bcmsdh_intr_disable(bus->sdh);
839
840                 /* Make sure the controller has the bus up */
841                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
842
843                 /* Tell device to start using OOB wakeup */
844                 W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
845                 if (retries > retry_limit)
846                         DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
847
848                 /* Turn off our contribution to the HT clock request */
849                 dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
850
851                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
852                                  SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
853
854                 /* Isolate the bus */
855                 if (bus->sih->chip != BCM4329_CHIP_ID && bus->sih->chip != BCM4319_CHIP_ID) {
856                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
857                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
858                 }
859
860                 /* Change state */
861                 bus->sleeping = TRUE;
862
863         } else {
864                 /* Waking up: bus power up is ok, set local state */
865
866                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
867                                  0, NULL);
868
869                 /* Force pad isolation off if possible (in case power never toggled) */
870                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
871
872
873                 /* Make sure the controller has the bus up */
874                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
875
876                 /* Send misc interrupt to indicate OOB not needed */
877                 W_SDREG(0, &regs->tosbmailboxdata, retries);
878                 if (retries <= retry_limit)
879                         W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
880
881                 if (retries > retry_limit)
882                         DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
883
884                 /* Make sure we have SD bus access */
885                 dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
886
887                 /* Change state */
888                 bus->sleeping = FALSE;
889
890                 /* Enable interrupts again */
891                 if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
892                         bus->intdis = FALSE;
893                         bcmsdh_intr_enable(bus->sdh);
894                 }
895         }
896
897         return BCME_OK;
898 }
899
900 #if defined(OOB_INTR_ONLY)
901 void
902 dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
903 {
904 #if defined(HW_OOB)
905         bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
906 #else
907         sdpcmd_regs_t *regs = bus->regs;
908         uint retries = 0;
909
910         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
911         if (enable == TRUE) {
912
913                 /* Tell device to start using OOB wakeup */
914                 W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
915                 if (retries > retry_limit)
916                         DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
917
918         } else {
919                 /* Send misc interrupt to indicate OOB not needed */
920                 W_SDREG(0, &regs->tosbmailboxdata, retries);
921                 if (retries <= retry_limit)
922                         W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
923         }
924
925         /* Turn off our contribution to the HT clock request */
926         dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
927 #endif /* !defined(HW_OOB) */
928 }
929 #endif /* defined(OOB_INTR_ONLY) */
930
931 /* Writes a HW/SW header into the packet and sends it. */
932 /* Assumes: (a) header space already there, (b) caller holds lock */
933 static int
934 dhdsdio_txpkt(dhd_bus_t *bus, void *pkt, uint chan, bool free_pkt)
935 {
936         int ret;
937         osl_t *osh;
938         uint8 *frame;
939         uint16 len, pad1 = 0;
940         uint32 swheader;
941         uint retries = 0;
942         bcmsdh_info_t *sdh;
943         void *new;
944         int i;
945 #ifdef WLMEDIA_HTSF
946         char *p;
947         htsfts_t *htsf_ts;
948 #endif
949
950
951         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
952
953         sdh = bus->sdh;
954         osh = bus->dhd->osh;
955
956         if (bus->dhd->dongle_reset) {
957                 ret = BCME_NOTREADY;
958                 goto done;
959         }
960
961         frame = (uint8*)PKTDATA(osh, pkt);
962
963 #ifdef WLMEDIA_HTSF
964         if (PKTLEN(osh, pkt) >= 100) {
965                 p = PKTDATA(osh, pkt);
966                 htsf_ts = (htsfts_t*) (p + HTSF_HOSTOFFSET + 12);
967                 if (htsf_ts->magic == HTSFMAGIC) {
968                         htsf_ts->c20 = get_cycles();
969                         htsf_ts->t20 = dhd_get_htsf(bus->dhd->info, 0);
970                 }
971         }
972 #endif /* WLMEDIA_HTSF */
973
974         /* Add alignment padding, allocate new packet if needed */
975         if ((pad1 = ((uintptr)frame % DHD_SDALIGN))) {
976                 if (PKTHEADROOM(osh, pkt) < pad1) {
977                         DHD_INFO(("%s: insufficient headroom %d for %d pad1\n",
978                                   __FUNCTION__, (int)PKTHEADROOM(osh, pkt), pad1));
979                         bus->dhd->tx_realloc++;
980                         new = PKTGET(osh, (PKTLEN(osh, pkt) + DHD_SDALIGN), TRUE);
981                         if (!new) {
982                                 DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
983                                            __FUNCTION__, PKTLEN(osh, pkt) + DHD_SDALIGN));
984                                 ret = BCME_NOMEM;
985                                 goto done;
986                         }
987
988                         PKTALIGN(osh, new, PKTLEN(osh, pkt), DHD_SDALIGN);
989                         bcopy(PKTDATA(osh, pkt), PKTDATA(osh, new), PKTLEN(osh, pkt));
990                         if (free_pkt)
991                                 PKTFREE(osh, pkt, TRUE);
992                         /* free the pkt if canned one is not used */
993                         free_pkt = TRUE;
994                         pkt = new;
995                         frame = (uint8*)PKTDATA(osh, pkt);
996                         ASSERT(((uintptr)frame % DHD_SDALIGN) == 0);
997                         pad1 = 0;
998                 } else {
999                         PKTPUSH(osh, pkt, pad1);
1000                         frame = (uint8*)PKTDATA(osh, pkt);
1001
1002                         ASSERT((pad1 + SDPCM_HDRLEN) <= (int) PKTLEN(osh, pkt));
1003                         bzero(frame, pad1 + SDPCM_HDRLEN);
1004                 }
1005         }
1006         ASSERT(pad1 < DHD_SDALIGN);
1007
1008         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1009         len = (uint16)PKTLEN(osh, pkt);
1010         *(uint16*)frame = htol16(len);
1011         *(((uint16*)frame) + 1) = htol16(~len);
1012
1013         /* Software tag: channel, sequence number, data offset */
1014         swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1015                 (((pad1 + SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1016         htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
1017         htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1018
1019 #ifdef DHD_DEBUG
1020         if (PKTPRIO(pkt) < ARRAYSIZE(tx_packets)) {
1021                 tx_packets[PKTPRIO(pkt)]++;
1022         }
1023         if (DHD_BYTES_ON() &&
1024             (((DHD_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
1025               (DHD_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
1026                 prhex("Tx Frame", frame, len);
1027         } else if (DHD_HDRS_ON()) {
1028                 prhex("TxHdr", frame, MIN(len, 16));
1029         }
1030 #endif
1031
1032         /* Raise len to next SDIO block to eliminate tail command */
1033         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1034                 uint16 pad2 = bus->blocksize - (len % bus->blocksize);
1035                 if ((pad2 <= bus->roundup) && (pad2 < bus->blocksize))
1036 #ifdef NOTUSED
1037                         if (pad2 <= PKTTAILROOM(osh, pkt))
1038 #endif /* NOTUSED */
1039                                 len += pad2;
1040         } else if (len % DHD_SDALIGN) {
1041                 len += DHD_SDALIGN - (len % DHD_SDALIGN);
1042         }
1043
1044         /* Some controllers have trouble with odd bytes -- round to even */
1045         if (forcealign && (len & (ALIGNMENT - 1))) {
1046 #ifdef NOTUSED
1047                 if (PKTTAILROOM(osh, pkt))
1048 #endif
1049                         len = ROUNDUP(len, ALIGNMENT);
1050 #ifdef NOTUSED
1051                 else
1052                         DHD_ERROR(("%s: sending unrounded %d-byte packet\n", __FUNCTION__, len));
1053 #endif
1054         }
1055
1056         do {
1057                 ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
1058                                           frame, len, pkt, NULL, NULL);
1059                 bus->f2txdata++;
1060                 ASSERT(ret != BCME_PENDING);
1061
1062                 if (ret < 0) {
1063                         /* On failure, abort the command and terminate the frame */
1064                         DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
1065                                   __FUNCTION__, ret));
1066                         bus->tx_sderrs++;
1067
1068                         bcmsdh_abort(sdh, SDIO_FUNC_2);
1069                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
1070                                          SFC_WF_TERM, NULL);
1071                         bus->f1regdata++;
1072
1073                         for (i = 0; i < 3; i++) {
1074                                 uint8 hi, lo;
1075                                 hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1076                                                      SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1077                                 lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1078                                                      SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1079                                 bus->f1regdata += 2;
1080                                 if ((hi == 0) && (lo == 0))
1081                                         break;
1082                         }
1083
1084                 }
1085                 if (ret == 0) {
1086                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1087                 }
1088         } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
1089
1090 done:
1091         /* restore pkt buffer pointer before calling tx complete routine */
1092         PKTPULL(osh, pkt, SDPCM_HDRLEN + pad1);
1093 #ifdef PROP_TXSTATUS
1094         if (bus->dhd->wlfc_state) {
1095                 dhd_os_sdunlock(bus->dhd);
1096                 dhd_wlfc_txcomplete(bus->dhd, pkt, ret == 0);
1097                 dhd_os_sdlock(bus->dhd);
1098         } else {
1099 #endif /* PROP_TXSTATUS */
1100         dhd_txcomplete(bus->dhd, pkt, ret != 0);
1101         if (free_pkt)
1102                 PKTFREE(osh, pkt, TRUE);
1103
1104 #ifdef PROP_TXSTATUS
1105         }
1106 #endif
1107         return ret;
1108 }
1109
1110 int
1111 dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
1112 {
1113         int ret = BCME_ERROR;
1114         osl_t *osh;
1115         uint datalen, prec;
1116
1117         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1118
1119         osh = bus->dhd->osh;
1120         datalen = PKTLEN(osh, pkt);
1121
1122 #ifdef SDTEST
1123         /* Push the test header if doing loopback */
1124         if (bus->ext_loop) {
1125                 uint8* data;
1126                 PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
1127                 data = PKTDATA(osh, pkt);
1128                 *data++ = SDPCM_TEST_ECHOREQ;
1129                 *data++ = (uint8)bus->loopid++;
1130                 *data++ = (datalen >> 0);
1131                 *data++ = (datalen >> 8);
1132                 datalen += SDPCM_TEST_HDRLEN;
1133         }
1134 #endif /* SDTEST */
1135
1136         /* Add space for the header */
1137         PKTPUSH(osh, pkt, SDPCM_HDRLEN);
1138         ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
1139
1140         prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
1141 #ifndef DHDTHREAD
1142         /* Lock: we're about to use shared data/code (and SDIO) */
1143         dhd_os_sdlock(bus->dhd);
1144 #endif /* DHDTHREAD */
1145
1146         /* Check for existing queue, current flow-control, pending event, or pending clock */
1147         if (dhd_deferred_tx || bus->fcstate || pktq_len(&bus->txq) || bus->dpc_sched ||
1148             (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
1149             (bus->clkstate != CLK_AVAIL)) {
1150                 DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__,
1151                         pktq_len(&bus->txq)));
1152                 bus->fcqueued++;
1153
1154                 /* Priority based enq */
1155                 dhd_os_sdlock_txq(bus->dhd);
1156                 if (dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec) == FALSE) {
1157                         PKTPULL(osh, pkt, SDPCM_HDRLEN);
1158 #ifndef DHDTHREAD
1159                         /* Need to also release txqlock before releasing sdlock.
1160                          * This thread still has txqlock and releases sdlock.
1161                          * Deadlock happens when dpc() grabs sdlock first then
1162                          * attempts to grab txqlock.
1163                          */
1164                         dhd_os_sdunlock_txq(bus->dhd);
1165                         dhd_os_sdunlock(bus->dhd);
1166 #endif
1167 #ifdef PROP_TXSTATUS
1168                         if (bus->dhd->wlfc_state)
1169                                 dhd_wlfc_txcomplete(bus->dhd, pkt, FALSE);
1170                         else
1171 #endif
1172                         dhd_txcomplete(bus->dhd, pkt, FALSE);
1173 #ifndef DHDTHREAD
1174                         dhd_os_sdlock(bus->dhd);
1175                         dhd_os_sdlock_txq(bus->dhd);
1176 #endif
1177 #ifdef PROP_TXSTATUS
1178                         /* let the caller decide whether to free the packet */
1179                 if (!bus->dhd->wlfc_state)
1180 #endif
1181                         PKTFREE(osh, pkt, TRUE);
1182                         ret = BCME_NORESOURCE;
1183                 }
1184                 else
1185                         ret = BCME_OK;
1186                 dhd_os_sdunlock_txq(bus->dhd);
1187
1188                 if ((pktq_len(&bus->txq) >= FCHI) && dhd_doflow)
1189                         dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
1190
1191 #ifdef DHD_DEBUG
1192                 if (pktq_plen(&bus->txq, prec) > qcount[prec])
1193                         qcount[prec] = pktq_plen(&bus->txq, prec);
1194 #endif
1195                 /* Schedule DPC if needed to send queued packet(s) */
1196                 if (dhd_deferred_tx && !bus->dpc_sched) {
1197                         bus->dpc_sched = TRUE;
1198                         dhd_sched_dpc(bus->dhd);
1199                 }
1200         } else {
1201 #ifdef DHDTHREAD
1202                 /* Lock: we're about to use shared data/code (and SDIO) */
1203                 dhd_os_sdlock(bus->dhd);
1204 #endif /* DHDTHREAD */
1205
1206                 /* Otherwise, send it now */
1207                 BUS_WAKE(bus);
1208                 /* Make sure back plane ht clk is on, no pending allowed */
1209                 dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
1210 #ifndef SDTEST
1211                 ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
1212 #else
1213                 ret = dhdsdio_txpkt(bus, pkt,
1214                         (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
1215 #endif
1216                 if (ret)
1217                         bus->dhd->tx_errors++;
1218                 else
1219                         bus->dhd->dstats.tx_bytes += datalen;
1220
1221                 if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1222                         bus->activity = FALSE;
1223                         dhdsdio_clkctl(bus, CLK_NONE, TRUE);
1224                 }
1225
1226 #ifdef DHDTHREAD
1227                 dhd_os_sdunlock(bus->dhd);
1228 #endif /* DHDTHREAD */
1229         }
1230
1231 #ifndef DHDTHREAD
1232         dhd_os_sdunlock(bus->dhd);
1233 #endif /* DHDTHREAD */
1234
1235         return ret;
1236 }
1237
1238 static uint
1239 dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
1240 {
1241         void *pkt;
1242         uint32 intstatus = 0;
1243         uint retries = 0;
1244         int ret = 0, prec_out;
1245         uint cnt = 0;
1246         uint datalen;
1247         uint8 tx_prec_map;
1248
1249         dhd_pub_t *dhd = bus->dhd;
1250         sdpcmd_regs_t *regs = bus->regs;
1251
1252         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1253
1254         tx_prec_map = ~bus->flowcontrol;
1255
1256         /* Send frames until the limit or some other event */
1257         for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
1258                 dhd_os_sdlock_txq(bus->dhd);
1259                 if ((pkt = pktq_mdeq(&bus->txq, tx_prec_map, &prec_out)) == NULL) {
1260                         dhd_os_sdunlock_txq(bus->dhd);
1261                         break;
1262                 }
1263                 dhd_os_sdunlock_txq(bus->dhd);
1264                 datalen = PKTLEN(bus->dhd->osh, pkt) - SDPCM_HDRLEN;
1265
1266 #ifndef SDTEST
1267                 ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
1268 #else
1269                 ret = dhdsdio_txpkt(bus, pkt,
1270                         (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
1271 #endif
1272                 if (ret)
1273                         bus->dhd->tx_errors++;
1274                 else
1275                         bus->dhd->dstats.tx_bytes += datalen;
1276
1277                 /* In poll mode, need to check for other events */
1278                 if (!bus->intr && cnt)
1279                 {
1280                         /* Check device status, signal pending interrupt */
1281                         R_SDREG(intstatus, &regs->intstatus, retries);
1282                         bus->f2txdata++;
1283                         if (bcmsdh_regfail(bus->sdh))
1284                                 break;
1285                         if (intstatus & bus->hostintmask)
1286                                 bus->ipend = TRUE;
1287                 }
1288         }
1289
1290         /* Deflow-control stack if needed */
1291         if (dhd_doflow && dhd->up && (dhd->busstate == DHD_BUS_DATA) &&
1292             dhd->txoff && (pktq_len(&bus->txq) < FCLOW))
1293                 dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);
1294
1295         return cnt;
1296 }
1297
1298 int
1299 dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
1300 {
1301         uint8 *frame;
1302         uint16 len;
1303         uint32 swheader;
1304         uint retries = 0;
1305         bcmsdh_info_t *sdh = bus->sdh;
1306         uint8 doff = 0;
1307         int ret = -1;
1308         int i;
1309
1310         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1311
1312         if (bus->dhd->dongle_reset)
1313                 return -EIO;
1314
1315         /* Back the pointer to make a room for bus header */
1316         frame = msg - SDPCM_HDRLEN;
1317         len = (msglen += SDPCM_HDRLEN);
1318
1319         /* Add alignment padding (optional for ctl frames) */
1320         if (dhd_alignctl) {
1321                 if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
1322                         frame -= doff;
1323                         len += doff;
1324                         msglen += doff;
1325                         bzero(frame, doff + SDPCM_HDRLEN);
1326                 }
1327                 ASSERT(doff < DHD_SDALIGN);
1328         }
1329         doff += SDPCM_HDRLEN;
1330
1331         /* Round send length to next SDIO block */
1332         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1333                 uint16 pad = bus->blocksize - (len % bus->blocksize);
1334                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1335                         len += pad;
1336         } else if (len % DHD_SDALIGN) {
1337                 len += DHD_SDALIGN - (len % DHD_SDALIGN);
1338         }
1339
1340         /* Satisfy length-alignment requirements */
1341         if (forcealign && (len & (ALIGNMENT - 1)))
1342                 len = ROUNDUP(len, ALIGNMENT);
1343
1344         ASSERT(ISALIGNED((uintptr)frame, 2));
1345
1346
1347         /* Need to lock here to protect txseq and SDIO tx calls */
1348         dhd_os_sdlock(bus->dhd);
1349
1350         BUS_WAKE(bus);
1351
1352         /* Make sure backplane clock is on */
1353         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
1354
1355         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1356         *(uint16*)frame = htol16((uint16)msglen);
1357         *(((uint16*)frame) + 1) = htol16(~msglen);
1358
1359         /* Software tag: channel, sequence number, data offset */
1360         swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
1361                 | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1362         htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
1363         htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1364
1365         if (!TXCTLOK(bus)) {
1366                 DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
1367                         __FUNCTION__, bus->tx_max, bus->tx_seq));
1368                 bus->ctrl_frame_stat = TRUE;
1369                 /* Send from dpc */
1370                 bus->ctrl_frame_buf = frame;
1371                 bus->ctrl_frame_len = len;
1372                 dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
1373                 if (bus->ctrl_frame_stat == FALSE) {
1374                         DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
1375                         ret = 0;
1376                 } else {
1377                         bus->dhd->txcnt_timeout++;
1378                         if (!bus->dhd->hang_was_sent)
1379                                 DHD_ERROR(("%s: ctrl_frame_stat == TRUE txcnt_timeout=%d\n",
1380                                         __FUNCTION__, bus->dhd->txcnt_timeout));
1381                         ret = -1;
1382                         bus->ctrl_frame_stat = FALSE;
1383                         goto done;
1384                 }
1385         }
1386
1387         bus->dhd->txcnt_timeout = 0;
1388
1389         if (ret == -1) {
1390 #ifdef DHD_DEBUG
1391                 if (DHD_BYTES_ON() && DHD_CTL_ON()) {
1392                         prhex("Tx Frame", frame, len);
1393                 } else if (DHD_HDRS_ON()) {
1394                         prhex("TxHdr", frame, MIN(len, 16));
1395                 }
1396 #endif
1397
1398                 do {
1399                         ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
1400                                                   frame, len, NULL, NULL, NULL);
1401                         ASSERT(ret != BCME_PENDING);
1402
1403                         if (ret < 0) {
1404                         /* On failure, abort the command and terminate the frame */
1405                                 DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
1406                                           __FUNCTION__, ret));
1407                                 bus->tx_sderrs++;
1408
1409                                 bcmsdh_abort(sdh, SDIO_FUNC_2);
1410
1411                                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
1412                                                  SFC_WF_TERM, NULL);
1413                                 bus->f1regdata++;
1414
1415                                 for (i = 0; i < 3; i++) {
1416                                         uint8 hi, lo;
1417                                         hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1418                                                              SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1419                                         lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1420                                                              SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1421                                         bus->f1regdata += 2;
1422                                         if ((hi == 0) && (lo == 0))
1423                                                 break;
1424                                 }
1425
1426                         }
1427                         if (ret == 0) {
1428                                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1429                         }
1430                 } while ((ret < 0) && retries++ < TXRETRIES);
1431         }
1432
1433 done:
1434         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1435                 bus->activity = FALSE;
1436                 dhdsdio_clkctl(bus, CLK_NONE, TRUE);
1437         }
1438
1439         dhd_os_sdunlock(bus->dhd);
1440
1441         if (ret)
1442                 bus->dhd->tx_ctlerrs++;
1443         else
1444                 bus->dhd->tx_ctlpkts++;
1445
1446         if (bus->dhd->txcnt_timeout >= MAX_CNTL_TIMEOUT)
1447                 return -ETIMEDOUT;
1448
1449         return ret ? -EIO : 0;
1450 }
1451
1452 int
1453 dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
1454 {
1455         int timeleft;
1456         uint rxlen = 0;
1457         bool pending = FALSE;
1458
1459         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1460
1461         if (bus->dhd->dongle_reset)
1462                 return -EIO;
1463
1464         /* Wait until control frame is available */
1465         timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen, &pending);
1466
1467         dhd_os_sdlock(bus->dhd);
1468         rxlen = bus->rxlen;
1469         bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
1470         bus->rxlen = 0;
1471         dhd_os_sdunlock(bus->dhd);
1472
1473         if (rxlen) {
1474                 DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
1475                          __FUNCTION__, rxlen, msglen));
1476         } else if (timeleft == 0) {
1477                 DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
1478 #ifdef DHD_DEBUG
1479                 dhd_os_sdlock(bus->dhd);
1480                 dhdsdio_checkdied(bus, NULL, 0);
1481                 dhd_os_sdunlock(bus->dhd);
1482 #endif /* DHD_DEBUG */
1483         } else if (pending == TRUE) {
1484                 /* signal pending */
1485                 DHD_ERROR(("%s: signal pending\n", __FUNCTION__));
1486                 return -EINTR;
1487         } else {
1488                 DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
1489 #ifdef DHD_DEBUG
1490                 dhd_os_sdlock(bus->dhd);
1491                 dhdsdio_checkdied(bus, NULL, 0);
1492                 dhd_os_sdunlock(bus->dhd);
1493 #endif /* DHD_DEBUG */
1494         }
1495         if (timeleft == 0) {
1496                 bus->dhd->rxcnt_timeout++;
1497                 DHD_ERROR(("%s: rxcnt_timeout=%d\n", __FUNCTION__, bus->dhd->rxcnt_timeout));
1498         }
1499         else
1500                 bus->dhd->rxcnt_timeout = 0;
1501
1502         if (rxlen)
1503                 bus->dhd->rx_ctlpkts++;
1504         else
1505                 bus->dhd->rx_ctlerrs++;
1506
1507         if (bus->dhd->rxcnt_timeout >= MAX_CNTL_TIMEOUT)
1508                 return -ETIMEDOUT;
1509
1510         return rxlen ? (int)rxlen : -EIO;
1511 }
1512
1513 /* IOVar table */
1514 enum {
1515         IOV_INTR = 1,
1516         IOV_POLLRATE,
1517         IOV_SDREG,
1518         IOV_SBREG,
1519         IOV_SDCIS,
1520         IOV_MEMBYTES,
1521         IOV_MEMSIZE,
1522 #ifdef DHD_DEBUG
1523         IOV_CHECKDIED,
1524         IOV_SERIALCONS,
1525 #endif /* DHD_DEBUG */
1526         IOV_DOWNLOAD,
1527         IOV_SOCRAM_STATE,
1528         IOV_FORCEEVEN,
1529         IOV_SDIOD_DRIVE,
1530         IOV_READAHEAD,
1531         IOV_SDRXCHAIN,
1532         IOV_ALIGNCTL,
1533         IOV_SDALIGN,
1534         IOV_DEVRESET,
1535         IOV_CPU,
1536 #ifdef SDTEST
1537         IOV_PKTGEN,
1538         IOV_EXTLOOP,
1539 #endif /* SDTEST */
1540         IOV_SPROM,
1541         IOV_TXBOUND,
1542         IOV_RXBOUND,
1543         IOV_TXMINMAX,
1544         IOV_IDLETIME,
1545         IOV_IDLECLOCK,
1546         IOV_SD1IDLE,
1547         IOV_SLEEP,
1548         IOV_DONGLEISOLATION,
1549         IOV_VARS,
1550 #ifdef SOFTAP
1551         IOV_FWPATH
1552 #endif
1553 };
1554
1555 const bcm_iovar_t dhdsdio_iovars[] = {
1556         {"intr",        IOV_INTR,       0,      IOVT_BOOL,      0 },
1557         {"sleep",       IOV_SLEEP,      0,      IOVT_BOOL,      0 },
1558         {"pollrate",    IOV_POLLRATE,   0,      IOVT_UINT32,    0 },
1559         {"idletime",    IOV_IDLETIME,   0,      IOVT_INT32,     0 },
1560         {"idleclock",   IOV_IDLECLOCK,  0,      IOVT_INT32,     0 },
1561         {"sd1idle",     IOV_SD1IDLE,    0,      IOVT_BOOL,      0 },
1562         {"membytes",    IOV_MEMBYTES,   0,      IOVT_BUFFER,    2 * sizeof(int) },
1563         {"memsize",     IOV_MEMSIZE,    0,      IOVT_UINT32,    0 },
1564         {"download",    IOV_DOWNLOAD,   0,      IOVT_BOOL,      0 },
1565         {"socram_state",        IOV_SOCRAM_STATE,       0,      IOVT_BOOL,      0 },
1566         {"vars",        IOV_VARS,       0,      IOVT_BUFFER,    0 },
1567         {"sdiod_drive", IOV_SDIOD_DRIVE, 0,     IOVT_UINT32,    0 },
1568         {"readahead",   IOV_READAHEAD,  0,      IOVT_BOOL,      0 },
1569         {"sdrxchain",   IOV_SDRXCHAIN,  0,      IOVT_BOOL,      0 },
1570         {"alignctl",    IOV_ALIGNCTL,   0,      IOVT_BOOL,      0 },
1571         {"sdalign",     IOV_SDALIGN,    0,      IOVT_BOOL,      0 },
1572         {"devreset",    IOV_DEVRESET,   0,      IOVT_BOOL,      0 },
1573 #ifdef DHD_DEBUG
1574         {"sdreg",       IOV_SDREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
1575         {"sbreg",       IOV_SBREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
1576         {"sd_cis",      IOV_SDCIS,      0,      IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
1577         {"forcealign",  IOV_FORCEEVEN,  0,      IOVT_BOOL,      0 },
1578         {"txbound",     IOV_TXBOUND,    0,      IOVT_UINT32,    0 },
1579         {"rxbound",     IOV_RXBOUND,    0,      IOVT_UINT32,    0 },
1580         {"txminmax",    IOV_TXMINMAX,   0,      IOVT_UINT32,    0 },
1581         {"cpu",         IOV_CPU,        0,      IOVT_BOOL,      0 },
1582 #ifdef DHD_DEBUG
1583         {"checkdied",   IOV_CHECKDIED,  0,      IOVT_BUFFER,    0 },
1584         {"serial",      IOV_SERIALCONS, 0,      IOVT_UINT32,    0 },
1585 #endif /* DHD_DEBUG  */
1586 #endif /* DHD_DEBUG */
1587 #ifdef SDTEST
1588         {"extloop",     IOV_EXTLOOP,    0,      IOVT_BOOL,      0 },
1589         {"pktgen",      IOV_PKTGEN,     0,      IOVT_BUFFER,    sizeof(dhd_pktgen_t) },
1590 #endif /* SDTEST */
1591         {"dngl_isolation", IOV_DONGLEISOLATION, 0,      IOVT_UINT32,    0 },
1592 #ifdef SOFTAP
1593         {"fwpath", IOV_FWPATH, 0, IOVT_BUFFER, 0 },
1594 #endif
1595         {NULL, 0, 0, 0, 0 }
1596 };
1597
1598 static void
1599 dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
1600 {
1601         uint q1, q2;
1602
1603         if (!div) {
1604                 bcm_bprintf(strbuf, "%s N/A", desc);
1605         } else {
1606                 q1 = num / div;
1607                 q2 = (100 * (num - (q1 * div))) / div;
1608                 bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
1609         }
1610 }
1611
1612 void
1613 dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
1614 {
1615         dhd_bus_t *bus = dhdp->bus;
1616
1617         bcm_bprintf(strbuf, "Bus SDIO structure:\n");
1618         bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
1619                     bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
1620         bcm_bprintf(strbuf, "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
1621                     bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
1622                     bus->rxlen, bus->rx_seq);
1623         bcm_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
1624                     bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
1625         bcm_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
1626                     bus->pollrate, bus->pollcnt, bus->regfails);
1627
1628         bcm_bprintf(strbuf, "\nAdditional counters:\n");
1629         bcm_bprintf(strbuf, "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
1630                     bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
1631                     bus->rxc_errors);
1632         bcm_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
1633                     bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
1634         bcm_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
1635                     bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
1636         bcm_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
1637                     bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
1638         bcm_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs %d\n",
1639                     (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
1640                     bus->f2txdata, bus->f1regdata);
1641         {
1642                 dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
1643                              (bus->f2rxhdrs + bus->f2rxdata));
1644                 dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
1645                 dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
1646                              (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
1647                 dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
1648                 bcm_bprintf(strbuf, "\n");
1649
1650                 dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
1651                              bus->dhd->rx_packets);
1652                 dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
1653                 bcm_bprintf(strbuf, "\n");
1654
1655                 dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
1656                 dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
1657                 dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
1658                              (bus->f2txdata + bus->f1regdata));
1659                 dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
1660                 bcm_bprintf(strbuf, "\n");
1661
1662                 dhd_dump_pct(strbuf, "Total: pkts/f2rw",
1663                              (bus->dhd->tx_packets + bus->dhd->rx_packets),
1664                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
1665                 dhd_dump_pct(strbuf, ", pkts/f1sd",
1666                              (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
1667                 dhd_dump_pct(strbuf, ", pkts/sd",
1668                              (bus->dhd->tx_packets + bus->dhd->rx_packets),
1669                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
1670                 dhd_dump_pct(strbuf, ", pkts/int",
1671                              (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
1672                 bcm_bprintf(strbuf, "\n\n");
1673         }
1674
1675 #ifdef SDTEST
1676         if (bus->pktgen_count) {
1677                 bcm_bprintf(strbuf, "pktgen config and count:\n");
1678                 bcm_bprintf(strbuf, "freq %d count %d print %d total %d min %d len %d\n",
1679                             bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
1680                             bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
1681                 bcm_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
1682                             bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
1683         }
1684 #endif /* SDTEST */
1685 #ifdef DHD_DEBUG
1686         bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
1687                     bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
1688         bcm_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize, bus->roundup);
1689 #endif /* DHD_DEBUG */
1690         bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
1691                     bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
1692 }
1693
1694 void
1695 dhd_bus_clearcounts(dhd_pub_t *dhdp)
1696 {
1697         dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
1698
1699         bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
1700         bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
1701         bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
1702         bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
1703         bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
1704         bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
1705 }
1706
1707 #ifdef SDTEST
1708 static int
1709 dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
1710 {
1711         dhd_pktgen_t pktgen;
1712
1713         pktgen.version = DHD_PKTGEN_VERSION;
1714         pktgen.freq = bus->pktgen_freq;
1715         pktgen.count = bus->pktgen_count;
1716         pktgen.print = bus->pktgen_print;
1717         pktgen.total = bus->pktgen_total;
1718         pktgen.minlen = bus->pktgen_minlen;
1719         pktgen.maxlen = bus->pktgen_maxlen;
1720         pktgen.numsent = bus->pktgen_sent;
1721         pktgen.numrcvd = bus->pktgen_rcvd;
1722         pktgen.numfail = bus->pktgen_fail;
1723         pktgen.mode = bus->pktgen_mode;
1724         pktgen.stop = bus->pktgen_stop;
1725
1726         bcopy(&pktgen, arg, sizeof(pktgen));
1727
1728         return 0;
1729 }
1730
1731 static int
1732 dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
1733 {
1734         dhd_pktgen_t pktgen;
1735         uint oldcnt, oldmode;
1736
1737         bcopy(arg, &pktgen, sizeof(pktgen));
1738         if (pktgen.version != DHD_PKTGEN_VERSION)
1739                 return BCME_BADARG;
1740
1741         oldcnt = bus->pktgen_count;
1742         oldmode = bus->pktgen_mode;
1743
1744         bus->pktgen_freq = pktgen.freq;
1745         bus->pktgen_count = pktgen.count;
1746         bus->pktgen_print = pktgen.print;
1747         bus->pktgen_total = pktgen.total;
1748         bus->pktgen_minlen = pktgen.minlen;
1749         bus->pktgen_maxlen = pktgen.maxlen;
1750         bus->pktgen_mode = pktgen.mode;
1751         bus->pktgen_stop = pktgen.stop;
1752
1753         bus->pktgen_tick = bus->pktgen_ptick = 0;
1754         bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
1755         bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
1756
1757         /* Clear counts for a new pktgen (mode change, or was stopped) */
1758         if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
1759                 bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
1760
1761         return 0;
1762 }
1763 #endif /* SDTEST */
1764
1765 static int
1766 dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
1767 {
1768         int bcmerror = 0;
1769         uint32 sdaddr;
1770         uint dsize;
1771
1772         /* Determine initial transfer parameters */
1773         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
1774         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
1775                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
1776         else
1777                 dsize = size;
1778
1779         /* Set the backplane window to include the start address */
1780         if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
1781                 DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
1782                 goto xfer_done;
1783         }
1784
1785         /* Do the transfer(s) */
1786         while (size) {
1787                 DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
1788                           __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
1789                           (address & SBSDIO_SBWINDOW_MASK)));
1790                 if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, data, dsize))) {
1791                         DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
1792                         break;
1793                 }
1794
1795                 /* Adjust for next transfer (if any) */
1796                 if ((size -= dsize)) {
1797                         data += dsize;
1798                         address += dsize;
1799                         if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
1800                                 DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
1801                                 break;
1802                         }
1803                         sdaddr = 0;
1804                         dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
1805                 }
1806
1807         }
1808
1809 xfer_done:
1810         /* Return the window to backplane enumeration space for core access */
1811         if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
1812                 DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
1813                         bcmsdh_cur_sbwad(bus->sdh)));
1814         }
1815
1816         return bcmerror;
1817 }
1818
1819 #ifdef DHD_DEBUG
1820 static int
1821 dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
1822 {
1823         uint32 addr;
1824         int rv;
1825
1826         /* Read last word in memory to determine address of sdpcm_shared structure */
1827         if ((rv = dhdsdio_membytes(bus, FALSE, bus->ramsize - 4, (uint8 *)&addr, 4)) < 0)
1828                 return rv;
1829
1830         addr = ltoh32(addr);
1831
1832         DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
1833
1834         /*
1835          * Check if addr is valid.
1836          * NVRAM length at the end of memory should have been overwritten.
1837          */
1838         if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
1839                 DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n", __FUNCTION__, addr));
1840                 return BCME_ERROR;
1841         }
1842
1843         /* Read hndrte_shared structure */
1844         if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
1845                 return rv;
1846
1847         /* Endianness */
1848         sh->flags = ltoh32(sh->flags);
1849         sh->trap_addr = ltoh32(sh->trap_addr);
1850         sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
1851         sh->assert_file_addr = ltoh32(sh->assert_file_addr);
1852         sh->assert_line = ltoh32(sh->assert_line);
1853         sh->console_addr = ltoh32(sh->console_addr);
1854         sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
1855
1856         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) == 3 && SDPCM_SHARED_VERSION == 1)
1857                 return BCME_OK;
1858
1859         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
1860                 DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
1861                            "is different than sdpcm_shared version %d in dongle\n",
1862                            __FUNCTION__, SDPCM_SHARED_VERSION,
1863                            sh->flags & SDPCM_SHARED_VERSION_MASK));
1864                 return BCME_ERROR;
1865         }
1866
1867         return BCME_OK;
1868 }
1869
1870
1871 static int
1872 dhdsdio_readconsole(dhd_bus_t *bus)
1873 {
1874         dhd_console_t *c = &bus->console;
1875         uint8 line[CONSOLE_LINE_MAX], ch;
1876         uint32 n, idx, addr;
1877         int rv;
1878
1879         /* Don't do anything until FWREADY updates console address */
1880         if (bus->console_addr == 0)
1881                 return 0;
1882
1883         /* Read console log struct */
1884         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, log);
1885         if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
1886                 return rv;
1887
1888         /* Allocate console buffer (one time only) */
1889         if (c->buf == NULL) {
1890                 c->bufsize = ltoh32(c->log.buf_size);
1891                 if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
1892                         return BCME_NOMEM;
1893         }
1894
1895         idx = ltoh32(c->log.idx);
1896
1897         /* Protect against corrupt value */
1898         if (idx > c->bufsize)
1899                 return BCME_ERROR;
1900
1901         /* Skip reading the console buffer if the index pointer has not moved */
1902         if (idx == c->last)
1903                 return BCME_OK;
1904
1905         /* Read the console buffer */
1906         addr = ltoh32(c->log.buf);
1907         if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
1908                 return rv;
1909
1910         while (c->last != idx) {
1911                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
1912                         if (c->last == idx) {
1913                                 /* This would output a partial line.  Instead, back up
1914                                  * the buffer pointer and output this line next time around.
1915                                  */
1916                                 if (c->last >= n)
1917                                         c->last -= n;
1918                                 else
1919                                         c->last = c->bufsize - n;
1920                                 goto break2;
1921                         }
1922                         ch = c->buf[c->last];
1923                         c->last = (c->last + 1) % c->bufsize;
1924                         if (ch == '\n')
1925                                 break;
1926                         line[n] = ch;
1927                 }
1928
1929                 if (n > 0) {
1930                         if (line[n - 1] == '\r')
1931                                 n--;
1932                         line[n] = 0;
1933                         printf("CONSOLE: %s\n", line);
1934                 }
1935         }
1936 break2:
1937
1938         return BCME_OK;
1939 }
1940
1941 static int
1942 dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size)
1943 {
1944         int bcmerror = 0;
1945         uint msize = 512;
1946         char *mbuffer = NULL;
1947         char *console_buffer = NULL;
1948         uint maxstrlen = 256;
1949         char *str = NULL;
1950         trap_t tr;
1951         sdpcm_shared_t sdpcm_shared;
1952         struct bcmstrbuf strbuf;
1953         uint32 console_ptr, console_size, console_index;
1954         uint8 line[CONSOLE_LINE_MAX], ch;
1955         uint32 n, i, addr;
1956         int rv;
1957
1958         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1959
1960         if (data == NULL) {
1961                 /*
1962                  * Called after a rx ctrl timeout. "data" is NULL.
1963                  * allocate memory to trace the trap or assert.
1964                  */
1965                 size = msize;
1966                 mbuffer = data = MALLOC(bus->dhd->osh, msize);
1967                 if (mbuffer == NULL) {
1968                         DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
1969                         bcmerror = BCME_NOMEM;
1970                         goto done;
1971                 }
1972         }
1973
1974         if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
1975                 DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
1976                 bcmerror = BCME_NOMEM;
1977                 goto done;
1978         }
1979
1980         if ((bcmerror = dhdsdio_readshared(bus, &sdpcm_shared)) < 0)
1981                 goto done;
1982
1983         bcm_binit(&strbuf, data, size);
1984
1985         bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
1986                     sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
1987
1988         if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
1989                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
1990                  * (Avoids conflict with real asserts for programmatic parsing of output.)
1991                  */
1992                 bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
1993         }
1994
1995         if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
1996                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
1997                  * (Avoids conflict with real asserts for programmatic parsing of output.)
1998                  */
1999                 bcm_bprintf(&strbuf, "No trap%s in dongle",
2000                           (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
2001                           ?"/assrt" :"");
2002         } else {
2003                 if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
2004                         /* Download assert */
2005                         bcm_bprintf(&strbuf, "Dongle assert");
2006                         if (sdpcm_shared.assert_exp_addr != 0) {
2007                                 str[0] = '\0';
2008                                 if ((bcmerror = dhdsdio_membytes(bus, FALSE,
2009                                                                  sdpcm_shared.assert_exp_addr,
2010                                                                  (uint8 *)str, maxstrlen)) < 0)
2011                                         goto done;
2012
2013                                 str[maxstrlen - 1] = '\0';
2014                                 bcm_bprintf(&strbuf, " expr \"%s\"", str);
2015                         }
2016
2017                         if (sdpcm_shared.assert_file_addr != 0) {
2018                                 str[0] = '\0';
2019                                 if ((bcmerror = dhdsdio_membytes(bus, FALSE,
2020                                                                  sdpcm_shared.assert_file_addr,
2021                                                                  (uint8 *)str, maxstrlen)) < 0)
2022                                         goto done;
2023
2024                                 str[maxstrlen - 1] = '\0';
2025                                 bcm_bprintf(&strbuf, " file \"%s\"", str);
2026                         }
2027
2028                         bcm_bprintf(&strbuf, " line %d ", sdpcm_shared.assert_line);
2029                 }
2030
2031                 if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
2032                         if ((bcmerror = dhdsdio_membytes(bus, FALSE,
2033                                                          sdpcm_shared.trap_addr,
2034                                                          (uint8*)&tr, sizeof(trap_t))) < 0)
2035                                 goto done;
2036
2037                         bcm_bprintf(&strbuf,
2038                         "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
2039                         "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
2040                         "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
2041                         "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
2042                         ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
2043                         ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
2044                         ltoh32(sdpcm_shared.trap_addr),
2045                         ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
2046                         ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
2047
2048                         addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log);
2049                         if ((rv = dhdsdio_membytes(bus, FALSE, addr,
2050                                 (uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
2051                                 goto printbuf;
2052
2053                         addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log.buf_size);
2054                         if ((rv = dhdsdio_membytes(bus, FALSE, addr,
2055                                 (uint8 *)&console_size, sizeof(console_size))) < 0)
2056                                 goto printbuf;
2057
2058                         addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log.idx);
2059                         if ((rv = dhdsdio_membytes(bus, FALSE, addr,
2060                                 (uint8 *)&console_index, sizeof(console_index))) < 0)
2061                                 goto printbuf;
2062
2063                         console_ptr = ltoh32(console_ptr);
2064                         console_size = ltoh32(console_size);
2065                         console_index = ltoh32(console_index);
2066
2067                         if (console_size > CONSOLE_BUFFER_MAX ||
2068                                 !(console_buffer = MALLOC(bus->dhd->osh, console_size)))
2069                                 goto printbuf;
2070
2071                         if ((rv = dhdsdio_membytes(bus, FALSE, console_ptr,
2072                                 (uint8 *)console_buffer, console_size)) < 0)
2073                                 goto printbuf;
2074
2075                         for (i = 0, n = 0; i < console_size; i += n + 1) {
2076                                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2077                                         ch = console_buffer[(console_index + i + n) % console_size];
2078                                         if (ch == '\n')
2079                                                 break;
2080                                         line[n] = ch;
2081                                 }
2082
2083
2084                                 if (n > 0) {
2085                                         if (line[n - 1] == '\r')
2086                                                 n--;
2087                                         line[n] = 0;
2088                                         /* Don't use DHD_ERROR macro since we print
2089                                          * a lot of information quickly. The macro
2090                                          * will truncate a lot of the printfs
2091                                          */
2092
2093                                         if (dhd_msg_level & DHD_ERROR_VAL) {
2094                                                 printf("CONSOLE: %s\n", line);
2095                                                 DHD_BLOG(line, strlen(line) + 1);
2096                                         }
2097                                 }
2098                         }
2099                 }
2100         }
2101
2102 printbuf:
2103         if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
2104                 DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
2105         }
2106
2107
2108 done:
2109         if (mbuffer)
2110                 MFREE(bus->dhd->osh, mbuffer, msize);
2111         if (str)
2112                 MFREE(bus->dhd->osh, str, maxstrlen);
2113         if (console_buffer)
2114                 MFREE(bus->dhd->osh, console_buffer, console_size);
2115
2116         return bcmerror;
2117 }
2118 #endif /* #ifdef DHD_DEBUG */
2119
2120
2121 int
2122 dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
2123 {
2124         int bcmerror = BCME_OK;
2125
2126         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
2127
2128         /* Basic sanity checks */
2129         if (bus->dhd->up) {
2130                 bcmerror = BCME_NOTDOWN;
2131                 goto err;
2132         }
2133         if (!len) {
2134                 bcmerror = BCME_BUFTOOSHORT;
2135                 goto err;
2136         }
2137
2138         /* Free the old ones and replace with passed variables */
2139         if (bus->vars)
2140                 MFREE(bus->dhd->osh, bus->vars, bus->varsz);
2141
2142         bus->vars = MALLOC(bus->dhd->osh, len);
2143         bus->varsz = bus->vars ? len : 0;
2144         if (bus->vars == NULL) {
2145                 bcmerror = BCME_NOMEM;
2146                 goto err;
2147         }
2148
2149         /* Copy the passed variables, which should include the terminating double-null */
2150         bcopy(arg, bus->vars, bus->varsz);
2151 err:
2152         return bcmerror;
2153 }
2154
2155 #ifdef DHD_DEBUG
2156
2157 #define CC_PLL_CHIPCTRL_SERIAL_ENAB     (1  << 24)
2158 static int
2159 dhd_serialconsole(dhd_bus_t *bus, bool set, bool enable, int *bcmerror)
2160 {
2161         int int_val;
2162         uint32 addr, data;
2163
2164
2165         addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
2166         data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
2167         *bcmerror = 0;
2168
2169         bcmsdh_reg_write(bus->sdh, addr, 4, 1);
2170         if (bcmsdh_regfail(bus->sdh)) {
2171                 *bcmerror = BCME_SDIO_ERROR;
2172                 return -1;
2173         }
2174         int_val = bcmsdh_reg_read(bus->sdh, data, 4);
2175         if (bcmsdh_regfail(bus->sdh)) {
2176                 *bcmerror = BCME_SDIO_ERROR;
2177                 return -1;
2178         }
2179         if (!set)
2180                 return (int_val & CC_PLL_CHIPCTRL_SERIAL_ENAB);
2181         if (enable)
2182                 int_val |= CC_PLL_CHIPCTRL_SERIAL_ENAB;
2183         else
2184                 int_val &= ~CC_PLL_CHIPCTRL_SERIAL_ENAB;
2185         bcmsdh_reg_write(bus->sdh, data, 4, int_val);
2186         if (bcmsdh_regfail(bus->sdh)) {
2187                 *bcmerror = BCME_SDIO_ERROR;
2188                 return -1;
2189         }
2190         if (bus->sih->chip == BCM4330_CHIP_ID) {
2191                 uint32 chipcontrol;
2192                 addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol);
2193                 chipcontrol = bcmsdh_reg_read(bus->sdh, addr, 4);
2194                 chipcontrol &= ~0x8;
2195                 if (enable) {
2196                         chipcontrol |=  0x8;
2197                         chipcontrol &= ~0x3;
2198                 }
2199                 bcmsdh_reg_write(bus->sdh, addr, 4, chipcontrol);
2200         }
2201
2202         return (int_val & CC_PLL_CHIPCTRL_SERIAL_ENAB);
2203 }
2204 #endif 
2205
2206 static int
2207 dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
2208                 void *params, int plen, void *arg, int len, int val_size)
2209 {
2210         int bcmerror = 0;
2211         int32 int_val = 0;
2212         bool bool_val = 0;
2213
2214         DHD_ERROR(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
2215                    __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
2216
2217         if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
2218                 goto exit;
2219
2220         if (plen >= (int)sizeof(int_val))
2221                 bcopy(params, &int_val, sizeof(int_val));
2222
2223         bool_val = (int_val != 0) ? TRUE : FALSE;
2224
2225
2226         /* Some ioctls use the bus */
2227         dhd_os_sdlock(bus->dhd);
2228
2229         /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
2230         if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
2231                                         actionid == IOV_GVAL(IOV_DEVRESET))) {
2232                 bcmerror = BCME_NOTREADY;
2233                 goto exit;
2234         }
2235
2236         /* Handle sleep stuff before any clock mucking */
2237         if (vi->varid == IOV_SLEEP) {
2238                 if (IOV_ISSET(actionid)) {
2239                         bcmerror = dhdsdio_bussleep(bus, bool_val);
2240                 } else {
2241                         int_val = (int32)bus->sleeping;
2242                         bcopy(&int_val, arg, val_size);
2243                 }
2244                 goto exit;
2245         }
2246
2247         /* Request clock to allow SDIO accesses */
2248         if (!bus->dhd->dongle_reset) {
2249                 BUS_WAKE(bus);
2250                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
2251         }
2252
2253         switch (actionid) {
2254         case IOV_GVAL(IOV_INTR):
2255                 int_val = (int32)bus->intr;
2256                 bcopy(&int_val, arg, val_size);
2257                 break;
2258
2259         case IOV_SVAL(IOV_INTR):
2260                 bus->intr = bool_val;
2261                 bus->intdis = FALSE;
2262                 if (bus->dhd->up) {
2263                         if (bus->intr) {
2264                                 DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
2265                                 bcmsdh_intr_enable(bus->sdh);
2266                         } else {
2267                                 DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
2268                                 bcmsdh_intr_disable(bus->sdh);
2269                         }
2270                 }
2271                 break;
2272
2273         case IOV_GVAL(IOV_POLLRATE):
2274                 int_val = (int32)bus->pollrate;
2275                 bcopy(&int_val, arg, val_size);
2276                 break;
2277
2278         case IOV_SVAL(IOV_POLLRATE):
2279                 bus->pollrate = (uint)int_val;
2280                 bus->poll = (bus->pollrate != 0);
2281                 break;
2282
2283         case IOV_GVAL(IOV_IDLETIME):
2284                 int_val = bus->idletime;
2285                 bcopy(&int_val, arg, val_size);
2286                 break;
2287
2288         case IOV_SVAL(IOV_IDLETIME):
2289                 if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
2290                         bcmerror = BCME_BADARG;
2291                 } else {
2292                         bus->idletime = int_val;
2293                 }
2294                 break;
2295
2296         case IOV_GVAL(IOV_IDLECLOCK):
2297                 int_val = (int32)bus->idleclock;
2298                 bcopy(&int_val, arg, val_size);
2299                 break;
2300
2301         case IOV_SVAL(IOV_IDLECLOCK):
2302                 bus->idleclock = int_val;
2303                 break;
2304
2305         case IOV_GVAL(IOV_SD1IDLE):
2306                 int_val = (int32)sd1idle;
2307                 bcopy(&int_val, arg, val_size);
2308                 break;
2309
2310         case IOV_SVAL(IOV_SD1IDLE):
2311                 sd1idle = bool_val;
2312                 break;
2313
2314
2315         case IOV_SVAL(IOV_MEMBYTES):
2316         case IOV_GVAL(IOV_MEMBYTES):
2317         {
2318                 uint32 address;
2319                 uint size, dsize;
2320                 uint8 *data;
2321
2322                 bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
2323
2324                 ASSERT(plen >= 2*sizeof(int));
2325
2326                 address = (uint32)int_val;
2327                 bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
2328                 size = (uint)int_val;
2329
2330                 /* Do some validation */
2331                 dsize = set ? plen - (2 * sizeof(int)) : len;
2332                 if (dsize < size) {
2333                         DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
2334                                    __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
2335                         bcmerror = BCME_BADARG;
2336                         break;
2337                 }
2338
2339                 DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
2340                           (set ? "write" : "read"), size, address));
2341
2342                 /* If we know about SOCRAM, check for a fit */
2343                 if ((bus->orig_ramsize) &&
2344                     ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
2345                 {
2346                         uint8 enable, protect;
2347                         si_socdevram(bus->sih, FALSE, &enable, &protect);
2348                         if (!enable || protect) {
2349                                 DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
2350                                         __FUNCTION__, bus->orig_ramsize, size, address));
2351                                 DHD_ERROR(("%s: socram enable %d, protect %d\n",
2352                                         __FUNCTION__, enable, protect));
2353                                 bcmerror = BCME_BADARG;
2354                                 break;
2355                         }
2356                         if (enable && (bus->sih->chip == BCM4330_CHIP_ID)) {
2357                                 uint32 devramsize = si_socdevram_size(bus->sih);
2358                                 if ((address < SOCDEVRAM_4330_ARM_ADDR) ||
2359                                         (address + size > (SOCDEVRAM_4330_ARM_ADDR + devramsize))) {
2360                                         DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
2361                                                 __FUNCTION__, address, size));
2362                                         DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
2363                                                 __FUNCTION__, SOCDEVRAM_4330_ARM_ADDR, devramsize));
2364                                         bcmerror = BCME_BADARG;
2365                                         break;
2366                                 }
2367                                 /* move it such that address is real now */
2368                                 address -= SOCDEVRAM_4330_ARM_ADDR;
2369                                 address += SOCDEVRAM_4330_BP_ADDR;
2370                                 DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
2371                                         __FUNCTION__, (set ? "write" : "read"), size, address));
2372                         }
2373                 }
2374
2375                 /* Generate the actual data pointer */
2376                 data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
2377
2378                 /* Call to do the transfer */
2379                 bcmerror = dhdsdio_membytes(bus, set, address, data, size);
2380
2381                 break;
2382         }
2383
2384         case IOV_GVAL(IOV_MEMSIZE):
2385                 int_val = (int32)bus->ramsize;
2386                 bcopy(&int_val, arg, val_size);
2387                 break;
2388
2389         case IOV_GVAL(IOV_SDIOD_DRIVE):
2390                 int_val = (int32)dhd_sdiod_drive_strength;
2391                 bcopy(&int_val, arg, val_size);
2392                 break;
2393
2394         case IOV_SVAL(IOV_SDIOD_DRIVE):
2395                 dhd_sdiod_drive_strength = int_val;
2396                 si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
2397                 break;
2398
2399         case IOV_SVAL(IOV_DOWNLOAD):
2400                 bcmerror = dhdsdio_download_state(bus, bool_val);
2401                 break;
2402
2403         case IOV_SVAL(IOV_SOCRAM_STATE):
2404                 bcmerror = dhdsdio_download_state(bus, bool_val);
2405                 break;
2406
2407         case IOV_SVAL(IOV_VARS):
2408                 bcmerror = dhdsdio_downloadvars(bus, arg, len);
2409                 break;
2410
2411         case IOV_GVAL(IOV_READAHEAD):
2412                 int_val = (int32)dhd_readahead;
2413                 bcopy(&int_val, arg, val_size);
2414                 break;
2415
2416         case IOV_SVAL(IOV_READAHEAD):
2417                 if (bool_val && !dhd_readahead)
2418                         bus->nextlen = 0;
2419                 dhd_readahead = bool_val;
2420                 break;
2421
2422         case IOV_GVAL(IOV_SDRXCHAIN):
2423                 int_val = (int32)bus->use_rxchain;
2424                 bcopy(&int_val, arg, val_size);
2425                 break;
2426
2427         case IOV_SVAL(IOV_SDRXCHAIN):
2428                 if (bool_val && !bus->sd_rxchain)
2429                         bcmerror = BCME_UNSUPPORTED;
2430                 else
2431                         bus->use_rxchain = bool_val;
2432                 break;
2433         case IOV_GVAL(IOV_ALIGNCTL):
2434                 int_val = (int32)dhd_alignctl;
2435                 bcopy(&int_val, arg, val_size);
2436                 break;
2437
2438         case IOV_SVAL(IOV_ALIGNCTL):
2439                 dhd_alignctl = bool_val;
2440                 break;
2441
2442         case IOV_GVAL(IOV_SDALIGN):
2443                 int_val = DHD_SDALIGN;
2444                 bcopy(&int_val, arg, val_size);
2445                 break;
2446
2447 #ifdef DHD_DEBUG
2448         case IOV_GVAL(IOV_VARS):
2449                 if (bus->varsz < (uint)len)
2450                         bcopy(bus->vars, arg, bus->varsz);
2451                 else
2452                         bcmerror = BCME_BUFTOOSHORT;
2453                 break;
2454 #endif /* DHD_DEBUG */
2455
2456 #ifdef DHD_DEBUG
2457         case IOV_GVAL(IOV_SDREG):
2458         {
2459                 sdreg_t *sd_ptr;
2460                 uint32 addr, size;
2461
2462                 sd_ptr = (sdreg_t *)params;
2463
2464                 addr = (uintptr)bus->regs + sd_ptr->offset;
2465                 size = sd_ptr->func;
2466                 int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
2467                 if (bcmsdh_regfail(bus->sdh))
2468                         bcmerror = BCME_SDIO_ERROR;
2469                 bcopy(&int_val, arg, sizeof(int32));
2470                 break;
2471         }
2472
2473         case IOV_SVAL(IOV_SDREG):
2474         {
2475                 sdreg_t *sd_ptr;
2476                 uint32 addr, size;
2477
2478                 sd_ptr = (sdreg_t *)params;
2479
2480                 addr = (uintptr)bus->regs + sd_ptr->offset;
2481                 size = sd_ptr->func;
2482                 bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
2483                 if (bcmsdh_regfail(bus->sdh))
2484                         bcmerror = BCME_SDIO_ERROR;
2485                 break;
2486         }
2487
2488         /* Same as above, but offset is not backplane (not SDIO core) */
2489         case IOV_GVAL(IOV_SBREG):
2490         {
2491                 sdreg_t sdreg;
2492                 uint32 addr, size;
2493
2494                 bcopy(params, &sdreg, sizeof(sdreg));
2495
2496                 addr = SI_ENUM_BASE + sdreg.offset;
2497                 size = sdreg.func;
2498                 int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
2499                 if (bcmsdh_regfail(bus->sdh))
2500                         bcmerror = BCME_SDIO_ERROR;
2501                 bcopy(&int_val, arg, sizeof(int32));
2502                 break;
2503         }
2504
2505         case IOV_SVAL(IOV_SBREG):
2506         {
2507                 sdreg_t sdreg;
2508                 uint32 addr, size;
2509
2510                 bcopy(params, &sdreg, sizeof(sdreg));
2511
2512                 addr = SI_ENUM_BASE + sdreg.offset;
2513                 size = sdreg.func;
2514                 bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
2515                 if (bcmsdh_regfail(bus->sdh))
2516                         bcmerror = BCME_SDIO_ERROR;
2517                 break;
2518         }
2519
2520         case IOV_GVAL(IOV_SDCIS):
2521         {
2522                 *(char *)arg = 0;
2523
2524                 bcmstrcat(arg, "\nFunc 0\n");
2525                 bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
2526                 bcmstrcat(arg, "\nFunc 1\n");
2527                 bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
2528                 bcmstrcat(arg, "\nFunc 2\n");
2529                 bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
2530                 break;
2531         }
2532
2533         case IOV_GVAL(IOV_FORCEEVEN):
2534                 int_val = (int32)forcealign;
2535                 bcopy(&int_val, arg, val_size);
2536                 break;
2537
2538         case IOV_SVAL(IOV_FORCEEVEN):
2539                 forcealign = bool_val;
2540                 break;
2541
2542         case IOV_GVAL(IOV_TXBOUND):
2543                 int_val = (int32)dhd_txbound;
2544                 bcopy(&int_val, arg, val_size);
2545                 break;
2546
2547         case IOV_SVAL(IOV_TXBOUND):
2548                 dhd_txbound = (uint)int_val;
2549                 break;
2550
2551         case IOV_GVAL(IOV_RXBOUND):
2552                 int_val = (int32)dhd_rxbound;
2553                 bcopy(&int_val, arg, val_size);
2554                 break;
2555
2556         case IOV_SVAL(IOV_RXBOUND):
2557                 dhd_rxbound = (uint)int_val;
2558                 break;
2559
2560         case IOV_GVAL(IOV_TXMINMAX):
2561                 int_val = (int32)dhd_txminmax;
2562                 bcopy(&int_val, arg, val_size);
2563                 break;
2564
2565         case IOV_SVAL(IOV_TXMINMAX):
2566                 dhd_txminmax = (uint)int_val;
2567                 break;
2568
2569         case IOV_GVAL(IOV_SERIALCONS):
2570                 int_val = dhd_serialconsole(bus, FALSE, 0, &bcmerror);
2571                 if (bcmerror != 0)
2572                         break;
2573
2574                 bcopy(&int_val, arg, val_size);
2575                 break;
2576
2577         case IOV_SVAL(IOV_SERIALCONS):
2578                 dhd_serialconsole(bus, TRUE, bool_val, &bcmerror);
2579                 break;
2580
2581
2582
2583 #endif /* DHD_DEBUG */
2584
2585
2586 #ifdef SDTEST
2587         case IOV_GVAL(IOV_EXTLOOP):
2588                 int_val = (int32)bus->ext_loop;
2589                 bcopy(&int_val, arg, val_size);
2590                 break;
2591
2592         case IOV_SVAL(IOV_EXTLOOP):
2593                 bus->ext_loop = bool_val;
2594                 break;
2595
2596         case IOV_GVAL(IOV_PKTGEN):
2597                 bcmerror = dhdsdio_pktgen_get(bus, arg);
2598                 break;
2599
2600         case IOV_SVAL(IOV_PKTGEN):
2601                 bcmerror = dhdsdio_pktgen_set(bus, arg);
2602                 break;
2603 #endif /* SDTEST */
2604
2605
2606         case IOV_GVAL(IOV_DONGLEISOLATION):
2607                 int_val = bus->dhd->dongle_isolation;
2608                 bcopy(&int_val, arg, val_size);
2609                 break;
2610
2611         case IOV_SVAL(IOV_DONGLEISOLATION):
2612                 bus->dhd->dongle_isolation = bool_val;
2613                 break;
2614
2615         case IOV_SVAL(IOV_DEVRESET):
2616                 DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
2617                            __FUNCTION__, bool_val, bus->dhd->dongle_reset,
2618                            bus->dhd->busstate));
2619
2620                 ASSERT(bus->dhd->osh);
2621                 /* ASSERT(bus->cl_devid); */
2622
2623                 dhd_bus_devreset(bus->dhd, (uint8)bool_val);
2624
2625                 break;
2626 #ifdef SOFTAP
2627         case IOV_GVAL(IOV_FWPATH):
2628         {
2629                 uint32  fw_path_len;
2630
2631                 fw_path_len = strlen(bus->fw_path);
2632                 DHD_INFO(("[softap] get fwpath, l=%d\n", len));
2633
2634                 if (fw_path_len > len-1) {
2635                         bcmerror = BCME_BUFTOOSHORT;
2636                         break;
2637                 }
2638
2639                 if (fw_path_len) {
2640                         bcopy(bus->fw_path, arg, fw_path_len);
2641                         ((uchar*)arg)[fw_path_len] = 0;
2642                 }
2643                 break;
2644         }
2645
2646         case IOV_SVAL(IOV_FWPATH):
2647                 DHD_INFO(("[softap] set fwpath, idx=%d\n", int_val));
2648
2649                 switch (int_val) {
2650                 case 1:
2651                         bus->fw_path = fw_path; /* ordinary one */
2652                         break;
2653                 case 2:
2654                         bus->fw_path = fw_path2;
2655                         break;
2656                 default:
2657                         bcmerror = BCME_BADARG;
2658                         break;
2659                 }
2660
2661                 DHD_INFO(("[softap] new fw path: %s\n", (bus->fw_path[0] ? bus->fw_path : "NULL")));
2662                 break;
2663
2664 #endif /* SOFTAP */
2665         case IOV_GVAL(IOV_DEVRESET):
2666                 DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
2667
2668                 /* Get its status */
2669                 int_val = (bool) bus->dhd->dongle_reset;
2670                 bcopy(&int_val, arg, val_size);
2671
2672                 break;
2673
2674         default:
2675                 bcmerror = BCME_UNSUPPORTED;
2676                 break;
2677         }
2678
2679 exit:
2680         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2681                 bus->activity = FALSE;
2682                 dhdsdio_clkctl(bus, CLK_NONE, TRUE);
2683         }
2684
2685         dhd_os_sdunlock(bus->dhd);
2686
2687         if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == FALSE)
2688                 dhd_preinit_ioctls((dhd_pub_t *) bus->dhd);
2689
2690         return bcmerror;
2691 }
2692
2693 static int
2694 dhdsdio_write_vars(dhd_bus_t *bus)
2695 {
2696         int bcmerror = 0;
2697         uint32 varsize;
2698         uint32 varaddr;
2699         uint8 *vbuffer;
2700         uint32 varsizew;
2701 #ifdef DHD_DEBUG
2702         uint8 *nvram_ularray;
2703 #endif /* DHD_DEBUG */
2704
2705         /* Even if there are no vars are to be written, we still need to set the ramsize. */
2706         varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
2707         varaddr = (bus->ramsize - 4) - varsize;
2708
2709         if (bus->vars) {
2710                 if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 7)) {
2711                         if (((varaddr & 0x3C) == 0x3C) && (varsize > 4)) {
2712                                 DHD_ERROR(("PR85623WAR in place\n"));
2713                                 varsize += 4;
2714                                 varaddr -= 4;
2715                         }
2716                 }
2717
2718                 vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
2719                 if (!vbuffer)
2720                         return BCME_NOMEM;
2721
2722                 bzero(vbuffer, varsize);
2723                 bcopy(bus->vars, vbuffer, bus->varsz);
2724
2725                 /* Write the vars list */
2726                 bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
2727 #ifdef DHD_DEBUG
2728                 /* Verify NVRAM bytes */
2729                 DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
2730                 nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
2731                 if (!nvram_ularray)
2732                         return BCME_NOMEM;
2733
2734                 /* Upload image to verify downloaded contents. */
2735                 memset(nvram_ularray, 0xaa, varsize);
2736
2737                 /* Read the vars list to temp buffer for comparison */
2738                 bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
2739                 if (bcmerror) {
2740                                 DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
2741                                         __FUNCTION__, bcmerror, varsize, varaddr));
2742                 }
2743                 /* Compare the org NVRAM with the one read from RAM */
2744                 if (memcmp(vbuffer, nvram_ularray, varsize)) {
2745                         DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
2746                 } else
2747                         DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
2748                         __FUNCTION__));
2749
2750                 MFREE(bus->dhd->osh, nvram_ularray, varsize);
2751 #endif /* DHD_DEBUG */
2752
2753                 MFREE(bus->dhd->osh, vbuffer, varsize);
2754         }
2755
2756         /* adjust to the user specified RAM */
2757         DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
2758                 bus->orig_ramsize, bus->ramsize));
2759         DHD_INFO(("Vars are at %d, orig varsize is %d\n",
2760                 varaddr, varsize));
2761         varsize = ((bus->orig_ramsize - 4) - varaddr);
2762
2763         /*
2764          * Determine the length token:
2765          * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
2766          */
2767         if (bcmerror) {
2768                 varsizew = 0;
2769         } else {
2770                 varsizew = varsize / 4;
2771                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
2772                 varsizew = htol32(varsizew);
2773         }
2774
2775         DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
2776
2777         /* Write the length token to the last word */
2778         bcmerror = dhdsdio_membytes(bus, TRUE, (bus->orig_ramsize - 4),
2779                 (uint8*)&varsizew, 4);
2780
2781         return bcmerror;
2782 }
2783
2784 static int
2785 dhdsdio_download_state(dhd_bus_t *bus, bool enter)
2786 {
2787         uint retries;
2788         int bcmerror = 0;
2789
2790         if (!bus->sih)
2791                 return BCME_ERROR;
2792
2793         /* To enter download state, disable ARM and reset SOCRAM.
2794          * To exit download state, simply reset ARM (default is RAM boot).
2795          */
2796         if (enter) {
2797                 bus->alp_only = TRUE;
2798
2799                 if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
2800                     !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
2801                         DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
2802                         bcmerror = BCME_ERROR;
2803                         goto fail;
2804                 }
2805
2806                 si_core_disable(bus->sih, 0);
2807                 if (bcmsdh_regfail(bus->sdh)) {
2808                         bcmerror = BCME_SDIO_ERROR;
2809                         goto fail;
2810                 }
2811
2812                 if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
2813                         DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
2814                         bcmerror = BCME_ERROR;
2815                         goto fail;
2816                 }
2817
2818                 si_core_reset(bus->sih, 0, 0);
2819                 if (bcmsdh_regfail(bus->sdh)) {
2820                         DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n", __FUNCTION__));
2821                         bcmerror = BCME_SDIO_ERROR;
2822                         goto fail;
2823                 }
2824
2825                 /* Clear the top bit of memory */
2826                 if (bus->ramsize) {
2827                         uint32 zeros = 0;
2828                         if (dhdsdio_membytes(bus, TRUE, bus->ramsize - 4, (uint8*)&zeros, 4) < 0) {
2829                                 bcmerror = BCME_SDIO_ERROR;
2830                                 goto fail;
2831                         }
2832                 }
2833         } else {
2834                 if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
2835                         DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
2836                         bcmerror = BCME_ERROR;
2837                         goto fail;
2838                 }
2839
2840                 if (!si_iscoreup(bus->sih)) {
2841                         DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
2842                         bcmerror = BCME_ERROR;
2843                         goto fail;
2844                 }
2845
2846                 if ((bcmerror = dhdsdio_write_vars(bus))) {
2847                         DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
2848                         goto fail;
2849                 }
2850
2851                 if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
2852                     !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
2853                         DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
2854                         bcmerror = BCME_ERROR;
2855                         goto fail;
2856                 }
2857                 W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
2858
2859
2860                 if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
2861                     !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
2862                         DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
2863                         bcmerror = BCME_ERROR;
2864                         goto fail;
2865                 }
2866
2867                 si_core_reset(bus->sih, 0, 0);
2868                 if (bcmsdh_regfail(bus->sdh)) {
2869                         DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
2870                         bcmerror = BCME_SDIO_ERROR;
2871                         goto fail;
2872                 }
2873
2874                 /* Allow HT Clock now that the ARM is running. */
2875                 bus->alp_only = FALSE;
2876
2877                 bus->dhd->busstate = DHD_BUS_LOAD;
2878         }
2879
2880 fail:
2881         /* Always return to SDIOD core */
2882         if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
2883                 si_setcore(bus->sih, SDIOD_CORE_ID, 0);
2884
2885         return bcmerror;
2886 }
2887
2888 int
2889 dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
2890                  void *params, int plen, void *arg, int len, bool set)
2891 {
2892         dhd_bus_t *bus = dhdp->bus;
2893         const bcm_iovar_t *vi = NULL;
2894         int bcmerror = 0;
2895         int val_size;
2896         uint32 actionid;
2897
2898         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
2899
2900         ASSERT(name);
2901         ASSERT(len >= 0);
2902
2903         /* Get MUST have return space */
2904         ASSERT(set || (arg && len));
2905
2906         /* Set does NOT take qualifiers */
2907         ASSERT(!set || (!params && !plen));
2908
2909         /* Look up var locally; if not found pass to host driver */
2910         if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
2911                 dhd_os_sdlock(bus->dhd);
2912
2913                 BUS_WAKE(bus);
2914
2915                 /* Turn on clock in case SD command needs backplane */
2916                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
2917
2918                 bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
2919
2920                 /* Check for bus configuration changes of interest */
2921
2922                 /* If it was divisor change, read the new one */
2923                 if (set && strcmp(name, "sd_divisor") == 0) {
2924                         if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
2925                                             &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
2926                                 bus->sd_divisor = -1;
2927                                 DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
2928                         } else {
2929                                 DHD_INFO(("%s: noted %s update, value now %d\n",
2930                                           __FUNCTION__, name, bus->sd_divisor));
2931                         }
2932                 }
2933                 /* If it was a mode change, read the new one */
2934                 if (set && strcmp(name, "sd_mode") == 0) {
2935                         if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
2936                                             &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
2937                                 bus->sd_mode = -1;
2938                                 DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
2939                         } else {
2940                                 DHD_INFO(("%s: noted %s update, value now %d\n",
2941                                           __FUNCTION__, name, bus->sd_mode));
2942                         }
2943                 }
2944                 /* Similar check for blocksize change */
2945                 if (set && strcmp(name, "sd_blocksize") == 0) {
2946                         int32 fnum = 2;
2947                         if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
2948                                             &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
2949                                 bus->blocksize = 0;
2950                                 DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
2951                         } else {
2952                                 DHD_INFO(("%s: noted %s update, value now %d\n",
2953                                           __FUNCTION__, "sd_blocksize", bus->blocksize));
2954                         }
2955                 }
2956                 bus->roundup = MIN(max_roundup, bus->blocksize);
2957
2958                 if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2959                         bus->activity = FALSE;
2960                         dhdsdio_clkctl(bus, CLK_NONE, TRUE);
2961                 }
2962
2963                 dhd_os_sdunlock(bus->dhd);
2964                 goto exit;
2965         }
2966
2967         DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
2968                  name, (set ? "set" : "get"), len, plen));
2969
2970         /* set up 'params' pointer in case this is a set command so that
2971          * the convenience int and bool code can be common to set and get
2972          */
2973         if (params == NULL) {
2974                 params = arg;
2975                 plen = len;
2976         }
2977
2978         if (vi->type == IOVT_VOID)
2979                 val_size = 0;
2980         else if (vi->type == IOVT_BUFFER)
2981                 val_size = len;
2982         else
2983                 /* all other types are integer sized */
2984                 val_size = sizeof(int);
2985
2986         actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
2987         bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
2988
2989 exit:
2990         return bcmerror;
2991 }
2992
2993 void
2994 dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
2995 {
2996         osl_t *osh;
2997         uint32 local_hostintmask;
2998         uint8 saveclk;
2999         uint retries;
3000         int err;
3001         if (!bus->dhd)
3002                 return;
3003
3004         osh = bus->dhd->osh;
3005         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3006
3007         bcmsdh_waitlockfree(NULL);
3008
3009         if (enforce_mutex)
3010                 dhd_os_sdlock(bus->dhd);
3011
3012         BUS_WAKE(bus);
3013
3014         /* Change our idea of bus state */
3015         bus->dhd->busstate = DHD_BUS_DOWN;
3016
3017         /* Enable clock for device interrupts */
3018         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
3019
3020         /* Disable and clear interrupts at the chip level also */
3021         W_SDREG(0, &bus->regs->hostintmask, retries);
3022         local_hostintmask = bus->hostintmask;
3023         bus->hostintmask = 0;
3024
3025         /* Force clocks on backplane to be sure F2 interrupt propagates */
3026         saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
3027         if (!err) {
3028                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
3029                                  (saveclk | SBSDIO_FORCE_HT), &err);
3030         }
3031         if (err) {
3032                 DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
3033         }
3034
3035         /* Turn off the bus (F2), free any pending packets */
3036         DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
3037         bcmsdh_intr_disable(bus->sdh);
3038         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
3039
3040         /* Clear any pending interrupts now that F2 is disabled */
3041         W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
3042
3043         /* Turn off the backplane clock (only) */
3044         dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
3045
3046         /* Clear the data packet queues */
3047         pktq_flush(osh, &bus->txq, TRUE, NULL, 0);
3048
3049         /* Clear any held glomming stuff */
3050         if (bus->glomd)
3051                 PKTFREE(osh, bus->glomd, FALSE);
3052
3053         if (bus->glom)
3054                 PKTFREE(osh, bus->glom, FALSE);
3055
3056         bus->glom = bus->glomd = NULL;
3057
3058         /* Clear rx control and wake any waiters */
3059         bus->rxlen = 0;
3060         dhd_os_ioctl_resp_wake(bus->dhd);
3061
3062         /* Reset some F2 state stuff */
3063         bus->rxskip = FALSE;
3064         bus->tx_seq = bus->rx_seq = 0;
3065
3066         /* Set to a safe default.  It gets updated when we
3067          * receive a packet from the fw but when we reset,
3068          * we need a safe default to be able to send the
3069          * initial mac address.
3070          */
3071         bus->tx_max = 4;
3072
3073         if (enforce_mutex)
3074                 dhd_os_sdunlock(bus->dhd);
3075 }
3076
3077
3078 int
3079 dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
3080 {
3081         dhd_bus_t *bus = dhdp->bus;
3082         dhd_timeout_t tmo;
3083         uint retries = 0;
3084         uint8 ready, enable;
3085         int err, ret = 0;
3086         uint8 saveclk;
3087
3088         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3089
3090         ASSERT(bus->dhd);
3091         if (!bus->dhd)
3092                 return 0;
3093
3094         if (enforce_mutex)
3095                 dhd_os_sdlock(bus->dhd);
3096
3097         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3098         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
3099         if (bus->clkstate != CLK_AVAIL) {
3100                 DHD_ERROR(("%s: clock state is wrong. state = %d\n", __FUNCTION__, bus->clkstate));
3101                 goto exit;
3102         }
3103
3104
3105         /* Force clocks on backplane to be sure F2 interrupt propagates */
3106         saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
3107         if (!err) {
3108                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
3109                                  (saveclk | SBSDIO_FORCE_HT), &err);
3110         }
3111         if (err) {
3112                 DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
3113                 goto exit;
3114         }
3115
3116         /* Enable function 2 (frame transfers) */
3117         W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
3118                 &bus->regs->tosbmailboxdata, retries);
3119         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3120
3121         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
3122
3123         /* Give the dongle some time to do its thing and set IOR2 */
3124         dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
3125
3126         ready = 0;
3127         do {
3128                 ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
3129         } while (ready != enable && !dhd_timeout_expired(&tmo));
3130
3131         DHD_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
3132                   __FUNCTION__, enable, ready, tmo.elapsed));
3133
3134
3135         /* If F2 successfully enabled, set core and enable interrupts */
3136         if (ready == enable) {
3137                 /* Make sure we're talking to the core. */
3138                 if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
3139                         bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
3140                 ASSERT(bus->regs != NULL);
3141
3142                 /* Set up the interrupt mask and enable interrupts */
3143                 bus->hostintmask = HOSTINTMASK;
3144                 /* corerev 4 could use the newer interrupt logic to detect the frames */
3145                 if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 4) &&
3146                         (bus->rxint_mode != SDIO_DEVICE_HMB_RXINT)) {
3147                         bus->hostintmask &= ~I_HMB_FRAME_IND;
3148                         bus->hostintmask |= I_XMTDATA_AVAIL;
3149                 }
3150                 W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
3151
3152                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, &err);
3153
3154                 /* Set bus state according to enable result */
3155                 dhdp->busstate = DHD_BUS_DATA;
3156
3157                 /* bcmsdh_intr_unmask(bus->sdh); */
3158
3159                 bus->intdis = FALSE;
3160                 if (bus->intr) {
3161                         DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
3162                         bcmsdh_intr_enable(bus->sdh);
3163                 } else {
3164                         DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
3165                         bcmsdh_intr_disable(bus->sdh);
3166                 }
3167
3168         }
3169
3170
3171         else {
3172                 /* Disable F2 again */
3173                 enable = SDIO_FUNC_ENABLE_1;
3174                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
3175         }
3176
3177         /* Restore previous clock setting */
3178         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3179
3180
3181         /* If we didn't come up, turn off backplane clock */
3182         if (dhdp->busstate != DHD_BUS_DATA)
3183                 dhdsdio_clkctl(bus, CLK_NONE, FALSE);
3184
3185 exit:
3186         if (enforce_mutex)
3187                 dhd_os_sdunlock(bus->dhd);
3188
3189         return ret;
3190 }
3191
3192 static void
3193 dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
3194 {
3195         bcmsdh_info_t *sdh = bus->sdh;
3196         sdpcmd_regs_t *regs = bus->regs;
3197         uint retries = 0;
3198         uint16 lastrbc;
3199         uint8 hi, lo;
3200         int err;
3201
3202         DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
3203                    (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
3204
3205         if (abort) {
3206                 bcmsdh_abort(sdh, SDIO_FUNC_2);
3207         }
3208
3209         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
3210         bus->f1regdata++;
3211
3212         /* Wait until the packet has been flushed (device/FIFO stable) */
3213         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
3214                 hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
3215                 lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, NULL);
3216                 bus->f1regdata += 2;
3217
3218                 if ((hi == 0) && (lo == 0))
3219                         break;
3220
3221                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
3222                         DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
3223                                    __FUNCTION__, lastrbc, ((hi << 8) + lo)));
3224                 }
3225                 lastrbc = (hi << 8) + lo;
3226         }
3227
3228         if (!retries) {
3229                 DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
3230         } else {
3231                 DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
3232         }
3233
3234         if (rtx) {
3235                 bus->rxrtx++;
3236                 W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
3237                 bus->f1regdata++;
3238                 if (retries <= retry_limit) {
3239                         bus->rxskip = TRUE;
3240                 }
3241         }
3242
3243         /* Clear partial in any case */
3244         bus->nextlen = 0;
3245
3246         /* If we can't reach the device, signal failure */
3247         if (err || bcmsdh_regfail(sdh))
3248                 bus->dhd->busstate = DHD_BUS_DOWN;
3249 }
3250
3251 static void
3252 dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
3253 {
3254         bcmsdh_info_t *sdh = bus->sdh;
3255         uint rdlen, pad;
3256
3257         int sdret;
3258
3259         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3260
3261         /* Control data already received in aligned rxctl */
3262         if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
3263                 goto gotpkt;
3264
3265         ASSERT(bus->rxbuf);
3266         /* Set rxctl for frame (w/optional alignment) */
3267         bus->rxctl = bus->rxbuf;
3268         if (dhd_alignctl) {
3269                 bus->rxctl += firstread;
3270                 if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
3271                         bus->rxctl += (DHD_SDALIGN - pad);
3272                 bus->rxctl -= firstread;
3273         }
3274         ASSERT(bus->rxctl >= bus->rxbuf);
3275
3276         /* Copy the already-read portion over */
3277         bcopy(hdr, bus->rxctl, firstread);
3278         if (len <= firstread)
3279                 goto gotpkt;
3280
3281         /* Copy the full data pkt in gSPI case and process ioctl. */
3282         if (bus->bus == SPI_BUS) {
3283                 bcopy(hdr, bus->rxctl, len);
3284                 goto gotpkt;
3285         }
3286
3287         /* Raise rdlen to next SDIO block to avoid tail command */
3288         rdlen = len - firstread;
3289         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
3290                 pad = bus->blocksize - (rdlen % bus->blocksize);
3291                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3292                     ((len + pad) < bus->dhd->maxctl))
3293                         rdlen += pad;
3294         } else if (rdlen % DHD_SDALIGN) {
3295                 rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
3296         }
3297
3298         /* Satisfy length-alignment requirements */
3299         if (forcealign && (rdlen & (ALIGNMENT - 1)))
3300                 rdlen = ROUNDUP(rdlen, ALIGNMENT);
3301
3302         /* Drop if the read is too big or it exceeds our maximum */
3303         if ((rdlen + firstread) > bus->dhd->maxctl) {
3304                 DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
3305                            __FUNCTION__, rdlen, bus->dhd->maxctl));
3306                 bus->dhd->rx_errors++;
3307                 dhdsdio_rxfail(bus, FALSE, FALSE);
3308                 goto done;
3309         }
3310
3311         if ((len - doff) > bus->dhd->maxctl) {
3312                 DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
3313                            __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
3314                 bus->dhd->rx_errors++; bus->rx_toolong++;
3315                 dhdsdio_rxfail(bus, FALSE, FALSE);
3316                 goto done;
3317         }
3318
3319
3320         /* Read remainder of frame body into the rxctl buffer */
3321         sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
3322                                     (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
3323         bus->f2rxdata++;
3324         ASSERT(sdret != BCME_PENDING);
3325
3326         /* Control frame failures need retransmission */
3327         if (sdret < 0) {
3328                 DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
3329                 bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
3330                 dhdsdio_rxfail(bus, TRUE, TRUE);
3331                 goto done;
3332         }
3333
3334 gotpkt:
3335
3336 #ifdef DHD_DEBUG
3337         if (DHD_BYTES_ON() && DHD_CTL_ON()) {
3338                 prhex("RxCtrl", bus->rxctl, len);
3339         }
3340 #endif
3341
3342         /* Point to valid data and indicate its length */
3343         bus->rxctl += doff;
3344         bus->rxlen = len - doff;
3345
3346 done:
3347         /* Awake any waiters */
3348         dhd_os_ioctl_resp_wake(bus->dhd);
3349 }
3350
3351 static uint8
3352 dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
3353 {
3354         uint16 dlen, totlen;
3355         uint8 *dptr, num = 0;
3356
3357         uint16 sublen, check;
3358         void *pfirst, *plast, *pnext, *save_pfirst;
3359         osl_t *osh = bus->dhd->osh;
3360
3361         int errcode;
3362         uint8 chan, seq, doff, sfdoff;
3363         uint8 txmax;
3364
3365         int ifidx = 0;
3366         bool usechain = bus->use_rxchain;
3367
3368         /* If packets, issue read(s) and send up packet chain */
3369         /* Return sequence numbers consumed? */
3370
3371         DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
3372
3373         /* If there's a descriptor, generate the packet chain */
3374         if (bus->glomd) {
3375                 dhd_os_sdlock_rxq(bus->dhd);
3376
3377                 pfirst = plast = pnext = NULL;
3378                 dlen = (uint16)PKTLEN(osh, bus->glomd);
3379                 dptr = PKTDATA(osh, bus->glomd);
3380                 if (!dlen || (dlen & 1)) {
3381                         DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
3382                                    __FUNCTION__, dlen));
3383                         dlen = 0;
3384                 }
3385
3386                 for (totlen = num = 0; dlen; num++) {
3387                         /* Get (and move past) next length */
3388                         sublen = ltoh16_ua(dptr);
3389                         dlen -= sizeof(uint16);
3390                         dptr += sizeof(uint16);
3391                         if ((sublen < SDPCM_HDRLEN) ||
3392                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
3393                                 DHD_ERROR(("%s: descriptor len %d bad: %d\n",
3394                                            __FUNCTION__, num, sublen));
3395                                 pnext = NULL;
3396                                 break;
3397                         }
3398                         if (sublen % DHD_SDALIGN) {
3399                                 DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
3400                                            __FUNCTION__, sublen, DHD_SDALIGN));
3401                                 usechain = FALSE;
3402                         }
3403                         totlen += sublen;
3404
3405                         /* For last frame, adjust read len so total is a block multiple */
3406                         if (!dlen) {
3407                                 sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
3408                                 totlen = ROUNDUP(totlen, bus->blocksize);
3409                         }
3410
3411                         /* Allocate/chain packet for next subframe */
3412                         if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
3413                                 DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
3414                                            __FUNCTION__, num, sublen));
3415                                 break;
3416                         }
3417                         ASSERT(!PKTLINK(pnext));
3418                         if (!pfirst) {
3419                                 ASSERT(!plast);
3420                                 pfirst = plast = pnext;
3421                         } else {
3422                                 ASSERT(plast);
3423                                 PKTSETNEXT(osh, plast, pnext);
3424                                 plast = pnext;
3425                         }
3426
3427                         /* Adhere to start alignment requirements */
3428                         PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
3429                 }
3430
3431                 /* If all allocations succeeded, save packet chain in bus structure */
3432                 if (pnext) {
3433                         DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
3434                                   __FUNCTION__, totlen, num));
3435                         if (DHD_GLOM_ON() && bus->nextlen) {
3436                                 if (totlen != bus->nextlen) {
3437                                         DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
3438                                                   "rxseq %d\n", __FUNCTION__, bus->nextlen,
3439                                                   totlen, rxseq));
3440                                 }
3441                         }
3442                         bus->glom = pfirst;
3443                         pfirst = pnext = NULL;
3444                 } else {
3445                         if (pfirst)
3446                                 PKTFREE(osh, pfirst, FALSE);
3447                         bus->glom = NULL;
3448                         num = 0;
3449                 }
3450
3451                 /* Done with descriptor packet */
3452                 PKTFREE(osh, bus->glomd, FALSE);
3453                 bus->glomd = NULL;
3454                 bus->nextlen = 0;
3455
3456                 dhd_os_sdunlock_rxq(bus->dhd);
3457         }
3458
3459         /* Ok -- either we just generated a packet chain, or had one from before */
3460         if (bus->glom) {
3461                 if (DHD_GLOM_ON()) {
3462                         DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
3463                         for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
3464                                 DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
3465                                           pnext, (uint8*)PKTDATA(osh, pnext),
3466                                           PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
3467                         }
3468                 }
3469
3470                 pfirst = bus->glom;
3471                 dlen = (uint16)pkttotlen(osh, pfirst);
3472
3473                 /* Do an SDIO read for the superframe.  Configurable iovar to
3474                  * read directly into the chained packet, or allocate a large
3475                  * packet and and copy into the chain.
3476                  */
3477                 if (usechain) {
3478                         errcode = dhd_bcmsdh_recv_buf(bus,
3479                                                       bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
3480                                                       F2SYNC, (uint8*)PKTDATA(osh, pfirst),
3481                                                       dlen, pfirst, NULL, NULL);
3482                 } else if (bus->dataptr) {
3483                         errcode = dhd_bcmsdh_recv_buf(bus,
3484                                                       bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
3485                                                       F2SYNC, bus->dataptr,
3486                                                       dlen, NULL, NULL, NULL);
3487                         sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
3488                         if (sublen != dlen) {
3489                                 DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
3490                                            __FUNCTION__, dlen, sublen));
3491                                 errcode = -1;
3492                         }
3493                         pnext = NULL;
3494                 } else {
3495                         DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
3496                         errcode = -1;
3497                 }
3498                 bus->f2rxdata++;
3499                 ASSERT(errcode != BCME_PENDING);
3500
3501                 /* On failure, kill the superframe, allow a couple retries */
3502                 if (errcode < 0) {
3503                         DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
3504                                    __FUNCTION__, dlen, errcode));
3505                         bus->dhd->rx_errors++;
3506
3507                         if (bus->glomerr++ < 3) {
3508                                 dhdsdio_rxfail(bus, TRUE, TRUE);
3509                         } else {
3510                                 bus->glomerr = 0;
3511                                 dhdsdio_rxfail(bus, TRUE, FALSE);
3512                                 dhd_os_sdlock_rxq(bus->dhd);
3513                                 PKTFREE(osh, bus->glom, FALSE);
3514                                 dhd_os_sdunlock_rxq(bus->dhd);
3515                                 bus->rxglomfail++;
3516                                 bus->glom = NULL;
3517                         }
3518                         return 0;
3519                 }
3520
3521 #ifdef DHD_DEBUG
3522                 if (DHD_GLOM_ON()) {
3523                         prhex("SUPERFRAME", PKTDATA(osh, pfirst),
3524                               MIN(PKTLEN(osh, pfirst), 48));
3525                 }
3526 #endif
3527
3528
3529                 /* Validate the superframe header */
3530                 dptr = (uint8 *)PKTDATA(osh, pfirst);
3531                 sublen = ltoh16_ua(dptr);
3532                 check = ltoh16_ua(dptr + sizeof(uint16));
3533
3534                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3535                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3536                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3537                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3538                         DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
3539                                   __FUNCTION__, bus->nextlen, seq));
3540                         bus->nextlen = 0;
3541                 }
3542                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3543                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3544
3545                 errcode = 0;
3546                 if ((uint16)~(sublen^check)) {
3547                         DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
3548                                    __FUNCTION__, sublen, check));
3549                         errcode = -1;
3550                 } else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
3551                         DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
3552                                    __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
3553                         errcode = -1;
3554                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
3555                         DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
3556                                    SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
3557                         errcode = -1;
3558                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
3559                         DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
3560                         errcode = -1;
3561                 } else if ((doff < SDPCM_HDRLEN) ||
3562                            (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
3563                         DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
3564                                    __FUNCTION__, doff, sublen, PKTLEN(osh, pfirst), SDPCM_HDRLEN));
3565                         errcode = -1;
3566                 }
3567
3568                 /* Check sequence number of superframe SW header */
3569                 if (rxseq != seq) {
3570                         DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
3571                                   __FUNCTION__, seq, rxseq));
3572                         bus->rx_badseq++;
3573                         rxseq = seq;
3574                 }
3575
3576                 /* Check window for sanity */
3577                 if ((uint8)(txmax - bus->tx_seq) > 0x40) {
3578                         DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
3579                                    __FUNCTION__, txmax, bus->tx_seq));
3580                         txmax = bus->tx_max;
3581                 }
3582                 bus->tx_max = txmax;
3583
3584                 /* Remove superframe header, remember offset */
3585                 PKTPULL(osh, pfirst, doff);
3586                 sfdoff = doff;
3587
3588                 /* Validate all the subframe headers */
3589                 for (num = 0, pnext = pfirst; pnext && !errcode;
3590                      num++, pnext = PKTNEXT(osh, pnext)) {
3591                         dptr = (uint8 *)PKTDATA(osh, pnext);
3592                         dlen = (uint16)PKTLEN(osh, pnext);
3593                         sublen = ltoh16_ua(dptr);
3594                         check = ltoh16_ua(dptr + sizeof(uint16));
3595                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3596                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3597 #ifdef DHD_DEBUG
3598                         if (DHD_GLOM_ON()) {
3599                                 prhex("subframe", dptr, 32);
3600                         }
3601 #endif
3602
3603                         if ((uint16)~(sublen^check)) {
3604                                 DHD_ERROR(("%s (subframe %d): HW hdr error: "
3605                                            "len/check 0x%04x/0x%04x\n",
3606                                            __FUNCTION__, num, sublen, check));
3607                                 errcode = -1;
3608                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
3609                                 DHD_ERROR(("%s (subframe %d): length mismatch: "
3610                                            "len 0x%04x, expect 0x%04x\n",
3611                                            __FUNCTION__, num, sublen, dlen));
3612                                 errcode = -1;
3613                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
3614                                    (chan != SDPCM_EVENT_CHANNEL)) {
3615                                 DHD_ERROR(("%s (subframe %d): bad channel %d\n",
3616                                            __FUNCTION__, num, chan));
3617                                 errcode = -1;
3618                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
3619                                 DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
3620                                            __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
3621                                 errcode = -1;
3622                         }
3623                 }
3624
3625                 if (errcode) {
3626                         /* Terminate frame on error, request a couple retries */
3627                         if (bus->glomerr++ < 3) {
3628                                 /* Restore superframe header space */
3629                                 PKTPUSH(osh, pfirst, sfdoff);
3630                                 dhdsdio_rxfail(bus, TRUE, TRUE);
3631                         } else {
3632                                 bus->glomerr = 0;
3633                                 dhdsdio_rxfail(bus, TRUE, FALSE);
3634                                 dhd_os_sdlock_rxq(bus->dhd);
3635                                 PKTFREE(osh, bus->glom, FALSE);
3636                                 dhd_os_sdunlock_rxq(bus->dhd);
3637                                 bus->rxglomfail++;
3638                                 bus->glom = NULL;
3639                         }
3640                         bus->nextlen = 0;
3641                         return 0;
3642                 }
3643
3644                 /* Basic SD framing looks ok - process each packet (header) */
3645                 save_pfirst = pfirst;
3646                 bus->glom = NULL;
3647                 plast = NULL;
3648
3649                 dhd_os_sdlock_rxq(bus->dhd);
3650                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
3651                         pnext = PKTNEXT(osh, pfirst);
3652                         PKTSETNEXT(osh, pfirst, NULL);
3653
3654                         dptr = (uint8 *)PKTDATA(osh, pfirst);
3655                         sublen = ltoh16_ua(dptr);
3656                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3657                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3658                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3659
3660                         DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
3661                                   __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
3662                                   PKTLEN(osh, pfirst), sublen, chan, seq));
3663
3664                         ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
3665
3666                         if (rxseq != seq) {
3667                                 DHD_GLOM(("%s: rx_seq %d, expected %d\n",
3668                                           __FUNCTION__, seq, rxseq));
3669                                 bus->rx_badseq++;
3670                                 rxseq = seq;
3671                         }
3672
3673 #ifdef DHD_DEBUG
3674                         if (DHD_BYTES_ON() && DHD_DATA_ON()) {
3675                                 prhex("Rx Subframe Data", dptr, dlen);
3676                         }
3677 #endif
3678
3679                         PKTSETLEN(osh, pfirst, sublen);
3680                         PKTPULL(osh, pfirst, doff);
3681
3682                         if (PKTLEN(osh, pfirst) == 0) {
3683                                 PKTFREE(bus->dhd->osh, pfirst, FALSE);
3684                                 if (plast) {
3685                                         PKTSETNEXT(osh, plast, pnext);
3686                                 } else {
3687                                         ASSERT(save_pfirst == pfirst);
3688                                         save_pfirst = pnext;
3689                                 }
3690                                 continue;
3691                         } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst) != 0) {
3692                                 DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
3693                                 bus->dhd->rx_errors++;
3694                                 PKTFREE(osh, pfirst, FALSE);
3695                                 if (plast) {
3696                                         PKTSETNEXT(osh, plast, pnext);
3697                                 } else {
3698                                         ASSERT(save_pfirst == pfirst);
3699                                         save_pfirst = pnext;
3700                                 }
3701                                 continue;
3702                         }
3703
3704                         /* this packet will go up, link back into chain and count it */
3705                         PKTSETNEXT(osh, pfirst, pnext);
3706                         plast = pfirst;
3707                         num++;
3708
3709 #ifdef DHD_DEBUG
3710                         if (DHD_GLOM_ON()) {
3711                                 DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
3712                                           __FUNCTION__, num, pfirst,
3713                                           PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
3714                                           PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
3715                                 prhex("", (uint8 *)PKTDATA(osh, pfirst),
3716                                       MIN(PKTLEN(osh, pfirst), 32));
3717                         }
3718 #endif /* DHD_DEBUG */
3719                 }
3720                 dhd_os_sdunlock_rxq(bus->dhd);
3721                 if (num) {
3722                         dhd_os_sdunlock(bus->dhd);
3723                         dhd_rx_frame(bus->dhd, ifidx, save_pfirst, num, 0);
3724                         dhd_os_sdlock(bus->dhd);
3725                 }
3726
3727                 bus->rxglomframes++;
3728                 bus->rxglompkts += num;
3729         }
3730         return num;
3731 }
3732
3733 /* Return TRUE if there may be more frames to read */
3734 static uint
3735 dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
3736 {
3737         osl_t *osh = bus->dhd->osh;
3738         bcmsdh_info_t *sdh = bus->sdh;
3739
3740         uint16 len, check;      /* Extracted hardware header fields */
3741         uint8 chan, seq, doff;  /* Extracted software header fields */
3742         uint8 fcbits;           /* Extracted fcbits from software header */
3743         uint8 delta;
3744
3745         void *pkt;      /* Packet for event or data frames */
3746         uint16 pad;     /* Number of pad bytes to read */
3747         uint16 rdlen;   /* Total number of bytes to read */
3748         uint8 rxseq;    /* Next sequence number to expect */
3749         uint rxleft = 0;        /* Remaining number of frames allowed */
3750         int sdret;      /* Return code from bcmsdh calls */
3751         uint8 txmax;    /* Maximum tx sequence offered */
3752         bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
3753         uint8 *rxbuf;
3754         int ifidx = 0;
3755         uint rxcount = 0; /* Total frames read */
3756
3757 #if defined(DHD_DEBUG) || defined(SDTEST)
3758         bool sdtest = FALSE;    /* To limit message spew from test mode */
3759 #endif
3760
3761         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3762
3763         ASSERT(maxframes);
3764
3765 #ifdef SDTEST
3766         /* Allow pktgen to override maxframes */
3767         if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
3768                 maxframes = bus->pktgen_count;
3769                 sdtest = TRUE;
3770         }
3771 #endif
3772
3773         /* Not finished unless we encounter no more frames indication */
3774         *finished = FALSE;
3775
3776
3777         for (rxseq = bus->rx_seq, rxleft = maxframes;
3778              !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
3779              rxseq++, rxleft--) {
3780
3781 #ifdef DHDTHREAD
3782                 /* tx more to improve rx performance */
3783                 if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
3784                         pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) {
3785                         dhdsdio_sendfromq(bus, dhd_txbound);
3786                 }
3787 #endif /* DHDTHREAD */
3788
3789                 /* Handle glomming separately */
3790                 if (bus->glom || bus->glomd) {
3791                         uint8 cnt;
3792                         DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
3793                                   __FUNCTION__, bus->glomd, bus->glom));
3794                         cnt = dhdsdio_rxglom(bus, rxseq);
3795                         DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
3796                         rxseq += cnt - 1;
3797                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
3798                         continue;
3799                 }
3800
3801                 /* Try doing single read if we can */
3802                 if (dhd_readahead && bus->nextlen) {
3803                         uint16 nextlen = bus->nextlen;
3804                         bus->nextlen = 0;
3805
3806                         if (bus->bus == SPI_BUS) {
3807                                 rdlen = len = nextlen;
3808                         }
3809                         else {
3810                                 rdlen = len = nextlen << 4;
3811
3812                                 /* Pad read to blocksize for efficiency */
3813                                 if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
3814                                         pad = bus->blocksize - (rdlen % bus->blocksize);
3815                                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3816                                                 ((rdlen + pad + firstread) < MAX_RX_DATASZ))
3817                                                 rdlen += pad;
3818                                 } else if (rdlen % DHD_SDALIGN) {
3819                                         rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
3820                                 }
3821                         }
3822
3823                         /* We use bus->rxctl buffer in WinXP for initial control pkt receives.
3824                          * Later we use buffer-poll for data as well as control packets.
3825                          * This is required because dhd receives full frame in gSPI unlike SDIO.
3826                          * After the frame is received we have to distinguish whether it is data
3827                          * or non-data frame.
3828                          */
3829                         /* Allocate a packet buffer */
3830                         dhd_os_sdlock_rxq(bus->dhd);
3831                         if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
3832                                 if (bus->bus == SPI_BUS) {
3833                                         bus->usebufpool = FALSE;
3834                                         bus->rxctl = bus->rxbuf;
3835                                         if (dhd_alignctl) {
3836                                                 bus->rxctl += firstread;
3837                                                 if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
3838                                                         bus->rxctl += (DHD_SDALIGN - pad);
3839                                                 bus->rxctl -= firstread;
3840                                         }
3841                                         ASSERT(bus->rxctl >= bus->rxbuf);
3842                                         rxbuf = bus->rxctl;
3843                                         /* Read the entire frame */
3844                                         sdret = dhd_bcmsdh_recv_buf(bus,
3845                                                                     bcmsdh_cur_sbwad(sdh),
3846                                                                     SDIO_FUNC_2,
3847                                                                     F2SYNC, rxbuf, rdlen,
3848                                                                     NULL, NULL, NULL);
3849                                         bus->f2rxdata++;
3850                                         ASSERT(sdret != BCME_PENDING);
3851
3852
3853                                         /* Control frame failures need retransmission */
3854                                         if (sdret < 0) {
3855                                                 DHD_ERROR(("%s: read %d control bytes failed: %d\n",
3856                                                    __FUNCTION__, rdlen, sdret));
3857                                                 /* dhd.rx_ctlerrs is higher level */
3858                                                 bus->rxc_errors++;
3859                                                 dhd_os_sdunlock_rxq(bus->dhd);
3860                                                 dhdsdio_rxfail(bus, TRUE,
3861                                                     (bus->bus == SPI_BUS) ? FALSE : TRUE);
3862                                                 continue;
3863                                         }
3864                                 } else {
3865                                         /* Give up on data, request rtx of events */
3866                                         DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
3867                                                    "expected rxseq %d\n",
3868                                                    __FUNCTION__, len, rdlen, rxseq));
3869                                         /* Just go try again w/normal header read */
3870                                         dhd_os_sdunlock_rxq(bus->dhd);
3871                                         continue;
3872                                 }
3873                         } else {
3874                                 if (bus->bus == SPI_BUS)
3875                                         bus->usebufpool = TRUE;
3876
3877                                 ASSERT(!PKTLINK(pkt));
3878                                 PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
3879                                 rxbuf = (uint8 *)PKTDATA(osh, pkt);
3880                                 /* Read the entire frame */
3881                                 sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
3882                                                             SDIO_FUNC_2,
3883                                                             F2SYNC, rxbuf, rdlen,
3884                                                             pkt, NULL, NULL);
3885                                 bus->f2rxdata++;
3886                                 ASSERT(sdret != BCME_PENDING);
3887
3888                                 if (sdret < 0) {
3889                                         DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
3890                                            __FUNCTION__, rdlen, sdret));
3891                                         PKTFREE(bus->dhd->osh, pkt, FALSE);
3892                                         bus->dhd->rx_errors++;
3893                                         dhd_os_sdunlock_rxq(bus->dhd);
3894                                         /* Force retry w/normal header read.  Don't attempt NAK for
3895                                          * gSPI
3896                                          */
3897                                         dhdsdio_rxfail(bus, TRUE,
3898                                               (bus->bus == SPI_BUS) ? FALSE : TRUE);
3899                                         continue;
3900                                 }
3901                         }
3902                         dhd_os_sdunlock_rxq(bus->dhd);
3903
3904                         /* Now check the header */
3905                         bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
3906
3907                         /* Extract hardware header fields */
3908                         len = ltoh16_ua(bus->rxhdr);
3909                         check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
3910
3911                         /* All zeros means readahead info was bad */
3912                         if (!(len|check)) {
3913                                 DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
3914                                            __FUNCTION__));
3915                                 dhd_os_sdlock_rxq(bus->dhd);
3916                                 PKTFREE2();
3917                                 dhd_os_sdunlock_rxq(bus->dhd);
3918                                 GSPI_PR55150_BAILOUT;
3919                                 continue;
3920                         }
3921
3922                         /* Validate check bytes */
3923                         if ((uint16)~(len^check)) {
3924                                 DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
3925                                            " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
3926                                            len, check));
3927                                 dhd_os_sdlock_rxq(bus->dhd);
3928                                 PKTFREE2();
3929                                 dhd_os_sdunlock_rxq(bus->dhd);
3930                                 bus->rx_badhdr++;
3931                                 dhdsdio_rxfail(bus, FALSE, FALSE);
3932                                 GSPI_PR55150_BAILOUT;
3933                                 continue;
3934                         }
3935
3936                         /* Validate frame length */
3937                         if (len < SDPCM_HDRLEN) {
3938                                 DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
3939                                            __FUNCTION__, len));
3940                                 dhd_os_sdlock_rxq(bus->dhd);
3941                                 PKTFREE2();
3942                                 dhd_os_sdunlock_rxq(bus->dhd);
3943                                 GSPI_PR55150_BAILOUT;
3944                                 continue;
3945                         }
3946
3947                         /* Check for consistency with readahead info */
3948                                 len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
3949                         if (len_consistent) {
3950                                 /* Mismatch, force retry w/normal header (may be >4K) */
3951                                 DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
3952                                            "expected rxseq %d\n",
3953                                            __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
3954                                 dhd_os_sdlock_rxq(bus->dhd);
3955                                 PKTFREE2();
3956                                 dhd_os_sdunlock_rxq(bus->dhd);
3957                                 dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
3958                                 GSPI_PR55150_BAILOUT;
3959                                 continue;
3960                         }
3961
3962
3963                         /* Extract software header fields */
3964                         chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3965                         seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3966                         doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3967                         txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3968
3969                                 bus->nextlen =
3970                                          bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3971                                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3972                                         DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
3973                                                   " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
3974                                                   seq));
3975                                         bus->nextlen = 0;
3976                                 }
3977
3978                                 bus->dhd->rx_readahead_cnt ++;
3979                         /* Handle Flow Control */
3980                         fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3981
3982                         delta = 0;
3983                         if (~bus->flowcontrol & fcbits) {
3984                                 bus->fc_xoff++;
3985                                 delta = 1;
3986                         }
3987                         if (bus->flowcontrol & ~fcbits) {
3988                                 bus->fc_xon++;
3989                                 delta = 1;
3990                         }
3991
3992                         if (delta) {
3993                                 bus->fc_rcvd++;
3994                                 bus->flowcontrol = fcbits;
3995                         }
3996
3997                         /* Check and update sequence number */
3998                         if (rxseq != seq) {
3999                                 DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
4000                                           __FUNCTION__, seq, rxseq));
4001                                 bus->rx_badseq++;
4002                                 rxseq = seq;
4003                         }
4004
4005                         /* Check window for sanity */
4006                         if ((uint8)(txmax - bus->tx_seq) > 0x40) {
4007                                         DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
4008                                                 __FUNCTION__, txmax, bus->tx_seq));
4009                                         txmax = bus->tx_max;
4010                         }
4011                         bus->tx_max = txmax;
4012
4013 #ifdef DHD_DEBUG
4014                         if (DHD_BYTES_ON() && DHD_DATA_ON()) {
4015                                 prhex("Rx Data", rxbuf, len);
4016                         } else if (DHD_HDRS_ON()) {
4017                                 prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
4018                         }
4019 #endif
4020
4021                         if (chan == SDPCM_CONTROL_CHANNEL) {
4022                                 if (bus->bus == SPI_BUS) {
4023                                         dhdsdio_read_control(bus, rxbuf, len, doff);
4024                                         if (bus->usebufpool) {
4025                                                 dhd_os_sdlock_rxq(bus->dhd);
4026                                                 PKTFREE(bus->dhd->osh, pkt, FALSE);
4027                                                 dhd_os_sdunlock_rxq(bus->dhd);
4028                                         }
4029                                         continue;
4030                                 } else {
4031                                         DHD_ERROR(("%s (nextlen): readahead on control"
4032                                                    " packet %d?\n", __FUNCTION__, seq));
4033                                         /* Force retry w/normal header read */
4034                                         bus->nextlen = 0;
4035                                         dhdsdio_rxfail(bus, FALSE, TRUE);
4036                                         dhd_os_sdlock_rxq(bus->dhd);
4037                                         PKTFREE2();
4038                                         dhd_os_sdunlock_rxq(bus->dhd);
4039                                         continue;
4040                                 }
4041                         }
4042
4043                         if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
4044                                 DHD_ERROR(("Received %d bytes on %d channel. Running out of "
4045                                            "rx pktbuf's or not yet malloced.\n", len, chan));
4046                                 continue;
4047                         }
4048
4049                         /* Validate data offset */
4050                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4051                                 DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
4052                                            __FUNCTION__, doff, len, SDPCM_HDRLEN));
4053                                 dhd_os_sdlock_rxq(bus->dhd);
4054                                 PKTFREE2();
4055                                 dhd_os_sdunlock_rxq(bus->dhd);
4056                                 ASSERT(0);
4057                                 dhdsdio_rxfail(bus, FALSE, FALSE);
4058                                 continue;
4059                         }
4060
4061                         /* All done with this one -- now deliver the packet */
4062                         goto deliver;
4063                 }
4064                 /* gSPI frames should not be handled in fractions */
4065                 if (bus->bus == SPI_BUS) {
4066                         break;
4067                 }
4068
4069                 /* Read frame header (hardware and software) */
4070                 sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
4071                                             bus->rxhdr, firstread, NULL, NULL, NULL);
4072                 bus->f2rxhdrs++;
4073                 ASSERT(sdret != BCME_PENDING);
4074
4075                 if (sdret < 0) {
4076                         DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
4077                         bus->rx_hdrfail++;
4078                         dhdsdio_rxfail(bus, TRUE, TRUE);
4079                         continue;
4080                 }
4081
4082 #ifdef DHD_DEBUG
4083                 if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
4084                         prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
4085                 }
4086 #endif
4087
4088                 /* Extract hardware header fields */
4089                 len = ltoh16_ua(bus->rxhdr);
4090                 check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
4091
4092                 /* All zeros means no more frames */
4093                 if (!(len|check)) {
4094                         *finished = TRUE;
4095                         break;
4096                 }
4097
4098                 /* Validate check bytes */
4099                 if ((uint16)~(len^check)) {
4100                         DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
4101                                    __FUNCTION__, len, check));
4102                         bus->rx_badhdr++;
4103                         dhdsdio_rxfail(bus, FALSE, FALSE);
4104                         continue;
4105                 }
4106
4107                 /* Validate frame length */
4108                 if (len < SDPCM_HDRLEN) {
4109                         DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
4110                         continue;
4111                 }
4112
4113                 /* Extract software header fields */
4114                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4115                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4116                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4117                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4118
4119                 /* Validate data offset */
4120                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4121                         DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
4122                                    __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
4123                         bus->rx_badhdr++;
4124                         ASSERT(0);
4125                         dhdsdio_rxfail(bus, FALSE, FALSE);
4126                         continue;
4127                 }
4128
4129                 /* Save the readahead length if there is one */
4130                 bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
4131                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
4132                         DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
4133                                   __FUNCTION__, bus->nextlen, seq));
4134                         bus->nextlen = 0;
4135                 }
4136
4137                 /* Handle Flow Control */
4138                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4139
4140                 delta = 0;
4141                 if (~bus->flowcontrol & fcbits) {
4142                         bus->fc_xoff++;
4143                         delta = 1;
4144                 }
4145                 if (bus->flowcontrol & ~fcbits) {
4146                         bus->fc_xon++;
4147                         delta = 1;
4148                 }
4149
4150                 if (delta) {
4151                         bus->fc_rcvd++;
4152                         bus->flowcontrol = fcbits;
4153                 }
4154
4155                 /* Check and update sequence number */
4156                 if (rxseq != seq) {
4157                         DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
4158                         bus->rx_badseq++;
4159                         rxseq = seq;
4160                 }
4161
4162                 /* Check window for sanity */
4163                 if ((uint8)(txmax - bus->tx_seq) > 0x40) {
4164                         DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
4165                                    __FUNCTION__, txmax, bus->tx_seq));
4166                         txmax = bus->tx_max;
4167                 }
4168                 bus->tx_max = txmax;
4169
4170                 /* Call a separate function for control frames */
4171                 if (chan == SDPCM_CONTROL_CHANNEL) {
4172                         dhdsdio_read_control(bus, bus->rxhdr, len, doff);
4173                         continue;
4174                 }
4175
4176                 ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
4177                        (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
4178
4179                 /* Length to read */
4180                 rdlen = (len > firstread) ? (len - firstread) : 0;
4181
4182                 /* May pad read to blocksize for efficiency */
4183                 if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
4184                         pad = bus->blocksize - (rdlen % bus->blocksize);
4185                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
4186                             ((rdlen + pad + firstread) < MAX_RX_DATASZ))
4187                                 rdlen += pad;
4188                 } else if (rdlen % DHD_SDALIGN) {
4189                         rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
4190                 }
4191
4192                 /* Satisfy length-alignment requirements */
4193                 if (forcealign && (rdlen & (ALIGNMENT - 1)))
4194                         rdlen = ROUNDUP(rdlen, ALIGNMENT);
4195
4196                 if ((rdlen + firstread) > MAX_RX_DATASZ) {
4197                         /* Too long -- skip this frame */
4198                         DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
4199                         bus->dhd->rx_errors++; bus->rx_toolong++;
4200                         dhdsdio_rxfail(bus, FALSE, FALSE);
4201                         continue;
4202                 }
4203
4204                 dhd_os_sdlock_rxq(bus->dhd);
4205                 if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
4206                         /* Give up on data, request rtx of events */
4207                         DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
4208                                    __FUNCTION__, rdlen, chan));
4209                         bus->dhd->rx_dropped++;
4210                         dhd_os_sdunlock_rxq(bus->dhd);
4211                         dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
4212                         continue;
4213                 }
4214                 dhd_os_sdunlock_rxq(bus->dhd);
4215
4216                 ASSERT(!PKTLINK(pkt));
4217
4218                 /* Leave room for what we already read, and align remainder */
4219                 ASSERT(firstread < (PKTLEN(osh, pkt)));
4220                 PKTPULL(osh, pkt, firstread);
4221                 PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
4222
4223                 /* Read the remaining frame data */
4224                 sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
4225                                             ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
4226                 bus->f2rxdata++;
4227                 ASSERT(sdret != BCME_PENDING);
4228
4229                 if (sdret < 0) {
4230                         DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
4231                                    ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
4232                                     ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
4233                         dhd_os_sdlock_rxq(bus->dhd);
4234                         PKTFREE(bus->dhd->osh, pkt, FALSE);
4235                         dhd_os_sdunlock_rxq(bus->dhd);
4236                         bus->dhd->rx_errors++;
4237                         dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
4238                         continue;
4239                 }
4240
4241                 /* Copy the already-read portion */
4242                 PKTPUSH(osh, pkt, firstread);
4243                 bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
4244
4245 #ifdef DHD_DEBUG
4246                 if (DHD_BYTES_ON() && DHD_DATA_ON()) {
4247                         prhex("Rx Data", PKTDATA(osh, pkt), len);
4248                 }
4249 #endif
4250
4251 deliver:
4252                 /* Save superframe descriptor and allocate packet frame */
4253                 if (chan == SDPCM_GLOM_CHANNEL) {
4254                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
4255                                 DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
4256                                           __FUNCTION__, len));
4257 #ifdef DHD_DEBUG
4258                                 if (DHD_GLOM_ON()) {
4259                                         prhex("Glom Data", PKTDATA(osh, pkt), len);
4260                                 }
4261 #endif
4262                                 PKTSETLEN(osh, pkt, len);
4263                                 ASSERT(doff == SDPCM_HDRLEN);
4264                                 PKTPULL(osh, pkt, SDPCM_HDRLEN);
4265                                 bus->glomd = pkt;
4266                         } else {
4267                                 DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
4268                                 dhdsdio_rxfail(bus, FALSE, FALSE);
4269                         }
4270                         continue;
4271                 }
4272
4273                 /* Fill in packet len and prio, deliver upward */
4274                 PKTSETLEN(osh, pkt, len);
4275                 PKTPULL(osh, pkt, doff);
4276
4277 #ifdef SDTEST
4278                 /* Test channel packets are processed separately */
4279                 if (chan == SDPCM_TEST_CHANNEL) {
4280                         dhdsdio_testrcv(bus, pkt, seq);
4281                         continue;
4282                 }
4283 #endif /* SDTEST */
4284
4285                 if (PKTLEN(osh, pkt) == 0) {
4286                         dhd_os_sdlock_rxq(bus->dhd);
4287                         PKTFREE(bus->dhd->osh, pkt, FALSE);
4288                         dhd_os_sdunlock_rxq(bus->dhd);
4289                         continue;
4290                 } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt) != 0) {
4291                         DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
4292                         dhd_os_sdlock_rxq(bus->dhd);
4293                         PKTFREE(bus->dhd->osh, pkt, FALSE);
4294                         dhd_os_sdunlock_rxq(bus->dhd);
4295                         bus->dhd->rx_errors++;
4296                         continue;
4297                 }
4298
4299
4300                 /* Unlock during rx call */
4301                 dhd_os_sdunlock(bus->dhd);
4302                 dhd_rx_frame(bus->dhd, ifidx, pkt, 1, chan);
4303                 dhd_os_sdlock(bus->dhd);
4304         }
4305         rxcount = maxframes - rxleft;
4306 #ifdef DHD_DEBUG
4307         /* Message if we hit the limit */
4308         if (!rxleft && !sdtest)
4309                 DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
4310         else
4311 #endif /* DHD_DEBUG */
4312         DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
4313         /* Back off rxseq if awaiting rtx, update rx_seq */
4314         if (bus->rxskip)
4315                 rxseq--;
4316         bus->rx_seq = rxseq;
4317
4318         return rxcount;
4319 }
4320
4321 static uint32
4322 dhdsdio_hostmail(dhd_bus_t *bus)
4323 {
4324         sdpcmd_regs_t *regs = bus->regs;
4325         uint32 intstatus = 0;
4326         uint32 hmb_data;
4327         uint8 fcbits;
4328         uint retries = 0;
4329
4330         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4331
4332         /* Read mailbox data and ack that we did so */
4333         R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
4334         if (retries <= retry_limit)
4335                 W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
4336         bus->f1regdata += 2;
4337
4338         /* Dongle recomposed rx frames, accept them again */
4339         if (hmb_data & HMB_DATA_NAKHANDLED) {
4340                 DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
4341                 if (!bus->rxskip) {
4342                         DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
4343                 }
4344                 bus->rxskip = FALSE;
4345                 intstatus |= FRAME_AVAIL_MASK(bus);
4346         }
4347
4348         /*
4349          * DEVREADY does not occur with gSPI.
4350          */
4351         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
4352                 bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
4353                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
4354                         DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
4355                                    bus->sdpcm_ver, SDPCM_PROT_VERSION));
4356                 else
4357                         DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
4358                 /* make sure for the SDIO_DEVICE_RXDATAINT_MODE_1 corecontrol is proper */
4359                 if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
4360                     (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1)) {
4361                         uint32 val;
4362
4363                         val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
4364                         val &= ~CC_XMTDATAAVAIL_MODE;
4365                         val |= CC_XMTDATAAVAIL_CTRL;
4366                         W_REG(bus->dhd->osh, &bus->regs->corecontrol, val);
4367
4368                         val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
4369                 }
4370
4371 #ifdef DHD_DEBUG
4372                 /* Retrieve console state address now that firmware should have updated it */
4373                 {
4374                         sdpcm_shared_t shared;
4375                         if (dhdsdio_readshared(bus, &shared) == 0)
4376                                 bus->console_addr = shared.console_addr;
4377                 }
4378 #endif /* DHD_DEBUG */
4379         }
4380
4381         /*
4382          * Flow Control has been moved into the RX headers and this out of band
4383          * method isn't used any more.  Leave this here for possibly remaining backward
4384          * compatible with older dongles
4385          */
4386         if (hmb_data & HMB_DATA_FC) {
4387                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
4388
4389                 if (fcbits & ~bus->flowcontrol)
4390                         bus->fc_xoff++;
4391                 if (bus->flowcontrol & ~fcbits)
4392                         bus->fc_xon++;
4393
4394                 bus->fc_rcvd++;
4395                 bus->flowcontrol = fcbits;
4396         }
4397
4398 #ifdef DHD_DEBUG
4399         /* At least print a message if FW halted */
4400         if (hmb_data & HMB_DATA_FWHALT) {
4401                 DHD_ERROR(("INTERNAL ERROR: FIRMWARE HALTED\n"));
4402                 dhdsdio_checkdied(bus, NULL, 0);
4403         }
4404 #endif /* DHD_DEBUG */
4405
4406         /* Shouldn't be any others */
4407         if (hmb_data & ~(HMB_DATA_DEVREADY |
4408                          HMB_DATA_FWHALT |
4409                          HMB_DATA_NAKHANDLED |
4410                          HMB_DATA_FC |
4411                          HMB_DATA_FWREADY |
4412                          HMB_DATA_FCDATA_MASK |
4413                          HMB_DATA_VERSION_MASK)) {
4414                 DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
4415         }
4416
4417         return intstatus;
4418 }
4419
4420 static bool
4421 dhdsdio_dpc(dhd_bus_t *bus)
4422 {
4423         bcmsdh_info_t *sdh = bus->sdh;
4424         sdpcmd_regs_t *regs = bus->regs;
4425         uint32 intstatus, newstatus = 0;
4426         uint retries = 0;
4427         uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
4428         uint txlimit = dhd_txbound; /* Tx frames to send before resched */
4429         uint framecnt = 0;                /* Temporary counter of tx/rx frames */
4430         bool rxdone = TRUE;               /* Flag for no more read data */
4431         bool resched = FALSE;     /* Flag indicating resched wanted */
4432
4433         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4434
4435         if (bus->dhd->busstate == DHD_BUS_DOWN) {
4436                 DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
4437                 bus->intstatus = 0;
4438                 return 0;
4439         }
4440
4441         /* Start with leftover status bits */
4442         intstatus = bus->intstatus;
4443
4444         dhd_os_sdlock(bus->dhd);
4445
4446         /* If waiting for HTAVAIL, check status */
4447         if (bus->clkstate == CLK_PENDING) {
4448                 int err;
4449                 uint8 clkctl, devctl = 0;
4450
4451 #ifdef DHD_DEBUG
4452                 /* Check for inconsistent device control */
4453                 devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
4454                 if (err) {
4455                         DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
4456                         bus->dhd->busstate = DHD_BUS_DOWN;
4457                 } else {
4458                         ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
4459                 }
4460 #endif /* DHD_DEBUG */
4461
4462                 /* Read CSR, if clock on switch to AVAIL, else ignore */
4463                 clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
4464                 if (err) {
4465                         DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
4466                         bus->dhd->busstate = DHD_BUS_DOWN;
4467                 }
4468
4469                 DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
4470
4471                 if (SBSDIO_HTAV(clkctl)) {
4472                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
4473                         if (err) {
4474                                 DHD_ERROR(("%s: error reading DEVCTL: %d\n",
4475                                            __FUNCTION__, err));
4476                                 bus->dhd->busstate = DHD_BUS_DOWN;
4477                         }
4478                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
4479                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
4480                         if (err) {
4481                                 DHD_ERROR(("%s: error writing DEVCTL: %d\n",
4482                                            __FUNCTION__, err));
4483                                 bus->dhd->busstate = DHD_BUS_DOWN;
4484                         }
4485                         bus->clkstate = CLK_AVAIL;
4486                 } else {
4487                         goto clkwait;
4488                 }
4489         }
4490
4491         BUS_WAKE(bus);
4492
4493         /* Make sure backplane clock is on */
4494         dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
4495         if (bus->clkstate != CLK_AVAIL)
4496                 goto clkwait;
4497
4498         /* Pending interrupt indicates new device status */
4499         if (bus->ipend) {
4500                 bus->ipend = FALSE;
4501                 R_SDREG(newstatus, &regs->intstatus, retries);
4502                 bus->f1regdata++;
4503                 if (bcmsdh_regfail(bus->sdh))
4504                         newstatus = 0;
4505                 newstatus &= bus->hostintmask;
4506                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
4507                 if (newstatus) {
4508                         bus->f1regdata++;
4509                         if ((bus->rxint_mode == SDIO_DEVICE_RXDATAINT_MODE_0) &&
4510                                 (newstatus == I_XMTDATA_AVAIL)) {
4511                         }
4512                         else
4513                                 W_SDREG(newstatus, &regs->intstatus, retries);
4514                 }
4515         }
4516
4517         /* Merge new bits with previous */
4518         intstatus |= newstatus;
4519         bus->intstatus = 0;
4520
4521         /* Handle flow-control change: read new state in case our ack
4522          * crossed another change interrupt.  If change still set, assume
4523          * FC ON for safety, let next loop through do the debounce.
4524          */
4525         if (intstatus & I_HMB_FC_CHANGE) {
4526                 intstatus &= ~I_HMB_FC_CHANGE;
4527                 W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
4528                 R_SDREG(newstatus, &regs->intstatus, retries);
4529                 bus->f1regdata += 2;
4530                 bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
4531                 intstatus |= (newstatus & bus->hostintmask);
4532         }
4533
4534         /* Just being here means nothing more to do for chipactive */
4535         if (intstatus & I_CHIPACTIVE) {
4536                 /* ASSERT(bus->clkstate == CLK_AVAIL); */
4537                 intstatus &= ~I_CHIPACTIVE;
4538         }
4539
4540         /* Handle host mailbox indication */
4541         if (intstatus & I_HMB_HOST_INT) {
4542                 intstatus &= ~I_HMB_HOST_INT;
4543                 intstatus |= dhdsdio_hostmail(bus);
4544         }
4545
4546         /* Generally don't ask for these, can get CRC errors... */
4547         if (intstatus & I_WR_OOSYNC) {
4548                 DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
4549                 intstatus &= ~I_WR_OOSYNC;
4550         }
4551
4552         if (intstatus & I_RD_OOSYNC) {
4553                 DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
4554                 intstatus &= ~I_RD_OOSYNC;
4555         }
4556
4557         if (intstatus & I_SBINT) {
4558                 DHD_ERROR(("Dongle reports SBINT\n"));
4559                 intstatus &= ~I_SBINT;
4560         }
4561
4562         /* Would be active due to wake-wlan in gSPI */
4563         if (intstatus & I_CHIPACTIVE) {
4564                 DHD_INFO(("Dongle reports CHIPACTIVE\n"));
4565                 intstatus &= ~I_CHIPACTIVE;
4566         }
4567
4568         /* Ignore frame indications if rxskip is set */
4569         if (bus->rxskip) {
4570                 intstatus &= ~FRAME_AVAIL_MASK(bus);
4571         }
4572
4573         /* On frame indication, read available frames */
4574         if (PKT_AVAILABLE(bus, intstatus)) {
4575                 framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
4576                 if (rxdone || bus->rxskip)
4577                         intstatus  &= ~FRAME_AVAIL_MASK(bus);
4578                 rxlimit -= MIN(framecnt, rxlimit);
4579         }
4580
4581         /* Keep still-pending events for next scheduling */
4582         bus->intstatus = intstatus;
4583
4584 clkwait:
4585         /* Re-enable interrupts to detect new device events (mailbox, rx frame)
4586          * or clock availability.  (Allows tx loop to check ipend if desired.)
4587          * (Unless register access seems hosed, as we may not be able to ACK...)
4588          */
4589         if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh)) {
4590                 DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
4591                           __FUNCTION__, rxdone, framecnt));
4592                 bus->intdis = FALSE;
4593 #if defined(OOB_INTR_ONLY)
4594         bcmsdh_oob_intr_set(1);
4595 #endif /* (OOB_INTR_ONLY) */
4596                 bcmsdh_intr_enable(sdh);
4597         }
4598
4599 #if defined(OOB_INTR_ONLY) && !defined(HW_OOB)
4600         /* In case of SW-OOB(using edge trigger),
4601          * Check interrupt status in the dongle again after enable irq on the host.
4602          * and rechedule dpc if interrupt is pended in the dongle.
4603          * There is a chance to miss OOB interrupt while irq is disabled on the host.
4604          * No need to do this with HW-OOB(level trigger)
4605          */
4606         R_SDREG(newstatus, &regs->intstatus, retries);
4607         if (bcmsdh_regfail(bus->sdh))
4608                 newstatus = 0;
4609         if (newstatus & bus->hostintmask) {
4610                 bus->ipend = TRUE;
4611                 resched = TRUE;
4612         }
4613 #endif /* defined(OOB_INTR_ONLY) && !defined(HW_OOB) */
4614
4615         if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL))  {
4616                 int ret, i;
4617                 uint8* frame_seq = bus->ctrl_frame_buf + SDPCM_FRAMETAG_LEN;
4618
4619                 if (*frame_seq != bus->tx_seq) {
4620                         DHD_INFO(("%s IOCTL frame seq lag detected!"
4621                                 " frm_seq:%d != bus->tx_seq:%d, corrected\n",
4622                                 __FUNCTION__, *frame_seq, bus->tx_seq));
4623                         *frame_seq = bus->tx_seq;
4624                 }
4625
4626                 ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
4627                                       (uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
4628                         NULL, NULL, NULL);
4629                 ASSERT(ret != BCME_PENDING);
4630
4631                 if (ret < 0) {
4632                         /* On failure, abort the command and terminate the frame */
4633                         DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
4634                                   __FUNCTION__, ret));
4635                         bus->tx_sderrs++;
4636
4637                         bcmsdh_abort(sdh, SDIO_FUNC_2);
4638
4639                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
4640                                          SFC_WF_TERM, NULL);
4641                         bus->f1regdata++;
4642
4643                         for (i = 0; i < 3; i++) {
4644                                 uint8 hi, lo;
4645                                 hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
4646                                                      SBSDIO_FUNC1_WFRAMEBCHI, NULL);
4647                                 lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
4648                                                      SBSDIO_FUNC1_WFRAMEBCLO, NULL);
4649                                 bus->f1regdata += 2;
4650                                 if ((hi == 0) && (lo == 0))
4651                                         break;
4652                         }
4653                 }
4654                 if (ret == 0) {
4655                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
4656                 }
4657
4658                 bus->ctrl_frame_stat = FALSE;
4659                 dhd_wait_event_wakeup(bus->dhd);
4660         }
4661         /* Send queued frames (limit 1 if rx may still be pending) */
4662         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
4663             pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
4664                 framecnt = rxdone ? txlimit : MIN(txlimit, dhd_txminmax);
4665                 framecnt = dhdsdio_sendfromq(bus, framecnt);
4666                 txlimit -= framecnt;
4667         }
4668         /* Resched the DPC if ctrl cmd is pending on bus credit */
4669         if (bus->ctrl_frame_stat)
4670                 resched = TRUE;
4671
4672         /* Resched if events or tx frames are pending, else await next interrupt */
4673         /* On failed register access, all bets are off: no resched or interrupts */
4674         if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
4675                 DHD_ERROR(("%s: failed backplane access over SDIO, halting operation %d \n",
4676                            __FUNCTION__, bcmsdh_regfail(sdh)));
4677                 bus->dhd->busstate = DHD_BUS_DOWN;
4678                 bus->intstatus = 0;
4679         } else if (bus->clkstate == CLK_PENDING) {
4680                 /* Awaiting I_CHIPACTIVE; don't resched */
4681         } else if (bus->intstatus || bus->ipend ||
4682                    (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
4683                         PKT_AVAILABLE(bus, bus->intstatus)) {  /* Read multiple frames */
4684                 resched = TRUE;
4685         }
4686
4687         bus->dpc_sched = resched;
4688
4689         /* If we're done for now, turn off clock request. */
4690         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && (bus->clkstate != CLK_PENDING)) {
4691                 bus->activity = FALSE;
4692                 dhdsdio_clkctl(bus, CLK_NONE, FALSE);
4693         }
4694
4695         dhd_os_sdunlock(bus->dhd);
4696         return resched;
4697 }
4698
4699 bool
4700 dhd_bus_dpc(struct dhd_bus *bus)
4701 {
4702         bool resched;
4703
4704         /* Call the DPC directly. */
4705         DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
4706         resched = dhdsdio_dpc(bus);
4707
4708         return resched;
4709 }
4710
4711 void
4712 dhdsdio_isr(void *arg)
4713 {
4714         dhd_bus_t *bus = (dhd_bus_t*)arg;
4715         bcmsdh_info_t *sdh;
4716
4717         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4718
4719         if (!bus) {
4720                 DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
4721                 return;
4722         }
4723         sdh = bus->sdh;
4724
4725         if (bus->dhd->busstate == DHD_BUS_DOWN) {
4726                 DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
4727                 return;
4728         }
4729
4730         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4731
4732         /* Count the interrupt call */
4733         bus->intrcount++;
4734         bus->ipend = TRUE;
4735
4736         /* Shouldn't get this interrupt if we're sleeping? */
4737         if (bus->sleeping) {
4738                 DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
4739                 return;
4740         }
4741
4742         /* Disable additional interrupts (is this needed now)? */
4743         if (bus->intr) {
4744                 DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
4745         } else {
4746                 DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
4747         }
4748
4749         bcmsdh_intr_disable(sdh);
4750         bus->intdis = TRUE;
4751
4752 #if defined(SDIO_ISR_THREAD)
4753         DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
4754         DHD_OS_WAKE_LOCK(bus->dhd);
4755         while (dhdsdio_dpc(bus));
4756         DHD_OS_WAKE_UNLOCK(bus->dhd);
4757 #else
4758         bus->dpc_sched = TRUE;
4759         dhd_sched_dpc(bus->dhd);
4760 #endif 
4761
4762 }
4763
4764 #ifdef SDTEST
4765 static void
4766 dhdsdio_pktgen_init(dhd_bus_t *bus)
4767 {
4768         /* Default to specified length, or full range */
4769         if (dhd_pktgen_len) {
4770                 bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
4771                 bus->pktgen_minlen = bus->pktgen_maxlen;
4772         } else {
4773                 bus->pktgen_maxlen = MAX_PKTGEN_LEN;
4774                 bus->pktgen_minlen = 0;
4775         }
4776         bus->pktgen_len = (uint16)bus->pktgen_minlen;
4777
4778         /* Default to per-watchdog burst with 10s print time */
4779         bus->pktgen_freq = 1;
4780         bus->pktgen_print = 10000 / dhd_watchdog_ms;
4781         bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
4782
4783         /* Default to echo mode */
4784         bus->pktgen_mode = DHD_PKTGEN_ECHO;
4785         bus->pktgen_stop = 1;
4786 }
4787
4788 static void
4789 dhdsdio_pktgen(dhd_bus_t *bus)
4790 {
4791         void *pkt;
4792         uint8 *data;
4793         uint pktcount;
4794         uint fillbyte;
4795         osl_t *osh = bus->dhd->osh;
4796         uint16 len;
4797
4798         /* Display current count if appropriate */
4799         if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
4800                 bus->pktgen_ptick = 0;
4801                 printf("%s: send attempts %d rcvd %d\n",
4802                        __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd);
4803         }
4804
4805         /* For recv mode, just make sure dongle has started sending */
4806         if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
4807                 if (bus->pktgen_rcv_state == PKTGEN_RCV_IDLE) {
4808                         bus->pktgen_rcv_state = PKTGEN_RCV_ONGOING;
4809                         dhdsdio_sdtest_set(bus, (uint8)bus->pktgen_total);
4810                 }
4811                 return;
4812         }
4813
4814         /* Otherwise, generate or request the specified number of packets */
4815         for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
4816                 /* Stop if total has been reached */
4817                 if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
4818                         bus->pktgen_count = 0;
4819                         break;
4820                 }
4821
4822                 /* Allocate an appropriate-sized packet */
4823                 len = bus->pktgen_len;
4824                 if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
4825                                    TRUE))) {;
4826                         DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
4827                         break;
4828                 }
4829                 PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
4830                 data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
4831
4832                 /* Write test header cmd and extra based on mode */
4833                 switch (bus->pktgen_mode) {
4834                 case DHD_PKTGEN_ECHO:
4835                         *data++ = SDPCM_TEST_ECHOREQ;
4836                         *data++ = (uint8)bus->pktgen_sent;
4837                         break;
4838
4839                 case DHD_PKTGEN_SEND:
4840                         *data++ = SDPCM_TEST_DISCARD;
4841                         *data++ = (uint8)bus->pktgen_sent;
4842                         break;
4843
4844                 case DHD_PKTGEN_RXBURST:
4845                         *data++ = SDPCM_TEST_BURST;
4846                         *data++ = (uint8)bus->pktgen_count;
4847                         break;
4848
4849                 default:
4850                         DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
4851                         PKTFREE(osh, pkt, TRUE);
4852                         bus->pktgen_count = 0;
4853                         return;
4854                 }
4855
4856                 /* Write test header length field */
4857                 *data++ = (len >> 0);
4858                 *data++ = (len >> 8);
4859
4860                 /* Then fill in the remainder -- N/A for burst, but who cares... */
4861                 for (fillbyte = 0; fillbyte < len; fillbyte++)
4862                         *data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
4863
4864 #ifdef DHD_DEBUG
4865                 if (DHD_BYTES_ON() && DHD_DATA_ON()) {
4866                         data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
4867                         prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
4868                 }
4869 #endif
4870
4871                 /* Send it */
4872                 if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE)) {
4873                         bus->pktgen_fail++;
4874                         if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
4875                                 bus->pktgen_count = 0;
4876                 }
4877                 bus->pktgen_sent++;
4878
4879                 /* Bump length if not fixed, wrap at max */
4880                 if (++bus->pktgen_len > bus->pktgen_maxlen)
4881                         bus->pktgen_len = (uint16)bus->pktgen_minlen;
4882
4883                 /* Special case for burst mode: just send one request! */
4884                 if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
4885                         break;
4886         }
4887 }
4888
4889 static void
4890 dhdsdio_sdtest_set(dhd_bus_t *bus, uint8 count)
4891 {
4892         void *pkt;
4893         uint8 *data;
4894         osl_t *osh = bus->dhd->osh;
4895
4896         /* Allocate the packet */
4897         if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN, TRUE))) {
4898                 DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
4899                 return;
4900         }
4901         PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
4902         data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
4903
4904         /* Fill in the test header */
4905         *data++ = SDPCM_TEST_SEND;
4906         *data++ = count;
4907         *data++ = (bus->pktgen_maxlen >> 0);
4908         *data++ = (bus->pktgen_maxlen >> 8);
4909
4910         /* Send it */
4911         if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE))
4912                 bus->pktgen_fail++;
4913 }
4914
4915
4916 static void
4917 dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
4918 {
4919         osl_t *osh = bus->dhd->osh;
4920         uint8 *data;
4921         uint pktlen;
4922
4923         uint8 cmd;
4924         uint8 extra;
4925         uint16 len;
4926         uint16 offset;
4927
4928         /* Check for min length */
4929         if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
4930                 DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
4931                 PKTFREE(osh, pkt, FALSE);
4932                 return;
4933         }
4934
4935         /* Extract header fields */
4936         data = PKTDATA(osh, pkt);
4937         cmd = *data++;
4938         extra = *data++;
4939         len = *data++; len += *data++ << 8;
4940         DHD_TRACE(("%s:cmd:%d, xtra:%d,len:%d\n", __FUNCTION__, cmd, extra, len));
4941         /* Check length for relevant commands */
4942         if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
4943                 if (pktlen != len + SDPCM_TEST_HDRLEN) {
4944                         DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
4945                                    " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
4946                         PKTFREE(osh, pkt, FALSE);
4947                         return;
4948                 }
4949         }
4950
4951         /* Process as per command */
4952         switch (cmd) {
4953         case SDPCM_TEST_ECHOREQ:
4954                 /* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
4955                 *(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
4956                 if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE) == 0) {
4957                         bus->pktgen_sent++;
4958                 } else {
4959                         bus->pktgen_fail++;
4960                         PKTFREE(osh, pkt, FALSE);
4961                 }
4962                 bus->pktgen_rcvd++;
4963                 break;
4964
4965         case SDPCM_TEST_ECHORSP:
4966                 if (bus->ext_loop) {
4967                         PKTFREE(osh, pkt, FALSE);
4968                         bus->pktgen_rcvd++;
4969                         break;
4970                 }
4971
4972                 for (offset = 0; offset < len; offset++, data++) {
4973                         if (*data != SDPCM_TEST_FILL(offset, extra)) {
4974                                 DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
4975                                            "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
4976                                            offset, len, SDPCM_TEST_FILL(offset, extra), *data));
4977                                 break;
4978                         }
4979                 }
4980                 PKTFREE(osh, pkt, FALSE);
4981                 bus->pktgen_rcvd++;
4982                 break;
4983
4984         case SDPCM_TEST_DISCARD:
4985                 {
4986                         int i = 0;
4987                         uint8 *prn = data;
4988                         uint8 testval = extra;
4989                         for (i = 0; i < len; i++) {
4990                                 if (*prn != testval) {
4991                                         DHD_ERROR(("DIErr@Pkt#:%d,Ix:%d, expected:0x%x, got:0x%x\n",
4992                                                 i, bus->pktgen_rcvd_rcvsession, testval, *prn));
4993                                         prn++; testval++;
4994                                 }
4995                         }
4996                 }
4997                 PKTFREE(osh, pkt, FALSE);
4998                 bus->pktgen_rcvd++;
4999                 break;
5000
5001         case SDPCM_TEST_BURST:
5002         case SDPCM_TEST_SEND:
5003         default:
5004                 DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
5005                           " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
5006                 PKTFREE(osh, pkt, FALSE);
5007                 break;
5008         }
5009
5010         /* For recv mode, stop at limit (and tell dongle to stop sending) */
5011         if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
5012                 if (bus->pktgen_rcv_state != PKTGEN_RCV_IDLE) {
5013                         bus->pktgen_rcvd_rcvsession++;
5014
5015                         if (bus->pktgen_total &&
5016                                 (bus->pktgen_rcvd_rcvsession >= bus->pktgen_total)) {
5017                         bus->pktgen_count = 0;
5018                     DHD_ERROR(("Pktgen:rcv test complete!\n"));
5019                     bus->pktgen_rcv_state = PKTGEN_RCV_IDLE;
5020                         dhdsdio_sdtest_set(bus, FALSE);
5021                                 bus->pktgen_rcvd_rcvsession = 0;
5022                         }
5023                 }
5024         }
5025 }
5026 #endif /* SDTEST */
5027
5028 extern void
5029 dhd_disable_intr(dhd_pub_t *dhdp)
5030 {
5031         dhd_bus_t *bus;
5032         bus = dhdp->bus;
5033         bcmsdh_intr_disable(bus->sdh);
5034 }
5035
5036 extern bool
5037 dhd_bus_watchdog(dhd_pub_t *dhdp)
5038 {
5039         dhd_bus_t *bus;
5040
5041         DHD_TIMER(("%s: Enter\n", __FUNCTION__));
5042
5043         bus = dhdp->bus;
5044
5045         if (bus->dhd->dongle_reset)
5046                 return FALSE;
5047
5048         /* Ignore the timer if simulating bus down */
5049         if (bus->sleeping)
5050                 return FALSE;
5051
5052         if (dhdp->busstate == DHD_BUS_DOWN)
5053                 return FALSE;
5054
5055         /* Poll period: check device if appropriate. */
5056         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
5057                 uint32 intstatus = 0;
5058
5059                 /* Reset poll tick */
5060                 bus->polltick = 0;
5061
5062                 /* Check device if no interrupts */
5063                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
5064
5065                         if (!bus->dpc_sched) {
5066                                 uint8 devpend;
5067                                 devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
5068                                                           SDIOD_CCCR_INTPEND, NULL);
5069                                 intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
5070                         }
5071
5072                         /* If there is something, make like the ISR and schedule the DPC */
5073                         if (intstatus) {
5074                                 bus->pollcnt++;
5075                                 bus->ipend = TRUE;
5076                                 if (bus->intr) {
5077                                         bcmsdh_intr_disable(bus->sdh);
5078                                 }
5079                                 bus->dpc_sched = TRUE;
5080                                 dhd_sched_dpc(bus->dhd);
5081
5082                         }
5083                 }
5084
5085                 /* Update interrupt tracking */
5086                 bus->lastintrs = bus->intrcount;
5087         }
5088
5089 #ifdef DHD_DEBUG
5090         /* Poll for console output periodically */
5091         if (dhdp->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
5092                 bus->console.count += dhd_watchdog_ms;
5093                 if (bus->console.count >= dhd_console_ms) {
5094                         bus->console.count -= dhd_console_ms;
5095                         /* Make sure backplane clock is on */
5096                         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
5097                         if (dhdsdio_readconsole(bus) < 0)
5098                                 dhd_console_ms = 0;     /* On error, stop trying */
5099                 }
5100         }
5101 #endif /* DHD_DEBUG */
5102
5103 #ifdef SDTEST
5104         /* Generate packets if configured */
5105         if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
5106                 /* Make sure backplane clock is on */
5107                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
5108                 bus->pktgen_tick = 0;
5109                 dhdsdio_pktgen(bus);
5110         }
5111 #endif
5112
5113         /* On idle timeout clear activity flag and/or turn off clock */
5114         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
5115                 if (++bus->idlecount >= bus->idletime) {
5116                         bus->idlecount = 0;
5117                         if (bus->activity) {
5118                                 bus->activity = FALSE;
5119                                 dhdsdio_clkctl(bus, CLK_NONE, FALSE);
5120                         }
5121                 }
5122         }
5123
5124         return bus->ipend;
5125 }
5126
5127 #ifdef DHD_DEBUG
5128 extern int
5129 dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
5130 {
5131         dhd_bus_t *bus = dhdp->bus;
5132         uint32 addr, val;
5133         int rv;
5134         void *pkt;
5135
5136         /* Address could be zero if CONSOLE := 0 in dongle Makefile */
5137         if (bus->console_addr == 0)
5138                 return BCME_UNSUPPORTED;
5139
5140         /* Exclusive bus access */
5141         dhd_os_sdlock(bus->dhd);
5142
5143         /* Don't allow input if dongle is in reset */
5144         if (bus->dhd->dongle_reset) {
5145                 dhd_os_sdunlock(bus->dhd);
5146                 return BCME_NOTREADY;
5147         }
5148
5149         /* Request clock to allow SDIO accesses */
5150         BUS_WAKE(bus);
5151         /* No pend allowed since txpkt is called later, ht clk has to be on */
5152         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
5153
5154         /* Zero cbuf_index */
5155         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf_idx);
5156         val = htol32(0);
5157         if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
5158                 goto done;
5159
5160         /* Write message into cbuf */
5161         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf);
5162         if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
5163                 goto done;
5164
5165         /* Write length into vcons_in */
5166         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, vcons_in);
5167         val = htol32(msglen);
5168         if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
5169                 goto done;
5170
5171         /* Bump dongle by sending an empty packet on the event channel.
5172          * sdpcm_sendup (RX) checks for virtual console input.
5173          */
5174         if ((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL)
5175                 dhdsdio_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, TRUE);
5176
5177 done:
5178         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
5179                 bus->activity = FALSE;
5180                 dhdsdio_clkctl(bus, CLK_NONE, TRUE);
5181         }
5182
5183         dhd_os_sdunlock(bus->dhd);
5184
5185         return rv;
5186 }
5187 #endif /* DHD_DEBUG */
5188
5189 #ifdef DHD_DEBUG
5190 static void
5191 dhd_dump_cis(uint fn, uint8 *cis)
5192 {
5193         uint byte, tag, tdata;
5194         DHD_INFO(("Function %d CIS:\n", fn));
5195
5196         for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
5197                 if ((byte % 16) == 0)
5198                         DHD_INFO(("    "));
5199                 DHD_INFO(("%02x ", cis[byte]));
5200                 if ((byte % 16) == 15)
5201                         DHD_INFO(("\n"));
5202                 if (!tdata--) {
5203                         tag = cis[byte];
5204                         if (tag == 0xff)
5205                                 break;
5206                         else if (!tag)
5207                                 tdata = 0;
5208                         else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
5209                                 tdata = cis[byte + 1] + 1;
5210                         else
5211                                 DHD_INFO(("]"));
5212                 }
5213         }
5214         if ((byte % 16) != 15)
5215                 DHD_INFO(("\n"));
5216 }
5217 #endif /* DHD_DEBUG */
5218
5219 static bool
5220 dhdsdio_chipmatch(uint16 chipid)
5221 {
5222         if (chipid == BCM4325_CHIP_ID)
5223                 return TRUE;
5224         if (chipid == BCM4329_CHIP_ID)
5225                 return TRUE;
5226         if (chipid == BCM4315_CHIP_ID)
5227                 return TRUE;
5228         if (chipid == BCM4319_CHIP_ID)
5229                 return TRUE;
5230         if (chipid == BCM4330_CHIP_ID)
5231                 return TRUE;
5232         if (chipid == BCM43239_CHIP_ID)
5233                 return TRUE;
5234         if (chipid == BCM4336_CHIP_ID)
5235                 return TRUE;
5236         if (chipid == BCM43237_CHIP_ID)
5237                 return TRUE;
5238         if (chipid == BCM43362_CHIP_ID)
5239                 return TRUE;
5240
5241         return FALSE;
5242 }
5243
5244 static void *
5245 dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
5246         uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh, void *dev)
5247 {
5248         int ret;
5249         dhd_bus_t *bus;