net: wireless: bcmdhd: Update to Version 5.90.195.28
[linux-2.6.git] / drivers / net / wireless / bcmdhd / dhd_sdio.c
1 /*
2  * DHD Bus Module for SDIO
3  *
4  * Copyright (C) 1999-2011, Broadcom Corporation
5  * 
6  *         Unless you and Broadcom execute a separate written software license
7  * agreement governing use of this software, this software is licensed to you
8  * under the terms of the GNU General Public License version 2 (the "GPL"),
9  * available at http://www.broadcom.com/licenses/GPLv2.php, with the
10  * following added to such license:
11  * 
12  *      As a special exception, the copyright holders of this software give you
13  * permission to link this software with independent modules, and to copy and
14  * distribute the resulting executable under terms of your choice, provided that
15  * you also meet, for each linked independent module, the terms and conditions of
16  * the license of that module.  An independent module is a module which is not
17  * derived from this software.  The special exception does not apply to any
18  * modifications of the software.
19  * 
20  *      Notwithstanding the above, under no circumstances may you combine this
21  * software in any way with any other Broadcom software provided under a license
22  * other than the GPL, without Broadcom's express prior written consent.
23  *
24  * $Id: dhd_sdio.c 314732 2012-02-14 03:22:42Z $
25  */
26
27 #include <typedefs.h>
28 #include <osl.h>
29 #include <bcmsdh.h>
30
31 #ifdef BCMEMBEDIMAGE
32 #include BCMEMBEDIMAGE
33 #endif /* BCMEMBEDIMAGE */
34
35 #include <bcmdefs.h>
36 #include <bcmutils.h>
37 #include <bcmendian.h>
38 #include <bcmdevs.h>
39
40 #include <siutils.h>
41 #include <hndpmu.h>
42 #include <hndsoc.h>
43 #include <bcmsdpcm.h>
44 #if defined(DHD_DEBUG)
45 #include <hndrte_armtrap.h>
46 #include <hndrte_cons.h>
47 #endif /* defined(DHD_DEBUG) */
48 #include <sbchipc.h>
49 #include <sbhnddma.h>
50
51 #include <sdio.h>
52 #include <sbsdio.h>
53 #include <sbsdpcmdev.h>
54 #include <bcmsdpcm.h>
55 #include <bcmsdbus.h>
56
57 #include <proto/ethernet.h>
58 #include <proto/802.1d.h>
59 #include <proto/802.11.h>
60
61 #include <dngl_stats.h>
62 #include <dhd.h>
63 #include <dhd_bus.h>
64 #include <dhd_proto.h>
65 #include <dhd_dbg.h>
66 #include <dhdioctl.h>
67 #include <sdiovar.h>
68
69 #ifndef DHDSDIO_MEM_DUMP_FNAME
70 #define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
71 #endif
72
73 #define QLEN            256     /* bulk rx and tx queue lengths */
74 #define FCHI            (QLEN - 10)
75 #define FCLOW           (FCHI / 2)
76 #define PRIOMASK        7
77
78 #define TXRETRIES       2       /* # of retries for tx frames */
79
80 #define DHD_RXBOUND     50      /* Default for max rx frames in one scheduling */
81
82 #define DHD_TXBOUND     20      /* Default for max tx frames in one scheduling */
83
84 #define DHD_TXMINMAX    1       /* Max tx frames if rx still pending */
85
86 #define MEMBLOCK        2048            /* Block size used for downloading of dongle image */
87 #define MAX_NVRAMBUF_SIZE       4096    /* max nvram buf size */
88 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold biggest possible glom */
89
90 #ifndef DHD_FIRSTREAD
91 #define DHD_FIRSTREAD   32
92 #endif
93 #if !ISPOWEROF2(DHD_FIRSTREAD)
94 #error DHD_FIRSTREAD is not a power of 2!
95 #endif
96
97 /* Total length of frame header for dongle protocol */
98 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
99 #ifdef SDTEST
100 #define SDPCM_RESERVE   (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
101 #else
102 #define SDPCM_RESERVE   (SDPCM_HDRLEN + DHD_SDALIGN)
103 #endif
104
105 /* Space for header read, limit for data packets */
106 #ifndef MAX_HDR_READ
107 #define MAX_HDR_READ    32
108 #endif
109 #if !ISPOWEROF2(MAX_HDR_READ)
110 #error MAX_HDR_READ is not a power of 2!
111 #endif
112
113 #define MAX_RX_DATASZ   2048
114
115 /* Maximum milliseconds to wait for F2 to come up */
116 #define DHD_WAIT_F2RDY  3000
117
118 /* Bump up limit on waiting for HT to account for first startup;
119  * if the image is doing a CRC calculation before programming the PMU
120  * for HT availability, it could take a couple hundred ms more, so
121  * max out at a 1 second (1000000us).
122  */
123 #if (PMU_MAX_TRANSITION_DLY <= 1000000)
124 #undef PMU_MAX_TRANSITION_DLY
125 #define PMU_MAX_TRANSITION_DLY 1000000
126 #endif
127
128 /* Value for ChipClockCSR during initial setup */
129 #define DHD_INIT_CLKCTL1        (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
130 #define DHD_INIT_CLKCTL2        (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
131
132 /* Flags for SDH calls */
133 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
134
135 /* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
136  * bufpool was present for gspi bus.
137  */
138 #define PKTFREE2()              if ((bus->bus != SPI_BUS) || bus->usebufpool) \
139                                         PKTFREE(bus->dhd->osh, pkt, FALSE);
140 DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
141 #if defined(OOB_INTR_ONLY)
142 extern void bcmsdh_set_irq(int flag);
143 #endif /* defined(OOB_INTR_ONLY) */
144 #ifdef PROP_TXSTATUS
145 extern void dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success);
146 #endif
147
148 #ifdef DHD_DEBUG
149 /* Device console log buffer state */
150 #define CONSOLE_LINE_MAX        192
151 #define CONSOLE_BUFFER_MAX      2024
152 typedef struct dhd_console {
153         uint            count;                  /* Poll interval msec counter */
154         uint            log_addr;               /* Log struct address (fixed) */
155         hndrte_log_t    log;                    /* Log struct (host copy) */
156         uint            bufsize;                /* Size of log buffer */
157         uint8           *buf;                   /* Log buffer (host copy) */
158         uint            last;                   /* Last buffer read index */
159 } dhd_console_t;
160 #endif /* DHD_DEBUG */
161
162 /* Private data for SDIO bus interaction */
163 typedef struct dhd_bus {
164         dhd_pub_t       *dhd;
165
166         bcmsdh_info_t   *sdh;                   /* Handle for BCMSDH calls */
167         si_t            *sih;                   /* Handle for SI calls */
168         char            *vars;                  /* Variables (from CIS and/or other) */
169         uint            varsz;                  /* Size of variables buffer */
170         uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
171
172         sdpcmd_regs_t   *regs;                  /* Registers for SDIO core */
173         uint            sdpcmrev;               /* SDIO core revision */
174         uint            armrev;                 /* CPU core revision */
175         uint            ramrev;                 /* SOCRAM core revision */
176         uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
177         uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
178
179         uint32          bus;                    /* gSPI or SDIO bus */
180         uint32          hostintmask;            /* Copy of Host Interrupt Mask */
181         uint32          intstatus;              /* Intstatus bits (events) pending */
182         bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
183         bool            fcstate;                /* State of dongle flow-control */
184
185         uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
186         char            *fw_path; /* module_param: path to firmware image */
187         char            *nv_path; /* module_param: path to nvram vars file */
188         const char      *nvram_params;          /* user specified nvram params. */
189
190         uint            blocksize;              /* Block size of SDIO transfers */
191         uint            roundup;                /* Max roundup limit */
192
193         struct pktq     txq;                    /* Queue length used for flow-control */
194         uint8           flowcontrol;            /* per prio flow control bitmask */
195         uint8           tx_seq;                 /* Transmit sequence number (next) */
196         uint8           tx_max;                 /* Maximum transmit sequence allowed */
197
198         uint8           hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
199         uint8           *rxhdr;                 /* Header of current rx frame (in hdrbuf) */
200         uint16          nextlen;                /* Next Read Len from last header */
201         uint8           rx_seq;                 /* Receive sequence number (expected) */
202         bool            rxskip;                 /* Skip receive (awaiting NAK ACK) */
203
204         void            *glomd;                 /* Packet containing glomming descriptor */
205         void            *glom;                  /* Packet chain for glommed superframe */
206         uint            glomerr;                /* Glom packet read errors */
207
208         uint8           *rxbuf;                 /* Buffer for receiving control packets */
209         uint            rxblen;                 /* Allocated length of rxbuf */
210         uint8           *rxctl;                 /* Aligned pointer into rxbuf */
211         uint8           *databuf;               /* Buffer for receiving big glom packet */
212         uint8           *dataptr;               /* Aligned pointer into databuf */
213         uint            rxlen;                  /* Length of valid data in buffer */
214
215         uint8           sdpcm_ver;              /* Bus protocol reported by dongle */
216
217         bool            intr;                   /* Use interrupts */
218         bool            poll;                   /* Use polling */
219         bool            ipend;                  /* Device interrupt is pending */
220         bool            intdis;                 /* Interrupts disabled by isr */
221         uint            intrcount;              /* Count of device interrupt callbacks */
222         uint            lastintrs;              /* Count as of last watchdog timer */
223         uint            spurious;               /* Count of spurious interrupts */
224         uint            pollrate;               /* Ticks between device polls */
225         uint            polltick;               /* Tick counter */
226         uint            pollcnt;                /* Count of active polls */
227
228 #ifdef DHD_DEBUG
229         dhd_console_t   console;                /* Console output polling support */
230         uint            console_addr;           /* Console address from shared struct */
231 #endif /* DHD_DEBUG */
232
233         uint            regfails;               /* Count of R_REG/W_REG failures */
234
235         uint            clkstate;               /* State of sd and backplane clock(s) */
236         bool            activity;               /* Activity flag for clock down */
237         int32           idletime;               /* Control for activity timeout */
238         int32           idlecount;              /* Activity timeout counter */
239         int32           idleclock;              /* How to set bus driver when idle */
240         int32           sd_divisor;             /* Speed control to bus driver */
241         int32           sd_mode;                /* Mode control to bus driver */
242         int32           sd_rxchain;             /* If bcmsdh api accepts PKT chains */
243         bool            use_rxchain;            /* If dhd should use PKT chains */
244         bool            sleeping;               /* Is SDIO bus sleeping? */
245         bool            rxflow_mode;    /* Rx flow control mode */
246         bool            rxflow;                 /* Is rx flow control on */
247         uint            prev_rxlim_hit;         /* Is prev rx limit exceeded (per dpc schedule) */
248         bool            alp_only;               /* Don't use HT clock (ALP only) */
249         /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
250         bool            usebufpool;
251
252 #ifdef SDTEST
253         /* external loopback */
254         bool            ext_loop;
255         uint8           loopid;
256
257         /* pktgen configuration */
258         uint            pktgen_freq;            /* Ticks between bursts */
259         uint            pktgen_count;           /* Packets to send each burst */
260         uint            pktgen_print;           /* Bursts between count displays */
261         uint            pktgen_total;           /* Stop after this many */
262         uint            pktgen_minlen;          /* Minimum packet data len */
263         uint            pktgen_maxlen;          /* Maximum packet data len */
264         uint            pktgen_mode;            /* Configured mode: tx, rx, or echo */
265         uint            pktgen_stop;            /* Number of tx failures causing stop */
266
267         /* active pktgen fields */
268         uint            pktgen_tick;            /* Tick counter for bursts */
269         uint            pktgen_ptick;           /* Burst counter for printing */
270         uint            pktgen_sent;            /* Number of test packets generated */
271         uint            pktgen_rcvd;            /* Number of test packets received */
272         uint            pktgen_fail;            /* Number of failed send attempts */
273         uint16          pktgen_len;             /* Length of next packet to send */
274 #define PKTGEN_RCV_IDLE     (0)
275 #define PKTGEN_RCV_ONGOING  (1)
276         uint16          pktgen_rcv_state;               /* receive state */
277         uint            pktgen_rcvd_rcvsession; /* test pkts rcvd per rcv session. */
278 #endif /* SDTEST */
279
280         /* Some additional counters */
281         uint            tx_sderrs;              /* Count of tx attempts with sd errors */
282         uint            fcqueued;               /* Tx packets that got queued */
283         uint            rxrtx;                  /* Count of rtx requests (NAK to dongle) */
284         uint            rx_toolong;             /* Receive frames too long to receive */
285         uint            rxc_errors;             /* SDIO errors when reading control frames */
286         uint            rx_hdrfail;             /* SDIO errors on header reads */
287         uint            rx_badhdr;              /* Bad received headers (roosync?) */
288         uint            rx_badseq;              /* Mismatched rx sequence number */
289         uint            fc_rcvd;                /* Number of flow-control events received */
290         uint            fc_xoff;                /* Number which turned on flow-control */
291         uint            fc_xon;                 /* Number which turned off flow-control */
292         uint            rxglomfail;             /* Failed deglom attempts */
293         uint            rxglomframes;           /* Number of glom frames (superframes) */
294         uint            rxglompkts;             /* Number of packets from glom frames */
295         uint            f2rxhdrs;               /* Number of header reads */
296         uint            f2rxdata;               /* Number of frame data reads */
297         uint            f2txdata;               /* Number of f2 frame writes */
298         uint            f1regdata;              /* Number of f1 register accesses */
299
300         uint8           *ctrl_frame_buf;
301         uint32          ctrl_frame_len;
302         bool            ctrl_frame_stat;
303         uint32          rxint_mode;     /* rx interrupt mode */
304 } dhd_bus_t;
305
306 /* clkstate */
307 #define CLK_NONE        0
308 #define CLK_SDONLY      1
309 #define CLK_PENDING     2       /* Not used yet */
310 #define CLK_AVAIL       3
311
312 #define DHD_NOPMU(dhd)  (FALSE)
313
314 #ifdef DHD_DEBUG
315 static int qcount[NUMPRIO];
316 static int tx_packets[NUMPRIO];
317 #endif /* DHD_DEBUG */
318
319 /* Deferred transmit */
320 const uint dhd_deferred_tx = 1;
321
322 extern uint dhd_watchdog_ms;
323 extern void dhd_os_wd_timer(void *bus, uint wdtick);
324
325 /* Tx/Rx bounds */
326 uint dhd_txbound;
327 uint dhd_rxbound;
328 uint dhd_txminmax = DHD_TXMINMAX;
329
330 /* override the RAM size if possible */
331 #define DONGLE_MIN_MEMSIZE (128 *1024)
332 int dhd_dongle_memsize;
333
334 static bool dhd_doflow;
335 static bool dhd_alignctl;
336
337 static bool sd1idle;
338
339 static bool retrydata;
340 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
341
342 static const uint watermark = 8;
343 static const uint firstread = DHD_FIRSTREAD;
344
345 #define HDATLEN (firstread - (SDPCM_HDRLEN))
346
347 /* Retry count for register access failures */
348 static const uint retry_limit = 2;
349
350 /* Force even SD lengths (some host controllers mess up on odd bytes) */
351 static bool forcealign;
352
353 /* Flag to indicate if we should download firmware on driver load */
354 uint dhd_download_fw_on_driverload = TRUE;
355
356 #define ALIGNMENT  4
357
358 #if defined(OOB_INTR_ONLY) && defined(HW_OOB)
359 extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
360 #endif
361
362 #if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
363 #error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
364 #endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
365 #define PKTALIGN(osh, p, len, align)                                    \
366         do {                                                            \
367                 uint datalign;                                          \
368                 datalign = (uintptr)PKTDATA((osh), (p));                \
369                 datalign = ROUNDUP(datalign, (align)) - datalign;       \
370                 ASSERT(datalign < (align));                             \
371                 ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));       \
372                 if (datalign)                                           \
373                         PKTPULL((osh), (p), datalign);                  \
374                 PKTSETLEN((osh), (p), (len));                           \
375         } while (0)
376
377 /* Limit on rounding up frames */
378 static const uint max_roundup = 512;
379
380 /* Try doing readahead */
381 static bool dhd_readahead;
382
383 /* To check if there's window offered */
384 #define DATAOK(bus) \
385         (((uint8)(bus->tx_max - bus->tx_seq) > 1) && \
386         (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
387
388 /* To check if there's window offered for ctrl frame */
389 #define TXCTLOK(bus) \
390         (((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
391         (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
392
393 /* Macros to get register read/write status */
394 /* NOTE: these assume a local dhdsdio_bus_t *bus! */
395 #define R_SDREG(regvar, regaddr, retryvar) \
396 do { \
397         retryvar = 0; \
398         do { \
399                 regvar = R_REG(bus->dhd->osh, regaddr); \
400         } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
401         if (retryvar) { \
402                 bus->regfails += (retryvar-1); \
403                 if (retryvar > retry_limit) { \
404                         DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
405                                    __FUNCTION__, __LINE__)); \
406                         regvar = 0; \
407                 } \
408         } \
409 } while (0)
410
411 #define W_SDREG(regval, regaddr, retryvar) \
412 do { \
413         retryvar = 0; \
414         do { \
415                 W_REG(bus->dhd->osh, regaddr, regval); \
416         } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
417         if (retryvar) { \
418                 bus->regfails += (retryvar-1); \
419                 if (retryvar > retry_limit) \
420                         DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
421                                    __FUNCTION__, __LINE__)); \
422         } \
423 } while (0)
424
425 #define BUS_WAKE(bus) \
426         do { \
427                 if ((bus)->sleeping) \
428                         dhdsdio_bussleep((bus), FALSE); \
429         } while (0);
430
431 /*
432  * pktavail interrupts from dongle to host can be managed in 3 different ways
433  * whenever there is a packet available in dongle to transmit to host.
434  *
435  * Mode 0:      Dongle writes the software host mailbox and host is interrupted.
436  * Mode 1:      (sdiod core rev >= 4)
437  *              Device sets a new bit in the intstatus whenever there is a packet
438  *              available in fifo.  Host can't clear this specific status bit until all the
439  *              packets are read from the FIFO.  No need to ack dongle intstatus.
440  * Mode 2:      (sdiod core rev >= 4)
441  *              Device sets a bit in the intstatus, and host acks this by writing
442  *              one to this bit.  Dongle won't generate anymore packet interrupts
443  *              until host reads all the packets from the dongle and reads a zero to
444  *              figure that there are no more packets.  No need to disable host ints.
445  *              Need to ack the intstatus.
446  */
447
448 #define SDIO_DEVICE_HMB_RXINT           0       /* default old way */
449 #define SDIO_DEVICE_RXDATAINT_MODE_0    1       /* from sdiod rev 4 */
450 #define SDIO_DEVICE_RXDATAINT_MODE_1    2       /* from sdiod rev 4 */
451
452
453 #define FRAME_AVAIL_MASK(bus)   \
454         ((bus->rxint_mode == SDIO_DEVICE_HMB_RXINT) ? I_HMB_FRAME_IND : I_XMTDATA_AVAIL)
455
456 #define DHD_BUS                 SDIO_BUS
457
458 #define PKT_AVAILABLE(bus, intstatus)   ((intstatus) & (FRAME_AVAIL_MASK(bus)))
459
460 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
461
462 #define GSPI_PR55150_BAILOUT
463
464
465 #ifdef SDTEST
466 static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
467 static void dhdsdio_sdtest_set(dhd_bus_t *bus, uint8 count);
468 #endif
469
470 #ifdef DHD_DEBUG
471 static int dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size);
472 static int dhd_serialconsole(dhd_bus_t *bus, bool get, bool enable, int *bcmerror);
473 #endif /* DHD_DEBUG */
474
475 static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
476
477 static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
478 static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
479 static void dhdsdio_disconnect(void *ptr);
480 static bool dhdsdio_chipmatch(uint16 chipid);
481 static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
482                                  void * regsva, uint16  devid);
483 static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
484 static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
485 static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation,
486         bool reset_flag);
487
488 static void dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size);
489 static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
490         uint8 *buf, uint nbytes,
491         void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
492 static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
493         uint8 *buf, uint nbytes,
494         void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
495
496 static bool dhdsdio_download_firmware(dhd_bus_t *bus, osl_t *osh, void *sdh);
497 static int _dhdsdio_download_firmware(dhd_bus_t *bus);
498
499 static int dhdsdio_download_code_file(dhd_bus_t *bus, char *image_path);
500 static int dhdsdio_download_nvram(dhd_bus_t *bus);
501 #ifdef BCMEMBEDIMAGE
502 static int dhdsdio_download_code_array(dhd_bus_t *bus);
503 #endif
504
505 #ifdef WLMEDIA_HTSF
506 #include <htsf.h>
507 extern uint32 dhd_get_htsf(void *dhd, int ifidx);
508 #endif /* WLMEDIA_HTSF */
509
510 static void
511 dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
512 {
513         int32 min_size =  DONGLE_MIN_MEMSIZE;
514         /* Restrict the memsize to user specified limit */
515         DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
516                 dhd_dongle_memsize, min_size));
517         if ((dhd_dongle_memsize > min_size) &&
518                 (dhd_dongle_memsize < (int32)bus->orig_ramsize))
519                 bus->ramsize = dhd_dongle_memsize;
520 }
521
522 static int
523 dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
524 {
525         int err = 0;
526         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
527                          (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
528         if (!err)
529                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
530                                  (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
531         if (!err)
532                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
533                                  (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
534         return err;
535 }
536
537
538 /* Turn backplane clock on or off */
539 static int
540 dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
541 {
542         int err;
543         uint8 clkctl, clkreq, devctl;
544         bcmsdh_info_t *sdh;
545
546         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
547
548 #if defined(OOB_INTR_ONLY)
549         pendok = FALSE;
550 #endif
551         clkctl = 0;
552         sdh = bus->sdh;
553
554
555         if (on) {
556                 /* Request HT Avail */
557                 clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
558
559
560
561
562                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
563                 if (err) {
564                         DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
565                         return BCME_ERROR;
566                 }
567
568                 if (pendok &&
569                     ((bus->sih->buscoretype == PCMCIA_CORE_ID) && (bus->sih->buscorerev == 9))) {
570                         uint32 dummy, retries;
571                         R_SDREG(dummy, &bus->regs->clockctlstatus, retries);
572                 }
573
574                 /* Check current status */
575                 clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
576                 if (err) {
577                         DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
578                         return BCME_ERROR;
579                 }
580
581                 /* Go to pending and await interrupt if appropriate */
582                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
583                         /* Allow only clock-available interrupt */
584                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
585                         if (err) {
586                                 DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
587                                            __FUNCTION__, err));
588                                 return BCME_ERROR;
589                         }
590
591                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
592                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
593                         DHD_INFO(("CLKCTL: set PENDING\n"));
594                         bus->clkstate = CLK_PENDING;
595                         return BCME_OK;
596                 } else if (bus->clkstate == CLK_PENDING) {
597                         /* Cancel CA-only interrupt filter */
598                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
599                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
600                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
601                 }
602
603                 /* Otherwise, wait here (polling) for HT Avail */
604                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
605                         SPINWAIT_SLEEP(sdioh_spinwait_sleep,
606                                 ((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
607                                                             SBSDIO_FUNC1_CHIPCLKCSR, &err)),
608                                   !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
609                 }
610                 if (err) {
611                         DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
612                         return BCME_ERROR;
613                 }
614                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
615                         DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
616                                    __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
617                         return BCME_ERROR;
618                 }
619
620
621                 /* Mark clock available */
622                 bus->clkstate = CLK_AVAIL;
623                 DHD_INFO(("CLKCTL: turned ON\n"));
624
625 #if defined(DHD_DEBUG)
626                 if (bus->alp_only == TRUE) {
627 #if !defined(BCMLXSDMMC)
628                         if (!SBSDIO_ALPONLY(clkctl)) {
629                                 DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
630                         }
631 #endif /* !defined(BCMLXSDMMC) */
632                 } else {
633                         if (SBSDIO_ALPONLY(clkctl)) {
634                                 DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
635                         }
636                 }
637 #endif /* defined (DHD_DEBUG) */
638
639                 bus->activity = TRUE;
640         } else {
641                 clkreq = 0;
642
643                 if (bus->clkstate == CLK_PENDING) {
644                         /* Cancel CA-only interrupt filter */
645                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
646                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
647                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
648                 }
649
650                 bus->clkstate = CLK_SDONLY;
651                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
652                 DHD_INFO(("CLKCTL: turned OFF\n"));
653                 if (err) {
654                         DHD_ERROR(("%s: Failed access turning clock off: %d\n",
655                                    __FUNCTION__, err));
656                         return BCME_ERROR;
657                 }
658         }
659         return BCME_OK;
660 }
661
662 /* Change idle/active SD state */
663 static int
664 dhdsdio_sdclk(dhd_bus_t *bus, bool on)
665 {
666         int err;
667         int32 iovalue;
668
669         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
670
671         if (on) {
672                 if (bus->idleclock == DHD_IDLE_STOP) {
673                         /* Turn on clock and restore mode */
674                         iovalue = 1;
675                         err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
676                                               &iovalue, sizeof(iovalue), TRUE);
677                         if (err) {
678                                 DHD_ERROR(("%s: error enabling sd_clock: %d\n",
679                                            __FUNCTION__, err));
680                                 return BCME_ERROR;
681                         }
682
683                         iovalue = bus->sd_mode;
684                         err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
685                                               &iovalue, sizeof(iovalue), TRUE);
686                         if (err) {
687                                 DHD_ERROR(("%s: error changing sd_mode: %d\n",
688                                            __FUNCTION__, err));
689                                 return BCME_ERROR;
690                         }
691                 } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
692                         /* Restore clock speed */
693                         iovalue = bus->sd_divisor;
694                         err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
695                                               &iovalue, sizeof(iovalue), TRUE);
696                         if (err) {
697                                 DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
698                                            __FUNCTION__, err));
699                                 return BCME_ERROR;
700                         }
701                 }
702                 bus->clkstate = CLK_SDONLY;
703         } else {
704                 /* Stop or slow the SD clock itself */
705                 if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
706                         DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
707                                    __FUNCTION__, bus->sd_divisor, bus->sd_mode));
708                         return BCME_ERROR;
709                 }
710                 if (bus->idleclock == DHD_IDLE_STOP) {
711                         if (sd1idle) {
712                                 /* Change to SD1 mode and turn off clock */
713                                 iovalue = 1;
714                                 err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
715                                                       &iovalue, sizeof(iovalue), TRUE);
716                                 if (err) {
717                                         DHD_ERROR(("%s: error changing sd_clock: %d\n",
718                                                    __FUNCTION__, err));
719                                         return BCME_ERROR;
720                                 }
721                         }
722
723                         iovalue = 0;
724                         err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
725                                               &iovalue, sizeof(iovalue), TRUE);
726                         if (err) {
727                                 DHD_ERROR(("%s: error disabling sd_clock: %d\n",
728                                            __FUNCTION__, err));
729                                 return BCME_ERROR;
730                         }
731                 } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
732                         /* Set divisor to idle value */
733                         iovalue = bus->idleclock;
734                         err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
735                                               &iovalue, sizeof(iovalue), TRUE);
736                         if (err) {
737                                 DHD_ERROR(("%s: error changing sd_divisor: %d\n",
738                                            __FUNCTION__, err));
739                                 return BCME_ERROR;
740                         }
741                 }
742                 bus->clkstate = CLK_NONE;
743         }
744
745         return BCME_OK;
746 }
747
748 /* Transition SD and backplane clock readiness */
749 static int
750 dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
751 {
752         int ret = BCME_OK;
753 #ifdef DHD_DEBUG
754         uint oldstate = bus->clkstate;
755 #endif /* DHD_DEBUG */
756
757         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
758
759         /* Early exit if we're already there */
760         if (bus->clkstate == target) {
761                 if (target == CLK_AVAIL) {
762                         dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
763                         bus->activity = TRUE;
764                 }
765                 return ret;
766         }
767
768         switch (target) {
769         case CLK_AVAIL:
770                 /* Make sure SD clock is available */
771                 if (bus->clkstate == CLK_NONE)
772                         dhdsdio_sdclk(bus, TRUE);
773                 /* Now request HT Avail on the backplane */
774                 ret = dhdsdio_htclk(bus, TRUE, pendok);
775                 if (ret == BCME_OK) {
776                         dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
777                         bus->activity = TRUE;
778                 }
779                 break;
780
781         case CLK_SDONLY:
782                 /* Remove HT request, or bring up SD clock */
783                 if (bus->clkstate == CLK_NONE)
784                         ret = dhdsdio_sdclk(bus, TRUE);
785                 else if (bus->clkstate == CLK_AVAIL)
786                         ret = dhdsdio_htclk(bus, FALSE, FALSE);
787                 else
788                         DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
789                                    bus->clkstate, target));
790                 if (ret == BCME_OK) {
791                         dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
792                 }
793                 break;
794
795         case CLK_NONE:
796                 /* Make sure to remove HT request */
797                 if (bus->clkstate == CLK_AVAIL)
798                         ret = dhdsdio_htclk(bus, FALSE, FALSE);
799                 /* Now remove the SD clock */
800                 ret = dhdsdio_sdclk(bus, FALSE);
801 #ifdef DHD_DEBUG
802                 if (dhd_console_ms == 0)
803 #endif /* DHD_DEBUG */
804                 dhd_os_wd_timer(bus->dhd, 0);
805                 break;
806         }
807 #ifdef DHD_DEBUG
808         DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
809 #endif /* DHD_DEBUG */
810
811         return ret;
812 }
813
814 static int
815 dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
816 {
817         bcmsdh_info_t *sdh = bus->sdh;
818         sdpcmd_regs_t *regs = bus->regs;
819         uint retries = 0;
820
821         DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
822                   (sleep ? "SLEEP" : "WAKE"),
823                   (bus->sleeping ? "SLEEP" : "WAKE")));
824
825         /* Done if we're already in the requested state */
826         if (sleep == bus->sleeping)
827                 return BCME_OK;
828
829         /* Going to sleep: set the alarm and turn off the lights... */
830         if (sleep) {
831                 /* Don't sleep if something is pending */
832                 if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
833                         return BCME_BUSY;
834
835
836                 /* Disable SDIO interrupts (no longer interested) */
837                 bcmsdh_intr_disable(bus->sdh);
838
839                 /* Make sure the controller has the bus up */
840                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
841
842                 /* Tell device to start using OOB wakeup */
843                 W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
844                 if (retries > retry_limit)
845                         DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
846
847                 /* Turn off our contribution to the HT clock request */
848                 dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
849
850                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
851                                  SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
852
853                 /* Isolate the bus */
854                 if (bus->sih->chip != BCM4329_CHIP_ID && bus->sih->chip != BCM4319_CHIP_ID) {
855                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
856                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
857                 }
858
859                 /* Change state */
860                 bus->sleeping = TRUE;
861
862         } else {
863                 /* Waking up: bus power up is ok, set local state */
864
865                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
866                                  0, NULL);
867
868                 /* Force pad isolation off if possible (in case power never toggled) */
869                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
870
871
872                 /* Make sure the controller has the bus up */
873                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
874
875                 /* Send misc interrupt to indicate OOB not needed */
876                 W_SDREG(0, &regs->tosbmailboxdata, retries);
877                 if (retries <= retry_limit)
878                         W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
879
880                 if (retries > retry_limit)
881                         DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
882
883                 /* Make sure we have SD bus access */
884                 dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
885
886                 /* Change state */
887                 bus->sleeping = FALSE;
888
889                 /* Enable interrupts again */
890                 if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
891                         bus->intdis = FALSE;
892                         bcmsdh_intr_enable(bus->sdh);
893                 }
894         }
895
896         return BCME_OK;
897 }
898
899 #if defined(OOB_INTR_ONLY)
900 void
901 dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
902 {
903 #if defined(HW_OOB)
904         bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
905 #else
906         sdpcmd_regs_t *regs = bus->regs;
907         uint retries = 0;
908
909         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
910         if (enable == TRUE) {
911
912                 /* Tell device to start using OOB wakeup */
913                 W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
914                 if (retries > retry_limit)
915                         DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
916
917         } else {
918                 /* Send misc interrupt to indicate OOB not needed */
919                 W_SDREG(0, &regs->tosbmailboxdata, retries);
920                 if (retries <= retry_limit)
921                         W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
922         }
923
924         /* Turn off our contribution to the HT clock request */
925         dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
926 #endif /* !defined(HW_OOB) */
927 }
928 #endif /* defined(OOB_INTR_ONLY) */
929
930 /* Writes a HW/SW header into the packet and sends it. */
931 /* Assumes: (a) header space already there, (b) caller holds lock */
932 static int
933 dhdsdio_txpkt(dhd_bus_t *bus, void *pkt, uint chan, bool free_pkt)
934 {
935         int ret;
936         osl_t *osh;
937         uint8 *frame;
938         uint16 len, pad1 = 0;
939         uint32 swheader;
940         uint retries = 0;
941         bcmsdh_info_t *sdh;
942         void *new;
943         int i;
944 #ifdef WLMEDIA_HTSF
945         char *p;
946         htsfts_t *htsf_ts;
947 #endif
948
949
950         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
951
952         sdh = bus->sdh;
953         osh = bus->dhd->osh;
954
955         if (bus->dhd->dongle_reset) {
956                 ret = BCME_NOTREADY;
957                 goto done;
958         }
959
960         frame = (uint8*)PKTDATA(osh, pkt);
961
962 #ifdef WLMEDIA_HTSF
963         if (PKTLEN(osh, pkt) >= 100) {
964                 p = PKTDATA(osh, pkt);
965                 htsf_ts = (htsfts_t*) (p + HTSF_HOSTOFFSET + 12);
966                 if (htsf_ts->magic == HTSFMAGIC) {
967                         htsf_ts->c20 = get_cycles();
968                         htsf_ts->t20 = dhd_get_htsf(bus->dhd->info, 0);
969                 }
970         }
971 #endif /* WLMEDIA_HTSF */
972
973         /* Add alignment padding, allocate new packet if needed */
974         if ((pad1 = ((uintptr)frame % DHD_SDALIGN))) {
975                 if (PKTHEADROOM(osh, pkt) < pad1) {
976                         DHD_INFO(("%s: insufficient headroom %d for %d pad1\n",
977                                   __FUNCTION__, (int)PKTHEADROOM(osh, pkt), pad1));
978                         bus->dhd->tx_realloc++;
979                         new = PKTGET(osh, (PKTLEN(osh, pkt) + DHD_SDALIGN), TRUE);
980                         if (!new) {
981                                 DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
982                                            __FUNCTION__, PKTLEN(osh, pkt) + DHD_SDALIGN));
983                                 ret = BCME_NOMEM;
984                                 goto done;
985                         }
986
987                         PKTALIGN(osh, new, PKTLEN(osh, pkt), DHD_SDALIGN);
988                         bcopy(PKTDATA(osh, pkt), PKTDATA(osh, new), PKTLEN(osh, pkt));
989                         if (free_pkt)
990                                 PKTFREE(osh, pkt, TRUE);
991                         /* free the pkt if canned one is not used */
992                         free_pkt = TRUE;
993                         pkt = new;
994                         frame = (uint8*)PKTDATA(osh, pkt);
995                         ASSERT(((uintptr)frame % DHD_SDALIGN) == 0);
996                         pad1 = 0;
997                 } else {
998                         PKTPUSH(osh, pkt, pad1);
999                         frame = (uint8*)PKTDATA(osh, pkt);
1000
1001                         ASSERT((pad1 + SDPCM_HDRLEN) <= (int) PKTLEN(osh, pkt));
1002                         bzero(frame, pad1 + SDPCM_HDRLEN);
1003                 }
1004         }
1005         ASSERT(pad1 < DHD_SDALIGN);
1006
1007         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1008         len = (uint16)PKTLEN(osh, pkt);
1009         *(uint16*)frame = htol16(len);
1010         *(((uint16*)frame) + 1) = htol16(~len);
1011
1012         /* Software tag: channel, sequence number, data offset */
1013         swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1014                 (((pad1 + SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1015         htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
1016         htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1017
1018 #ifdef DHD_DEBUG
1019         if (PKTPRIO(pkt) < ARRAYSIZE(tx_packets)) {
1020                 tx_packets[PKTPRIO(pkt)]++;
1021         }
1022         if (DHD_BYTES_ON() &&
1023             (((DHD_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
1024               (DHD_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
1025                 prhex("Tx Frame", frame, len);
1026         } else if (DHD_HDRS_ON()) {
1027                 prhex("TxHdr", frame, MIN(len, 16));
1028         }
1029 #endif
1030
1031         /* Raise len to next SDIO block to eliminate tail command */
1032         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1033                 uint16 pad2 = bus->blocksize - (len % bus->blocksize);
1034                 if ((pad2 <= bus->roundup) && (pad2 < bus->blocksize))
1035 #ifdef NOTUSED
1036                         if (pad2 <= PKTTAILROOM(osh, pkt))
1037 #endif /* NOTUSED */
1038                                 len += pad2;
1039         } else if (len % DHD_SDALIGN) {
1040                 len += DHD_SDALIGN - (len % DHD_SDALIGN);
1041         }
1042
1043         /* Some controllers have trouble with odd bytes -- round to even */
1044         if (forcealign && (len & (ALIGNMENT - 1))) {
1045 #ifdef NOTUSED
1046                 if (PKTTAILROOM(osh, pkt))
1047 #endif
1048                         len = ROUNDUP(len, ALIGNMENT);
1049 #ifdef NOTUSED
1050                 else
1051                         DHD_ERROR(("%s: sending unrounded %d-byte packet\n", __FUNCTION__, len));
1052 #endif
1053         }
1054
1055         do {
1056                 ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
1057                                           frame, len, pkt, NULL, NULL);
1058                 bus->f2txdata++;
1059                 ASSERT(ret != BCME_PENDING);
1060
1061                 if (ret < 0) {
1062                         /* On failure, abort the command and terminate the frame */
1063                         DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
1064                                   __FUNCTION__, ret));
1065                         bus->tx_sderrs++;
1066
1067                         bcmsdh_abort(sdh, SDIO_FUNC_2);
1068                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
1069                                          SFC_WF_TERM, NULL);
1070                         bus->f1regdata++;
1071
1072                         for (i = 0; i < 3; i++) {
1073                                 uint8 hi, lo;
1074                                 hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1075                                                      SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1076                                 lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1077                                                      SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1078                                 bus->f1regdata += 2;
1079                                 if ((hi == 0) && (lo == 0))
1080                                         break;
1081                         }
1082
1083                 }
1084                 if (ret == 0) {
1085                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1086                 }
1087         } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
1088
1089 done:
1090         /* restore pkt buffer pointer before calling tx complete routine */
1091         PKTPULL(osh, pkt, SDPCM_HDRLEN + pad1);
1092 #ifdef PROP_TXSTATUS
1093         if (bus->dhd->wlfc_state) {
1094                 dhd_os_sdunlock(bus->dhd);
1095                 dhd_wlfc_txcomplete(bus->dhd, pkt, ret == 0);
1096                 dhd_os_sdlock(bus->dhd);
1097         } else {
1098 #endif /* PROP_TXSTATUS */
1099         dhd_txcomplete(bus->dhd, pkt, ret != 0);
1100         if (free_pkt)
1101                 PKTFREE(osh, pkt, TRUE);
1102
1103 #ifdef PROP_TXSTATUS
1104         }
1105 #endif
1106         return ret;
1107 }
1108
1109 int
1110 dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
1111 {
1112         int ret = BCME_ERROR;
1113         osl_t *osh;
1114         uint datalen, prec;
1115
1116         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1117
1118         osh = bus->dhd->osh;
1119         datalen = PKTLEN(osh, pkt);
1120
1121 #ifdef SDTEST
1122         /* Push the test header if doing loopback */
1123         if (bus->ext_loop) {
1124                 uint8* data;
1125                 PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
1126                 data = PKTDATA(osh, pkt);
1127                 *data++ = SDPCM_TEST_ECHOREQ;
1128                 *data++ = (uint8)bus->loopid++;
1129                 *data++ = (datalen >> 0);
1130                 *data++ = (datalen >> 8);
1131                 datalen += SDPCM_TEST_HDRLEN;
1132         }
1133 #endif /* SDTEST */
1134
1135         /* Add space for the header */
1136         PKTPUSH(osh, pkt, SDPCM_HDRLEN);
1137         ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
1138
1139         prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
1140 #ifndef DHDTHREAD
1141         /* Lock: we're about to use shared data/code (and SDIO) */
1142         dhd_os_sdlock(bus->dhd);
1143 #endif /* DHDTHREAD */
1144
1145         /* Check for existing queue, current flow-control, pending event, or pending clock */
1146         if (dhd_deferred_tx || bus->fcstate || pktq_len(&bus->txq) || bus->dpc_sched ||
1147             (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
1148             (bus->clkstate != CLK_AVAIL)) {
1149                 DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__,
1150                         pktq_len(&bus->txq)));
1151                 bus->fcqueued++;
1152
1153                 /* Priority based enq */
1154                 dhd_os_sdlock_txq(bus->dhd);
1155                 if (dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec) == FALSE) {
1156                         PKTPULL(osh, pkt, SDPCM_HDRLEN);
1157 #ifndef DHDTHREAD
1158                         /* Need to also release txqlock before releasing sdlock.
1159                          * This thread still has txqlock and releases sdlock.
1160                          * Deadlock happens when dpc() grabs sdlock first then
1161                          * attempts to grab txqlock.
1162                          */
1163                         dhd_os_sdunlock_txq(bus->dhd);
1164                         dhd_os_sdunlock(bus->dhd);
1165 #endif
1166 #ifdef PROP_TXSTATUS
1167                         if (bus->dhd->wlfc_state)
1168                                 dhd_wlfc_txcomplete(bus->dhd, pkt, FALSE);
1169                         else
1170 #endif
1171                         dhd_txcomplete(bus->dhd, pkt, FALSE);
1172 #ifndef DHDTHREAD
1173                         dhd_os_sdlock(bus->dhd);
1174                         dhd_os_sdlock_txq(bus->dhd);
1175 #endif
1176 #ifdef PROP_TXSTATUS
1177                         /* let the caller decide whether to free the packet */
1178                 if (!bus->dhd->wlfc_state)
1179 #endif
1180                         PKTFREE(osh, pkt, TRUE);
1181                         ret = BCME_NORESOURCE;
1182                 }
1183                 else
1184                         ret = BCME_OK;
1185                 dhd_os_sdunlock_txq(bus->dhd);
1186
1187                 if ((pktq_len(&bus->txq) >= FCHI) && dhd_doflow)
1188                         dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
1189
1190 #ifdef DHD_DEBUG
1191                 if (pktq_plen(&bus->txq, prec) > qcount[prec])
1192                         qcount[prec] = pktq_plen(&bus->txq, prec);
1193 #endif
1194                 /* Schedule DPC if needed to send queued packet(s) */
1195                 if (dhd_deferred_tx && !bus->dpc_sched) {
1196                         bus->dpc_sched = TRUE;
1197                         dhd_sched_dpc(bus->dhd);
1198                 }
1199         } else {
1200 #ifdef DHDTHREAD
1201                 /* Lock: we're about to use shared data/code (and SDIO) */
1202                 dhd_os_sdlock(bus->dhd);
1203 #endif /* DHDTHREAD */
1204
1205                 /* Otherwise, send it now */
1206                 BUS_WAKE(bus);
1207                 /* Make sure back plane ht clk is on, no pending allowed */
1208                 dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
1209 #ifndef SDTEST
1210                 ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
1211 #else
1212                 ret = dhdsdio_txpkt(bus, pkt,
1213                         (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
1214 #endif
1215                 if (ret)
1216                         bus->dhd->tx_errors++;
1217                 else
1218                         bus->dhd->dstats.tx_bytes += datalen;
1219
1220                 if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1221                         bus->activity = FALSE;
1222                         dhdsdio_clkctl(bus, CLK_NONE, TRUE);
1223                 }
1224
1225 #ifdef DHDTHREAD
1226                 dhd_os_sdunlock(bus->dhd);
1227 #endif /* DHDTHREAD */
1228         }
1229
1230 #ifndef DHDTHREAD
1231         dhd_os_sdunlock(bus->dhd);
1232 #endif /* DHDTHREAD */
1233
1234         return ret;
1235 }
1236
1237 static uint
1238 dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
1239 {
1240         void *pkt;
1241         uint32 intstatus = 0;
1242         uint retries = 0;
1243         int ret = 0, prec_out;
1244         uint cnt = 0;
1245         uint datalen;
1246         uint8 tx_prec_map;
1247
1248         dhd_pub_t *dhd = bus->dhd;
1249         sdpcmd_regs_t *regs = bus->regs;
1250
1251         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1252
1253         tx_prec_map = ~bus->flowcontrol;
1254
1255         /* Send frames until the limit or some other event */
1256         for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
1257                 dhd_os_sdlock_txq(bus->dhd);
1258                 if ((pkt = pktq_mdeq(&bus->txq, tx_prec_map, &prec_out)) == NULL) {
1259                         dhd_os_sdunlock_txq(bus->dhd);
1260                         break;
1261                 }
1262                 dhd_os_sdunlock_txq(bus->dhd);
1263                 datalen = PKTLEN(bus->dhd->osh, pkt) - SDPCM_HDRLEN;
1264
1265 #ifndef SDTEST
1266                 ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
1267 #else
1268                 ret = dhdsdio_txpkt(bus, pkt,
1269                         (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
1270 #endif
1271                 if (ret)
1272                         bus->dhd->tx_errors++;
1273                 else
1274                         bus->dhd->dstats.tx_bytes += datalen;
1275
1276                 /* In poll mode, need to check for other events */
1277                 if (!bus->intr && cnt)
1278                 {
1279                         /* Check device status, signal pending interrupt */
1280                         R_SDREG(intstatus, &regs->intstatus, retries);
1281                         bus->f2txdata++;
1282                         if (bcmsdh_regfail(bus->sdh))
1283                                 break;
1284                         if (intstatus & bus->hostintmask)
1285                                 bus->ipend = TRUE;
1286                 }
1287         }
1288
1289         /* Deflow-control stack if needed */
1290         if (dhd_doflow && dhd->up && (dhd->busstate == DHD_BUS_DATA) &&
1291             dhd->txoff && (pktq_len(&bus->txq) < FCLOW))
1292                 dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);
1293
1294         return cnt;
1295 }
1296
1297 int
1298 dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
1299 {
1300         uint8 *frame;
1301         uint16 len;
1302         uint32 swheader;
1303         uint retries = 0;
1304         bcmsdh_info_t *sdh = bus->sdh;
1305         uint8 doff = 0;
1306         int ret = -1;
1307         int i;
1308
1309         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1310
1311         if (bus->dhd->dongle_reset)
1312                 return -EIO;
1313
1314         /* Back the pointer to make a room for bus header */
1315         frame = msg - SDPCM_HDRLEN;
1316         len = (msglen += SDPCM_HDRLEN);
1317
1318         /* Add alignment padding (optional for ctl frames) */
1319         if (dhd_alignctl) {
1320                 if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
1321                         frame -= doff;
1322                         len += doff;
1323                         msglen += doff;
1324                         bzero(frame, doff + SDPCM_HDRLEN);
1325                 }
1326                 ASSERT(doff < DHD_SDALIGN);
1327         }
1328         doff += SDPCM_HDRLEN;
1329
1330         /* Round send length to next SDIO block */
1331         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1332                 uint16 pad = bus->blocksize - (len % bus->blocksize);
1333                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1334                         len += pad;
1335         } else if (len % DHD_SDALIGN) {
1336                 len += DHD_SDALIGN - (len % DHD_SDALIGN);
1337         }
1338
1339         /* Satisfy length-alignment requirements */
1340         if (forcealign && (len & (ALIGNMENT - 1)))
1341                 len = ROUNDUP(len, ALIGNMENT);
1342
1343         ASSERT(ISALIGNED((uintptr)frame, 2));
1344
1345
1346         /* Need to lock here to protect txseq and SDIO tx calls */
1347         dhd_os_sdlock(bus->dhd);
1348
1349         BUS_WAKE(bus);
1350
1351         /* Make sure backplane clock is on */
1352         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
1353
1354         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1355         *(uint16*)frame = htol16((uint16)msglen);
1356         *(((uint16*)frame) + 1) = htol16(~msglen);
1357
1358         /* Software tag: channel, sequence number, data offset */
1359         swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
1360                 | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1361         htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
1362         htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
1363
1364         if (!TXCTLOK(bus)) {
1365                 DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
1366                         __FUNCTION__, bus->tx_max, bus->tx_seq));
1367                 bus->ctrl_frame_stat = TRUE;
1368                 /* Send from dpc */
1369                 bus->ctrl_frame_buf = frame;
1370                 bus->ctrl_frame_len = len;
1371                 dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
1372                 if (bus->ctrl_frame_stat == FALSE) {
1373                         DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
1374                         ret = 0;
1375                 } else {
1376                         bus->dhd->txcnt_timeout++;
1377                         if (!bus->dhd->hang_was_sent)
1378                                 DHD_ERROR(("%s: ctrl_frame_stat == TRUE txcnt_timeout=%d\n",
1379                                         __FUNCTION__, bus->dhd->txcnt_timeout));
1380                         ret = -1;
1381                         bus->ctrl_frame_stat = FALSE;
1382                         goto done;
1383                 }
1384         }
1385
1386         bus->dhd->txcnt_timeout = 0;
1387
1388         if (ret == -1) {
1389 #ifdef DHD_DEBUG
1390                 if (DHD_BYTES_ON() && DHD_CTL_ON()) {
1391                         prhex("Tx Frame", frame, len);
1392                 } else if (DHD_HDRS_ON()) {
1393                         prhex("TxHdr", frame, MIN(len, 16));
1394                 }
1395 #endif
1396
1397                 do {
1398                         ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
1399                                                   frame, len, NULL, NULL, NULL);
1400                         ASSERT(ret != BCME_PENDING);
1401
1402                         if (ret < 0) {
1403                         /* On failure, abort the command and terminate the frame */
1404                                 DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
1405                                           __FUNCTION__, ret));
1406                                 bus->tx_sderrs++;
1407
1408                                 bcmsdh_abort(sdh, SDIO_FUNC_2);
1409
1410                                 bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
1411                                                  SFC_WF_TERM, NULL);
1412                                 bus->f1regdata++;
1413
1414                                 for (i = 0; i < 3; i++) {
1415                                         uint8 hi, lo;
1416                                         hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1417                                                              SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1418                                         lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
1419                                                              SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1420                                         bus->f1regdata += 2;
1421                                         if ((hi == 0) && (lo == 0))
1422                                                 break;
1423                                 }
1424
1425                         }
1426                         if (ret == 0) {
1427                                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1428                         }
1429                 } while ((ret < 0) && retries++ < TXRETRIES);
1430         }
1431
1432 done:
1433         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
1434                 bus->activity = FALSE;
1435                 dhdsdio_clkctl(bus, CLK_NONE, TRUE);
1436         }
1437
1438         dhd_os_sdunlock(bus->dhd);
1439
1440         if (ret)
1441                 bus->dhd->tx_ctlerrs++;
1442         else
1443                 bus->dhd->tx_ctlpkts++;
1444
1445         if (bus->dhd->txcnt_timeout >= MAX_CNTL_TIMEOUT)
1446                 return -ETIMEDOUT;
1447
1448         return ret ? -EIO : 0;
1449 }
1450
1451 int
1452 dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
1453 {
1454         int timeleft;
1455         uint rxlen = 0;
1456         bool pending;
1457
1458         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1459
1460         if (bus->dhd->dongle_reset)
1461                 return -EIO;
1462
1463         /* Wait until control frame is available */
1464         timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen, &pending);
1465
1466         dhd_os_sdlock(bus->dhd);
1467         rxlen = bus->rxlen;
1468         bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
1469         bus->rxlen = 0;
1470         dhd_os_sdunlock(bus->dhd);
1471
1472         if (rxlen) {
1473                 DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
1474                          __FUNCTION__, rxlen, msglen));
1475         } else if (timeleft == 0) {
1476                 DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
1477 #ifdef DHD_DEBUG
1478                 dhd_os_sdlock(bus->dhd);
1479                 dhdsdio_checkdied(bus, NULL, 0);
1480                 dhd_os_sdunlock(bus->dhd);
1481 #endif /* DHD_DEBUG */
1482         } else if (pending == TRUE) {
1483                 DHD_CTL(("%s: canceled\n", __FUNCTION__));
1484                 return -ERESTARTSYS;
1485         } else {
1486                 DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
1487 #ifdef DHD_DEBUG
1488                 dhd_os_sdlock(bus->dhd);
1489                 dhdsdio_checkdied(bus, NULL, 0);
1490                 dhd_os_sdunlock(bus->dhd);
1491 #endif /* DHD_DEBUG */
1492         }
1493         if (timeleft == 0) {
1494                 bus->dhd->rxcnt_timeout++;
1495                 DHD_ERROR(("%s: rxcnt_timeout=%d\n", __FUNCTION__, bus->dhd->rxcnt_timeout));
1496         }
1497         else
1498                 bus->dhd->rxcnt_timeout = 0;
1499
1500         if (rxlen)
1501                 bus->dhd->rx_ctlpkts++;
1502         else
1503                 bus->dhd->rx_ctlerrs++;
1504
1505         if (bus->dhd->rxcnt_timeout >= MAX_CNTL_TIMEOUT)
1506                 return -ETIMEDOUT;
1507
1508         return rxlen ? (int)rxlen : -EIO;
1509 }
1510
1511 /* IOVar table */
1512 enum {
1513         IOV_INTR = 1,
1514         IOV_POLLRATE,
1515         IOV_SDREG,
1516         IOV_SBREG,
1517         IOV_SDCIS,
1518         IOV_MEMBYTES,
1519         IOV_MEMSIZE,
1520 #ifdef DHD_DEBUG
1521         IOV_CHECKDIED,
1522         IOV_SERIALCONS,
1523 #endif /* DHD_DEBUG */
1524         IOV_DOWNLOAD,
1525         IOV_SOCRAM_STATE,
1526         IOV_FORCEEVEN,
1527         IOV_SDIOD_DRIVE,
1528         IOV_READAHEAD,
1529         IOV_SDRXCHAIN,
1530         IOV_ALIGNCTL,
1531         IOV_SDALIGN,
1532         IOV_DEVRESET,
1533         IOV_CPU,
1534 #ifdef SDTEST
1535         IOV_PKTGEN,
1536         IOV_EXTLOOP,
1537 #endif /* SDTEST */
1538         IOV_SPROM,
1539         IOV_TXBOUND,
1540         IOV_RXBOUND,
1541         IOV_TXMINMAX,
1542         IOV_IDLETIME,
1543         IOV_IDLECLOCK,
1544         IOV_SD1IDLE,
1545         IOV_SLEEP,
1546         IOV_DONGLEISOLATION,
1547         IOV_VARS,
1548 #ifdef SOFTAP
1549         IOV_FWPATH
1550 #endif
1551 };
1552
1553 const bcm_iovar_t dhdsdio_iovars[] = {
1554         {"intr",        IOV_INTR,       0,      IOVT_BOOL,      0 },
1555         {"sleep",       IOV_SLEEP,      0,      IOVT_BOOL,      0 },
1556         {"pollrate",    IOV_POLLRATE,   0,      IOVT_UINT32,    0 },
1557         {"idletime",    IOV_IDLETIME,   0,      IOVT_INT32,     0 },
1558         {"idleclock",   IOV_IDLECLOCK,  0,      IOVT_INT32,     0 },
1559         {"sd1idle",     IOV_SD1IDLE,    0,      IOVT_BOOL,      0 },
1560         {"membytes",    IOV_MEMBYTES,   0,      IOVT_BUFFER,    2 * sizeof(int) },
1561         {"memsize",     IOV_MEMSIZE,    0,      IOVT_UINT32,    0 },
1562         {"download",    IOV_DOWNLOAD,   0,      IOVT_BOOL,      0 },
1563         {"socram_state",        IOV_SOCRAM_STATE,       0,      IOVT_BOOL,      0 },
1564         {"vars",        IOV_VARS,       0,      IOVT_BUFFER,    0 },
1565         {"sdiod_drive", IOV_SDIOD_DRIVE, 0,     IOVT_UINT32,    0 },
1566         {"readahead",   IOV_READAHEAD,  0,      IOVT_BOOL,      0 },
1567         {"sdrxchain",   IOV_SDRXCHAIN,  0,      IOVT_BOOL,      0 },
1568         {"alignctl",    IOV_ALIGNCTL,   0,      IOVT_BOOL,      0 },
1569         {"sdalign",     IOV_SDALIGN,    0,      IOVT_BOOL,      0 },
1570         {"devreset",    IOV_DEVRESET,   0,      IOVT_BOOL,      0 },
1571 #ifdef DHD_DEBUG
1572         {"sdreg",       IOV_SDREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
1573         {"sbreg",       IOV_SBREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
1574         {"sd_cis",      IOV_SDCIS,      0,      IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
1575         {"forcealign",  IOV_FORCEEVEN,  0,      IOVT_BOOL,      0 },
1576         {"txbound",     IOV_TXBOUND,    0,      IOVT_UINT32,    0 },
1577         {"rxbound",     IOV_RXBOUND,    0,      IOVT_UINT32,    0 },
1578         {"txminmax",    IOV_TXMINMAX,   0,      IOVT_UINT32,    0 },
1579         {"cpu",         IOV_CPU,        0,      IOVT_BOOL,      0 },
1580 #ifdef DHD_DEBUG
1581         {"checkdied",   IOV_CHECKDIED,  0,      IOVT_BUFFER,    0 },
1582         {"serial",      IOV_SERIALCONS, 0,      IOVT_UINT32,    0 },
1583 #endif /* DHD_DEBUG  */
1584 #endif /* DHD_DEBUG */
1585 #ifdef SDTEST
1586         {"extloop",     IOV_EXTLOOP,    0,      IOVT_BOOL,      0 },
1587         {"pktgen",      IOV_PKTGEN,     0,      IOVT_BUFFER,    sizeof(dhd_pktgen_t) },
1588 #endif /* SDTEST */
1589         {"dngl_isolation", IOV_DONGLEISOLATION, 0,      IOVT_UINT32,    0 },
1590 #ifdef SOFTAP
1591         {"fwpath", IOV_FWPATH, 0, IOVT_BUFFER, 0 },
1592 #endif
1593         {NULL, 0, 0, 0, 0 }
1594 };
1595
1596 static void
1597 dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
1598 {
1599         uint q1, q2;
1600
1601         if (!div) {
1602                 bcm_bprintf(strbuf, "%s N/A", desc);
1603         } else {
1604                 q1 = num / div;
1605                 q2 = (100 * (num - (q1 * div))) / div;
1606                 bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
1607         }
1608 }
1609
1610 void
1611 dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
1612 {
1613         dhd_bus_t *bus = dhdp->bus;
1614
1615         bcm_bprintf(strbuf, "Bus SDIO structure:\n");
1616         bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
1617                     bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
1618         bcm_bprintf(strbuf, "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
1619                     bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
1620                     bus->rxlen, bus->rx_seq);
1621         bcm_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
1622                     bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
1623         bcm_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
1624                     bus->pollrate, bus->pollcnt, bus->regfails);
1625
1626         bcm_bprintf(strbuf, "\nAdditional counters:\n");
1627         bcm_bprintf(strbuf, "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
1628                     bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
1629                     bus->rxc_errors);
1630         bcm_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
1631                     bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
1632         bcm_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
1633                     bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
1634         bcm_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
1635                     bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
1636         bcm_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs %d\n",
1637                     (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
1638                     bus->f2txdata, bus->f1regdata);
1639         {
1640                 dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
1641                              (bus->f2rxhdrs + bus->f2rxdata));
1642                 dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
1643                 dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
1644                              (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
1645                 dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
1646                 bcm_bprintf(strbuf, "\n");
1647
1648                 dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
1649                              bus->dhd->rx_packets);
1650                 dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
1651                 bcm_bprintf(strbuf, "\n");
1652
1653                 dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
1654                 dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
1655                 dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
1656                              (bus->f2txdata + bus->f1regdata));
1657                 dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
1658                 bcm_bprintf(strbuf, "\n");
1659
1660                 dhd_dump_pct(strbuf, "Total: pkts/f2rw",
1661                              (bus->dhd->tx_packets + bus->dhd->rx_packets),
1662                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
1663                 dhd_dump_pct(strbuf, ", pkts/f1sd",
1664                              (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
1665                 dhd_dump_pct(strbuf, ", pkts/sd",
1666                              (bus->dhd->tx_packets + bus->dhd->rx_packets),
1667                              (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
1668                 dhd_dump_pct(strbuf, ", pkts/int",
1669                              (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
1670                 bcm_bprintf(strbuf, "\n\n");
1671         }
1672
1673 #ifdef SDTEST
1674         if (bus->pktgen_count) {
1675                 bcm_bprintf(strbuf, "pktgen config and count:\n");
1676                 bcm_bprintf(strbuf, "freq %d count %d print %d total %d min %d len %d\n",
1677                             bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
1678                             bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
1679                 bcm_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
1680                             bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
1681         }
1682 #endif /* SDTEST */
1683 #ifdef DHD_DEBUG
1684         bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
1685                     bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
1686         bcm_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize, bus->roundup);
1687 #endif /* DHD_DEBUG */
1688         bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
1689                     bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
1690 }
1691
1692 void
1693 dhd_bus_clearcounts(dhd_pub_t *dhdp)
1694 {
1695         dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
1696
1697         bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
1698         bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
1699         bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
1700         bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
1701         bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
1702         bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
1703 }
1704
1705 #ifdef SDTEST
1706 static int
1707 dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
1708 {
1709         dhd_pktgen_t pktgen;
1710
1711         pktgen.version = DHD_PKTGEN_VERSION;
1712         pktgen.freq = bus->pktgen_freq;
1713         pktgen.count = bus->pktgen_count;
1714         pktgen.print = bus->pktgen_print;
1715         pktgen.total = bus->pktgen_total;
1716         pktgen.minlen = bus->pktgen_minlen;
1717         pktgen.maxlen = bus->pktgen_maxlen;
1718         pktgen.numsent = bus->pktgen_sent;
1719         pktgen.numrcvd = bus->pktgen_rcvd;
1720         pktgen.numfail = bus->pktgen_fail;
1721         pktgen.mode = bus->pktgen_mode;
1722         pktgen.stop = bus->pktgen_stop;
1723
1724         bcopy(&pktgen, arg, sizeof(pktgen));
1725
1726         return 0;
1727 }
1728
1729 static int
1730 dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
1731 {
1732         dhd_pktgen_t pktgen;
1733         uint oldcnt, oldmode;
1734
1735         bcopy(arg, &pktgen, sizeof(pktgen));
1736         if (pktgen.version != DHD_PKTGEN_VERSION)
1737                 return BCME_BADARG;
1738
1739         oldcnt = bus->pktgen_count;
1740         oldmode = bus->pktgen_mode;
1741
1742         bus->pktgen_freq = pktgen.freq;
1743         bus->pktgen_count = pktgen.count;
1744         bus->pktgen_print = pktgen.print;
1745         bus->pktgen_total = pktgen.total;
1746         bus->pktgen_minlen = pktgen.minlen;
1747         bus->pktgen_maxlen = pktgen.maxlen;
1748         bus->pktgen_mode = pktgen.mode;
1749         bus->pktgen_stop = pktgen.stop;
1750
1751         bus->pktgen_tick = bus->pktgen_ptick = 0;
1752         bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
1753         bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
1754
1755         /* Clear counts for a new pktgen (mode change, or was stopped) */
1756         if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
1757                 bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
1758
1759         return 0;
1760 }
1761 #endif /* SDTEST */
1762
1763 static int
1764 dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
1765 {
1766         int bcmerror = 0;
1767         uint32 sdaddr;
1768         uint dsize;
1769
1770         /* Determine initial transfer parameters */
1771         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
1772         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
1773                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
1774         else
1775                 dsize = size;
1776
1777         /* Set the backplane window to include the start address */
1778         if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
1779                 DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
1780                 goto xfer_done;
1781         }
1782
1783         /* Do the transfer(s) */
1784         while (size) {
1785                 DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
1786                           __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
1787                           (address & SBSDIO_SBWINDOW_MASK)));
1788                 if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, data, dsize))) {
1789                         DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
1790                         break;
1791                 }
1792
1793                 /* Adjust for next transfer (if any) */
1794                 if ((size -= dsize)) {
1795                         data += dsize;
1796                         address += dsize;
1797                         if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
1798                                 DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
1799                                 break;
1800                         }
1801                         sdaddr = 0;
1802                         dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
1803                 }
1804
1805         }
1806
1807 xfer_done:
1808         /* Return the window to backplane enumeration space for core access */
1809         if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
1810                 DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
1811                         bcmsdh_cur_sbwad(bus->sdh)));
1812         }
1813
1814         return bcmerror;
1815 }
1816
1817 #ifdef DHD_DEBUG
1818 static int
1819 dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
1820 {
1821         uint32 addr;
1822         int rv;
1823
1824         /* Read last word in memory to determine address of sdpcm_shared structure */
1825         if ((rv = dhdsdio_membytes(bus, FALSE, bus->ramsize - 4, (uint8 *)&addr, 4)) < 0)
1826                 return rv;
1827
1828         addr = ltoh32(addr);
1829
1830         DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
1831
1832         /*
1833          * Check if addr is valid.
1834          * NVRAM length at the end of memory should have been overwritten.
1835          */
1836         if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
1837                 DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n", __FUNCTION__, addr));
1838                 return BCME_ERROR;
1839         }
1840
1841         /* Read hndrte_shared structure */
1842         if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
1843                 return rv;
1844
1845         /* Endianness */
1846         sh->flags = ltoh32(sh->flags);
1847         sh->trap_addr = ltoh32(sh->trap_addr);
1848         sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
1849         sh->assert_file_addr = ltoh32(sh->assert_file_addr);
1850         sh->assert_line = ltoh32(sh->assert_line);
1851         sh->console_addr = ltoh32(sh->console_addr);
1852         sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
1853
1854         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) == 3 && SDPCM_SHARED_VERSION == 1)
1855                 return BCME_OK;
1856
1857         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
1858                 DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
1859                            "is different than sdpcm_shared version %d in dongle\n",
1860                            __FUNCTION__, SDPCM_SHARED_VERSION,
1861                            sh->flags & SDPCM_SHARED_VERSION_MASK));
1862                 return BCME_ERROR;
1863         }
1864
1865         return BCME_OK;
1866 }
1867
1868
1869 static int
1870 dhdsdio_readconsole(dhd_bus_t *bus)
1871 {
1872         dhd_console_t *c = &bus->console;
1873         uint8 line[CONSOLE_LINE_MAX], ch;
1874         uint32 n, idx, addr;
1875         int rv;
1876
1877         /* Don't do anything until FWREADY updates console address */
1878         if (bus->console_addr == 0)
1879                 return 0;
1880
1881         /* Read console log struct */
1882         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, log);
1883         if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
1884                 return rv;
1885
1886         /* Allocate console buffer (one time only) */
1887         if (c->buf == NULL) {
1888                 c->bufsize = ltoh32(c->log.buf_size);
1889                 if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
1890                         return BCME_NOMEM;
1891         }
1892
1893         idx = ltoh32(c->log.idx);
1894
1895         /* Protect against corrupt value */
1896         if (idx > c->bufsize)
1897                 return BCME_ERROR;
1898
1899         /* Skip reading the console buffer if the index pointer has not moved */
1900         if (idx == c->last)
1901                 return BCME_OK;
1902
1903         /* Read the console buffer */
1904         addr = ltoh32(c->log.buf);
1905         if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
1906                 return rv;
1907
1908         while (c->last != idx) {
1909                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
1910                         if (c->last == idx) {
1911                                 /* This would output a partial line.  Instead, back up
1912                                  * the buffer pointer and output this line next time around.
1913                                  */
1914                                 if (c->last >= n)
1915                                         c->last -= n;
1916                                 else
1917                                         c->last = c->bufsize - n;
1918                                 goto break2;
1919                         }
1920                         ch = c->buf[c->last];
1921                         c->last = (c->last + 1) % c->bufsize;
1922                         if (ch == '\n')
1923                                 break;
1924                         line[n] = ch;
1925                 }
1926
1927                 if (n > 0) {
1928                         if (line[n - 1] == '\r')
1929                                 n--;
1930                         line[n] = 0;
1931                         printf("CONSOLE: %s\n", line);
1932                 }
1933         }
1934 break2:
1935
1936         return BCME_OK;
1937 }
1938
1939 static int
1940 dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size)
1941 {
1942         int bcmerror = 0;
1943         uint msize = 512;
1944         char *mbuffer = NULL;
1945         char *console_buffer = NULL;
1946         uint maxstrlen = 256;
1947         char *str = NULL;
1948         trap_t tr;
1949         sdpcm_shared_t sdpcm_shared;
1950         struct bcmstrbuf strbuf;
1951         uint32 console_ptr, console_size, console_index;
1952         uint8 line[CONSOLE_LINE_MAX], ch;
1953         uint32 n, i, addr;
1954         int rv;
1955
1956         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
1957
1958         if (data == NULL) {
1959                 /*
1960                  * Called after a rx ctrl timeout. "data" is NULL.
1961                  * allocate memory to trace the trap or assert.
1962                  */
1963                 size = msize;
1964                 mbuffer = data = MALLOC(bus->dhd->osh, msize);
1965                 if (mbuffer == NULL) {
1966                         DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
1967                         bcmerror = BCME_NOMEM;
1968                         goto done;
1969                 }
1970         }
1971
1972         if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
1973                 DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
1974                 bcmerror = BCME_NOMEM;
1975                 goto done;
1976         }
1977
1978         if ((bcmerror = dhdsdio_readshared(bus, &sdpcm_shared)) < 0)
1979                 goto done;
1980
1981         bcm_binit(&strbuf, data, size);
1982
1983         bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
1984                     sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
1985
1986         if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
1987                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
1988                  * (Avoids conflict with real asserts for programmatic parsing of output.)
1989                  */
1990                 bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
1991         }
1992
1993         if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
1994                 /* NOTE: Misspelled assert is intentional - DO NOT FIX.
1995                  * (Avoids conflict with real asserts for programmatic parsing of output.)
1996                  */
1997                 bcm_bprintf(&strbuf, "No trap%s in dongle",
1998                           (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
1999                           ?"/assrt" :"");
2000         } else {
2001                 if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
2002                         /* Download assert */
2003                         bcm_bprintf(&strbuf, "Dongle assert");
2004                         if (sdpcm_shared.assert_exp_addr != 0) {
2005                                 str[0] = '\0';
2006                                 if ((bcmerror = dhdsdio_membytes(bus, FALSE,
2007                                                                  sdpcm_shared.assert_exp_addr,
2008                                                                  (uint8 *)str, maxstrlen)) < 0)
2009                                         goto done;
2010
2011                                 str[maxstrlen - 1] = '\0';
2012                                 bcm_bprintf(&strbuf, " expr \"%s\"", str);
2013                         }
2014
2015                         if (sdpcm_shared.assert_file_addr != 0) {
2016                                 str[0] = '\0';
2017                                 if ((bcmerror = dhdsdio_membytes(bus, FALSE,
2018                                                                  sdpcm_shared.assert_file_addr,
2019                                                                  (uint8 *)str, maxstrlen)) < 0)
2020                                         goto done;
2021
2022                                 str[maxstrlen - 1] = '\0';
2023                                 bcm_bprintf(&strbuf, " file \"%s\"", str);
2024                         }
2025
2026                         bcm_bprintf(&strbuf, " line %d ", sdpcm_shared.assert_line);
2027                 }
2028
2029                 if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
2030                         if ((bcmerror = dhdsdio_membytes(bus, FALSE,
2031                                                          sdpcm_shared.trap_addr,
2032                                                          (uint8*)&tr, sizeof(trap_t))) < 0)
2033                                 goto done;
2034
2035                         bcm_bprintf(&strbuf,
2036                         "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
2037                         "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
2038                         "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
2039                         "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
2040                         ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
2041                         ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
2042                         ltoh32(sdpcm_shared.trap_addr),
2043                         ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
2044                         ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
2045
2046                         addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log);
2047                         if ((rv = dhdsdio_membytes(bus, FALSE, addr,
2048                                 (uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
2049                                 goto printbuf;
2050
2051                         addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log.buf_size);
2052                         if ((rv = dhdsdio_membytes(bus, FALSE, addr,
2053                                 (uint8 *)&console_size, sizeof(console_size))) < 0)
2054                                 goto printbuf;
2055
2056                         addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log.idx);
2057                         if ((rv = dhdsdio_membytes(bus, FALSE, addr,
2058                                 (uint8 *)&console_index, sizeof(console_index))) < 0)
2059                                 goto printbuf;
2060
2061                         console_ptr = ltoh32(console_ptr);
2062                         console_size = ltoh32(console_size);
2063                         console_index = ltoh32(console_index);
2064
2065                         if (console_size > CONSOLE_BUFFER_MAX ||
2066                                 !(console_buffer = MALLOC(bus->dhd->osh, console_size)))
2067                                 goto printbuf;
2068
2069                         if ((rv = dhdsdio_membytes(bus, FALSE, console_ptr,
2070                                 (uint8 *)console_buffer, console_size)) < 0)
2071                                 goto printbuf;
2072
2073                         for (i = 0, n = 0; i < console_size; i += n + 1) {
2074                                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2075                                         ch = console_buffer[(console_index + i + n) % console_size];
2076                                         if (ch == '\n')
2077                                                 break;
2078                                         line[n] = ch;
2079                                 }
2080
2081
2082                                 if (n > 0) {
2083                                         if (line[n - 1] == '\r')
2084                                                 n--;
2085                                         line[n] = 0;
2086                                         /* Don't use DHD_ERROR macro since we print
2087                                          * a lot of information quickly. The macro
2088                                          * will truncate a lot of the printfs
2089                                          */
2090
2091                                         if (dhd_msg_level & DHD_ERROR_VAL) {
2092                                                 printf("CONSOLE: %s\n", line);
2093                                                 DHD_BLOG(line, strlen(line) + 1);
2094                                         }
2095                                 }
2096                         }
2097                 }
2098         }
2099
2100 printbuf:
2101         if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
2102                 DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
2103         }
2104
2105
2106 done:
2107         if (mbuffer)
2108                 MFREE(bus->dhd->osh, mbuffer, msize);
2109         if (str)
2110                 MFREE(bus->dhd->osh, str, maxstrlen);
2111         if (console_buffer)
2112                 MFREE(bus->dhd->osh, console_buffer, console_size);
2113
2114         return bcmerror;
2115 }
2116 #endif /* #ifdef DHD_DEBUG */
2117
2118
2119 int
2120 dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
2121 {
2122         int bcmerror = BCME_OK;
2123
2124         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
2125
2126         /* Basic sanity checks */
2127         if (bus->dhd->up) {
2128                 bcmerror = BCME_NOTDOWN;
2129                 goto err;
2130         }
2131         if (!len) {
2132                 bcmerror = BCME_BUFTOOSHORT;
2133                 goto err;
2134         }
2135
2136         /* Free the old ones and replace with passed variables */
2137         if (bus->vars)
2138                 MFREE(bus->dhd->osh, bus->vars, bus->varsz);
2139
2140         bus->vars = MALLOC(bus->dhd->osh, len);
2141         bus->varsz = bus->vars ? len : 0;
2142         if (bus->vars == NULL) {
2143                 bcmerror = BCME_NOMEM;
2144                 goto err;
2145         }
2146
2147         /* Copy the passed variables, which should include the terminating double-null */
2148         bcopy(arg, bus->vars, bus->varsz);
2149 err:
2150         return bcmerror;
2151 }
2152
2153 #ifdef DHD_DEBUG
2154
2155 #define CC_PLL_CHIPCTRL_SERIAL_ENAB     (1  << 24)
2156 static int
2157 dhd_serialconsole(dhd_bus_t *bus, bool set, bool enable, int *bcmerror)
2158 {
2159         int int_val;
2160         uint32 addr, data;
2161
2162
2163         addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
2164         data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
2165         *bcmerror = 0;
2166
2167         bcmsdh_reg_write(bus->sdh, addr, 4, 1);
2168         if (bcmsdh_regfail(bus->sdh)) {
2169                 *bcmerror = BCME_SDIO_ERROR;
2170                 return -1;
2171         }
2172         int_val = bcmsdh_reg_read(bus->sdh, data, 4);
2173         if (bcmsdh_regfail(bus->sdh)) {
2174                 *bcmerror = BCME_SDIO_ERROR;
2175                 return -1;
2176         }
2177         if (!set)
2178                 return (int_val & CC_PLL_CHIPCTRL_SERIAL_ENAB);
2179         if (enable)
2180                 int_val |= CC_PLL_CHIPCTRL_SERIAL_ENAB;
2181         else
2182                 int_val &= ~CC_PLL_CHIPCTRL_SERIAL_ENAB;
2183         bcmsdh_reg_write(bus->sdh, data, 4, int_val);
2184         if (bcmsdh_regfail(bus->sdh)) {
2185                 *bcmerror = BCME_SDIO_ERROR;
2186                 return -1;
2187         }
2188         if (bus->sih->chip == BCM4330_CHIP_ID) {
2189                 uint32 chipcontrol;
2190                 addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol);
2191                 chipcontrol = bcmsdh_reg_read(bus->sdh, addr, 4);
2192                 chipcontrol &= ~0x8;
2193                 if (enable) {
2194                         chipcontrol |=  0x8;
2195                         chipcontrol &= ~0x3;
2196                 }
2197                 bcmsdh_reg_write(bus->sdh, addr, 4, chipcontrol);
2198         }
2199
2200         return (int_val & CC_PLL_CHIPCTRL_SERIAL_ENAB);
2201 }
2202 #endif 
2203
2204 static int
2205 dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
2206                 void *params, int plen, void *arg, int len, int val_size)
2207 {
2208         int bcmerror = 0;
2209         int32 int_val = 0;
2210         bool bool_val = 0;
2211
2212         DHD_ERROR(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
2213                    __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
2214
2215         if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
2216                 goto exit;
2217
2218         if (plen >= (int)sizeof(int_val))
2219                 bcopy(params, &int_val, sizeof(int_val));
2220
2221         bool_val = (int_val != 0) ? TRUE : FALSE;
2222
2223
2224         /* Some ioctls use the bus */
2225         dhd_os_sdlock(bus->dhd);
2226
2227         /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
2228         if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
2229                                         actionid == IOV_GVAL(IOV_DEVRESET))) {
2230                 bcmerror = BCME_NOTREADY;
2231                 goto exit;
2232         }
2233
2234         /* Handle sleep stuff before any clock mucking */
2235         if (vi->varid == IOV_SLEEP) {
2236                 if (IOV_ISSET(actionid)) {
2237                         bcmerror = dhdsdio_bussleep(bus, bool_val);
2238                 } else {
2239                         int_val = (int32)bus->sleeping;
2240                         bcopy(&int_val, arg, val_size);
2241                 }
2242                 goto exit;
2243         }
2244
2245         /* Request clock to allow SDIO accesses */
2246         if (!bus->dhd->dongle_reset) {
2247                 BUS_WAKE(bus);
2248                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
2249         }
2250
2251         switch (actionid) {
2252         case IOV_GVAL(IOV_INTR):
2253                 int_val = (int32)bus->intr;
2254                 bcopy(&int_val, arg, val_size);
2255                 break;
2256
2257         case IOV_SVAL(IOV_INTR):
2258                 bus->intr = bool_val;
2259                 bus->intdis = FALSE;
2260                 if (bus->dhd->up) {
2261                         if (bus->intr) {
2262                                 DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
2263                                 bcmsdh_intr_enable(bus->sdh);
2264                         } else {
2265                                 DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
2266                                 bcmsdh_intr_disable(bus->sdh);
2267                         }
2268                 }
2269                 break;
2270
2271         case IOV_GVAL(IOV_POLLRATE):
2272                 int_val = (int32)bus->pollrate;
2273                 bcopy(&int_val, arg, val_size);
2274                 break;
2275
2276         case IOV_SVAL(IOV_POLLRATE):
2277                 bus->pollrate = (uint)int_val;
2278                 bus->poll = (bus->pollrate != 0);
2279                 break;
2280
2281         case IOV_GVAL(IOV_IDLETIME):
2282                 int_val = bus->idletime;
2283                 bcopy(&int_val, arg, val_size);
2284                 break;
2285
2286         case IOV_SVAL(IOV_IDLETIME):
2287                 if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
2288                         bcmerror = BCME_BADARG;
2289                 } else {
2290                         bus->idletime = int_val;
2291                 }
2292                 break;
2293
2294         case IOV_GVAL(IOV_IDLECLOCK):
2295                 int_val = (int32)bus->idleclock;
2296                 bcopy(&int_val, arg, val_size);
2297                 break;
2298
2299         case IOV_SVAL(IOV_IDLECLOCK):
2300                 bus->idleclock = int_val;
2301                 break;
2302
2303         case IOV_GVAL(IOV_SD1IDLE):
2304                 int_val = (int32)sd1idle;
2305                 bcopy(&int_val, arg, val_size);
2306                 break;
2307
2308         case IOV_SVAL(IOV_SD1IDLE):
2309                 sd1idle = bool_val;
2310                 break;
2311
2312
2313         case IOV_SVAL(IOV_MEMBYTES):
2314         case IOV_GVAL(IOV_MEMBYTES):
2315         {
2316                 uint32 address;
2317                 uint size, dsize;
2318                 uint8 *data;
2319
2320                 bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
2321
2322                 ASSERT(plen >= 2*sizeof(int));
2323
2324                 address = (uint32)int_val;
2325                 bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
2326                 size = (uint)int_val;
2327
2328                 /* Do some validation */
2329                 dsize = set ? plen - (2 * sizeof(int)) : len;
2330                 if (dsize < size) {
2331                         DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
2332                                    __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
2333                         bcmerror = BCME_BADARG;
2334                         break;
2335                 }
2336
2337                 DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
2338                           (set ? "write" : "read"), size, address));
2339
2340                 /* If we know about SOCRAM, check for a fit */
2341                 if ((bus->orig_ramsize) &&
2342                     ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
2343                 {
2344                         uint8 enable, protect;
2345                         si_socdevram(bus->sih, FALSE, &enable, &protect);
2346                         if (!enable || protect) {
2347                                 DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
2348                                         __FUNCTION__, bus->orig_ramsize, size, address));
2349                                 DHD_ERROR(("%s: socram enable %d, protect %d\n",
2350                                         __FUNCTION__, enable, protect));
2351                                 bcmerror = BCME_BADARG;
2352                                 break;
2353                         }
2354                         if (enable && (bus->sih->chip == BCM4330_CHIP_ID)) {
2355                                 uint32 devramsize = si_socdevram_size(bus->sih);
2356                                 if ((address < SOCDEVRAM_4330_ARM_ADDR) ||
2357                                         (address + size > (SOCDEVRAM_4330_ARM_ADDR + devramsize))) {
2358                                         DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
2359                                                 __FUNCTION__, address, size));
2360                                         DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
2361                                                 __FUNCTION__, SOCDEVRAM_4330_ARM_ADDR, devramsize));
2362                                         bcmerror = BCME_BADARG;
2363                                         break;
2364                                 }
2365                                 /* move it such that address is real now */
2366                                 address -= SOCDEVRAM_4330_ARM_ADDR;
2367                                 address += SOCDEVRAM_4330_BP_ADDR;
2368                                 DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
2369                                         __FUNCTION__, (set ? "write" : "read"), size, address));
2370                         }
2371                 }
2372
2373                 /* Generate the actual data pointer */
2374                 data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
2375
2376                 /* Call to do the transfer */
2377                 bcmerror = dhdsdio_membytes(bus, set, address, data, size);
2378
2379                 break;
2380         }
2381
2382         case IOV_GVAL(IOV_MEMSIZE):
2383                 int_val = (int32)bus->ramsize;
2384                 bcopy(&int_val, arg, val_size);
2385                 break;
2386
2387         case IOV_GVAL(IOV_SDIOD_DRIVE):
2388                 int_val = (int32)dhd_sdiod_drive_strength;
2389                 bcopy(&int_val, arg, val_size);
2390                 break;
2391
2392         case IOV_SVAL(IOV_SDIOD_DRIVE):
2393                 dhd_sdiod_drive_strength = int_val;
2394                 si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
2395                 break;
2396
2397         case IOV_SVAL(IOV_DOWNLOAD):
2398                 bcmerror = dhdsdio_download_state(bus, bool_val);
2399                 break;
2400
2401         case IOV_SVAL(IOV_SOCRAM_STATE):
2402                 bcmerror = dhdsdio_download_state(bus, bool_val);
2403                 break;
2404
2405         case IOV_SVAL(IOV_VARS):
2406                 bcmerror = dhdsdio_downloadvars(bus, arg, len);
2407                 break;
2408
2409         case IOV_GVAL(IOV_READAHEAD):
2410                 int_val = (int32)dhd_readahead;
2411                 bcopy(&int_val, arg, val_size);
2412                 break;
2413
2414         case IOV_SVAL(IOV_READAHEAD):
2415                 if (bool_val && !dhd_readahead)
2416                         bus->nextlen = 0;
2417                 dhd_readahead = bool_val;
2418                 break;
2419
2420         case IOV_GVAL(IOV_SDRXCHAIN):
2421                 int_val = (int32)bus->use_rxchain;
2422                 bcopy(&int_val, arg, val_size);
2423                 break;
2424
2425         case IOV_SVAL(IOV_SDRXCHAIN):
2426                 if (bool_val && !bus->sd_rxchain)
2427                         bcmerror = BCME_UNSUPPORTED;
2428                 else
2429                         bus->use_rxchain = bool_val;
2430                 break;
2431         case IOV_GVAL(IOV_ALIGNCTL):
2432                 int_val = (int32)dhd_alignctl;
2433                 bcopy(&int_val, arg, val_size);
2434                 break;
2435
2436         case IOV_SVAL(IOV_ALIGNCTL):
2437                 dhd_alignctl = bool_val;
2438                 break;
2439
2440         case IOV_GVAL(IOV_SDALIGN):
2441                 int_val = DHD_SDALIGN;
2442                 bcopy(&int_val, arg, val_size);
2443                 break;
2444
2445 #ifdef DHD_DEBUG
2446         case IOV_GVAL(IOV_VARS):
2447                 if (bus->varsz < (uint)len)
2448                         bcopy(bus->vars, arg, bus->varsz);
2449                 else
2450                         bcmerror = BCME_BUFTOOSHORT;
2451                 break;
2452 #endif /* DHD_DEBUG */
2453
2454 #ifdef DHD_DEBUG
2455         case IOV_GVAL(IOV_SDREG):
2456         {
2457                 sdreg_t *sd_ptr;
2458                 uint32 addr, size;
2459
2460                 sd_ptr = (sdreg_t *)params;
2461
2462                 addr = (uintptr)bus->regs + sd_ptr->offset;
2463                 size = sd_ptr->func;
2464                 int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
2465                 if (bcmsdh_regfail(bus->sdh))
2466                         bcmerror = BCME_SDIO_ERROR;
2467                 bcopy(&int_val, arg, sizeof(int32));
2468                 break;
2469         }
2470
2471         case IOV_SVAL(IOV_SDREG):
2472         {
2473                 sdreg_t *sd_ptr;
2474                 uint32 addr, size;
2475
2476                 sd_ptr = (sdreg_t *)params;
2477
2478                 addr = (uintptr)bus->regs + sd_ptr->offset;
2479                 size = sd_ptr->func;
2480                 bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
2481                 if (bcmsdh_regfail(bus->sdh))
2482                         bcmerror = BCME_SDIO_ERROR;
2483                 break;
2484         }
2485
2486         /* Same as above, but offset is not backplane (not SDIO core) */
2487         case IOV_GVAL(IOV_SBREG):
2488         {
2489                 sdreg_t sdreg;
2490                 uint32 addr, size;
2491
2492                 bcopy(params, &sdreg, sizeof(sdreg));
2493
2494                 addr = SI_ENUM_BASE + sdreg.offset;
2495                 size = sdreg.func;
2496                 int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
2497                 if (bcmsdh_regfail(bus->sdh))
2498                         bcmerror = BCME_SDIO_ERROR;
2499                 bcopy(&int_val, arg, sizeof(int32));
2500                 break;
2501         }
2502
2503         case IOV_SVAL(IOV_SBREG):
2504         {
2505                 sdreg_t sdreg;
2506                 uint32 addr, size;
2507
2508                 bcopy(params, &sdreg, sizeof(sdreg));
2509
2510                 addr = SI_ENUM_BASE + sdreg.offset;
2511                 size = sdreg.func;
2512                 bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
2513                 if (bcmsdh_regfail(bus->sdh))
2514                         bcmerror = BCME_SDIO_ERROR;
2515                 break;
2516         }
2517
2518         case IOV_GVAL(IOV_SDCIS):
2519         {
2520                 *(char *)arg = 0;
2521
2522                 bcmstrcat(arg, "\nFunc 0\n");
2523                 bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
2524                 bcmstrcat(arg, "\nFunc 1\n");
2525                 bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
2526                 bcmstrcat(arg, "\nFunc 2\n");
2527                 bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
2528                 break;
2529         }
2530
2531         case IOV_GVAL(IOV_FORCEEVEN):
2532                 int_val = (int32)forcealign;
2533                 bcopy(&int_val, arg, val_size);
2534                 break;
2535
2536         case IOV_SVAL(IOV_FORCEEVEN):
2537                 forcealign = bool_val;
2538                 break;
2539
2540         case IOV_GVAL(IOV_TXBOUND):
2541                 int_val = (int32)dhd_txbound;
2542                 bcopy(&int_val, arg, val_size);
2543                 break;
2544
2545         case IOV_SVAL(IOV_TXBOUND):
2546                 dhd_txbound = (uint)int_val;
2547                 break;
2548
2549         case IOV_GVAL(IOV_RXBOUND):
2550                 int_val = (int32)dhd_rxbound;
2551                 bcopy(&int_val, arg, val_size);
2552                 break;
2553
2554         case IOV_SVAL(IOV_RXBOUND):
2555                 dhd_rxbound = (uint)int_val;
2556                 break;
2557
2558         case IOV_GVAL(IOV_TXMINMAX):
2559                 int_val = (int32)dhd_txminmax;
2560                 bcopy(&int_val, arg, val_size);
2561                 break;
2562
2563         case IOV_SVAL(IOV_TXMINMAX):
2564                 dhd_txminmax = (uint)int_val;
2565                 break;
2566
2567         case IOV_GVAL(IOV_SERIALCONS):
2568                 int_val = dhd_serialconsole(bus, FALSE, 0, &bcmerror);
2569                 if (bcmerror != 0)
2570                         break;
2571
2572                 bcopy(&int_val, arg, val_size);
2573                 break;
2574
2575         case IOV_SVAL(IOV_SERIALCONS):
2576                 dhd_serialconsole(bus, TRUE, bool_val, &bcmerror);
2577                 break;
2578
2579
2580
2581 #endif /* DHD_DEBUG */
2582
2583
2584 #ifdef SDTEST
2585         case IOV_GVAL(IOV_EXTLOOP):
2586                 int_val = (int32)bus->ext_loop;
2587                 bcopy(&int_val, arg, val_size);
2588                 break;
2589
2590         case IOV_SVAL(IOV_EXTLOOP):
2591                 bus->ext_loop = bool_val;
2592                 break;
2593
2594         case IOV_GVAL(IOV_PKTGEN):
2595                 bcmerror = dhdsdio_pktgen_get(bus, arg);
2596                 break;
2597
2598         case IOV_SVAL(IOV_PKTGEN):
2599                 bcmerror = dhdsdio_pktgen_set(bus, arg);
2600                 break;
2601 #endif /* SDTEST */
2602
2603
2604         case IOV_GVAL(IOV_DONGLEISOLATION):
2605                 int_val = bus->dhd->dongle_isolation;
2606                 bcopy(&int_val, arg, val_size);
2607                 break;
2608
2609         case IOV_SVAL(IOV_DONGLEISOLATION):
2610                 bus->dhd->dongle_isolation = bool_val;
2611                 break;
2612
2613         case IOV_SVAL(IOV_DEVRESET):
2614                 DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
2615                            __FUNCTION__, bool_val, bus->dhd->dongle_reset,
2616                            bus->dhd->busstate));
2617
2618                 ASSERT(bus->dhd->osh);
2619                 /* ASSERT(bus->cl_devid); */
2620
2621                 dhd_bus_devreset(bus->dhd, (uint8)bool_val);
2622
2623                 break;
2624 #ifdef SOFTAP
2625         case IOV_GVAL(IOV_FWPATH):
2626         {
2627                 uint32  fw_path_len;
2628
2629                 fw_path_len = strlen(bus->fw_path);
2630                 DHD_INFO(("[softap] get fwpath, l=%d\n", len));
2631
2632                 if (fw_path_len > len-1) {
2633                         bcmerror = BCME_BUFTOOSHORT;
2634                         break;
2635                 }
2636
2637                 if (fw_path_len) {
2638                         bcopy(bus->fw_path, arg, fw_path_len);
2639                         ((uchar*)arg)[fw_path_len] = 0;
2640                 }
2641                 break;
2642         }
2643
2644         case IOV_SVAL(IOV_FWPATH):
2645                 DHD_INFO(("[softap] set fwpath, idx=%d\n", int_val));
2646
2647                 switch (int_val) {
2648                 case 1:
2649                         bus->fw_path = fw_path; /* ordinary one */
2650                         break;
2651                 case 2:
2652                         bus->fw_path = fw_path2;
2653                         break;
2654                 default:
2655                         bcmerror = BCME_BADARG;
2656                         break;
2657                 }
2658
2659                 DHD_INFO(("[softap] new fw path: %s\n", (bus->fw_path[0] ? bus->fw_path : "NULL")));
2660                 break;
2661
2662 #endif /* SOFTAP */
2663         case IOV_GVAL(IOV_DEVRESET):
2664                 DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
2665
2666                 /* Get its status */
2667                 int_val = (bool) bus->dhd->dongle_reset;
2668                 bcopy(&int_val, arg, val_size);
2669
2670                 break;
2671
2672         default:
2673                 bcmerror = BCME_UNSUPPORTED;
2674                 break;
2675         }
2676
2677 exit:
2678         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2679                 bus->activity = FALSE;
2680                 dhdsdio_clkctl(bus, CLK_NONE, TRUE);
2681         }
2682
2683         dhd_os_sdunlock(bus->dhd);
2684
2685         if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == FALSE)
2686                 dhd_preinit_ioctls((dhd_pub_t *) bus->dhd);
2687
2688         return bcmerror;
2689 }
2690
2691 static int
2692 dhdsdio_write_vars(dhd_bus_t *bus)
2693 {
2694         int bcmerror = 0;
2695         uint32 varsize;
2696         uint32 varaddr;
2697         uint8 *vbuffer;
2698         uint32 varsizew;
2699 #ifdef DHD_DEBUG
2700         uint8 *nvram_ularray;
2701 #endif /* DHD_DEBUG */
2702
2703         /* Even if there are no vars are to be written, we still need to set the ramsize. */
2704         varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
2705         varaddr = (bus->ramsize - 4) - varsize;
2706
2707         if (bus->vars) {
2708                 if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 7)) {
2709                         if (((varaddr & 0x3C) == 0x3C) && (varsize > 4)) {
2710                                 DHD_ERROR(("PR85623WAR in place\n"));
2711                                 varsize += 4;
2712                                 varaddr -= 4;
2713                         }
2714                 }
2715
2716                 vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
2717                 if (!vbuffer)
2718                         return BCME_NOMEM;
2719
2720                 bzero(vbuffer, varsize);
2721                 bcopy(bus->vars, vbuffer, bus->varsz);
2722
2723                 /* Write the vars list */
2724                 bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
2725 #ifdef DHD_DEBUG
2726                 /* Verify NVRAM bytes */
2727                 DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
2728                 nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
2729                 if (!nvram_ularray)
2730                         return BCME_NOMEM;
2731
2732                 /* Upload image to verify downloaded contents. */
2733                 memset(nvram_ularray, 0xaa, varsize);
2734
2735                 /* Read the vars list to temp buffer for comparison */
2736                 bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
2737                 if (bcmerror) {
2738                                 DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
2739                                         __FUNCTION__, bcmerror, varsize, varaddr));
2740                 }
2741                 /* Compare the org NVRAM with the one read from RAM */
2742                 if (memcmp(vbuffer, nvram_ularray, varsize)) {
2743                         DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
2744                 } else
2745                         DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
2746                         __FUNCTION__));
2747
2748                 MFREE(bus->dhd->osh, nvram_ularray, varsize);
2749 #endif /* DHD_DEBUG */
2750
2751                 MFREE(bus->dhd->osh, vbuffer, varsize);
2752         }
2753
2754         /* adjust to the user specified RAM */
2755         DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
2756                 bus->orig_ramsize, bus->ramsize));
2757         DHD_INFO(("Vars are at %d, orig varsize is %d\n",
2758                 varaddr, varsize));
2759         varsize = ((bus->orig_ramsize - 4) - varaddr);
2760
2761         /*
2762          * Determine the length token:
2763          * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
2764          */
2765         if (bcmerror) {
2766                 varsizew = 0;
2767         } else {
2768                 varsizew = varsize / 4;
2769                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
2770                 varsizew = htol32(varsizew);
2771         }
2772
2773         DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
2774
2775         /* Write the length token to the last word */
2776         bcmerror = dhdsdio_membytes(bus, TRUE, (bus->orig_ramsize - 4),
2777                 (uint8*)&varsizew, 4);
2778
2779         return bcmerror;
2780 }
2781
2782 static int
2783 dhdsdio_download_state(dhd_bus_t *bus, bool enter)
2784 {
2785         uint retries;
2786         int bcmerror = 0;
2787
2788         if (!bus->sih)
2789                 return BCME_ERROR;
2790
2791         /* To enter download state, disable ARM and reset SOCRAM.
2792          * To exit download state, simply reset ARM (default is RAM boot).
2793          */
2794         if (enter) {
2795                 bus->alp_only = TRUE;
2796
2797                 if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
2798                     !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
2799                         DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
2800                         bcmerror = BCME_ERROR;
2801                         goto fail;
2802                 }
2803
2804                 si_core_disable(bus->sih, 0);
2805                 if (bcmsdh_regfail(bus->sdh)) {
2806                         bcmerror = BCME_SDIO_ERROR;
2807                         goto fail;
2808                 }
2809
2810                 if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
2811                         DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
2812                         bcmerror = BCME_ERROR;
2813                         goto fail;
2814                 }
2815
2816                 si_core_reset(bus->sih, 0, 0);
2817                 if (bcmsdh_regfail(bus->sdh)) {
2818                         DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n", __FUNCTION__));
2819                         bcmerror = BCME_SDIO_ERROR;
2820                         goto fail;
2821                 }
2822
2823                 /* Clear the top bit of memory */
2824                 if (bus->ramsize) {
2825                         uint32 zeros = 0;
2826                         if (dhdsdio_membytes(bus, TRUE, bus->ramsize - 4, (uint8*)&zeros, 4) < 0) {
2827                                 bcmerror = BCME_SDIO_ERROR;
2828                                 goto fail;
2829                         }
2830                 }
2831         } else {
2832                 if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
2833                         DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
2834                         bcmerror = BCME_ERROR;
2835                         goto fail;
2836                 }
2837
2838                 if (!si_iscoreup(bus->sih)) {
2839                         DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
2840                         bcmerror = BCME_ERROR;
2841                         goto fail;
2842                 }
2843
2844                 if ((bcmerror = dhdsdio_write_vars(bus))) {
2845                         DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
2846                         goto fail;
2847                 }
2848
2849                 if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
2850                     !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
2851                         DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
2852                         bcmerror = BCME_ERROR;
2853                         goto fail;
2854                 }
2855                 W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
2856
2857
2858                 if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
2859                     !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
2860                         DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
2861                         bcmerror = BCME_ERROR;
2862                         goto fail;
2863                 }
2864
2865                 si_core_reset(bus->sih, 0, 0);
2866                 if (bcmsdh_regfail(bus->sdh)) {
2867                         DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
2868                         bcmerror = BCME_SDIO_ERROR;
2869                         goto fail;
2870                 }
2871
2872                 /* Allow HT Clock now that the ARM is running. */
2873                 bus->alp_only = FALSE;
2874
2875                 bus->dhd->busstate = DHD_BUS_LOAD;
2876         }
2877
2878 fail:
2879         /* Always return to SDIOD core */
2880         if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
2881                 si_setcore(bus->sih, SDIOD_CORE_ID, 0);
2882
2883         return bcmerror;
2884 }
2885
2886 int
2887 dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
2888                  void *params, int plen, void *arg, int len, bool set)
2889 {
2890         dhd_bus_t *bus = dhdp->bus;
2891         const bcm_iovar_t *vi = NULL;
2892         int bcmerror = 0;
2893         int val_size;
2894         uint32 actionid;
2895
2896         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
2897
2898         ASSERT(name);
2899         ASSERT(len >= 0);
2900
2901         /* Get MUST have return space */
2902         ASSERT(set || (arg && len));
2903
2904         /* Set does NOT take qualifiers */
2905         ASSERT(!set || (!params && !plen));
2906
2907         /* Look up var locally; if not found pass to host driver */
2908         if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
2909                 dhd_os_sdlock(bus->dhd);
2910
2911                 BUS_WAKE(bus);
2912
2913                 /* Turn on clock in case SD command needs backplane */
2914                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
2915
2916                 bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
2917
2918                 /* Check for bus configuration changes of interest */
2919
2920                 /* If it was divisor change, read the new one */
2921                 if (set && strcmp(name, "sd_divisor") == 0) {
2922                         if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
2923                                             &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
2924                                 bus->sd_divisor = -1;
2925                                 DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
2926                         } else {
2927                                 DHD_INFO(("%s: noted %s update, value now %d\n",
2928                                           __FUNCTION__, name, bus->sd_divisor));
2929                         }
2930                 }
2931                 /* If it was a mode change, read the new one */
2932                 if (set && strcmp(name, "sd_mode") == 0) {
2933                         if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
2934                                             &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
2935                                 bus->sd_mode = -1;
2936                                 DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
2937                         } else {
2938                                 DHD_INFO(("%s: noted %s update, value now %d\n",
2939                                           __FUNCTION__, name, bus->sd_mode));
2940                         }
2941                 }
2942                 /* Similar check for blocksize change */
2943                 if (set && strcmp(name, "sd_blocksize") == 0) {
2944                         int32 fnum = 2;
2945                         if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
2946                                             &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
2947                                 bus->blocksize = 0;
2948                                 DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
2949                         } else {
2950                                 DHD_INFO(("%s: noted %s update, value now %d\n",
2951                                           __FUNCTION__, "sd_blocksize", bus->blocksize));
2952                         }
2953                 }
2954                 bus->roundup = MIN(max_roundup, bus->blocksize);
2955
2956                 if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
2957                         bus->activity = FALSE;
2958                         dhdsdio_clkctl(bus, CLK_NONE, TRUE);
2959                 }
2960
2961                 dhd_os_sdunlock(bus->dhd);
2962                 goto exit;
2963         }
2964
2965         DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
2966                  name, (set ? "set" : "get"), len, plen));
2967
2968         /* set up 'params' pointer in case this is a set command so that
2969          * the convenience int and bool code can be common to set and get
2970          */
2971         if (params == NULL) {
2972                 params = arg;
2973                 plen = len;
2974         }
2975
2976         if (vi->type == IOVT_VOID)
2977                 val_size = 0;
2978         else if (vi->type == IOVT_BUFFER)
2979                 val_size = len;
2980         else
2981                 /* all other types are integer sized */
2982                 val_size = sizeof(int);
2983
2984         actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
2985         bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
2986
2987 exit:
2988         return bcmerror;
2989 }
2990
2991 void
2992 dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
2993 {
2994         osl_t *osh;
2995         uint32 local_hostintmask;
2996         uint8 saveclk;
2997         uint retries;
2998         int err;
2999         if (!bus->dhd)
3000                 return;
3001
3002         osh = bus->dhd->osh;
3003         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3004
3005         bcmsdh_waitlockfree(NULL);
3006
3007         if (enforce_mutex)
3008                 dhd_os_sdlock(bus->dhd);
3009
3010         BUS_WAKE(bus);
3011
3012         /* Change our idea of bus state */
3013         bus->dhd->busstate = DHD_BUS_DOWN;
3014
3015         /* Enable clock for device interrupts */
3016         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
3017
3018         /* Disable and clear interrupts at the chip level also */
3019         W_SDREG(0, &bus->regs->hostintmask, retries);
3020         local_hostintmask = bus->hostintmask;
3021         bus->hostintmask = 0;
3022
3023         /* Force clocks on backplane to be sure F2 interrupt propagates */
3024         saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
3025         if (!err) {
3026                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
3027                                  (saveclk | SBSDIO_FORCE_HT), &err);
3028         }
3029         if (err) {
3030                 DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
3031         }
3032
3033         /* Turn off the bus (F2), free any pending packets */
3034         DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
3035         bcmsdh_intr_disable(bus->sdh);
3036         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
3037
3038         /* Clear any pending interrupts now that F2 is disabled */
3039         W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
3040
3041         /* Turn off the backplane clock (only) */
3042         dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
3043
3044         /* Clear the data packet queues */
3045         pktq_flush(osh, &bus->txq, TRUE, NULL, 0);
3046
3047         /* Clear any held glomming stuff */
3048         if (bus->glomd)
3049                 PKTFREE(osh, bus->glomd, FALSE);
3050
3051         if (bus->glom)
3052                 PKTFREE(osh, bus->glom, FALSE);
3053
3054         bus->glom = bus->glomd = NULL;
3055
3056         /* Clear rx control and wake any waiters */
3057         bus->rxlen = 0;
3058         dhd_os_ioctl_resp_wake(bus->dhd);
3059
3060         /* Reset some F2 state stuff */
3061         bus->rxskip = FALSE;
3062         bus->tx_seq = bus->rx_seq = 0;
3063
3064         /* Set to a safe default.  It gets updated when we
3065          * receive a packet from the fw but when we reset,
3066          * we need a safe default to be able to send the
3067          * initial mac address.
3068          */
3069         bus->tx_max = 4;
3070
3071         if (enforce_mutex)
3072                 dhd_os_sdunlock(bus->dhd);
3073 }
3074
3075
3076 int
3077 dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
3078 {
3079         dhd_bus_t *bus = dhdp->bus;
3080         dhd_timeout_t tmo;
3081         uint retries = 0;
3082         uint8 ready, enable;
3083         int err, ret = 0;
3084         uint8 saveclk;
3085
3086         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3087
3088         ASSERT(bus->dhd);
3089         if (!bus->dhd)
3090                 return 0;
3091
3092         if (enforce_mutex)
3093                 dhd_os_sdlock(bus->dhd);
3094
3095         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3096         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
3097         if (bus->clkstate != CLK_AVAIL) {
3098                 DHD_ERROR(("%s: clock state is wrong. state = %d\n", __FUNCTION__, bus->clkstate));
3099                 goto exit;
3100         }
3101
3102
3103         /* Force clocks on backplane to be sure F2 interrupt propagates */
3104         saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
3105         if (!err) {
3106                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
3107                                  (saveclk | SBSDIO_FORCE_HT), &err);
3108         }
3109         if (err) {
3110                 DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
3111                 goto exit;
3112         }
3113
3114         /* Enable function 2 (frame transfers) */
3115         W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
3116                 &bus->regs->tosbmailboxdata, retries);
3117         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3118
3119         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
3120
3121         /* Give the dongle some time to do its thing and set IOR2 */
3122         dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
3123
3124         ready = 0;
3125         while (ready != enable && !dhd_timeout_expired(&tmo))
3126                 ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
3127
3128
3129         DHD_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
3130                   __FUNCTION__, enable, ready, tmo.elapsed));
3131
3132
3133         /* If F2 successfully enabled, set core and enable interrupts */
3134         if (ready == enable) {
3135                 /* Make sure we're talking to the core. */
3136                 if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
3137                         bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
3138                 ASSERT(bus->regs != NULL);
3139
3140                 /* Set up the interrupt mask and enable interrupts */
3141                 bus->hostintmask = HOSTINTMASK;
3142                 /* corerev 4 could use the newer interrupt logic to detect the frames */
3143                 if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 4) &&
3144                         (bus->rxint_mode != SDIO_DEVICE_HMB_RXINT)) {
3145                         bus->hostintmask &= ~I_HMB_FRAME_IND;
3146                         bus->hostintmask |= I_XMTDATA_AVAIL;
3147                 }
3148                 W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
3149
3150                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, &err);
3151
3152                 /* Set bus state according to enable result */
3153                 dhdp->busstate = DHD_BUS_DATA;
3154
3155                 /* bcmsdh_intr_unmask(bus->sdh); */
3156
3157                 bus->intdis = FALSE;
3158                 if (bus->intr) {
3159                         DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
3160                         bcmsdh_intr_enable(bus->sdh);
3161                 } else {
3162                         DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
3163                         bcmsdh_intr_disable(bus->sdh);
3164                 }
3165
3166         }
3167
3168
3169         else {
3170                 /* Disable F2 again */
3171                 enable = SDIO_FUNC_ENABLE_1;
3172                 bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
3173         }
3174
3175         /* Restore previous clock setting */
3176         bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3177
3178
3179         /* If we didn't come up, turn off backplane clock */
3180         if (dhdp->busstate != DHD_BUS_DATA)
3181                 dhdsdio_clkctl(bus, CLK_NONE, FALSE);
3182
3183 exit:
3184         if (enforce_mutex)
3185                 dhd_os_sdunlock(bus->dhd);
3186
3187         return ret;
3188 }
3189
3190 static void
3191 dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
3192 {
3193         bcmsdh_info_t *sdh = bus->sdh;
3194         sdpcmd_regs_t *regs = bus->regs;
3195         uint retries = 0;
3196         uint16 lastrbc;
3197         uint8 hi, lo;
3198         int err;
3199
3200         DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
3201                    (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
3202
3203         if (abort) {
3204                 bcmsdh_abort(sdh, SDIO_FUNC_2);
3205         }
3206
3207         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
3208         bus->f1regdata++;
3209
3210         /* Wait until the packet has been flushed (device/FIFO stable) */
3211         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
3212                 hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
3213                 lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, NULL);
3214                 bus->f1regdata += 2;
3215
3216                 if ((hi == 0) && (lo == 0))
3217                         break;
3218
3219                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
3220                         DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
3221                                    __FUNCTION__, lastrbc, ((hi << 8) + lo)));
3222                 }
3223                 lastrbc = (hi << 8) + lo;
3224         }
3225
3226         if (!retries) {
3227                 DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
3228         } else {
3229                 DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
3230         }
3231
3232         if (rtx) {
3233                 bus->rxrtx++;
3234                 W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
3235                 bus->f1regdata++;
3236                 if (retries <= retry_limit) {
3237                         bus->rxskip = TRUE;
3238                 }
3239         }
3240
3241         /* Clear partial in any case */
3242         bus->nextlen = 0;
3243
3244         /* If we can't reach the device, signal failure */
3245         if (err || bcmsdh_regfail(sdh))
3246                 bus->dhd->busstate = DHD_BUS_DOWN;
3247 }
3248
3249 static void
3250 dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
3251 {
3252         bcmsdh_info_t *sdh = bus->sdh;
3253         uint rdlen, pad;
3254
3255         int sdret;
3256
3257         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3258
3259         /* Control data already received in aligned rxctl */
3260         if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
3261                 goto gotpkt;
3262
3263         ASSERT(bus->rxbuf);
3264         /* Set rxctl for frame (w/optional alignment) */
3265         bus->rxctl = bus->rxbuf;
3266         if (dhd_alignctl) {
3267                 bus->rxctl += firstread;
3268                 if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
3269                         bus->rxctl += (DHD_SDALIGN - pad);
3270                 bus->rxctl -= firstread;
3271         }
3272         ASSERT(bus->rxctl >= bus->rxbuf);
3273
3274         /* Copy the already-read portion over */
3275         bcopy(hdr, bus->rxctl, firstread);
3276         if (len <= firstread)
3277                 goto gotpkt;
3278
3279         /* Copy the full data pkt in gSPI case and process ioctl. */
3280         if (bus->bus == SPI_BUS) {
3281                 bcopy(hdr, bus->rxctl, len);
3282                 goto gotpkt;
3283         }
3284
3285         /* Raise rdlen to next SDIO block to avoid tail command */
3286         rdlen = len - firstread;
3287         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
3288                 pad = bus->blocksize - (rdlen % bus->blocksize);
3289                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3290                     ((len + pad) < bus->dhd->maxctl))
3291                         rdlen += pad;
3292         } else if (rdlen % DHD_SDALIGN) {
3293                 rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
3294         }
3295
3296         /* Satisfy length-alignment requirements */
3297         if (forcealign && (rdlen & (ALIGNMENT - 1)))
3298                 rdlen = ROUNDUP(rdlen, ALIGNMENT);
3299
3300         /* Drop if the read is too big or it exceeds our maximum */
3301         if ((rdlen + firstread) > bus->dhd->maxctl) {
3302                 DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
3303                            __FUNCTION__, rdlen, bus->dhd->maxctl));
3304                 bus->dhd->rx_errors++;
3305                 dhdsdio_rxfail(bus, FALSE, FALSE);
3306                 goto done;
3307         }
3308
3309         if ((len - doff) > bus->dhd->maxctl) {
3310                 DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
3311                            __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
3312                 bus->dhd->rx_errors++; bus->rx_toolong++;
3313                 dhdsdio_rxfail(bus, FALSE, FALSE);
3314                 goto done;
3315         }
3316
3317
3318         /* Read remainder of frame body into the rxctl buffer */
3319         sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
3320                                     (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
3321         bus->f2rxdata++;
3322         ASSERT(sdret != BCME_PENDING);
3323
3324         /* Control frame failures need retransmission */
3325         if (sdret < 0) {
3326                 DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
3327                 bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
3328                 dhdsdio_rxfail(bus, TRUE, TRUE);
3329                 goto done;
3330         }
3331
3332 gotpkt:
3333
3334 #ifdef DHD_DEBUG
3335         if (DHD_BYTES_ON() && DHD_CTL_ON()) {
3336                 prhex("RxCtrl", bus->rxctl, len);
3337         }
3338 #endif
3339
3340         /* Point to valid data and indicate its length */
3341         bus->rxctl += doff;
3342         bus->rxlen = len - doff;
3343
3344 done:
3345         /* Awake any waiters */
3346         dhd_os_ioctl_resp_wake(bus->dhd);
3347 }
3348
3349 static uint8
3350 dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
3351 {
3352         uint16 dlen, totlen;
3353         uint8 *dptr, num = 0;
3354
3355         uint16 sublen, check;
3356         void *pfirst, *plast, *pnext, *save_pfirst;
3357         osl_t *osh = bus->dhd->osh;
3358
3359         int errcode;
3360         uint8 chan, seq, doff, sfdoff;
3361         uint8 txmax;
3362
3363         int ifidx = 0;
3364         bool usechain = bus->use_rxchain;
3365
3366         /* If packets, issue read(s) and send up packet chain */
3367         /* Return sequence numbers consumed? */
3368
3369         DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
3370
3371         /* If there's a descriptor, generate the packet chain */
3372         if (bus->glomd) {
3373                 dhd_os_sdlock_rxq(bus->dhd);
3374
3375                 pfirst = plast = pnext = NULL;
3376                 dlen = (uint16)PKTLEN(osh, bus->glomd);
3377                 dptr = PKTDATA(osh, bus->glomd);
3378                 if (!dlen || (dlen & 1)) {
3379                         DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
3380                                    __FUNCTION__, dlen));
3381                         dlen = 0;
3382                 }
3383
3384                 for (totlen = num = 0; dlen; num++) {
3385                         /* Get (and move past) next length */
3386                         sublen = ltoh16_ua(dptr);
3387                         dlen -= sizeof(uint16);
3388                         dptr += sizeof(uint16);
3389                         if ((sublen < SDPCM_HDRLEN) ||
3390                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
3391                                 DHD_ERROR(("%s: descriptor len %d bad: %d\n",
3392                                            __FUNCTION__, num, sublen));
3393                                 pnext = NULL;
3394                                 break;
3395                         }
3396                         if (sublen % DHD_SDALIGN) {
3397                                 DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
3398                                            __FUNCTION__, sublen, DHD_SDALIGN));
3399                                 usechain = FALSE;
3400                         }
3401                         totlen += sublen;
3402
3403                         /* For last frame, adjust read len so total is a block multiple */
3404                         if (!dlen) {
3405                                 sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
3406                                 totlen = ROUNDUP(totlen, bus->blocksize);
3407                         }
3408
3409                         /* Allocate/chain packet for next subframe */
3410                         if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
3411                                 DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
3412                                            __FUNCTION__, num, sublen));
3413                                 break;
3414                         }
3415                         ASSERT(!PKTLINK(pnext));
3416                         if (!pfirst) {
3417                                 ASSERT(!plast);
3418                                 pfirst = plast = pnext;
3419                         } else {
3420                                 ASSERT(plast);
3421                                 PKTSETNEXT(osh, plast, pnext);
3422                                 plast = pnext;
3423                         }
3424
3425                         /* Adhere to start alignment requirements */
3426                         PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
3427                 }
3428
3429                 /* If all allocations succeeded, save packet chain in bus structure */
3430                 if (pnext) {
3431                         DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
3432                                   __FUNCTION__, totlen, num));
3433                         if (DHD_GLOM_ON() && bus->nextlen) {
3434                                 if (totlen != bus->nextlen) {
3435                                         DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
3436                                                   "rxseq %d\n", __FUNCTION__, bus->nextlen,
3437                                                   totlen, rxseq));
3438                                 }
3439                         }
3440                         bus->glom = pfirst;
3441                         pfirst = pnext = NULL;
3442                 } else {
3443                         if (pfirst)
3444                                 PKTFREE(osh, pfirst, FALSE);
3445                         bus->glom = NULL;
3446                         num = 0;
3447                 }
3448
3449                 /* Done with descriptor packet */
3450                 PKTFREE(osh, bus->glomd, FALSE);
3451                 bus->glomd = NULL;
3452                 bus->nextlen = 0;
3453
3454                 dhd_os_sdunlock_rxq(bus->dhd);
3455         }
3456
3457         /* Ok -- either we just generated a packet chain, or had one from before */
3458         if (bus->glom) {
3459                 if (DHD_GLOM_ON()) {
3460                         DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
3461                         for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
3462                                 DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
3463                                           pnext, (uint8*)PKTDATA(osh, pnext),
3464                                           PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
3465                         }
3466                 }
3467
3468                 pfirst = bus->glom;
3469                 dlen = (uint16)pkttotlen(osh, pfirst);
3470
3471                 /* Do an SDIO read for the superframe.  Configurable iovar to
3472                  * read directly into the chained packet, or allocate a large
3473                  * packet and and copy into the chain.
3474                  */
3475                 if (usechain) {
3476                         errcode = dhd_bcmsdh_recv_buf(bus,
3477                                                       bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
3478                                                       F2SYNC, (uint8*)PKTDATA(osh, pfirst),
3479                                                       dlen, pfirst, NULL, NULL);
3480                 } else if (bus->dataptr) {
3481                         errcode = dhd_bcmsdh_recv_buf(bus,
3482                                                       bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
3483                                                       F2SYNC, bus->dataptr,
3484                                                       dlen, NULL, NULL, NULL);
3485                         sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
3486                         if (sublen != dlen) {
3487                                 DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
3488                                            __FUNCTION__, dlen, sublen));
3489                                 errcode = -1;
3490                         }
3491                         pnext = NULL;
3492                 } else {
3493                         DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
3494                         errcode = -1;
3495                 }
3496                 bus->f2rxdata++;
3497                 ASSERT(errcode != BCME_PENDING);
3498
3499                 /* On failure, kill the superframe, allow a couple retries */
3500                 if (errcode < 0) {
3501                         DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
3502                                    __FUNCTION__, dlen, errcode));
3503                         bus->dhd->rx_errors++;
3504
3505                         if (bus->glomerr++ < 3) {
3506                                 dhdsdio_rxfail(bus, TRUE, TRUE);
3507                         } else {
3508                                 bus->glomerr = 0;
3509                                 dhdsdio_rxfail(bus, TRUE, FALSE);
3510                                 dhd_os_sdlock_rxq(bus->dhd);
3511                                 PKTFREE(osh, bus->glom, FALSE);
3512                                 dhd_os_sdunlock_rxq(bus->dhd);
3513                                 bus->rxglomfail++;
3514                                 bus->glom = NULL;
3515                         }
3516                         return 0;
3517                 }
3518
3519 #ifdef DHD_DEBUG
3520                 if (DHD_GLOM_ON()) {
3521                         prhex("SUPERFRAME", PKTDATA(osh, pfirst),
3522                               MIN(PKTLEN(osh, pfirst), 48));
3523                 }
3524 #endif
3525
3526
3527                 /* Validate the superframe header */
3528                 dptr = (uint8 *)PKTDATA(osh, pfirst);
3529                 sublen = ltoh16_ua(dptr);
3530                 check = ltoh16_ua(dptr + sizeof(uint16));
3531
3532                 chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3533                 seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3534                 bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3535                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3536                         DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
3537                                   __FUNCTION__, bus->nextlen, seq));
3538                         bus->nextlen = 0;
3539                 }
3540                 doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3541                 txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3542
3543                 errcode = 0;
3544                 if ((uint16)~(sublen^check)) {
3545                         DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
3546                                    __FUNCTION__, sublen, check));
3547                         errcode = -1;
3548                 } else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
3549                         DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
3550                                    __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
3551                         errcode = -1;
3552                 } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
3553                         DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
3554                                    SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
3555                         errcode = -1;
3556                 } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
3557                         DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
3558                         errcode = -1;
3559                 } else if ((doff < SDPCM_HDRLEN) ||
3560                            (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
3561                         DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
3562                                    __FUNCTION__, doff, sublen, PKTLEN(osh, pfirst), SDPCM_HDRLEN));
3563                         errcode = -1;
3564                 }
3565
3566                 /* Check sequence number of superframe SW header */
3567                 if (rxseq != seq) {
3568                         DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
3569                                   __FUNCTION__, seq, rxseq));
3570                         bus->rx_badseq++;
3571                         rxseq = seq;
3572                 }
3573
3574                 /* Check window for sanity */
3575                 if ((uint8)(txmax - bus->tx_seq) > 0x40) {
3576                         DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
3577                                    __FUNCTION__, txmax, bus->tx_seq));
3578                         txmax = bus->tx_max;
3579                 }
3580                 bus->tx_max = txmax;
3581
3582                 /* Remove superframe header, remember offset */
3583                 PKTPULL(osh, pfirst, doff);
3584                 sfdoff = doff;
3585
3586                 /* Validate all the subframe headers */
3587                 for (num = 0, pnext = pfirst; pnext && !errcode;
3588                      num++, pnext = PKTNEXT(osh, pnext)) {
3589                         dptr = (uint8 *)PKTDATA(osh, pnext);
3590                         dlen = (uint16)PKTLEN(osh, pnext);
3591                         sublen = ltoh16_ua(dptr);
3592                         check = ltoh16_ua(dptr + sizeof(uint16));
3593                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3594                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3595 #ifdef DHD_DEBUG
3596                         if (DHD_GLOM_ON()) {
3597                                 prhex("subframe", dptr, 32);
3598                         }
3599 #endif
3600
3601                         if ((uint16)~(sublen^check)) {
3602                                 DHD_ERROR(("%s (subframe %d): HW hdr error: "
3603                                            "len/check 0x%04x/0x%04x\n",
3604                                            __FUNCTION__, num, sublen, check));
3605                                 errcode = -1;
3606                         } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
3607                                 DHD_ERROR(("%s (subframe %d): length mismatch: "
3608                                            "len 0x%04x, expect 0x%04x\n",
3609                                            __FUNCTION__, num, sublen, dlen));
3610                                 errcode = -1;
3611                         } else if ((chan != SDPCM_DATA_CHANNEL) &&
3612                                    (chan != SDPCM_EVENT_CHANNEL)) {
3613                                 DHD_ERROR(("%s (subframe %d): bad channel %d\n",
3614                                            __FUNCTION__, num, chan));
3615                                 errcode = -1;
3616                         } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
3617                                 DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
3618                                            __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
3619                                 errcode = -1;
3620                         }
3621                 }
3622
3623                 if (errcode) {
3624                         /* Terminate frame on error, request a couple retries */
3625                         if (bus->glomerr++ < 3) {
3626                                 /* Restore superframe header space */
3627                                 PKTPUSH(osh, pfirst, sfdoff);
3628                                 dhdsdio_rxfail(bus, TRUE, TRUE);
3629                         } else {
3630                                 bus->glomerr = 0;
3631                                 dhdsdio_rxfail(bus, TRUE, FALSE);
3632                                 dhd_os_sdlock_rxq(bus->dhd);
3633                                 PKTFREE(osh, bus->glom, FALSE);
3634                                 dhd_os_sdunlock_rxq(bus->dhd);
3635                                 bus->rxglomfail++;
3636                                 bus->glom = NULL;
3637                         }
3638                         bus->nextlen = 0;
3639                         return 0;
3640                 }
3641
3642                 /* Basic SD framing looks ok - process each packet (header) */
3643                 save_pfirst = pfirst;
3644                 bus->glom = NULL;
3645                 plast = NULL;
3646
3647                 dhd_os_sdlock_rxq(bus->dhd);
3648                 for (num = 0; pfirst; rxseq++, pfirst = pnext) {
3649                         pnext = PKTNEXT(osh, pfirst);
3650                         PKTSETNEXT(osh, pfirst, NULL);
3651
3652                         dptr = (uint8 *)PKTDATA(osh, pfirst);
3653                         sublen = ltoh16_ua(dptr);
3654                         chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
3655                         seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
3656                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
3657
3658                         DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
3659                                   __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
3660                                   PKTLEN(osh, pfirst), sublen, chan, seq));
3661
3662                         ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
3663
3664                         if (rxseq != seq) {
3665                                 DHD_GLOM(("%s: rx_seq %d, expected %d\n",
3666                                           __FUNCTION__, seq, rxseq));
3667                                 bus->rx_badseq++;
3668                                 rxseq = seq;
3669                         }
3670
3671 #ifdef DHD_DEBUG
3672                         if (DHD_BYTES_ON() && DHD_DATA_ON()) {
3673                                 prhex("Rx Subframe Data", dptr, dlen);
3674                         }
3675 #endif
3676
3677                         PKTSETLEN(osh, pfirst, sublen);
3678                         PKTPULL(osh, pfirst, doff);
3679
3680                         if (PKTLEN(osh, pfirst) == 0) {
3681                                 PKTFREE(bus->dhd->osh, pfirst, FALSE);
3682                                 if (plast) {
3683                                         PKTSETNEXT(osh, plast, pnext);
3684                                 } else {
3685                                         ASSERT(save_pfirst == pfirst);
3686                                         save_pfirst = pnext;
3687                                 }
3688                                 continue;
3689                         } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst) != 0) {
3690                                 DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
3691                                 bus->dhd->rx_errors++;
3692                                 PKTFREE(osh, pfirst, FALSE);
3693                                 if (plast) {
3694                                         PKTSETNEXT(osh, plast, pnext);
3695                                 } else {
3696                                         ASSERT(save_pfirst == pfirst);
3697                                         save_pfirst = pnext;
3698                                 }
3699                                 continue;
3700                         }
3701
3702                         /* this packet will go up, link back into chain and count it */
3703                         PKTSETNEXT(osh, pfirst, pnext);
3704                         plast = pfirst;
3705                         num++;
3706
3707 #ifdef DHD_DEBUG
3708                         if (DHD_GLOM_ON()) {
3709                                 DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
3710                                           __FUNCTION__, num, pfirst,
3711                                           PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
3712                                           PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
3713                                 prhex("", (uint8 *)PKTDATA(osh, pfirst),
3714                                       MIN(PKTLEN(osh, pfirst), 32));
3715                         }
3716 #endif /* DHD_DEBUG */
3717                 }
3718                 dhd_os_sdunlock_rxq(bus->dhd);
3719                 if (num) {
3720                         dhd_os_sdunlock(bus->dhd);
3721                         dhd_rx_frame(bus->dhd, ifidx, save_pfirst, num, 0);
3722                         dhd_os_sdlock(bus->dhd);
3723                 }
3724
3725                 bus->rxglomframes++;
3726                 bus->rxglompkts += num;
3727         }
3728         return num;
3729 }
3730
3731 /* Return TRUE if there may be more frames to read */
3732 static uint
3733 dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
3734 {
3735         osl_t *osh = bus->dhd->osh;
3736         bcmsdh_info_t *sdh = bus->sdh;
3737
3738         uint16 len, check;      /* Extracted hardware header fields */
3739         uint8 chan, seq, doff;  /* Extracted software header fields */
3740         uint8 fcbits;           /* Extracted fcbits from software header */
3741         uint8 delta;
3742
3743         void *pkt;      /* Packet for event or data frames */
3744         uint16 pad;     /* Number of pad bytes to read */
3745         uint16 rdlen;   /* Total number of bytes to read */
3746         uint8 rxseq;    /* Next sequence number to expect */
3747         uint rxleft = 0;        /* Remaining number of frames allowed */
3748         int sdret;      /* Return code from bcmsdh calls */
3749         uint8 txmax;    /* Maximum tx sequence offered */
3750         bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
3751         uint8 *rxbuf;
3752         int ifidx = 0;
3753         uint rxcount = 0; /* Total frames read */
3754
3755 #if defined(DHD_DEBUG) || defined(SDTEST)
3756         bool sdtest = FALSE;    /* To limit message spew from test mode */
3757 #endif
3758
3759         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
3760
3761         ASSERT(maxframes);
3762
3763 #ifdef SDTEST
3764         /* Allow pktgen to override maxframes */
3765         if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
3766                 maxframes = bus->pktgen_count;
3767                 sdtest = TRUE;
3768         }
3769 #endif
3770
3771         /* Not finished unless we encounter no more frames indication */
3772         *finished = FALSE;
3773
3774
3775         for (rxseq = bus->rx_seq, rxleft = maxframes;
3776              !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
3777              rxseq++, rxleft--) {
3778
3779 #ifdef DHDTHREAD
3780                 /* tx more to improve rx performance */
3781                 if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
3782                         pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) {
3783                         dhdsdio_sendfromq(bus, dhd_txbound);
3784                 }
3785 #endif /* DHDTHREAD */
3786
3787                 /* Handle glomming separately */
3788                 if (bus->glom || bus->glomd) {
3789                         uint8 cnt;
3790                         DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
3791                                   __FUNCTION__, bus->glomd, bus->glom));
3792                         cnt = dhdsdio_rxglom(bus, rxseq);
3793                         DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
3794                         rxseq += cnt - 1;
3795                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
3796                         continue;
3797                 }
3798
3799                 /* Try doing single read if we can */
3800                 if (dhd_readahead && bus->nextlen) {
3801                         uint16 nextlen = bus->nextlen;
3802                         bus->nextlen = 0;
3803
3804                         if (bus->bus == SPI_BUS) {
3805                                 rdlen = len = nextlen;
3806                         }
3807                         else {
3808                                 rdlen = len = nextlen << 4;
3809
3810                                 /* Pad read to blocksize for efficiency */
3811                                 if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
3812                                         pad = bus->blocksize - (rdlen % bus->blocksize);
3813                                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
3814                                                 ((rdlen + pad + firstread) < MAX_RX_DATASZ))
3815                                                 rdlen += pad;
3816                                 } else if (rdlen % DHD_SDALIGN) {
3817                                         rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
3818                                 }
3819                         }
3820
3821                         /* We use bus->rxctl buffer in WinXP for initial control pkt receives.
3822                          * Later we use buffer-poll for data as well as control packets.
3823                          * This is required because dhd receives full frame in gSPI unlike SDIO.
3824                          * After the frame is received we have to distinguish whether it is data
3825                          * or non-data frame.
3826                          */
3827                         /* Allocate a packet buffer */
3828                         dhd_os_sdlock_rxq(bus->dhd);
3829                         if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
3830                                 if (bus->bus == SPI_BUS) {
3831                                         bus->usebufpool = FALSE;
3832                                         bus->rxctl = bus->rxbuf;
3833                                         if (dhd_alignctl) {
3834                                                 bus->rxctl += firstread;
3835                                                 if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
3836                                                         bus->rxctl += (DHD_SDALIGN - pad);
3837                                                 bus->rxctl -= firstread;
3838                                         }
3839                                         ASSERT(bus->rxctl >= bus->rxbuf);
3840                                         rxbuf = bus->rxctl;
3841                                         /* Read the entire frame */
3842                                         sdret = dhd_bcmsdh_recv_buf(bus,
3843                                                                     bcmsdh_cur_sbwad(sdh),
3844                                                                     SDIO_FUNC_2,
3845                                                                     F2SYNC, rxbuf, rdlen,
3846                                                                     NULL, NULL, NULL);
3847                                         bus->f2rxdata++;
3848                                         ASSERT(sdret != BCME_PENDING);
3849
3850
3851                                         /* Control frame failures need retransmission */
3852                                         if (sdret < 0) {
3853                                                 DHD_ERROR(("%s: read %d control bytes failed: %d\n",
3854                                                    __FUNCTION__, rdlen, sdret));
3855                                                 /* dhd.rx_ctlerrs is higher level */
3856                                                 bus->rxc_errors++;
3857                                                 dhd_os_sdunlock_rxq(bus->dhd);
3858                                                 dhdsdio_rxfail(bus, TRUE,
3859                                                     (bus->bus == SPI_BUS) ? FALSE : TRUE);
3860                                                 continue;
3861                                         }
3862                                 } else {
3863                                         /* Give up on data, request rtx of events */
3864                                         DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
3865                                                    "expected rxseq %d\n",
3866                                                    __FUNCTION__, len, rdlen, rxseq));
3867                                         /* Just go try again w/normal header read */
3868                                         dhd_os_sdunlock_rxq(bus->dhd);
3869                                         continue;
3870                                 }
3871                         } else {
3872                                 if (bus->bus == SPI_BUS)
3873                                         bus->usebufpool = TRUE;
3874
3875                                 ASSERT(!PKTLINK(pkt));
3876                                 PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
3877                                 rxbuf = (uint8 *)PKTDATA(osh, pkt);
3878                                 /* Read the entire frame */
3879                                 sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
3880                                                             SDIO_FUNC_2,
3881                                                             F2SYNC, rxbuf, rdlen,
3882                                                             pkt, NULL, NULL);
3883                                 bus->f2rxdata++;
3884                                 ASSERT(sdret != BCME_PENDING);
3885
3886                                 if (sdret < 0) {
3887                                         DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
3888                                            __FUNCTION__, rdlen, sdret));
3889                                         PKTFREE(bus->dhd->osh, pkt, FALSE);
3890                                         bus->dhd->rx_errors++;
3891                                         dhd_os_sdunlock_rxq(bus->dhd);
3892                                         /* Force retry w/normal header read.  Don't attempt NAK for
3893                                          * gSPI
3894                                          */
3895                                         dhdsdio_rxfail(bus, TRUE,
3896                                               (bus->bus == SPI_BUS) ? FALSE : TRUE);
3897                                         continue;
3898                                 }
3899                         }
3900                         dhd_os_sdunlock_rxq(bus->dhd);
3901
3902                         /* Now check the header */
3903                         bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
3904
3905                         /* Extract hardware header fields */
3906                         len = ltoh16_ua(bus->rxhdr);
3907                         check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
3908
3909                         /* All zeros means readahead info was bad */
3910                         if (!(len|check)) {
3911                                 DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
3912                                            __FUNCTION__));
3913                                 dhd_os_sdlock_rxq(bus->dhd);
3914                                 PKTFREE2();
3915                                 dhd_os_sdunlock_rxq(bus->dhd);
3916                                 GSPI_PR55150_BAILOUT;
3917                                 continue;
3918                         }
3919
3920                         /* Validate check bytes */
3921                         if ((uint16)~(len^check)) {
3922                                 DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
3923                                            " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
3924                                            len, check));
3925                                 dhd_os_sdlock_rxq(bus->dhd);
3926                                 PKTFREE2();
3927                                 dhd_os_sdunlock_rxq(bus->dhd);
3928                                 bus->rx_badhdr++;
3929                                 dhdsdio_rxfail(bus, FALSE, FALSE);
3930                                 GSPI_PR55150_BAILOUT;
3931                                 continue;
3932                         }
3933
3934                         /* Validate frame length */
3935                         if (len < SDPCM_HDRLEN) {
3936                                 DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
3937                                            __FUNCTION__, len));
3938                                 dhd_os_sdlock_rxq(bus->dhd);
3939                                 PKTFREE2();
3940                                 dhd_os_sdunlock_rxq(bus->dhd);
3941                                 GSPI_PR55150_BAILOUT;
3942                                 continue;
3943                         }
3944
3945                         /* Check for consistency with readahead info */
3946                                 len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
3947                         if (len_consistent) {
3948                                 /* Mismatch, force retry w/normal header (may be >4K) */
3949                                 DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
3950                                            "expected rxseq %d\n",
3951                                            __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
3952                                 dhd_os_sdlock_rxq(bus->dhd);
3953                                 PKTFREE2();
3954                                 dhd_os_sdunlock_rxq(bus->dhd);
3955                                 dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
3956                                 GSPI_PR55150_BAILOUT;
3957                                 continue;
3958                         }
3959
3960
3961                         /* Extract software header fields */
3962                         chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3963                         seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3964                         doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3965                         txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3966
3967                                 bus->nextlen =
3968                                          bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
3969                                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
3970                                         DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
3971                                                   " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
3972                                                   seq));
3973                                         bus->nextlen = 0;
3974                                 }
3975
3976                                 bus->dhd->rx_readahead_cnt ++;
3977                         /* Handle Flow Control */
3978                         fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
3979
3980                         delta = 0;
3981                         if (~bus->flowcontrol & fcbits) {
3982                                 bus->fc_xoff++;
3983                                 delta = 1;
3984                         }
3985                         if (bus->flowcontrol & ~fcbits) {
3986                                 bus->fc_xon++;
3987                                 delta = 1;
3988                         }
3989
3990                         if (delta) {
3991                                 bus->fc_rcvd++;
3992                                 bus->flowcontrol = fcbits;
3993                         }
3994
3995                         /* Check and update sequence number */
3996                         if (rxseq != seq) {
3997                                 DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
3998                                           __FUNCTION__, seq, rxseq));
3999                                 bus->rx_badseq++;
4000                                 rxseq = seq;
4001                         }
4002
4003                         /* Check window for sanity */
4004                         if ((uint8)(txmax - bus->tx_seq) > 0x40) {
4005                                         DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
4006                                                 __FUNCTION__, txmax, bus->tx_seq));
4007                                         txmax = bus->tx_max;
4008                         }
4009                         bus->tx_max = txmax;
4010
4011 #ifdef DHD_DEBUG
4012                         if (DHD_BYTES_ON() && DHD_DATA_ON()) {
4013                                 prhex("Rx Data", rxbuf, len);
4014                         } else if (DHD_HDRS_ON()) {
4015                                 prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
4016                         }
4017 #endif
4018
4019                         if (chan == SDPCM_CONTROL_CHANNEL) {
4020                                 if (bus->bus == SPI_BUS) {
4021                                         dhdsdio_read_control(bus, rxbuf, len, doff);
4022                                         if (bus->usebufpool) {
4023                                                 dhd_os_sdlock_rxq(bus->dhd);
4024                                                 PKTFREE(bus->dhd->osh, pkt, FALSE);
4025                                                 dhd_os_sdunlock_rxq(bus->dhd);
4026                                         }
4027                                         continue;
4028                                 } else {
4029                                         DHD_ERROR(("%s (nextlen): readahead on control"
4030                                                    " packet %d?\n", __FUNCTION__, seq));
4031                                         /* Force retry w/normal header read */
4032                                         bus->nextlen = 0;
4033                                         dhdsdio_rxfail(bus, FALSE, TRUE);
4034                                         dhd_os_sdlock_rxq(bus->dhd);
4035                                         PKTFREE2();
4036                                         dhd_os_sdunlock_rxq(bus->dhd);
4037                                         continue;
4038                                 }
4039                         }
4040
4041                         if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
4042                                 DHD_ERROR(("Received %d bytes on %d channel. Running out of "
4043                                            "rx pktbuf's or not yet malloced.\n", len, chan));
4044                                 continue;
4045                         }
4046
4047                         /* Validate data offset */
4048                         if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4049                                 DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
4050                                            __FUNCTION__, doff, len, SDPCM_HDRLEN));
4051                                 dhd_os_sdlock_rxq(bus->dhd);
4052                                 PKTFREE2();
4053                                 dhd_os_sdunlock_rxq(bus->dhd);
4054                                 ASSERT(0);
4055                                 dhdsdio_rxfail(bus, FALSE, FALSE);
4056                                 continue;
4057                         }
4058
4059                         /* All done with this one -- now deliver the packet */
4060                         goto deliver;
4061                 }
4062                 /* gSPI frames should not be handled in fractions */
4063                 if (bus->bus == SPI_BUS) {
4064                         break;
4065                 }
4066
4067                 /* Read frame header (hardware and software) */
4068                 sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
4069                                             bus->rxhdr, firstread, NULL, NULL, NULL);
4070                 bus->f2rxhdrs++;
4071                 ASSERT(sdret != BCME_PENDING);
4072
4073                 if (sdret < 0) {
4074                         DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
4075                         bus->rx_hdrfail++;
4076                         dhdsdio_rxfail(bus, TRUE, TRUE);
4077                         continue;
4078                 }
4079
4080 #ifdef DHD_DEBUG
4081                 if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
4082                         prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
4083                 }
4084 #endif
4085
4086                 /* Extract hardware header fields */
4087                 len = ltoh16_ua(bus->rxhdr);
4088                 check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
4089
4090                 /* All zeros means no more frames */
4091                 if (!(len|check)) {
4092                         *finished = TRUE;
4093                         break;
4094                 }
4095
4096                 /* Validate check bytes */
4097                 if ((uint16)~(len^check)) {
4098                         DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
4099                                    __FUNCTION__, len, check));
4100                         bus->rx_badhdr++;
4101                         dhdsdio_rxfail(bus, FALSE, FALSE);
4102                         continue;
4103                 }
4104
4105                 /* Validate frame length */
4106                 if (len < SDPCM_HDRLEN) {
4107                         DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
4108                         continue;
4109                 }
4110
4111                 /* Extract software header fields */
4112                 chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4113                 seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4114                 doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4115                 txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4116
4117                 /* Validate data offset */
4118                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
4119                         DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
4120                                    __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
4121                         bus->rx_badhdr++;
4122                         ASSERT(0);
4123                         dhdsdio_rxfail(bus, FALSE, FALSE);
4124                         continue;
4125                 }
4126
4127                 /* Save the readahead length if there is one */
4128                 bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
4129                 if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
4130                         DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
4131                                   __FUNCTION__, bus->nextlen, seq));
4132                         bus->nextlen = 0;
4133                 }
4134
4135                 /* Handle Flow Control */
4136                 fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
4137
4138                 delta = 0;
4139                 if (~bus->flowcontrol & fcbits) {
4140                         bus->fc_xoff++;
4141                         delta = 1;
4142                 }
4143                 if (bus->flowcontrol & ~fcbits) {
4144                         bus->fc_xon++;
4145                         delta = 1;
4146                 }
4147
4148                 if (delta) {
4149                         bus->fc_rcvd++;
4150                         bus->flowcontrol = fcbits;
4151                 }
4152
4153                 /* Check and update sequence number */
4154                 if (rxseq != seq) {
4155                         DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
4156                         bus->rx_badseq++;
4157                         rxseq = seq;
4158                 }
4159
4160                 /* Check window for sanity */
4161                 if ((uint8)(txmax - bus->tx_seq) > 0x40) {
4162                         DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
4163                                    __FUNCTION__, txmax, bus->tx_seq));
4164                         txmax = bus->tx_max;
4165                 }
4166                 bus->tx_max = txmax;
4167
4168                 /* Call a separate function for control frames */
4169                 if (chan == SDPCM_CONTROL_CHANNEL) {
4170                         dhdsdio_read_control(bus, bus->rxhdr, len, doff);
4171                         continue;
4172                 }
4173
4174                 ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
4175                        (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
4176
4177                 /* Length to read */
4178                 rdlen = (len > firstread) ? (len - firstread) : 0;
4179
4180                 /* May pad read to blocksize for efficiency */
4181                 if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
4182                         pad = bus->blocksize - (rdlen % bus->blocksize);
4183                         if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
4184                             ((rdlen + pad + firstread) < MAX_RX_DATASZ))
4185                                 rdlen += pad;
4186                 } else if (rdlen % DHD_SDALIGN) {
4187                         rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
4188                 }
4189
4190                 /* Satisfy length-alignment requirements */
4191                 if (forcealign && (rdlen & (ALIGNMENT - 1)))
4192                         rdlen = ROUNDUP(rdlen, ALIGNMENT);
4193
4194                 if ((rdlen + firstread) > MAX_RX_DATASZ) {
4195                         /* Too long -- skip this frame */
4196                         DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
4197                         bus->dhd->rx_errors++; bus->rx_toolong++;
4198                         dhdsdio_rxfail(bus, FALSE, FALSE);
4199                         continue;
4200                 }
4201
4202                 dhd_os_sdlock_rxq(bus->dhd);
4203                 if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
4204                         /* Give up on data, request rtx of events */
4205                         DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
4206                                    __FUNCTION__, rdlen, chan));
4207                         bus->dhd->rx_dropped++;
4208                         dhd_os_sdunlock_rxq(bus->dhd);
4209                         dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
4210                         continue;
4211                 }
4212                 dhd_os_sdunlock_rxq(bus->dhd);
4213
4214                 ASSERT(!PKTLINK(pkt));
4215
4216                 /* Leave room for what we already read, and align remainder */
4217                 ASSERT(firstread < (PKTLEN(osh, pkt)));
4218                 PKTPULL(osh, pkt, firstread);
4219                 PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
4220
4221                 /* Read the remaining frame data */
4222                 sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
4223                                             ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
4224                 bus->f2rxdata++;
4225                 ASSERT(sdret != BCME_PENDING);
4226
4227                 if (sdret < 0) {
4228                         DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
4229                                    ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
4230                                     ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
4231                         dhd_os_sdlock_rxq(bus->dhd);
4232                         PKTFREE(bus->dhd->osh, pkt, FALSE);
4233                         dhd_os_sdunlock_rxq(bus->dhd);
4234                         bus->dhd->rx_errors++;
4235                         dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
4236                         continue;
4237                 }
4238
4239                 /* Copy the already-read portion */
4240                 PKTPUSH(osh, pkt, firstread);
4241                 bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
4242
4243 #ifdef DHD_DEBUG
4244                 if (DHD_BYTES_ON() && DHD_DATA_ON()) {
4245                         prhex("Rx Data", PKTDATA(osh, pkt), len);
4246                 }
4247 #endif
4248
4249 deliver:
4250                 /* Save superframe descriptor and allocate packet frame */
4251                 if (chan == SDPCM_GLOM_CHANNEL) {
4252                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
4253                                 DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
4254                                           __FUNCTION__, len));
4255 #ifdef DHD_DEBUG
4256                                 if (DHD_GLOM_ON()) {
4257                                         prhex("Glom Data", PKTDATA(osh, pkt), len);
4258                                 }
4259 #endif
4260                                 PKTSETLEN(osh, pkt, len);
4261                                 ASSERT(doff == SDPCM_HDRLEN);
4262                                 PKTPULL(osh, pkt, SDPCM_HDRLEN);
4263                                 bus->glomd = pkt;
4264                         } else {
4265                                 DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
4266                                 dhdsdio_rxfail(bus, FALSE, FALSE);
4267                         }
4268                         continue;
4269                 }
4270
4271                 /* Fill in packet len and prio, deliver upward */
4272                 PKTSETLEN(osh, pkt, len);
4273                 PKTPULL(osh, pkt, doff);
4274
4275 #ifdef SDTEST
4276                 /* Test channel packets are processed separately */
4277                 if (chan == SDPCM_TEST_CHANNEL) {
4278                         dhdsdio_testrcv(bus, pkt, seq);
4279                         continue;
4280                 }
4281 #endif /* SDTEST */
4282
4283                 if (PKTLEN(osh, pkt) == 0) {
4284                         dhd_os_sdlock_rxq(bus->dhd);
4285                         PKTFREE(bus->dhd->osh, pkt, FALSE);
4286                         dhd_os_sdunlock_rxq(bus->dhd);
4287                         continue;
4288                 } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt) != 0) {
4289                         DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
4290                         dhd_os_sdlock_rxq(bus->dhd);
4291                         PKTFREE(bus->dhd->osh, pkt, FALSE);
4292                         dhd_os_sdunlock_rxq(bus->dhd);
4293                         bus->dhd->rx_errors++;
4294                         continue;
4295                 }
4296
4297
4298                 /* Unlock during rx call */
4299                 dhd_os_sdunlock(bus->dhd);
4300                 dhd_rx_frame(bus->dhd, ifidx, pkt, 1, chan);
4301                 dhd_os_sdlock(bus->dhd);
4302         }
4303         rxcount = maxframes - rxleft;
4304 #ifdef DHD_DEBUG
4305         /* Message if we hit the limit */
4306         if (!rxleft && !sdtest)
4307                 DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
4308         else
4309 #endif /* DHD_DEBUG */
4310         DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
4311         /* Back off rxseq if awaiting rtx, update rx_seq */
4312         if (bus->rxskip)
4313                 rxseq--;
4314         bus->rx_seq = rxseq;
4315
4316         return rxcount;
4317 }
4318
4319 static uint32
4320 dhdsdio_hostmail(dhd_bus_t *bus)
4321 {
4322         sdpcmd_regs_t *regs = bus->regs;
4323         uint32 intstatus = 0;
4324         uint32 hmb_data;
4325         uint8 fcbits;
4326         uint retries = 0;
4327
4328         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4329
4330         /* Read mailbox data and ack that we did so */
4331         R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
4332         if (retries <= retry_limit)
4333                 W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
4334         bus->f1regdata += 2;
4335
4336         /* Dongle recomposed rx frames, accept them again */
4337         if (hmb_data & HMB_DATA_NAKHANDLED) {
4338                 DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
4339                 if (!bus->rxskip) {
4340                         DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
4341                 }
4342                 bus->rxskip = FALSE;
4343                 intstatus |= FRAME_AVAIL_MASK(bus);
4344         }
4345
4346         /*
4347          * DEVREADY does not occur with gSPI.
4348          */
4349         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
4350                 bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
4351                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
4352                         DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
4353                                    bus->sdpcm_ver, SDPCM_PROT_VERSION));
4354                 else
4355                         DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
4356                 /* make sure for the SDIO_DEVICE_RXDATAINT_MODE_1 corecontrol is proper */
4357                 if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
4358                     (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1)) {
4359                         uint32 val;
4360
4361                         val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
4362                         val &= ~CC_XMTDATAAVAIL_MODE;
4363                         val |= CC_XMTDATAAVAIL_CTRL;
4364                         W_REG(bus->dhd->osh, &bus->regs->corecontrol, val);
4365
4366                         val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
4367                 }
4368
4369 #ifdef DHD_DEBUG
4370                 /* Retrieve console state address now that firmware should have updated it */
4371                 {
4372                         sdpcm_shared_t shared;
4373                         if (dhdsdio_readshared(bus, &shared) == 0)
4374                                 bus->console_addr = shared.console_addr;
4375                 }
4376 #endif /* DHD_DEBUG */
4377         }
4378
4379         /*
4380          * Flow Control has been moved into the RX headers and this out of band
4381          * method isn't used any more.  Leave this here for possibly remaining backward
4382          * compatible with older dongles
4383          */
4384         if (hmb_data & HMB_DATA_FC) {
4385                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
4386
4387                 if (fcbits & ~bus->flowcontrol)
4388                         bus->fc_xoff++;
4389                 if (bus->flowcontrol & ~fcbits)
4390                         bus->fc_xon++;
4391
4392                 bus->fc_rcvd++;
4393                 bus->flowcontrol = fcbits;
4394         }
4395
4396 #ifdef DHD_DEBUG
4397         /* At least print a message if FW halted */
4398         if (hmb_data & HMB_DATA_FWHALT) {
4399                 DHD_ERROR(("INTERNAL ERROR: FIRMWARE HALTED\n"));
4400                 dhdsdio_checkdied(bus, NULL, 0);
4401         }
4402 #endif /* DHD_DEBUG */
4403
4404         /* Shouldn't be any others */
4405         if (hmb_data & ~(HMB_DATA_DEVREADY |
4406                          HMB_DATA_FWHALT |
4407                          HMB_DATA_NAKHANDLED |
4408                          HMB_DATA_FC |
4409                          HMB_DATA_FWREADY |
4410                          HMB_DATA_FCDATA_MASK |
4411                          HMB_DATA_VERSION_MASK)) {
4412                 DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
4413         }
4414
4415         return intstatus;
4416 }
4417
4418 static bool
4419 dhdsdio_dpc(dhd_bus_t *bus)
4420 {
4421         bcmsdh_info_t *sdh = bus->sdh;
4422         sdpcmd_regs_t *regs = bus->regs;
4423         uint32 intstatus, newstatus = 0;
4424         uint retries = 0;
4425         uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
4426         uint txlimit = dhd_txbound; /* Tx frames to send before resched */
4427         uint framecnt = 0;                /* Temporary counter of tx/rx frames */
4428         bool rxdone = TRUE;               /* Flag for no more read data */
4429         bool resched = FALSE;     /* Flag indicating resched wanted */
4430
4431         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4432
4433         if (bus->dhd->busstate == DHD_BUS_DOWN) {
4434                 DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
4435                 bus->intstatus = 0;
4436                 return 0;
4437         }
4438
4439         /* Start with leftover status bits */
4440         intstatus = bus->intstatus;
4441
4442         dhd_os_sdlock(bus->dhd);
4443
4444         /* If waiting for HTAVAIL, check status */
4445         if (bus->clkstate == CLK_PENDING) {
4446                 int err;
4447                 uint8 clkctl, devctl = 0;
4448
4449 #ifdef DHD_DEBUG
4450                 /* Check for inconsistent device control */
4451                 devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
4452                 if (err) {
4453                         DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
4454                         bus->dhd->busstate = DHD_BUS_DOWN;
4455                 } else {
4456                         ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
4457                 }
4458 #endif /* DHD_DEBUG */
4459
4460                 /* Read CSR, if clock on switch to AVAIL, else ignore */
4461                 clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
4462                 if (err) {
4463                         DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
4464                         bus->dhd->busstate = DHD_BUS_DOWN;
4465                 }
4466
4467                 DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
4468
4469                 if (SBSDIO_HTAV(clkctl)) {
4470                         devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
4471                         if (err) {
4472                                 DHD_ERROR(("%s: error reading DEVCTL: %d\n",
4473                                            __FUNCTION__, err));
4474                                 bus->dhd->busstate = DHD_BUS_DOWN;
4475                         }
4476                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
4477                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
4478                         if (err) {
4479                                 DHD_ERROR(("%s: error writing DEVCTL: %d\n",
4480                                            __FUNCTION__, err));
4481                                 bus->dhd->busstate = DHD_BUS_DOWN;
4482                         }
4483                         bus->clkstate = CLK_AVAIL;
4484                 } else {
4485                         goto clkwait;
4486                 }
4487         }
4488
4489         BUS_WAKE(bus);
4490
4491         /* Make sure backplane clock is on */
4492         dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
4493         if (bus->clkstate != CLK_AVAIL)
4494                 goto clkwait;
4495
4496         /* Pending interrupt indicates new device status */
4497         if (bus->ipend) {
4498                 bus->ipend = FALSE;
4499                 R_SDREG(newstatus, &regs->intstatus, retries);
4500                 bus->f1regdata++;
4501                 if (bcmsdh_regfail(bus->sdh))
4502                         newstatus = 0;
4503                 newstatus &= bus->hostintmask;
4504                 bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
4505                 if (newstatus) {
4506                         bus->f1regdata++;
4507                         if ((bus->rxint_mode == SDIO_DEVICE_RXDATAINT_MODE_0) &&
4508                                 (newstatus == I_XMTDATA_AVAIL)) {
4509                         }
4510                         else
4511                                 W_SDREG(newstatus, &regs->intstatus, retries);
4512                 }
4513         }
4514
4515         /* Merge new bits with previous */
4516         intstatus |= newstatus;
4517         bus->intstatus = 0;
4518
4519         /* Handle flow-control change: read new state in case our ack
4520          * crossed another change interrupt.  If change still set, assume
4521          * FC ON for safety, let next loop through do the debounce.
4522          */
4523         if (intstatus & I_HMB_FC_CHANGE) {
4524                 intstatus &= ~I_HMB_FC_CHANGE;
4525                 W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
4526                 R_SDREG(newstatus, &regs->intstatus, retries);
4527                 bus->f1regdata += 2;
4528                 bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
4529                 intstatus |= (newstatus & bus->hostintmask);
4530         }
4531
4532         /* Just being here means nothing more to do for chipactive */
4533         if (intstatus & I_CHIPACTIVE) {
4534                 /* ASSERT(bus->clkstate == CLK_AVAIL); */
4535                 intstatus &= ~I_CHIPACTIVE;
4536         }
4537
4538         /* Handle host mailbox indication */
4539         if (intstatus & I_HMB_HOST_INT) {
4540                 intstatus &= ~I_HMB_HOST_INT;
4541                 intstatus |= dhdsdio_hostmail(bus);
4542         }
4543
4544         /* Generally don't ask for these, can get CRC errors... */
4545         if (intstatus & I_WR_OOSYNC) {
4546                 DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
4547                 intstatus &= ~I_WR_OOSYNC;
4548         }
4549
4550         if (intstatus & I_RD_OOSYNC) {
4551                 DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
4552                 intstatus &= ~I_RD_OOSYNC;
4553         }
4554
4555         if (intstatus & I_SBINT) {
4556                 DHD_ERROR(("Dongle reports SBINT\n"));
4557                 intstatus &= ~I_SBINT;
4558         }
4559
4560         /* Would be active due to wake-wlan in gSPI */
4561         if (intstatus & I_CHIPACTIVE) {
4562                 DHD_INFO(("Dongle reports CHIPACTIVE\n"));
4563                 intstatus &= ~I_CHIPACTIVE;
4564         }
4565
4566         /* Ignore frame indications if rxskip is set */
4567         if (bus->rxskip) {
4568                 intstatus &= ~FRAME_AVAIL_MASK(bus);
4569         }
4570
4571         /* On frame indication, read available frames */
4572         if (PKT_AVAILABLE(bus, intstatus)) {
4573                 framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
4574                 if (rxdone || bus->rxskip)
4575                         intstatus  &= ~FRAME_AVAIL_MASK(bus);
4576                 rxlimit -= MIN(framecnt, rxlimit);
4577         }
4578
4579         /* Keep still-pending events for next scheduling */
4580         bus->intstatus = intstatus;
4581
4582 clkwait:
4583         /* Re-enable interrupts to detect new device events (mailbox, rx frame)
4584          * or clock availability.  (Allows tx loop to check ipend if desired.)
4585          * (Unless register access seems hosed, as we may not be able to ACK...)
4586          */
4587         if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh)) {
4588                 DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
4589                           __FUNCTION__, rxdone, framecnt));
4590                 bus->intdis = FALSE;
4591 #if defined(OOB_INTR_ONLY)
4592         bcmsdh_oob_intr_set(1);
4593 #endif /* (OOB_INTR_ONLY) */
4594                 bcmsdh_intr_enable(sdh);
4595         }
4596
4597         if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL))  {
4598                 int ret, i;
4599
4600                 ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
4601                                       (uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
4602                         NULL, NULL, NULL);
4603                 ASSERT(ret != BCME_PENDING);
4604
4605                 if (ret < 0) {
4606                         /* On failure, abort the command and terminate the frame */
4607                         DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
4608                                   __FUNCTION__, ret));
4609                         bus->tx_sderrs++;
4610
4611                         bcmsdh_abort(sdh, SDIO_FUNC_2);
4612
4613                         bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
4614                                          SFC_WF_TERM, NULL);
4615                         bus->f1regdata++;
4616
4617                         for (i = 0; i < 3; i++) {
4618                                 uint8 hi, lo;
4619                                 hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
4620                                                      SBSDIO_FUNC1_WFRAMEBCHI, NULL);
4621                                 lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
4622                                                      SBSDIO_FUNC1_WFRAMEBCLO, NULL);
4623                                 bus->f1regdata += 2;
4624                                 if ((hi == 0) && (lo == 0))
4625                                         break;
4626                         }
4627                 }
4628                 if (ret == 0) {
4629                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
4630                 }
4631
4632                 bus->ctrl_frame_stat = FALSE;
4633                 dhd_wait_event_wakeup(bus->dhd);
4634         }
4635         /* Send queued frames (limit 1 if rx may still be pending) */
4636         else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
4637             pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
4638                 framecnt = rxdone ? txlimit : MIN(txlimit, dhd_txminmax);
4639                 framecnt = dhdsdio_sendfromq(bus, framecnt);
4640                 txlimit -= framecnt;
4641         }
4642         /* Resched the DPC if ctrl cmd is pending on bus credit */
4643         if (bus->ctrl_frame_stat)
4644                 resched = TRUE;
4645
4646         /* Resched if events or tx frames are pending, else await next interrupt */
4647         /* On failed register access, all bets are off: no resched or interrupts */
4648         if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
4649                 DHD_ERROR(("%s: failed backplane access over SDIO, halting operation %d \n",
4650                            __FUNCTION__, bcmsdh_regfail(sdh)));
4651                 bus->dhd->busstate = DHD_BUS_DOWN;
4652                 bus->intstatus = 0;
4653         } else if (bus->clkstate == CLK_PENDING) {
4654                 /* Awaiting I_CHIPACTIVE; don't resched */
4655         } else if (bus->intstatus || bus->ipend ||
4656                    (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
4657                         PKT_AVAILABLE(bus, bus->intstatus)) {  /* Read multiple frames */
4658                 resched = TRUE;
4659         }
4660
4661         bus->dpc_sched = resched;
4662
4663         /* If we're done for now, turn off clock request. */
4664         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && (bus->clkstate != CLK_PENDING)) {
4665                 bus->activity = FALSE;
4666                 dhdsdio_clkctl(bus, CLK_NONE, FALSE);
4667         }
4668
4669         dhd_os_sdunlock(bus->dhd);
4670         return resched;
4671 }
4672
4673 bool
4674 dhd_bus_dpc(struct dhd_bus *bus)
4675 {
4676         bool resched;
4677
4678         /* Call the DPC directly. */
4679         DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
4680         resched = dhdsdio_dpc(bus);
4681
4682         return resched;
4683 }
4684
4685 void
4686 dhdsdio_isr(void *arg)
4687 {
4688         dhd_bus_t *bus = (dhd_bus_t*)arg;
4689         bcmsdh_info_t *sdh;
4690
4691         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4692
4693         if (!bus) {
4694                 DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
4695                 return;
4696         }
4697         sdh = bus->sdh;
4698
4699         if (bus->dhd->busstate == DHD_BUS_DOWN) {
4700                 DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
4701                 return;
4702         }
4703
4704         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
4705
4706         /* Count the interrupt call */
4707         bus->intrcount++;
4708         bus->ipend = TRUE;
4709
4710         /* Shouldn't get this interrupt if we're sleeping? */
4711         if (bus->sleeping) {
4712                 DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
4713                 return;
4714         }
4715
4716         /* Disable additional interrupts (is this needed now)? */
4717         if (bus->intr) {
4718                 DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
4719         } else {
4720                 DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
4721         }
4722
4723         bcmsdh_intr_disable(sdh);
4724         bus->intdis = TRUE;
4725
4726 #if defined(SDIO_ISR_THREAD)
4727         DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
4728         DHD_OS_WAKE_LOCK(bus->dhd);
4729         while (dhdsdio_dpc(bus));
4730         DHD_OS_WAKE_UNLOCK(bus->dhd);
4731 #else
4732         bus->dpc_sched = TRUE;
4733         dhd_sched_dpc(bus->dhd);
4734 #endif 
4735
4736 }
4737
4738 #ifdef SDTEST
4739 static void
4740 dhdsdio_pktgen_init(dhd_bus_t *bus)
4741 {
4742         /* Default to specified length, or full range */
4743         if (dhd_pktgen_len) {
4744                 bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
4745                 bus->pktgen_minlen = bus->pktgen_maxlen;
4746         } else {
4747                 bus->pktgen_maxlen = MAX_PKTGEN_LEN;
4748                 bus->pktgen_minlen = 0;
4749         }
4750         bus->pktgen_len = (uint16)bus->pktgen_minlen;
4751
4752         /* Default to per-watchdog burst with 10s print time */
4753         bus->pktgen_freq = 1;
4754         bus->pktgen_print = 10000 / dhd_watchdog_ms;
4755         bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
4756
4757         /* Default to echo mode */
4758         bus->pktgen_mode = DHD_PKTGEN_ECHO;
4759         bus->pktgen_stop = 1;
4760 }
4761
4762 static void
4763 dhdsdio_pktgen(dhd_bus_t *bus)
4764 {
4765         void *pkt;
4766         uint8 *data;
4767         uint pktcount;
4768         uint fillbyte;
4769         osl_t *osh = bus->dhd->osh;
4770         uint16 len;
4771
4772         /* Display current count if appropriate */
4773         if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
4774                 bus->pktgen_ptick = 0;
4775                 printf("%s: send attempts %d rcvd %d\n",
4776                        __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd);
4777         }
4778
4779         /* For recv mode, just make sure dongle has started sending */
4780         if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
4781                 if (bus->pktgen_rcv_state == PKTGEN_RCV_IDLE) {
4782                         bus->pktgen_rcv_state = PKTGEN_RCV_ONGOING;
4783                         dhdsdio_sdtest_set(bus, (uint8)bus->pktgen_total);
4784                 }
4785                 return;
4786         }
4787
4788         /* Otherwise, generate or request the specified number of packets */
4789         for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
4790                 /* Stop if total has been reached */
4791                 if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
4792                         bus->pktgen_count = 0;
4793                         break;
4794                 }
4795
4796                 /* Allocate an appropriate-sized packet */
4797                 len = bus->pktgen_len;
4798                 if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
4799                                    TRUE))) {;
4800                         DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
4801                         break;
4802                 }
4803                 PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
4804                 data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
4805
4806                 /* Write test header cmd and extra based on mode */
4807                 switch (bus->pktgen_mode) {
4808                 case DHD_PKTGEN_ECHO:
4809                         *data++ = SDPCM_TEST_ECHOREQ;
4810                         *data++ = (uint8)bus->pktgen_sent;
4811                         break;
4812
4813                 case DHD_PKTGEN_SEND:
4814                         *data++ = SDPCM_TEST_DISCARD;
4815                         *data++ = (uint8)bus->pktgen_sent;
4816                         break;
4817
4818                 case DHD_PKTGEN_RXBURST:
4819                         *data++ = SDPCM_TEST_BURST;
4820                         *data++ = (uint8)bus->pktgen_count;
4821                         break;
4822
4823                 default:
4824                         DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
4825                         PKTFREE(osh, pkt, TRUE);
4826                         bus->pktgen_count = 0;
4827                         return;
4828                 }
4829
4830                 /* Write test header length field */
4831                 *data++ = (len >> 0);
4832                 *data++ = (len >> 8);
4833
4834                 /* Then fill in the remainder -- N/A for burst, but who cares... */
4835                 for (fillbyte = 0; fillbyte < len; fillbyte++)
4836                         *data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
4837
4838 #ifdef DHD_DEBUG
4839                 if (DHD_BYTES_ON() && DHD_DATA_ON()) {
4840                         data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
4841                         prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
4842                 }
4843 #endif
4844
4845                 /* Send it */
4846                 if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE)) {
4847                         bus->pktgen_fail++;
4848                         if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
4849                                 bus->pktgen_count = 0;
4850                 }
4851                 bus->pktgen_sent++;
4852
4853                 /* Bump length if not fixed, wrap at max */
4854                 if (++bus->pktgen_len > bus->pktgen_maxlen)
4855                         bus->pktgen_len = (uint16)bus->pktgen_minlen;
4856
4857                 /* Special case for burst mode: just send one request! */
4858                 if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
4859                         break;
4860         }
4861 }
4862
4863 static void
4864 dhdsdio_sdtest_set(dhd_bus_t *bus, uint8 count)
4865 {
4866         void *pkt;
4867         uint8 *data;
4868         osl_t *osh = bus->dhd->osh;
4869
4870         /* Allocate the packet */
4871         if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN, TRUE))) {
4872                 DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
4873                 return;
4874         }
4875         PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
4876         data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
4877
4878         /* Fill in the test header */
4879         *data++ = SDPCM_TEST_SEND;
4880         *data++ = count;
4881         *data++ = (bus->pktgen_maxlen >> 0);
4882         *data++ = (bus->pktgen_maxlen >> 8);
4883
4884         /* Send it */
4885         if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE))
4886                 bus->pktgen_fail++;
4887 }
4888
4889
4890 static void
4891 dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
4892 {
4893         osl_t *osh = bus->dhd->osh;
4894         uint8 *data;
4895         uint pktlen;
4896
4897         uint8 cmd;
4898         uint8 extra;
4899         uint16 len;
4900         uint16 offset;
4901
4902         /* Check for min length */
4903         if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
4904                 DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
4905                 PKTFREE(osh, pkt, FALSE);
4906                 return;
4907         }
4908
4909         /* Extract header fields */
4910         data = PKTDATA(osh, pkt);
4911         cmd = *data++;
4912         extra = *data++;
4913         len = *data++; len += *data++ << 8;
4914         DHD_TRACE(("%s:cmd:%d, xtra:%d,len:%d\n", __FUNCTION__, cmd, extra, len));
4915         /* Check length for relevant commands */
4916         if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
4917                 if (pktlen != len + SDPCM_TEST_HDRLEN) {
4918                         DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
4919                                    " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
4920                         PKTFREE(osh, pkt, FALSE);
4921                         return;
4922                 }
4923         }
4924
4925         /* Process as per command */
4926         switch (cmd) {
4927         case SDPCM_TEST_ECHOREQ:
4928                 /* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
4929                 *(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
4930                 if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE) == 0) {
4931                         bus->pktgen_sent++;
4932                 } else {
4933                         bus->pktgen_fail++;
4934                         PKTFREE(osh, pkt, FALSE);
4935                 }
4936                 bus->pktgen_rcvd++;
4937                 break;
4938
4939         case SDPCM_TEST_ECHORSP:
4940                 if (bus->ext_loop) {
4941                         PKTFREE(osh, pkt, FALSE);
4942                         bus->pktgen_rcvd++;
4943                         break;
4944                 }
4945
4946                 for (offset = 0; offset < len; offset++, data++) {
4947                         if (*data != SDPCM_TEST_FILL(offset, extra)) {
4948                                 DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
4949                                            "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
4950                                            offset, len, SDPCM_TEST_FILL(offset, extra), *data));
4951                                 break;
4952                         }
4953                 }
4954                 PKTFREE(osh, pkt, FALSE);
4955                 bus->pktgen_rcvd++;
4956                 break;
4957
4958         case SDPCM_TEST_DISCARD:
4959                 {
4960                         int i = 0;
4961                         uint8 *prn = data;
4962                         uint8 testval = extra;
4963                         for (i = 0; i < len; i++) {
4964                                 if (*prn != testval) {
4965                                         DHD_ERROR(("DIErr@Pkt#:%d,Ix:%d, expected:0x%x, got:0x%x\n",
4966                                                 i, bus->pktgen_rcvd_rcvsession, testval, *prn));
4967                                         prn++; testval++;
4968                                 }
4969                         }
4970                 }
4971                 PKTFREE(osh, pkt, FALSE);
4972                 bus->pktgen_rcvd++;
4973                 break;
4974
4975         case SDPCM_TEST_BURST:
4976         case SDPCM_TEST_SEND:
4977         default:
4978                 DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
4979                           " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
4980                 PKTFREE(osh, pkt, FALSE);
4981                 break;
4982         }
4983
4984         /* For recv mode, stop at limit (and tell dongle to stop sending) */
4985         if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
4986                 if (bus->pktgen_rcv_state != PKTGEN_RCV_IDLE) {
4987                         bus->pktgen_rcvd_rcvsession++;
4988
4989                         if (bus->pktgen_total &&
4990                                 (bus->pktgen_rcvd_rcvsession >= bus->pktgen_total)) {
4991                         bus->pktgen_count = 0;
4992                     DHD_ERROR(("Pktgen:rcv test complete!\n"));
4993                     bus->pktgen_rcv_state = PKTGEN_RCV_IDLE;
4994                         dhdsdio_sdtest_set(bus, FALSE);
4995                                 bus->pktgen_rcvd_rcvsession = 0;
4996                         }
4997                 }
4998         }
4999 }
5000 #endif /* SDTEST */
5001
5002 extern void
5003 dhd_disable_intr(dhd_pub_t *dhdp)
5004 {
5005         dhd_bus_t *bus;
5006         bus = dhdp->bus;
5007         bcmsdh_intr_disable(bus->sdh);
5008 }
5009
5010 extern bool
5011 dhd_bus_watchdog(dhd_pub_t *dhdp)
5012 {
5013         dhd_bus_t *bus;
5014
5015         DHD_TIMER(("%s: Enter\n", __FUNCTION__));
5016
5017         bus = dhdp->bus;
5018
5019         if (bus->dhd->dongle_reset)
5020                 return FALSE;
5021
5022         /* Ignore the timer if simulating bus down */
5023         if (bus->sleeping)
5024                 return FALSE;
5025
5026         if (dhdp->busstate == DHD_BUS_DOWN)
5027                 return FALSE;
5028
5029         /* Poll period: check device if appropriate. */
5030         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
5031                 uint32 intstatus = 0;
5032
5033                 /* Reset poll tick */
5034                 bus->polltick = 0;
5035
5036                 /* Check device if no interrupts */
5037                 if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
5038
5039                         if (!bus->dpc_sched) {
5040                                 uint8 devpend;
5041                                 devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
5042                                                           SDIOD_CCCR_INTPEND, NULL);
5043                                 intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
5044                         }
5045
5046                         /* If there is something, make like the ISR and schedule the DPC */
5047                         if (intstatus) {
5048                                 bus->pollcnt++;
5049                                 bus->ipend = TRUE;
5050                                 if (bus->intr) {
5051                                         bcmsdh_intr_disable(bus->sdh);
5052                                 }
5053                                 bus->dpc_sched = TRUE;
5054                                 dhd_sched_dpc(bus->dhd);
5055
5056                         }
5057                 }
5058
5059                 /* Update interrupt tracking */
5060                 bus->lastintrs = bus->intrcount;
5061         }
5062
5063 #ifdef DHD_DEBUG
5064         /* Poll for console output periodically */
5065         if (dhdp->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
5066                 bus->console.count += dhd_watchdog_ms;
5067                 if (bus->console.count >= dhd_console_ms) {
5068                         bus->console.count -= dhd_console_ms;
5069                         /* Make sure backplane clock is on */
5070                         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
5071                         if (dhdsdio_readconsole(bus) < 0)
5072                                 dhd_console_ms = 0;     /* On error, stop trying */
5073                 }
5074         }
5075 #endif /* DHD_DEBUG */
5076
5077 #ifdef SDTEST
5078         /* Generate packets if configured */
5079         if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
5080                 /* Make sure backplane clock is on */
5081                 dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
5082                 bus->pktgen_tick = 0;
5083                 dhdsdio_pktgen(bus);
5084         }
5085 #endif
5086
5087         /* On idle timeout clear activity flag and/or turn off clock */
5088         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
5089                 if (++bus->idlecount >= bus->idletime) {
5090                         bus->idlecount = 0;
5091                         if (bus->activity) {
5092                                 bus->activity = FALSE;
5093                                 dhdsdio_clkctl(bus, CLK_NONE, FALSE);
5094                         }
5095                 }
5096         }
5097
5098         return bus->ipend;
5099 }
5100
5101 #ifdef DHD_DEBUG
5102 extern int
5103 dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
5104 {
5105         dhd_bus_t *bus = dhdp->bus;
5106         uint32 addr, val;
5107         int rv;
5108         void *pkt;
5109
5110         /* Address could be zero if CONSOLE := 0 in dongle Makefile */
5111         if (bus->console_addr == 0)
5112                 return BCME_UNSUPPORTED;
5113
5114         /* Exclusive bus access */
5115         dhd_os_sdlock(bus->dhd);
5116
5117         /* Don't allow input if dongle is in reset */
5118         if (bus->dhd->dongle_reset) {
5119                 dhd_os_sdunlock(bus->dhd);
5120                 return BCME_NOTREADY;
5121         }
5122
5123         /* Request clock to allow SDIO accesses */
5124         BUS_WAKE(bus);
5125         /* No pend allowed since txpkt is called later, ht clk has to be on */
5126         dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
5127
5128         /* Zero cbuf_index */
5129         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf_idx);
5130         val = htol32(0);
5131         if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
5132                 goto done;
5133
5134         /* Write message into cbuf */
5135         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf);
5136         if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
5137                 goto done;
5138
5139         /* Write length into vcons_in */
5140         addr = bus->console_addr + OFFSETOF(hndrte_cons_t, vcons_in);
5141         val = htol32(msglen);
5142         if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
5143                 goto done;
5144
5145         /* Bump dongle by sending an empty packet on the event channel.
5146          * sdpcm_sendup (RX) checks for virtual console input.
5147          */
5148         if ((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL)
5149                 dhdsdio_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, TRUE);
5150
5151 done:
5152         if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
5153                 bus->activity = FALSE;
5154                 dhdsdio_clkctl(bus, CLK_NONE, TRUE);
5155         }
5156
5157         dhd_os_sdunlock(bus->dhd);
5158
5159         return rv;
5160 }
5161 #endif /* DHD_DEBUG */
5162
5163 #ifdef DHD_DEBUG
5164 static void
5165 dhd_dump_cis(uint fn, uint8 *cis)
5166 {
5167         uint byte, tag, tdata;
5168         DHD_INFO(("Function %d CIS:\n", fn));
5169
5170         for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
5171                 if ((byte % 16) == 0)
5172                         DHD_INFO(("    "));
5173                 DHD_INFO(("%02x ", cis[byte]));
5174                 if ((byte % 16) == 15)
5175                         DHD_INFO(("\n"));
5176                 if (!tdata--) {
5177                         tag = cis[byte];
5178                         if (tag == 0xff)
5179                                 break;
5180                         else if (!tag)
5181                                 tdata = 0;
5182                         else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
5183                                 tdata = cis[byte + 1] + 1;
5184                         else
5185                                 DHD_INFO(("]"));
5186                 }
5187         }
5188         if ((byte % 16) != 15)
5189                 DHD_INFO(("\n"));
5190 }
5191 #endif /* DHD_DEBUG */
5192
5193 static bool
5194 dhdsdio_chipmatch(uint16 chipid)
5195 {
5196         if (chipid == BCM4325_CHIP_ID)
5197                 return TRUE;
5198         if (chipid == BCM4329_CHIP_ID)
5199                 return TRUE;
5200         if (chipid == BCM4315_CHIP_ID)
5201                 return TRUE;
5202         if (chipid == BCM4319_CHIP_ID)
5203                 return TRUE;
5204         if (chipid == BCM4330_CHIP_ID)
5205                 return TRUE;
5206         if (chipid == BCM43239_CHIP_ID)
5207                 return TRUE;
5208         if (chipid == BCM4336_CHIP_ID)
5209                 return TRUE;
5210         if (chipid == BCM43237_CHIP_ID)
5211                 return TRUE;
5212         if (chipid == BCM43362_CHIP_ID)
5213                 return TRUE;
5214
5215         return FALSE;
5216 }
5217
5218 static void *
5219 dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
5220         uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh, void *dev)
5221 {
5222         int ret;
5223         dhd_bus_t *bus;
5224         dhd_cmn_t *cmn;
5225 #ifdef GET_CUSTOM_MAC_ENABLE
5226         struct ether_addr ea_addr;
5227 #endif /* GET_CUSTOM_MAC_ENABLE */
5228 #ifdef PROP_TXSTATUS
5229         uint up = 0;
5230 #endif
5231
5232         /* Init global variables at run-time, not as part of the declaration.
5233          * This is required to support init/de-init of the driver. Initialization
5234          * of globals as part of the declaration results in non-deterministic
5235          * behavior since the value of the globals may be different on the
5236          * first time that the driver is initialized vs subsequent initializations.
5237          */
5238         dhd_txbound = DHD_TXBOUND;
5239         dhd_rxbound = DHD_RXBOUND;
5240         dhd_alignctl = TRUE;
5241         sd1idle = TRUE;
5242         dhd_readahead = TRUE;
5243         retrydata = FALSE;
5244         dhd_doflow = FALSE;
5245         dhd_dongle_memsize = 0;
5246         dhd_txminmax = DHD_TXMINMAX;
5247
5248         forcealign = TRUE;
5249
5250
5251         DHD_TRACE(("%s: Enter\n", __FUNCTION__));
5252         DHD_INFO(("%s: venid 0x%04x devid 0x%04x\n", __FUNCTION__, venid, devid));
5253
5254         /* We make assumptions about address window mappings */
5255         ASSERT((uintptr)regsva == SI_ENUM_BASE);
5256
5257         /* BCMSDH passes venid and devid based on CIS parsing -- but low-power start
5258          * means early parse could fail, so&n